@xynogen/pix-ssh 0.3.1 → 0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-ssh",
-	"version": "0.3.1",
+	"version": "0.3.4",
 	"description": "Pi tool — ssh_run: run remote commands over SSH with password/key auth and remote sudo",
 	"type": "module",
 	"main": "src/index.ts",
@@ -9,6 +9,7 @@
 	},
 	"files": [
 		"src",
+		"!src/**/*.test.*",
 		"README.md",
 		"LICENSE"
 	],
@@ -37,7 +38,7 @@
 	},
 	"dependencies": {
 		"typebox": "^1.1.38",
-		"@xynogen/pix-pretty": "^1.16.0",
+		"@xynogen/pix-pretty": "^1.19.0",
 		"@xynogen/pix-runtime": "^0.8.0"
 	},
 	"peerDependencies": {

package/src/index.ts

@@ -35,6 +35,7 @@ import type { RenderContextLike, ThemeLike, ToolResultLike } from "@xynogen/pix-
 import {
 	dotJoin,
 	fillToolBackground,
+	frameToolResult,
 	getTextContent,
 	hideCollapsedToolCall,
 	normalizeLineEndings,
@@ -43,6 +44,7 @@ import {
 	ruleFrame,
 	sectionRule,
 	termW,
+	unframeToolResult,
 } from "@xynogen/pix-pretty/utils";
 import { SPINNER } from "@xynogen/pix-pretty/widget-format";
 import { getUnattendedMode, withAgentBlock } from "@xynogen/pix-runtime";
@@ -310,14 +312,7 @@ export default function (pi: ExtensionAPI): void {
 			"`destination`, and optional `recursive`. Transfers may overwrite the destination. Always provide a clear `reason`.",
 		promptSnippet: "Run a remote command or transfer files over SSH",
 		promptGuidelines: [
-			"ssh_run sends commands or transfers files/directories over SSH. Basic cmd, PowerShell, or " +
-				"pwsh commands may work, but treat Windows shells as best-effort. Back away and tell the user " +
-				"when correctness depends on explicit shell selection, complex quoting, PowerShell error/stream/encoding " +
-				"semantics, interactive prompts, or Windows administrator/UAC elevation. `sudo` covers POSIX sudo " +
-				'only. Provide `host` as `[user@]host[:port]`. For file transfer, use `action: "file"`, ' +
-				'`direction: "upload" | "download"`, `source`, `destination`, and optional `recursive`. ' +
-				"Transfers may overwrite the destination and are warning-level: AFK/YOLO auto-approve when " +
-				"no login password is missing. Always explain the intent in `reason`.",
+			'ssh_run: `host` as `[user@]host[:port]`; `sudo` covers POSIX sudo only. For transfer use `action: "file"` with `direction: "upload"|"download"`, `source`, `destination`, optional `recursive` (may overwrite). Always set `reason`.',
 		],
 
 		renderShell: "self",
@@ -737,8 +732,10 @@ export default function (pi: ExtensionAPI): void {
 			renderCtx: RenderContextLike,
 		) => {
 			resolveBaseBackground(theme);
-			const text = renderCtx.lastComponent ?? new Text("", 0, 0);
+			const text = unframeToolResult(renderCtx.lastComponent ?? new Text("", 0, 0));
 			const details = result.details as SshResultDetails | undefined;
+			const isPartial = (_opt as { isPartial?: boolean } | undefined)?.isPartial === true;
+			const completed = (isError: boolean) => frameToolResult(text, theme, isError);
 
 			if (details?._type !== "sshResult") {
 				if (renderCtx.isError) {
@@ -748,10 +745,11 @@ export default function (pi: ExtensionAPI): void {
 						fillToolBackground(`  ${theme.fg("muted", getTextContent(result) || "done")}`),
 					);
 				}
-				return text;
+				return isPartial ? text : completed(renderCtx.isError);
 			}
 
 			if (
+				!isPartial &&
 				isTerminal(details) &&
 				tickCollapse(
 					"ssh",
@@ -760,12 +758,7 @@ export default function (pi: ExtensionAPI): void {
 					renderCtx.expanded,
 				)
 			) {
-				const status =
-					details.outcome === "success"
-						? "success"
-						: details.outcome === "error"
-							? "error"
-							: "warning";
+				const status = details.outcome === "success" ? "success" : "error";
 				text.setText(
 					renderCollapsedToolRow(
 						theme,
@@ -792,7 +785,7 @@ export default function (pi: ExtensionAPI): void {
 						? renderToolError(diagnostic, theme)
 						: fillToolBackground(`  ${theme.fg("warning", diagnostic)}`),
 				);
-				return text;
+				return isPartial ? text : completed(true);
 			}
 
 			const code = typeof details.exitCode === "number" ? details.exitCode : null;
@@ -803,22 +796,18 @@ export default function (pi: ExtensionAPI): void {
 
 			if (!rendered) {
 				text.setText(fillToolBackground(`  ${summary}`));
-				return text;
+				return isPartial ? text : completed(details.outcome !== "success");
 			}
 
 			const maxShow = renderCtx.expanded ? lineCount : MAX_PREVIEW_LINES;
 			const show = lines.slice(0, maxShow);
 			const footer =
 				lineCount > maxShow ? [`${FG_DIM}  … ${lineCount - maxShow} more lines${RST}`] : [];
-			const statusKey = code === null ? "dim" : code === 0 ? "success" : "error";
+			const statusKey = details.outcome === "success" ? "success" : "error";
 			const paint = (s: string) => theme.fg(statusKey, s);
 			const sw = Math.max(8, termW() - 4); // section-rule width inside the 2-space indent
-			const out = ruleFrame(
-				show.map((line) => `  ${sectionRule(line, theme, sw) ?? line}`),
-				footer,
-				termW(),
-				paint,
-			);
+			const body = show.map((line) => `  ${sectionRule(line, theme, sw) ?? line}`);
+			const out = isPartial ? [...body, ...footer] : ruleFrame(body, footer, termW(), paint);
 			text.setText(fillToolBackground(out.join("\n")));
 			return text;
 		}) as never,

package/src/lib.test.ts

@@ -1,253 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import {
-	baseScpArgs,
-	baseSshArgs,
-	commandEscalatesPrivilege,
-	controlPathFor,
-	detectSshFailure,
-	detectSudoFailure,
-	filterSudoPrompt,
-	hostApproved,
-	hostTarget,
-	isUnreachable,
-	parseHost,
-	parseSshConfig,
-	remoteCommand,
-	remoteTransferPath,
-	shellQuote,
-	transferApprovalDecision,
-	transferArgs,
-	truncate,
-} from "./lib.ts";
-
-describe("parseHost", () => {
-	it("parses bare host", () => {
-		expect(parseHost("example.com")).toEqual({ host: "example.com" });
-	});
-	it("parses user@host", () => {
-		expect(parseHost("deploy@10.0.0.5")).toEqual({ user: "deploy", host: "10.0.0.5" });
-	});
-	it("parses user@host:port", () => {
-		expect(parseHost("deploy@10.0.0.5:2222")).toEqual({
-			user: "deploy",
-			host: "10.0.0.5",
-			port: 2222,
-		});
-	});
-	it("parses bracketed IPv6 with port", () => {
-		expect(parseHost("root@[::1]:22")).toEqual({ user: "root", host: "::1", port: 22 });
-	});
-	it("leaves bare IPv6 (multiple colons) as host", () => {
-		expect(parseHost("fe80::1")).toEqual({ host: "fe80::1" });
-	});
-	it("rejects empty host", () => {
-		expect(() => parseHost("   ")).toThrow();
-		expect(() => parseHost("user@")).toThrow();
-	});
-	it("rejects invalid port", () => {
-		expect(() => parseHost("h:0")).toThrow();
-		expect(() => parseHost("h:70000")).toThrow();
-		expect(() => parseHost("h:abc")).toThrow();
-	});
-});
-
-describe("parseSshConfig", () => {
-	it("reads effective user, hostname, and port from ssh -G output", () => {
-		expect(parseSshConfig("host orin\nuser jetson\nhostname 10.10.21.251\nport 2222\n")).toEqual({
-			user: "jetson",
-			host: "10.10.21.251",
-			port: 2222,
-		});
-	});
-
-	it("rejects incomplete ssh -G output", () => {
-		expect(parseSshConfig("hostname 10.10.21.251\n")).toBeUndefined();
-	});
-});
-
-describe("hostTarget", () => {
-	it("joins user and host", () => {
-		expect(hostTarget({ user: "a", host: "b" })).toBe("a@b");
-		expect(hostTarget({ host: "b" })).toBe("b");
-	});
-});
-
-describe("controlPathFor", () => {
-	it("is stable per host+user+port and differs across hosts", () => {
-		const a = controlPathFor({ user: "u", host: "h", port: 22 });
-		expect(a).toBe(controlPathFor({ user: "u", host: "h", port: 22 }));
-		expect(a).not.toBe(controlPathFor({ user: "u", host: "h", port: 23 }));
-		expect(a).not.toBe(controlPathFor({ user: "x", host: "h", port: 22 }));
-		expect(a).toContain("pix-ssh-");
-		expect(a.endsWith(".sock")).toBe(true);
-	});
-});
-
-describe("baseSshArgs", () => {
-	it("enables multiplexing and includes the control path", () => {
-		const args = baseSshArgs({ host: "h" }, "/tmp/x.sock");
-		expect(args).toContain("ControlMaster=auto");
-		expect(args).toContain("ControlPath=/tmp/x.sock");
-		expect(args.some((a) => a.startsWith("ControlPersist="))).toBe(true);
-	});
-	it("adds -p only when a port is set", () => {
-		expect(baseSshArgs({ host: "h" }, "s")).not.toContain("-p");
-		const withPort = baseSshArgs({ host: "h", port: 2222 }, "s");
-		expect(withPort).toContain("-p");
-		expect(withPort).toContain("2222");
-	});
-});
-
-describe("transfer unattended approval", () => {
-	it("treats transfer as warning-level in AFK and YOLO", () => {
-		expect(transferApprovalDecision("off", false)).toBe("ask");
-		expect(transferApprovalDecision("afk", false)).toBe("allow");
-		expect(transferApprovalDecision("yolo", false)).toBe("allow");
-	});
-
-	it("denies unattended transfer when a login password is missing", () => {
-		expect(transferApprovalDecision("afk", true)).toBe("deny");
-		expect(transferApprovalDecision("yolo", true)).toBe("deny");
-	});
-});
-
-describe("SCP transfer arguments", () => {
-	it("builds upload and download endpoints", () => {
-		const spec = { user: "deploy", host: "example.com", port: 2222 };
-		expect(remoteTransferPath(spec, "/srv/app file")).toBe("deploy@example.com:/srv/app file");
-		expect(transferArgs(spec, "upload", "./build", "/srv/app")).toEqual([
-			"./build",
-			"deploy@example.com:/srv/app",
-		]);
-		expect(transferArgs(spec, "download", "/var/log/app.log", "./app.log")).toEqual([
-			"deploy@example.com:/var/log/app.log",
-			"./app.log",
-		]);
-		expect(baseScpArgs(spec, "/tmp/control.sock", true)).toEqual([
-			"-o",
-			"ControlMaster=auto",
-			"-o",
-			"ControlPath=/tmp/control.sock",
-			"-o",
-			"ControlPersist=120",
-			"-o",
-			"ConnectTimeout=10",
-			"-o",
-			"StrictHostKeyChecking=accept-new",
-			"-P",
-			"2222",
-			"-r",
-		]);
-	});
-
-	it("brackets IPv6 hosts for SCP remote-path syntax", () => {
-		expect(remoteTransferPath({ user: "root", host: "::1" }, "/tmp/x")).toBe("root@[::1]:/tmp/x");
-	});
-});
-
-describe("remoteCommand + shellQuote", () => {
-	it("returns the command unchanged without sudo", () => {
-		expect(remoteCommand("whoami", false)).toBe("whoami");
-	});
-	it("wraps in sudo -S with a quoted inner command", () => {
-		const out = remoteCommand("apt update", true);
-		expect(out).toStartWith("sudo -S -p '' -- sh -c ");
-		expect(out).toContain("'apt update'");
-	});
-	it("escapes embedded single quotes safely", () => {
-		expect(shellQuote("it's")).toBe(`'it'\\''s'`);
-		// The wrapped form has no unescaped quote that would break out of the string.
-		const wrapped = remoteCommand("echo 'hi'", true);
-		expect(wrapped).toContain(`'echo '\\''hi'\\'''`);
-	});
-});
-
-describe("detectSshFailure", () => {
-	it("is false on exit 0", () => {
-		expect(detectSshFailure(0, "permission denied")).toBe(false);
-	});
-	it("flags common ssh errors", () => {
-		expect(detectSshFailure(255, "Permission denied (publickey,password).")).toBe(true);
-		expect(detectSshFailure(255, "ssh: connect to host x: Connection refused")).toBe(true);
-		expect(detectSshFailure(255, "Could not resolve hostname x")).toBe(true);
-	});
-	it("does not flag a normal nonzero command exit", () => {
-		expect(detectSshFailure(1, "ls: no such file")).toBe(false);
-	});
-});
-
-describe("isUnreachable", () => {
-	it("flags connection/DNS failures (not auth)", () => {
-		expect(isUnreachable("ssh: connect to host x port 22: Connection timed out")).toBe(true);
-		expect(isUnreachable("ssh: connect to host x port 22: Connection refused")).toBe(true);
-		expect(isUnreachable("ssh: Could not resolve hostname x")).toBe(true);
-		expect(isUnreachable("ssh: connect to host x: No route to host")).toBe(true);
-	});
-	it("does NOT flag a password rejection (that's an auth failure)", () => {
-		expect(isUnreachable("Permission denied, please try again.")).toBe(false);
-		expect(isUnreachable("Permission denied (publickey,password).")).toBe(false);
-	});
-});
-
-describe("detectSudoFailure", () => {
-	it("flags wrong sudo password", () => {
-		expect(detectSudoFailure("Sorry, try again.")).toBe(true);
-		expect(detectSudoFailure("sudo: 1 incorrect password attempt")).toBe(true);
-		expect(detectSudoFailure("sudo: a password is required")).toBe(true);
-	});
-	it("ignores unrelated stderr", () => {
-		expect(detectSudoFailure("warning: something")).toBe(false);
-	});
-});
-
-describe("filterSudoPrompt", () => {
-	it("strips bare password prompt lines", () => {
-		expect(filterSudoPrompt("[sudo] password for u:\nreal output")).toBe("real output");
-		expect(filterSudoPrompt("Password:\nx")).toBe("x");
-	});
-	it("keeps normal lines", () => {
-		expect(filterSudoPrompt("line one\nline two")).toBe("line one\nline two");
-	});
-});
-
-describe("hostApproved", () => {
-	it("is false for an unknown host", () => {
-		expect(hostApproved(new Map(), "u@h:22")).toBe(false);
-	});
-	it("is true within the TTL window", () => {
-		const m = new Map([["u@h:22", 1000]]);
-		expect(hostApproved(m, "u@h:22", 500)).toBe(true);
-	});
-	it("expires and self-prunes at/after the deadline", () => {
-		const m = new Map([["u@h:22", 1000]]);
-		expect(hostApproved(m, "u@h:22", 1000)).toBe(false);
-		expect(m.has("u@h:22")).toBe(false);
-	});
-});
-
-describe("commandEscalatesPrivilege", () => {
-	it("flags leading and mid-chain escalation tokens", () => {
-		expect(commandEscalatesPrivilege("sudo apt update")).toBe(true);
-		expect(commandEscalatesPrivilege("apt update && sudo apt install x")).toBe(true);
-		expect(commandEscalatesPrivilege("foo; su -c 'x'")).toBe(true);
-		expect(commandEscalatesPrivilege("doas reboot")).toBe(true);
-		expect(commandEscalatesPrivilege("pkexec whoami")).toBe(true);
-	});
-	it("does not flag plain commands or substrings", () => {
-		expect(commandEscalatesPrivilege("ls -la")).toBe(false);
-		expect(commandEscalatesPrivilege("pseudo-tty")).toBe(false);
-		expect(commandEscalatesPrivilege("cat sudoku.txt")).toBe(false);
-	});
-});
-
-describe("truncate", () => {
-	it("passes short text through", () => {
-		expect(truncate("a\nb").truncated).toBe(false);
-	});
-	it("caps by line count", () => {
-		const many = Array.from({ length: 3000 }, (_, i) => `l${i}`).join("\n");
-		const out = truncate(many, 2000);
-		expect(out.truncated).toBe(true);
-		expect(out.text.split("\n").length).toBe(2000);
-	});
-});