@xynogen/pix-ssh 0.6.0 → 0.6.2

package/README.md

@@ -9,8 +9,8 @@ Pi tool — `ssh_run`: run a command through a remote host's configured SSH shel
 
 Registers the `ssh_run` tool — run a command through the configured SSH shell on a remote machine, behind the same permission dialog pix-sudo uses (shared overlay from `@xynogen/pix-pretty`).
 
-- **Initial + privileged calls** → Allow/Deny approval, 60-second auto-deny timeout.
-- **Non-privileged calls** → may auto-approve during the 15-minute per-host window, or in YOLO mode when no password is missing; each auto-approval emits a notification.
+- **Every call** → Allow / Allow for this session / Deny approval, 60-second auto-deny timeout. Plain Allow covers that one call only.
+- **Non-privileged calls** → auto-approve only after "Allow for this session" on that host (until `/new`), or in YOLO mode when no password is missing; each auto-approval emits a notification. Privileged calls always ask.
 
 Output is truncated to 50 KB / 2000 lines. Non-interactive (RPC/JSON) mode blocks the tool immediately.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-ssh",
-	"version": "0.6.0",
+	"version": "0.6.2",
 	"description": "Pi tool \u2014 ssh_run: run remote commands over SSH with password/key auth and remote sudo",
 	"type": "module",
 	"main": "src/index.ts",

package/src/index.ts

@@ -16,7 +16,8 @@
  *
  * Connection reuse: OpenSSH ControlMaster multiplexing keeps one authenticated
  * connection per host alive (ControlPersist window), so repeat calls skip
- * re-auth.
+ * re-auth. `fresh: true` stops that master first, and every result reports the
+ * auth method (key/password) and whether the connection was new or reused.
  *
  * Security notes:
  *   - Passwords never leave JS memory; never written to disk; never in argv.
@@ -25,6 +26,7 @@
  *   - Output truncated to 50 KB / 2000 lines.
  */
 
+import { existsSync } from "node:fs";
 import type { AgentToolUpdateCallback, ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import { resolveBaseBackground } from "@xynogen/pix-pretty/ansi";
@@ -51,6 +53,7 @@ import {
 	hideCollapsedToolCall,
 	moreLines,
 	normalizeLineEndings,
+	renderCollapsedToolRow,
 	renderToolError,
 	ruleFrame,
 	termW,
@@ -62,7 +65,7 @@ import { requireTool } from "@xynogen/pix-runtime/binaries";
 import { type CollapseState, tickCollapse } from "@xynogen/pix-runtime/collapse";
 import { Type } from "typebox";
 import {
-	APPROVAL_TTL_MS,
+	closeMaster,
 	commandEscalatesPrivilege,
 	controlPathFor,
 	detectSshFailure,
@@ -70,7 +73,6 @@ import {
 	type HostAlias,
 	type HostInfo,
 	type HostSpec,
-	hostApproved,
 	hostTarget,
 	MAX_OUTPUT_BYTES,
 	MAX_OUTPUT_LINES,
@@ -91,6 +93,9 @@ import {
 const PROMPT_TIMEOUT_MS = 60_000;
 const MAX_PASSWORD_ATTEMPTS = 3;
 const SPINNER_INTERVAL_MS = 120;
+/** Min gap between key re-checks on a host whose login password is cached.
+ * Each failed probe is one auth failure in the server log (fail2ban counts it). */
+const KEY_RECHECK_MS = 60_000;
 
 // In-memory per-host credential cache (session-scoped, never persisted).
 // Key = canonical "user@host:port". Cleared on process exit.
@@ -99,19 +104,60 @@ interface HostCreds {
 	sudoPassword?: string;
 }
 const credCache = new Map<string, HostCreds>();
-
-// Per-host allow-memory (on by default): once the user approves any command on
-// a host, later calls to that host skip the confirm overlay until the approval
-// expires — mirroring sudo's PAM ticket window (~15 min), not the whole session.
-// Password prompts are NOT skipped — a still-missing login or sudo password
-// always re-prompts. Each auto-approve emits a visible notify so the decision is
-// never silent. Map value = epoch ms when the approval lapses (see APPROVAL_TTL_MS).
-const approvedHosts = new Map<string, number>();
+// Per-host epoch ms before which the cached-password key re-check is skipped.
+const keyRecheckAt = new Map<string, number>();
 
 function cacheKey(spec: HostSpec): string {
 	return `${spec.user ?? ""}@${spec.host}:${spec.port ?? 22}`;
 }
 
+/** Pre-run connection prep: honor `fresh`, re-check the key, and report
+ * whether the run will reuse a live master. Checked before the auth probes,
+ * which open a master themselves. */
+async function prepareConnection(
+	spec: HostSpec,
+	controlPath: string,
+	key: string,
+	creds: HostCreds,
+	fresh: boolean | undefined,
+	sig?: AbortSignal,
+): Promise<{ creds: HostCreds; connection: "new" | "reused" }> {
+	if (fresh === true) await closeMaster(spec, controlPath, sig);
+	const next = await recheckKey(spec, controlPath, key, creds, fresh === true, sig);
+	return { creds: next, connection: existsSync(controlPath) ? "reused" : "new" };
+}
+
+function authVia(loginPassword: string | undefined, connection: "new" | "reused") {
+	return { auth: loginPassword ? "password" : "key", connection } as const;
+}
+
+/**
+ * A cached login password means the live master is likely password-authed, so a
+ * normal probe would ride it and never test the key. Re-check the key with
+ * multiplexing off (rate-limited by KEY_RECHECK_MS unless `force`); on success
+ * drop the password and its master so this call and later ones use the key.
+ */
+async function recheckKey(
+	spec: HostSpec,
+	controlPath: string,
+	key: string,
+	creds: HostCreds,
+	force: boolean,
+	sig?: AbortSignal,
+): Promise<HostCreds> {
+	if (!creds.loginPassword) return creds;
+	if (!force && (keyRecheckAt.get(key) ?? 0) > Date.now()) return creds;
+	if ((await probeKeyAuth(spec, "none", sig)) !== "ok") {
+		keyRecheckAt.set(key, Date.now() + KEY_RECHECK_MS);
+		return creds;
+	}
+	const next = creds.sudoPassword ? { sudoPassword: creds.sudoPassword } : {};
+	credCache.set(key, next);
+	keyRecheckAt.delete(key);
+	await closeMaster(spec, controlPath, sig);
+	return next;
+}
+
 /**
  * Overlay password validator for a prompt stage. The login stage tests the
  * password against the host (wrong one re-prompts up to MAX_PASSWORD_ATTEMPTS);
@@ -153,6 +199,10 @@ export interface SshResultDetails {
 	truncated?: boolean;
 	cancellationKind?: SshCancellationKind;
 	errorKind?: SshErrorKind;
+	/** How this call authenticated: SSH key/agent, or a login password. */
+	auth?: "key" | "password";
+	/** Whether this call opened a new connection or reused a live master. */
+	connection?: "new" | "reused";
 	_render?: string;
 }
 
@@ -168,6 +218,7 @@ type SshParams = {
 	destination?: string;
 	recursive?: boolean;
 	reason?: string;
+	fresh?: boolean;
 };
 
 interface SshOperation {
@@ -294,6 +345,8 @@ function terminalMeta(details: SshResultDetails): string {
 	const hasLines = typeof details.lineCount === "number" && details.lineCount > 0;
 	return dotJoin([
 		typeof details.exitCode === "number" && `exit ${details.exitCode}`,
+		details.auth && `${details.auth} auth`,
+		details.connection && `${details.connection} connection`,
 		hasLines && `${details.lineCount} ${details.lineCount === 1 ? "line" : "lines"}`,
 		details.truncated && "truncated",
 	]);
@@ -339,7 +392,7 @@ function formatHostInfo(host: string, info: HostInfo): string {
 		["IdentityFile", info.identityFile],
 	].filter((r): r is [string, string] => Boolean(r[1]));
 	if (rows.length === 0) return `No SSH config found for ${host}.`;
-	return [`Effective SSH config for ${host}:`, ...rows.map(([k, v]) => `  ${k} ${v}`)].join("\n");
+	return [`Effective SSH config for ${host}:`, ...rows.map(([k, v]) => `${k} ${v}`)].join("\n");
 }
 
 function formatAliasList(aliases: HostAlias[]): string {
@@ -359,15 +412,14 @@ function formatAliasList(aliases: HostAlias[]): string {
 			target = `${userPart}${a.hostname}${portPart}`;
 		}
 		const via = a.proxyJump && a.proxyJump !== "none" ? ` via ${a.proxyJump}` : "";
-		lines.push(`  ${a.alias}${target ? ` → ${target}` : ""}${via}`);
+		lines.push(`${a.alias}${target ? ` → ${target}` : ""}${via}`);
 	}
 	return [`SSH host aliases (${lines.length}):`, ...lines].join("\n");
 }
 
 /** Build the info-action result: per-host effective config when `host` is
  * given, otherwise the alias inventory from ~/.ssh/config. Read-only.
- * Details carry `_type: "sshInfo"` so renderResult falls to its generic
- * plain-text branch (no collapse, no exit-code framing). */
+ * Details carry `_type: "sshInfo"` + `host` for the collapsed row. */
 /**
  * The pix-runtime lookup message for the first missing binary this action
  * needs (ssh, plus scp for file transfers), or undefined when all resolve.
@@ -385,7 +437,7 @@ export function missingSshTools(action: "command" | "file"): string | undefined
 }
 
 async function infoResult(host: string | undefined, sig?: AbortSignal) {
-	const details = { _type: "sshInfo" as const };
+	const details = { _type: "sshInfo" as const, host: host?.trim() || "aliases" };
 	if (host?.trim()) {
 		let spec: HostSpec;
 		try {
@@ -418,7 +470,7 @@ export default function (pi: ExtensionAPI): void {
 	// "Allow for this session" hosts. Lives in the factory: Pi hands each new session a fresh `pi`,
 	// so this resets on /new. Privileged commands never use it (see `privileged` below).
 	const sessionHosts = new Set<string>();
-	const approved = (key: string) => sessionHosts.has(key) || hostApproved(approvedHosts, key);
+	const approved = (key: string) => sessionHosts.has(key);
 	pi.registerTool({
 		name: "ssh_run",
 		...({ exposure: "deferred" } as const),
@@ -485,6 +537,12 @@ export default function (pi: ExtensionAPI): void {
 					description: "[file] Optional, default false. Copy a directory recursively.",
 				}),
 			),
+			fresh: Type.Optional(
+				Type.Boolean({
+					description:
+						"[command|file] Optional, default false. Close the reused connection first so this call re-authenticates (e.g. to prove key login).",
+				}),
+			),
 			reason: Type.String({
 				description: "Short plain-English intent, shown to the user as the approval title.",
 			}),
@@ -568,7 +626,7 @@ export default function (pi: ExtensionAPI): void {
 			// ProxyJump, and other SSH config options still apply.
 			const controlPath = controlPathFor(effectiveSpec);
 			const key = cacheKey(effectiveSpec);
-			const creds = credCache.get(key) ?? {};
+			let creds = credCache.get(key) ?? {};
 
 			const mode = getUnattendedMode(pi.events);
 			const yolo = mode === "yolo";
@@ -597,6 +655,10 @@ export default function (pi: ExtensionAPI): void {
 
 			updatePresentation(onUpdate, command, host, sudo, reason, "awaiting-approval");
 
+			const prep = await prepareConnection(spec, controlPath, key, creds, params.fresh, sig);
+			creds = prep.creds;
+			const connection = prep.connection;
+
 			// Probe key/agent/existing-master auth (no password needed on success).
 			// Only prompt for a login password when the host is reachable but rejects
 			// key auth ("auth"). If it's unreachable (timeout/DNS/refused) a password
@@ -735,6 +797,18 @@ export default function (pi: ExtensionAPI): void {
 				});
 
 			const overlayResult = await runOverlay();
+			if (overlayResult.passwordAttemptsExhausted) {
+				const text = `SSH authentication failed after ${MAX_PASSWORD_ATTEMPTS} attempts — wrong password.`;
+				ctx.ui.notify(`🔐 ${text}`, "error");
+				return {
+					content: [{ type: "text", text }],
+					details: makeDetails(command, host, sudo, reason, {
+						outcome: "error",
+						errorKind: "auth-ssh",
+					}),
+					isError: true,
+				};
+			}
 			const missing =
 				overlayResult.action === "approved" &&
 				((needLogin && !collected.login) || (needSudo && !collected.sudo));
@@ -744,10 +818,8 @@ export default function (pi: ExtensionAPI): void {
 				return r;
 			}
 
-			// File transfers remain warning-level: normal mode asks every time,
-			// AFK denies above, and YOLO may approve when no password is missing.
-			if (action === "command") approvedHosts.set(key, Date.now() + APPROVAL_TTL_MS);
-			// "session" is only offered for non-privileged commands (sessionChoices).
+			// Plain "Allow" approves this call only. "session" (offered only for
+			// non-privileged commands) is the sole way to skip later prompts.
 			if (overlayResult.choice === "session") {
 				sessionHosts.add(key);
 				ctx.ui.notify(`ssh_run: ${host} allowed for this session (sudo still asks)`, "info");
@@ -755,6 +827,7 @@ export default function (pi: ExtensionAPI): void {
 
 			// Persist newly-entered passwords in the session cache.
 			const loginPassword = creds.loginPassword ?? collected.login;
+			const via = authVia(loginPassword, connection);
 			const sudoPassword = creds.sudoPassword ?? collected.sudo;
 			credCache.set(key, {
 				...(loginPassword ? { loginPassword } : {}),
@@ -859,6 +932,7 @@ export default function (pi: ExtensionAPI): void {
 					details: makeDetails(command, host, sudo, reason, {
 						outcome: "error",
 						exitCode: result.code,
+						...via,
 						lineCount: outputLineCount(result.stderr),
 						errorKind: "auth-sudo",
 						_render: normalizeLineEndings(result.stderr),
@@ -877,10 +951,16 @@ export default function (pi: ExtensionAPI): void {
 				.replace(/^\n+|\n+$/g, "");
 
 			return {
-				content: [{ type: "text", text: `Exit code: ${result.code}\n\n${truncatedText}${suffix}` }],
+				content: [
+					{
+						type: "text",
+						text: `Exit code: ${result.code} (auth: ${via.auth}, ${via.connection} connection)\n\n${truncatedText}${suffix}`,
+					},
+				],
 				details: makeDetails(command, host, sudo, reason, {
 					outcome: result.code === 0 ? "success" : "error",
 					exitCode: result.code,
+					...via,
 					lineCount: outputLineCount(rendered),
 					truncated,
 					...(result.code === 0 ? {} : { errorKind: "exit-code" as const }),
@@ -936,13 +1016,40 @@ export default function (pi: ExtensionAPI): void {
 			const completed = (isError: boolean) => frameToolResult(text, theme, isError);
 
 			if (details?._type !== "sshResult") {
-				if (renderCtx.isError) {
-					text.setText(renderToolError(getTextContent(result) || "Error", theme));
-				} else {
+				const info = (result.details as { _type?: string; host?: string } | undefined) ?? {};
+				if (
+					!isPartial &&
+					info._type === "sshInfo" &&
+					tickCollapse(
+						"ssh",
+						renderCtx.state as CollapseState,
+						renderCtx.invalidate,
+						renderCtx.expanded,
+					)
+				) {
+					const status = renderCtx.isError ? "error" : "success";
 					text.setText(
-						fillToolBackground(`${BODY_PAD}${theme.fg("muted", getTextContent(result) || "done")}`),
+						renderCollapsedToolRow(
+							theme,
+							"ssh info",
+							info.host ?? "",
+							renderCtx.isError ? "failed" : "",
+							status,
+						),
 					);
+					return text;
 				}
+				const body = getTextContent(result) || "done";
+				text.setText(
+					renderCtx.isError
+						? renderToolError(body, theme)
+						: fillToolBackground(
+								body
+									.split("\n")
+									.map((line) => `${BODY_PAD}${theme.fg("muted", line)}`)
+									.join("\n"),
+							),
+				);
 				return isPartial ? text : completed(renderCtx.isError);
 			}
 

package/src/lib.ts

@@ -29,23 +29,6 @@ import { expandHome, homeDir, tempDir } from "@xynogen/pix-runtime/paths";
 export const MAX_OUTPUT_BYTES = DEFAULT_MAX_BYTES;
 export const MAX_OUTPUT_LINES = DEFAULT_MAX_LINES;
 
-/** Per-host approval TTL (ms) — mirrors sudo's PAM ticket window (~15 min). */
-export const APPROVAL_TTL_MS = 15 * 60_000;
-
-/**
- * True when `key` has a live (non-expired) approval in `map`; deletes the entry
- * on expiry so the map self-prunes. `now` is injectable for tests.
- */
-export function hostApproved(map: Map<string, number>, key: string, now = Date.now()): boolean {
-	const expiry = map.get(key);
-	if (expiry === undefined) return false;
-	if (now >= expiry) {
-		map.delete(key);
-		return false;
-	}
-	return true;
-}
-
 /**
  * True when the command text itself escalates privilege (sudo/su/doas/pkexec),
  * so per-host allow-memory must NOT auto-approve it even when `sudo:true` was
@@ -431,6 +414,8 @@ export type ProbeResult = "ok" | "auth" | "unreachable";
  * clean connect (ok), auth rejected but host reachable (auth), and
  * connection/DNS failure (unreachable) — the last must NOT trigger a password
  * prompt, since a login password can't fix an unreachable host.
+ * Pass `controlPath = "none"` to bypass a live master: a password-authed master
+ * answers `ok` for any probe, which hides whether the key itself works.
  */
 export function probeKeyAuth(
 	spec: HostSpec,
@@ -454,6 +439,27 @@ export function probeKeyAuth(
 	});
 }
 
+/** argv that asks the live master on `controlPath` to stop accepting new
+ * sessions. `stop` (not `exit`) lets in-flight sessions finish. */
+export function closeMasterArgs(spec: HostSpec, controlPath: string): string[] {
+	return ["-o", `ControlPath=${controlPath}`, "-O", "stop", hostTarget(spec)];
+}
+
+/** Stop the multiplexed master so the next call opens (and authenticates) a
+ * fresh connection. No master = no-op; errors are ignored for the same reason. */
+export function closeMaster(
+	spec: HostSpec,
+	controlPath: string,
+	signal?: AbortSignal,
+): Promise<void> {
+	return new Promise((resolve) => {
+		const proc = spawnTool("ssh", closeMasterArgs(spec, controlPath), { stdio: "ignore" });
+		proc.on("error", () => resolve());
+		proc.on("close", () => resolve());
+		signal?.addEventListener("abort", () => proc.kill("SIGTERM"), { once: true });
+	});
+}
+
 /**
  * Validate an SSH *login* password by attempting one real password auth. Forces
  * password auth (no pubkey/agent) with a single prompt, fed via `sshpass -e`