@xynogen/pix-ssh 0.6.1 → 0.6.3

package/README.md

@@ -9,8 +9,8 @@ Pi tool — `ssh_run`: run a command through a remote host's configured SSH shel
 
 Registers the `ssh_run` tool — run a command through the configured SSH shell on a remote machine, behind the same permission dialog pix-sudo uses (shared overlay from `@xynogen/pix-pretty`).
 
-- **Initial + privileged calls** → Allow/Deny approval, 60-second auto-deny timeout.
-- **Non-privileged calls** → may auto-approve during the 15-minute per-host window, or in YOLO mode when no password is missing; each auto-approval emits a notification.
+- **Every call** → Allow / Allow for this session / Deny approval, 60-second auto-deny timeout. Plain Allow covers that one call only.
+- **Non-privileged calls** → auto-approve only after "Allow for this session" on that host (until `/new`), or in YOLO mode when no password is missing; each auto-approval emits a notification. Privileged calls always ask.
 
 Output is truncated to 50 KB / 2000 lines. Non-interactive (RPC/JSON) mode blocks the tool immediately.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-ssh",
-	"version": "0.6.1",
+	"version": "0.6.3",
 	"description": "Pi tool \u2014 ssh_run: run remote commands over SSH with password/key auth and remote sudo",
 	"type": "module",
 	"main": "src/index.ts",

package/src/index.ts

@@ -53,6 +53,7 @@ import {
 	hideCollapsedToolCall,
 	moreLines,
 	normalizeLineEndings,
+	renderCollapsedToolRow,
 	renderToolError,
 	ruleFrame,
 	termW,
@@ -64,7 +65,6 @@ import { requireTool } from "@xynogen/pix-runtime/binaries";
 import { type CollapseState, tickCollapse } from "@xynogen/pix-runtime/collapse";
 import { Type } from "typebox";
 import {
-	APPROVAL_TTL_MS,
 	closeMaster,
 	commandEscalatesPrivilege,
 	controlPathFor,
@@ -73,7 +73,6 @@ import {
 	type HostAlias,
 	type HostInfo,
 	type HostSpec,
-	hostApproved,
 	hostTarget,
 	MAX_OUTPUT_BYTES,
 	MAX_OUTPUT_LINES,
@@ -108,14 +107,6 @@ const credCache = new Map<string, HostCreds>();
 // Per-host epoch ms before which the cached-password key re-check is skipped.
 const keyRecheckAt = new Map<string, number>();
 
-// Per-host allow-memory (on by default): once the user approves any command on
-// a host, later calls to that host skip the confirm overlay until the approval
-// expires — mirroring sudo's PAM ticket window (~15 min), not the whole session.
-// Password prompts are NOT skipped — a still-missing login or sudo password
-// always re-prompts. Each auto-approve emits a visible notify so the decision is
-// never silent. Map value = epoch ms when the approval lapses (see APPROVAL_TTL_MS).
-const approvedHosts = new Map<string, number>();
-
 function cacheKey(spec: HostSpec): string {
 	return `${spec.user ?? ""}@${spec.host}:${spec.port ?? 22}`;
 }
@@ -401,7 +392,7 @@ function formatHostInfo(host: string, info: HostInfo): string {
 		["IdentityFile", info.identityFile],
 	].filter((r): r is [string, string] => Boolean(r[1]));
 	if (rows.length === 0) return `No SSH config found for ${host}.`;
-	return [`Effective SSH config for ${host}:`, ...rows.map(([k, v]) => `  ${k} ${v}`)].join("\n");
+	return [`Effective SSH config for ${host}:`, ...rows.map(([k, v]) => `${k} ${v}`)].join("\n");
 }
 
 function formatAliasList(aliases: HostAlias[]): string {
@@ -421,15 +412,14 @@ function formatAliasList(aliases: HostAlias[]): string {
 			target = `${userPart}${a.hostname}${portPart}`;
 		}
 		const via = a.proxyJump && a.proxyJump !== "none" ? ` via ${a.proxyJump}` : "";
-		lines.push(`  ${a.alias}${target ? ` → ${target}` : ""}${via}`);
+		lines.push(`${a.alias}${target ? ` → ${target}` : ""}${via}`);
 	}
 	return [`SSH host aliases (${lines.length}):`, ...lines].join("\n");
 }
 
 /** Build the info-action result: per-host effective config when `host` is
  * given, otherwise the alias inventory from ~/.ssh/config. Read-only.
- * Details carry `_type: "sshInfo"` so renderResult falls to its generic
- * plain-text branch (no collapse, no exit-code framing). */
+ * Details carry `_type: "sshInfo"` + `host` for the collapsed row. */
 /**
  * The pix-runtime lookup message for the first missing binary this action
  * needs (ssh, plus scp for file transfers), or undefined when all resolve.
@@ -447,7 +437,7 @@ export function missingSshTools(action: "command" | "file"): string | undefined
 }
 
 async function infoResult(host: string | undefined, sig?: AbortSignal) {
-	const details = { _type: "sshInfo" as const };
+	const details = { _type: "sshInfo" as const, host: host?.trim() || "aliases" };
 	if (host?.trim()) {
 		let spec: HostSpec;
 		try {
@@ -480,7 +470,7 @@ export default function (pi: ExtensionAPI): void {
 	// "Allow for this session" hosts. Lives in the factory: Pi hands each new session a fresh `pi`,
 	// so this resets on /new. Privileged commands never use it (see `privileged` below).
 	const sessionHosts = new Set<string>();
-	const approved = (key: string) => sessionHosts.has(key) || hostApproved(approvedHosts, key);
+	const approved = (key: string) => sessionHosts.has(key);
 	pi.registerTool({
 		name: "ssh_run",
 		...({ exposure: "deferred" } as const),
@@ -807,6 +797,18 @@ export default function (pi: ExtensionAPI): void {
 				});
 
 			const overlayResult = await runOverlay();
+			if (overlayResult.passwordAttemptsExhausted) {
+				const text = `SSH authentication failed after ${MAX_PASSWORD_ATTEMPTS} attempts — wrong password.`;
+				ctx.ui.notify(`🔐 ${text}`, "error");
+				return {
+					content: [{ type: "text", text }],
+					details: makeDetails(command, host, sudo, reason, {
+						outcome: "error",
+						errorKind: "auth-ssh",
+					}),
+					isError: true,
+				};
+			}
 			const missing =
 				overlayResult.action === "approved" &&
 				((needLogin && !collected.login) || (needSudo && !collected.sudo));
@@ -816,10 +818,8 @@ export default function (pi: ExtensionAPI): void {
 				return r;
 			}
 
-			// File transfers remain warning-level: normal mode asks every time,
-			// AFK denies above, and YOLO may approve when no password is missing.
-			if (action === "command") approvedHosts.set(key, Date.now() + APPROVAL_TTL_MS);
-			// "session" is only offered for non-privileged commands (sessionChoices).
+			// Plain "Allow" approves this call only. "session" (offered only for
+			// non-privileged commands) is the sole way to skip later prompts.
 			if (overlayResult.choice === "session") {
 				sessionHosts.add(key);
 				ctx.ui.notify(`ssh_run: ${host} allowed for this session (sudo still asks)`, "info");
@@ -1016,13 +1016,40 @@ export default function (pi: ExtensionAPI): void {
 			const completed = (isError: boolean) => frameToolResult(text, theme, isError);
 
 			if (details?._type !== "sshResult") {
-				if (renderCtx.isError) {
-					text.setText(renderToolError(getTextContent(result) || "Error", theme));
-				} else {
+				const info = (result.details as { _type?: string; host?: string } | undefined) ?? {};
+				if (
+					!isPartial &&
+					info._type === "sshInfo" &&
+					tickCollapse(
+						"ssh",
+						renderCtx.state as CollapseState,
+						renderCtx.invalidate,
+						renderCtx.expanded,
+					)
+				) {
+					const status = renderCtx.isError ? "error" : "success";
 					text.setText(
-						fillToolBackground(`${BODY_PAD}${theme.fg("muted", getTextContent(result) || "done")}`),
+						renderCollapsedToolRow(
+							theme,
+							"ssh info",
+							info.host ?? "",
+							renderCtx.isError ? "failed" : "",
+							status,
+						),
 					);
+					return text;
 				}
+				const body = getTextContent(result) || "done";
+				text.setText(
+					renderCtx.isError
+						? renderToolError(body, theme)
+						: fillToolBackground(
+								body
+									.split("\n")
+									.map((line) => `${BODY_PAD}${theme.fg("muted", line)}`)
+									.join("\n"),
+							),
+				);
 				return isPartial ? text : completed(renderCtx.isError);
 			}
 

package/src/lib.ts

@@ -29,23 +29,6 @@ import { expandHome, homeDir, tempDir } from "@xynogen/pix-runtime/paths";
 export const MAX_OUTPUT_BYTES = DEFAULT_MAX_BYTES;
 export const MAX_OUTPUT_LINES = DEFAULT_MAX_LINES;
 
-/** Per-host approval TTL (ms) — mirrors sudo's PAM ticket window (~15 min). */
-export const APPROVAL_TTL_MS = 15 * 60_000;
-
-/**
- * True when `key` has a live (non-expired) approval in `map`; deletes the entry
- * on expiry so the map self-prunes. `now` is injectable for tests.
- */
-export function hostApproved(map: Map<string, number>, key: string, now = Date.now()): boolean {
-	const expiry = map.get(key);
-	if (expiry === undefined) return false;
-	if (now >= expiry) {
-		map.delete(key);
-		return false;
-	}
-	return true;
-}
-
 /**
  * True when the command text itself escalates privilege (sudo/su/doas/pkexec),
  * so per-host allow-memory must NOT auto-approve it even when `sudo:true` was
@@ -106,6 +89,7 @@ export function parseHost(spec: string): HostSpec {
 	const colons = rest.split(":").length - 1;
 	if (rest.startsWith("[")) {
 		const end = rest.indexOf("]");
+		if (end === -1) throw new Error(`Invalid host: ${spec} (missing "]")`);
 		const hostPart = rest.slice(1, end);
 		const tail = rest.slice(end + 1);
 		if (tail.startsWith(":")) port = parsePort(tail.slice(1));
@@ -117,6 +101,11 @@ export function parseHost(spec: string): HostSpec {
 	}
 
 	if (!rest) throw new Error(`Invalid host: ${spec}`);
+	// The target is a positional argv entry; a leading "-" would make ssh/scp
+	// read it as an option (e.g. -oProxyCommand=...), which runs a local command.
+	if (rest.startsWith("-") || user?.startsWith("-")) {
+		throw new Error(`Invalid host: ${spec} (host and user must not start with "-")`);
+	}
 	return { user, host: rest, ...(port !== undefined ? { port } : {}) };
 }