@zicolasjac-ai/remote-readonly-ssh 1.3.0 → 1.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@zicolasjac-ai/remote-readonly-ssh",
|
|
3
|
-
"version": "1.3.
|
|
3
|
+
"version": "1.3.1",
|
|
4
4
|
"description": "只读 SSH 运维 CLI 与 Agent Skill：通过 JumpServer 堡垒机白名单强制执行只读查询；认证组支持 SSH 私钥/密码两种模式与按 IP 分组；附 SKILL.md 让 opencode / Claude Code / Cursor 等 AI 助手自动发现并正确调用。",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"bin": {
|
|
@@ -95,6 +95,7 @@ rrs <tool> [arg] [--host <ip>] [--config <file>] [--json]
|
|
|
95
95
|
2. **永远不要**用 `read-file` 读 `blocked_paths`（`/etc/passwd`、`/etc/shadow`、`~/.ssh/id_*` 等）
|
|
96
96
|
3. **永远不要**指定未在 `target_hosts` 注册的 IP
|
|
97
97
|
4. **不要**试图把 `;` `&&` `|` `>` `$()` 拼到参数里——所有路径和参数都做严格字符集校验
|
|
98
|
+
5. **修改 `~/.rrs/config.json` 前必须先征得用户确认**（`~/.rrs/` 下的所有文件均如此，含白名单、target_hosts、认证组、known_hosts）。被拒绝时不要直接动手改配置：先把需要的路径/主机/变更内容展示给用户，等用户明确同意后再编辑。配置文件属于用户资产，不在工具的只读授权范围内自行变更。
|
|
98
99
|
|
|
99
100
|
被拒绝的尝试一样会进审计日志。
|
|
100
101
|
|