aws-ssh-utils 0.2.6__tar.gz → 0.3.0__tar.gz

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: aws-ssh-utils
-Version: 0.2.6
+Version: 0.3.0
 Summary: Easy AWS SSHing
 Project-URL: Homepage, https://github.com/mvanderlee/aws-ssh-utils
 Author-email: Michiel Vanderlee <jmt.vanderlee@gmail.com>
@@ -26,7 +26,9 @@ Requires-Dist: boto3
 Requires-Dist: click
 Requires-Dist: loguru
 Requires-Dist: paramiko
+Requires-Dist: ptyprocess>=0.7.0; sys_platform != 'win32'
 Requires-Dist: pyte>=0.8.2
+Requires-Dist: pywinpty>=3.0.0; sys_platform == 'win32'
 Requires-Dist: questionary
 Requires-Dist: requests>=2.34.2
 Requires-Dist: rich>=15.0.0
@@ -58,17 +60,21 @@ It utilizes [questionary](https://pypi.org/project/questionary/) to ask you whic
 
 ## App
 
-Terminal UI to browse EC2 instances and EMR clusters, with SSH shells in tabs.
+Terminal UI to browse EC2 instances and EMR clusters, with SSM or SSH shells in tabs.
 It's the default command, so `aws_ssh` and `aws_ssh -p my-profile` launch it too.
-Each connection tries, in order: `~/.ssh/config`, SSH over AWS SSM (`session-manager-plugin`), opkssh (via instance/cluster tags),
+Each connection tries, in order: `~/.ssh/config`, a keyless AWS SSM shell, opkssh (via instance/cluster tags),
 the instance's EC2 key found in `~/.ssh`, then your default keys/ssh-agent.
-Unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
+SSM uses `aws ssm start-session --target INSTANCE_ID` with the selected profile and region. It requires the AWS CLI,
+`session-manager-plugin`, and Session Manager access to the instance, but no SSH key, SSH server, or inbound port 22.
+The shell runs as the Session Manager configured user (usually `ssm-user`); SSH usernames and key options only apply
+to SSH connections. The `ec2` and `emr` commands use the same connection order; `emr-all` still uses SSH in tmux.
+For SSH connections, unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
 
 ```shell
 $ aws_ssh app --help
 Usage: aws_ssh app [OPTIONS]
 
-  Browse EC2 instances and EMR clusters, and open SSH shells in tabs.
+  Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs.
 
 Options:
   -p, --profile TEXT          Which AWS profile to use
@@ -92,7 +98,7 @@ $ aws_auth ec2 --help
 Usage: aws_ssh ec2 [OPTIONS]
 
   Asks user which EC2 instance they want to connect to, then opens an
-  interactive SSH session to the instance
+  interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use
@@ -114,7 +120,7 @@ Select the EMR cluster, instance group, and instance to connect to.
 $ aws_ssh emr --help
 Usage: aws_ssh emr [OPTIONS]
 
-  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSH session to the instance
+  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/README.md

@@ -22,17 +22,21 @@ It utilizes [questionary](https://pypi.org/project/questionary/) to ask you whic
 
 ## App
 
-Terminal UI to browse EC2 instances and EMR clusters, with SSH shells in tabs.
+Terminal UI to browse EC2 instances and EMR clusters, with SSM or SSH shells in tabs.
 It's the default command, so `aws_ssh` and `aws_ssh -p my-profile` launch it too.
-Each connection tries, in order: `~/.ssh/config`, SSH over AWS SSM (`session-manager-plugin`), opkssh (via instance/cluster tags),
+Each connection tries, in order: `~/.ssh/config`, a keyless AWS SSM shell, opkssh (via instance/cluster tags),
 the instance's EC2 key found in `~/.ssh`, then your default keys/ssh-agent.
-Unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
+SSM uses `aws ssm start-session --target INSTANCE_ID` with the selected profile and region. It requires the AWS CLI,
+`session-manager-plugin`, and Session Manager access to the instance, but no SSH key, SSH server, or inbound port 22.
+The shell runs as the Session Manager configured user (usually `ssm-user`); SSH usernames and key options only apply
+to SSH connections. The `ec2` and `emr` commands use the same connection order; `emr-all` still uses SSH in tmux.
+For SSH connections, unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
 
 ```shell
 $ aws_ssh app --help
 Usage: aws_ssh app [OPTIONS]
 
-  Browse EC2 instances and EMR clusters, and open SSH shells in tabs.
+  Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs.
 
 Options:
   -p, --profile TEXT          Which AWS profile to use
@@ -56,7 +60,7 @@ $ aws_auth ec2 --help
 Usage: aws_ssh ec2 [OPTIONS]
 
   Asks user which EC2 instance they want to connect to, then opens an
-  interactive SSH session to the instance
+  interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use
@@ -78,7 +82,7 @@ Select the EMR cluster, instance group, and instance to connect to.
 $ aws_ssh emr --help
 Usage: aws_ssh emr [OPTIONS]
 
-  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSH session to the instance
+  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use

aws_ssh_utils-0.3.0/aws_ssh_utils/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/aws_ssh_utils/cli_utils.py

@@ -6,10 +6,11 @@ import json
 import os
 import subprocess
 import sys
-from collections.abc import Callable
+import time
+from collections.abc import Callable, Sequence
 from pathlib import Path
 from shutil import which
-from typing import ParamSpec, TypeVar
+from typing import ParamSpec, TypeVar, cast
 
 import click
 import paramiko
@@ -17,11 +18,14 @@ import questionary
 from botocore.exceptions import ClientError
 from loguru import logger
 from rich.console import Console
+from rich.live import Live
 from rich.markup import escape
+from rich.spinner import Spinner
 from rich.status import Status
+from rich.text import Text
 
 from aws_ssh_utils.commands.healthcheck import is_aws_ssm_installed, is_opkssh_installed
-from aws_ssh_utils.connection import Environment, Target, connect, open_shell_channel
+from aws_ssh_utils.connection import Attempt, Environment, Target, connect, open_shell_channel
 from aws_ssh_utils.terminal import ShellApp
 
 P = ParamSpec('P')
@@ -37,6 +41,7 @@ WINDOWS_TERMINAL_SETTINGS = (
 """Relative to %LOCALAPPDATA%: Store, Store preview, and unpackaged installs."""
 
 console = Console(stderr=True)
+connecting_spinner = Spinner('dots')
 
 
 class ShellError(Exception):
@@ -50,6 +55,29 @@ def spinner(message: str = '') -> Status:
     return console.status(message, spinner='dots')
 
 
+def render_attempts(attempts: Sequence[Attempt]) -> Text:
+    """The connection checklist: done attempts, the current one with a spinner, and the remaining ones muted."""
+
+    def line(attempt: Attempt) -> Text:
+        match attempt.state:
+            case 'connecting':
+                frame = cast(Text, connecting_spinner.render(time.monotonic()))
+                return Text.assemble(frame, f" Connecting via {attempt.via} ...")
+            case 'connected':
+                return Text(f"✓ Connected via {attempt.via}", 'green')
+            case 'failed':
+                return Text.assemble(
+                    f"❌ Failed to connect via {attempt.via} - {attempt.detail}\n",
+                    (f"    {attempt.command}", 'dim'),
+                )
+            case 'skipped':
+                return Text(f"  {attempt.detail}, skipping.", 'dim')
+            case 'pending':
+                return Text(f"  {attempt.via}", 'dim')
+
+    return Text('\n').join(line(a) for a in attempts)
+
+
 def handle_errors(func: Callable[P, R]) -> Callable[P, R]:
     """Log ShellErrors and AWS errors, and exit, instead of printing a traceback."""
 
@@ -145,10 +173,28 @@ def open_shell(target: Target, env: Environment, title: str, scrollback: int | N
 
     `scrollback` defaults to the terminal's own setting, see `detect_scrollback`.
     """
-    result = connect(target, env, on_output=logger.info, on_waiting=lambda: None, confirm_host_key=confirm_host_key)
-    if isinstance(result, list):
-        for line in result:
-            console.print(escape(line))
+    attempts: list[Attempt] = []
+    with Live(console=console, get_renderable=lambda: render_attempts(attempts)) as live:
+
+        def on_progress(snapshot: list[Attempt]):
+            attempts[:] = snapshot
+
+        def confirm(hostname: str, key: paramiko.PKey) -> bool:
+            live.stop()
+            try:
+                return confirm_host_key(hostname, key)
+            finally:
+                live.start()
+
+        result = connect(
+            target,
+            env,
+            on_output=lambda line: live.console.print(escape(line)),
+            on_waiting=lambda: None,
+            on_progress=on_progress,
+            confirm_host_key=confirm,
+        )
+    if result is None:
         raise ShellError(f'Failed to connect to {target.user}@{target.ip}')
 
     channel = open_shell_channel(result.client)

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/aws_ssh_utils/commands/app.py

@@ -22,8 +22,8 @@ from textual.widgets import Footer, Input, OptionList, RichLog, Static, TabbedCo
 from textual.widgets.option_list import Option
 from textual.widgets.tree import TreeNode
 
-from aws_ssh_utils.cli_utils import detect_environment, detect_scrollback, scrollback_option
-from aws_ssh_utils.connection import Environment, Target, connect, open_shell_channel
+from aws_ssh_utils.cli_utils import detect_environment, detect_scrollback, render_attempts, scrollback_option
+from aws_ssh_utils.connection import Attempt, Environment, Target, connect, open_shell_channel
 from aws_ssh_utils.ec2_utils import ec2_name, ec2_target, get_running_ec2_instances
 from aws_ssh_utils.emr_utils import emr_target, get_emr_clusters, get_emr_instances, group_role, group_sort_key
 from aws_ssh_utils.terminal import ShellStatus, Terminal
@@ -48,7 +48,7 @@ ANIMATION_INTERVAL = 1 / 12
 @click.option('-r', '--region', default=None, help='Which AWS region to use')
 @scrollback_option
 def app(profile: str | None = None, region: str | None = None, scrollback: int | None = None, **kwargs: Any):
-    """Browse EC2 instances and EMR clusters, and open SSH shells in tabs."""
+    """Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs."""
     try:
         session = boto3.Session(profile_name=profile, region_name=region)
         session.client('sts').get_caller_identity()
@@ -99,8 +99,10 @@ class ShellPane(TabPane):
         self.scrollback = scrollback
         self.status: Status = 'connecting'
         self.spinner = Spinner('dots')
+        self.attempts: list[Attempt] = []
 
     def compose(self) -> ComposeResult:
+        yield Static(classes='attempts')
         yield RichLog(wrap=True, markup=True)
 
     def on_mount(self):
@@ -110,6 +112,11 @@ class ShellPane(TabPane):
     def update_label(self):
         icon = cast(Text, self.spinner.render(time.monotonic())) if self.status == 'connecting' else STATUS_ICONS[self.status]
         self.query_ancestor(TabbedContent).get_tab(self).label = Text.assemble(icon, ' ', self.title_)
+        self.query_one('.attempts', Static).update(render_attempts(self.attempts))
+
+    def set_attempts(self, attempts: list[Attempt]):
+        self.attempts = attempts
+        self.update_label()
 
     def set_status(self, status: Status):
         self.status = status
@@ -131,10 +138,9 @@ class ShellPane(TabPane):
                 self.env,
                 on_output=write,
                 on_waiting=lambda: self.app.call_from_thread(self.set_status, 'waiting'),
+                on_progress=lambda attempts: self.app.call_from_thread(self.set_attempts, attempts),
             )
-            if isinstance(result, list):
-                for line in result:
-                    write(line)
+            if result is None:
                 self.app.call_from_thread(self.set_status, 'failed')
                 return
 
@@ -149,6 +155,7 @@ class ShellPane(TabPane):
 
     async def attach(self, via: str, terminal: Terminal):
         await self.query_one(RichLog).remove()
+        await self.query_one('.attempts').remove()
         await self.mount(ShellStatus(via), terminal)
         self.set_status('connected')
 

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/aws_ssh_utils/commands/ec2.py

@@ -41,7 +41,7 @@ def ec2(
 ):
     """
     Asks user which EC2 instance they want to connect to,
-    then opens an interactive SSH session to the instance
+    then opens an interactive SSM or SSH session to the instance
     """
     session = boto3.Session(profile_name=profile, region_name=region)
     ec2_client = session.client('ec2')

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/aws_ssh_utils/commands/emr.py

@@ -45,7 +45,7 @@ def emr(
 ):
     """
     Asks user which Cluster and EC2 instance they want to connect to,
-    then opens an interactive SSH session to the instance
+    then opens an interactive SSM or SSH session to the instance
     """
     session = boto3.Session(profile_name=profile, region_name=region)
     emr_client = session.client('emr')
@@ -65,9 +65,11 @@ def emr(
     with spinner():
         target = emr_target(emr_client, cluster_id, instance_ip.instance_id or '', ip)
     target = replace(target, user=user or target.user, key_file=key_file)
+    env = detect_environment(profile, session.region_name)
 
     if (
-        key_file is None
+        not env.ssm_installed
+        and key_file is None
         and target.opkssh_provider is None
         and find_ssh_key_file(target.key_name) is None
         and not questionary.confirm(f'Could not find the ssh key {target.key_name}, would you like to continue?').unsafe_ask()
@@ -78,7 +80,7 @@ def emr(
     postfix = f'[{group_idx}]' if group_idx else ''
     open_shell(
         target,
-        detect_environment(profile, session.region_name),
+        env,
         title=f'{cluster_name} - {group}{postfix}',
         scrollback=scrollback,
         initial_input=CORE_NODE_INPUT if group.lower().startswith('core') else b'',

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/aws_ssh_utils/connection.py

@@ -1,4 +1,4 @@
-"""SSH connection strategies, tried in order until one succeeds."""
+"""SSM and SSH connection strategies, tried in order until one succeeds."""
 
 import os
 import shlex
@@ -7,17 +7,19 @@ import subprocess
 import threading
 import time
 from collections.abc import Callable, Sequence
-from dataclasses import dataclass
+from dataclasses import dataclass, field, replace
 from fnmatch import fnmatch
 from functools import partial
 from hashlib import sha256
 from pathlib import Path
-from typing import IO, cast
+from typing import IO, Literal, cast
 
 import paramiko
 from loguru import logger
 from typing_extensions import override
 
+from aws_ssh_utils.session import ShellChannel, SSMSession
+
 # CSV of issuer,client
 OPKSSH_PROVIDER_TAG = 'opkssh_provider'
 # EMR doesn't support comma's in tags.
@@ -54,97 +56,121 @@ class Environment:
 
 @dataclass(frozen=True)
 class Connection:
-    client: paramiko.SSHClient
+    client: paramiko.SSHClient | SSMSession
     via: str
     """How the connection was made: AWS SSM, opkssh, a key name, ..."""
 
 
+@dataclass(frozen=True)
+class Attempt:
+    via: str
+    command: str
+    """The equivalent command line, to retry by hand."""
+    open_client: Callable[[], paramiko.SSHClient | SSMSession] = field(repr=False, compare=False)
+    state: Literal['pending', 'connecting', 'connected', 'failed', 'skipped'] = 'pending'
+    detail: str = ''
+    """The error when failed, the reason when skipped."""
+
+
+OnProgress = Callable[[list[Attempt]], None]
+
+
 def connect(
     target: Target,
     env: Environment,
     on_output: OnOutput,
     on_waiting: Callable[[], None],
+    on_progress: OnProgress,
     confirm_host_key: ConfirmHostKey | None = None,
-) -> Connection | list[str]:
-    """Return the first successful connection, or the failure checklist.
+) -> Connection | None:
+    """Return the first successful connection, or None when all fail.
 
     Tried in order:
     1. ~/.ssh/config, when a Host pattern (other than `*`) matches the instance id, an alias or the IP.
-    2. SSH over AWS SSM to the instance id, with any existing opkssh/EC2 key plus the default keys.
+    2. A keyless AWS SSM shell, authenticated with the AWS profile.
     3. opkssh, when the instance/cluster has opkssh tags. May open a browser login.
     4. The EC2 key pair (or `target.key_file`), when a matching file is found in ~/.ssh.
     5. The ssh-agent and default ~/.ssh/id_* keys.
 
+    `on_progress` gets a snapshot of all attempts whenever one changes state.
     Unknown host keys are trusted, unless `confirm_host_key` declines them.
     """
-    failures: list[str] = []
     open_ssh_ = partial(open_ssh, confirm_host_key=confirm_host_key)
+    attempts: list[Attempt] = []
 
-    def attempt(via: str, failure: str, open_client: Callable[[], paramiko.SSHClient]) -> Connection | None:
-        logger.info(f"Connecting via {via}")
+    def try_attempt(i: int) -> Connection | None:
+        attempt = attempts[i]
+        if attempt.state == 'skipped':
+            on_progress(list(attempts))
+            return None
+        attempts[i] = replace(attempt, state='connecting')
+        on_progress(list(attempts))
         try:
-            return Connection(open_client(), via)
+            client = attempt.open_client()
         except Exception as e:
-            logger.debug(f"{failure}: {e!r}")
-            failures.append(f"{failure}\n    {e or type(e).__name__}")
+            logger.debug(f"Failed to connect via {attempt.via}: {e!r}")
+            attempts[i] = replace(attempt, state='failed', detail=str(e) or type(e).__name__)
+            on_progress(list(attempts))
             return None
+        attempts[i] = replace(attempt, state='connected')
+        on_progress(list(attempts))
+        return Connection(client, attempt.via)
 
     config = find_ssh_config(target)
     if config is not None:
         alias, options = config
-        if connection := attempt(
-            f"ssh config ({alias})",
-            f":x: Failed with ssh config - ssh {alias}",
-            lambda: open_with_config(alias, options, target, confirm_host_key),
-        ):
-            return connection
+        attempts.append(
+            Attempt(
+                f"ssh config ({alias})",
+                shlex.join(['ssh', alias]),
+                lambda: open_with_config(alias, options, target, confirm_host_key),
+            ),
+        )
+
+    command = ssm_command(target.instance_id, env)
+    ssm = Attempt('AWS SSM', shlex.join(command), lambda: SSMSession.open(command))
+    attempts.append(
+        ssm if env.ssm_installed else replace(ssm, state='skipped', detail="AWS CLI or session-manager-plugin not installed"),
+    )
+    for i in range(len(attempts)):
+        if result := try_attempt(i):
+            return result
 
+    # Key discovery is only needed for the remaining SSH fallbacks.
+    fallback_start = len(attempts)
     ec2_key = target.key_file or find_ssh_key_file(target.key_name)
-    known_keys = [k for k in (valid_opkssh_key_file(target.opkssh_provider), ec2_key) if k]
-
-    if not env.ssm_installed:
-        failures.append(":x: AWS session-manager-plugin not installed")
-    elif connection := attempt(
-        "AWS SSM",
-        ":x: Failed to start session with AWS session-manager",
-        lambda: open_ssh_(
-            target.instance_id,
-            target.user,
-            known_keys,
-            use_defaults=True,
-            sock=proxy_socket(ssm_command(target.instance_id, env), on_output),
-        ),
-    ):
-        return connection
-
-    if target.opkssh_provider is not None:
-        provider = target.opkssh_provider
-        if not env.opkssh_installed:
-            failures.append(":x: Failed to authenticate with opkssh\n    opkssh not installed")
-        elif connection := attempt(
+
+    if (provider := target.opkssh_provider) is not None:
+        opkssh_key = str(opkssh_key_path(provider))
+        opkssh = Attempt(
             "opkssh",
-            ":x: Failed to authenticate with opkssh",
+            f"{shlex.join(opkssh_login_command(provider, opkssh_key))} && "
+            + ssh_command(target.user, target.ip, [opkssh_key], identities_only=True),
             lambda: open_ssh_(target.ip, target.user, [opkssh_login(provider, on_output, on_waiting)], use_defaults=False),
-        ):
-            return connection
-
-    if ec2_key is not None and (
-        connection := attempt(
-            Path(ec2_key).stem,
-            f":x: Key found, but failed - ssh -o IdentitiesOnly=yes -i {ec2_key} {target.user}@{target.ip}",
-            lambda: open_ssh_(target.ip, target.user, [ec2_key], use_defaults=False),
         )
-    ):
-        return connection
+        attempts.append(opkssh if env.opkssh_installed else replace(opkssh, state='skipped', detail="opkssh not installed"))
+
+    if ec2_key is not None:
+        attempts.append(
+            Attempt(
+                Path(ec2_key).stem,
+                ssh_command(target.user, target.ip, [ec2_key], identities_only=True),
+                lambda: open_ssh_(target.ip, target.user, [ec2_key], use_defaults=False),
+            ),
+        )
 
-    if connection := attempt(
-        "default key",
-        f":x: Failed with default key - ssh {target.user}@{target.ip}",
-        lambda: open_ssh_(target.ip, target.user, [], use_defaults=True),
-    ):
-        return connection
+    attempts.append(
+        Attempt(
+            "default key",
+            ssh_command(target.user, target.ip),
+            lambda: open_ssh_(target.ip, target.user, [], use_defaults=True),
+        ),
+    )
 
-    return failures
+    for i in range(fallback_start, len(attempts)):
+        if result := try_attempt(i):
+            return result
+    return None
 
 
 def open_ssh(
@@ -186,7 +212,28 @@ def open_ssh(
     return client
 
 
-def open_shell_channel(client: paramiko.SSHClient) -> paramiko.Channel:
+def ssh_command(
+    user: str,
+    host: str,
+    key_files: Sequence[str] = (),
+    *,
+    identities_only: bool = False,
+    proxy: list[str] | None = None,
+) -> str:
+    """The OpenSSH command line equivalent of an `open_ssh` call."""
+    cmd = ['ssh']
+    if proxy:
+        cmd += ['-o', f'ProxyCommand={shlex.join(proxy)}']
+    if identities_only:
+        cmd += ['-o', 'IdentitiesOnly=yes']
+    for key_file in key_files:
+        cmd += ['-i', key_file]
+    return shlex.join([*cmd, f'{user}@{host}'])
+
+
+def open_shell_channel(client: paramiko.SSHClient | SSMSession) -> ShellChannel:
+    if isinstance(client, SSMSession):
+        return client
     channel = client.get_transport().open_session()  # pyright: ignore[reportOptionalMemberAccess]
     channel.get_pty(term='xterm-256color')
     channel.invoke_shell()
@@ -261,10 +308,6 @@ def ssm_command(instance_id: str, env: Environment) -> list[str]:
         'start-session',
         '--target',
         instance_id,
-        '--document-name',
-        'AWS-StartSSHSession',
-        '--parameters',
-        'portNumber=22',
     ]
     if env.profile:
         cmd += ['--profile', env.profile]
@@ -357,6 +400,10 @@ def valid_opkssh_key_file(provider: str | None) -> str | None:
     return str(key) if key.is_file() and key.stat().st_mtime > time.time() - OPKSSH_KEY_MAX_AGE else None
 
 
+def opkssh_login_command(provider: str, key_file: str) -> list[str]:
+    return ['opkssh', 'login', '--provider', provider, '-i', key_file]
+
+
 def opkssh_login(provider: str, on_output: OnOutput, on_waiting: Callable[[], None]) -> str:
     """Return a valid opkssh key file, logging in when missing or expired."""
     if key_file := valid_opkssh_key_file(provider):
@@ -368,7 +415,7 @@ def opkssh_login(provider: str, on_output: OnOutput, on_waiting: Callable[[], No
         path.unlink(missing_ok=True)
 
     proc = subprocess.Popen(  # noqa: S603
-        ['opkssh', 'login', '--provider', provider, '-i', str(key)],  # noqa: S607
+        opkssh_login_command(provider, str(key)),
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
         text=True,

aws_ssh_utils-0.3.0/aws_ssh_utils/session.py

@@ -0,0 +1,128 @@
+"""Terminal channels for native, keyless Session Manager shells."""
+
+import os
+import queue
+import re
+import threading
+import time
+from typing import Protocol, cast
+
+
+class ShellChannel(Protocol):
+    def recv(self, nbytes: int, /) -> bytes: ...
+    def send(self, data: bytes, /) -> int: ...
+    def resize_pty(self, width: int, height: int) -> None: ...
+
+
+class ShellClient(Protocol):
+    def close(self) -> None: ...
+
+
+class Pty(Protocol):
+    def read(self, size: int) -> str: ...
+    def write(self, data: str) -> int: ...
+    def setwinsize(self, rows: int, cols: int) -> None: ...
+    def close(self, force: bool = False) -> None: ...
+
+
+def spawn_pty(command: list[str]) -> Pty:
+    """SSM needs a real terminal for raw input, control keys, and window sizes."""
+    env = {**os.environ, 'TERM': 'xterm-256color', 'AWS_PAGER': '', 'AWS_CLI_AUTO_PROMPT': 'off'}
+    if os.name == 'nt':
+        from winpty import PtyProcess
+
+        return cast(Pty, PtyProcess.spawn(command, env=env, dimensions=(24, 80)))
+
+    from ptyprocess import PtyProcessUnicode
+
+    return cast(Pty, PtyProcessUnicode.spawn(command, env=env, dimensions=(24, 80), echo=False))
+
+
+class SSMSession:
+    """Adapt an AWS CLI pseudo-terminal to the terminal widget's channel interface."""
+
+    def __init__(self, process: Pty):
+        self.process = process
+        self.closed = False
+        self._output: queue.Queue[bytes | Exception | None] = queue.Queue()
+        self._pending = b''
+        self._eof = False
+        threading.Thread(target=self._read, daemon=True).start()
+
+    @classmethod
+    def open(cls, command: list[str], timeout: float = 30) -> 'SSMSession':
+        session = cls(spawn_pty(command))
+        try:
+            session._wait_started(timeout)
+        except BaseException:
+            session.close()
+            raise
+        return session
+
+    def _read(self):
+        try:
+            while not self.closed:
+                data = self.process.read(65536)
+                if data:
+                    self._output.put(data.encode('utf-8'))
+        except EOFError:
+            pass
+        except Exception as e:
+            if not self.closed:
+                self._output.put(e)
+        finally:
+            self._output.put(None)
+
+    def _wait_started(self, timeout: float):
+        """Keep startup output for the terminal, but report CLI failures to the fallback list."""
+        deadline = time.monotonic() + timeout
+        output = bytearray()
+        try:
+            while True:
+                data = self._output.get(timeout=max(0, deadline - time.monotonic()))
+                if isinstance(data, Exception):
+                    raise OSError(str(data)) from data
+                if data is None:
+                    raise OSError(output.decode('utf-8', errors='replace').strip() or 'SSM exited before starting a session')
+                output.extend(data)
+                # ConPTY adds terminal escape sequences to console output on Windows.
+                text = re.sub(rb'\x1b\[[0-?]*[ -/]*[@-~]', b'', output)
+                if re.search(rb'Starting session with SessionId:\s*\S+', text):
+                    self._pending = bytes(output)
+                    return
+        except queue.Empty:
+            detail = output.decode('utf-8', errors='replace').strip()
+            raise TimeoutError(f'Timed out starting SSM session{": " + detail if detail else ""}') from None
+
+    def recv(self, nbytes: int) -> bytes:
+        if nbytes <= 0:
+            return b''
+        while not self._pending and not self._eof:
+            data = self._output.get()
+            if isinstance(data, Exception):
+                raise OSError(str(data)) from data
+            if data is None:
+                self._eof = True
+            else:
+                self._pending = data
+        data, self._pending = self._pending[:nbytes], self._pending[nbytes:]
+        return data
+
+    def send(self, data: bytes) -> int:
+        try:
+            self.process.write(data.decode('utf-8'))
+        except EOFError as e:
+            raise OSError('SSM session is closed') from e
+        return len(data)
+
+    def resize_pty(self, width: int, height: int):
+        if not self.closed:
+            self.process.setwinsize(height, width)
+
+    def close(self):
+        if not self.closed:
+            self.closed = True
+            try:
+                self.process.close(force=True)
+            finally:
+                self._output.put(None)

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/aws_ssh_utils/ssh.py

@@ -53,8 +53,12 @@ def cli(
     )
     level = "DEBUG" if verbose else 100 if quiet else "INFO"
 
+    def to_stdout(message: str):
+        # Look up sys.stdout per message, so rich.live can redirect it above its display.
+        sys.stdout.write(message)
+
     logger.remove()
-    logger.add(sys.stdout, level=level, format=log_format, colorize=True)
+    logger.add(to_stdout, level=level, format=log_format, colorize=True)
 
 
 for command in (app, ec2, emr, emr_all, healthcheck):

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/aws_ssh_utils/terminal.py

@@ -1,4 +1,4 @@
-"""Textual widgets rendering a paramiko shell channel through the pyte VT100 emulator."""
+"""Textual widgets rendering SSH and SSM shell channels through the pyte VT100 emulator."""
 
 import datetime as dt
 import time
@@ -7,7 +7,6 @@ from collections.abc import Sequence
 from functools import lru_cache
 from typing import Any
 
-import paramiko
 import pyte
 from pyte.screens import Char, Margins
 from rich.segment import Segment
@@ -22,6 +21,8 @@ from textual.widget import Widget
 from textual.widgets import Static
 from typing_extensions import override
 
+from aws_ssh_utils.session import ShellChannel, ShellClient
+
 KEYS = {
     'enter': '\r',
     'tab': '\t',
@@ -108,7 +109,7 @@ def cell_style(
 class ChannelScreen(pyte.Screen):
     """Answers terminal queries over the channel, and keeps the lines scrolled off the top as history."""
 
-    def __init__(self, channel: paramiko.Channel, columns: int, lines: int, scrollback: int = 0):
+    def __init__(self, channel: ShellChannel, columns: int, lines: int, scrollback: int = 0):
         super().__init__(columns, lines)
         self.channel = channel
         self.history: deque[tuple[Char, ...]] = deque(maxlen=scrollback)
@@ -145,7 +146,7 @@ class Terminal(Widget, can_focus=True):
     class Closed(Message):
         pass
 
-    def __init__(self, client: paramiko.SSHClient, channel: paramiko.Channel, scrollback: int = 0, **kwargs: object):
+    def __init__(self, client: ShellClient, channel: ShellChannel, scrollback: int = 0, **kwargs: object):
         super().__init__(**kwargs)  # pyright: ignore[reportArgumentType]
         self.client = client
         self.channel = channel
@@ -287,7 +288,7 @@ class ShellApp(App[None]):
     # Its priority ctrl+p binding would steal shell history navigation from the terminal.
     ENABLE_COMMAND_PALETTE = False
 
-    def __init__(self, via: str, client: paramiko.SSHClient, channel: paramiko.Channel, scrollback: int = 0):
+    def __init__(self, via: str, client: ShellClient, channel: ShellChannel, scrollback: int = 0):
         super().__init__()
         self.via = via
         self.client = client

{aws_ssh_utils-0.2.6 → aws_ssh_utils-0.3.0}/pyproject.toml

@@ -34,6 +34,8 @@ dependencies = [
   "loguru",
   "paramiko",
   "pyte>=0.8.2",
+  "ptyprocess>=0.7.0; sys_platform != 'win32'",
+  "pywinpty>=3.0.0; sys_platform == 'win32'",
   "questionary",
   "requests>=2.34.2",
   "rich>=15.0.0",

aws_ssh_utils-0.2.6/aws_ssh_utils/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.6"