aws-ssh-utils 0.2.7__tar.gz → 0.3.1__tar.gz

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: aws-ssh-utils
-Version: 0.2.7
+Version: 0.3.1
 Summary: Easy AWS SSHing
 Project-URL: Homepage, https://github.com/mvanderlee/aws-ssh-utils
 Author-email: Michiel Vanderlee <jmt.vanderlee@gmail.com>
@@ -26,7 +26,9 @@ Requires-Dist: boto3
 Requires-Dist: click
 Requires-Dist: loguru
 Requires-Dist: paramiko
+Requires-Dist: ptyprocess>=0.7.0; sys_platform != 'win32'
 Requires-Dist: pyte>=0.8.2
+Requires-Dist: pywinpty>=3.0.0; sys_platform == 'win32'
 Requires-Dist: questionary
 Requires-Dist: requests>=2.34.2
 Requires-Dist: rich>=15.0.0
@@ -58,17 +60,21 @@ It utilizes [questionary](https://pypi.org/project/questionary/) to ask you whic
 
 ## App
 
-Terminal UI to browse EC2 instances and EMR clusters, with SSH shells in tabs.
+Terminal UI to browse EC2 instances and EMR clusters, with SSM or SSH shells in tabs.
 It's the default command, so `aws_ssh` and `aws_ssh -p my-profile` launch it too.
-Each connection tries, in order: `~/.ssh/config`, SSH over AWS SSM (`session-manager-plugin`), opkssh (via instance/cluster tags),
+Each connection tries, in order: `~/.ssh/config`, a keyless AWS SSM shell, opkssh (via instance/cluster tags),
 the instance's EC2 key found in `~/.ssh`, then your default keys/ssh-agent.
-Unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
+SSM uses `aws ssm start-session --target INSTANCE_ID` with the selected profile and region. It requires the AWS CLI,
+`session-manager-plugin`, and Session Manager access to the instance, but no SSH key, SSH server, or inbound port 22.
+The shell runs as the Session Manager configured user (usually `ssm-user`); SSH usernames and key options only apply
+to SSH connections. The `ec2` and `emr` commands use the same connection order; `emr-all` still uses SSH in tmux.
+For SSH connections, unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
 
 ```shell
 $ aws_ssh app --help
 Usage: aws_ssh app [OPTIONS]
 
-  Browse EC2 instances and EMR clusters, and open SSH shells in tabs.
+  Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs.
 
 Options:
   -p, --profile TEXT          Which AWS profile to use
@@ -83,6 +89,19 @@ Scroll back with the mouse wheel or `shift+PgUp`/`shift+PgDn`; typing jumps back
 `F12` shows/hides the sidebar, `ctrl+w` closes a failed tab, `ctrl+q` quits. Every other key goes to the focused shell.
 Logs are viewable with `textual console`.
 
+To keep diagnostics and crash tracebacks in a file, use the global `--log-file` option:
+
+```shell
+aws-ssh-utils --log-file ./aws-ssh.log --verbose --profile my-profile
+# Also works before an explicit command:
+aws-ssh-utils --log-file ./aws-ssh.log ec2 --profile my-profile
+```
+
+Alternatively, set `AWS_SSH_LOG_FILE` to the file path. Logs append across runs and rotate at 10 MB,
+keeping up to three rotated files. `--verbose` includes debug diagnostics; `--quiet` only suppresses
+console logging. File logs include the version, source location, and error tracebacks, without local
+variable dumps or a recording of shell input/output.
+
 ## EC2
 
 Select an instance from an interactive list. You can filter the instances by name.
@@ -92,7 +111,7 @@ $ aws_auth ec2 --help
 Usage: aws_ssh ec2 [OPTIONS]
 
   Asks user which EC2 instance they want to connect to, then opens an
-  interactive SSH session to the instance
+  interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use
@@ -114,7 +133,7 @@ Select the EMR cluster, instance group, and instance to connect to.
 $ aws_ssh emr --help
 Usage: aws_ssh emr [OPTIONS]
 
-  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSH session to the instance
+  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/README.md

@@ -1,114 +1,131 @@
-# AWS SSH Utils
-
-[![Version](https://img.shields.io/pypi/v/aws-ssh-utils.svg)](https://pypi.org/project/aws-ssh-utils/)
-[![License](https://img.shields.io/pypi/l/aws-ssh-utils.svg)](#)
-[![Supported Python Versions](https://img.shields.io/pypi/pyversions/aws-ssh-utils.svg)](https://pypi.org/project/aws-ssh-utils/)
-
-```shell
-uvx aws-ssh-utils
-
-uvx aws-ssh-utils app  # optional - `app` is default.
-uvx aws-ssh-utils ec2
-uvx aws-ssh-utils emr
-uvx aws-ssh-utils emr-all
-
-# Also exposed as `aws_ssh`
-uvx --from aws-ssh-utils aws_ssh
-```
-
-This allows you to interactively SSH to an EC2 instance, EMR instance, or all EMR instances with TMUX.
-
-It utilizes [questionary](https://pypi.org/project/questionary/) to ask you which instance you want to connect to.
-
-## App
-
-Terminal UI to browse EC2 instances and EMR clusters, with SSH shells in tabs.
-It's the default command, so `aws_ssh` and `aws_ssh -p my-profile` launch it too.
-Each connection tries, in order: `~/.ssh/config`, SSH over AWS SSM (`session-manager-plugin`), opkssh (via instance/cluster tags),
-the instance's EC2 key found in `~/.ssh`, then your default keys/ssh-agent.
-Unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
-
-```shell
-$ aws_ssh app --help
-Usage: aws_ssh app [OPTIONS]
-
-  Browse EC2 instances and EMR clusters, and open SSH shells in tabs.
-
-Options:
-  -p, --profile TEXT          Which AWS profile to use
-  -r, --region TEXT           Which AWS region to use
-  --scrollback INTEGER RANGE  Lines of scrollback per shell. Defaults to your
-                              tmux or Windows Terminal setting, else 1000.
-                              [x>=0]
-  --help                      Show this message and exit.
-```
-
-Scroll back with the mouse wheel or `shift+PgUp`/`shift+PgDn`; typing jumps back to the prompt.
-`F12` shows/hides the sidebar, `ctrl+w` closes a failed tab, `ctrl+q` quits. Every other key goes to the focused shell.
-Logs are viewable with `textual console`.
-
-## EC2
-
-Select an instance from an interactive list. You can filter the instances by name.
-
-```shell
-$ aws_auth ec2 --help
-Usage: aws_ssh ec2 [OPTIONS]
-
-  Asks user which EC2 instance they want to connect to, then opens an
-  interactive SSH session to the instance
-
-Options:
-  -p, --profile TEXT    Which AWS profile to use
-  -r, --region TEXT     Which AWS region to use
-  -u, --user TEXT       Which user to connect as
-  --private / --public  Connect to the instance's private or public IP
-  -k, --key-file FILE   Which key file to use to connect
-  --scrollback INTEGER RANGE
-                        Lines of scrollback per shell. Defaults to your tmux or
-                        Windows Terminal setting, else 1000.  [x>=0]
-  --help                Show this message and exit.
-```
-
-## EMR
-
-Select the EMR cluster, instance group, and instance to connect to.
-
-```shell
-$ aws_ssh emr --help
-Usage: aws_ssh emr [OPTIONS]
-
-  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSH session to the instance
-
-Options:
-  -p, --profile TEXT    Which AWS profile to use
-  -r, --region TEXT     Which AWS region to use
-  -u, --user TEXT       Which user to connect as
-  --private / --public  Connect to the instance's private or public IP
-  -k, --key-file FILE   Which key file to use to connect
-  --scrollback INTEGER RANGE
-                        Lines of scrollback per shell. Defaults to your tmux or
-                        Windows Terminal setting, else 1000.  [x>=0]
-  --help                Show this message and exit.
-```
-
-## EMR All
-
-Select the EMR cluster to connect to. Then creates a new TMUX session with a window per instance. Each window will have an SSH connection to that instance open.
-
-```shell
-$ aws_ssh emr-all --help
-Usage: aws_ssh emr-all [OPTIONS]
-
-  Asks user which Cluster and EC2 instance they want to connect to, Then
-  prints a tmux cli statement that will open a new session with a window per
-  ec2 instance with ssh shell already opened.
-
-Options:
-  -p, --profile TEXT    Which AWS profile to use
-  -r, --region TEXT     Which AWS region to use
-  -u, --user TEXT       Which user to connect as
-  --private / --public  Connect to the instance's private or public IP
-  -k, --key-file FILE   Which key file to use to connect
-  --help                Show this message and exit.
-```
+# AWS SSH Utils
+
+[![Version](https://img.shields.io/pypi/v/aws-ssh-utils.svg)](https://pypi.org/project/aws-ssh-utils/)
+[![License](https://img.shields.io/pypi/l/aws-ssh-utils.svg)](#)
+[![Supported Python Versions](https://img.shields.io/pypi/pyversions/aws-ssh-utils.svg)](https://pypi.org/project/aws-ssh-utils/)
+
+```shell
+uvx aws-ssh-utils
+
+uvx aws-ssh-utils app  # optional - `app` is default.
+uvx aws-ssh-utils ec2
+uvx aws-ssh-utils emr
+uvx aws-ssh-utils emr-all
+
+# Also exposed as `aws_ssh`
+uvx --from aws-ssh-utils aws_ssh
+```
+
+This allows you to interactively SSH to an EC2 instance, EMR instance, or all EMR instances with TMUX.
+
+It utilizes [questionary](https://pypi.org/project/questionary/) to ask you which instance you want to connect to.
+
+## App
+
+Terminal UI to browse EC2 instances and EMR clusters, with SSM or SSH shells in tabs.
+It's the default command, so `aws_ssh` and `aws_ssh -p my-profile` launch it too.
+Each connection tries, in order: `~/.ssh/config`, a keyless AWS SSM shell, opkssh (via instance/cluster tags),
+the instance's EC2 key found in `~/.ssh`, then your default keys/ssh-agent.
+SSM uses `aws ssm start-session --target INSTANCE_ID` with the selected profile and region. It requires the AWS CLI,
+`session-manager-plugin`, and Session Manager access to the instance, but no SSH key, SSH server, or inbound port 22.
+The shell runs as the Session Manager configured user (usually `ssm-user`); SSH usernames and key options only apply
+to SSH connections. The `ec2` and `emr` commands use the same connection order; `emr-all` still uses SSH in tmux.
+For SSH connections, unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
+
+```shell
+$ aws_ssh app --help
+Usage: aws_ssh app [OPTIONS]
+
+  Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs.
+
+Options:
+  -p, --profile TEXT          Which AWS profile to use
+  -r, --region TEXT           Which AWS region to use
+  --scrollback INTEGER RANGE  Lines of scrollback per shell. Defaults to your
+                              tmux or Windows Terminal setting, else 1000.
+                              [x>=0]
+  --help                      Show this message and exit.
+```
+
+Scroll back with the mouse wheel or `shift+PgUp`/`shift+PgDn`; typing jumps back to the prompt.
+`F12` shows/hides the sidebar, `ctrl+w` closes a failed tab, `ctrl+q` quits. Every other key goes to the focused shell.
+Logs are viewable with `textual console`.
+
+To keep diagnostics and crash tracebacks in a file, use the global `--log-file` option:
+
+```shell
+aws-ssh-utils --log-file ./aws-ssh.log --verbose --profile my-profile
+# Also works before an explicit command:
+aws-ssh-utils --log-file ./aws-ssh.log ec2 --profile my-profile
+```
+
+Alternatively, set `AWS_SSH_LOG_FILE` to the file path. Logs append across runs and rotate at 10 MB,
+keeping up to three rotated files. `--verbose` includes debug diagnostics; `--quiet` only suppresses
+console logging. File logs include the version, source location, and error tracebacks, without local
+variable dumps or a recording of shell input/output.
+
+## EC2
+
+Select an instance from an interactive list. You can filter the instances by name.
+
+```shell
+$ aws_auth ec2 --help
+Usage: aws_ssh ec2 [OPTIONS]
+
+  Asks user which EC2 instance they want to connect to, then opens an
+  interactive SSM or SSH session to the instance
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file FILE   Which key file to use to connect
+  --scrollback INTEGER RANGE
+                        Lines of scrollback per shell. Defaults to your tmux or
+                        Windows Terminal setting, else 1000.  [x>=0]
+  --help                Show this message and exit.
+```
+
+## EMR
+
+Select the EMR cluster, instance group, and instance to connect to.
+
+```shell
+$ aws_ssh emr --help
+Usage: aws_ssh emr [OPTIONS]
+
+  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSM or SSH session to the instance
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file FILE   Which key file to use to connect
+  --scrollback INTEGER RANGE
+                        Lines of scrollback per shell. Defaults to your tmux or
+                        Windows Terminal setting, else 1000.  [x>=0]
+  --help                Show this message and exit.
+```
+
+## EMR All
+
+Select the EMR cluster to connect to. Then creates a new TMUX session with a window per instance. Each window will have an SSH connection to that instance open.
+
+```shell
+$ aws_ssh emr-all --help
+Usage: aws_ssh emr-all [OPTIONS]
+
+  Asks user which Cluster and EC2 instance they want to connect to, Then
+  prints a tmux cli statement that will open a new session with a window per
+  ec2 instance with ssh shell already opened.
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file FILE   Which key file to use to connect
+  --help                Show this message and exit.
+```

aws_ssh_utils-0.3.1/aws_ssh_utils/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.1"

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/aws_ssh_utils/cli_utils.py

@@ -26,6 +26,7 @@ from rich.text import Text
 
 from aws_ssh_utils.commands.healthcheck import is_aws_ssm_installed, is_opkssh_installed
 from aws_ssh_utils.connection import Attempt, Environment, Target, connect, open_shell_channel
+from aws_ssh_utils.logging_utils import terminal_logging
 from aws_ssh_utils.terminal import ShellApp
 
 P = ParamSpec('P')
@@ -202,10 +203,8 @@ def open_shell(target: Target, env: Environment, title: str, scrollback: int | N
         channel.send(initial_input)
 
     set_terminal_title(title)
-    # Logs, e.g. AWS SSM's stderr, would draw over the full-screen shell.
-    logger.disable('aws_ssh_utils')
     try:
-        ShellApp(result.via, result.client, channel, detect_scrollback() if scrollback is None else scrollback).run()
+        with terminal_logging():
+            ShellApp(result.via, result.client, channel, detect_scrollback() if scrollback is None else scrollback).run()
     finally:
-        logger.enable('aws_ssh_utils')
         set_terminal_title()

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/aws_ssh_utils/commands/app.py

@@ -14,10 +14,9 @@ from rich.markup import escape
 from rich.spinner import Spinner
 from rich.text import Text
 from textual import work
-from textual.app import App, ComposeResult
+from textual.app import ComposeResult
 from textual.binding import Binding, BindingType
 from textual.containers import Horizontal
-from textual.logging import TextualHandler
 from textual.widgets import Footer, Input, OptionList, RichLog, Static, TabbedContent, TabPane, Tree
 from textual.widgets.option_list import Option
 from textual.widgets.tree import TreeNode
@@ -26,6 +25,7 @@ from aws_ssh_utils.cli_utils import detect_environment, detect_scrollback, rende
 from aws_ssh_utils.connection import Attempt, Environment, Target, connect, open_shell_channel
 from aws_ssh_utils.ec2_utils import ec2_name, ec2_target, get_running_ec2_instances
 from aws_ssh_utils.emr_utils import emr_target, get_emr_clusters, get_emr_instances, group_role, group_sort_key
+from aws_ssh_utils.logging_utils import LoggedApp, terminal_logging
 from aws_ssh_utils.terminal import ShellStatus, Terminal
 
 if TYPE_CHECKING:
@@ -48,21 +48,19 @@ ANIMATION_INTERVAL = 1 / 12
 @click.option('-r', '--region', default=None, help='Which AWS region to use')
 @scrollback_option
 def app(profile: str | None = None, region: str | None = None, scrollback: int | None = None, **kwargs: Any):
-    """Browse EC2 instances and EMR clusters, and open SSH shells in tabs."""
+    """Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs."""
     try:
         session = boto3.Session(profile_name=profile, region_name=region)
         session.client('sts').get_caller_identity()
     except (BotoCoreError, ClientError) as e:
+        logger.bind(file_only=True).opt(exception=e).error('AWS authentication failed')
         Console().print(f"[red]✗[/] {escape(str(e))}")
         sys.exit(1)
 
-    # loguru holds on to the real stdout, which would draw over the TUI. View logs with `textual console`.
-    logger.remove()
-    logger.add(TextualHandler(), format="{message}")
-
     env = detect_environment(profile, session.region_name)
     scrollback = detect_scrollback() if scrollback is None else scrollback
-    SSHApp(session.client('ec2'), session.client('emr'), env, scrollback).run()
+    with terminal_logging():
+        SSHApp(session.client('ec2'), session.client('emr'), env, scrollback).run()
 
 
 def muted_label(name: str, instance_id: str) -> Text:
@@ -112,10 +110,10 @@ class ShellPane(TabPane):
     def update_label(self):
         icon = cast(Text, self.spinner.render(time.monotonic())) if self.status == 'connecting' else STATUS_ICONS[self.status]
         self.query_ancestor(TabbedContent).get_tab(self).label = Text.assemble(icon, ' ', self.title_)
-        self.query_one('.attempts', Static).update(render_attempts(self.attempts))
 
     def set_attempts(self, attempts: list[Attempt]):
         self.attempts = attempts
+        self.query_one('.attempts', Static).update(render_attempts(self.attempts))
         self.update_label()
 
     def set_status(self, status: Status):
@@ -154,16 +152,20 @@ class ShellPane(TabPane):
         self.app.call_from_thread(self.attach, result.via, Terminal(result.client, channel, self.scrollback))
 
     async def attach(self, via: str, terminal: Terminal):
+        logger.info('Shell tab {} connected via {}', self.id, via)
+        # Stop animation before yielding to widget removal or mounting a reader
+        # that may immediately close the session.
+        self.set_status('connected')
         await self.query_one(RichLog).remove()
         await self.query_one('.attempts').remove()
         await self.mount(ShellStatus(via), terminal)
-        self.set_status('connected')
 
     def on_terminal_closed(self):
+        logger.info('Shell tab {} closed', self.id)
         self.query_ancestor(TabbedContent).remove_pane(self.id or '')
 
 
-class SSHApp(App[None]):
+class SSHApp(LoggedApp):
     """The textual app"""
 
     TITLE = "AWS SSH"
@@ -252,9 +254,16 @@ class SSHApp(App[None]):
         if shells.active:
             shells.remove_pane(shells.active)
 
+    def on_tabbed_content_tab_activated(self, event: TabbedContent.TabActivated):
+        if event.tabbed_content.id != 'shells' or event.pane.id != event.tabbed_content.active:
+            return
+        if terminals := event.pane.query(Terminal):
+            terminals.first().focus()
+
     def open_shell(self, title: str, resolve: Callable[[], Target]):
         shells = self.query_one('#shells', TabbedContent)
         pane = ShellPane(title, resolve, self.env, self.scrollback, id=f'shell-{next(self.pane_ids)}')
+        logger.info('Opening shell tab {} ({})', pane.id, title)
         shells.add_pane(pane)
         shells.active = pane.id or ''
 

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/aws_ssh_utils/commands/ec2.py

@@ -41,7 +41,7 @@ def ec2(
 ):
     """
     Asks user which EC2 instance they want to connect to,
-    then opens an interactive SSH session to the instance
+    then opens an interactive SSM or SSH session to the instance
     """
     session = boto3.Session(profile_name=profile, region_name=region)
     ec2_client = session.client('ec2')

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/aws_ssh_utils/commands/emr.py

@@ -45,7 +45,7 @@ def emr(
 ):
     """
     Asks user which Cluster and EC2 instance they want to connect to,
-    then opens an interactive SSH session to the instance
+    then opens an interactive SSM or SSH session to the instance
     """
     session = boto3.Session(profile_name=profile, region_name=region)
     emr_client = session.client('emr')
@@ -65,9 +65,11 @@ def emr(
     with spinner():
         target = emr_target(emr_client, cluster_id, instance_ip.instance_id or '', ip)
     target = replace(target, user=user or target.user, key_file=key_file)
+    env = detect_environment(profile, session.region_name)
 
     if (
-        key_file is None
+        not env.ssm_installed
+        and key_file is None
         and target.opkssh_provider is None
         and find_ssh_key_file(target.key_name) is None
         and not questionary.confirm(f'Could not find the ssh key {target.key_name}, would you like to continue?').unsafe_ask()
@@ -78,7 +80,7 @@ def emr(
     postfix = f'[{group_idx}]' if group_idx else ''
     open_shell(
         target,
-        detect_environment(profile, session.region_name),
+        env,
         title=f'{cluster_name} - {group}{postfix}',
         scrollback=scrollback,
         initial_input=CORE_NODE_INPUT if group.lower().startswith('core') else b'',

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/aws_ssh_utils/connection.py

@@ -1,4 +1,4 @@
-"""SSH connection strategies, tried in order until one succeeds."""
+"""SSM and SSH connection strategies, tried in order until one succeeds."""
 
 import os
 import shlex
@@ -18,6 +18,8 @@ import paramiko
 from loguru import logger
 from typing_extensions import override
 
+from aws_ssh_utils.session import ShellChannel, SSMSession
+
 # CSV of issuer,client
 OPKSSH_PROVIDER_TAG = 'opkssh_provider'
 # EMR doesn't support comma's in tags.
@@ -54,7 +56,7 @@ class Environment:
 
 @dataclass(frozen=True)
 class Connection:
-    client: paramiko.SSHClient
+    client: paramiko.SSHClient | SSMSession
     via: str
     """How the connection was made: AWS SSM, opkssh, a key name, ..."""
 
@@ -64,7 +66,7 @@ class Attempt:
     via: str
     command: str
     """The equivalent command line, to retry by hand."""
-    open_client: Callable[[], paramiko.SSHClient] = field(repr=False, compare=False)
+    open_client: Callable[[], paramiko.SSHClient | SSMSession] = field(repr=False, compare=False)
     state: Literal['pending', 'connecting', 'connected', 'failed', 'skipped'] = 'pending'
     detail: str = ''
     """The error when failed, the reason when skipped."""
@@ -85,7 +87,7 @@ def connect(
 
     Tried in order:
     1. ~/.ssh/config, when a Host pattern (other than `*`) matches the instance id, an alias or the IP.
-    2. SSH over AWS SSM to the instance id, with any existing opkssh/EC2 key plus the default keys.
+    2. A keyless AWS SSM shell, authenticated with the AWS profile.
     3. opkssh, when the instance/cluster has opkssh tags. May open a browser login.
     4. The EC2 key pair (or `target.key_file`), when a matching file is found in ~/.ssh.
     5. The ssh-agent and default ~/.ssh/id_* keys.
@@ -96,6 +98,24 @@ def connect(
     open_ssh_ = partial(open_ssh, confirm_host_key=confirm_host_key)
     attempts: list[Attempt] = []
 
+    def try_attempt(i: int) -> Connection | None:
+        attempt = attempts[i]
+        if attempt.state == 'skipped':
+            on_progress(list(attempts))
+            return None
+        attempts[i] = replace(attempt, state='connecting')
+        on_progress(list(attempts))
+        try:
+            client = attempt.open_client()
+        except Exception as e:
+            logger.debug(f"Failed to connect via {attempt.via}: {e!r}")
+            attempts[i] = replace(attempt, state='failed', detail=str(e) or type(e).__name__)
+            on_progress(list(attempts))
+            return None
+        attempts[i] = replace(attempt, state='connected')
+        on_progress(list(attempts))
+        return Connection(client, attempt.via)
+
     config = find_ssh_config(target)
     if config is not None:
         alias, options = config
@@ -107,21 +127,18 @@ def connect(
             ),
         )
 
-    ec2_key = target.key_file or find_ssh_key_file(target.key_name)
-    known_keys = [k for k in (valid_opkssh_key_file(target.opkssh_provider), ec2_key) if k]
-    ssm_proxy = ssm_command(target.instance_id, env)
-    ssm = Attempt(
-        "AWS SSM",
-        ssh_command(target.user, target.instance_id, known_keys, proxy=ssm_proxy),
-        lambda: open_ssh_(
-            target.instance_id,
-            target.user,
-            known_keys,
-            use_defaults=True,
-            sock=proxy_socket(ssm_proxy, on_output),
-        ),
+    command = ssm_command(target.instance_id, env)
+    ssm = Attempt('AWS SSM', shlex.join(command), lambda: SSMSession.open(command))
+    attempts.append(
+        ssm if env.ssm_installed else replace(ssm, state='skipped', detail="AWS CLI or session-manager-plugin not installed"),
     )
-    attempts.append(ssm if env.ssm_installed else replace(ssm, state='skipped', detail="session-manager-plugin not installed"))
+    for i in range(len(attempts)):
+        if result := try_attempt(i):
+            return result
+
+    # Key discovery is only needed for the remaining SSH fallbacks.
+    fallback_start = len(attempts)
+    ec2_key = target.key_file or find_ssh_key_file(target.key_name)
 
     if (provider := target.opkssh_provider) is not None:
         opkssh_key = str(opkssh_key_path(provider))
@@ -150,21 +167,9 @@ def connect(
         ),
     )
 
-    for i, attempt in enumerate(attempts):
-        if attempt.state == 'skipped':
-            continue
-        attempts[i] = replace(attempt, state='connecting')
-        on_progress(list(attempts))
-        try:
-            client = attempt.open_client()
-        except Exception as e:
-            logger.debug(f"Failed to connect via {attempt.via}: {e!r}")
-            attempts[i] = replace(attempt, state='failed', detail=str(e) or type(e).__name__)
-            on_progress(list(attempts))
-            continue
-        attempts[i] = replace(attempt, state='connected')
-        on_progress(list(attempts))
-        return Connection(client, attempt.via)
+    for i in range(fallback_start, len(attempts)):
+        if result := try_attempt(i):
+            return result
     return None
 
 
@@ -226,7 +231,9 @@ def ssh_command(
     return shlex.join([*cmd, f'{user}@{host}'])
 
 
-def open_shell_channel(client: paramiko.SSHClient) -> paramiko.Channel:
+def open_shell_channel(client: paramiko.SSHClient | SSMSession) -> ShellChannel:
+    if isinstance(client, SSMSession):
+        return client
     channel = client.get_transport().open_session()  # pyright: ignore[reportOptionalMemberAccess]
     channel.get_pty(term='xterm-256color')
     channel.invoke_shell()
@@ -301,10 +308,6 @@ def ssm_command(instance_id: str, env: Environment) -> list[str]:
         'start-session',
         '--target',
         instance_id,
-        '--document-name',
-        'AWS-StartSSHSession',
-        '--parameters',
-        'portNumber=22',
     ]
     if env.profile:
         cmd += ['--profile', env.profile]

aws_ssh_utils-0.3.1/aws_ssh_utils/logging_utils.py

@@ -0,0 +1,37 @@
+"""Keep diagnostics available without drawing over the full-screen terminal."""
+
+import sys
+from collections.abc import Iterator
+from contextlib import contextmanager
+
+from loguru import logger
+from textual.app import App
+from typing_extensions import override
+
+_terminal_active = False
+
+
+def write_console(message: str) -> None:
+    # Worker threads don't inherit Textual's active-app context. Suppress the
+    # console process-wide while the UI runs; file logging remains enabled.
+    if not _terminal_active:
+        sys.stdout.write(message)
+
+
+@contextmanager
+def terminal_logging() -> Iterator[None]:
+    global _terminal_active
+    previous = _terminal_active
+    _terminal_active = True
+    try:
+        yield
+    finally:
+        _terminal_active = previous
+
+
+class LoggedApp(App[None]):
+    @override
+    def _handle_exception(self, error: Exception) -> None:
+        # Textual handles UI errors internally instead of raising from run().
+        logger.opt(exception=error).error('Unhandled {} error', type(self).__name__)
+        super()._handle_exception(error)

aws_ssh_utils-0.3.1/aws_ssh_utils/session.py

@@ -0,0 +1,128 @@
+"""Terminal channels for native, keyless Session Manager shells."""
+
+import os
+import queue
+import re
+import threading
+import time
+from typing import Protocol, cast
+
+
+class ShellChannel(Protocol):
+    def recv(self, nbytes: int, /) -> bytes: ...
+    def send(self, data: bytes, /) -> int: ...
+    def resize_pty(self, width: int, height: int) -> None: ...
+
+
+class ShellClient(Protocol):
+    def close(self) -> None: ...
+
+
+class Pty(Protocol):
+    def read(self, size: int) -> str: ...
+    def write(self, data: str) -> int: ...
+    def setwinsize(self, rows: int, cols: int) -> None: ...
+    def close(self, force: bool = False) -> None: ...
+
+
+def spawn_pty(command: list[str]) -> Pty:
+    """SSM needs a real terminal for raw input, control keys, and window sizes."""
+    env = {**os.environ, 'TERM': 'xterm-256color', 'AWS_PAGER': '', 'AWS_CLI_AUTO_PROMPT': 'off'}
+    if os.name == 'nt':
+        from winpty import PtyProcess
+
+        return cast(Pty, PtyProcess.spawn(command, env=env, dimensions=(24, 80)))
+
+    from ptyprocess import PtyProcessUnicode
+
+    return cast(Pty, PtyProcessUnicode.spawn(command, env=env, dimensions=(24, 80), echo=False))
+
+
+class SSMSession:
+    """Adapt an AWS CLI pseudo-terminal to the terminal widget's channel interface."""
+
+    def __init__(self, process: Pty):
+        self.process = process
+        self.closed = False
+        self._output: queue.Queue[bytes | Exception | None] = queue.Queue()
+        self._pending = b''
+        self._eof = False
+        threading.Thread(target=self._read, daemon=True).start()
+
+    @classmethod
+    def open(cls, command: list[str], timeout: float = 30) -> 'SSMSession':
+        session = cls(spawn_pty(command))
+        try:
+            session._wait_started(timeout)
+        except BaseException:
+            session.close()
+            raise
+        return session
+
+    def _read(self):
+        try:
+            while not self.closed:
+                data = self.process.read(65536)
+                if data:
+                    self._output.put(data.encode('utf-8'))
+        except EOFError:
+            pass
+        except Exception as e:
+            if not self.closed:
+                self._output.put(e)
+        finally:
+            self._output.put(None)
+
+    def _wait_started(self, timeout: float):
+        """Keep startup output for the terminal, but report CLI failures to the fallback list."""
+        deadline = time.monotonic() + timeout
+        output = bytearray()
+        try:
+            while True:
+                data = self._output.get(timeout=max(0, deadline - time.monotonic()))
+                if isinstance(data, Exception):
+                    raise OSError(str(data)) from data
+                if data is None:
+                    raise OSError(output.decode('utf-8', errors='replace').strip() or 'SSM exited before starting a session')
+                output.extend(data)
+                # ConPTY adds terminal escape sequences to console output on Windows.
+                text = re.sub(rb'\x1b\[[0-?]*[ -/]*[@-~]', b'', output)
+                if re.search(rb'Starting session with SessionId:\s*\S+', text):
+                    self._pending = bytes(output)
+                    return
+        except queue.Empty:
+            detail = output.decode('utf-8', errors='replace').strip()
+            raise TimeoutError(f'Timed out starting SSM session{": " + detail if detail else ""}') from None
+
+    def recv(self, nbytes: int) -> bytes:
+        if nbytes <= 0:
+            return b''
+        while not self._pending and not self._eof:
+            data = self._output.get()
+            if isinstance(data, Exception):
+                raise OSError(str(data)) from data
+            if data is None:
+                self._eof = True
+            else:
+                self._pending = data
+        data, self._pending = self._pending[:nbytes], self._pending[nbytes:]
+        return data
+
+    def send(self, data: bytes) -> int:
+        try:
+            self.process.write(data.decode('utf-8'))
+        except EOFError as e:
+            raise OSError('SSM session is closed') from e
+        return len(data)
+
+    def resize_pty(self, width: int, height: int):
+        if not self.closed:
+            self.process.setwinsize(height, width)
+
+    def close(self):
+        if not self.closed:
+            self.closed = True
+            try:
+                self.process.close(force=True)
+            finally:
+                self._output.put(None)

aws_ssh_utils-0.3.1/aws_ssh_utils/ssh.py

@@ -0,0 +1,124 @@
+import sys
+from pathlib import Path
+from typing import Any
+
+import click
+from loguru import logger
+from textual.logging import TextualHandler
+from typing_extensions import override
+
+import aws_ssh_utils
+from aws_ssh_utils.commands.app import app
+from aws_ssh_utils.commands.ec2 import ec2
+from aws_ssh_utils.commands.emr import emr
+from aws_ssh_utils.commands.emr_all import emr_all
+from aws_ssh_utils.commands.healthcheck import healthcheck
+from aws_ssh_utils.logging_utils import write_console
+
+
+class DefaultCommandGroup(click.Group):
+    """Runs `default_command` when no subcommand is given, e.g. `aws_ssh -p prod` -> `aws_ssh app -p prod`.
+
+    Skip group options and their values before looking for the subcommand.
+    """
+
+    def __init__(self, *args: Any, default_command: str, **kwargs: Any):
+        super().__init__(*args, **kwargs)
+        self.default_command = default_command
+
+    @override
+    def parse_args(self, ctx: click.Context, args: list[str]) -> list[str]:
+        group_options = {opt: param for param in self.get_params(ctx) for opt in (*param.opts, *param.secondary_opts)}
+        idx = 0
+        while idx < len(args):
+            name, separator, _ = args[idx].partition('=')
+            param = group_options.get(name)
+            if not isinstance(param, click.Option):
+                break
+            idx += 1
+            if not param.is_flag and not param.count and not separator:
+                if len(args) < idx + param.nargs:
+                    return super().parse_args(ctx, args)
+                idx += param.nargs
+        if idx == len(args) or args[idx].startswith('-'):
+            args = [*args[:idx], self.default_command, *args[idx:]]
+        return super().parse_args(ctx, args)
+
+
+@click.group(cls=DefaultCommandGroup, default_command='app')
+@click.option('-ll/', '--long-log/--no-long-log', default=False, help='Enable long logging')
+@click.option('--verbose/--no-verbose', default=False, help='Enable debug logging')
+@click.option('--quiet/--no-quiet', default=False, help='Disable console logging')
+@click.option(
+    '--log-file',
+    type=click.Path(dir_okay=False, path_type=Path),
+    envvar='AWS_SSH_LOG_FILE',
+    help='Append diagnostics and tracebacks to this file. Also settable with AWS_SSH_LOG_FILE.',
+)
+@click.pass_context
+def cli(
+    ctx: click.Context,
+    long_log: bool = False,
+    verbose: bool = False,
+    quiet: bool = False,
+    log_file: Path | None = None,
+    **kwargs: Any,
+):
+    """Runs `app` when no command is given."""
+    log_format = (
+        (
+            "<green>{time:YYYY-MM-DD HH:mm:ss.SSS}</green> | "
+            "<level>{level: <8}</level> | "
+            "<cyan>{name}</cyan>:<cyan>{function}</cyan>:<cyan>{line}</cyan> - <level>{message}</level>"
+        )
+        if long_log
+        else "<level>{message}</level>"
+    )
+    level = 100 if quiet else "DEBUG" if verbose else "INFO"
+
+    logger.remove()
+    # Route to Textual's console when an app is active, and stdout otherwise.
+    # Keep the file sink active through both full-screen and questionary flows.
+    logger.add(
+        write_console,
+        level=level,
+        format=log_format,
+        colorize=True,
+        diagnose=False,
+        backtrace=False,
+        filter=lambda record: not record['extra'].get('file_only'),
+    )
+    logger.add(
+        TextualHandler(stderr=False, stdout=False),
+        level=level,
+        format='{message}',
+        diagnose=False,
+        backtrace=False,
+        filter=lambda record: not record['extra'].get('file_only'),
+    )
+    if log_file is not None:
+        try:
+            sink = logger.add(
+                log_file,
+                level='DEBUG' if verbose else 'INFO',
+                format='{time:YYYY-MM-DD HH:mm:ss.SSS Z} | {level: <8} | {name}:{function}:{line} | {message}',
+                encoding='utf-8',
+                colorize=False,
+                diagnose=False,
+                backtrace=False,
+                rotation='10 MB',
+                retention=3,
+            )
+        except OSError as error:
+            raise click.ClickException(f'Cannot open log file {log_file}: {error}') from error
+        ctx.call_on_close(lambda: logger.remove(sink))
+        logger.bind(file_only=True).info(
+            'aws-ssh-utils {}; Python {}; source={}',
+            aws_ssh_utils.__version__,
+            sys.version.split()[0],
+            aws_ssh_utils.__file__,
+        )
+
+
+for command in (app, ec2, emr, emr_all, healthcheck):
+    cli.add_command(command)

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/aws_ssh_utils/terminal.py

@@ -1,4 +1,4 @@
-"""Textual widgets rendering a paramiko shell channel through the pyte VT100 emulator."""
+"""Textual widgets rendering SSH and SSM shell channels through the pyte VT100 emulator."""
 
 import datetime as dt
 import time
@@ -7,14 +7,14 @@ from collections.abc import Sequence
 from functools import lru_cache
 from typing import Any
 
-import paramiko
 import pyte
+from loguru import logger
 from pyte.screens import Char, Margins
 from rich.segment import Segment
 from rich.style import Style
 from rich.text import Text
 from textual import events, work
-from textual.app import App, ComposeResult
+from textual.app import ComposeResult
 from textual.containers import Horizontal
 from textual.message import Message
 from textual.strip import Strip
@@ -22,6 +22,9 @@ from textual.widget import Widget
 from textual.widgets import Static
 from typing_extensions import override
 
+from aws_ssh_utils.logging_utils import LoggedApp
+from aws_ssh_utils.session import ShellChannel, ShellClient
+
 KEYS = {
     'enter': '\r',
     'tab': '\t',
@@ -108,7 +111,7 @@ def cell_style(
 class ChannelScreen(pyte.Screen):
     """Answers terminal queries over the channel, and keeps the lines scrolled off the top as history."""
 
-    def __init__(self, channel: paramiko.Channel, columns: int, lines: int, scrollback: int = 0):
+    def __init__(self, channel: ShellChannel, columns: int, lines: int, scrollback: int = 0):
         super().__init__(columns, lines)
         self.channel = channel
         self.history: deque[tuple[Char, ...]] = deque(maxlen=scrollback)
@@ -119,6 +122,14 @@ class ChannelScreen(pyte.Screen):
     def write_process_input(self, data: str):
         self.channel.send(data.encode())
 
+    @override
+    def select_graphic_rendition(self, *attrs: int, private: bool = False):
+        # Vim queries modifyOtherKeys with CSI ? 4 m. pyte 0.8.2 dispatches it
+        # here, but its SGR handler rejects `private`, killing the reader worker.
+        # Ignore unsupported keyboard queries without changing text attributes.
+        if not private:
+            super().select_graphic_rendition(*attrs)
+
     @override
     def index(self):
         top, bottom = self.margins or Margins(0, self.lines - 1)
@@ -145,7 +156,7 @@ class Terminal(Widget, can_focus=True):
     class Closed(Message):
         pass
 
-    def __init__(self, client: paramiko.SSHClient, channel: paramiko.Channel, scrollback: int = 0, **kwargs: object):
+    def __init__(self, client: ShellClient, channel: ShellChannel, scrollback: int = 0, **kwargs: object):
         super().__init__(**kwargs)  # pyright: ignore[reportArgumentType]
         self.client = client
         self.channel = channel
@@ -167,8 +178,15 @@ class Terminal(Widget, can_focus=True):
             while data := self.channel.recv(65536):
                 self.app.call_from_thread(self.feed, data)
         except OSError:
-            pass
-        self.post_message(self.Closed())
+            logger.exception('Terminal channel read failed')
+        except Exception:
+            logger.exception('Terminal reader failed')
+            raise
+        finally:
+            # Unexpected parser errors must also tear down the dead session.
+            # Textual records the worker exception, but exit_on_error=False
+            # would otherwise leave the last frame looking like a live terminal.
+            self.post_message(self.Closed())
 
     def feed(self, data: bytes):
         history_size = len(self.vt.history)
@@ -226,7 +244,9 @@ class Terminal(Widget, can_focus=True):
     def render_line(self, y: int) -> Strip:
         vt = self.vt
         if y >= vt.lines:
-            return Strip.blank(self.size.width)
+            # Layout may grow before on_resize updates pyte. Textual's color
+            # filters require a Style even for these temporary blank rows.
+            return Strip.blank(self.size.width, Style())
 
         index = len(vt.history) - self.scrolled + y
         if index < len(vt.history):
@@ -281,13 +301,13 @@ class ShellStatus(Horizontal):
         self.query_one('.duration', Static).update(f"{hours:02}:{minutes:02}:{seconds:02}")
 
 
-class ShellApp(App[None]):
+class ShellApp(LoggedApp):
     """A single full-screen shell, exits when the shell closes."""
 
     # Its priority ctrl+p binding would steal shell history navigation from the terminal.
     ENABLE_COMMAND_PALETTE = False
 
-    def __init__(self, via: str, client: paramiko.SSHClient, channel: paramiko.Channel, scrollback: int = 0):
+    def __init__(self, via: str, client: ShellClient, channel: ShellChannel, scrollback: int = 0):
         super().__init__()
         self.via = via
         self.client = client

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.1}/pyproject.toml

@@ -34,6 +34,8 @@ dependencies = [
   "loguru",
   "paramiko",
   "pyte>=0.8.2",
+  "ptyprocess>=0.7.0; sys_platform != 'win32'",
+  "pywinpty>=3.0.0; sys_platform == 'win32'",
   "questionary",
   "requests>=2.34.2",
   "rich>=15.0.0",

aws_ssh_utils-0.2.7/aws_ssh_utils/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.7"

aws_ssh_utils-0.2.7/aws_ssh_utils/ssh.py

@@ -1,65 +0,0 @@
-import sys
-from typing import Any
-
-import click
-from loguru import logger
-from typing_extensions import override
-
-from aws_ssh_utils.commands.app import app
-from aws_ssh_utils.commands.ec2 import ec2
-from aws_ssh_utils.commands.emr import emr
-from aws_ssh_utils.commands.emr_all import emr_all
-from aws_ssh_utils.commands.healthcheck import healthcheck
-
-
-class DefaultCommandGroup(click.Group):
-    """Runs `default_command` when no subcommand is given, e.g. `aws_ssh -p prod` -> `aws_ssh app -p prod`.
-
-    Assumes all group options are flags, so the first argument that isn't one is where the subcommand goes.
-    """
-
-    def __init__(self, *args: Any, default_command: str, **kwargs: Any):
-        super().__init__(*args, **kwargs)
-        self.default_command = default_command
-
-    @override
-    def parse_args(self, ctx: click.Context, args: list[str]) -> list[str]:
-        group_options = {opt for param in self.get_params(ctx) for opt in (*param.opts, *param.secondary_opts)}
-        idx = next((i for i, arg in enumerate(args) if arg not in group_options), len(args))
-        if idx == len(args) or args[idx].startswith('-'):
-            args = [*args[:idx], self.default_command, *args[idx:]]
-        return super().parse_args(ctx, args)
-
-
-@click.group(cls=DefaultCommandGroup, default_command='app')
-@click.option('-ll/', '--long-log/--no-long-log', default=False, help='Enable long logging')
-@click.option('--verbose/--no-verbose', default=False, help='Enable debug logging')
-@click.option('--quiet/--no-quiet', default=False, help='Disable logging')
-def cli(
-    long_log: bool = False,
-    verbose: bool = False,
-    quiet: bool = False,
-    **kwargs: Any,
-):
-    """Runs `app` when no command is given."""
-    log_format = (
-        (
-            "<green>{time:YYYY-MM-DD HH:mm:ss.SSS}</green> | "
-            "<level>{level: <8}</level> | "
-            "<cyan>{name}</cyan>:<cyan>{function}</cyan>:<cyan>{line}</cyan> - <level>{message}</level>"
-        )
-        if long_log
-        else "<level>{message}</level>"
-    )
-    level = "DEBUG" if verbose else 100 if quiet else "INFO"
-
-    def to_stdout(message: str):
-        # Look up sys.stdout per message, so rich.live can redirect it above its display.
-        sys.stdout.write(message)
-
-    logger.remove()
-    logger.add(to_stdout, level=level, format=log_format, colorize=True)
-
-
-for command in (app, ec2, emr, emr_all, healthcheck):
-    cli.add_command(command)