feat: add pure ssh2 remote operations

pi-permission-system/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -25,6 +25,7 @@ import { describePathGate } from "./path";
 import type { GateRunner } from "./runner";
 import { describeSkillReadGate } from "./skill-read";
 import { describeToolGate } from "./tool";
+import { applyShellDecisionFloor } from "./shell-decision-floor";
 import type { GateOutcome, ToolCallContext } from "./types";
 
 /**
@@ -164,25 +165,27 @@ export class ToolCallGatePipeline {
   ): { toolCheck: PermissionCheckResult; accessPath?: AccessPath } {
     if (shell) {
       if (bashProgram) {
+        const check = resolveBashCommandCheck(
+          bashProgram.commandText(),
+          bashProgram.commands(),
+          tcc.agentName ?? undefined,
+          this.resolver,
+        );
         return {
-          toolCheck: resolveBashCommandCheck(
-            bashProgram.commandText(),
-            bashProgram.commands(),
-            tcc.agentName ?? undefined,
-            this.resolver,
-          ),
+          toolCheck: applyShellDecisionFloor(check, shell.decisionFloor),
         };
       }
       // A shell invocation whose command did not parse (e.g. empty) still
       // resolves on the `bash` surface, so an aliased tool never falls through
       // to its own extension-tool surface.
+      const check = this.resolver.resolve({
+        kind: "tool",
+        surface: "bash",
+        input: { command: shell.command },
+        agentName: tcc.agentName ?? undefined,
+      });
       return {
-        toolCheck: this.resolver.resolve({
-          kind: "tool",
-          surface: "bash",
-          input: { command: shell.command },
-          agentName: tcc.agentName ?? undefined,
-        }),
+        toolCheck: applyShellDecisionFloor(check, shell.decisionFloor),
       };
     }