feat: add pure ssh2 remote operations

pi-permission-system/test/handlers/shell-tool-alias.test.ts

@@ -32,6 +32,14 @@ const execShellTools = {
   exec_command: { commandArgument: "cmd", workdirArgument: "workdir" },
 };
 
+const reviewedExecShellTools = {
+  exec_command: {
+    commandArgument: "cmd",
+    workdirArgument: "workdir",
+    decisionFloor: "ask" as const,
+  },
+};
+
 describe("shell-tool alias gating (#574)", () => {
   it("denies an aliased command that a bash: rule denies", async () => {
     const { handler, events } = makeHandler({
@@ -84,6 +92,37 @@ describe("shell-tool alias gating (#574)", () => {
     );
   });
 
+  it("raises an allowed aliased command to ask before execution", async () => {
+    const prompter = denyingPrompter();
+    const { handler, events } = makeHandler({
+      shellTools: reviewedExecShellTools,
+      tools: ["exec_command"],
+      prompter,
+      session: {
+        checkPermission: makeBashCommandCheck({
+          deny: /rm -rf/,
+          denyMatched: "rm -rf *",
+          allowMatched: "*",
+        }),
+      },
+    });
+
+    await handler.handleToolCall(
+      makeToolCallEvent("exec_command", { input: { cmd: "git status" } }),
+      makeCtx(),
+    );
+
+    expect(prompter.escalate).toHaveBeenCalledOnce();
+    expect(getDecisionEvents(events)).toContainEqual(
+      expect.objectContaining({
+        surface: "bash",
+        value: "git status",
+        result: "deny",
+        matchedPattern: "<shell-tool-decision-floor>",
+      }),
+    );
+  });
+
   it("decomposes a chained aliased command so a denied sub-command still blocks", async () => {
     const { handler, events } = makeHandler({
       shellTools: execShellTools,