admin/my-pi
1
0
Fork 0
mirror of https://bitbucket.org/siakitem/my-pi.git synced 2026-08-28 08:35:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(pi-ssh): add reviewed agent connection flow

Browse Source
This commit is contained in:
云服务部-叶林立
2026-08-21 20:52:50 +08:00
parent 0ac50eb581
commit a7891f18bf
20 changed files with 208 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pi-ssh/extension-spec.md
+10 -7
View File
@@ -4,6 +4,7 @@
Pi and its default tools remain local. Explicit collision-free tools perform selected operations on one configured remote server:
- `ssh_connect`
- `ssh_read`
- `ssh_write`
- `ssh_edit`
@@ -26,13 +27,14 @@ ssh_config.sh import <alias>
→ encrypted vault is updated
```
The resulting host ID is the only runtime selector:
The resulting host ID is the only runtime selector. When a direct user request names that imported host as part of a concrete remote task, the agent calls:
```text
/ssh <host-id>[:/absolute/path]
pi --ssh <host-id>[:/absolute/path]
ssh_connect({ hostId: "<host-id>", remotePath?: "/absolute/or/~/path" })
```
`ssh_connect` is the only runtime connection surface. It is a model tool governed by `pi-permission-system`; there is no `/ssh` command, `--ssh` flag, session-resume reconnect, or user `!` remote-shell override.
Arbitrary `user@host`, port overrides, ProxyJump, and ProxyCommand are not supported in the first pure-ssh2 version. Unsupported imported configuration is rejected rather than ignored.
## Vault
@@ -71,7 +73,7 @@ One persistent `ssh2.Client` belongs to the active host. Connection loss fails c
### Shell
`ssh_bash` and explicit user `!` commands open exec channels. Commands run through `bash -lc` after changing to the selected remote cwd. Output streams through the normal Pi Bash operations callback. Abort or timeout closes the channel without reconnecting or replaying.
`ssh_bash` opens exec channels. Commands run through `bash -lc` after changing to the selected remote cwd. Output streams through the normal Pi Bash operations callback. Abort or timeout closes the channel without reconnecting or replaying.
### Files
@@ -103,6 +105,7 @@ Direct search commands remain denied through `ssh_bash`; structured search tools
There is one permission gate: `pi-permission-system`.
- `ssh_connect` defaults to `ask`; its preview resolves the imported host ID to the non-secret endpoint, port, and requested/default cwd before connection.
- `ssh_read`, `ssh_write`, `ssh_edit`, `ssh_find`, and `ssh_grep` default to `ask`.
- `ssh_bash` is a Bash-semantic `shellTools` alias with `decisionFloor: "ask"`.
- Bash hard denies remain denies.
@@ -111,8 +114,8 @@ There is one permission gate: `pi-permission-system`.
Evidence includes configured host ID, endpoint, port, remote cwd, and a bounded operation summary, never credentials.
## Session and UI
## Session lifecycle
The session stores only host ID, remote cwd, and remote home. Resume reloads current vault data and establishes a new ssh2 connection; failures fall back to local mode. `/ssh off` disposes the client and clears the status line.
Connections are created only by an approved `ssh_connect` call after session start. They are not persisted or automatically resumed. Connecting another imported host disposes the previous client, and session shutdown disposes the active client.
The system prompt states that default tools are local and `ssh_*` tools are remote. It does not include remote file content.
The system prompt states that default tools are local and `ssh_*` tools are remote after a connection becomes active. It does not include remote file content.