feat(pi-ssh): add reviewed agent connection flow

pi-ssh/test/agent-connection.test.ts

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+import { parseConnectInput, SSH_CONNECT_TOOL_METADATA } from "../src/agent-connection.ts";
+
+test("defines the reviewed agent-controlled SSH connection tool", () => {
+  assert.equal(SSH_CONNECT_TOOL_METADATA.name, "ssh_connect");
+  assert.deepEqual(SSH_CONNECT_TOOL_METADATA.parameters.required, ["hostId"]);
+  assert.ok(SSH_CONNECT_TOOL_METADATA.parameters.properties.remotePath);
+  assert.deepEqual(parseConnectInput({ hostId: " packaging-server " }), { hostId: "packaging-server" });
+  assert.deepEqual(parseConnectInput({ hostId: "packaging-server", remotePath: "~/api" }), {
+    hostId: "packaging-server",
+    remotePath: "~/api",
+  });
+  assert.throws(() => parseConnectInput({ hostId: "user@host" }), /invalid pi-ssh host id/);
+  assert.throws(() => parseConnectInput({ hostId: "packaging-server", remotePath: "relative" }), /remote path/);
+});
+
+test("removes manual and implicit SSH connection surfaces", async () => {
+  const source = await readFile(new URL("../index.ts", import.meta.url), "utf8");
+  assert.match(source, /\.\.\.SSH_CONNECT_TOOL_METADATA/);
+  assert.doesNotMatch(source, /registerCommand\(["']ssh["']/);
+  assert.doesNotMatch(source, /registerFlag\(["']ssh["']/);
+  assert.doesNotMatch(source, /getFlag\(["']ssh["']/);
+  assert.doesNotMatch(source, /appendEntry\(["']pi-ssh-config["']/);
+  assert.doesNotMatch(source, /pi\.on\(["']user_bash["']/);
+});