feat(pi-ssh): add reviewed agent connection flow

tests/extension-load.test.ts

@@ -33,6 +33,11 @@ test("all package extensions load together without global registration conflicts
 	assert.equal(packageJson.dependencies.jiti, "2.7.0", "the packed helper must load local TypeScript outside Pi");
 	assert.ok(packageJson.files.includes("pi-ssh"), "the packed bundle must include the locally maintained SSH source");
 	assert.ok(packageJson.files.includes("ssh_config.sh"), "the packed bundle must include the SSH host import helper");
+	const permissionConfig = JSON.parse(
+		await readFile(join(repositoryRoot, "config", "pi-permission-system.json"), "utf8"),
+	) as { authorizerChain: string[]; permission: Record<string, unknown> };
+	assert.equal(permissionConfig.permission.ssh_connect, "ask", "SSH connection must enter the permission gate");
+	assert.deepEqual(permissionConfig.authorizerChain, ["auto-review"], "SSH connection asks must reach AutoReview");
 	assert.ok(
 		packageJson.pi.extensions.indexOf("./extensions/permission-system.ts") <
 			packageJson.pi.extensions.indexOf("./pi-ssh/index.ts"),

tests/tool-routing.test.ts

@@ -21,6 +21,13 @@ test("search routing narrows files before requesting matching line numbers", ()
 	assert.match(section, /Use read with offset\/limit only for the exact matching region/);
 });
 
+test("SSH connection routing requires an explicit named host and concrete task", () => {
+	const section = buildToolRoutingSection(["ssh_connect"]);
+	assert.match(section, /only when the user explicitly names an imported host/);
+	assert.match(section, /Connect before calling other ssh_\* tools/);
+	assert.match(section, /never infer or substitute a different host/);
+});
+
 test("remote search routing uses structured bounded SSH tools", () => {
 	const section = buildToolRoutingSection(["ssh_find", "ssh_grep"]);
 	assert.match(section, /use ssh_find to narrow remote file paths before ssh_grep/);