fix(pi-ssh): harden remote execution and search

pi-tool-search/CHANGELOG.md

@@ -11,7 +11,8 @@
 - Added limits for active groups, generated group size, and total dynamic tools, plus current-host catalog/config/LRU tests.
 - Added checked-in authoritative groups for every tool exposed by the standard my-pi bundle, eliminating first-use model generation and user caching unless unrecognized third-party tools are present.
 - Replaced the Hermes and third-party Hippo assignments with the five tools exposed by the official Hippo Pi extension, grouped into recall and management workflows.
-- Added authoritative `ssh-connection`, `ssh-remote-files`, `ssh-remote-search`, and `ssh-remote-shell` groups for the maintained `pi-ssh` tools, keeping reviewed connection, bounded discovery, structured file operations, and reviewed shell execution separate.
+- Added authoritative `ssh-connection`, `ssh-remote-files`, `ssh-remote-search`, and `ssh-remote-shell` groups for the maintained `pi-ssh` tools, keeping reviewed connection, bounded discovery, structured file operations, and reviewed shell execution separate; the connection workflow now requires sequential `ssh_connect` to succeed before dependent tools.
+- Added sequential `ssh_cd` to the authoritative remote-shell workflow and direct the model to wait for a successful workspace change before dependent remote calls, avoiding both the unknown-tools fallback and cwd races.
 
 ## [0.3.6] - 2026-04-24
 

pi-tool-search/README.md

@@ -30,7 +30,7 @@ Run `/tool-search-rebuild` to remove model enrichment. Standard bundle tools imm
 | `ssh-connection` | `ssh_connect` |
 | `ssh-remote-files` | `ssh_read`, `ssh_write`, `ssh_edit` |
 | `ssh-remote-search` | `ssh_find`, `ssh_grep` |
-| `ssh-remote-shell` | `ssh_bash` |
+| `ssh-remote-shell` | `ssh_cd`, `ssh_bash` |
 | `code-intelligence` | CodeGraph and all LSP tools |
 | `web-tavily` | Tavily search/fetch |
 | `web-exa` | Exa search/advanced/fetch |

pi-tool-search/docs/dynamic-tool-loading.md

@@ -13,7 +13,7 @@
 9. `turn_start` notices tool or grouping-configuration changes by hash, resets stale dynamic groups, and reconstructs the checked-in/hybrid catalog.
 
 The standard bundle assigns the official Hippo Pi extension's five `hippo_*` tools to recall and management groups. `context_tree_query` remains in `memory-recall` because it recovers condensed tool output; retired Hermes names and third-party `tff-memory_*` names are not seeded.
-The maintained `pi-ssh` tools are also split by workflow: reviewed agent-controlled connection lives in `ssh-connection`, structured `ssh_read`/`ssh_write`/`ssh_edit` file operations live in `ssh-remote-files`, bounded `ssh_find`/`ssh_grep` discovery lives in `ssh-remote-search`, and the reviewed `ssh_bash` command surface stays isolated in `ssh-remote-shell`.
+The maintained `pi-ssh` tools are also split by workflow: sequential reviewed agent-controlled connection lives in `ssh-connection`, structured `ssh_read`/`ssh_write`/`ssh_edit` file operations live in `ssh-remote-files`, bounded `ssh_find`/`ssh_grep` discovery lives in `ssh-remote-search`, and sequential reviewed workspace changes plus reviewed command execution live in `ssh-remote-shell`. The workflows tell the model to call `ssh_connect` or `ssh_cd` separately and wait for success before issuing remote calls that depend on the new connection or cwd.
 
 A purely additive first load receives Pi's native dynamic-tool result propagation. A replacement that evicts one group while adding another is intentionally non-additive; current Pi detects the removal and uses its safe next-request fallback instead of attaching an invalid additive-only hint.
 

pi-tool-search/extensions/bundle-groups.ts

@@ -34,8 +34,8 @@ export const BUNDLE_GROUP_DEFINITIONS: BundleGroupDefinition[] = [
   {
     id: "ssh-connection",
     title: "SSH connection",
-    summary: "Connect to an explicitly imported SSH host through the reviewed agent tool flow.",
-    useWhen: ["The user names a remote server as part of a concrete task and no matching SSH2 connection is active"],
+    summary: "Connect sequentially to an explicitly imported SSH host through the reviewed agent tool flow.",
+    useWhen: ["The user names a remote server as part of a concrete task and no matching SSH2 connection is active; call ssh_connect separately and wait for success before dependent remote tools"],
     avoidWhen: ["The task is local, the server was not explicitly named, or the host has not been imported"],
     keywords: ["ssh", "connect", "server", "host", "remote", "连接服务器", "远程主机", "SSH"],
     tools: ["ssh_connect"],
@@ -60,12 +60,12 @@ export const BUNDLE_GROUP_DEFINITIONS: BundleGroupDefinition[] = [
   },
   {
     id: "ssh-remote-shell",
-    title: "SSH remote shell",
-    summary: "Run a reviewed shell command in the currently connected remote SSH workspace.",
-    useWhen: ["You need builds, tests, Git, or other shell operations on an active SSH target"],
-    avoidWhen: ["Structured remote file tools are sufficient, or the command should run locally"],
-    keywords: ["ssh", "remote", "bash", "build", "test", "git", "远程命令", "SSH"],
-    tools: ["ssh_bash"],
+    title: "SSH remote workspace shell",
+    summary: "Change the active remote cwd as a separate reviewed step, or run a reviewed shell command in that workspace.",
+    useWhen: ["You need to change the active remote workspace or run builds, tests, Git, or other shell operations there; call ssh_cd separately and wait for success before dependent remote calls"],
+    avoidWhen: ["Structured remote file tools are sufficient, or the operation should run locally"],
+    keywords: ["ssh", "remote", "bash", "cd", "cwd", "workspace", "build", "test", "git", "远程命令", "工作目录", "SSH"],
+    tools: ["ssh_cd", "ssh_bash"],
   },
   {
     id: "code-intelligence",