dsh-ssh-plugin

Usage

ssh_exec

The model gains an ssh_exec tool. Ask in natural language (e.g. "ssh to root@10.0.0.5 and show disk usage"), or pass explicit arguments:

Arg	Required	Notes
host	yes*	Remote host as [user@]host, e.g. root@10.0.0.5, or any alias defined in ~/.ssh/config.
command	yes	Bash command(s) run on the remote host via bash -s.
port	no	SSH port. Default 22.
key_path	no	Absolute path to the private key. Omit for ~/.ssh defaults and ssh-agent.
timeout_ms	no	Foreground timeout in ms. Default 30000.
connection	no	Label of a saved connection; fills in host/port/user/keyPath.

* host is required in the schema, but at execution the effective host resolves as explicit host → explicit connection → workspace default. Explicit port/key_path always win over the resolved connection's values. A host that is a ~/.ssh/config alias is handed to ssh unchanged — ssh applies the config's HostName/User/Port/IdentityFile itself, so no ssh_connections save is needed for config hosts.

ssh_connections

The model also gains an ssh_connections tool for durable connection management (persisted through the harness settings store, so it survives restarts):

• save — persist a connection (label, host, optional port/user/keyPath). Labels are unique.
• list — show saved connections plus hosts discovered from the local ~/.ssh/config (read-only; pass the alias as ssh_exec host, no save needed).
• delete — remove one by label (also unbinds workspaces that pointed at it).
• use — bind the current workspace to a connection label so ssh_exec may omit host; omit label to clear the workspace default.

SSH config discovery

On every call the plugin reads the local OpenSSH client config (~/.ssh/config, or sshConfigPath when configured) and parses it:

• Concrete Host aliases become visible to the model in ssh_connections list and are suggested in ssh_exec error messages.
• Per ssh semantics, the first obtained value wins: global directives and Host * blocks provide defaults, later matching blocks cannot override them. HostName/User/Port/IdentityFile are resolved; Match blocks and Include directives are not expanded — hosts must live in the file itself.
• Discovery is best-effort: a missing/unreadable config yields an empty list, never an error. Config hosts are never persisted — they exist only in your ~/.ssh/config.

Settings card

With a web profile, Settings → Plugins shows an "SSH Connections" card styled like the built-in plugin cards (Bash/Terminal, Agent loop, Web search): a collapsible card with an unsaved badge and discard/save actions. Edit the same connections list (add/remove rows, save). The card only writes the connections field; workspace bindings are managed by ssh_connections use.

Configuration

Set row-level defaults in a later patch layer (profile cordis.patch.yml or --patch):

- id: tool-ssh
  name: dsh-ssh-plugin
  config:
    timeoutMs: 30000
    connectTimeout: 15
    sshConfigPath: C:\Users\me\.ssh\config   # optional; defaults to ~/.ssh/config