dsh-ssh-vault

Usage

Model-facing tools

Tool	Purpose	Typical phrasing
ssh_hosts	Manage the vault (list / show / add / update / remove)	"which hosts do I have", "change kali's note"
ssh_run	Run a command on a host, return stdout and stderr	"check disk usage on kali"
ssh_transfer	Upload or download a file (scp)	"copy this file to /tmp on kali"
ssh_probe	Reachability self-check returning system facts	"is kali still reachable"

Where to see the result: calls to ssh_run, ssh_probe and ssh_transfer render as a terminal card — a header with "host · command" and a state dot, above a scrollable monospace output area. The dot is blue while running, grey on success, red on failure (including a non-zero exit code).

Settings UI

Settings → SSH Connections provides:

• A host list with a health dot per card; hover for detail
• Add / edit / delete connections (the alias is editable, credentials move with it)
• A "Test connection" button per card, whose result also drives the dot
• "Open in file manager" for the vault directory
• Password and private-key authentication; a key can be uploaded whole and is written into the vault with its permissions tightened

The /hosts command

Start a line with / in the composer and the command runs without going through the model.

/hosts                    list every host, grouped into online / offline
/hosts kali               probe one
/hosts kali,win10         probe several (either comma form works)
/hosts kali; apt update   run a command on kali
/hosts kali,win10; uptime run on every reachable host

• Separators accept both ASCII and full-width forms: , and ，, ; and ；
• If the text after the semicolon reads as natural language (e.g. "check the disk"), the command does not run it and tells you to send that sentence to the conversation instead — command output never reaches the model, so such requests cannot go through the command
• Output renders as two cards: reachability and command execution, each with its own state dot

Configuration

The plugin has no user-configurable options. config: {} in cordis.patch.yml is an empty object, and the Loader entry id is fixed as ssh-vault.

Behaviour is shaped by the following:

Item	Notes
Vault directory	Defaults to $DSH_HOME/ssh-vault; DSH_HOME is decided by DSH
Key protection	Windows defaults to dpapi; other platforms require a master passphrase (passphrase mode)
Timeouts	ssh_run defaults to 120s, adjustable, capped at 30 minutes; commands inside /hosts are fixed at 120s
Health checks	Settings page and /hosts probe with a 15s timeout; the background sweep refreshes every 5 minutes