AgentSSH

Terminal bytes, agent status, command proposals, approvals, audit events, and context estimates move through a single live channel that accepts connections only from the app's own browser origin and only with an auto-provisioned session token.

If the local link drops, the UI reconnects automatically with backoff and re-syncs the latest settings, so a refreshed or recovered session picks up where it left off.

Credentials are accepted for connection setup but are not persisted, logged, or passed into the AI prompt.

The backend detects real command completion and the actual exit status rather than guessing from prompt text, so failed commands are reported to the agent as failures instead of silent successes. Long-running commands also have wall-clock timeouts with a clean interrupt path.

Proposed shell actions are classified into read-only, write, or destructive categories, with policy outcomes such as auto-run, approval-required, or blocked. Elevated read-only commands are gated behind their own opt-in policy, separate from plain read-only auto-run. The classifier is hardened and fail-closed, with an automated test suite running in CI.

The first connection to a host pins its key on a trust-on-first-use basis. A later key mismatch blocks the connection with a clear explanation rather than silently reconnecting to a changed or forged server identity.

Command and web output is scrubbed for credential-shaped values before it reaches the model, and reads of sensitive files are gated behind approval like a state-changing command, so secrets do not quietly become model context.

The agent can list and read files through SFTP, with writes gated behind approval, and the operator has a read-only file browser. File access follows the same approval and redaction rules as commands.

The model is asked to choose a single next action, then output is fed back into the next step. This keeps the workflow inspectable. The loop also deduplicates repeated actions and recovers from malformed model responses.

A plain-text command protocol keeps the loop working on minimal llama.cpp-style backends, while an optional native function-calling mode gives more reliable parsing on capable endpoints.

Agent tasks have an action cap and must ask before continuing; users can cancel the whole task or interrupt a running command.

Command output is buffered, throttled, and truncated in several places so runaway commands do not overwhelm the UI or prompt context. Server-side chat and audit histories are bounded so long sessions do not grow without limit.

While an agent command is active, terminal input is locked unless the shell is waiting for a password or passphrase-style prompt.

The UI shows estimated context usage so long troubleshooting runs do not silently drift toward model limits.

Without an AI endpoint, common server-inspection requests map to safe, predictable command suggestions.

Public web search is opt-in, capped, cache-aware, and refuses local/private network URLs - including re-checking every redirect hop, not just the first URL.

Collapsible panels are keyboard-operable with proper ARIA state, and status indicators do not rely on color alone.