Repository navigation
SSH anywhere 1/3: foundations (ssh_enabled gate + ported primitives) - #334
Open
theogravity wants to merge 12 commits into
Open
theogravity wants to merge 12 commits into
theogravity wants to merge 12 commits into
Conversation
theogravity
force-pushed
the
feat/ssh-anywhere
branch
from
October 8, 2026 02:46
0c6325c to
8225c19
Compare
theogravity
force-pushed
the
feat/ssh-anywhere-1
branch
from
October 8, 2026 02:46
334de40 to
c5a04be
Compare
This was referenced Oct 8, 2026
theogravity
force-pushed
the
feat/ssh-anywhere-1
branch
from
October 11, 2026 08:48
c5a04be to
8812be4
Compare
theogravity
force-pushed
the
feat/ssh-anywhere
branch
from
October 11, 2026 08:48
8225c19 to
1ac7eaf
Compare
…efusal codes into subshell-protocol
…enabled route
setNodeSshEnabled is the one change-site (row + audit, Task 7 layers the
push); the route is gate-only. Owner-only management (canManage, admin on
local), audit metadata is {on} alone. Node view carries sshEnabled on both
list and detail.
…ready reporting (protocol 16) Completes the loop Task 6 opened: the plane is the sole author of nodes.ssh_enabled, and this is the machinery that reaches the machine. - node: ssh-enabled.ts mirror (0600 temp+rename like maintenance, but fail-CLOSED the other way: absent and unreadable both refuse, only a parsed on:true allows); set_ssh_enabled executor writes it verbatim and memoizes as reported; the ssh_enabled event carries a mirror that moved mid-session (corruption, chiefly); ready.sshEnabled rides the same synchronous seed + optional-spread as maintenance. - protocol 15 -> 16: NodeSshEnabledWire/parseNodeSshEnabled, the set_ssh_enabled arm, the ssh_enabled event, ready.sshEnabled (drop-not-fatal). Breaking on purpose: pre-16 agents are wire-indistinguishable from a 16 agent whose mirror says no, and a capability gate cannot live with that ambiguity (spec 4.3). - plane: pushSetSshEnabled (local is a no-op - the row is its mirror) wired into setNodeSshEnabled as the one-function write+audit+push; decideSshEnabled + reconcileSshEnabled never adopt - every disagreement, and every row-ON-with-silent-node, ends with the ROW pushed down, stamped verbatim, and no audit row (pushes are not acts). Tests: node 866/866 (new 17), plane services/nodes 694/694 (new 14 + 4 hook-door cases), protocol 364/364 (version pin + ssh arm cases).
…ld the older-snapshot fixture on a valid ledger prefix (the tip-removal fixture hardcoded 0046 as newest; adding a migration must move both the ceiling and the fixture's strip set)
…-16 hold consequence, ported wiring claims say 'until Plan 2' (barrel, parseNodeCommandBody arms, node-results validators, the retired command quad), Gate A values attributed to their actual freeze, spec pointers trimmed to honest anchors, route comment + import fold + test-restore audit note
…er re-tagged to the Gate A lineage, and the Match-exec disclosure pointer moved off the wire JSDoc (which does not carry it) onto the grammar header that does
…now states the shipped order (walk refuses a seen exec before -G ever runs; the disclosure covers what the bounded walk could not see)
theogravity
force-pushed
the
feat/ssh-anywhere
branch
from
October 12, 2026 00:36
1ac7eaf to
ec94aa0
Compare
theogravity
force-pushed
the
feat/ssh-anywhere-1
branch
from
October 12, 2026 00:36
8812be4 to
74e5490
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #333 (the spec/plan branch). Tier 1 of the ssh-anywhere plan: https://github.com/subshell-ai/subshell/blob/feat/ssh-anywhere-1/docs/superpowers/plans/2026-10-07-ssh-anywhere-1-foundations.md
Ships:
ssh -Gresolve/spawn engines into @internal/pane-runtime, the isolated sshd fixture into e2e.ssh_enabledcapability gate: migration 0047 (default OFF everywhere includinglocal),nodeCanSsh(owner, admin onlocal),PUT /api/nodes/:id/ssh-enabledbehind the cookie-admin chain (one change-site service, auditednode.ssh_enabled.update), a node mirror file read fail-closed,set_ssh_enabledpush,ready.sshEnabledreporting, and a plane-authoritative reconcile that never adopts from the node.NODE_PROTOCOL_VERSION15 -> 16. Nothing launches SSH yet; that is tier 2.Deploy note (in the changeset): the node link gate is exact-match, so deploying this server holds every pre-16 agent (offline for everything but update) until it crosses the bump on the update command. Sequence server-first.
Verification: verify-types / lint:check / lint:prose / turbo build green; full
bun run testgreen excepte2e-cross-subshell, which fails identically at the base commit on this host (proven in a clean worktree at 0c6325c) - pre-existing, unrelated.Review: every task passed a per-task spec+quality gate; the whole-branch review ran four rounds (2 Important + 6 Minor, then 2 Minor, then 1 Minor) ending CLEAN with zero findings.
Co-Authored-By: Claude noreply@anthropic.com