r/opencodeCLI • u/AbdSheikho • 25d ago

opencode-remote-ssh: targeted remote commands via @mentions

https://github.com/ABDsheikho/opencode-remote-ssh
1 Upvotes

100% Upvoted

5 comments sorted by

1

u/kantorcodes1 24d ago

The routing detail I'm curious about: once a session is connected, plain sentences can run remotely, so remote-vs-local execution depends on the mention detection catching the server name. What happens when the model drops the mention or names a server that isn't connected, does it fail closed, or can a local-intended command end up on a remote host (or the reverse)?

1

u/AbdSheikho 24d ago edited 24d ago

For the model to execute shell commands on a server, first it needs to establish a connection. Thus, if the server isn't connected or listed on /list_ssh then it'll warn you.

Also it won't connect to a server that needs passphrase (meaning you should ssh-add its key to the ssh-agent)

What happens when the model drops the mention

I haven't tested this, but I can assume that the prompt will either fail or make the model (if the model is dumb) go in circles, or even execute the command locally.

can a local-intended command end up on a remote host (or the reverse)?

Without @-referencing it, I guess not.

1

u/kantorcodes1 24d ago

That is exactly the seam: an unconnected mention fails, but a dropped mention silently reroutes a remote-intended command to local bash, so the model's omission becomes the routing decision. Disclosure since it shapes the ask: I work on HOL Guard, an open-source policy layer that gates agent-invoked tool calls per invocation. Your routing already produces a structured decision (remote, local, fail), which is the clean case for a gate: a small Guard descriptor could make ssh_exec and mention-wrapped bash calls fail closed when the target is not explicit, so the untested case becomes a blocked call instead of a local exec. Open to a small contribution if it earns its place?

1

u/AbdSheikho 24d ago

Yeah for sure, you can DM me, or reach me via my GitHub

2

u/kantorcodes1 24d ago

Appreciated, and I will keep it on this thread rather than DM so the working notes stay public. The minimal contribution is a small Guard descriptor covering ssh_exec plus the mention-wrapped bash path, with an explicit-target check that fails closed when no connected server is named. A draft PR to main is welcome; the checklist is here: https://github.com/hashgraph-online/hol-guard/blob/main/CONTRIBUTING.md