kubus/hatbot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SSH: ssh_copy_file moves files between hosts, containers, the sandbox and the chat #7

Merged
kubus merged 1 commit from t3/file-transfer-hosts-sandbox into main 2026-10-14 00:51:25 +00:00
Conversation 0 Commits 1 Files changed 9 +427 -39
kubus commented 2026-10-14 00:47:46 +00:00
Owner
Copy link

Summary

  • Added ssh_copy_file tool to move any file up to 25 MB between hosts, containers (via Proxmox's hatbot-pct-exec), the desktop sandbox, and the chat
  • Files can come from a remote host or container, the sandbox, or the owner's chat attachments
  • Files can go to a remote host or container, the sandbox, or back to the owner (under the reply or on a task)
  • Write operations follow ssh_write_file rules: automatic on the user's home/tmp, asks for sensitive paths (SSH keys) and paths outside user control
  • In containers, writes outside /root and /tmp require approval
  • Only writes to a host count against the chat's two-change limit
  • Refactored SSH exec into a lower-level connect() function that handles stdin/stdout; exec() and file operations build on it
  • Updated CallContext with optional sendFile() callback so plugins and tools can send files to the owner
  • Bytes travel over SSH stdin/stdout—no new host setup needed; container support depends on pct exec passing stdin (untested on the real host)

Testing

  • ssh_copy_file tool moves binary and text files between all four places (host, container, sandbox, chat) and preserves content
  • Write policy matches ssh_write_file: allows writes to home/tmp without asking, blocks SSH key paths and out-of-home paths, respects the owner's "approve all changes" setting per host
  • Untrusted content: reading a host file into the sandbox marks the conversation as tainted (as ssh_read_file does)
  • Error messages are clear when a file is missing, too large, or a container doesn't exist
  • The tool works in both chat and task contexts: files sent to the owner appear under the reply or on the task
  • Command counting: writes to a host count as 1 change; copying to sandbox or owner count as 0 changes
  • Descriptions and target labels work correctly for approval display ("CT 105 on pve:/a to the owner" etc.)
## Summary - Added `ssh_copy_file` tool to move any file up to 25 MB between hosts, containers (via Proxmox's `hatbot-pct-exec`), the desktop sandbox, and the chat - Files can come from a remote host or container, the sandbox, or the owner's chat attachments - Files can go to a remote host or container, the sandbox, or back to the owner (under the reply or on a task) - Write operations follow `ssh_write_file` rules: automatic on the user's home/tmp, asks for sensitive paths (SSH keys) and paths outside user control - In containers, writes outside `/root` and `/tmp` require approval - Only writes to a host count against the chat's two-change limit - Refactored SSH exec into a lower-level `connect()` function that handles stdin/stdout; `exec()` and file operations build on it - Updated `CallContext` with optional `sendFile()` callback so plugins and tools can send files to the owner - Bytes travel over SSH stdin/stdout—no new host setup needed; container support depends on `pct exec` passing stdin (untested on the real host) ## Testing - `ssh_copy_file` tool moves binary and text files between all four places (host, container, sandbox, chat) and preserves content - Write policy matches `ssh_write_file`: allows writes to home/tmp without asking, blocks SSH key paths and out-of-home paths, respects the owner's "approve all changes" setting per host - Untrusted content: reading a host file into the sandbox marks the conversation as tainted (as `ssh_read_file` does) - Error messages are clear when a file is missing, too large, or a container doesn't exist - The tool works in both chat and task contexts: files sent to the owner appear under the reply or on the task - Command counting: writes to a host count as 1 change; copying to sandbox or owner count as 0 changes - Descriptions and target labels work correctly for approval display ("CT 105 on pve:/a to the owner" etc.)
Any file up to 25 MB, over ssh's stdin and stdout: the owner's attachments onto a host or into a
container, a host's file to the owner or into the sandbox to work on, and between hosts. Plugins get
the sandbox and the chat's files, and a call can put a file under the reply or on its task.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kubus merged commit 8a9c6c1007 into main 2026-10-14 00:51:25 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kubus/hatbot!7
No description provided.