bashkit 0.1.15

Awesomely fast virtual sandbox with bash and file system
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

//! SSH support for Bashkit
//!
//! Provides SSH/SCP/SFTP operations via the `ssh` feature flag.
//! Follows the same opt-in pattern as `git` and `http_client`.
//!
//! # Security Model
//!
//! - **Disabled by default**: SSH requires explicit configuration
//! - **Host allowlist**: Only allowed hosts can be connected to (default-deny)
//! - **No credential leakage**: Keys read from VFS only, never host `~/.ssh/`
//! - **Resource limits**: Timeouts, max response size, max sessions
//!
//! # Usage
//!
//! ```rust,ignore
//! use bashkit::{Bash, SshConfig};
//!
//! let mut bash = Bash::builder()
//!     .ssh(SshConfig::new()
//!         .allow("*.supabase.co")
//!         .default_user("root"))
//!     .build();
//!
//! let result = bash.exec("ssh db.abc.supabase.co 'psql -c \"SELECT 1\"'").await?;
//! ```
//!
//! # Security Threats
//!
//! See `specs/015-ssh-support.md` and `specs/006-threat-model.md` (TM-SSH-*)

mod allowlist;
mod config;

#[cfg(feature = "ssh")]
mod client;

#[cfg(feature = "ssh")]
mod handler;

#[cfg(feature = "ssh")]
mod russh_handler;

pub use allowlist::SshAllowlist;
pub use config::SshConfig;

#[cfg(feature = "ssh")]
pub use client::SshClient;

#[cfg(feature = "ssh")]
pub use handler::{SshHandler, SshOutput, SshTarget};