Module packing 

Safe packing of sudo/su commands for one-shot multi-host LLM flows.

Builds remote sh -c strings with shell-safe single-quote escaping for compound commands sent over the SSH channel (channel.exec), not local std::process::Command spawns.

External process boundary (G-PROC)

• Local product code never invokes sh/sudo/su via Command.
• Remote packing is intentional: elevation must run on the target host shell.
• Secrets go on channel stdin (sudo -S / su), never in argv / command text.
• Callers must pass payloads already rejected for NUL (validate_command_length).

Structs

PackedCommand

Packing result: remote command without secret in argv + optional bytes to send on the SSH channel stdin (GAP-SSH-SEC-001).

Functions

append_description

Appends description as a shell comment safely.

escape_shell_single_quotes

Escapes a string for safe use inside shell single quotes.

pack_abort_pkill

Builds a best-effort remote abort command (TERM, then KILL).

pack_su

Packs a command for su - -c one-shot; password goes on the channel stdin.

pack_sudo

Packs a command for sudo with sh -c.

remote_abort_pattern

Sanitizes a command fragment for best-effort use with pkill -f.