Crate strop_remote 

Native-byte remote identity, read-only SFTP and explicit cooperative SSH saves.

Requests belong on workers. Authentication and encryption stay in system OpenSSH; no editor, CLI, view or rendering state lives here. Identity types (endpoint, file, location, address errors) live in strop-workspace (0042); this crate is the transport and behavior over them.

Modules

save

Explicit remote editing. Atomic replacement and cooperative locking are owned by the shipped helper; nonparticipating writers are not excluded by flock.

Structs

CommandOutput

Bounded captured output of one finished remote command. stdout keeps its first STDOUT_LIMIT bytes; stderr its first STDERR_LIMIT bytes plus the last STDERR_TAIL bytes (where the supervisor’s status record lives). The dropped counters say how many further bytes arrived; treat any non-zero counter as truncation, never as silence.

ConnectionLease

HostCandidate

One completion candidate: the endpoint local data knows about. token() renders exactly what can be typed after ssh://; the constructor is pure and admissible() is judged by the address grammar alone.

HostEnumeration

Everything enumeration found: candidates plus bounded notes. Notes are diagnostics, not failures — an unreadable config still completes from the remaining sources.

HostSources

Explicit enumeration inputs. The caller owns path resolution, so enumeration itself is isolated from ambient state.

PermissionBitsError

ReadLimit

A checked read length in bytes: positive and at most ReadLimit::MAX, the in-memory snapshot cap.

ReadLimitError

Why a ReadLimit was refused: the byte-domain bounds exist so one snapshot can never ask for an unbounded or empty allocation.

RemoteClient

RemoteCommand

A checked description of one remote process. Pure data: nothing is spawned by constructing, cloning or inspecting it.

RemoteDirectorySnapshot

RemoteEntry

RemoteOffset

A byte offset into a remote file. Untyped in memory, typed at the API.

RemotePermissions

Only the POSIX access/special bits; file kind is a separate typed value.

RemoteReadError

A fully diagnosed remote read failure. Carries everything a user needs to act: stage, classification, detail, bounded ssh stderr, the child’s exit line when observed, and a hint for fixable causes.

RemoteSize

A whole-file size in bytes, as captured at inspection time.

RemoteSnapshot

RemoteWindow

The bytes a snapshot actually covers: where the content starts, how many bytes it holds, and how large the whole file was when inspected. The buffer contains exactly the window — nothing more is implied.

SupervisionKey

Identifies one supervised session’s status records: the supervisor writes STROP-SUP-v1 <nonce> ... lines to stderr, and only lines carrying this session’s nonce are its. Not a secret — it travels inside the spec and is visible in remote process listings.

Enums

CandidateOrigin

Where a candidate came from — shown so users can tell config data from hosts they actually connected to.

ReadFailureKind

What went wrong, classified far enough to act on. Auth, trust and install problems carry hints; the rest are honest transport facts.

ReadSelection

Which bytes one read wants.

ReadStage

Where a remote read stopped. Retained so diagnostics name the phase instead of a bare transport error.

RemoteCommandError

Why a remote command could not be admitted, spawned, supervised or completed. Every variant is descriptive; none guesses success.

RemoteEntryKind

RemoteExitStatus

The remote worker’s termination outcome, when the supervisor reported it. Non-zero codes are ordinary results — exit codes are data for Git (diff --quiet exits 1), not transport failures.

RemoteProgram

Program identity is distinct from argv. Built-in scripts reuse the already selected supervisor interpreter, never another PATH lookup for python3.

RemoteResource

StdinMode

What the supervised ssh connection does with the local stdin lease.

SupervisionOutcome

One parsed supervisor record. SupervisionOutcome::LaunchFailure outranks a later exit record: the program never started.

Functions

command

The ssh invocation for an owned stdio client — a language server. Relayed stdin, all three pipes piped, no spawn. The caller owns the local child (see the module docs for the lease and cancel story) and may parse the supervisor’s stderr records via command_supervised.

command_supervised

command with the leash visible: choose the stdin mode explicitly and keep the SupervisionKey for parsing status records out of the session’s stderr tail.

enumerate_hosts

Enumerate host candidates from explicit local data. Pure and bounded: reads only the given files, spawns nothing, authenticates nothing. History candidates are admitted first (the endpoints the user actually opens), then config files in order, then known_hosts.

run

Run one finite remote command to completion. Worker-only: it blocks for the whole exchange, bounded by the command’s deadline. Each run uses its own dedicated, noninteractive ssh connection — no pooled session or lease is involved. Output is bounded per CommandOutput; cancellation kills the local ssh group and the remote supervisor tears down the remote group.

run_with_input

Worker-only framed input. Chunks are borrowed; no whole-rope copy is needed. The stdin lease remains open after the final chunk until the program exits.