v2.0.3 — 8 Bug Fixes

Bug Fixes

1. snprintf 缓冲区溢出 — safe_append() 替代原始 snprintf 循环，防止 health/profiles 响应写入越界
2. proxy 字段未 JSON 转义 — profiles 响应的 proxy 在插入前经过 json_esc() 转义
3. Bash CLI Python 注入 — 所有用户变量改用 sys.argv 传参，消除单引号注入风险
4. Windows 线程竞态 — CRITICAL_SECTION 保护 profile 数组并发访问
5. Windows 白名单子串误匹配 — match_glob 支持 ^/$ 锚点精确定位
6. ssh_exec 缺少端口 — Unix/Windows 双端加入 -o Port=N，socket 丢失时不再回退到端口 22
7. CLI upload/download 不支持密码认证 — sftp→scp + sshpass，兼容密码配置
8. Web download 文件名编码 — Content-Disposition 使用 RFC 8187 filename*=UTF-8 编码

Tested

nvd2 + nvd3 双机实测 16/16 全部通过：

• 命令白名单/黑名单 ✓
• 文件上传/下载 ✓
• 配置热重载 ✓
• 双机并发 ✓
• 健康检查/重连 ✓

v2.0.1 — Command Safety, SFTP, Config Hot Reload

What's New

🔒 Command Safety

• Per-server command regex whitelist/blacklist (allow / deny fields)
• POSIX extended regex on Unix, glob matching on Windows
• Validated in C daemon before any SSH execution — impossible to bypass
• CLI: ./sshc add prod root@host -i key --allow "^(ls|df).*" --deny ".*rm -rf.*"
• Web UI: allow/deny input fields in add-server form

📁 SFTP File Transfer

• ./sshc upload <profile> <local> <remote> — direct SFTP with ControlMaster reuse
• ./sshc download <profile> <remote> <local> — auto-detects dirs, uses tar pipe
• Web UI: upload modal with drag-drop file picker + progress bar
• Web UI: download modal with remote path input
• POST /api/upload/<name> and GET /api/download/<name>?path=... endpoints
• Zero extra dependencies — uses OpenSSH sftp

🔄 Config Hot Reload

• Daemon auto-detects config changes via mtime (no polling, no restart)
• Modifying ~/.sshc/profiles.json takes effect on next request
• Proven race-condition-free under 100 rounds × 3 concurrent load

🐛 Fixes

• cmd_upload / cmd_download sftp command incorrectly included 'ssh' in args (fixed)

📊 Performance (daemon IPC, profiles action)

• Avg latency: 15ms, P99: 21ms
• Regex validation overhead: < 1ms
• Max throughput: ~300 TPS (listen backlog bound)
• Hot reload under concurrent load: 0 errors / 100 rounds

v2.0.0 — Cross-platform daemon, proxy support, drag-drop keys, async health UI

Breaking changes

• Daemon C code rewritten with #ifdef _WIN32 cross-platform support
• profiles.json: new optional proxy field per server

New features

Cross-platform Windows support

• Native Windows daemon via CreateProcess + CreateThread + TCP IPC
• Auto-assigned localhost port, stored in ~/.sshc/daemon.port
• POSIX path uses posix_spawnp for macOS-optimized process creation
• Single source file compiles on both platforms (cc / cl / mingw)

Per-server proxy support

• Optional proxy field in profiles.json (ProxyCommand string)
• Web UI: modal with type dropdown (HTTP / SOCKS5 / SOCKS4 / Custom)
• CLI: sshc add --proxy "..." flag
• API: PUT /api/profiles/<name> {"proxy": "..."} / {"proxy": null}
• Proxy injected into all SSH invocations (health, exec, ensure_master, check)

Web UI overhaul

• Drag-and-drop key file upload (FileReader + base64, stored to ~/.sshc/keys/)
• Async parallel health checks — table renders instantly, status streams in
• Proxy configuration modal per server (dropdown + host/port + live preview)
• HTML-escaped rendering (XSS safe)
• Path traversal fix (os.path.basename on uploaded filenames)

Bug fixes

• Fix cmd_add flag parsing (positional args after flags)
• Fix cmd_remove None → '' for clean JSON output
• Fix cmd_profiles: use stdin pipe instead of fragile string interpolation
• Remove dead code (fd_is_socket, INVALID_SOCK, SOCKERR, HOME_ENV)
• Fix Windows ensure_master timeout 15s → 10s
• Fix /dev/null vs nul cross-platform in ssh_check and cleanup_masters
• Fix double close(cli) on fork failure
• Guard <unistd.h> for MSVC compatibility, add ssize_t typedef for Windows

Documentation

• SKILL.md: comprehensive agent workflow guide, proxy types table, platform notes
• README: agent-first narrative with /sshc slash command examples

sshc v1.0.0 — Agent-Native SSH Multiplexing

What is sshc?

Let your local AI agent (Claude Code, Codex, Cursor) manage remote servers directly — check status, view logs, batch update, restart services.

Features

• Zero-overhead C daemon — vfork+execvp, ~15ms overhead above raw SSH
• 10 CLI subcommands — daemon, health, exec, profiles, add, remove, default, reconnect, web
• Web UI + REST API — agents self-configure server profiles without human help
• SSH key + password auth — both supported, uses ControlMaster for connection reuse
• Auto-build on first use — compiles daemon from source, works on any POSIX system
• 55+ AI agents — installable via npx skills add fivif/sshc -g

Install

npx skills add fivif/sshc -g --agent claude-code -y

Full documentation