DSH plugins for Terminal & Shell

Terminal plugins range from a status line in a TUI front end to full remote operations plugins that open SSH sessions and guard dangerous commands. The common thread is that the shell becomes part of the agent loop rather than something you alt-tab into.

Because these plugins often carry command execution permissions, review the guard rules: which patterns are blocked, whether destructive commands need confirmation, and whether output is truncated safely before it lands in context. A shell tool without guardrails is the highest-blast-radius category in a text harness.

How to evaluate

Ask what executes where. Local node-pty sessions are different from SSH to a bastion. Check allowlists and denylists by name, not by marketing: rm -rf, package publishes, and curl | sh should not run unattended unless you deliberately opened that door. Look for dry-run or approval modes on remote paths, and for transcript-friendly truncation so a giant log does not silently fill the window.

UI-only terminal plugins (status bars, gauges, rewind) are lower risk but should still declare their dshTarget: they hook surfaces that move between preview releases.

What good looks like

A strong terminal plugin keeps humans in the loop for anything irreversible. Local workbenches show a real shell, not a simulator, and persist history you can reopen. Remote plugins document transport, auth material, and which hosts are in scope. Guardrails are configurable and default closed on destructive classes. Output is clipped with an explicit “truncated” marker rather than dumped raw.

Pair a careful shell plugin with a file diff view when you can: the combination makes it obvious what the command changed on disk.

Common failure modes

The usual failure is a “helpful” default that runs scripts from the model with no confirmation. The second is SSH plugins that store keys where the model can read them. The third is assuming a TUI front end is safe because it looks like a terminal — the risk is the tools it injects into the model, not the chrome.

Install order and boundaries

Confirm which profile and workspace a command runs in. Streaming logs help; expose a shell to the model only after you have read the permission surface.