Open an interactive SSH session (supports key/password auth and SSH config aliases)

Open a local interactive terminal session (bash, python3, node, etc.). WARNING: Executes as the current user with full local system access — this is by design for legitimate sysadmin automation. Only use on trusted systems.

Open a serial port session. Device path must start with /dev/tty or /dev/cu. (e.g. /dev/ttyUSB0, /dev/cu.usbserial-XXXX)

Send input and wait for output to settle. Returns cursor_start/cursor_end for command boundary tracking, and is_complete (false = timeout, use read_output for remaining output). If wait_for is set, blocks until the pattern matches (combines send_input + read_output wait_for in one call).

Read output from a session. Three modes: (1) default: wait for output to settle, (2) since_cursor: incremental read from a cursor position (returns only new output), (3) wait_for: block until a regex pattern matches. Mode 2 response includes has_more (true = more unread data, call again with new cursor) and is_truncated (true = data was overwritten before you read it).

Pre-stage a secret (password/passphrase) for a session. Shows a GUI dialog NOW so the operator can enter the secret before a password prompt appears. The secret is stored in a buffer and automatically sent when a password prompt is detected — no further agent action needed. Use this before connecting to devices with short password timeouts (e.g. serial console). The buffered secret is never logged.

Prompt the human user to type a secret (password/passphrase) directly into a GUI dialog. The value is sent to the PTY session without ever appearing in AI context or logs. IMPORTANT: only call this when the session is actively waiting for a password input (echo is off) — e.g. an SSH/sudo/getpass prompt. Do NOT call this on an idle shell prompt. If prepare_secret was called earlier for this session, uses the buffered secret without showing a dialog.

Send a control key (ctrl+c, ctrl+d, enter, tab, up, down, etc.)

Get detailed state of a session: type, target, is_alive, cursor, and classified state (at_prompt/password_prompt/confirmation/pager/running/unknown), awaiting_secret, last_prompt. Use cursor with read_output(since_cursor=...) for incremental reads.

List all active sessions

List persistent sessions on a remote ai-tmux server (use session_id to reattach). Optionally filter by status.

Close a session (also terminates remote PTY)

Detach from a persistent session but keep the remote PTY running (reattach via list_remote_sessions + session_id)

Resize the terminal window (rows x cols) for a session. Affects how TUI tools (top, less, vim, etc.) lay out output. Serial sessions are not supported.

Generate a signed ConsumerBundle for use with cred-mcp's vault_seal tool. The bundle contains only public keys and is safe to pass to the AI. The session private key is held in memory for a matching inject_secret call. Call this before request_authorization + vault_seal on cred-mcp.

Decrypt a SealedBox from cred-mcp and write the plaintext directly into a PTY session. The plaintext never appears in AI context or tool results — only {success:true} is returned. Call after vault_seal on cred-mcp.