Module helper_consent

Expand description

Asking before AgentMux’s helper is installed on a host (SPEC_REMOTES_PANE_2026_10_05.md §4.9).

The helper is software put on someone’s machine, so nothing is uploaded until the user says so: in the approval window (crates/cef ssh_approval), which agents can neither reach nor answer. conn:helper for the host, else the global conn:helper, says ask (the default), always or never. An install an agent’s pane sets off is always asked about, whatever the setting: letting an agent use a host is not letting it install software there.

The server installs the window and the settings (install) once srv is up; until then (and in tests) there is no one to ask, so nothing installs.

Structs§

AgentOpening: An agent’s pane.open on a host is in flight while this lives.
AgentPanes 🔒: Panes an agent opened on a host, and the agent: an install from one of them is the agent’s doing. Kept in memory, not in the pane’s meta, which any caller holding srv’s key could clear. opening counts the agent pane.opens in flight per host: until one returns its pane isn’t noted yet, so any install on that host asks.
Answer: The user’s answer in the approval window.
Deps: What allow_install needs from the server.
OpenQuestion 🔒: A host’s open question, closed on drop.

Enums§

Need: What needs the helper on a host: it decides what an answer given earlier for the host (since srv started) means now.
Policy: What the settings say for a host.
Step: What to do before installing.

Constants§

MAX_AGENT_PANES 🔒: The most agent panes remembered; past it the oldest go (a pane that old has long since installed the helper, or not).

Statics§

DEPS 🔒

Functions§

agent_of 🔒
agent_opening 🔒
agent_panes 🔒
allow_install: Whether the helper may be installed on connection now, for the pane block_id (None: no pane, which counts as an agent’s doing). Err says why not, for the pane to show.
allow_install_with 🔒: allow_install with its dependencies given.
approved 🔒: Hosts the user answered Install for since srv started: the host’s other terminals install without asking again, the first maybe still uploading.
ask_once 🔒: Ask the user about connection once: a question already open for the host answers this pane too, and so does an answer given earlier (held). A failed question counts as no answer.
begin_agent_open: Call before an agent’s pane.open on connection; hold the guard until the pane is noted (note_agent_pane).
declined 🔒: Hosts the user answered “Not now” for since srv started.
forget_answers: The helper was removed from connection’s host: what was answered for it since srv started (Install, Not now, a failed try) no longer holds, and its next need asks again. A stored Always or Never is a setting, and stays.
held 🔒: What was answered for the host since srv started, as it holds for need: None to ask. Read with the open questions locked, so a question closing meanwhile can’t be missed (its answer is noted before it closes).
host_key 🔒: One host, however it is spelled.
hosts 🔒
install: Called once, when srv is up.
lock 🔒
not_installed: Whether connection’s helper didn’t get installed for a terminal durable by default, since srv started.
not_installed_hosts 🔒: Hosts whose terminals were durable by default (Mode::Default) and whose helper didn’t get installed since srv started: the question went unanswered, or the install failed. Their panes are plain until then, unless durable is asked for.
note_agent_pane: block_id was opened by agent (a verified agent’s pane.open on a host).
note_answer 🔒: Remember an answer until srv restarts: “Not now” for plain_instead, Install so the host isn’t asked again; each undoes the other. A closed window is no answer.
note_not_installed: connection’s helper didn’t get installed for a terminal durable by default.
note_unsupported: connection’s host can’t run the helper (a Windows host, spec §6.4 of the remote-terminals spec): its durable panes run as plain SSH terminals.
open_questions 🔒: The user’s question per host while it is open: their other panes on that host wait for its answer instead of asking again.
outcome: What an answer does: install or not, and what to store for the host.
plain_for 🔒: plain_instead from the host’s policy and whether the user answered “Not now” for it since srv started.
plain_instead: Whether a durable pane on connection runs as a plain SSH terminal instead, because the user doesn’t want the helper there (§4.9: “Not now, or Never: the pane falls back”): the host is set to Never, or the user answered “Not now” for it since srv started. Set to Always, never. Also a host the helper can’t run on (a Windows host), whatever the setting.
question: The question (§4.9).
record 🔒: Store and log an answer once, where it was asked.
step: Always installs and Never refuses without asking, for the user’s own panes only; an agent’s always asks.
unsupported 🔒: Hosts found since srv started to be ones the helper can’t run on.
unsupported_host: Whether connection’s host was found to be one the helper can’t run on.
verdict 🔒: What an answer means for the pane: install, or why not.

Type Aliases§

BoxFuture 🔒
Hosts 🔒: Hosts (by host_key) remembered until srv restarts.