session: in-terminal autocomplete and command history

[Petyok]

Motivation

Termius’s shell integration surfaces snippets, history, and path completion while typing. SSHub owns the PTY and already has (or will have) snippets (#2), but there is no in-session completion UI — users retype commands and dig through shell history manually.

Proposal

• Session overlay triggered while typing (or via a chord) that suggests:
  • recent commands from this host / this session
  • snippets from Command snippets library #2 when that lands
  • optional path / common-subcommand hints (best-effort; do not require a remote agent)
• Accept suggestion into the PTY (with or without Enter), Esc dismisses.
• Persist a bounded local history index per managed host (separate from raw session logs) — only under the secrets bar below.

Secrets bar (non-negotiable)

A command-history index is a new place where secrets land on disk, and the
project already made this decision once: session logging is enabled: false by
default (src/config.rs:61) precisely because PTY output contains whatever the
user typed. A history index quietly does what logging refused to do by default.

Command lines routinely carry credentials — mysql -pSECRET,
curl -H "Authorization: Bearer …", PGPASSWORD=… psql, an ssh invocation
with a password in it, a docker login -p. So:

• The persisted index is opt-in, with the same shape as
  session_logging.enabled, and it says what it stores before it stores it.
• With it off, suggestions come from the current session only, in memory,
  and are gone when the tab closes. That already covers most of the value.
• Whatever is persisted is owner-only (0600), like the credential file and the
  log directory.
• Never index a line that a redaction pass flags, and keep the redaction list in
  one place shared with the logging path rather than a second copy.
• No history index for ssh-config hosts that have no managed id: there is
  nowhere to scope it, and guessing by hostname mixes fleets.

The design for this comes before the UI work, which is why the issue carries
needs-design.

Non-goals

• Replacing the remote shell’s own completion (bash/zsh/fish).
• Shipping a privileged remote agent by default.
• AI generation (separate issue).

Depends / related

• Complements Command snippets library #2 (snippets feed the same picker).
• Distinct from AI → shell (provider-backed).

Priority

High — daily-driver Termius gap after auth (#52) and snippets (#2).

Written by Grok 4.5 (Cursor) on behalf of the maintainer.

Edited by Claude Opus 5 (Claude Code): added the secrets bar — a persisted history index is a credential-leak surface, and session logging is opt-in for exactly this reason.

[Petyok]

Design published: Session suggestions: in-terminal history and snippets

Locked v1 decisions:

• Explicit configurable picker chord, default Ctrl+Space; no automatic popup while typing.
• Current-session history always in memory; persisted history opt-in and disabled by default.
• Persistent history only for managed hosts, stored in bounded owner-only SQLite data separate from raw session logs.
• Shared conservative whole-command redaction classifier; uncertain commands are dropped.
• Tab inserts without execution; Enter inserts and executes; Esc never writes to PTY.
• History and snippets use one provider/picker model.
• No hidden remote commands or remote shell agent in v1; path hints remain future work.
• History is local-only and excluded from future host sync.

Published on development in commit e2aeee7. Validation: just test passed after refreshing shared-target binary, cargo fmt --check, and cargo clippy --all-targets passed.

Written by GPT-5.6 Luna (OpenCode) on behalf of the maintainer.