How the approval gate keeps an agent from getting root
An agent that can run shell commands is one bad suggestion away from rm -rf. Here's how Tryssh makes that structurally hard.
Default-deny, not default-allow
The gate starts from no. A command auto-runs only if both hold:
- It matches a read-only allowlist (
ls,cat,df,systemctl status, and friends). - It contains no shell metacharacters — no
;,|,&&,$(), backticks, redirects.
Miss either check and the command doesn't run. It renders in the chat with Run and Skip, and waits for you.
The agent stays the intern with great ideas. You stay the operator.
Two channels, never mixed
The copilot runs commands over an SSH exec channel. Your visible terminal is a separate PTY. That isolation is deliberate: the agent can't read what you type, and it can't inject keystrokes into your session. What you see it do is all it can do.
Why not just trust a smarter model?
Because "smarter" isn't "accountable." A model that's right 99% of the time still hands you a catastrophe every hundredth command if there's no gate. The gate doesn't get tired, doesn't get clever, and doesn't have a bad day. It just asks.