feat(pam): default ssh access to interactive shell

[x032205]

Description 📣

Makes the SSH access CLI command default to an interactive shell, like web access. Before it would default to just starting a proxy.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[linear]

PAM-428

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-377-feat-pam-default-ssh-access-to-interactive-shell

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[greptile-apps]

Greptile Summary

The PR changes SSH PAM access to open an interactive shell by default while retaining an explicit local-proxy mode and adding direct remote-command execution.

• Adds --proxy and -- <command> CLI modes with SSH-specific validation.
• Implements direct SSH transport, terminal raw mode, resize handling, signal/expiry handling, and remote exit-code propagation.
• Updates unit and end-to-end coverage for proxy and direct-command paths.

Confidence Score: 4/5

The direct SSH path should not merge until interruption during connection establishment reliably terminates the newly created PAM session.

The PAM session is created before dialing begins, but SIGINT and SIGTERM are not intercepted until all handshakes finish, so an interruption during a slow or stalled dial can bypass the only explicit session-termination call.

Files Needing Attention: packages/pam/local/ssh-shell.go, packages/pam/local/access.go

Important Files Changed

Filename	Overview
packages/cmd/pam.go	Adds explicit SSH proxy and remote-command syntax, validates conflicting modes, and passes structured access options into the PAM layer.
packages/pam/local/access.go	Routes SSH sessions among direct shell, remote command, and proxy modes, but direct-session cleanup depends on RunSSHShell returning.
packages/pam/local/ssh-shell.go	Implements the direct SSH client and terminal lifecycle; signal handling starts too late to clean up a session interrupted during connection establishment.
packages/pam/local/ssh-shell-resize.go	Adds SIGWINCH-based terminal resize propagation on non-Windows platforms.
packages/pam/local/ssh-shell-resize_windows.go	Adds polling-based terminal resize propagation on Windows.
packages/pam/local/ssh-shell_test.go	Covers command execution, exit codes, gateway traversal, and interactive terminal restoration, but not interruption during connection establishment.
e2e/pam/ssh_test.go	Updates proxy coverage for the explicit flag and adds direct-command end-to-end coverage.

_{Reviews (1): Last reviewed commit: "feat(pam): default ssh access to interac..." | Re-trigger Greptile}