[jasperf]

This change extends the SSH passthrough tool in the MCP server so it accepts read-only pipelines instead of only single commands, and adds find, awk, and wc to the command allowlist. Operators can chain inspection commands, such as find /home/web/monitoring -mtime +90 | wc -l, in one call without confirm: true.

Previously every token was shell-quoted, so an unquoted pipe was rejected by the read-only check and, worse, sent to the remote host as a literal argument, meaning the pipeline never ran.

Pipeline behavior

• An unquoted, standalone | is treated as a pipe operator. A pipeline is auto-approved only when every segment passes the read-only check on its own.
• Leading, trailing, and doubled pipes are rejected.
• Quoted or escaped pipes ('a|b') and pipes glued to other text (ls|wc) stay literal arguments.
• Credential-path checks apply to each segment.

New allowlist entries and their guards

• find is refused when it carries mutating primaries: -delete, -exec, -execdir, -ok, -okdir, -fprint, -fprint0, -fprintf, -fls.
• awk is refused when its program text contains system(), getline, close(), |, or output redirection, and when it carries any option other than -F or -v (gawk's -i inplace, -o, --profile, -f, -l, -E, --include can write files or load code).
• wc has no extra guard.

Related fix

• The tokenizer no longer drops empty quoted arguments, so grep '' file reaches the remote host with its '' intact.

Tests

• Adds a node:test suite, run with npm test in mcp-server/, covering the find and awk rules, pipeline splitting, malformed pipelines, quoted and glued pipes, remote command building, empty arguments, and credential paths inside pipelines.

Rollout

• The MCP server runs from dist/, so it needs npm run build and a restart to pick this up. The Go CLI is unaffected.
• CHANGELOG.md has Added and Fixed entries under Unreleased, with no version bump.

Files Changed

• CHANGELOG.md
• mcp-server/package.json
• mcp-server/src/tools/sshPassthrough.ts
• mcp-server/test/sshPassthrough.test.ts