Interactive terminal
High-trust WebSocket SSH terminal access.
terminal.use capability.Transport
The browser terminal uses /ws/devices/<device_id>/terminal. The backend authenticates the session, checks role and scope, validates the device, and coordinates terminal access with the same per-device SSH lane used by automation.
Same-origin protection
v2.0.0 validates WebSocket Origin before accepting terminal connections.
Idle timeout
SSH_TERMINAL_IDLE_MINUTES controls the interactive terminal idle timeout. The default in .env.example is 15 minutes.
Logging boundary
Password data and terminal content are not written into Job records.
Interactive session boundary
The terminal is a WebSocket-backed personal SSH session. It uses the signed-in user's session credential and does not write terminal content or passwords into Job records.
The same per-device coordinator protects interactive and automated work. A terminal cannot overtake a live automation transaction, and a Job cannot enter while another operation owns the device lease. Idle sessions close according to the configured timeout.
Operational guidance
- Use the terminal when a catalog action or diagnostic is insufficient.
- Confirm the selected switch before entering commands.
- Do not assume terminal changes participate in pending-configuration tracking.
- Close the session when work is complete.