feat(ai): add remote coding agent sessions for SSH hosts (#1545)

* feat(ai): add host coding agent sessions with configured providers

* Wait for agent initialization and shutdown before resuming sessions

* Keep Pi transcripts outside its configuration migration directory

* Cover Pi session directory separation

* Update core permission catalog expectations for remote agents

* Install remote agent runtimes from verified official sources

* Wait for the identity panel credentials request in its test

* Add scoped SSH forwarding setup for remote agents

* Verify forwarding setup through a fresh SSH connection

* Bound the SSH forwarding verification timeout

* Return the forwarding verification callback result

* fix(ai): support agent send and interrupt keyboard shortcuts

* feat(ai): add agent queues attachments worktrees and session recovery

* fix(ai): handle deleted workspace paths and duplicate status events

* fix(ai): accept file references in root workspaces

* fix(ai): refresh paused queues after agent errors

* fix(ai): store agent sessions in plugin tables and lock down OpenCode

Agent sessions lived in a single ctx.kv value holding up to 2000 events,
which passed the 256 KB kv limit within minutes of a normal run. Every
save after that failed, so history, nativeId, queue and archive changes
were lost and every event wrote a kv audit row.

Sessions, events and queued prompts now have their own tables. A running
agent appends events in batches at most once a second with a lazy save;
session and queue changes save immediately. Prompts, drafts and stored
event text are capped in UTF-8 bytes to fit MySQL TEXT. kv:own is no
longer requested.

The OpenCode server now requires a per-session password, so other local
accounts on the host cannot drive the agent through its loopback port.

* test(upgrade): include agent session tables in the reviewed upgrade SQL

plugins/ai/locales/translated/es_ES.json

@@ -115,5 +115,81 @@
   },
   "hosts": {
     "docsLink": "Ver documentación"
+  },
+  "agents": {
+    "title": "AI Agent",
+    "permissionTitle": "Run remote AI agents",
+    "permissionDescription": "Start coding agents on SSH hosts using configured AI providers. Agents can execute commands and change files as the SSH user.",
+    "new": "New session",
+    "description": "Run an agent in a directory on this host using a Termix AI provider.",
+    "runtime": "Agent",
+    "provider": "Termix provider",
+    "chooseProvider": "Choose a compatible provider",
+    "model": "Model",
+    "directory": "Working directory",
+    "executable": "Executable (optional absolute path)",
+    "requirements": "The host needs Node.js 22.19+ and the selected agent installed. SSH remote loopback forwarding must be allowed. Existing agent configurations are not overwritten.",
+    "responsesRequired": "Codex requires a Responses API endpoint. A Chat Completions-only endpoint cannot run Codex.",
+    "piPermissions": "Pi tools run with this SSH account’s permissions. Only launch in a directory you authorize the agent to modify.",
+    "start": "Start agent",
+    "resume": "Resume",
+    "stop": "Stop session",
+    "interrupt": "Interrupt turn",
+    "send": "Send",
+    "prompt": "Ask the agent to work in this directory…",
+    "noSessions": "No agent sessions for this host.",
+    "approval": "Agent needs your decision",
+    "answer": "Answer (JSON for structured questions)",
+    "allow": "Allow once",
+    "deny": "Deny",
+    "tool": "Tool activity",
+    "streamFailed": "Agent stream disconnected. Reopen the session to reconnect.",
+    "status": {
+      "starting": "Starting",
+      "ready": "Ready",
+      "running": "Working",
+      "stopped": "Stopped",
+      "error": "Error"
+    },
+    "installRuntime": "Install selected agent and Node.js",
+    "installSource": "Official sources only: nodejs.org (SHA-256 verified) and registry.npmjs.org (locked package integrity). Installs for the SSH user in ~/.local/share/termix-agent-runtime; requires curl, tar, and Linux/macOS x64 or arm64. Does not change SSH forwarding policy.",
+    "installSucceeded": "Installation verified. You can now start the agent; SSH loopback remote forwarding must also be allowed.",
+    "installFailed": "Installation failed. Review the log and retry.",
+    "installLog": "Installation log",
+    "enableForwarding": "Enable Agent forwarding",
+    "forwardingScope": "Linux with systemd/OpenSSH; requires root or passwordless sudo. Backs up and validates SSH configuration, then reloads it. Only the current SSH account and observed connection source receive loopback remote forwarding; existing local forwarding is preserved. Failed changes are rolled back.",
+    "forwardingSucceeded": "SSH loopback remote forwarding is ready. Start or resume the agent to open a new SSH connection.",
+    "forwardingFailed": "SSH forwarding configuration failed. Review the log; no unvalidated configuration is kept.",
+    "search": "Search sessions",
+    "showArchived": "Show archived",
+    "sessionName": "Session name",
+    "rename": "Rename",
+    "archive": "Archive and stop",
+    "restore": "Restore session",
+    "queue": "Queued messages",
+    "enqueue": "Queue message",
+    "continueQueue": "Continue queue",
+    "pauseQueue": "Pause queue",
+    "editQueued": "Edit queued message",
+    "save": "Save",
+    "remove": "Remove",
+    "upload": "Upload attachment",
+    "remoteFile": "File path inside working directory",
+    "attach": "Attach file",
+    "attachments": "Reuse a session attachment",
+    "pasteImage": "Paste an image in the composer. Up to 4 attachments, 1 MiB each.",
+    "attachmentLimit": "Up to 4 attachments, 1 MiB each",
+    "review": "Git changes and worktrees",
+    "gitStatus": "Refresh Git status",
+    "diffFile": "File path to review",
+    "diff": "View diff",
+    "branch": "New branch name",
+    "createWorktree": "Create worktree",
+    "useWorktree": "New session in this worktree",
+    "worktreeHint": "Creates a new branch from HEAD. Uncommitted changes stay in the current directory. Existing worktrees are never deleted automatically.",
+    "clean": "No changes",
+    "reconnecting": "Reconnecting and restoring messages…",
+    "unavailable": "Session is no longer accessible. Check your permissions or sign in again.",
+    "shortcuts": "Enter sends or queues · Shift+Enter adds a line · Esc interrupts and pauses the queue"
   }
 }