Athenode

History and gateway settings

This page lists what the SSH gateway records for every action of your AI coding agent, where you find it, how long it is kept and the gateway settings that you change in the web UI without a restart. The SSH gateway is the part of Athenode through which your AI agent runs commands and transfers files on your SSH hosts, each action approved by you or by a rule you set, as the SSH gateway overview describes.

Sessions and session windows

A session is the work of one AI tool session on one connection, where a connection is one SSH host in the SSH gateway, with its login, its host key and its rules. An AI tool that works on two connections has two sessions, and a new session of the AI tool starts new ones.

Item Where it is What it shows
Session list Under each connection in the Connections link of the sidebar The most recent sessions of the connection
Session title The sidebar and the session window The label the agent gave the session, of up to 200 characters, or the AI tool's name and the time the session started
Session header The top of the session window The AI tool and its version, the start time and Confirmation mode
Actions The session window, oldest first Every action of the session. Load older shows earlier ones

The session window is where you approve and reject actions and change the session's confirmation mode, as approvals and rules describes. A session whose history was deleted after the retention period shows "Session not found.".

Each action in a session window shows:

Field Content
Reason The agent's reason for the action, above the command
Command The command, or the tool and its remote path, such as read_file /var/log/syslog
Time When the action arrived
Status Pending approval, Running, Done, Failed, Rejected, Timed out, Cancelled, Aborted or Interrupted. Failed also marks a command that ended with an exit code other than 0
Tool and decision The tool, such as exec, and how the action was decided: auto, approved, rejected, timed_out, cancelled, aborted or bypass for an action that needs no approval
Details The exit code, the signal, sudo, "stderr merged" for a sudo command and "binary (base64)" for output that is not text
Matched rules Each allow rule or denylist pattern the action matched, such as allow: systemctl status *. On Athenode Pro, "(personal)" and "(global)" mark personal and global allow rules
Output A preview of the last lines while the action runs. Show output opens the whole output, with Text and Markdown views, Copy and Load more

The History page

The History page lists every action of every session of the project, newest first. Open it from History in the SSH Gateway group of the sidebar. Its columns are Time, Action, Connection and Status, and selecting a row opens the action in its session window. Load more shows older entries.

Filter What it narrows the list to
Search Entries whose command, reason or output contains the text, ignoring case
Connection One connection, or All connections
Status Auto-approved, Approved, Rejected, Timed out, Failed, Running or Pending, or Any status
Group The connections with one tag, under More filters
Tool One tool: exec, start_job, cancel_job, job_status, job_logs, read_file, write_file, list_dir, upload, download, add_service, update_service, service_health or run_service_check, under More filters
Session id One session, under More filters
From and To A range of dates, under More filters

Clear removes every filter. The filters are part of the page's address, so you can share or bookmark a filtered list. On Athenode Pro every member of a project sees the history of all its sessions, as the gateway on Athenode Pro describes.

On the athenode daemon and the ssh-gateway package, the History page is always there. On Athenode Pro, the History page is a Pro Team and up feature: on Pro Solo it is locked and says "The audit history is part of Pro Team and above. Audit entries are still recorded and become visible after an upgrade." Session windows keep showing their actions and output on every tier. Pro tiers lists the features of each tier.

What the history records

Every action that goes through the SSH gateway gets an entry when it arrives, and the entry is updated while it waits and runs. An entry holds:

  • the time it arrived, its duration, the session and the connection;
  • the tool, the command or the file operation, and the agent's reason;
  • sudo, the working folder and the names of the environment variables the agent set, without their values;
  • the decision and the rules it matched;
  • the status, the exit code, the signal and the output of the command.

A sudo password never appears in the output: Athenode replaces it with [REDACTED]. Of a long output, the history keeps up to 64 MiB per stream, and commands, files and jobs describes how the agent reads output page by page.

These have no entry in the history: the runs of health checks, which have their own check history as services and health checks describes; the status checks of connections; and the actions that change no host, such as labelling a session, reading the list of connections or renaming a service.

How long the history is kept

Athenode deletes the finished entries of the history that are older than the audit retention, 90 days by default, when it starts and then every hour. With them go the sessions and the finished background jobs and their output that no remaining entry refers to.

These are kept whatever their age:

  • entries that are still waiting for approval or running;
  • background jobs that are starting or running;
  • the sessions of AI tools that are connected.

Once an entry is deleted, its output can no longer be read in the web UI or by the agent. Health check runs are kept for their own period, 7 days and at most 1,000 runs per service by default. Change both periods on the Settings page.

Gateway settings that apply without a restart

The gateway settings are under Approvals and limits on the Settings page, which you open from Settings in the sidebar outside a project. They apply to every project of the server, at once and without a restart. Select Save next to a value to apply it. On Athenode Pro only administrators change them, as project roles lists, and everyone else reads them.

Setting Default Range What it changes Environment variable config.json key
Approval timeout 10 min Up to 1,440 min How long an action waits for a decision. Applies to actions that arrive afterwards ATHENODE_APPROVAL_TIMEOUT_MS approvalTimeoutMs
Audit retention 90 days 1 to 3,650 days How long finished history entries are kept ATHENODE_AUDIT_RETENTION_DAYS auditRetentionDays
Status poll interval 60 s 5 s or more How often the status of each connection is checked ATHENODE_STATUS_POLL_INTERVAL_MS statusPollIntervalMs
SSH idle timeout 5 min 1 s or more How long an unused SSH connection to a host stays open ATHENODE_SSH_IDLE_TIMEOUT_MS sshIdleTimeoutMs
Health check history 7 days 1 to 3,650 days How long health check runs are kept ATHENODE_SERVICE_CHECK_HISTORY_DAYS serviceCheckHistoryDays
Health check runs kept per service 1,000 runs 10 to 100,000 runs How many of the latest runs of each health check are kept ATHENODE_SERVICE_CHECK_HISTORY_MAX_RUNS serviceCheckHistoryMaxRuns
Transfer URL lifetime 10 min 0.5 to 1,440 min How long a one-time URL of upload or download stays valid. Applies to URLs issued afterwards ATHENODE_TRANSFER_URL_TTL_SEC transferUrlTtlSec
File transfer size limit 1,024 MiB 1 to 65,536 MiB The largest file one upload or download transfers. Applies to URLs issued afterwards ATHENODE_TRANSFER_MAX_BYTES transferMaxBytes

The web UI shows each value in the unit of this table. The environment variables and the config.json keys take milliseconds for the times, days for the periods, seconds for the transfer URL lifetime and bytes for the size limit. They set the first value of a setting, when the server starts with a new data folder, and from then on the value saved on the Settings page is used. Configuration gives the data folder, config.json and the order in which flags, environment variables and config.json apply.

The output limits of exec take their value from ATHENODE_EXEC_OUTPUT_LIMIT_BYTES and ATHENODE_EXEC_STORED_OUTPUT_LIMIT_BYTES, or from the config.json keys execOutputLimitBytes and execStoredOutputLimitBytes, in the same way, and the Settings page does not show them. Commands, files and jobs gives their defaults and ranges.

Other gateway sections of the Settings page

Section What it holds Where it is described
Denylist The patterns whose actions always need approval Approvals and rules
Service alerts On Athenode Pro Team and up, the webhook that receives down and recovered events of services Services and health checks
Notifications Desktop notifications of approvals and services, for this browser only Approvals and rules and services and health checks