The project team integrated AI agents with MODX CMS, enabling them to perform site maintenance tasks directly via SSH. The system allows agents to read files, check error logs, and execute diagnostic commands, reducing the need for manual intervention by developers.
Initially, the high frequency of short-lived SSH connections triggered security blocks from the hosting provider. The team resolved this by implementing a connection pooling system using OpenSSH's ControlMaster, which maintains persistent connections and limits concurrent operations to two per account.
To ensure security, the team introduced a dedicated 'site-file' tool for file modifications, bypassing direct SSH access for production files. This tool enforces strict path normalization to prevent directory traversal and restricts access to sensitive configuration files and directories.
The file update process requires a preview of changes via checksum comparison before application. Modifications are written to temporary files first, followed by permission settings and an atomic move operation. The system automatically rolls back to the previous version if checksums mismatch or if PHP linting and site health checks fail.
