I don't think you understand. I'm well aware it can run whatever command on bash. You're taking a significant risk asking it to do what it's doing via ssh, because it could easily forget that it's suppose to be doing ssh and do whatever locally.

The point is: opencode should have a specific deterministic tool like https://www.npmjs.com/package/node-ssh where commands can only be run; the environment can only be the remote; etc.

The last thing I would want is for it to suddenly forget it's suppose to be running commands as ssh and does something local.