# ssh-cli full LLM index
> Complete discovery map for one-shot multi-host SSH automation
ssh-cli is the Rust replacement for long-lived Node SSH daemons. Agents start the binary, run one operation, and the process exits. Multi-host credentials live under XDG via directories::ProjectDirs. Authentication accepts password or OpenSSH private key. sudo uses secure `sh -c` packing. su-exec provides real elevation. known_hosts implements TOFU. config writes are atomic with flock. Secrets in config.toml are **encrypted by default** (ChaCha20-Poly1305; auto `secrets.key`). Install is gated with crypto pins for clean `cargo install --locked`. Product line **0.4.1** closes AUD-POST (export empty secret, tunnel deadline exit 0, tunnel/health auth parity, scp-transfer event) on top of 0.4.0 SCP wire; russh 0.62.2.
- Portuguese discovery file: [llms.pt-BR.txt](llms.pt-BR.txt)
- Short index: [llms.txt](llms.txt)
## Primary Documentation
- [README.md](README.md)
- [README.pt-BR.md](README.pt-BR.md)
- [CHANGELOG.md](CHANGELOG.md)
- [CHANGELOG.pt-BR.md](CHANGELOG.pt-BR.md)
- [CONTRIBUTING.md](CONTRIBUTING.md)
- [CONTRIBUTING.pt-BR.md](CONTRIBUTING.pt-BR.md)
- [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
- [CODE_OF_CONDUCT.pt-BR.md](CODE_OF_CONDUCT.pt-BR.md)
- [SECURITY.md](SECURITY.md)
- [SECURITY.pt-BR.md](SECURITY.pt-BR.md)
- [INTEGRATIONS.md](INTEGRATIONS.md)
- [INTEGRATIONS.pt-BR.md](INTEGRATIONS.pt-BR.md)
- [docs/HOW_TO_USE.md](docs/HOW_TO_USE.md)
- [docs/HOW_TO_USE.pt-BR.md](docs/HOW_TO_USE.pt-BR.md)
- [docs/AGENTS.md](docs/AGENTS.md)
- [docs/AGENTS.pt-BR.md](docs/AGENTS.pt-BR.md)
- [docs/COOKBOOK.md](docs/COOKBOOK.md)
- [docs/COOKBOOK.pt-BR.md](docs/COOKBOOK.pt-BR.md)
- [docs/CROSS_PLATFORM.md](docs/CROSS_PLATFORM.md)
- [docs/CROSS_PLATFORM.pt-BR.md](docs/CROSS_PLATFORM.pt-BR.md)
- [docs/MIGRATION.md](docs/MIGRATION.md)
- [docs/MIGRATION.pt-BR.md](docs/MIGRATION.pt-BR.md)
- [docs/TESTING.md](docs/TESTING.md)
- [docs/TESTING.pt-BR.md](docs/TESTING.pt-BR.md)
- [docs/RELEASE_CHECKLIST.md](docs/RELEASE_CHECKLIST.md)
- [docs/RELEASE_CHECKLIST.pt-BR.md](docs/RELEASE_CHECKLIST.pt-BR.md)
- [docs/schemas/README.md](docs/schemas/README.md)
- [skills/ssh-cli-en/SKILL.md](skills/ssh-cli-en/SKILL.md)
- [skills/ssh-cli-pt/SKILL.md](skills/ssh-cli-pt/SKILL.md)
- [scripts/e2e_real_ssh.sh](scripts/e2e_real_ssh.sh) (real SSH E2E; never logs secrets)
- [scripts/verify_install_resolve.sh](scripts/verify_install_resolve.sh) (GAP-014 install gate)
## JSON Schemas
- [vps-list.schema.json](docs/schemas/vps-list.schema.json)
- [vps-show.schema.json](docs/schemas/vps-show.schema.json)
- [vps-doctor.schema.json](docs/schemas/vps-doctor.schema.json)
- [exec.schema.json](docs/schemas/exec.schema.json)
- [sudo-exec.schema.json](docs/schemas/sudo-exec.schema.json)
- [su-exec.schema.json](docs/schemas/su-exec.schema.json)
- [health-check.schema.json](docs/schemas/health-check.schema.json)
- [scp-transfer.schema.json](docs/schemas/scp-transfer.schema.json) (`scp upload|download --json`; regular files only)
- [tunnel-listening.schema.json](docs/schemas/tunnel-listening.schema.json) (`tunnel --json` post-bind event)
- [error-envelope.schema.json](docs/schemas/error-envelope.schema.json)
## Commands (product surface 0.4.1)
- `vps add|list|show|edit|remove|path|doctor|export|import`
- `connect`, `exec`, `sudo-exec`, `su-exec`
- `scp upload|download` (**regular files only**; no `-r`/SFTP; avoid crates.io **0.3.9** broken SCP wire — use **0.4.1**): flags `--timeout|--password-stdin|--key|--key-passphrase[-stdin]|--json` → `scp-transfer` with required `event: "scp-transfer"`; download `.ssh-cli.partial` then rename; preserve mtime/mode; stream upload 32 KiB
- `tunnel --timeout-ms` with auth `--password-stdin|--key|--key-passphrase[-stdin]`; `--json` → `tunnel_listening` after bind; post-bind deadline exits **0** after listening (pre-bind timeout still **74**)
- `health-check [--timeout]` with auth `--password-stdin|--key|--key-passphrase[-stdin]`
- `vps export` redacted: empty password is `""`, never an `sshcli-enc:` blob of empty
- `secrets status|init|reencrypt`
- `completions`
## Defaults and Limits
- Default SSH port is 22
- Default timeout is 60000 ms
- Default max_command_chars is 1000
- Default max_output_chars is 100000
- Schema version for new hosts is 2
- Default tracing filter is **error**; `RUST_LOG` overrides; `-v` enables debug
- Empty password fields are JSON `null` on key-only hosts (`vps list` / `show`); non-empty secrets mask as `"***"`
- `health-check` accepts `--timeout <ms>` plus auth flags above
- Secrets at rest: encrypted by default (auto `secrets.key`); opt-out `SSH_CLI_ALLOW_PLAINTEXT_SECRETS=1` for tests only
- Redacted export: empty secrets serialize as empty strings, never `sshcli-enc:` ciphertext of empty
- Telemetry is always false
- Install: always prefer `--locked`; product line **0.4.1** uses russh 0.62.2
## Operational Rules for Agents
- Birth execute die after every product command
- Prefer stored hosts over ad-hoc passwords in chat
- Prefer key auth when available
- Prefer `--password-stdin` and encrypted at-rest defaults
- Validate command length before SSH using max_command_chars
- Parse --json stdout only; default stderr is silent at tracing level error
- Map exit codes before retry
- Never reintroduce long-lived daemon packaging into this project
- Never enable telemetry
- Never print master-key or live SSH passwords