ssh

ssh

SSH-key CLI verbs — list, import, add, export, pub, default, link, rename, remove.

Operates on the SSH key tables of the credentials DB. Each handler opens the DB with the CLI's prompt-on-tty policy and closes it before returning. Display formatting (_print_key_table) sanitises every field via sanitize_tty so a hostile key comment can't inject terminal escapes into operator output.

SSH_COMMANDS = (CommandDef(name='ssh', help='SSH keypair management', children=(CommandDef(name='list', help='List SSH keys stored in the vault', handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_list'), args=(ArgDef(name='--scope', help='Show keys for a specific credential scope only', default=None),)), CommandDef(name='import', help='Import an OpenSSH keypair from files into the vault DB', handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_import'), args=(ArgDef(name='scope', help='Credential scope to associate the key with'), ArgDef(name='--private-key', help='Path to the private key file', dest='private_key', required=True), ArgDef(name='--public-key', help='Path to the .pub file (default: derive from the private key)', default=None, dest='public_key'), ArgDef(name='-c/--comment', help="Override the key's comment string", default=None))), CommandDef(name='add', help='Generate a new SSH keypair in the vault for a credential scope', handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_add'), args=(ArgDef(name='scope', help='Credential scope to associate the key with'), ArgDef(name='--key-type', help='Key algorithm: ed25519 (default) or rsa', default='ed25519', dest='key_type'), ArgDef(name='-c/--comment', help='Key comment (default: next unused <scope>-N; prompted on a TTY)', default=None), ArgDef(name='--force', help='Rotate — unassign all existing keys from the scope and generate fresh', action='store_true'))), CommandDef(name='export', help="Export a scope's SSH keypair to standard OpenSSH files", handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_export'), args=(ArgDef(name='scope', help='Credential scope to export'), ArgDef(name='--out-dir', help='Directory to write files into', dest='out_dir', required=True), ArgDef(name='--key-id', help="Export a specific ssh_keys.id (default: the scope's default key)", default=None, dest='key_id', type=int), ArgDef(name='--out-name', help='Override the output filename stem (default: id_<type>_<fp8>)', default=None, dest='out_name'))), CommandDef(name='pub', help='Print all assigned public keys, one per line with the default first', handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_pub'), args=(ArgDef(name='scope', help='Credential scope'), ArgDef(name='--key-id', help='Print only this assigned ssh_keys.id (default: every assigned key)', default=None, dest='key_id', type=int))), CommandDef(name='default', help="Choose which assigned key the scope's SSH agent offers first", handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_default'), args=(ArgDef(name='scope', help='Credential scope'), ArgDef(name='key_id', help='Assigned ssh_keys.id to offer first', type=int))), CommandDef(name='link', help='Link an existing vault key to an additional scope', handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_link'), args=(ArgDef(name='scope', help='Credential scope to link the key to'), ArgDef(name='--key-id', help='ssh_keys.id of the key already stored in the vault', dest='key_id', type=int, required=True))), CommandDef(name='rename', help='Change the comment of a stored SSH key (selected by fingerprint prefix)', handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_rename'), args=(ArgDef(name='fingerprint', help='Fingerprint prefix identifying the key (min 8 chars recommended)'), ArgDef(name='comment', help='New comment text'))), CommandDef(name='remove', help='Unassign SSH keys from scopes (orphaned keys cascade-delete)', handler=LazyHandler('terok_sandbox.commands.ssh:_handle_ssh_remove'), args=(ArgDef(name='--scope', help='Filter by credential scope (exact match)', default=None), ArgDef(name='-c/--comment', help='Filter by comment (supports glob wildcards)', default=None), ArgDef(name='--fingerprint', help='Filter by fingerprint prefix (min 8 chars recommended)', default=None), ArgDef(name='--yes', help='Skip confirmation prompts', action='store_true', dest='yes'))))),) module-attribute

SSH = SSH_COMMANDS[0] module-attribute

__all__ = ['SSH', 'SSH_COMMANDS'] module-attribute