clisshd

var RootCmd = &cobra.Command{
	Use:   "sshd",
	Short: "Run a direct-TCP pty-subsystem server (peers connect by PK)",
	Long: `skywire cli pty host — OpenSSH-equivalent server over skywire identity.

Binds a TCP port and serves the dmsgpty protocol over it, gated by an
XK noise handshake against this server's PK + a whitelist of client
PKs. The protocol underneath is identical to the dmsg-overlay
dmsgpty-host; sshd is the discoverable, ssh-shaped surface over the
direct-TCP entry point.

Use this when:
  - You want a peer-to-peer remote shell that doesn't require running
    a full skywire visor on the server (or that runs ALONGSIDE one,
    sharing the visor's PK without contending for the dmsg-disc entry).
  - You have direct IP reachability to the server and want lower
    latency than the dmsg overlay path.
  - You're scripting ssh-like access into your skywire fleet.

Use the visor's embedded pty.ssh_listen field instead when:
  - You want the same port served by your already-running visor.
  - You want the dmsg-overlay path AND the TCP path on the same
    process (sshd is TCP-only by design).

Examples:
  # Run on :2022 with two PKs allowed, identity from default visor config:
  skywire cli pty host --listen :2022 --allow 02f9...,03d1...

  # Use a non-default visor config for the server identity:
  skywire cli pty host --listen :2022 --sk-from-visor /etc/skywire/skywire.json --allow 02f9...

  # Use a standalone dmsgpty config.json for both identity AND whitelist:
  skywire cli pty host --listen :2022 --conf /etc/skywire/pty.json`,
	SilenceErrors:         true,
	SilenceUsage:          true,
	DisableSuggestions:    true,
	DisableFlagsInUseLine: true,
	RunE: func(cmd *cobra.Command, _ []string) error {
		if sshdListen == "" {
			return fmt.Errorf("pty host: --listen is required")
		}

		log := logging.MustGetLogger("sshd")
		if lvl, err := logging.LevelFromString(sshdLog); err == nil {
			logging.SetLevel(lvl)
		}

		sk, err := resolveServerSK(sshdConfPath, sshdSKFromConf)
		if err != nil {
			return err
		}
		pk, err := sk.PubKey()
		if err != nil {
			return fmt.Errorf("pty host: derive PK from SK: %w", err)
		}

		wl, wlSize, err := buildSshdWhitelist(sshdConfPath, sshdAllow)
		if err != nil {
			return err
		}

		host := pty.NewHost(nil, wl)

		ctx, cancel := cmdutil.SignalContext(context.Background(), log)
		defer cancel()

		log.WithField("addr", sshdListen).
			WithField("pk", pk.String()).
			WithField("whitelist_size", wlSize).
			Info("pty host: listening")

		var wg sync.WaitGroup
		wg.Add(1)
		errCh := make(chan error, 1)
		go func() {
			defer wg.Done()
			errCh <- host.ListenAndServeTCP(ctx, sshdListen, pk, sk)
		}()

		select {
		case <-ctx.Done():
			log.Info("pty host: shutting down on signal")
		case err := <-errCh:
			if err != nil {
				return fmt.Errorf("pty host: listen %s: %w", sshdListen, err)
			}
		}
		wg.Wait()
		return nil
	},
}