clissh

var RootCmd = &cobra.Command{
	Use:   "ssh <pk>@<host>[:<port>] [-- <command> [args...]]",
	Short: "Open a remote shell or exec a command on a peer visor",
	Long: `skywire cli pty shell — OpenSSH-equivalent client over skywire identity.

Dials a peer's direct-TCP dmsgpty endpoint (the surface exposed by
'skywire cli pty host' or by 'pty.ssh_listen' in the visor config),
runs an XK noise handshake pinning the server's PK, and proxies an
interactive shell or a one-shot exec.

Compared to OpenSSH:
  ssh's host-key check  ↔ noise XK pins the server PK from the
                          destination URL
  authorized_keys       ↔ dmsgpty whitelist on the server side
  password / pubkey     ↔ client PK alone, derived from the local
                          visor's SK by default (override with --sk
                          or --visor-key=false)
  TCP :22 default       ↔ TCP :2022 default (--port to override)
  ssh -t / ssh <cmd>    ↔ no positional command → interactive pty
                          positional command after '--' → exec mode

Examples:
  # Interactive shell on a peer visor at 1.2.3.4:2022
  skywire cli pty shell 0323272a60895f56aad82cb767fb5c413807adcf7c9fb0578b1b1c5807c7f29d4c@1.2.3.4:2022

  # One-shot exec
  skywire cli pty shell 0323...@1.2.3.4:2022 -- systemctl status skywire

  # Use a pinned client SK instead of the visor's
  skywire cli pty shell 0323...@1.2.3.4:2022 --sk <hex> -- whoami

Transport: this command is direct-TCP only. --transport auto and
--transport tcp both select that single path; --transport dmsg /
skynet error with a pointer to 'cli pty exec', which has the via-visor
paths. A tcp://<pk>@host:port destination is accepted (the scheme is
optional); dmsg:// / skynet:// destinations are rejected here.
--standalone is not supported (errors if set).

The underlying transport is identical to 'cli pty exec/start
--via tcp://<pk>@<host>:<port>'; this command is the discoverable
ssh-shaped alias over that path.`,
	Args:                  cobra.MinimumNArgs(1),
	SilenceErrors:         true,
	SilenceUsage:          true,
	DisableSuggestions:    true,
	DisableFlagsInUseLine: true,
	RunE: func(cmd *cobra.Command, args []string) error {
		if sshStandalone {
			return fmt.Errorf("pty shell: --standalone not supported (this command is direct-TCP only); for a via-visor path use `cli pty exec` / `cli pty start`")
		}
		dest := args[0]

		scheme, rest := internal.SplitTargetScheme(dest)
		eff, err := internal.ResolveTransport(sshTransport, cmd.Flags().Changed("transport"), scheme)
		if err != nil {
			return fmt.Errorf("pty shell: %w", err)
		}
		switch eff {
		case internal.TransportAuto, internal.TransportTCP:

		default:
			return fmt.Errorf("pty shell is direct-TCP only; use `cli pty exec --transport %s` for the via-visor path", eff)
		}
		dest = rest

		dest = injectDefaultPort(dest, sshDefPort)

		rPK, addr, err := parseSSHDestination(dest)
		if err != nil {
			return err
		}

		useVisorKey := sshVisorKey
		if !cmd.Flags().Changed("visor-key") && cmd.Flags().Changed("no-visor-key") {
			useVisorKey = !sshNoVisor
		}
		myPK, mySK := resolveSSHIdentity(sshSK, useVisorKey)

		ctx, cancel := cmdutil.SignalContext(context.Background(), nil)
		defer cancel()

		cli := pty.DefaultCLI()

		if len(args) == 1 {
			if sshNoPty {
				return fmt.Errorf("pty shell: --no-pty requires a command to exec")
			}
			return (&cli).StartRemotePtyTCP(ctx, rPK, addr, myPK, mySK, pty.DefaultCmd)
		}

		timeout, err := time.ParseDuration(sshTimeout)
		if err != nil {
			return fmt.Errorf("pty shell: --timeout %q: %w", sshTimeout, err)
		}
		name := args[1]
		var cmdArgs []string
		if len(args) > 2 {
			cmdArgs = args[2:]
		}
		resp, err := (&cli).ExecRemoteTCP(ctx, rPK, addr, myPK, mySK, name, cmdArgs, sshEnv, nil, timeout)
		if err != nil {
			fmt.Fprintf(cmd.ErrOrStderr(), "pty shell: %v\n", err)
			os.Exit(1)
		}
		reportSSHExec(cmd, resp)
		return nil
	},
}