id       = "tsh"
name     = "Teleport tsh"
homepage = "https://goteleport.com"
description = "Teleport provides connectivity, authentication, access controls and audit for infrastructure."
icon     = "theSVG:teleport"
executables   = ["tsh"]

[dotfiles]

# tool/tsh/common/tsh.go declares the loaded configuration as
# "TSHConfig is the loaded tsh configuration file ~/.tsh/config/config.yaml",
# and reads command aliases, proxy templates and extra headers out of it. That
# one file is the hand-written part of ~/.tsh.
paths = ["~/.tsh/config/config.yaml"]

exclude = []

# api/profile/profile.go: "Package profile handles management of the Teleport
# profile directory (~/.tsh)", and api/utils/keypaths/keypaths.go puts the
# session keys under it — sessionKeyDir = "keys", holding the user's private
# key, its SSH certificate and the per-cluster TLS certificates. Short-lived,
# but credentials while they live.
#
# The rest of ~/.tsh is neither config nor secret and is simply not synced:
# `current-profile` and the per-proxy <proxy>.yaml profiles are this login's
# state, and `known_hosts` is per-machine trust state.
secret = ["~/.tsh/keys/"]

# Parsed at the start of a tsh command; the long-lived process is the proxy on
# the other end, not this file's reader.
side_effect = false

# No machine_lines. The config file holds aliases, proxy templates and extra
# headers — things a user sets once and wants on every laptop. What is pinned
# to one machine in ~/.tsh is the certificate material, and that is covered by
# `secret` above rather than by a line rule.

[commands]
format = 1
label = "Teleport tsh"
description = "Log in to a Teleport cluster, list nodes and open SSH sessions. Databases, Kubernetes, apps and access requests are left out."
quality = "ai-draft"
base = "fig:tsh"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/tsh.ts"
license = "MIT"

[[commands.subcommand]]
path = ["login"]
label = "Log in"
description = "Log in to a cluster and fetch a session certificate."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/tsh.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "proxy"
label = "Proxy address"
type = "string"
option = ["--proxy"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "user"
label = "User"
type = "string"
option = ["--user"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "auth"
label = "Auth connector"
type = "string"
option = ["--auth"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "ttl"
label = "Minutes to live"
type = "string"
option = ["--ttl"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "insecure"
label = "Skip certificate verification"
type = "boolean"
option = ["--insecure"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["-f", "--format"]
choices = [{ value = "text", label = "Text" }, { value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }]
sources = ["fig"]

[[commands.subcommand.field]]
id = "quiet"
label = "Quiet"
type = "boolean"
option = ["-q", "--quiet"]
sources = ["fig"]

[[commands.subcommand.task]]
id = "login"
label = "Log in to proxy"
fields = ["proxy", "user", "auth"]
required = ["proxy"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["proxy", "user", "auth", "ttl", "format", "quiet", "insecure"]

[[commands.subcommand]]
path = ["ls"]
label = "List nodes"
description = "List remote SSH nodes."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/tsh.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["-f", "--format"]
choices = [{ value = "text", label = "Text" }, { value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }]
sources = ["fig"]

[[commands.subcommand.field]]
id = "quiet"
label = "Quiet"
type = "boolean"
option = ["-q", "--quiet"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "proxy"
label = "Proxy address"
type = "string"
option = ["--proxy"]
sources = ["fig"]

[[commands.subcommand.task]]
id = "ls"
label = "List nodes"
fields = ["format"]
required = []

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["format", "quiet", "proxy"]

[[commands.subcommand]]
path = ["ssh"]
label = "SSH to a node"
description = "Run a shell on a node through Teleport. Port forwarding options are left out."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/tsh.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "target"
label = "user@hostname"
type = "string"
position = 0
sources = ["fig"]

[[commands.subcommand.field]]
id = "login"
label = "Login name"
type = "string"
option = ["-l"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "port"
label = "Port"
type = "integer"
option = ["-p"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "agent"
label = "Forward auth agent"
type = "boolean"
option = ["-A"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "identity"
label = "Identity file"
type = "path"
option = ["-i"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]

[[commands.subcommand.field]]
id = "no_tty"
label = "Disable pseudo-tty"
type = "boolean"
option = ["-T"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "quiet"
label = "Quiet"
type = "boolean"
option = ["-q"]
sources = ["fig"]

[[commands.subcommand.task]]
id = "ssh"
label = "Connect"
fields = ["target"]
required = ["target"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["target", "login", "port", "agent", "identity", "no_tty", "quiet"]