SSHScript 7.0.0

SSHScript 7.0.0 standardizes the connection API and improves interactive console input, exits, output and error diagnostics.

Incompatible connection changes

Use hostname, parent_key_filename, proxy_command, proxy_jump,
missing_host_key_policy and known_hosts_source in place of the former names.
Only hostname may be positional. key_filename reads local files;
parent_key_filename reads caller-host RSA keys. Compatibility aliases are not retained.

SSHScript remains in active development; pin and validate before upgrading.

Changes

• Document reproducible test-snapshot updates for code, matching documents and
  the complete agent skill; make interactive-input and program-return regressions
  independent of short real-I/O deadlines on busy CI runners.

• Run full CI on pull requests and release pushes without duplicate
  candidate-push runs. Preserve all platform/backend matrices and required gates.

• Keep minimum-backend CI on Paramiko 2.11 with cryptography<48, and use
  encrypted OpenSSH RSA fixtures for key-passphrase forwarding tests.

• Add console-only input(secret=True) and automatic hidden input for recognized
  password/passphrase/PIN/token prompts in entered programs. Bypass Python parsing
  and readline history, restore terminal echo after cancellation, and reject
  getpass plaintext fallback. Embedded hosts supply their own password_func.

• Rename connection arguments to hostname, parent_key_filename, proxy_command,
  proxy_jump, missing_host_key_policy and known_hosts_source with no aliases.
  Rename matching Session settings/properties and CLI flags. Keep key_filename
  as a local-file option; caller-host RSA keys use parent_key_filename and
  passphrase, falling back to password for decryption.

• Make connection arguments after hostname keyword-only. Explicit username
  always overrides a user embedded in hostname; remove password guessing.
  Reject unknown/backend-unsupported keywords and socket/key conflicts before
  opening connections. Provide typed Paramiko keyword options.

• State prominently that the project is not stable and incompatible changes
  may occur without a deprecation period; pin and revalidate before upgrading.

• Add :error and :traceback diagnostics that also work inside entered
  programs; retain original syntax/protocol exceptions for explicit inspection.

• Preserve entered-program output on input timeouts and before subsequent input.
  Recognize parent-shell returns without a configured program prompt even when
  the silence wait times out. Do not send another reply after a delayed return.

• Add console-only $.exit() to leave one layer and $.exit("command") to
  supply an entered program's exit sequence when leaving. With no explicit or
  configured sequence, display a reminder without sending input. Keep the layer
  until the program's return to its parent shell is detected.

• Display script CLI command output automatically for each stream connected to
  a terminal. Add --quiet/-q; retain --verbose/-v and --stderr overrides
  for redirection. The three output options are mutually exclusive. Explicit
  Python output is unchanged; library defaults remain unchanged.

Install

python3 -m pip install --upgrade 'sshscript==7.0.0'
sshscript --version

Python 3.11+ is required. See the documentation,
version and API differences,
and agent skill and update workflow.
The attached verified.json records the distribution SHA-256 hashes.

Last modified: 2026-10-25 15:44:15