The tool reference.

Each tool keeps its own repository and release lifecycle. Follow its source documentation for complete flags, configuration, and policy requirements.

adssh

A programmable shell with policy evaluation, approvals, an HMAC audit chain, Starlark extensions, and an MCP server. The binary remains adssh.

Execution shell. Source documentation ↗

vpscfgfarm

Configuration and deployment gates for SSH fleets. A governor, reviewed contracts, and journals bound every permitted mutation.

Contracted fleet changes. Source documentation ↗

badfarm

Inventory and assess hosts, containers, Kubernetes, and infrastructure code. Emit evidence and a reviewable remediation handoff.

Read-only discovery. Source documentation ↗

goodfarm

Plan, approve, submit, reconcile, and independently verify service repairs through vpscfgfarm. Ships in the badfarm distribution.

Reviewed repair coordination. Source documentation ↗

Repair coordination uses explicit protocol operations through vpscfgfarm. A finding recommendation is not converted into an arbitrary shell command. Some host recipes remain gated until the executor supports them.

farmops

A catalog and loader for routine operations built on badfarm and vpscfgfarm. Scheduling, execution, and reports remain planned.

Routine operations. Source documentation ↗

Current scope is the catalog schema, loader, journal, and test foundations. Compiler, templates, scheduler, runner, and reports are future work.

oos

Find where the disk goes, check policy thresholds, and clean configured paths with quarantine and restore. macOS and Linux.

Disk headroom and cleanup. Source documentation ↗

Out of Danger

Check command arguments and protected paths before invoking a configured executable. A safer normal command path, not an unbypassable security boundary.

Command policy wrapper. Source documentation ↗

The underlying executable remains accessible. This wrapper helps prevent mistakes on the normal command path; it does not isolate a hostile user.

opensah

List suite roles and check that sahlink, sahconnect, and sahapi are on PATH. Reports adssh separately.

Local suite index. Source documentation ↗

sahconnect

Make authenticated SystemAPI HTTP requests, or pass SSH arguments through to the installed adssh executable.

SystemAPI and SSH client. Source documentation ↗

sahconnect api GET /api/v1/fleet
sahconnect ssh -- version

HTTP uses SYSTEMAPI_URL and SYSTEMAPI_API_KEY. SSH launches SAHCONNECT_ADSSH or adssh on PATH.

sahapi

A bearer-protected loopback service with a suite catalog and three fixed, read-only SystemAPI proxy routes.

Local API service. Source documentation ↗

sahlink

Launch a process, record stdio, and optionally relay one socket connection. Read capture and write input through a local control socket.

Process I/O capture. Source documentation ↗

sahlink run -- /bin/echo hello

Stderr prints socket and token-file paths. Capture applies only to the process started by this command and the optional configured relay. Captured output can contain secrets printed by the child. Existing-PID attachment and ptrace are unsupported.

sahcore

The name is reserved. No assigned role, binary, or service exists yet.

Reserved component. Source documentation ↗

Development worktrees

The phase-integration and CI-fix worktrees of vpscfgfarm are development checkouts of the same project. They do not have separate installation paths or product identities.