Remote Access/en - Versionsgeschichte

Sv: Fold the Automatic-Refresh bullets onto single physical lines

2026-05-26T18:52:47Z

Fold the Automatic-Refresh bullets onto single physical lines

← Nächstältere Version		Version vom 26. Mai 2026, 18:52 Uhr
Zeile 56:		Zeile 56:
	detect external changes. The default depends on the current root:		detect external changes. The default depends on the current root:

	* Local filesystem → '''on''' (10-second cycle, matches the		* Local filesystem → '''on''' (10-second cycle, matches the long-standing behaviour).
			* SFTP → '''off'''. Each cycle costs one STAT round-trip per child, which is fine for a handful of local directories but painful over the network. Click Refresh manually when you need to pick up remote changes.
	long-standing behaviour).
	* SFTP → '''off'''. Each cycle costs one STAT round-trip
	per child, which is fine for a handful of local directories but
	painful over the network. Click Refresh manually when you need
	to pick up remote changes.

	When you navigate between local and SFTP roots the toggle flips		When you navigate between local and SFTP roots the toggle flips

Sv: Document the Automatic Refresh dropdown toggle and its root-type default

2026-05-26T18:50:31Z

Document the Automatic Refresh dropdown toggle and its root-type default

← Nächstältere Version		Version vom 26. Mai 2026, 18:50 Uhr
Zeile 43:		Zeile 43:
	<code>/</code>.		<code>/</code>.

		⚫	The '''Refresh''' button in the toolbar (the round-arrow icon
	The directory tree does '''not''' auto-update: previously a background
		⚫	between ''Forward'' and ''DirectoryUp'') re-reads both the
	task walked every expanded item every 10 seconds, which over SFTP
		⚫	directory tree and the contents pane on demand. Works uniformly
	meant one STAT round-trip per child on every cycle. Click the
		⚫	for local and SFTP paths; for SFTP it also flushes the per-file
⚫	'''Refresh''' button in the toolbar (the round-arrow icon ~~between~~
		⚫	STAT cache, so changes made directly on the remote side become
⚫	''Forward'' and ''DirectoryUp'') to re-~~read~~ ~~the tree and~~ the
		⚫	visible immediately rather than waiting for the 5-second cache TTL
⚫	contents pane on demand. ~~Refresh works~~ uniformly ~~for local and~~
		⚫	to expire.
⚫	SFTP paths; for SFTP it also flushes the per-file ~~STAT cache, so~~

⚫	changes made directly on the remote side become ~~visible~~
			The small arrow next to the Refresh icon opens a dropdown with a
⚫	immediately rather than waiting for the 5-second cache TTL to
			single checkbox, '''Automatic Refresh''', controlling the
⚫	expire.
			background polling task that walks every expanded tree item to
			detect external changes. The default depends on the current root:

			* Local filesystem → '''on''' (10-second cycle, matches the
			long-standing behaviour).
			* SFTP → '''off'''. Each cycle costs one STAT round-trip
			per child, which is fine for a handful of local directories but
			painful over the network. Click Refresh manually when you need
			to pick up remote changes.

			When you navigate between local and SFTP roots the toggle flips
			automatically — but only if you haven't overridden it for
			the previous root. An explicit user choice is preserved across
			navigations.

	The Tools menu offers four browser actions, three of them gated on		The Tools menu offers four browser actions, three of them gated on

Sv: Document the Refresh toolbar button (and the disabled tree auto-poll)

2026-05-26T13:46:08Z

Document the Refresh toolbar button (and the disabled tree auto-poll)

@@ Zeile 42: / Zeile 42: @@
 User defaults to the local login name, port to 22, path to
 <code>/</code>.
 The Tools menu offers four browser actions, three of them gated on

Sv: Fold bullet continuation lines onto a single physical line so MediaWiki keeps them inside

2026-05-26T10:33:01Z

Fold bullet continuation lines onto a single physical line so MediaWiki keeps them inside <li>

Änderungen zeigen

Sv: Remove 2-space continuation-line indent (was triggering MediaWiki

2026-05-26T10:29:04Z

Remove 2-space continuation-line indent (was triggering MediaWiki <pre>)

Änderungen zeigen

Sv: Use label= for the bold language link (after Template:Languages patch)

2026-05-26T10:20:13Z

Use label= for the bold language link (after Template:Languages patch)

← Nächstältere Version		Version vom 26. Mai 2026, 10:20 Uhr
Zeile 1:		Zeile 1:
	{{Languages~~\|Remote Access~~\|Remote Access/en}}		{{Languages\|Remote Access/en\|label=English}}

	'''Remote access''' is the ability to drive a remote computer or		'''Remote access''' is the ability to drive a remote computer or

Sv: Add Filesystem Info feature; document OpenSSH SFTP extensions (posix-rename, hardlink, statvfs, fsync); correct stale limitations/future-work entries.

2026-05-26T09:53:07Z

Add Filesystem Info feature; document OpenSSH SFTP extensions (posix-rename, hardlink, statvfs, fsync); correct stale limitations/future-work entries.

@@ Zeile 1: / Zeile 1: @@
 '''Remote access''' is the ability to drive a remote computer or
@@ Zeile 52: / Zeile 53: @@
 <code>/</code>.
-The Tools menu offers three SSH-related actions, all gated on the
+The Tools menu offers four browser actions, three of them gated on
-SSH library being loaded:
+the SSH library being loaded:
 * '''Generate SSH Key Pair...''' — opens the same key-generation
@@ Zeile 61: / Zeile 62: @@
 * '''SFTP Connect...''' — points this browser tab at a remote
   filesystem via SFTP.
 == From expecco actions ==
@@ Zeile 372: / Zeile 381: @@
   no SSH_FXP_READLINK exposed (<code>#isSymbolicLink</code> always
   <code>false</code>, <code>#linkInfo</code> returns the regular
-  stat info).  SFTPv5+ features (atomic-overwrite rename via
+  stat info).  Several SFTPv5+ niceties are nevertheless picked up
 * '''Per-host serialisation.'''  Two concurrent operations on the
   same host queue through the host mutex.  See [[#Future work]].
-* '''<code>#renameTo:</code> has a TOCTOU window.'''  POSIX-style
+* '''<code>#renameTo:</code> fallback has a TOCTOU window.'''  On
 * '''<code>#isNonEmptyDirectory</code> is heuristic.'''  Always
   returns <code>#isDirectory</code> (the accurate answer would cost
@@ Zeile 412: / Zeile 424: @@
 heartbeat, SSH_MSG_DISCONNECT.
 |}
 === Connection pooling ===
@@ Zeile 448: / Zeile 496: @@
   + READ_DIR (first batch only) + CLOSE — three RTTs per probe;
   needs SftpClient to pipeline requests before this pays off.
-* '''SFTP v5/v6 negotiation''' for atomic-overwrite rename,
+* '''SFTP v5/v6 negotiation''' for extended attrs and FTP-style
 = Command Shell =

Sv: Die Seite wurde neu angelegt: „ '''Remote access''' is the ability to drive a remote computer or network from this expecco image — opening shells, running commands, moving files, or driving a test target. Three protocol families are supported, listed in current-recommended order: * '''SSH and SFTP''' (recommended) — encrypted shell + secure file transfer over an SSH-2 tunnel. Pure-Smalltalk implementation in `exept:libcrypt/ssh`; no external dependency on OpenSS…“

2026-05-26T08:49:01Z

Die Seite wurde neu angelegt: „ '''Remote access''' is the ability to drive a remote computer or network from this expecco image — opening shells, running commands, moving files, or driving a test target. Three protocol families are supported, listed in current-recommended order: * '''SSH and SFTP''' (recommended) — encrypted shell + secure file transfer over an SSH-2 tunnel. Pure-Smalltalk implementation in <code>exept:libcrypt/ssh</code>; no external dependency on OpenSS…“

Neue Seite

'''Remote access''' is the ability to drive a remote computer or
network from this expecco image — opening shells, running commands,
moving files, or driving a test target. Three protocol families are
supported, listed in current-recommended order:

* '''SSH and SFTP''' (recommended) — encrypted shell + secure
file transfer over an SSH-2 tunnel. Pure-Smalltalk implementation
in <code>exept:libcrypt/ssh</code>; no external dependency on
OpenSSL or libssh. Use this for anything that touches credentials
or sensitive payloads.
* '''Local Command Shell''' — fork + exec on the local machine.
Used for local-tool integration and for the local end of a remote
workflow that bridges via another protocol.
* '''Telnet''' (legacy) — plain-text terminal session. No
encryption, passwords on the wire in clear. Use only when the
target hardware has no other option.

= SSH and SFTP =

The SSH stack covers the full SSH-2 protocol (RFC 4251–4254,
RFC 5656, RFC 8709, RFC 8731) plus OpenSSH's chacha20-poly1305
transport cipher and the SFTP v3 file-transfer subsystem
(draft-ietf-secsh-filexfer-02). Two layers:

* '''<code>SSH::Client</code>''' — programmatic SSH access (remote
<code>exec</code>, TTY shell, agent forwarding, ProxyJump bastion).
* '''<code>SSH::SftpFilename</code>''' — a <code>Filename</code>
subclass that lets the rest of ST/X treat a remote SFTP path the
same way it treats a local file.

The rest of this section is organised user-task-first: what the user
sees and does, the expecco-library hooks below that, then the
implementation detail at the end for the curious.

== From the FileBrowserV2 ==

Open the location dropdown and paste an <code>sftp://</code> URL.
The browser tab populates as if it were a local path. Tree
expansion, column sort (name / size / mtime), preview, and
double-click-to-open-in-editor all behave normally. The first
click on a host takes ~200–500 ms (TCP + KEX + auth); subsequent
clicks reuse the pooled connection.

URL syntax:

<pre>
sftp://[user@]host[:port]/remote/path
</pre>

User defaults to the local login name, port to 22, path to
<code>/</code>.

The Tools menu offers three SSH-related actions, all gated on the
SSH library being loaded:

* '''Generate SSH Key Pair...''' — opens the same key-generation
dialog described under [[#Generating an SSH key pair]] below.
* '''SSH Connect...''' — opens an interactive VT100 terminal to a
remote host.
* '''SFTP Connect...''' — points this browser tab at a remote
filesystem via SFTP.

== From expecco actions ==

The Expecco RemoteAccess plugin
([[Expecco::RemoteAccessImportPlugin]]) exposes the following test
actions to the expecco action palette:

* '''CmdShell - Open SSH Remote Connection''' — opens an SSH session
via the platform's <code>ssh</code> binary (PuTTY's
<code>plink</code> on Windows).
* '''CmdShell - Open SSH Remote Connection and PublicKey''' — same
but with explicit public-key authentication.

To run these you need a configured keypair (private key on this
machine, public key in the remote host's
<code>~/.ssh/authorized_keys</code>). Generate one via the dialog
below or via <code>ssh-keygen</code>.

The plugin also adds a settings page at '''Extras → Settings →
Plugins → Remote Access — SSH Keys''' carrying a single
'''Generate SSH Key Pair...''' button that opens the same dialog.

== Generating an SSH key pair ==

=== The dialog (FileBrowserV2 / settings page) ===

The dialog asks for all parameters in one form:

* '''Comment''' — embedded in the generated key (defaults to
<code>stx@<hostname></code>).
* '''Storage''':
** ''Save to disk file only'' — writes <code>~/.ssh/id_ed25519_stx</code>
(or wherever) plus a matching <code>.pub</code> companion.
** ''Save to disk AND load into ssh-agent'' — writes the file and
also hands the key to the running ssh-agent.
** ''Load into ssh-agent only'' — key lives in agent memory only;
gone on agent restart.
* '''Private key file''' — full path; disabled in agent-only mode.
* '''Passphrase / Confirm''' — empty leaves the on-disk file
unencrypted (agent-only mode ignores the passphrase, since the
OpenSSH agent wire protocol carries only the decrypted key).

On '''Generate''', the public-key line (the same
<code>ssh-ed25519 AAAA... comment</code> string ssh-keygen
emits) is copied to the system clipboard for pasting into the
remote host's <code>~/.ssh/authorized_keys</code>.

=== From a workspace ===

For headless deployments, sandboxed builds, or scripts,
<code>SSH::Client</code> exposes a pure-Smalltalk key generator
that produces output bit-compatible with
<code>ssh-keygen -t ed25519</code>:

<pre>
| seed comment priv |
seed := SSH::Client generateEd25519Seed.
comment := 'stx@', OperatingSystem getHostName.

"/ Save passphrase-encrypted to disk"
priv := (Filename homeDirectory / '.ssh' / 'id_ed25519_stx') pathName.
SSH::Client
saveOpenSshEd25519Seed:seed
toFile:priv
comment:comment
passphrase:'choose-something-long'.

"/ AND load into the running agent"
SSH::Client addEd25519SeedToAgent:seed comment:comment.

"/ Print the public-key line to paste into authorized_keys"
Transcript showCR:
(SSH::Client authorizedKeysLineForEd25519Seed:seed comment:comment).
</pre>

Keys generated this way are interoperable with OpenSSH's own
tooling (<code>ssh-keygen -y -f ...</code> re-derives the public
key, <code>ssh-keygen -p -f ...</code> changes the passphrase,
etc.).

=== Using the shell tools instead ===

The traditional path also works:

<pre>
ssh-keygen -t ed25519 -C "stx@your.host"
ssh-copy-id user@remotehost
ssh-add ~/.ssh/id_ed25519
</pre>

== Preparing ssh-agent ==

The agent path is strongly preferred over reading raw keyfiles: it
keeps encrypted private keys unlocked once per session, and handles
identities (hardware-token-backed keys, KeePassXC entries) that
ST/X should never see directly.

ST/X picks the agent path automatically when
<code>$SSH_AUTH_SOCK</code> is set in the process environment
'''at the time stx is launched'''. Setting it later from a
workspace does not help.

=== Linux / macOS ===

Most desktop distributions launch an agent automatically as part of
the session (gnome-keyring on GNOME, ssh-agent.service on systemd,
KWallet on KDE). Verify in a terminal:

<pre>
echo $SSH_AUTH_SOCK # /run/user/1000/keyring/ssh or similar
ssh-add -l # lists loaded identities
ssh-add ~/.ssh/id_ed25519 # load yours if not loaded
</pre>

If no agent runs at all, add this snippet to your shell rc:

<pre>
# ~/.bashrc or ~/.zshrc
if [ -z "$SSH_AUTH_SOCK" ]; then
eval "$(ssh-agent -s)" > /dev/null
fi
</pre>

ST/X must be launched from a shell that has seen this rc — a
desktop launcher started from the file manager does NOT inherit
the variable. Wrap the stx start command in a small script under
<code>~/.local/bin/</code> that sources the rc first.

The Remote Access settings page ('''Extras → Settings → Plugins
→ Remote Access — SSH Keys''') shows whether the running image
sees an agent.

==== Permanent setup via systemd ====

For a truly cross-session agent (survives desktop logouts, comes
up automatically at next login), enable the per-user systemd
unit shipped with most distros' <code>openssh-clients</code>
package:

<pre>
systemctl --user enable --now ssh-agent.service
</pre>

Then point <code>SSH_AUTH_SOCK</code> at the user-service socket
in your shell rc (this replaces the <code>eval $(ssh-agent -s)</code>
snippet above):

<pre>
export SSH_AUTH_SOCK="${XDG_RUNTIME_DIR}/ssh-agent.socket"
</pre>

==== Auto-loading keys on first use ====

To skip the manual <code>ssh-add</code> step, let OpenSSH load
keys into the agent automatically the first time they are needed.
Add to <code>~/.ssh/config</code>:

<pre>
Host *
AddKeysToAgent yes
IdentityFile ~/.ssh/id_ed25519
</pre>

The first SSH connection then prompts for the key passphrase
once and hands the unlocked key to the agent; subsequent
connections use the cached identity without prompting.

=== Windows ===

Windows 10+ ships native OpenSSH including an agent service.
One-time setup:

# Open '''Services''' (<code>services.msc</code>) as Administrator.
# Find '''OpenSSH Authentication Agent''', set Startup Type to
'''Automatic''', click '''Start'''.
# In PowerShell: <code>ssh-add $HOME\.ssh\id_ed25519</code>.
# Verify: <code>ssh-add -l</code>.

The Windows OpenSSH agent listens on a named pipe
(<code>\\.\pipe\openssh-ssh-agent</code>), not a Unix socket. ST/X
supports both transports, but Windows ssh-add does '''not''' set
<code>SSH_AUTH_SOCK</code> for you. Add it manually:

# Press {{Key|Win}} → type "environment" → "Edit the system environment variables".
# '''Environment Variables''' → under '''User variables''', '''New'''.
# Name: <code>SSH_AUTH_SOCK</code>
# Value: <code>\\.\pipe\openssh-ssh-agent</code>
# Log out and back in (or restart stx) so the new env propagates.

==== PowerShell quick-setup ====

The same setup from an '''elevated''' PowerShell prompt, for
scripts or unattended provisioning:

<pre>
# Start the agent now AND on every reboot (permanent).
Set-Service -Name ssh-agent -StartupType Automatic
Start-Service ssh-agent

# Persist SSH_AUTH_SOCK for the user (survives reboots).
[Environment]::SetEnvironmentVariable(
'SSH_AUTH_SOCK',
'\\.\pipe\openssh-ssh-agent',
'User')

# Load a key (prompts for the passphrase if the file is encrypted).
ssh-add $HOME\.ssh\id_ed25519
</pre>

For a one-shot agent start without making it persistent (e.g.
single-session test), drop the <code>Set-Service</code> line and
just run <code>Start-Service ssh-agent</code>. The env-var line
can also be omitted if <code>SSH_AUTH_SOCK</code> is only needed
in the current shell — use <code>$env:SSH_AUTH_SOCK = '...'</code>
instead for that session-local form.

On stripped-down Windows installs the ssh-agent service may not
be present. Add it once via '''Settings → Apps → Optional
features → OpenSSH Client'''.

Alternative agents:

* '''PuTTY pageant''' — uses its own protocol; NOT supported by
ST/X's SSH::Agent. Migrate the keys to OpenSSH.
* '''Git for Windows ssh-agent''' — works; point
<code>SSH_AUTH_SOCK</code> at the socket it publishes.
* '''WSL 2''' — a ST/X inside WSL sees WSL's Linux agent normally;
a ST/X on the Windows side does not. Bridging needs a helper
like <code>npiperelay</code> + <code>socat</code>.

Verify in the Remote Access settings page
('''Extras → Settings → Plugins → Remote Access — SSH Keys''') —
the agent indicator there reports whether the running image sees
the agent.

==== Auto-loading keys on first use ====

Windows OpenSSH does '''not''' persist agent-loaded keys across
agent restarts. To avoid running <code>ssh-add</code> manually
after each reboot, add the same lazy-load configuration to
<code>%USERPROFILE%\.ssh\config</code>:

<pre>
Host *
AddKeysToAgent yes
IdentityFile ~/.ssh/id_ed25519
</pre>

OpenSSH then loads the key into the agent on first use (prompts
for the passphrase once) and reuses it for the rest of the
session.

== Configuration ==

All tunables are class-side on <code>SSH::SftpFilename</code>:

{| class="wikitable"
! Accessor !! Default !! What it controls
|-
| <code>#idleEvictionSeconds:</code> || 240 (4 min) || How long a pooled
connection sits idle before the next access proactively closes +
reopens it. Just under typical sshd
<code>ClientAliveInterval × ClientAliveCountMax</code> so we recycle
before the server TCP-RESETs us. Pass <code>nil</code> to restore
the default.
|-
| <code>#attrsCacheTtlSeconds:</code> || 5 || Max age (s) of a
cached STAT before <code>#ensureAttrs</code> refetches. Parent
listDir always re-stamps fresh attrs onto children, so navigating
an open directory does not pay the TTL. Set to <code>0</code> to
disable caching.
|-
| <code>#closeAllConnections</code> || (action) || Tears down every
pooled connection. Useful after a known-bad network event, before
a deliberate identity swap, or as part of a clean image shutdown.
|}

== Diagnostics ==

=== SemaphoreMonitor ===

Open <code>SemaphoreMonitor</code> from the Launcher's "Status"
sub-menu. Per-host SFTP mutex appears as
<code>SFTP/<user@host:port></code>; the pool-wide mutex as
<code>SFTP/pool</code>. Right-click a row:

* '''Copy Waiters Stack to Clipboard''' — dumps the last-owner's
walkback plus each waiter's, formatted as plain text. Use when
a process is wedged in <code>readWait</code> inside
<code>withSftpClientDo:</code> and you need to see which SFTP
request it is on.
* '''Copy List to Clipboard''' — the whole table, for an
email-this-to-someone diagnosis.
* '''Detect Deadlocks''' — DFS over the wait-for graph, reports
cycles.

=== Logger ===

The SSH stack logs interesting events:

* <code>warning:</code> on auto-reconnect after a dead connection.
* <code>warning:</code> when a pool entry is idle-evicted.
* <code>warning:</code> when an SSH key file cannot be parsed
(e.g. legacy PEM, encrypted-without-agent) — the file is skipped,
others tried.

== Limitations ==

* '''SFTP v3 only.''' No SETSTAT (no remote chmod / chown / utime),
no SSH_FXP_READLINK exposed (<code>#isSymbolicLink</code> always
<code>false</code>, <code>#linkInfo</code> returns the regular
stat info). SFTPv5+ features (atomic-overwrite rename via
<code>SSH_FXF_OVERWRITE</code>) not supported.
* '''Per-host serialisation.''' Two concurrent operations on the
same host queue through the host mutex. See [[#Future work]].
* '''<code>#renameTo:</code> has a TOCTOU window.''' POSIX-style
overwrite is emulated as delete-then-rename; another process can
race in between.
* '''<code>#isNonEmptyDirectory</code> is heuristic.''' Always
returns <code>#isDirectory</code> (the accurate answer would cost
three round-trips per directory icon, which made the original tree
expansion unbearably slow).

== Implementation details ==

For readers wanting the architecture. Five classes, top-down:

{| class="wikitable"
! Class !! Role
|-
| <code>SSH::SftpFilename</code> || Filename subclass; the public
API. Maps <code>sftp://...</code> URLs to remote files; exposes
<code>directoryContents</code>, <code>readingFileDo:</code>,
<code>renameTo:</code> etc.
|-
| <code>SSH::SftpClient</code> || SFTP-v3 protocol
(request/response codec, listDir, stat, open, read, write, mkdir).
Driven by SftpFilename.
|-
| <code>SSH::Channel</code> || SSH channel multiplexer
(CHANNEL_OPEN, DATA, EOF, CLOSE, WINDOW_ADJUST). One logical
session per Channel instance.
|-
| <code>SSH::Client</code> || High-level SSH client: opens the
transport, runs KEX, host-key check, userauth, then dispenses
Channels.
|-
| <code>SSH::Transport</code> || Wire layer. Banner + KEXINIT
exchange, ChaCha20-Poly1305 packet framing, sendSeq / recvSeq,
heartbeat, SSH_MSG_DISCONNECT.
|}

=== Connection pooling ===

Every <code>SftpFilename</code> instance pointing at the same
<code>user@host:port</code> triple shares one
<code>SSH::Client</code> plus one <code>SSH::SftpClient</code>.
Pool is class-side, guarded by a single
<code>ConnectionPoolMutex</code>:

* '''Lazy bring-up''' — TCP + KEX + userauth + SFTP INIT happens
on the first SFTP operation, not on <code>forUrl:</code>.
* '''Per-host serialisation''' — SFTP requests on a given host
are serialised through a <code>RecursionLock</code> named
<code>SFTP/<user@host:port></code> (visible in
SemaphoreMonitor).
* '''Idle eviction''' — unused for longer than
<code>idleEvictionSeconds</code>, the entry is proactively
closed + reopened on the next access.
* '''Auto-reconnect''' — a transport-level failure (broken pipe,
EOF, MNU on nil socket) evicts the dead pool entry, opens a
fresh client, retries the request '''once'''. Application-level
SFTP STATUS errors propagate immediately.

== Future work ==

Tracked but not yet implemented:

* '''Multi-channel parallelism per host''' — today one TCP +
one SFTP channel per host means N concurrent requests
serialise. Pipelining over multiple SshClients in the pool
(preferred), or a transport-level reader process demultiplexing
to per-channel inboxes, would let the tree pane keep listing
while the content pane reads a large file.
* '''Accurate <code>#isNonEmptyDirectory</code>''' via OPEN_DIR
+ READ_DIR (first batch only) + CLOSE — three RTTs per probe;
needs SftpClient to pipeline requests before this pays off.
* '''SFTP v5/v6 negotiation''' for atomic-overwrite rename,
extended attrs, FTP-style canonicalisation.

= Command Shell =

Local command shell on this expecco machine. Typical applications:
local command-line, running a local helper tool, bridging a
remote workflow to a local utility.

The Expecco RemoteAccess plugin exposes:

* '''CmdShell - Open'''
* '''CmdShell - Close'''

No credentials, no network — runs as the expecco process's own
user. Output streams to expecco's log.

= Telnet =

[[File:Warning.svg|24px|Warning]] '''Telnet is a legacy protocol
with no encryption.''' Passwords are transmitted in plain text on
the wire; anyone on the network path can read them. Use Telnet
ONLY when the target device has no other option (typically: old
industrial controllers, lab instruments, embedded measurement
equipment without an SSH stack). For everything else use
[[#SSH and SFTP]].

The expecco plugin exposes:

* '''Telnet - Open Remote Connection With Login'''
* '''Telnet - Execute Remote Command'''
* '''Example - Remote Device Control via Telnet''' (internal demo)

The Telnet protocol (RFC 854) is a bidirectional 8-bit byte stream
over TCP, with in-band control sequences for terminal options.
A connection is established to a target host:port; after optional
in-band login, both sides can send data.

= See also =

* [[SSH Client/en|SSH::Client]] — the SSH layer (exec, TTY, agent
forwarding, ProxyJump).
* [[FileBrowserV2/en|FileBrowserV2]] — the main UI client of
this stack.
* [[ClaudeCode plugin/en|Claude Code]] — uses the same SSH stack
for its HTTPS transport.
* [[Wikipedia:Secure Shell|RFC 4251 (SSH-2 Architecture)]]
* [[Wikipedia:Telnet|RFC 854 (Telnet Protocol)]]

[[Category:Plugins]]
[[Category:Network]]
[[Category:SSH]]