plugin-ssh

Placement	compiled-in (in-process)
Source	github.com/opencharly/plugin-ssh/candy/plugin-ssh
Version	2026.209.0000
Candy	plugin-ssh

This plugin is listed in charly/charly.yml’s compiled_plugins:, so its providers are compiled into the charly binary and register in-process.

Providers

The reserved words this plugin serves:

• ssh — command class

What it does

COMPILED-IN charly COMMAND-class plugin owning the externalized charly ssh tunnel spice/vnc command (#118 loader+check-tail cone). It opens an SSH-forwarded local SPICE/VNC endpoint pointing at a VM’s display on a remote libvirt host, for clients that don’t natively understand qemu+ssh:// (standalone remote-viewer with a TCP addr, TigerVNC, Spicy). virt-manager and remote-viewer --connect qemu+ssh://… do NOT need it.

The plugin owns the command end to end: the kong grammar (SshCmd → tunnel spice/vnc), the sshx SSH-tunnel machinery, the vmshared libvirt-URI parse, and the kit UNIX→TCP bridge — all sdk libraries. The ONE thing it cannot do itself is the display-endpoint RESOLVE (go-libvirt, out-of-process): it reaches verb:libvirt DIRECTLY over its in-proc reverse channel via InvokeProvider, so no charly-core symbol crosses the boundary.

ssh is COMPILED-IN (listed in charly/charly.yml compiled_plugins) BECAUSE its Invoke(OpRun) needs the in-proc reverse channel — threaded by dispatchInProcCommand — to reach verb:libvirt. The out-of-process CliMain path has no reverse channel, so it errors. command:ssh dispatches through the compiled-in registry path (registerCompiledPlugin → resolve(ClassCommand,“ssh”) → dispatchInProcCommand → Invoke(OpRun)); NewMeta advertises command:ssh with no plugin_input (the args are plain CLI tokens kong-parsed into SshCmd).

Parameter schema

The CUE schema below is the authoritative grammar for this plugin’s input. It is the same single source that generates the plugin’s Go parameter types and answers the runtime Describe RPC, so this page cannot disagree with either.

schema/ssh.cue

// plugin-ssh's OWN self-contained CUE schema — the SINGLE SOURCE for this plugin's
// served declaration surface (there is no schema-less plugin: every plugin ships a
// non-empty schema over Describe).
//
// SELF-CONTAINED and PACKAGE-LESS: it references no base def and carries no package
// clause, so it compiles STANDALONE — the property the SDK's serve-side compile needs
// and the property that lets the host splice `base ++ plugin` at the load gate
// (registerPluginUnitSchema); a self-contained schema that will not splice is a LOUD
// load failure.
//
// NO GO CONSUMER: the plugin declares no typed `plugin_input` (its authored input is
// its pass-through CLI grammar), so this schema generates NO `params` package and has
// NO `cue exp gengotypes` artifact — it is the SERVED documentation/config surface,
// not a code-generation source.
//
// It DOCUMENTS the `command: ssh` contract. The concrete subcommands/flags live in the Kong grammar; this schema declares the command word + its contract.
#SshPlugin: {
  // The command word the plugin serves.
  command: "ssh"

  // What the command does, in one line (the public-docs surface).
  contract: string & !=""

}

---

See also the candy reference for this candy’s install surface.