sshepherdlisted

Use this skill whenever the user mentions "sshepherd" by name, or wants to check on a remote server (health, disk, memory, CPU, ports, OOM history), inspect or restart docker/systemd services, tail remote logs, read or write remote config files, deploy a project via a named recipe, introspect a remote Postgres database, or audit SSH/security posture on a box — while keeping the agent zero-knowledge about credentials (no password, private key, or host/user/port ever reaches the agent's context or a tool response). Covers all 9 registry-driven command groups (hosts, check, logs, services, deploy, config, db, files, security) via a single compiled Bun/TypeScript CLI that shells out to the system `ssh` binary — the agent only ever passes an ssh alias, a pg-target name, or a recipe name, never a credential. `setup` is a separate group (deliberately not one of the 9) that writes sshepherd's own local config files; every `setup` action is agent-invocable, with one narrow exception — `setup ssh-alias install` opens a
Antheurus/sshepherd · ★ 0 · DevOps & Infrastructure · score 72

Install: claude install-skill Antheurus/sshepherd

# sshepherd `sshepherd` is a compiled Bun/TypeScript CLI for server operations over SSH — health checks, service/container control, log tailing, config edits, Postgres introspection, and declarative deploys — built so an agent can drive a real server without ever seeing a password, private key, host, user, or port. Every op resolves through an ssh alias already configured in `~/.ssh/config` (or a `db`-group pg-target / `deploy`-group recipe name that itself resolves to an alias); OpenSSH does the actual authentication, entirely outside this process. **Binary:** `/Users/macbook/Documents/PROJECT_MISPAQUL_ATTORIQ/sshepherd/dist/sshepherd` If the binary is missing, build it first: ```bash cd /Users/macbook/Documents/PROJECT_MISPAQUL_ATTORIQ/sshepherd && just build ``` Call the binary by its absolute path — it is not on `PATH`. Every example below uses the bare `sshepherd` name for brevity; substitute the absolute path when invoking. **Deep references (read on demand, not upfront):** - `references/transport.md` — the zero-knowledge SSH model, ControlMaster lifecycle, the error classification enum, why stderr is discarded entirely. - `references/recipes.md` — the TOML deploy-recipe format, every step kind, `depends_on` ordering, the `[rollback]` block, `--dry-run` plan shape, a complete worked recipe. - `references/db.md` — the pg-target model, read-only enforcement layers, the `db` ops' output shapes, why `db query` rejects multi-statement SQL. - `references/output-s