src

Package cli is the cobra command surface for ssh-manager.

Package authkeys has pure helpers for editing an authorized_keys file, ported from src/ssh_manager/core/authorized_keys.py.

Package expiry is the pure expiry-policy engine, ported from src/ssh_manager/core/expiry.py.

Package inventory is the deployment-tracking model, ported from src/ssh_manager/core/inventory.py.

Package key implements the ssh-manager key-naming convention, ported from src/ssh_manager/core/key.py.

Package manifest is the ssh-manager manifest domain model, ported from src/ssh_manager/core/manifest.py.

Package providers is the read-only provider catalog, ported from the spec/ registry parts of src/ssh_manager/providers (base.py + registry.py).

Package renderer renders the managed SSH config, ported from src/ssh_manager/core/renderer.py (+ its two Jinja2 templates).

Package platform isolates the OS-specific behaviour sshmgr needs, so the rest of the tree can stay free of runtime.GOOS branches: terminal handling for reading secrets without echoing them (here), and the OS predicates every other package asks its questions through (os.go).

Package agent adds keys to the ssh-agent (macOS keychain), ported from services/agent.py + facade.load.

Package bundler makes and restores an age-encrypted backup.

Package configsvc renders, checks, and shows the SSH config, ported from src/ssh_manager/services/configsvc.py.

Package deployer installs a key's public half on its target(s) and records the deployment, ported from services/deployer.py.

Package doctor diagnoses the install: deps, perms, agent, known_hosts, manifest-vs-disk drift, and dangling keys.

Package editor does manifest editing - profile/host add·edit·delete - ported from services/editor.py.

Package importer onboards an existing ~/.ssh into the manifest + inventory, ported from services/importer.py.

Package initsvc creates and converges the per-user home, ported from facade.init: it (re)creates the directory scaffolding, seeds the starter files (manifest, inventory, .env) when missing, and re-asserts secret perms.

Package keyaudit is the one definition of what "dangling" means for a key.

Package keystore generates and fingerprints SSH keys by shelling out to ssh-keygen, ported from services/keystore.py.

Package keysvc is the key-centric read layer: for every key the manifest owns, what is on disk for it, which hosts wire it, and where it is deployed.

Package knownhosts pins host keys via ssh-keyscan, ported from services/knownhosts.py + facade.{known_hosts_targets,init_known_hosts}.

Package lifecycle removes a profile or a key completely, as one guarded transaction.

Package migratesvc moves a legacy home (~/.config/sshmgr from before the rename, or the older ~/.sshmgr) to the OS-standard home, ported from facade.migrate_home.

Package netstat reports per-host network reachability for the `net` verb, ported from facade.network_status.

Package notifier drives the expiry surfaces from the pure expiry engine, ported from services/notifier.py: States (per-key expiry), Banner (the debounced inline reminder), and Notify (the cadence-gated desktop alert).

Package preflight detects the OS and verifies the SSH tooling doctor needs, ported from services/preflight.py.

Package query is the read-only view layer over the manifest + inventory that backs list/view (and feeds audit), ported from src/ssh_manager/services/query.py.

Package reconciler rebuilds the ~/.ssh tree from the manifest.

Package recover emits break-glass recovery material, ported from facade.recovery_script + _recovery_snippet.

Package rotator does zero-downtime, staged, single-old-archive key rotation, ported from services/rotator.py.

Package snapshots is the local reversible-backup layer for ~/.ssh.

Package validate checks that managed keypairs parse, that the public key matches the private key, and that perms are correct.

Package askpass delivers a passphrase to ssh-keygen without it ever appearing on a command line.

Package desktop posts a best-effort desktop notification, ported from the platforms/*.notify methods: terminal-notifier/osascript on macOS, notify-send on Linux, a PowerShell balloon on Windows.

Package fs has atomic-write and directory helpers, ported from the parts of src/ssh_manager/util/fs.py the renderer/config writer need.

Package homeperms is the single enumeration of the config-home secret paths and their canonical modes, shared by init (the seeder) and doctor (the fixer) so they can never disagree.

Package httpjson is a minimal JSON-over-HTTP client for the REST provider adapters, ported from util/http.py.

Package lock is an advisory file lock so concurrent commands (e.g.

Package log writes the append-only audit trail, ported from util/log.audit.

Package netcheck is the network reachability + VPN status probe, ported from util/net.py.

Package paths resolves the per-user home and the on-disk layout, ported from src/ssh_manager/util/paths.py + the platform config_dir logic.

Package perms centralizes the file modes ssh-manager enforces and applies them in a platform-correct way - POSIX chmod on Unix, ACLs via icacls on Windows.

Package scheduler installs the daily job that runs `sshmgr audit --notify`, ported from the platforms/*.install_scheduler layer: a launchd agent on macOS, a systemd --user timer (else cron) on Linux, a schtasks task on Windows.

Package secrets resolves provider tokens, ported from util/secrets.py.

Package version carries the build version.