skarbiec ssh new

Invocation#

skarbiec ssh new <id> [--comment <text>] [--name <display name>] [--tags <tag,...>]

Purpose#

Make an SSH key whose private half lives only in the vault, and get the public half to paste into a server's authorized_keys or a forge.

Required inputs and options#

• One new item id. --comment is the key's comment (the id when left out), --name the display name the item shows under, --tags its tags. POST /v1/operator/items/new-ssh-key takes id, comment, name and tags.

Output and state effects#

• Runs ssh-keygen -t ed25519 with an empty passphrase into an owner-only directory created beside the vault file, reads the private and public key, removes the directory, stores a key-pair item with private_key and public_key, appends an ssh-key-created audit entry, and prints ok, item, type and public_key. The private key never reaches standard output; `ssh add <id>` loads it into an agent through a pipe, and `get <id> --field public_key` prints the public key again. Desktop's Items → New SSH key does the same and offers Copy public key.

Refusals#

• Anything but one id exits 2 with the usage. An id that already exists is refused with `<id> already exists; ssh new creates an item and never replaces one (rotate <id> --with ssh replaces its key)`; a vault path without a directory, a workspace that cannot be created, ssh-keygen's own refusal (`ssh-keygen <status>: <its words>; nothing was written`) and a key file that cannot be read are named, and nothing is stored on any of them. A tag no namespace covers is refused as set refuses it.