Connect
Connect is the surface CMDOP exposes for reaching machines you’ve registered. It shows up in three places — and they all dial through the same fleet, the same machine identity, and the same permission rules.
| Surface | Use it when |
|---|---|
CLI — cmdop connect | You live in the terminal, scripting or attaching to one machine. |
| Desktop — Machines tab inspector | You want a GUI machine list with per-machine chat in one click. |
Agent-to-agent — ask_machine, ask_machines | Your agent needs to ask another agent on another machine to do something. |
What replaced “SSH”
cmdop ssh is gone. The transport, identity model, and tool surface
moved into a package called connect — Go: internal/connect/,
CLI: cmd/cmdop/cmds/connect/, agent tool: connecttool. There is
no plain SSH protocol underneath; CMDOP uses an outbound-only gRPC
stream multiplexed over the relay, so machines don’t open ports and
you don’t manage keys.
If your muscle memory still types cmdop ssh vps-audi, run
cmdop connect vps-audi instead. Same intent, real verb.
The mental model
CMDOP machines belong to fleets. A fleet is the unit of billing, membership, and credential scope. You can be a member of several fleets; one is active at a time.
A machine has a stable UUID, a hostname, an optional friendly display name, and an online flag (heartbeat-driven). The fuzzy resolver accepts hostname, display name, unique prefix, or full UUID — the same way for CLI, Desktop, and agent tools.
A session is what you get after attaching. Sessions can be
one-shot (cmdop connect exec) or persistent (remote
sessions carry a 1 MiB ring buffer for
multi-command shells). Some machines are protected by an
attach password; CMDOP caches the resulting
session token for 24 hours.
What you can do
- Attach interactively — pick from a TUI or address by hostname: see Interactive attach.
- Run one-shot commands —
cmdop connect exec, returns structured output for scripts: see Exec. - Hand out access without inviting people — time-limited share links.
- Talk to other agents — agents on different machines call
each other via
ask_machine/ask_machines. - Chat with a specific machine from Desktop — the Machines tab opens a direct-pipe inspector chat to the agent on that machine.
- Chat as a specific machine from CLI —
cmdop chat --machine Xfilters tools to remote-only and seeds the prompt; see CLI machine chat.
How auth resolves
Whatever surface you call from, the credential is the same: the OAuth
access token you obtain with cmdop login. There is no --api-key
flag, CMDOP_API_KEY env var, or stored API-key file — signing in is
the one and only way to authenticate the CLI.
cmdop login # browser device flow
cmdop connect --list # uses the stored OAuth token automaticallyDetails and the “not signed in” remedy live in Credential resolver.
Where to read next
- New here? Start with Fleets and Machines & identity.
- Want the verb-by-verb reference?
cmdop connect. - Building agent automations across hosts? Server-to-server and Multi-machine prompts.
- Sharing access? Share links.
Cmdop