Install. Inspect. Connect.

Install the SAH utilities.

Requires Go 1.26 or later. Clone each repository and build from its root. Repository access is required; these commands do not assume a published package release.

git clone https://github.com/afterdarksys/opensah.git
git clone https://github.com/afterdarksys/sahconnect.git
git clone https://github.com/afterdarksys/sahapi.git
git clone https://github.com/afterdarksys/sahlink.git

(cd opensah && go install ./cmd/opensah)
(cd sahconnect && go install ./cmd/sahconnect)
(cd sahapi && go install ./cmd/sahapi)
(cd sahlink && go install ./cmd/sahlink)

Add your configured GOBIN, or the default $(go env GOPATH)/bin, to PATH. Then check the installation:

opensah tools
opensah ready
sahlink run -- /bin/echo hello

opensah ready returns a failure when sahconnect, sahapi, or sahlink is missing. A missing adssh is reported but does not fail the check. sahcore is intentionally unassigned.

Build the execution shell.

The development binary remains adssh. Requires Go 1.26 or later. Build from source using the repository targets:

git clone https://github.com/afterdarksys/adssh.git
cd adssh
make build
make build-mcp
./adssh --help

Build outputs are adssh and adssh-mcp. Read the repository policy documentation before connecting the shell to a managed environment. A Homebrew formula template is not a published tap.

Connect to SystemAPI.

Use your configured control-plane origin and an API key with the necessary permissions. The example hostname below is a placeholder.

export SYSTEMAPI_URL=https://systemapi.example
# Set SYSTEMAPI_API_KEY through your secret manager.
sahconnect api GET /api/v1/fleet

For an agent build from an existing SystemAPI checkout:

cd systemapi-agent
go build -o systemapi-agent .
# Set SYSTEMAPI_API_KEY through your secret manager.
./systemapi-agent \
  --server wss://systemapi.example/api/v1/systems/stream \
  --tenant YOUR_TENANT

The tenant, host enrollment, and credential must be configured on the control plane. This is a host connection procedure, not a hosted-account signup. Managed platform scope is Linux.

Run the local proxy.

Set a 16–512 byte local bearer without whitespace as SAHAPI_TOKEN. Keep the listener on a loopback IP.

# Set SAHAPI_TOKEN through your secret manager.
export SAHAPI_LISTEN=127.0.0.1:8787
export SYSTEMAPI_URL=https://systemapi.example
# Set SYSTEMAPI_API_KEY through your secret manager.
sahapi serve

/health is unauthenticated. The suite catalog and proxy routes require the local bearer. Without the upstream URL and key, proxy requests return 503 systemapi_unconfigured.

Install the farm tools.

badfarm and goodfarm ship together. Use Python 3.9 or later and follow the repository’s dependency instructions.

git clone https://github.com/afterdarksys/badfarm.git
cd badfarm
python3 -m pip install '.[yaml,iac]'
badfarm doctor
badfarm --offline inventory local
goodfarm --help

For vpscfgfarm, configure the isolated interpreter and estate governor using its installation guide. It refuses execution without the governor. Do not substitute a generic wrapper for its documented invocation.

Local operational utilities.

go install github.com/afterdarksys/oos/cmd/oos@latest
oos
oos -C

oos -C previews cleanup. For Out of Danger, build with Cargo and validate the policy before installing wrapper symlinks.