SSHScript v3.1 Release Notes

SSHScript v3.1 is currently beta. The changes below describe the unreleased working_branch state used to prepare this documentation.

Security

SSH connections verify system host keys by default. Insecure automatic key acceptance now requires an explicit Paramiko policy.
Interactive SSH sessions no longer forward the complete local environment.
Private keys on a connected parent host are read through SFTP instead of being interpolated into a shell command.

Remote stdout and stderr are drained concurrently, and stdin EOF is sent.
Session cleanup failures are observable through close_errors and may be made strict with close(strict=True).
$.break(code) is preserved as the CLI exit status.
run_file() executes exactly one file. Programs should compose scripts through include syntax or Python imports instead of directory or glob execution.
.spy importing is explicit through sshscript.spy_imports() and is scoped automatically while run_file() is executing.
Importing SSHScript no longer patches threading.Thread, warning handling, or __main__.
.spy threads retain Session inheritance through a context-aware Thread created by the source transformer, not a process-wide monkey patch.
Session() construction is side-effect free. Session-stack activation is scoped to execution, context managers, or an explicit unscoped $.connect() operation.

Packaging metadata, an MIT license, contributor guidance, and CI configuration have been prepared in the development workspace. They remain pending release until they are committed with a public v3.1 artifact.

See Contributing and Testing for the release gate that validates these behaviors without SSH credentials.

Last Updated: 2026-09-18 15:58:44