feat(cli): add 'box ssh' command suite (mint, list, show) with auto signers registration

bin/super-cli.py

@@ -3042,6 +3042,73 @@ def cmd_loop_remediate(args):
 # ---------------------------------------------------------------------------
 # CLI Argument Parser Setup
 # ---------------------------------------------------------------------------
+
+def cmd_ssh_mint(args):
+    cmd = ["python3", str(BIN_DIR / "box-ctl.py"), "ssh-mint", args.name]
+    if args.force:
+        cmd.append("--force")
+    res = subprocess.run(cmd, capture_output=True, text=True)
+    if args.json:
+        sys.stdout.write(res.stdout)
+        return
+    try:
+        d = json.loads(res.stdout)
+        if d.get("ok"):
+            print(c_green(f"✓ Minted ed25519 SSH keypair for '{args.name}'"))
+            print(f"  Private key: {d.get('private_key')}")
+            print(f"  Public key:  {d.get('public_key')}")
+            print(f"  Public key text: {d.get('public_key_content')}")
+            print(c_dim("  Registered into: ") + ", ".join(d.get("registered_in", [])))
+        else:
+            print(c_red(f"✗ Failed: {d.get('error')} ({d.get('code')})"))
+    except Exception:
+        sys.stdout.write(res.stdout)
+
+
+def cmd_ssh_list(args):
+    cmd = ["python3", str(BIN_DIR / "box-ctl.py"), "ssh-list"]
+    res = subprocess.run(cmd, capture_output=True, text=True)
+    if args.json:
+        sys.stdout.write(res.stdout)
+        return
+    try:
+        d = json.loads(res.stdout)
+        if d.get("ok"):
+            keys = d.get("keys", [])
+            print("\n" + c_bold(f"=== MANAGED SSH KEYS ({len(keys)}) ===") + "\n")
+            headers = ["NAME", "PRIVATE KEY", "PUB STATUS", "PUBLIC KEY PREVIEW"]
+            rows = []
+            for k in keys:
+                pub_txt = k.get("public_key") or ""
+                preview = (pub_txt[:32] + "..." + pub_txt[-16:]) if len(pub_txt) > 48 else pub_txt
+                rows.append([c_cyan(k.get("name")), k.get("private_key"), c_green("✓ present") if k.get("has_public") else c_red("missing"), preview])
+            print_table(headers, rows)
+            print("\n" + c_dim("  Mint new key: box ssh mint <name> [--force]") + "\n")
+        else:
+            print(c_red(f"✗ Failed: {d.get('error')}"))
+    except Exception:
+        sys.stdout.write(res.stdout)
+
+
+def cmd_ssh_show(args):
+    cmd = ["python3", str(BIN_DIR / "box-ctl.py"), "ssh-show", args.name]
+    res = subprocess.run(cmd, capture_output=True, text=True)
+    if args.json:
+        sys.stdout.write(res.stdout)
+        return
+    try:
+        d = json.loads(res.stdout)
+        if d.get("ok"):
+            print(c_bold(f"=== SSH KEY DETAILS: {args.name} ==="))
+            print(f"  Private key: {d.get('private_key')}")
+            print(f"  Public key:  {d.get('public_key')}")
+            print(f"  Fingerprint: {d.get('fingerprint')}")
+            print(f"\n  Public Key:\n  {c_cyan(d.get('public_key_content'))}\n")
+        else:
+            print(c_red(f"✗ Failed: {d.get('error')}"))
+    except Exception:
+        sys.stdout.write(res.stdout)
+
 def build_parser():
     common = argparse.ArgumentParser(add_help=False)
     common.add_argument("--json", action="store_true", help="Output machine-readable JSON")
@@ -3233,6 +3300,19 @@ def build_parser():
 
     cred_sub.add_parser("list", parents=[common], help="List all registered nodes and vitality statuses")
 
+
+    # Domain: SSH
+    p_ssh = subparsers.add_parser("ssh", parents=[common], help="Mint and manage fleet SSH signing/access keys")
+    ssh_sub = p_ssh.add_subparsers(dest="action")
+
+    p_s_mint = ssh_sub.add_parser("mint", parents=[common], help="Mint a new ed25519 SSH keypair and register in allowed_signers")
+    p_s_mint.add_argument("name", help="Identity/agent name (e.g. 646, pip, dev, canary)")
+    p_s_mint.add_argument("--force", action="store_true", help="Overwrite existing keypair")
+
+    p_s_list = ssh_sub.add_parser("list", parents=[common], help="List managed SSH keypairs and registration status")
+    p_s_show = ssh_sub.add_parser("show", parents=[common], help="Show public key content and fingerprint")
+    p_s_show.add_argument("name", help="Identity/agent name")
+
     # Domain: HARVEST
     p_harvest = subparsers.add_parser("harvest", parents=[common], help="Readback & response harvesting engine")
     harvest_sub = p_harvest.add_subparsers(dest="action")
@@ -3539,6 +3619,16 @@ def main():
             cmd_cred_meta_audit(args)
         else:
             parser.print_help()
+    elif args.domain == "ssh":
+        act = getattr(args, "action", None)
+        if not act or act == "list":
+            cmd_ssh_list(args)
+        elif act == "mint":
+            cmd_ssh_mint(args)
+        elif act == "show":
+            cmd_ssh_show(args)
+        else:
+            p_ssh.print_help()
     elif args.domain == "harvest":
         act = getattr(args, "action", None)
         if not act or act == "status":