SSH and SFTP
Run commands and move files on a remote server from a workflow, and what the remote server has to provide
The SSH and SFTP blocks (tools scrydon:ssh:* and scrydon:sftp:*) connect to a remote server with the OpenSSH client that ships in the platform. They can run commands and scripts, and they can list, read, write, upload, download, move and delete files.
Connection fields
| Field | Rules |
|---|---|
| Host | A DNS hostname (sftp.example.com), an IPv4 address (10.0.0.12) or an IPv6 address, with or without brackets (fe80::1 or [fe80::1]). It must not start with -, and it must not contain whitespace, control characters, @ or /. Put the port in the Port field, not in the host. |
| Port | 1–65535. Defaults to 22. |
| Username | The login name. It must not start with -, and it must not contain whitespace, control characters, @, :, /, [ or ]. |
| Password or Private key | You need one of the two. Password authentication must be enabled on the server. Encrypted (passphrase-protected) private keys are not supported, so use an unencrypted key or a password. |
| Trusted host key | Optional, but recommended. It is the server's public host key on one line, as <key-type> <base64> (for example ssh-ed25519 AAAAC3Nza…). When you set it, the connection is refused if the server presents any other key, on any port. When you leave it empty, host-key checking is disabled. |
If a request breaks one of these rules, it fails with HTTP 400. The response names the field and the rule, and nothing is sent to the server. The rules exist because the username and host are passed to the OpenSSH client, so a value that starts with - would be read as a client option. A [ or ] in the username is refused for a similar reason: scp would treat the remote path as a local one.
What the remote server must provide
Upload and download use scp. Every other operation is an ordinary command that runs in the remote account's login shell:
| Operation | Remote command |
|---|---|
| Execute Command | your command as given, after cd <working directory> && when you set one |
| Execute Script | bash -s, with the script on standard input (after cd <working directory> && when you set one) |
| List directory / SFTP List Files | ls -lA --color=never |
| Read file | cat |
| Write file | cat >, with the content on standard input |
| Delete file / SFTP Delete File | rm |
| Create directory / SFTP Create Directory | mkdir -p |
| Move / rename | mv |
| Check File Exists | test -e, then echo |
| Check Command Exists | command -v, then echo $? |
| Get System Info | uname -a, hostname and uptime, joined with echo |
| Upload / download | scp over the server's SFTP subsystem. A download that fails with no diagnostic is retried once over the legacy scp protocol, which runs scp on the server, but only when the remote path has no shell-special characters |
So the account needs a POSIX shell with these commands (GNU coreutils or BusyBox) on its exec channel, and Execute Script also needs bash. A server that offers only the SFTP subsystem cannot run them. Public SFTP-only demo servers such as test.rebex.net answer list, delete and create-directory with exit status 127 (command not found). Downloads from them can still work.
Errors
- A remote command that fails is reported as
<operation> failed (exit <code>): <diagnostic>. The diagnostic is the command's stderr, or its stdout when stderr is empty. A path that does not exist, a permission error and a missing command are all errors. List never turns them into an empty listing. (spawn failed)means the OpenSSH client could not be started on the platform side. That is a platform problem, not a problem with your server.- Check File Exists and Check Command Exists answer
falseonly when the remote shell says so. If the connection fails, they report an error instead.
Local paths
Upload and Download read and write local files in the platform's staging area. The local path must be absolute and must stay inside /tmp/scrydon-* after .. segments are resolved.