Host endpoint lifecycle only: op=list|open|close. open uses profile=; close uses ep=. Not for serial ports — use the console tool.

Remote non-interactive exec on ep=. Provide command= or argv= or script=/script_path=; optional runtime=, script_args=, cwd=, timeout=.

Filesystem on ep=: op=list|stat|read|write|put|get|mkdir|rm; path= absolute preferred.

Interactive PTY screen on host ep=: op=open|send|close|list. Loop: open → frame → send(actions) → frame → close. Not for serial hardware — use the console tool.

Persistent PowerShell runspace (WinRM): op=open|invoke|close. open needs ep=; invoke/close need id=; invoke uses script=.

Serial Console (embedded device link on this host; not PTY/SSH). op=list|open|send|views|close|sessions. list: system device= names (do not scan /dev or drivers). open: path= or device= from list, optional baud=, max_lines= (default huge buffer; background capture starts immediately). send: id= + data= or data_b64=, optional newline=. views: id= + mode=tail|since|contains; n=; since=; contains=; context=; settle_ms=; with_seq=; queries capture buffer (not driver recv). close/sessions: id= / list open sessions.

Complete self-config for profiles. Do NOT shell-edit config files. ops: help|home|ensure_home|get|list_profiles|get_profile|put_profile|delete_profile|put_secret|list_secrets. Password is NOT private — write it inline: put_profile name=lab transport=ssh host=… username=… auth={"method":"password","password":""} ssh={"known_hosts":"none"} then endpoint open profile=lab. SSH key still uses put_secret + key_path=secrets/…. WinRM: auth password=plain + winrm={scheme,auth}; optional defaults/caps. op=help for recipes.