aspera-cli 4.27.5 → 4.28.0

data/docs/README.md

@@ -1,9 +1,10 @@
 # Command Line Interface for IBM Aspera products
 <!--
-EDITING GUIDELINES (developers and AI):
+EDITING GUIDELINES:
 - This file is the source template for the generated README.md. Edit this file, not README.md.
-- Do not use Unicode characters unless strictly necessary (e.g. wizard menu labels that must
-  match the actual on-screen UI text). Use plain ASCII equivalents instead:
+- Do not use Unicode characters unless strictly necessary
+  (e.g. wizard menu labels that must match the actual on-screen UI text). 
+  Use plain ASCII equivalents instead:
     apostrophe : ' (not ' or ')
     dash       : - (not en-dash U+2013, not em-dash U+2014, not --)
     ellipsis   : ... (not U+2026)
@@ -11,7 +12,7 @@ EDITING GUIDELINES (developers and AI):
 DO NOT EDIT: THIS FILE IS GENERATED, edit docs/README.erb.md.
 PANDOC_DEFAULTS_BEGIN
 metadata:
-  subtitle: "ascli 4.27.5"
+  subtitle: "ascli 4.28.0"
   author: "Laurent Martin"
 PANDOC_DEFAULTS_END
 -->
@@ -96,23 +97,43 @@ Example implementations can be found at: <https://github.com/laurent-martin/aspe
 For scripting and ad hoc command-line tasks, `ascli` is ideal.
 It is developer-friendly and well-suited for testing and learning Aspera APIs (see [Logging, Debugging](#logging-debugging)).
 
-### CLI landscape overview: `ascp`
+### `ascli` or `ascp`?
 
 `ascp` is the low-level command-line utility that implements the FASP protocol and is used for actual data transfers.
 Every Aspera transfer involves an `ascp` process on both the client and server sides.
-While `ascp` can be used directly, it is limited to basic send/receive operations and lacks features like configuration management, automatic resume, and remote file listing.
-`ascli` provides a higher-level interface that encompasses all `ascp` capabilities and adds significant usability improvements.
+`ascli` is not an alternative transfer engine: it starts `ascp` (directly or through another [transfer agent](#agent-direct)), so transfer performance is identical.
 
-To use `ascp` directly as a command line, refer to the IBM Aspera documentation of either [Desktop Client](https://www.ibm.com/docs/en/asdc), [Endpoint](https://www.ibm.com/docs/en/ahte) or [Transfer Server](https://www.ibm.com/docs/en/ahts) - each of which includes [a dedicated section on `ascp`](https://www.ibm.com/docs/en/ahts/4.4?topic=linux-ascp-transferring-from-command-line).
+Other low-level command line tools are included with Aspera transfer products, and `ascli` is a front end for them too:
+
+- `async`: the IBM Aspera Sync utility, to synchronize folders (see [IBM Aspera Sync](#ibm-aspera-sync)).
+- `ascp4`: an alternate transfer engine, selected with transfer spec parameter `use_ascp4`. `ascp4` will be deprecated: use `ascp` unless one of its specific features is needed.
+
+Used directly, `ascp` is limited to sending and receiving files:
+
+- Connection parameters (address, ports, user, credentials) must be provided on each command line: there are no connection profiles.
+- The remote server cannot be browsed: remote paths must be known in advance.
+- With Aspera applications (AoC, Faspex, Shares, Node API), the transfer address and token must first be obtained through the application's REST API.
+- Multi-session requires starting and monitoring one `ascp` process per session (option `-C`).
+- On interruption, `ascp` exits with an error: data already at destination is skipped on the next run (option `-k`), but restarting is up to the caller.
+
+`ascli` adds:
 
-Using `ascli` with the `server` plugin instead of raw `ascp` provides several advantages:
+- Configuration presets, with secrets protected in a vault (see [Option Preset](#option-preset) and [Secret Vault](#secret-vault))
+- Detection of the Aspera application from its URL, and automatic retrieval of transfer parameters and tokens (see [Wizard](#wizard))
+- Remote file browsing and management: list, create folder, rename, copy, delete, checksum
+- Built-in multi-session, with an aggregated progress bar (see [Multi-session transfer](#multi-session-transfer))
+- Automatic resume on retry-able errors, with increasing delay and token renewal (see [Agent: Direct](#agent-direct))
+- Choice of transfer agents: Direct, Node, Connect, HTTP Gateway, Transfer Daemon
+- Structured output (table, JSON, YAML, CSV) for scripting (see [Output](#output))
 
-- Automatic resume on error
-- Configuration file support
-- Choice of transfer agents
-- Built-in multi-session support
+All `ascp` options remain available, either through transfer spec parameters (listed with `config ascp spec`), or by passing `ascp` arguments directly when using the `direct` agent (via `ascp_args` in option `transfer`).
 
-All `ascp` options are supported, either through transfer spec parameters (listed with `config ascp spec`), or by passing `ascp` arguments directly when using the `direct` agent (via `ascp_args` in option `transfer`).
+Using `ascp` directly remains relevant when:
+
+- `ascli` cannot be installed: `ascp` is included with every Aspera transfer product.
+- The need is limited to simple transfers with an HSTS using SSH credentials.
+
+To use `ascp` directly as a command line, refer to the IBM Aspera documentation of either [Desktop Client](https://www.ibm.com/docs/en/asdc), [Endpoint](https://www.ibm.com/docs/en/ahte) or [Transfer Server](https://www.ibm.com/docs/en/ahts) - each of which includes [a dedicated section on `ascp`](https://www.ibm.com/docs/en/ahts/4.4?topic=linux-ascp-transferring-from-command-line).
 
 ### Notations, Shell, Examples
 
@@ -145,7 +166,7 @@ This section walks you through your first interaction with `ascli` on Linux.
 
 ```shell
 mkdir -p $HOME/bin
-tar -C $HOME/bin -zxvf ascli-4.27.5-linux-x86_64.tgz
+tar -C $HOME/bin -zxvf ascli-4.28.0-linux-x86_64.tgz
 export PATH=$PATH:$HOME/bin
 ```
 
@@ -159,7 +180,7 @@ ascli -v
 ```
 
 ```text
-4.27.5
+4.28.0
 ```
 
 - Install the Aspera transfer runtime (tested version), as it is not included in the `ascli` package:
@@ -396,7 +417,11 @@ To uninstall, delete the folder, and the symbolic link if it was created.
 A ready-to-use ZIP archive for Windows (x64) is available in the [Releases](https://github.com/IBM/aspera-cli/releases): `aspera-cli-<VERSION>-windows-x86_64-portable.zip`.
 
 It contains the Ruby runtime, the aspera-cli gem with its dependencies, and the Aspera Transfer SDK (`ascp`).
-No installation step, no administrator rights, and no internet access are required.
+Apart from the prerequisite below, no installation step, no administrator rights, and no internet access are required.
+
+> [!IMPORTANT]
+> The package does not include the Microsoft Visual C++ Redistributable (x64), which `ascp` requires.
+> If it is not already present on the system, install it from [Microsoft Visual C++ Redistributable latest supported downloads](https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist) (administrator rights required), otherwise transfers fail.
 
 1. Download the ZIP archive, then right-click on it and select **Extract All...**.
    Preferably, extract in a folder writable by the user, for example: `%LOCALAPPDATA%\Programs`.
@@ -414,6 +439,8 @@ No installation step, no administrator rights, and no internet access are requir
    ascli -v
    ```
 
+4. Optionally, activate the [shell completion](#shell-completion) of PowerShell (the folder must be in the `PATH`).
+
 > [!NOTE]
 > The launcher `ascli.cmd` uses the `ascp` located in folder `sdk` of the package, unless environment variable `ASCLI_SDK_FOLDER` is set.
 > So, `ascli config transferd install` is not needed.
@@ -438,10 +465,10 @@ Then, install the Aspera Transfer Daemon, see [Installing `ascp` through `transf
 
 A Ruby interpreter is required to run `ascli`.
 
-Required Ruby version is version: >= 3.1.
+Required Ruby version is version: >= 3.2.
 
 > [!WARNING]
-> The minimum Ruby version will be 3.2 in a future version.
+> The minimum Ruby version will be 3.3 in a future version.
 
 **Ruby can be installed using any of the following methods**: `rpm`, `yum`, `dnf`, `rvm`, `rbenv`, `brew`, Windows installer, ...
 
@@ -452,7 +479,8 @@ Required Ruby version is version: >= 3.1.
 
 For convenience, you may refer to the following sections for a proposed method for specific operating systems.
 
-`ascli` requires a Ruby version [at least under maintenance support](https://www.ruby-lang.org/en/downloads/branches/).
+`ascli` supports a Ruby version until 18 months after its [end of official support](https://www.ruby-lang.org/en/downloads/branches/).
+The minimum version is increased accordingly, and announced in advance.
 If only an older Ruby version must be used due to system constraints, use an older version of `ascli` that supports it; refer to [rubygems.org](https://rubygems.org/gems/aspera-cli).
 
 #### Windows: Installer
@@ -542,7 +570,7 @@ If your Linux distribution provides a standard Ruby package, you can use it prov
 - Enable the Ruby version you selected:
 
   ```shell
-  dnf module -y enable ruby:3.2
+  dnf module -y enable ruby:3.3
 
   dnf install -y ruby-devel
   ```
@@ -726,7 +754,7 @@ Those are not installed as part of dependencies because they involve compilation
 See [Gemfile](../Gemfile):
 
 | name | version | comment |
-|---------------------|----------|-------------------------------------------------------------------------------|
+|---------------------|-----------|-------------------------------------------------------------------------------|
 | rake | ~> 13.0 |  |
 | debug | ~> 1.11 | (no jruby) |
 | grpc-tools | ~> 1.67 |  |
@@ -738,16 +766,17 @@ See [Gemfile](../Gemfile):
 | rubocop-shopify | ~> 2.0 |  |
 | simplecov | ~> 0.22 |  |
 | solargraph | ~> 0.48 | (no jruby) |
+| ferrum | ~> 0.19.1 | (no jruby) |
 | mcp | ~> 1.2 | for ascli mcp server (MCP protocol support) |
 | rack | ~> 3.0 | for ascli mcp server HTTP transport (required by mcp StreamableHTTPTransport) |
 | grpc | ~> 1.71 | (no jruby) for Aspera Transfer Daemon |
-| base64 | ~> 0.3 | if RUBY_VERSION >= '3.4' remove from standard gems |
 | sqlite3 | ~> 2.7 | (no jruby) for async DB |
 | jdbc-sqlite3 | ~> 3.46 | (jruby) for async DB |
 | sequel | ~> 5.96 | (jruby) for async DB |
 | ed25519 | ~> 1.4 | (no jruby) for ed25519 and OpenSSH file format |
 | bcrypt_pbkdf | ~> 1.1 | (no jruby) for ed25519 and OpenSSH file format |
 | syslog | ~> 0.3 | (no jruby) for logger=syslog |
+| zxcvbn | ~> 1.0 | for better estimate of secret strength (faspex5 postprocessing secret_token) |
 | rmagick | ~> 6.1 | (no jruby) for terminal view |
 
 Install like this:
@@ -764,16 +793,17 @@ gem install rubocop-performance -v '~> 1.10'
 gem install rubocop-shopify -v '~> 2.0'
 gem install simplecov -v '~> 0.22'
 gem install solargraph -v '~> 0.48'
+gem install ferrum -v '~> 0.19.1'
 gem install mcp -v '~> 1.2'
 gem install rack -v '~> 3.0'
 gem install grpc -v '~> 1.71'
-gem install base64 -v '~> 0.3'
 gem install sqlite3 -v '~> 2.7'
 gem install jdbc-sqlite3 -v '~> 3.46'
 gem install sequel -v '~> 5.96'
 gem install ed25519 -v '~> 1.4'
 gem install bcrypt_pbkdf -v '~> 1.1'
 gem install syslog -v '~> 0.3'
+gem install zxcvbn -v '~> 1.0'
 gem install rmagick -v '~> 6.1'
 ```
 
@@ -857,7 +887,9 @@ The installation of the transfer binaries follows those steps:
 
 - **Select the SDK package to use**. Check the `sdk_url` option:
   - If the value is **not** the default value (`DEF`), it directly specifies the archive URL to download.
-  - If the value is `DEF`, `ascli` downloads the YAML file from the URL specified by the `locations_url` option (default: <https://ibm.biz/sdk_location>).
+  - If the value is `DEF`, `ascli` downloads the YAML file from the URLs specified by the `locations_url` option.
+    - URLs are tried in order until one succeeds. All but the last are tried with a short timeout and no retry.
+      By default: <https://ibm.biz/sdk_location>, then its target on GitHub.
     - This YAML file lists supported architectures (OS, CPU) and Aspera Transfer Daemon versions with their associated package URLs.
     - The SDK version is selected as follows: if an additional **positional parameter** is provided it specifies the version; if the special value `LATEST` is given the latest available version is used; otherwise the version tested with this release of `ascli` is used.
     - The package URL matching the current system architecture is then used.
@@ -865,11 +897,11 @@ The installation of the transfer binaries follows those steps:
   - By default, the archive is extracted to `$HOME/.aspera/sdk`.
   - The destination folder can be changed by setting the `sdk_folder` option.
 
-| Option          | Default | Description                                            |
-|-----------------|---------|--------------------------------------------------------|
-| `sdk_url`       | `DEF`   | URL to download the Aspera Transfer Daemon archive.<br/>`DEF` means: select from available archives. |
-| `locations_url` | `https://ibm.biz/sdk_location` | URL to get download URLs of Aspera Transfer Daemon from IBM official repository. |
-| `sdk_folder`    | `$HOME/.aspera/sdk` | Folder where the SDK archive is extracted. |
+| Option        | Description                                                  |
+|---------------|--------------------------------------------------------------|
+| `sdk_url`     | URL to download the Aspera Transfer Daemon archive.<br/>Default: `DEF` (select from available archives.) |
+| `locations_url` | List of URLs to get download URLs of Aspera Transfer Daemon from IBM official repository, tried in order.<br/>A list given in options replaces the default list.<br/>Default:<br/>- `https://ibm.biz/sdk_location`<br/>- `https://raw.githubusercontent.com/IBM/aspera-cli/refs/heads/main/docs/sdk_location.yaml`|
+| `sdk_folder`  | Folder where the SDK archive is extracted.<br/>Default: `$HOME/.aspera/sdk` |
 
 Transfer Daemon versions available from `locations_url` can be listed with: `ascli config transferd list`
 
@@ -899,10 +931,10 @@ ascli config transferd install --sdk-url=file:///macos-arm64-1.1.3-c6c7a2a.zip
 
 The format is: `file:///<PATH>` (canonical form) or `file:<PATH>` (short form), where `<PATH>` can be either a relative path (not starting with `/`), or an absolute path (starting with `/`).
 
-| Form | Relative example | Absolute example |
-|------|-----------------|-----------------|
+| Form      | Relative example            | Absolute example                 |
+|-----------|-----------------------------|----------------------------------|
 | Canonical | `file:///mydir/archive.zip` | `file:////home/user/archive.zip` |
-| Short | `file:mydir/archive.zip` | `file:/home/user/archive.zip` |
+| Short     | `file:mydir/archive.zip`    | `file:/home/user/archive.zip`    |
 
 Supported platforms are listed in the [Release Notes](https://developer.ibm.com/apis/catalog/aspera--aspera-transfer-sdk/Release+notes) and archives can be downloaded from [Downloads](https://developer.ibm.com/apis/catalog/aspera--aspera-transfer-sdk/downloads/downloads.json).
 
@@ -967,11 +999,11 @@ Alternatively, the necessary gems can be packaged into a `tar.gz` archive as fol
 
 ```shell
 mkdir temp_folder
-gem install aspera-cli:4.27.5 --no-document --install-dir temp_folder
+gem install aspera-cli:4.28.0 --no-document --install-dir temp_folder
 find temp_folder
-mv temp_folder/cache aspera-cli-4.27.5-gems
+mv temp_folder/cache aspera-cli-4.28.0-gems
 rm -fr temp_folder
-tar zcvf aspera-cli-4.27.5-gems.tgz aspera-cli-4.27.5-gems
+tar zcvf aspera-cli-4.28.0-gems.tgz aspera-cli-4.28.0-gems
 ```
 
 #### Unix-like: Alternative installation using `rvm`
@@ -1107,7 +1139,7 @@ ascli -v
 ```
 
 ```text
-4.27.5
+4.28.0
 ```
 
 To persist the configuration on the host, specify your user's configuration folder as a volume for the container.
@@ -1565,8 +1597,8 @@ Understanding this concept once makes it immediately usable everywhere it appear
 
 [Dot-path](#dot-path-notation) notation is used in four distinct places in `ascli`:
 
-| Surface                   | Syntax                | in/out | read/write |
-|---------------------------|-----------------------|--------|------------|
+| Surface        | Syntax                | in/out | read/write |
+|----------------|-----------------------|--------|------------|
 | [Option](#options) names  | `--opt.key.sub=value` | Input  | write     |
 | [Positional arguments](#positional-arguments) | `@: key.sub=value ... [END]` | Input | write |
 | [Extended value](#extended-value-syntax) `@preset:` | `@preset:key.sub` | Input | read  |
@@ -1627,24 +1659,25 @@ It allows you to construct complex parameters (`Hash`es and `Array`s) directly f
 The general syntax for this argument is:
 
 ```text
-@: <DOT_PATH>=<VALUE> [<DOT_PATH>=<VALUE>] ... [END]
+@:[<MARKER>] <DOT_PATH>=<VALUE> [<DOT_PATH>=<VALUE>] ... [<MARKER>]
 ```
 
-- `@:`: The prefix that initiates the collection of [dot-path](#dot-path-notation) assignments into a single data structure.
+- `@:[<MARKER>]`: A standalone argument that starts collecting [dot-path](#dot-path-notation) assignments into a single data structure.
+  The optional text after `:` sets the end marker. If it is empty, the marker is `END`.
 
 - `<DOT_PATH>=<VALUE>`: An assignment using the standard [dot-path](#dot-path-notation) notation. Multiple assignments can be provided in sequence to build a complex object.
 
-- `END`: An optional marker that terminates the `@:` parsing session.
+- `<MARKER>` (`END` by default): An optional argument that ends the collection.
 
-  - Without `END`: **All** remaining positional arguments are consumed and interpreted as part of the nested structure, as if `END` were the last argument on the command line.
+  - Without the marker: **All** remaining positional arguments are collected, and each one must contain `=`.
 
-  - With `END`: **Only** arguments between `@:` and `END` are used for the structure. Any arguments following `END` are treated as separate, subsequent positional parameters for the command.
+  - With the marker: **Only** arguments between `@:` and the marker are used for the structure. Arguments after the marker are passed to the command as normal positional arguments.
 
-  - If another value than `END` is preferred, then specify: `@:<MARKER>` and use `@:<MARKER>` as replacement for `END`.
+  - Example with a custom marker: `@:STOP a=1 STOP`.
 
 > [!IMPORTANT]
 > Use `END` whenever any positional argument must follow the object built with `@:` (for example, a file list, or any other subsequent positional parameter).
-> Without `END`, those arguments are silently consumed as [dot-path](#dot-path-notation) keys instead of being passed to the command.
+> Without `END`, those arguments are collected as [dot-path](#dot-path-notation) assignments instead of being passed to the command: an argument without `=` causes an error, and an argument containing `=` is silently added to the structure.
 
 **Example**: Sending a package with a file list using `@:` for package information.
 
@@ -1653,7 +1686,7 @@ ascli aoc packages send @: name="<TITLE>" recipients.0=user@example.com END file
 ```
 
 > [!CAUTION]
-> In the above example, removing `END` would cause `file1.dat` and `file2.dat` to be consumed as [dot-path](#dot-path-notation) keys, not passed as files.
+> In the above example, removing `END` causes an error, because `file1.dat` is read as a [dot-path](#dot-path-notation) assignment and does not contain `=`.
 
 > [!NOTE]
 > `@:` can also be used as an option value (for example, `--query=@: a=b`).
@@ -1745,11 +1778,11 @@ A command line argument is typically designed as option if:
 ### Interactive Input
 
 Some options and **Command Parameters** are mandatory and others are optional.
-By default, `ascli` prompts for missing mandatory options or **Command Parameters** during interactive execution.
+By default, `ascli` raises an error for missing mandatory options or **Command Parameters**.
 
 The behavior can be controlled with:
 
-- `--interactive=<yes|no>` (default=yes if STDIN is a terminal, else no)
+- `--interactive=<yes|no>` (default=no)
   - `yes`: Missing mandatory parameters/arguments are asked to the user.
   - `no`: Missing mandatory parameters/arguments raise an error message.
 - `--ask-options=<yes|no>` (default=no)
@@ -1810,7 +1843,7 @@ ascli config echo @json:'{"ni":null,"es":"","ea":[],"eh":{}}'
 The style of output can be set using the `format` option:
 
 | `format` | Output formatting         |
-|----------|---------------------------|
+| -------- | -------- |
 | `table`  | Text table (default)      |
 | `text`   | Value as `String`         |
 | `ruby`   | Ruby code                 |
@@ -1844,6 +1877,11 @@ A special parameter is defined: `str_lst_sep` (`String`), default is `\n`.
 It defines how lists of strings are displayed.
 Alternatively, set to `,`.
 
+When the output is a terminal, the table is fitted to the terminal width: columns with text (e.g. `description`) are wrapped, the widest first.
+If not enough, other columns (names, identifiers) are wrapped too, preferably after a punctuation (`-`, `_`, `.`, `/`).
+If the table cannot fit, columns are narrowed to their minimum width (20 characters for text, 10 for others, or heading).
+Parameter `width` (`Integer`) sets the maximum table width (e.g. `--out.table.width=100`), also when the output is not a terminal.
+
 For `format=csv`, options are described in gem [`csv`](https://ruby.github.io/csv/CSV.html#class-CSV-label-Options+for+Generating).
 
 For example, to display a CSV with headers and quotes:
@@ -1862,7 +1900,7 @@ If value is `no`, then object's `field` names are only the first level keys of t
 
 If value is `yes` (default), then objects are "flattened" using [dot-path](#dot-path-notation) notation with a variation:
 
-- Final arrays are displayed as comma separated list of values
+- Final arrays are displayed as a list of values, one per line (see `str_lst_sep` in `--out.table` above)
 - `Array` of `Hash` with only `name` keys are displayed as comma separated list of values
 - `Array` of `Hash` with only `name` and `value` keys are displayed like a `Hash` with value of `name` as key.
 
@@ -2017,18 +2055,17 @@ The option `--out.level` controls the level of output:
 
 #### Option: `--out.secrets`: Hide or show secrets in results
 
-- If value is `no` (default), then secrets are redacted from command results.
+- If value is `no` (default), then secrets are redacted from command results: replaced with `🔑`, or `***` if the terminal does not support Unicode (see [`--out.utf8`](#terminal-rendering-colors-and-utf-8)).
 - If value is `yes`, then secrets are shown in clear in results.
-- If `--out.level` is `data`, secrets are included to allow piping results.
 
 #### Terminal rendering: Colors and UTF-8
 
 By default, `ascli` detects the capabilities of the terminal:
 
 | Option         | Effect when `yes`                                             | Auto-detection (default)                                                       |
-|----------------|---------------------------------------------------------------|--------------------------------------------------------------------------------|
-| `--out.colors` | ANSI colors and styles in results, messages and logs          | `yes` if both `stdout` and `stderr` are terminals and `TERM` is not `dumb`, or if `CLICOLOR_FORCE=1` |
-| `--out.utf8`   | Unicode characters: table borders, check marks                | `yes` if `stdout` is a terminal and the locale is UTF-8                        |
+|--|--|--|
+| `--out.colors` | ANSI colors and styles in results, messages and logs          | `no` if [`NO_COLOR`](https://no-color.org) is set or results are written to a file (`--out.file`), else `yes` if `CLICOLOR_FORCE` is set and not `0`, else `yes` if both `stdout` and `stderr` are terminals, `TERM` is not `dumb` and `CLICOLOR` is not `0` |
+| `--out.utf8`   | Unicode characters: table borders, check marks, hidden secrets, symbols in messages, half blocks in images (else ASCII equivalents) | `yes` if `stdout` is a terminal and the locale is UTF-8, or on Windows, the terminal is Windows Terminal, VS Code, Git Bash, ConEmu, or sets `TERM` to `xterm*` |
 
 Set either option to `yes` or `no` to override detection, for example to keep colors when piping to `less -R`, or to get plain ASCII output in a terminal:
 
@@ -2096,6 +2133,76 @@ In the above example, the same result is obtained with option:
 
 Option `select` applies the filter after a possible "flattening" with option `--out.flat`.
 
+For comparisons, functions or reshaping of results, use option `--out.query`.
+
+#### Option: `--out.query`
+
+Option `--out.query` applies a [JMESPath](https://jmespath.org) expression to the result of a command, when it is an object or a list.
+JMESPath is a standard query language for JSON, also used by option `--query` of the AWS and Azure CLIs.
+
+The expression is applied to the data as returned by the API, before the options `select` and `fields`, and before flattening with `--out.flat`.
+Its syntax is checked before the command is executed.
+Results of other types (status, no result) are not changed.
+
+Examples:
+
+```shell
+# Name and email of ATS administrators
+ascli aoc admin user list --out.query='[?ats_admin].{name: name, email: email}'
+# Number of users
+ascli aoc admin user list --out.query='length(@)'
+# Email of users, one per line, for use in a shell loop
+ascli aoc admin user list --out.query='[].email' --format=text
+```
+
+> [!TIP]
+> Enclose the expression in single quotes for the shell.
+> In JMESPath, literal values are enclosed in backticks, for example: ``[?size > `1000`]``.
+
+For processing that JMESPath does not provide (regular expressions, string manipulation, grouping), the value can be a Ruby lambda (`@ruby:`): it is called with the data, and returns the new data, converted to JSON data (for example, symbols and dates become strings).
+It is refused at [Security Level](#security-level) `medium` and `high`.
+
+```shell
+# Number of users per email domain
+ascli aoc admin user list --out.query=@ruby:'->(users){users.group_by{|u|u["email"].split("@").last}.transform_values(&:count)}'
+```
+
+The result of the query is displayed according to its type: a list of objects as a table, a list of values with one value per line, a single value as is.
+A list of lists (for example, `[].[name, email]`) is displayed only with a structured format (`json`, `yaml`, ...): to display a table, or CSV, use a multi-select hash instead, for example, `[].{name: name, email: email}`.
+
+> [!NOTE]
+> Option `--query` gives filtering parameters to the API, while option `--out.query` filters and reshapes the result received.
+> Option `--out.query` is the equivalent of option `--query` of the AWS and Azure CLIs.
+
+### Exit status
+
+The exit code of `ascli` indicates the category of error, so that scripts can react to it:
+
+| Code | Description |
+|------|----------------------------------------------------------------------------|
+| `0` | Success |
+| `1` | Other error |
+| `2` | Command line error: unknown command or option, invalid or missing argument |
+| `3` | Authentication or authorization failure: SSH, HTTP 401 or 403, OAuth grant |
+| `4` | Resource not found, or several resources match the identifier, HTTP 404 |
+| `5` | Transfer failure |
+| `6` | Network or TLS failure: name resolution, connection, timeout, certificate |
+| `7` | Other error returned by a remote API |
+| `130` | Interrupted by user (Ctrl-C) |
+
+With format `nagios`, the exit code is the status of the check: `0` (OK), `1` (WARNING), `2` (CRITICAL), and `3` (UNKNOWN) if the command fails, following the [Nagios plugin guidelines](https://nagios-plugins.org/doc/guidelines.html).
+
+Example:
+
+```bash
+ascli aoc files download /report.csv
+case $? in
+  0) echo 'Downloaded' ;;
+  6) echo 'Network failure, retry later' ;;
+  *) echo 'Failed' ;;
+esac
+```
+
 ### Extended Value Syntax
 
 An **Extended Value** is a structured value - typically a `Hash` (key/value dictionary) or `Array`, potentially nested - that is passed on the command line wherever a simple string is not sufficient.
@@ -2140,15 +2247,16 @@ The following decoders are supported:
 | `list`   | `String` | `Array`  | Split a string in multiple items taking first character as separator and return an `Array`. |
 | `none`   | None     | Nil      | A `null` value. |
 | `path`   | `String` | `String` | Performs path expansion on specified path (prefix `~/` is replaced with the user's home folder). For example, `--config-file=@path:~/sample_config.yml` |
-| `preset` | `String` | `Hash`   | Get value from configuration file using [dot-path](#dot-path-notation) notation. |
+| `preset` | `String` | Any      | Get value from configuration file using [dot-path](#dot-path-notation) notation: a whole preset (`Hash`) or a single value. |
 | `extend` | `String` | `String` | Evaluates embedded [Extended Value](#extended-value-syntax) syntax in string. |
 | `re`     | `String` | `Regexp` | Ruby Regular Expression (short for `@ruby:/.../`) |
 | `ruby`   | `String` | Any      | Execute specified Ruby code. |
 | `s`      | Any      | `String` | Converts argument to `String`. |
-| `secret` | `String` | `String` | Ask password interactively (hides input). Argument is the prompt. |
+| `secret` | `String` | `String` | Ask password interactively: on terminal (hides input), or on a web page if option `ui` is `graphical`. Argument is the prompt. |
 | `stdin`  | `String` | `String` | Read from stdin in text mode. Argument: `<empty>`, `bin` or `chomp`. |
 | `uri`    | `String` | `String` | Read value from specified URL. Supported schemes: `http:`, `https:`, `data:`, `file:`. For example, `--fpac=@uri:http://serv/f.pac` or `--key=@uri:file:/path/to/key.pem` |
 | `val`    | `String` | `String` | Prevent decoding by the decoders on the right. For example, `--key=@val:@file:foo` sets the option `key` to value `@file:foo`. |
+| `vault`  | `String` | `String` | Read a secret from the [Secret Vault](#secret-vault): `<label>.<field>`. For example, `--password=@vault:my_label.password` |
 | `yaml`   | `String` | Any      | Decode YAML. |
 | `zlib`   | `String` | `String` | Decompress data using zlib. |
 | `<empty>`| None     | Any      | The **dot-path** modifier: argument `@:` collects the following positional arguments as `key.subkey=value` assignments and builds a `Hash` or `Array` using [dot-path](#dot-path-notation) notation. Shell-friendly alternative to `@json:` for structured values.<br/>See [Positional Arguments with Dot-path](#positional-arguments-with-dot-path) for full syntax. Use `END` to stop collection when further positional arguments must follow. |
@@ -2470,6 +2578,38 @@ ascli config echo Hello\ World --format=text
 Hello World
 ```
 
+### Security Level
+
+On the command line, `ascli` can do anything that the user running it is allowed to do.
+Option `security` restricts the features that access local resources or execute code, for example, when commands come from another program, such as an MCP client (see [MCP Security](#security)).
+It is a `Hash` with the following keys:
+
+| Key | Type | Default | Description |
+|-----|-----|-----|-----|
+| `level` | `string` | `low` | `low`, `medium`, or `high` |
+| `allowed_paths` | `Array<string>` | - | With level `medium`: files and folders that `@file:` can read |
+
+| Level | `@file:` | `@ruby:`, `@uri:`, and `@env:` | Secret processed by another extended value |
+|---|---|---|---|
+| `low` | Allowed | Allowed | Allowed |
+| `medium` | Only files in `allowed_paths` | Refused | Refused |
+| `high` | Refused | Refused | Refused |
+
+With level `medium`, the real path of the file is checked: a symbolic link leading outside of `allowed_paths` is refused.
+
+A secret (read by `@secret:`, `@vault:`, or `@preset:`) is hidden in results by its value: processed by another extended value, it could be revealed (for example, split by `@list:@vault:...`, or with a short value in a text by `@extend:`).
+With levels `medium` and `high`, a secret must be the whole value of an option or argument, for example `@preset:<PRESET_NAME>.password` for option `password`, and it cannot be a parameter name of `config preset set`.
+
+Options are evaluated in the order of the command line: place `--security` before options that use extended values.
+
+```shell
+ascli config echo @file:/etc/hosts --security.level=high
+```
+
+```text
+ERRR Argument: Evaluation of file for argument: value: @file: extended value is disabled by security level high
+```
+
 ### Main, configuration and Persistency Folder
 
 `ascli` looks for configuration and persistency files (token cache, file lists, persistency files) in the folder specified using option `home`.
@@ -2512,7 +2652,7 @@ C:\Users\Kenji\.aspera\ascli
 When OAuth is used (AoC, Faspex 5), `ascli` keeps a cache of generated bearer tokens in folder `persist_store` located in the configuration folder by default.
 Option `cache_tokens` (**yes**/no) allows controlling if OAuth tokens are cached on file system, or generated for each request.
 The command `config tokens flush` clears that cache.
-Tokens are kept on disk for a maximum of 30 minutes (`TOKEN_CACHE_EXPIRY_SEC`) and garbage collected after that.
+Tokens are kept on disk for a maximum of 30 minutes and garbage collected after that.
 When a token has expired, then a new token is generated, either using a `refresh_token` if it is available, or by the default method.
 
 ### Configuration file
@@ -2600,9 +2740,11 @@ An [Option Preset](#option-preset) is a collection of options and their associat
 A named [Option Preset](#option-preset) can be modified directly using `ascli`, which will update the configuration file:
 
 ```text
-ascli config preset <set|delete|show|initialize|update> <PRESET_NAME>
+ascli config preset <show|delete|get|unset|set|initialize|update|ask> <PRESET_NAME> ...
 ```
 
+The syntax of all `config preset` commands, including `list` and `overview`, is displayed with `ascli config commands config preset`.
+
 The command `initialize` allows setting several options at once, but it deletes an existing configuration instead of updating it, and expects a `Hash` [Extended Value](#extended-value-syntax).
 
 ```shell
@@ -2674,7 +2816,7 @@ demo_server:
   _comment: "Demo server - public credentials"
   url: ssh://demo.asperasoft.com:33001
   username: asperaweb
-  password: demoaspera
+  password: <PASSWORD>
 ```
 
 > [!NOTE]
@@ -2748,11 +2890,25 @@ The default value is `_<>:"/\|?*`, corresponding to replacement character `_` an
 
 ### Managing temporary files
 
-Some temporary files may be needed during runtime.
-The temporary folder may be specified with option: `temp_folder`.
-Temporary files are deleted at the end of execution unless option: `clean_temp` is set to `no`.
-By default (`@sys`), the temporary folder is the system's temporary folder for the current user (Ruby `Etc.systmpdir`).
-A special value of `@env` sets the folder to Ruby `Dir.tmpdir`, which uses the usual environment variables (for example, `TMPDIR`).
+Some temporary files may be needed during runtime, for example the file list of `ascp`.
+The composite option `temp` (use `--temp=help` to display this schema) controls them:
+
+| Field | Type | Description |
+|--------|----------------------|----------------------------------------------------------------------------------|
+| `clean` | `Bool` | Delete temporary files created by the command when it ends. `false` keeps them, e.g. for debugging. Files left by previous commands are still deleted according to `expiry`.<br/>Default: `true`. |
+| `expiry` | `String, Number, Bool` | Age after which file lists of `ascp` left by previous commands (e.g. interrupted) are deleted, when a command starts. They are in folder `filelists` of the main folder (option `home`). A duration, e.g. `5d`, `12h`, `1w`, `1h 30m`, `1d 02:00:00`, a plain number is seconds. `false` or `null` (`@none:`): never delete them. `0`: delete all of them, including file lists of transfers in progress in other executions of ascli. Such a transfer fails if `ascp` reads its file list again: next session of a multi-session transfer, or resume after an error. Use `0` only when no other transfer is in progress, not in a permanent configuration.<br/>Default: `5d`. |
+| `folder` | `String` | Folder for temporary files, e.g. certificate for WSS transfers, logs of `transferd`. `@sys`: temporary folder of the system for the current user (Ruby `Etc.systmpdir`). `@env`: from environment variables, e.g. `TMPDIR` (Ruby `Dir.tmpdir`).<br/>Default: `@sys`. |
+
+A plain value is the `folder`, for example: `--temp=/data/tmp`.
+
+Temporary files of a command are deleted when it ends, unless `clean` is `false`.
+If a command is interrupted (for example, killed), its `ascp` file lists remain: a later command deletes them when they are older than `expiry`.
+
+> [!WARNING]
+> `--temp.expiry=0` also deletes the file lists of transfers in progress in other executions of `ascli`, which may then fail: use it only when no other transfer is in progress.
+
+> [!TIP]
+> Options `temp_folder` and `clean_temp` are deprecated aliases for `temp.folder` and `temp.clean`.
 
 ### Plugin: `config`: Configuration
 
@@ -2847,12 +3003,14 @@ echo -- --special-string
 echo @base64:SGVsbG8gV29ybGQK
 echo @csvt:@stdin:
 echo @env:USER
+echo @json:'[{"email":"a@x.com"},{"email":"b@x.com"},{"email":"c@y.org"}]' --out.query=@ruby:'->(users){users.group_by{|u|u["email"].split("@").last}.transform_values(&:count)}' --format=json
+echo @json:'[{"name":"alice","size":10},{"name":"bob","size":2000}]' --out.query='[?size > `100`].name' --format=text
 echo @json:'[{"user":{"id":1,"name":"foo"},"project":"bar"}]' --out.table.pivot=single
 echo @json:'[{"user":{"id":1,"name":"foo"},"project":"bar"}]' --out.table.pivot=yes
 echo @json:'{"empty":"","bool":true}' --out.colors=yes --out.utf8=yes
 echo @lines:@stdin:
 echo @list:,1,2,3
-echo @secret:
+echo @secret: --ui=text --out.secrets=yes
 echo @stdin:bin
 echo @uri:/etc/hosts
 echo @uri:file:/etc/hosts
@@ -2888,7 +3046,7 @@ preset list
 preset overview
 preset set GLOBAL sdk_folder 'product:IBM Aspera Connect'
 preset set GLOBAL vault @: type=file name=/secure/vault_file
-preset set GLOBAL vault_password _simple_one_
+preset set GLOBAL vault_password <PASSWORD>
 preset set GLOBAL version_check_days 0
 preset set conf_name param value
 preset set default shares conf_name
@@ -2909,7 +3067,7 @@ transfer list
 transfer status <conf_async_node_upload>
 transferd install
 transferd list
-vault create @: label=my_label password=my_password_here 'description=my secret'
+vault create @: label=my_label password=<PASSWORD> 'description=my secret'
 vault delete foo --vault.type=system
 vault delete my_label
 vault ids
@@ -2918,11 +3076,11 @@ vault list
 vault show my_label
 wizard https://console.example.com/path console
 wizard https://f5.example.com/path faspex5 --key-path=my_private_key
-wizard https://node.example.com/path node --username=test --password=test
-wizard https://orch.example.com/path orchestrator --username=test --password=test
-wizard https://server.example.com/path server --username=my_username --password=my_password
-wizard https://shares.example.com/path shares --username=test --password=test
-wizard https://tst.example.com/path faspio --username=my_username --password=my_password
+wizard https://node.example.com/path node --username=test --password=<PASSWORD>
+wizard https://orch.example.com/path orchestrator --username=test --password=<PASSWORD>
+wizard https://server.example.com/path server --username=my_username --password=<PASSWORD>
+wizard https://shares.example.com/path shares --username=test --password=<PASSWORD>
+wizard https://tst.example.com/path faspio --override=yes --username=my_username --password=<PASSWORD>
 wizard https://tst.example.com/path httpgw
 wizard my_org aoc --key-path=my_private_key --username=my_user_email --use-generic-client=yes
 wizard my_org aoc mypreset --key-path=my_private_key --username=my_user_email
@@ -2968,18 +3126,18 @@ ascli config preset unset cli_default interactive
 Example: Define options using command line:
 
 ```shell
-ascli -N --url=_url_here_ --password=<PASSWORD> --username=_name_here_ node --show-config
+ascli -N --url=<URL> --password=<PASSWORD> --username=<USERNAME> node --show-config
 ```
 
 Example: Define options using a `Hash`:
 
 ```shell
-ascli -N --preset=@json:'{"url":"_url_here_","password":"<PASSWORD>","username":"_name_here_"}' node --show-config
+ascli -N --preset=@json:'{"url":"<URL>","password":"<PASSWORD>","username":"<USERNAME>"}' node --show-config
 ```
 
 #### Shell Completion
 
-`ascli` supports shell tab-completion for **Bash**, **Zsh**, and **Fish**.
+`ascli` supports shell tab-completion for **Bash**, **Zsh**, **Fish**, and **PowerShell** (Windows PowerShell 5.1 and PowerShell 7, on any OS).
 The command `ascli config completion <shell>` displays the completion script for the given shell.
 
 To activate completion, add the line for your shell to its startup file:
@@ -2999,6 +3157,11 @@ eval "$(ascli config completion zsh)"
 ascli config completion fish | source
 ```
 
+```powershell
+# PowerShell, in $PROFILE (edit with notepad $PROFILE)
+ascli config completion powershell | Out-String | Invoke-Expression
+```
+
 The startup file then executes `ascli` each time a shell starts.
 Alternatively, save the script once in the completion folder of the shell (and save it again after an upgrade of `ascli`):
 
@@ -3011,16 +3174,40 @@ ascli config completion zsh > ~/.zsh/completions/_ascli
 ascli config completion fish > ~/.config/fish/completions/ascli.fish
 ```
 
-Once active, press `Tab` to complete commands at any depth:
+PowerShell has no completion folder: save the script, and dot-source it in `$PROFILE`:
 
-```bash
-ascli <Tab>               # lists all plugins: aoc, server, node, ...
-ascli server <Tab>        # lists server sub-commands: upload, download, ls, ...
-ascli aoc admin <Tab>     # lists aoc admin sub-commands: user, node, ...
+```powershell
+ascli config completion powershell | Set-Content "$HOME\ascli_completion.ps1"
+Add-Content -Path $PROFILE -Value ". '$HOME\ascli_completion.ps1'"
 ```
 
-The scripts call `ascli config completion words [<word>...]`, which lists the words that can follow the given ones.
-It can also be used directly to inspect available commands:
+In PowerShell, the words proposed are kept for the session, so only the first `Tab` at a given position executes `ascli`.
+
+Once active, press `Tab` to complete:
+
+
+```bash
+ascli <Tab>                            # plugins and global options: aoc, server, node, ..., --format, ...
+ascli server <Tab>                     # sub-commands and options of plugin: upload, download, ls, ..., --url, ...
+ascli aoc admin <Tab>                  # sub-commands at any depth: user, node, ...
+ascli server ls --u<Tab>               # options, after any command: --url, --username, ...
+ascli --format=<Tab>                   # values of option: --format=json, --format=table, ...
+ascli --ts.<Tab>                       # keys of option, from its schema: --ts.direction, --ts.target_rate_kbps, ...
+ascli --ts.direction=<Tab>             # values of key: --ts.direction=send, --ts.direction=receive
+ascli server upload <Tab>              # local files
+ascli config preset show <Tab>         # type of expected value, not inserted: <identifier>
+ascli aoc packages send <Tab>          # type, and keys of structure (required ones with *): <Hash> name*, workspace_id*, ...
+ascli aoc packages send @: name=x <Tab> # end marker of structure built with @: END
+```
+
+Zsh, Fish and PowerShell also display the description of commands and options.
+Zsh lists options once `-` is typed (zsh style `prefix-needed`).
+The type of an expected value is displayed by Bash and Zsh, and by PowerShell in the list of `MenuComplete` (`Ctrl+Space`).
+
+The scripts call `ascli config completion candidates -- [<word>...] <current word>`, which lists the candidates for the word at the cursor, with their description, followed by a directive for the shell.
+The words are not evaluated (e.g. `@env:` is not replaced).
+The command `ascli config completion words [<word>...]` lists the words that can follow the given ones.
+It can be used directly to inspect available commands:
 
 ```bash
 ascli config completion words aoc admin
@@ -3123,8 +3310,13 @@ Instead, they shall be hidden (logs, output) or encrypted (configuration).
 
 Terminal output (command result) secret removal is controlled by option `--out.secrets` (default: `no`).
 Log secret removal is controlled by option `log_secrets` (default: `no`).
+Secrets are identified by the name of their field (for example, `password`, `token`), and by their value: values of secret options and of presets, of [Extended Values](#extended-value-syntax) `@secret:` and `@vault:`, tokens obtained or generated, and secrets of transfer specs are hidden wherever they appear, also in field names.
+In presets, a secret made of digits only (for example, a password not quoted in the YAML file) is converted to a string, so that it is identified as a secret.
+A value shorter than 8 characters is hidden only when it is the whole value, not inside a text, except in responses of `mcp server`, where it is also hidden as a word (not next to a letter or digit).
 Mandatory command line options can be requested interactively (for example, password) using option `interactive`.
 It is possible to use [Extended Value](#extended-value-syntax) `@secret:[name]` to ask for a secret interactively.
+If option `ui` is `graphical` (see [Graphical Interactions](#graphical-interactions-browser-and-text-editor)), the secret is entered on a web page opened in the browser, served by a local web server on `127.0.0.1`, else on terminal.
+In MCP server mode, the secret is entered on a web page, see [Secrets entered in a web page](#secrets-entered-in-a-web-page).
 It is also possible to enter an option as an environment variable, for example, `ASCLI_PASSWORD` for option `password` and read the env var like this:
 
 ```shell
@@ -3157,32 +3349,32 @@ Quick start macOS:
 ```shell
 brew tap hashicorp/tap
 brew install hashicorp/tap/vault
-vault server -dev -dev-root-token-id=dev-only-token
+vault server -dev -dev-root-token-id=<TOKEN>
 ```
 
 | Field | Type | Description |
 |----------|--------|----------------------------------------------------------------------------------|
 | **type** | `String` | `vault`: IBM HashiCorp Vault secret store. |
 | `token` | `String` | Authentication token. Defaults to the value of `vault_password`.<br/>Example: `dev-only-token`. |
-| `type` | `String` | Vault type selector.<br/>Allowed values: `vault`. |
-| `url` | `String` | URL of the HashiCorp Vault server.<br/>Example: `http://127.0.0.1:8200`. |
+| `type` | `String` | Vault type selector.<br/>Required.<br/>Allowed values: `vault`. |
+| `url` | `String` | URL of the HashiCorp Vault server.<br/>Required.<br/>Example: `http://127.0.0.1:8200`. |
 | **type** | `String` | `system`: macOS system keychain secret store. |
-| `name` | `String` | Name of the keychain to use. |
-| `type` | `String` | Vault type selector.<br/>Allowed values: `system`. |
+| `name` | `String` | Name of the keychain to use (file `<name>.keychain-db` in the keychain search list).<br/>Default: `ascli`. |
+| `type` | `String` | Vault type selector.<br/>Required.<br/>Allowed values: `system`. |
 | **type** | `String` | `file`: Encrypted file secret store. |
 | `name` | `String` | Path to the encrypted vault file. Relative paths are resolved from the configuration folder.<br/>Default: `vault.bin`. |
-| `type` | `String` | Vault type selector.<br/>Allowed values: `file`. |
+| `type` | `String` | Vault type selector.<br/>Required.<br/>Allowed values: `file`. |
 | **type** | `String` | `1password`: 1Password secret store (Connect REST API or CLI). |
 | `account` | `String` | Account shorthand for `op` (used when `source` is `cli`). Uses the default account if omitted. |
-| `source` | `String` | Backend source. Use `api` for the Connect REST API, `cli` for the `op` CLI.<br/>Allowed values: `api`, `cli`.<br/>Default: `api`. |
+| `source` | `String` | Backend source. Use `api` for the Connect REST API, `cli` for the `op` CLI.<br/>Required.<br/>Allowed values: `api`, `cli`.<br/>Default: `api`. |
 | `token` | `String` | Bearer token for the Connect API (required when `source` is `api`). Defaults to the value of `vault_password`. |
-| `type` | `String` | Vault type selector.<br/>Allowed values: `1password`. |
+| `type` | `String` | Vault type selector.<br/>Required.<br/>Allowed values: `1password`. |
 | `url` | `String` | Base URL of the 1Password Connect server (required when `source` is `api`).<br/>Example: `http://localhost:8080`. |
 | `vault_id` | `String` | ID of the 1Password vault to use (required when `source` is `api`). |
 | `vault` | `String` | Name or ID of the 1Password vault to use with the CLI (used when `source` is `cli`). Uses the default vault if omitted. |
 
 ```shell
---vault=@json:'{"type":"vault","url":"http://127.0.0.1:8200"}' --vault-password=dev-only-token
+--vault=@json:'{"type":"vault","url":"http://127.0.0.1:8200"}' --vault-password=<TOKEN>
 ```
 
 #### Vault: System keychain
@@ -3190,7 +3382,8 @@ vault server -dev -dev-root-token-id=dev-only-token
 > [!WARNING]
 > **macOS only**
 
-It is possible to manage secrets in macOS keychain (only read supported currently).
+It is possible to manage secrets in macOS keychain.
+Commands `list`, `ids` and `delete` are not supported: use the **Keychain Access** app.
 
 ```shell
 --vault=@json:'{"type":"system","name":"ascli"}'
@@ -3264,6 +3457,18 @@ No server to deploy: authentication is handled by the 1Password desktop app (bio
 > Install `op` on macOS with `brew install 1password-cli`, then connect it to the desktop app:
 > `op signin`
 
+##### Referencing items
+
+An item can be referenced by its title (label) or by its 1Password ID, in `@vault:<item>.<field>`:
+
+```shell
+--password=@vault:<ITEM_ID>.password
+--password=@vault:<ITEM_TITLE>.password
+```
+
+> [!NOTE]
+> If several items share the same title, use the item ID (or the `vault` parameter to restrict the search).
+
 #### Vault: Operations
 
 Secrets can be manipulated using the `config vault` command:
@@ -3274,7 +3479,7 @@ Secrets can be manipulated using the `config vault` command:
 - `show` : Show a secret by label (or id)
 - `create` : Add a new secret to the vault
 - `delete` : Delete a secret by label (or id)
-- `password` : Change the vault password
+- `password` : Set a new password for the vault
 - `import` : Import secrets from a JSON array (supports `--bulk`)
 
 To add a new password entry in the vault for label `<NAME>`:
@@ -3291,7 +3496,7 @@ To migrate all secrets from one vault backend to another (for example, from the
 > Use `list` (not `ids`) as the source: `ids` returns only labels, while `list` returns the full secret details needed for import.
 
 ```shell
-ascli config vault list --format=json --out.level=data \
+ascli config vault list --format=json --out.level=data --out.secrets=yes \
   --vault=@json:'{"type":"file","name":"<SOURCE_VAULT_FILE>"}' \
   --vault-password=<SOURCE_PASSWORD> | \
 ascli config vault import @json:@stdin: --bulk=yes \
@@ -3300,7 +3505,7 @@ ascli config vault import @json:@stdin: --bulk=yes \
 ```
 
 > [!TIP]
-> Use `--out.level=data` on the `list` command so that only the raw JSON array is written to stdout, with no table headers or status lines.
+> Use `--out.level=data` on the `list` command so that only the raw JSON array is written to stdout, with no table headers or status lines, and `--out.secrets=yes` so that secrets are not replaced by a placeholder.
 
 The `import` command accepts a JSON array where each element is a vault secret object (same schema as `create`).
 `--bulk` makes each entry reported individually in the result table; omit it to get a single-line summary.
@@ -3414,17 +3619,17 @@ ssh-keygen -t rsa -b 4096 -m PEM -N '' -f ${KEY_PAIR_PATH}
 To generate a key pair with a passphrase, the following can be used on any system:
 
 ```shell
-openssl genrsa -passout pass:_passphrase_here_ -out ${KEY_PAIR_PATH} 4096
+openssl genrsa -passout pass:<PASSPHRASE> -out ${KEY_PAIR_PATH} 4096
 openssl rsa -pubout -in ${KEY_PAIR_PATH} -out ${KEY_PAIR_PATH}.pub
 ```
 
 `openssl` is sometimes compiled to support option `-nodes` (no DES, that is, no passphrase, for example, on macOS).
-In that case, add option `-nodes` instead of `-passout pass:_passphrase_here_` to generate a key without passphrase.
+In that case, add option `-nodes` instead of `-passout pass:<PASSPHRASE>` to generate a key without passphrase.
 
 If option `-nodes` is not available, the passphrase can be removed using this method:
 
 ```shell
-openssl rsa -passin pass:_passphrase_here_ -in ${KEY_PAIR_PATH} -out ${KEY_PAIR_PATH}.no_des
+openssl rsa -passin pass:<PASSPHRASE> -in ${KEY_PAIR_PATH} -out ${KEY_PAIR_PATH}.no_des
 mv ${KEY_PAIR_PATH}.no_des ${KEY_PAIR_PATH}
 ```
 
@@ -3463,6 +3668,16 @@ Parameter `url` (base URL) defines:
 - The local port number (default 443 for HTTPS, 80 for HTTP)
 - The **base path**, that is, the path under which requests are received (useful for routing when a reverse proxy is used).
 
+A web page open in a browser can send requests to a local web server, also on `localhost`.
+To refuse them, the server checks each request:
+
+- When `url` is a loopback address (`localhost`, `127.0.0.0/8`, `::1`), header `Host` shall be a loopback name or address, else HTTP 403: a host name that resolves to `127.0.0.1` is refused (DNS rebinding).
+- Header `Origin`, sent by browsers, shall be the origin of the server, else HTTP 403.
+- A JSON body shall have `Content-Type: application/json`, else HTTP 415: a web page cannot send it to another site without the agreement of that site.
+
+Clients that are not browsers send no `Origin`, and the `Host` of the URL they call.
+They shall send the type of a JSON body: for example, with `curl`, add `-H 'Content-Type: application/json'`.
+
 ### Image and video thumbnails
 
 `ascli` can display thumbnails for images and videos in the **terminal**, using [iTerm2 inline image protocol](https://iterm2.com/documentation-images.html) or through colorized text.
@@ -3478,7 +3693,7 @@ The following options can be specified in option `--out.img`:
 
 | Field | Type | Description |
 |------------|---------|----------------------------------------------------------------------------------|
-| `double` | `Bool` | Use double vertical resolution via half-block characters.<br/>Default: `true`. |
+| `double` | `Bool` | Use double vertical resolution via half-block characters (Unicode). Default is `true` if the terminal supports Unicode (see `utf8`). |
 | `font_ratio` | `Number` | Terminal font aspect ratio (height divided by width).<br/>Default: `2.3`. |
 | `reserve` | `Integer` | Number of terminal lines reserved for non-image output.<br/>Default: `3`. |
 | `text` | `Bool` | Display the image as colorized text instead of using the iTerm2 inline protocol.<br/>Default: `false`. |
@@ -3508,13 +3723,31 @@ ascli config image @stdin:bin < A-team.jpg
 Some actions may require the use of a graphical tool:
 
 - A browser for Aspera on Cloud authentication (web auth method)
+- A browser to enter a secret requested with `@secret:`
 - A text editor for editing the configuration file
 
 By default, `ascli` assumes that a graphical environment is available on Windows; on other systems, it relies on the presence of the `DISPLAY` environment variable.
-It is also possible to force the graphical mode with option `ui`:
+The composite option `ui` (use `--ui=help` to display this schema) selects the mode and the browser command:
+
+| Field | Type | Description |
+|---------|---------------|----------------------------------------------------------------------------------|
+| `command` | `Array[String]` | Command that opens a URL, instead of the system default. First item is the executable, then its arguments. The URL is added as last argument. When set, it is used to open URLs, whatever the `mode`. |
+| `mode` | `String` | `auto`: `browser` on Windows and macOS, or if env var `DISPLAY` is set, else `terminal`. `terminal`: URLs and files to open are displayed on terminal, and secrets are entered on terminal. `browser`: a browser opens URLs, secrets are entered on a web page, and a text editor opens files. `text` is an alias for `terminal`, and `graphical` is an alias for `browser`.<br/>Allowed values: `auto`, `terminal`, `browser`, `text`, `graphical`.<br/>Default: `auto`. |
+
+A plain value is the `mode`:
 
-- `--ui=graphical` forces a graphical environment: a browser is opened for URLs, or a text editor for files.
-- `--ui=text` forces a text environment, the URL or file path to open is displayed on terminal.
+- `--ui=browser` (or `graphical`) forces a graphical environment: a browser is opened for URLs or secrets, or a text editor for files.
+- `--ui=terminal` (or `text`) forces a text environment, the URL or file path to open is displayed on terminal, and secrets are entered on terminal.
+- `--ui=auto` selects the mode from the environment (default).
+
+The browser is opened, by priority, with: `--ui.command`, or the system default.
+When a command is defined, it is used to open URLs whatever the `mode`.
+The command is an array: the URL is appended as last argument.
+For example, to use Firefox:
+
+```bash
+ascli config echo @secret: --ui=browser --ui.command=@json:'["firefox","--private-window"]'
+```
 
 ### Logging, Debugging
 
@@ -3594,7 +3827,7 @@ It will display the exact content of HTTP requests and responses.
 ### HTTP socket parameters
 
 To ignore SSL certificate for **any** address/port, use option: `insecure`, that is, `--insecure=yes`.
-To ignore SSL certificate for a list of specific address/port, use option `ignore_certificate`, set to an `Array` of URLs for which the certificate is ignored (only the address and port are matched), for example, `--ignore-certificate=@list:,https://127.0.0.1:9092`
+To ignore SSL certificate for a list of specific address/port, use option `ignore_certificate`, set to a URL or an `Array` of URLs for which the certificate is ignored (only the address and port are matched), for example, `--ignore-certificate=https://127.0.0.1:9092` or `--ignore-certificate=@list:,https://127.0.0.1:9092,https://127.0.0.1:9093`
 
 > [!NOTE]
 > Ignoring certificate also applies to `ascp` WSS.
@@ -3727,16 +3960,16 @@ proxy://proxy.example.com:8080
 If the proxy found with the PAC requires credentials, then use option `proxy_credentials` with username and password provided as an `Array`:
 
 ```shell
-ascli --proxy-credentials=@json:'["__username_here__","__password_here__"]' ...
+ascli --proxy-credentials=@json:'["<USERNAME>","<PASSWORD>"]' ...
 ```
 
 ```shell
-ascli --proxy-credentials=@list::__username_here__:__password_here__ ...
+ascli --proxy-credentials=@list::<USERNAME>:<PASSWORD> ...
 ```
 
 #### Proxy for Legacy Aspera HTTP/S Fallback
 
-Only supported with the `direct` agent: To specify a proxy for legacy HTTP fallback, use `ascp` native option `-x` and `ascp_args`: `--transfer=@json:'{"ascp_args":["-x","url_here"]}'`.
+Only supported with the `direct` agent: To specify a proxy for legacy HTTP fallback, use `ascp` native option `-x` and `ascp_args`: `--transfer=@json:'{"ascp_args":["-x","<PROXY_URL>"]}'`.
 
 #### FASP proxy (forward) for transfers
 
@@ -3877,7 +4110,7 @@ The list of agents and their short identifier can be displayed with:
 ascli config agents list
 ```
 
-To display all configurable parameters for a specific agent:
+To display the configurable parameters of a specific agent (with required fields, default values, enumerated values):
 
 ```shell
 ascli config agents parameters <agent name>
@@ -3890,7 +4123,7 @@ ascli config agents parameters direct
 ascli config agents parameters node
 ```
 
-To display the full detail of an agent (description, required fields, default values, enumerated values):
+To display the description of an agent:
 
 ```shell
 ascli config agents show <agent name>
@@ -4235,21 +4468,21 @@ Parameters provided in option `transfer` are:
 
 | Field | Type | Description |
 |----------|--------|---------------------------------------------------------------|
-| `password` | `String` | Password, secret, or bearer token. |
+| `password` | `String` | Password, secret, or bearer token.<br/>Required. |
 | `root_id` | `String` | Root file ID. Mandatory only when `password` is a bearer token. |
-| `url` | `String` | URL of the Node API. |
-| `username` | `String` | Node API user or access key. |
+| `url` | `String` | URL of the Node API.<br/>Required. |
+| `username` | `String` | Node API user or access key.<br/>Required. |
 
 Like any other option, `transfer` can get its value from a pre-configured [Option Preset](#option-preset):
 
 ```shell
---transfer=@preset:_name_here_ --transfer.agent=node
+--transfer=@preset:<PRESET_NAME> --transfer.agent=node
 ```
 
 It can also directly use the [Extended Value](#extended-value-syntax) syntax:
 
 ```shell
---transfer=@json:'{"agent":"node","url":"https://...","username":"_user_here_","password":"<PASSWORD>"}'
+--transfer=@json:'{"agent":"node","url":"https://...","username":"<USERNAME>","password":"<PASSWORD>"}'
 ```
 
 If `transfer` is not specified and a default node has been configured (name in `node` for section `default`) then this node is used by default.
@@ -4270,7 +4503,7 @@ Parameters provided in option `transfer` are:
 | `api_version` | `String` | Force use of a specific API version.<br/>Allowed values: `v1`, `v2`.<br/>Default: `v2`. |
 | `synchronous` | `Bool` | Wait for acknowledgment after each message.<br/>Default: `false`. |
 | `upload_chunk_size` | `Integer` | Size in bytes of each upload chunk.<br/>Default: `64000`. |
-| `url` | `String` | URL of the HTTP Gateway. |
+| `url` | `String` | URL of the HTTP Gateway.<br/>Required. |
 
 Example:
 
@@ -4396,7 +4629,14 @@ Parameters can be displayed with commands:
 
 ```shell
 ascli config ascp spec
-ascli config ascp spec --select=@json:'{"d":"Y"}' --fields=-d,n,c
+```
+
+An optional parameter can be specified to display only the parameters supported by a specific transfer agent, or `overview` for one column per agent indicating which agents support each parameter:
+
+```shell
+ascli config ascp spec direct
+ascli config ascp spec overview
+ascli config ascp spec overview --fields=name,a,c,d,h,n,t
 ```
 
 A JSON Schema can be generated with command:
@@ -4411,7 +4651,7 @@ An optional parameter can be specified to display the schema for a specific tran
 ascli config ascp schema transferd --format=jsonpp
 ```
 
-The description gives the corresponding `ascp` argument or environment variable.
+The description gives the supported agents, if not all, and the corresponding `ascp` argument or environment variable.
 
 #### Transfer Specification Reference
 
@@ -4428,7 +4668,7 @@ The description gives the corresponding `ascp` argument or environment variable.
 |--------------------------------|-----------------|----------------------------------------------------------------------------------|
 | `apply_local_docroot` | `Bool` | Apply local docroot to source paths.<br/>(A, T)<br/>(`--apply-local-docroot`) |
 | `authentication` | `String` | Set to `token` for SSH bypass keys, else password asked if not provided.<br/>(C) |
-| `cipher_allowed` | `String` | Returned by node API. Valid literals include `aes-128` and `none`.<br/>(C)<br/>Allowed values: `none`, `aes-128`, `aes-192`, `aes-256`, `aes-128-cfb`, `aes-192-cfb`, `aes-256-cfb`, `aes-128-gcm`, `aes-192-gcm`, `aes-256-gcm`. |
+| `cipher_allowed` | `String` | Returned by node API. Valid literals include `aes-128` and `none`.<br/>Allowed values: `none`, `aes-128`, `aes-192`, `aes-256`, `aes-128-cfb`, `aes-192-cfb`, `aes-256-cfb`, `aes-128-gcm`, `aes-192-gcm`, `aes-256-gcm`.<br/>(C) |
 | `cipher` | `String` | In transit encryption algorithms.<br/>Allowed values: `none`, `aes-128`, `aes-192`, `aes-256`, `aes-128-cfb`, `aes-192-cfb`, `aes-256-cfb`, `aes-128-gcm`, `aes-192-gcm`, `aes-256-gcm`.<br/>Default: `none`.<br/>(`-c (conversion){enum}`) |
 | `content_protection_password` | `String` | Password for encryption/decryption of transferred assets.<br/>(env:`ASPERA_SCP_FILEPASS`) |
 | `content_protection` | `String` | Enable client-side content protection (CSEAR, encryption-at-rest).<br/>For uploads, set to `encrypt` to transfer encrypted files and store them on the server with the extension `.aspera-env`. (`aspera.conf` parameter `transfer_encryption_content_protection_extension`). To download and decrypt encrypted files, set to `decrypt`<br/>`content_protection_password` must be specified if this option is set.<br/>Allowed values: `encrypt`, `decrypt`.<br/>(`--file-crypt={enum}`) |
@@ -4437,15 +4677,15 @@ The description gives the corresponding `ascp` argument or environment variable.
 | `delete_before_transfer` | `Bool` | Before transfer, delete files that exist at the destination but not at the source.<br/>The source and destination arguments must be directories that have matching names.<br/>Objects on the destination that have the same name but different type or size as objects on the source are not deleted.<br/>(`--delete-before-transfer`) |
 | `delete_source` | `Bool` | Remove transferred source files after transfer success. Equivalent to `remove_after_transfer` + `remove_empty_directories` + `remove_empty_source_directory`. Take precedence over those.<br/>(A, N, T) |
 | `destination_root_id` | `String` | The file ID of the destination root directory.<br/>Required when using Bearer token auth for the destination node.<br/>(T) |
-| `destination_root` | `String` | Destination root directory. |
+| `destination_root` | `String` | Destination root directory.<br/>Required. |
 | `dgram_size` | `Integer` | UDP datagram size in bytes.<br/>(`-Z {integer}`) |
-| `direction` | `String` | Direction of transfer (on client side).<br/>Allowed values: `send`, `receive`.<br/>(`--mode=(conversion){enum}`) |
+| `direction` | `String` | Direction of transfer (on client side).<br/>Required.<br/>Allowed values: `send`, `receive`.<br/>(`--mode=(conversion){enum}`) |
 | `exclude_newer_than` | `String` | Exclude files, but not directories, from the transfer if they are newer than the specified number of seconds added to the source computer's epoch.<br/>e.g. `-86400` for newer than a day back.<br/>(`--exclude-newer-than={string}`) |
 | `exclude_older_than` | `String` | Exclude files, but not directories, from the transfer if they are older than the specified number of seconds added to the source computer's epoch.<br/>e.g. `-86400` for older than a day back.<br/>(`--exclude-older-than={string}`) |
 | `fail_bad_filepass` | `Bool` | Fail on bad file decryption passphrase.<br/>(A, T)<br/>(`--fail-bad-filepass`) |
 | `fasp_port` | `Integer` | Specifies fasp (UDP) port.<br/>Default: `33001`.<br/>(`-O {integer}`) |
 | `fasp_proxy` | `Hash` | Proxy for communications between the remote server and the (local) client.<br/>(T) |
-| `file_checksum` | `String` | Enable checksum reporting for transferred files by specifying the hash to use.<br/>(A, N)<br/>Allowed values: `sha-512`, `sha-384`, `sha-256`, `sha1`, `md5`, `none`.<br/>Default: `none`.<br/>(`--file-checksum={enum}`) |
+| `file_checksum` | `String` | Enable checksum reporting for transferred files by specifying the hash to use.<br/>Allowed values: `sha-512`, `sha-384`, `sha-256`, `sha1`, `md5`, `none`.<br/>Default: `none`.<br/>(A, N)<br/>(`--file-checksum={enum}`) |
 | `http_fallback_port` | `Integer` | Specifies HTTP port when no cipher is used.<br/>(`-t {integer}`) |
 | `http_fallback` | `Bool, String` | When true(1), attempts to perform an HTTP transfer if a FASP transfer cannot be performed.<br/>(`-y (conversion){boolean\|string}`) |
 | `https_fallback_port` | `Integer` | Specifies HTTPS port when cipher is used.<br/>(`-t {integer}`) |
@@ -4464,26 +4704,26 @@ The description gives the corresponding `ascp` argument or environment variable.
 | `obfuscate_file_names` | `Bool` | HTTP Gateway obfuscates file names when set to `true`.<br/>(H) |
 | `overwrite` | `String` | Overwrite files at the destination with source files of the same name based  on the policy:<br/>- `always` : Always overwrite the file.<br/>- `never` : Never overwrite the file. If the destination contains partial files that are older or the same  as the source files and resume is enabled, the partial files resume transfer. Partial files with checksums or sizes that differ from the source files  are not overwritten.<br/>- `diff` : (default) Overwrite the file if it is different from the source,  depending on the compare method (default is size). If the destination is object storage, `diff` has the same effect as always. If resume is not enabled, partial files are overwritten if they are different  from the source, otherwise they are skipped. If resume is enabled, only partial files with different sizes or checksums  from the source are overwritten; otherwise, files resume.<br/>- `diff+older` : Overwrite the file if it is older and different from the source,  depending on the compare method (default is size). If resume is not enabled, partial files are overwritten if they are older  and different from the source, otherwise they are skipped. If resume is enabled, only partial files that are different and older than  the source are overwritten, otherwise they are resumed.<br/>- `older` : Overwrite the file if its timestamp is older than the source timestamp.<br/>If you set an overwrite policy of `diff` or `diff+older`, difference is determined  by the value set for `resume_policy`:<br/>`none` : The source and destination files are always considered different and  the destination file is always overwritten<br/>`attributes` : The source and destination files are compared based on file attributes <br/>`sparse_checksum` : The source and destination files are compared based on sparse checksums, (currently file size)<br/>`full_checksum` : The source and destination files are compared based on full checksums<br/>Allowed values: `never`, `always`, `diff`, `older`, `diff+older`.<br/>Default: `diff`.<br/>(`--overwrite={enum}`) |
 | `password` | `String` | Password for local Windows user when transfer user associated with node API user is not the same as the one running `asperanoded`.<br/>Allows impersonating the transfer user and have access to resources (e.g. network shares).<br/>Windows only, node API only.<br/>(N) |
-| `paths` | `Array` | Array of path to the source (required) and a path to the destination (optional). |
+| `paths` | `Array` | Array of path to the source (required) and a path to the destination (optional).<br/>Required. |
 | `precalculate_job_size` | `Bool` | Specifies whether to precalculate the job size.<br/>(`--precalculate-job-size / --precalculate-disable`) |
 | `preserve_access_time` | `Bool` | Preserve the source-file access timestamps at the destination.<br/>Because source access times are updated by the transfer operation, the timestamp that is preserved is the one just before to the transfer.<br/>(`--preserve-access-time`) |
-| `preserve_acls` | `String` | Preserve access control lists.<br/>(A, T)<br/>Allowed values: `none`, `native`, `metafile`.<br/>Default: `none`.<br/>(`--preserve-acls={enum}`) |
+| `preserve_acls` | `String` | Preserve access control lists.<br/>Allowed values: `none`, `native`, `metafile`.<br/>Default: `none`.<br/>(A, T)<br/>(`--preserve-acls={enum}`) |
 | `preserve_creation_time` | `Bool` | Preserve source-file creation timestamps at the destination.<br/>Only Windows systems retain information about creation time. If the destination is not a Windows computer, this option is ignored.<br/>(`--preserve-creation-time`) |
-| `preserve_extended_attrs` | `String` | Preserve the extended attributes.<br/>(A, T)<br/>Allowed values: `none`, `native`, `metafile`.<br/>Default: `none`.<br/>(`--preserve-xattrs={enum}`) |
+| `preserve_extended_attrs` | `String` | Preserve the extended attributes.<br/>Allowed values: `none`, `native`, `metafile`.<br/>Default: `none`.<br/>(A, T)<br/>(`--preserve-xattrs={enum}`) |
 | `preserve_file_owner_gid` | `Bool` | Preserve the group ID for a file owner.<br/>(A, T)<br/>(`--preserve-file-owner-gid`) |
 | `preserve_file_owner_uid` | `Bool` | Preserve the user ID for a file owner.<br/>(A, T)<br/>(`--preserve-file-owner-uid`) |
 | `preserve_modification_time` | `Bool` | Set the modification time, the last time a file or directory was modified (written), of a transferred file to the modification of the source file or directory.<br/>Preserve source-file modification timestamps at the destination.<br/>(`--preserve-modification-time`) |
-| `preserve_remote_acls` | `String` | Preserve remote access control lists.<br/>(A, T)<br/>Allowed values: `none`, `native`, `metafile`.<br/>Default: `none`.<br/>(`--remote-preserve-acls={enum}`) |
-| `preserve_remote_extended_attrs` | `String` | Preserve remote extended attributes.<br/>(A, T)<br/>Allowed values: `none`, `native`, `metafile`.<br/>Default: `none`.<br/>(`--remote-preserve-xattrs={enum}`) |
+| `preserve_remote_acls` | `String` | Preserve remote access control lists.<br/>Allowed values: `none`, `native`, `metafile`.<br/>Default: `none`.<br/>(A, T)<br/>(`--remote-preserve-acls={enum}`) |
+| `preserve_remote_extended_attrs` | `String` | Preserve remote extended attributes.<br/>Allowed values: `none`, `native`, `metafile`.<br/>Default: `none`.<br/>(A, T)<br/>(`--remote-preserve-xattrs={enum}`) |
 | `preserve_source_access_time` | `Bool` | Preserve the time logged for when the source file was accessed.<br/>(A, T)<br/>(`--preserve-source-access-time`) |
 | `preserve_times` | `Bool` | Preserve file timestamps.<br/>(A, N, T)<br/>(`-p`) |
 | `proxy` | `String` | Specify the address of the Aspera high-speed proxy server.<br/>`dnat(s)://[user[:password]@]server:port`<br/>Default ports for DNAT and DNATS protocols are 9091 and 9092.<br/>Password, if specified here, overrides the value of environment variable `ASPERA_PROXY_PASS`.<br/>(A)<br/>(`--proxy={string}`) |
-| `rate_policy_allowed` | `String` | Specifies most aggressive rate policy that is allowed. Returned by node API.<br/>(C)<br/>Allowed values: `low`, `fair`, `high`, `fixed`. |
+| `rate_policy_allowed` | `String` | Specifies most aggressive rate policy that is allowed. Returned by node API.<br/>Allowed values: `low`, `fair`, `high`, `fixed`.<br/>(C) |
 | `rate_policy` | `String` | The transfer rate policy to use when sharing bandwidth. Allowable values:<br/>- `high` : When sharing bandwidth, transfer at twice the rate of a transfer using a fair policy.<br/>- `fair` : (Default) Share bandwidth equally with other traffic.<br/>- `low` : Use only unused bandwidth.<br/>- `fixed` : Transfer at the target rate, regardless of the actual network capacity. Do not share bandwidth. Aspera recommends that you do not use this setting except under special circumstances,  otherwise the destination storage can be damaged.<br/>Allowed values: `low`, `fair`, `high`, `fixed`.<br/>(`--policy={enum}`) |
 | `remote_access_key` | `String` | The access key ID of the access key that was used to construct the bearer token that is used to authenticate to the remote node.<br/>(T) |
-| `remote_host` | `String` | IP or fully qualified domain name (FQDN) of the remote server.<br/>(`--host={string}`) |
+| `remote_host` | `String` | IP or fully qualified domain name (FQDN) of the remote server.<br/>Required.<br/>(`--host={string}`) |
 | `remote_password` | `String` | SSH session password.<br/>(env:`ASPERA_SCP_PASS`) |
-| `remote_user` | `String` | Remote user. Default value is `xfer` on node or connect.<br/>(`--user={string}`) |
+| `remote_user` | `String` | Remote user. Default value is `xfer` on node or connect.<br/>Required.<br/>(`--user={string}`) |
 | `remove_after_transfer` | `Bool` | Remove SRC files after transfer success.<br/>(A, N, T)<br/>(`--remove-after-transfer`) |
 | `remove_empty_directories` | `Bool` | Specifies whether to remove empty directories.<br/>(A, N, T)<br/>(`--remove-empty-directories`) |
 | `remove_empty_source_dir` | `Bool` | Remove empty source subdirectories and remove the source directory itself, if empty.<br/>(T) |
@@ -4509,10 +4749,10 @@ The description gives the corresponding `ascp` argument or environment variable.
 | `tags` | `Hash` | Metadata for transfer as JSON. Key `aspera` is reserved. Key `aspera.xfer_retry` specifies a "retry timeout" but is not actually used for node API initiated transfers.<br/>(`--tags64=(conversion){object}`) |
 | `target_rate_cap_kbps` | `Integer` | Maximum target rate for incoming transfers, in kilobits per second. Returned by upload/download_setup node API.<br/>(C, T) |
 | `target_rate_kbps` | `Integer` | Specifies desired speed for the transfer.<br/>(`-l {integer}`) |
-| `target_rate` | `String` | Pseudo-parameter: desired transfer rate as a human-readable string with an optional unit suffix. Converted to `target_rate_kbps` before the transfer is started, overriding it if both are present. Accepted formats: plain integer (kbps), or integer followed by `k`/`K` (kbps), `m`/`M` (x1000 kbps), `g`/`G` (x1000000 kbps). Examples: `100000`, `100000k`, `100m`, `1g`. |
+| `target_rate` | `String, Integer` | Pseudo-parameter: desired transfer rate in bps, with an optional unit suffix. Converted to `target_rate_kbps` (rounded down) before the transfer is started, overriding it if both are present. Also applies to `async` (sync). Accepted formats: integer (bps), or integer followed by `k`/`K` (x1000), `m`/`M` (x1000000), `g`/`G` (x1000000000). Examples: `100000000`, `100000k`, `100m`, `1g`. |
 | `title` | `String` | Title of the transfer.<br/>(C, N, T) |
 | `token` | `String` | Authorization token. Type is Bearer, Basic or ATM.<br/>(env:`ASPERA_SCP_TOKEN`) |
-| `use_ascp4` | `Bool` | Specify version of protocol. `ascp4` will be deprecated.<br/>(A, N, T)<br/>Default: `false`. |
+| `use_ascp4` | `Bool` | Specify version of protocol. `ascp4` will be deprecated.<br/>Default: `false`.<br/>(A, N, T) |
 | `use_system_ssh` | `Bool` | Use an external `ssh` program instead of the built-in `libssh2` implementation to establish the connection to the remote host. The desired `ssh` program must be in the environment's `PATH`.<br/>To enable debugging of the `ssh` process, supply `-DD` and `--ssh-arg=-vv` arguments to `ascp`.<br/>(A, T)<br/>(`-SSH`) |
 | `wss_enabled` | `Bool` | Server has Web Socket service enabled.<br/>(special:`--ws-connect`) |
 | `wss_port` | `Integer` | TCP port used for Web Socket service feed. |
@@ -5166,54 +5406,164 @@ ascli server upload "faux:///mydir?file=testfile&count=1000&size=1" --to-folder=
 
 ### `file:` for growing files
 
-The built-in `file` PVCL adapter allows referencing a local file using a URI-style path with optional query parameters.
-This is particularly useful for transferring **growing files** - files that are still being written at the time of transfer (for example, live recordings, log files, streaming output).
+A growing file is a file that another program is still writing during the transfer, for example a live recording, a log file, or a stream capture.
+The built-in `file` PVCL adapter of `ascp` transfers such a file: `ascp` sends the data as the file grows, and completes the transfer when the file stops changing.
+This is a feature of `ascp`, not `ascli`.
+
+For more information, see the [HSTS `ascp` command reference](https://www.ibm.com/docs/en/ahts/4.4.x?topic=line-ascp-command-reference).
 
-The source parameter syntax is:
+#### Syntax of the `file:` URI
+
+To transfer a growing file, specify the source file as a `file:` URI that contains the `grow` parameter:
 
 ```shell
-file:///<PATH>?grow=<WAIT_TIME>[&wait_start=[mtime|null_read]][&confirm_stop=[true|false]]
+file:///<PATH>?grow=<WAIT_TIME>[&<PARAMETER>=<VALUE>...]
 ```
 
-A transfer is considered complete when the source file has not changed for `wait_time` seconds.
-See [HSTS `ascp` command reference](https://www.ibm.com/docs/en/ahts/4.4.x?topic=line-ascp-command-reference) for full details.
+The path of the file follows the prefix `file:///`:
 
-> [!NOTE]
-> The source file must reside on a **native file system**.
+| Path     | Example URI                        | File                             |
+|----------|------------------------------------|----------------------------------|
+| Relative | `file:///live.log?grow=60`         | `live.log` in the current folder |
+| Absolute | `file:////var/log/app.log?grow=60` | `/var/log/app.log`               |
 
-Key query parameters:
+An absolute path starts with `/`, so the URI of an absolute path contains four slashes.
 
-| Parameter      | Description                                                          |
-|----------------|----------------------------------------------------------------------|
-| `grow`         | **(Required)** Wait time in seconds after last file change before the transfer is declared complete.<br/>Default wait time is 10 s if set to a non-numeric string. |
-| `wait_start`   | How the wait time is measured:<br/>- `mtime` (default) file modification time<br/>- `null_read` first zero-byte read. |
-| `confirm_stop` | Set to `true` to let an external program signal completion by setting:<br/>`mtime < current_time - wait_time`.<br/>Ignored when `wait_start=null_read`. |
+The URI supports the following parameters:
 
-> [!NOTE]
-> `ascp` requires that all sources in a single transfer session share the same PVCL URI scheme.
-> This means the `file:` URI (with its query parameters) must be specified either directly on the command line, or uniformly as a source prefix - it cannot be mixed with plain paths in a file list.
-> So, use one of the following methods:
+| Parameter       | Description |
+|-----------------|----------------------------------------------------------------|
+| `grow`          | Wait time, in seconds: the transfer completes when the file does not change during this time.<br/>Required.<br/>If the value is not a number, for example `grow=default`, the wait time is 10 seconds. |
+| `wait_start`    | Start of the wait time:<br/>- `mtime`: the last modification time of the file.<br/>- `null_read`: the time when `ascp` reaches the end of the file, that is, when a read of the file returns no data.<br/>Default: `mtime` |
+| `confirm_stop`  | If `true`, the program that writes the file confirms the end of the file. See [Confirming the end of a growing file](#confirming-the-end-of-a-growing-file).<br/>Ignored if `wait_start` is `null_read`.<br/>Default: `false` |
+| `max_grow_size` | Maximum size of the file, in bytes.<br/>Accepts the suffixes `k`, `m`, `g`, `t`, `p`, and `e` (powers of 1024).<br/>Default: 2<sup>63</sup> - 1 bytes, or the maximum file size of the file system if lower. |
+
+> [!IMPORTANT]
+> The growing file must be on a native file system, that is, a file system that the operating system accesses directly.
+
+> [!TIP]
+> On the command line, enclose the URI in single quotes: the characters `?` and `&` have a special meaning for the shell.
+
+#### Completion of the transfer
+
+`ascp` sends the data as the program writes it.
+When `ascp` has sent all the data that the file contains, it starts to count the wait time.
+If the file grows during the wait time, `ascp` sends the new data and starts to count the wait time again.
+When the wait time ends without a change to the file, the transfer completes.
+
+As a result:
+
+- The command completes after the wait time that follows the last write.
+  For example, with `grow=120`, the command completes about 2 minutes after the program stops writing.
+- If the program pauses for longer than the wait time, the transfer completes before the end of the file, and the destination file is incomplete.
+  Set a wait time that is longer than the longest pause of the program.
+
+To complete the transfer without waiting, use `confirm_stop`.
+
+#### Confirming the end of a growing file
+
+With `confirm_stop=true`, the program that writes the file signals the end of the file, so the transfer does not wait.
+
+1. Start the transfer with `confirm_stop=true` and a wait time that is longer than the longest pause of the program:
+
+   ```shell
+   ascli server upload live.log --ts.source_root='file:///?grow=600&confirm_stop=true' --to-folder=/Upload
+   ```
+
+2. When the program finishes writing the file, set the modification time of the file to a time earlier than the wait time.
+   For example:
+
+   ```shell
+   touch -t 200001010000 live.log
+   ```
+
+   The transfer completes immediately.
+
+> [!IMPORTANT]
+> With `confirm_stop=true`, if the wait time ends before the program sets the modification time, `ascp` considers the file invalid and the transfer fails.
 
-- **File list with `source_root` transfer spec** (preferred)
+To report an error in the file, with or without `confirm_stop`, the program sets the modification time of the file to 0, that is, `1970-01-01 00:00:00 UTC`.
+`ascp` then fails the transfer of the file.
+For example:
+
+```shell
+TZ=UTC touch -t 197001010000 live.log
+```
+
+#### Uploading a growing file
+
+`ascp` activates the growing file mode only if it finds the `grow` parameter in one of the following locations:
+
+- The first source on its command line.
+- The source prefix: `ascp` option `--source-prefix`, set by transfer spec parameter `source_root`.
+- The docroot of the transfer user, on the server.
+
+`ascp` does not look for the `grow` parameter in a file list.
+By default, the [`direct`](#agent-direct) agent provides the sources to `ascp` in a file list.
+As a result, if you specify a `file:` URI as a source with the default options, the transfer fails with the error `Session initiation failed, fail to set pvcl`.
+
+Use one of the following methods.
+The examples use the [`direct`](#agent-direct) agent.
+
+- **Set the URI as source prefix** (recommended)
 
-  Place only the bare filename(s) in the file list, and pass the `file:` URI as the source prefix so that the query parameters apply uniformly to every entry:
+  Set transfer spec parameter `source_root` to a `file:` URI that contains the folder of the files and the parameters.
+  Specify the sources as paths relative to this folder.
+  `ascp` inserts each source path before the parameters: for example, `file:////var/log?grow=120` and `app.log` give `file:////var/log/app.log?grow=120`.
+  All the files of the transfer use the same parameters.
+
+  To upload `live.log` from the current folder:
+
+  ```shell
+  ascli server upload live.log --ts.source_root='file:///?grow=120' --to-folder=/Upload
+  ```
+
+  To upload `/var/log/app.log`:
 
   ```shell
-  ascli server upload growing --to-folder=/Upload --ts.source_root='file:///?grow=120' --transfer.quiet=false
+  ascli server upload app.log --ts.source_root='file:////var/log?grow=120' --to-folder=/Upload
   ```
 
-- **URI directly on the command line with `file_list=false`**
+- **Set the URI as source on the command line**
+
+  Set transfer parameter `file_list` to `false`, so that `ascli` places the source on the `ascp` command line instead of in a file list.
+  Use this method for a single file.
 
   ```shell
-  ascli server upload 'file:///./growing?grow=120' --to-folder=/Upload --transfer.file_list=false --transfer.quiet=false
+  ascli server upload 'file:///live.log?grow=120' --to-folder=/Upload --transfer.file_list=false
   ```
 
+> [!TIP]
+> To display the native progress bar of `ascp` instead of the progress bar of `ascli`, add `--transfer.quiet=false`.
+
+#### Downloading a growing file
+
+For a download, the growing file is on the server.
+The transfer user on the server usually has a docroot, and the server does not resolve a `file:` URI from the client in this docroot: the transfer fails with the error `No such file or directory`.
+Instead, the server administrator sets the parameters in the docroot of the transfer user.
+For example, on the server:
+
+```shell
+asconfigurator -x 'set_user_data;user_name,xfer_live;absolute,file:////data/live?grow=120'
+```
+
+Then, the client downloads the file with a path relative to the docroot, as for any other file:
+
+```shell
+ascli server download live.log --to-folder=.
+```
+
+All the transfers of this user are then growing file transfers, so use a dedicated transfer user.
+This method also applies to transfers that use a token, for example with the Node API or Aspera on Cloud: for a download with a token, `ascp` does not accept a `file:` URI as source prefix.
+
+If the transfer user has no docroot and the transfer does not use a token, you can also use the upload methods, with absolute paths on the server.
+
 ### Usage
 
 ```text
 ascli -h
 NAME
-        ascli -- a command line tool for Aspera Applications (v4.27.5)
+        ascli -- a command line tool for Aspera Applications (v4.28.0)
 
 SYNOPSIS
         ascli [GLOBAL_OPTIONS] <command> [OPTIONS] [ARGS]
@@ -5241,10 +5591,21 @@ OPTIONS
 ARGS
         Some commands require mandatory arguments, e.g. a path.
 
+EXIT STATUS
+        0    Success
+        1    Other error
+        2    Command line error: unknown command or option, invalid or missing argument
+        3    Authentication or authorization failure: SSH, HTTP 401 or 403, OAuth grant
+        4    Resource not found, or several resources match the identifier, HTTP 404
+        5    Transfer failure
+        6    Network or TLS failure: name resolution, connection, timeout, certificate
+        7    Other error returned by a remote API
+        130  Interrupted by user (Ctrl-C)
+
 OPTIONS: global
     --interactive=yes|no           Use interactive input of missing params
     --ask-options=yes|no           Ask even optional options
-    --out=HASH                     Output rendering options (dot-notation: format, level, file, fields, select, table[.pivot], flat, secrets, colors, utf8, img)
+    --out=HASH                     Output rendering options (dot-notation: format, level, file, fields, select, query, table[.pivot], flat, secrets, colors, utf8, img)
     --display=info|data|error      Output only some information (deprecated after 4.27.0: use --out.level)
     --format=ENUM                  Output format (also: --out.format)
     --output=VALUE                 Destination for results (deprecated after 4.27.0: use --out.file)
@@ -5258,17 +5619,19 @@ OPTIONS: global
 -h, --help                         Show this message
     --show-config                  Display parameters used for the provided action
 -v, --version                      Display version
-    --ui=text|graphical            Method to start browser
+    --ui=HASH                      User interface (dot-notation: mode, command)
     --invalid-characters=VALUE     Replacement character and invalid filename characters
     --log-level=ENUM               Log level
     --log-format=VALUE             Log formatter
     --logger=stderr|stdout|syslog  Logging method
     --log=HASH                     Logging options (dot-notation: level, type, format, secrets)
+    --security=HASH                Security restrictions (dot-notation: level, allowed_paths)
     --lock-port=INT                Prevent dual execution of a command, e.g. in cron
     --once-only=yes|no             Process only new items (some commands)
     --log-secrets=yes|no           Show passwords in logs
-    --clean-temp=yes|no            Cleanup temporary files on exit
-    --temp-folder=VALUE            Temporary folder
+    --temp=HASH                    Temporary files (dot-notation: folder, clean, expiry)
+    --clean-temp=yes|no            Cleanup temporary files on exit (deprecated after 4.27.5: use --temp.clean)
+    --temp-folder=VALUE            Temporary folder (deprecated after 4.27.5: use --temp.folder)
     --pid-file=VALUE               Write process identifier to file, delete on exit
     --parser=none|json|ruby|yaml   Default parser for structured parameters and options
     --home=VALUE                   Home folder for tool
@@ -5284,7 +5647,7 @@ OPTIONS: global
     --version-check-days=INT       Period in days to check new version (zero to disable)
     --plugin-folder=VALUE          Folder where to find additional plugins
     --sdk-url=VALUE                Ascp: URL to get Aspera Transfer Executables
-    --locations-url=VALUE          Ascp: URL to get download locations of Aspera Transfer Daemon
+    --locations-url=LIST           Ascp: URLs to get download locations of Aspera Transfer Daemon
     --sdk-folder=VALUE             Ascp: Path to folder with ascp (or product with "product:")
     --smtp=HASH                    SMTP email server configuration
     --notify-to=VALUE              Email: Recipient for notification of transfers
@@ -5900,6 +6263,7 @@ To register with web-based authentication (auth=web):
 > [!NOTE]
 > For web based authentication, `ascli` listens on a local port (for example, specified by the `redirect_uri` parameter, in this example: `12345`), and the browser will provide the OAuth code there.
 > For `ascli`, HTTP is required, and `12345` is the default port.
+> The host of `redirect_uri` shall be loopback: `localhost`, an address of `127.0.0.0/8`, or `[::1]`.
 
 Once the client is registered, a **Client ID** and **Secret** are created; these values are used in the next step.
 
@@ -6106,11 +6470,12 @@ empty
 
 The command `ascli aoc bearer_token` can be used to generate an OAuth token suitable to call any AoC API.
 This can be useful when a command is not yet available.
+The token is a secret: it is hidden in the output, unless option `--out.secrets=yes` is used.
 
 Example:
 
 ```shell
-curl -s -H "Authorization: $(ascli aoc bearer_token)" 'https://api.ibmaspera.com/api/v1/group_memberships?embed[]=dropbox&embed[]=workspace'|jq -r '.[]|(.workspace.name + " -> " + .dropbox.name)'
+curl -s -H "Authorization: $(ascli aoc bearer_token --out.secrets=yes)" 'https://api.ibmaspera.com/api/v1/group_memberships?embed[]=dropbox&embed[]=workspace'|jq -r '.[]|(.workspace.name + " -> " + .dropbox.name)'
 ```
 
 It is also possible to get the bearer token for node, as user or as admin using:
@@ -6714,7 +7079,7 @@ So, for example, the creation of a node using ATS in IBM Cloud looks like (see o
 The creation options are the ones of ATS API, refer to the [section on ATS](#ats-access-key-creation-parameters) for more details and examples.
 
 ```shell
-ascli aoc admin ats access_key create @json:'{"storage":{"type":"ibm-s3","bucket":"mybucket","credentials":{"access_key_id":"mykey","secret_access_key":"mysecret"},"path":"/"}}' --cloud=softlayer --region=eu-de
+ascli aoc admin ats access_key create @json:'{"storage":{"type":"ibm-s3","bucket":"mybucket","credentials":{"access_key_id":"<ACCESS_KEY_ID>","secret_access_key":"<SECRET>"},"path":"/"}}' --cloud=softlayer --region=eu-de
 ```
 
 Once executed, the access key `id` and `secret`, randomly generated by the Node API, are displayed.
@@ -6734,7 +7099,7 @@ ascli aoc admin ats cluster show --cloud=softlayer --region=eu-de --fields=trans
 Then use the returned address for the `url` key to create the AoC Node resource:
 
 ```shell
-ascli aoc admin node create @json:'{"name":"myname","access_key":"myaccesskeyid","ats_access_key":true,"ats_storage_type":"ibm-s3","url":"https://ats-sl-fra-all.aspera.io"}'
+ascli aoc admin node create @json:'{"name":"myname","access_key":"<ACCESS_KEY>","ats_access_key":true,"ats_storage_type":"ibm-s3","url":"https://ats-sl-fra-all.aspera.io"}'
 ```
 
 Creation of a node with a self-managed node is similar, but the command `aoc admin ats access_key create` is replaced with `node access_keys create` on the private node itself.
@@ -6849,7 +7214,7 @@ ascli aoc files browse /src_folder
 To send a package with the file `10M.dat` from subfolder /src_folder:
 
 ```shell
-ascli aoc files node_info /src_folder --format=json --out.level=data | ascli aoc packages send @json:'{"name":"test","recipients":["someuser@example.com"]}' 10M.dat --transfer=@json:@stdin: --transfer.agent=node
+ascli aoc files node_info /src_folder --format=json --out.level=data --out.secrets=yes | ascli aoc packages send @json:'{"name":"test","recipients":["someuser@example.com"]}' 10M.dat --transfer=@json:@stdin: --transfer.agent=node
 ```
 
 #### Receive packages
@@ -7322,7 +7687,7 @@ Procedure to send a file from org1 to org2:
 - Execute the following:
 
 ```shell
-ascli -Porg1 aoc files node_info <SOURCE_FOLDER> --format=json --out.level=data | ascli -Porg2 aoc files upload <SOURCE_FILE> --to-folder=<DEST_FOLDER> --transfer=@json:@stdin: --transfer.agent=node
+ascli -Porg1 aoc files node_info <SOURCE_FOLDER> --format=json --out.level=data --out.secrets=yes | ascli -Porg2 aoc files upload <SOURCE_FILE> --to-folder=<DEST_FOLDER> --transfer=@json:@stdin: --transfer.agent=node
 ```
 
 Explanation:
@@ -7367,16 +7732,16 @@ admin application instance list --query.organization_apps=true
 admin application membership list
 admin application types
 admin ats access_key create --cloud=aws --region=my_region @json:'{"id":"ak_aws_aoc","name":"my test key AWS","storage":{"type":"aws_s3","bucket":"my_bucket","credentials":{"access_key_id":"my_access_key","secret_access_key":"my_secret_key"},"path":"/"}}'
-admin ats access_key create --cloud=softlayer --region=my_region @: id=ak1ibmcloud secret=my_secret_here 'name="my test key"' storage.type=ibm-s3 storage.bucket=my_bucket storage.credentials.access_key_id=my_access_key storage.credentials.secret_access_key=my_secret_key storage.path=/
+admin ats access_key create --cloud=softlayer --region=my_region @: id=ak1ibmcloud secret=<SECRET> 'name="my test key"' storage.type=ibm-s3 storage.bucket=my_bucket storage.credentials.access_key_id=my_access_key storage.credentials.secret_access_key=my_secret_key storage.path=/
 admin ats access_key delete ak1ibmcloud
 admin ats access_key list --fields=name,id
-admin ats access_key node ak1ibmcloud --secret=my_secret_here browse /
+admin ats access_key node ak1ibmcloud --secret=<SECRET> browse /
 admin ats cluster clouds
 admin ats cluster list
 admin ats cluster show --cloud=aws --region=eu-west-1
 admin ats cluster show 1f412ae7-869a-445c-9c05-02ad16813be2
 admin auth_providers list
-admin bearer_token --out.level=data
+admin bearer_token --out.level=data --out.secrets=yes
 admin client list
 admin client_access_key list
 admin client_registration_token create @json:'{"data":{"name":"test_client_reg1","client_subject_scopes":["alee","aejd"],"client_subject_enabled":true}}'
@@ -7393,15 +7758,15 @@ admin kms_profile list
 admin network_policy list
 admin network_policy show <id>
 admin node bearer_token %name:my_node_name user:all
-admin node do %name:my_node_name --secret=my_ak_secret browse /
-admin node do %name:my_node_name --secret=my_ak_secret browse /folder_sub --node-api.cache=false
-admin node do %name:my_node_name --secret=my_ak_secret delete /folder1
-admin node do %name:my_node_name --secret=my_ak_secret delete /folder_sub
-admin node do %name:my_node_name --secret=my_ak_secret mkdir /folder1
-admin node do %name:my_node_name --secret=my_ak_secret mkdir /folder_sub
-admin node do %name:my_node_name --secret=my_ak_secret v3 access_key create @json:'{"id":"testsub1","storage":{"path":"/folder_sub"}}'
-admin node do %name:my_node_name --secret=my_ak_secret v3 access_key delete testsub1
-admin node do %name:my_node_name --secret=my_ak_secret v3 events
+admin node do %name:my_node_name --secret=<AK_SECRET> browse /
+admin node do %name:my_node_name --secret=<AK_SECRET> browse /folder_sub --node-api.cache=false
+admin node do %name:my_node_name --secret=<AK_SECRET> delete /folder1
+admin node do %name:my_node_name --secret=<AK_SECRET> delete /folder_sub
+admin node do %name:my_node_name --secret=<AK_SECRET> mkdir /folder1
+admin node do %name:my_node_name --secret=<AK_SECRET> mkdir /folder_sub
+admin node do %name:my_node_name --secret=<AK_SECRET> v3 access_key create @json:'{"id":"testsub1","storage":{"path":"/folder_sub"}}'
+admin node do %name:my_node_name --secret=<AK_SECRET> v3 access_key delete testsub1
+admin node do %name:my_node_name --secret=<AK_SECRET> v3 events
 admin node do %name:my_node_name delete test_shared_folder
 admin node do %name:my_node_name mkdir test_shared_folder
 admin node do %name:my_node_name perm test_shared_folder create @json:'{"with":"","as":"other_name_shared"}' --workspace=my_workspace_shared_inbox
@@ -7418,6 +7783,7 @@ admin subscription account
 admin subscription usage
 admin subscription usage MONTH
 admin user list
+admin user list --out.query='[?ats_admin].{name: name, email: email}'
 admin user modify %name:my_user_email @: deactivated=false
 admin user notifications %name:my_user_email show
 admin user preferences %name:my_user_email show
@@ -7433,13 +7799,13 @@ automation workflow delete <id>
 automation workflow list
 automation workflow list --query.show_org_workflows=@val:true
 automation workflow list --select.name=test_workflow --fields=id
-bearer_token --out.level=data
+bearer_token --out.level=data --out.secrets=yes
 files bearer /
 files bearer_token_node / --cache-tokens=no
 files browse /
 files browse / --url=my_private_link_shared_folder
 files browse / --url=my_public_link_folder_no_pass
-files browse / --url=my_public_link_folder_with_pass --password=my_public_link_folder_password
+files browse / --url=my_public_link_folder_with_pass --password=<PUBLIC_LINK_FOLDER_PASSWORD>
 files browse my_remote_file
 files browse my_remote_folder
 files browse my_remote_folder/
@@ -7486,7 +7852,7 @@ packages receive INIT --once-only=yes --query.dropbox_name=my_shared_inbox_name
 packages send --workspace=my_workspace_shared_inbox --validate-metadata=yes @json:'{"name":"package title","recipients":["my_shared_inbox_meta"],"metadata":[{"input_type":"single-text","name":"Project Id","values":["123"]},{"input_type":"single-dropdown","name":"Type","values":["Opt2"]},{"input_type":"multiple-checkbox","name":"CheckThose","values":["Check1","Check2"]},{"input_type":"date","name":"Optional Date","values":["2021-01-13T15:02:00.000Z"]}]}' test_file.bin
 packages send --workspace=my_workspace_shared_inbox --validate-metadata=yes @json:'{"name":"package title","recipients":["my_shared_inbox_meta"],"metadata":{"Project Id":"456","Type":"Opt2","CheckThose":["Check1","Check2"],"Optional Date":"2021-01-13T15:02:00.000Z"}}' test_file.bin
 packages send --workspace=my_workspace_shared_inbox @json:'{"name":"package title","recipients":["my_shared_inbox_name"]}' test_file.bin
-packages send @: 'name=package title' END test_file.bin --url=my_public_link_send_aoc_user --password=my_public_link_send_use_pass
+packages send @: 'name=package title' END test_file.bin --url=my_public_link_send_aoc_user --password=<PUBLIC_LINK_SEND_USE_PASS>
 packages send @: 'name=package title' END test_file.bin --url=my_public_link_send_shared_inbox
 packages send @: 'name=package title' recipients.0=my_username 'note=some notes' END test_file.bin
 packages send @json:'{"name":"package title","recipients":["my_email_external"]}' --new-user-option.package_contact=true test_file.bin
@@ -7494,7 +7860,7 @@ packages shared_inboxes list
 packages shared_inboxes short_link public %name:my_shared_inbox_name create --fields=id
 packages shared_inboxes short_link public %name:my_shared_inbox_name delete <aoc_shared_inbox_short_link_create>
 packages shared_inboxes short_link public %name:my_shared_inbox_name list
-packages shared_inboxes short_link public %name:my_shared_inbox_name modify <aoc_shared_inbox_short_link_create> @: password=my_public_link_folder_password
+packages shared_inboxes short_link public %name:my_shared_inbox_name modify <aoc_shared_inbox_short_link_create> @: password=<PUBLIC_LINK_FOLDER_PASSWORD>
 packages shared_inboxes short_link public %name:my_shared_inbox_name show <aoc_shared_inbox_short_link_create>
 packages shared_inboxes show %name:my_shared_inbox_name
 packages show '%name:package title'
@@ -7542,7 +7908,7 @@ Please preserve the API key! It cannot be retrieved after it's created.
 Name          <KEY_NAME>
 Description   <DESCRIPTION>
 Created At    2019-09-30T12:17+0000
-API Key       <SECRET>_api_key_here
+API Key       <API_KEY>
 Locked        false
 UUID          ApiKey-05b8fadf-e7fe-abcd-93a9-6fd348c5ab1f
 ```
@@ -7559,7 +7925,7 @@ Then, to register the key by default for the `ats` plugin, create a preset.
 Execute:
 
 ```shell
-ascli config preset update <PRESET_NAME> --ibm-api-key=<SECRET>_api_key_here
+ascli config preset update <PRESET_NAME> --ibm-api-key=<API_KEY>
 ```
 
 ```shell
@@ -7583,16 +7949,16 @@ ascli ats api_key create --out.secrets=yes
 ```
 
 ```text
-╭────────┬──────────────────────────────────────────────╮
-│ field  │ value                                        │
-╞════════╪══════════════════════════════════════════════╡
-│ id     │ ats_XXXXXXXXXXXXXXXXXXXXXXXX                 │
-│ secret │ YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY │
-╰────────┴──────────────────────────────────────────────╯
+╭────────┬──────────────╮
+│ field  │ value        │
+╞════════╪══════════════╡
+│ id     │ <ATS_KEY>    │
+│ secret │ <ATS_SECRET> │
+╰────────┴──────────────╯
 ```
 
 ```shell
-ascli config preset update <PRESET_NAME> --ats-key=ats_XXXXXXXXXXXXXXXXXXXXXXXX --ats-secret=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
+ascli config preset update <PRESET_NAME> --ats-key=<ATS_KEY> --ats-secret=<ATS_SECRET>
 ```
 
 ### ATS Access key creation parameters
@@ -7612,7 +7978,7 @@ ascli ats access_key create @json:'{"storage":{"type":"softlayer_swift","contain
 Example: create access key on AWS:
 
 ```shell
-ascli ats access_key create @json:'{"id":"<ACCESS_KEY>","name":"laurent key AWS","storage":{"type":"aws_s3","bucket":"my-bucket","credentials":{"access_key_id":"_access_key_id_here_","secret_access_key":"<SECRET>"},"path":"/laurent"}}' --cloud=aws --region=eu-west-1
+ascli ats access_key create @json:'{"id":"<ACCESS_KEY>","name":"laurent key AWS","storage":{"type":"aws_s3","bucket":"my-bucket","credentials":{"access_key_id":"<ACCESS_KEY_ID>","secret_access_key":"<SECRET>"},"path":"/laurent"}}' --cloud=aws --region=eu-west-1
 ```
 
 Example: create access key on Azure SAS:
@@ -7644,13 +8010,13 @@ The parameters provided to ATS for access key creation are the ones of [ATS API]
 > Add `ascli ats` in front of the following commands:
 
 ```shell
-access_key cluster ak2ibmcloud --secret=my_secret_here
+access_key cluster ak2ibmcloud --secret=<SECRET>
 access_key create --cloud=aws --region=my_region @json:'{"id":"ak_aws","name":"my test key AWS","storage":{"type":"aws_s3","bucket":"my_bucket","credentials":{"access_key_id":"my_access_key","secret_access_key":"my_secret_key"},"path":"/"}}'
-access_key create --cloud=softlayer --region=my_region @json:'{"id":"ak2ibmcloud","secret":"my_secret_here","name":"my test key","storage":{"type":"ibm-s3","bucket":"my_bucket","credentials":{"access_key_id":"my_access_key","secret_access_key":"my_secret_key"},"path":"/"}}'
+access_key create --cloud=softlayer --region=my_region @json:'{"id":"ak2ibmcloud","secret":"<SECRET>","name":"my test key","storage":{"type":"ibm-s3","bucket":"my_bucket","credentials":{"access_key_id":"my_access_key","secret_access_key":"my_secret_key"},"path":"/"}}'
 access_key delete ak2ibmcloud
 access_key entitlement ak2ibmcloud
 access_key list --fields=name,id
-access_key node ak2ibmcloud browse / --secret=my_secret_here
+access_key node ak2ibmcloud browse / --secret=<SECRET>
 access_key show ak2ibmcloud
 api_key create
 api_key instances
@@ -7674,12 +8040,12 @@ Then, commands `ascp` (for transfers) and `ascmd` (for file operations) are exec
 > If you have Node API credentials, or Access Key/Secret, use the plugin: `node`.
 > This plugin is exclusively using SSH credentials.
 
-The URL to be provided with option `url` shall be like `ssh://_server_address_:33001`, then option `username` is used to specify the transfer user, and finally either option `password` or `ssh_keys` (with one or several paths) for the authentication.
+The URL to be provided with option `url` shall be like `ssh://<SERVER_ADDRESS>:33001`, then option `username` is used to specify the transfer user, and finally either option `password` or `ssh_keys` (with one or several paths) for the authentication.
 
 Typically:
 
 ```shell
-ascli server --url=ssh://hsts.example.com:33001 --username=john --password=_something_here_ ...
+ascli server --url=ssh://hsts.example.com:33001 --username=john --password=<PASSWORD> ...
 ```
 
 ```shell
@@ -7693,7 +8059,7 @@ ascli server --url=ssh://hsts.example.com:33001 --username=john --ssh-keys=~/.ss
 
 ```shell
 browse /
-browse / --password=@none: --ssh-options.number_of_password_prompts=0 --ssh-keys=<serv_key_path>
+browse / --password @none: --ssh-options.number_of_password_prompts=0 --ssh-keys=<serv_key_path>
 browse my_inside_folder/test_file.bin
 browse my_upload_folder/target_hot
 cp my_inside_folder/test_file.bin my_upload_folder/200KB.2
@@ -7715,17 +8081,17 @@ sync admin file_info /data/local_sync
 sync admin overview /data/local_sync
 sync admin query --sql='SELECT name FROM sqlite_master WHERE type='table'' /data/local_sync
 sync admin status /data/local_sync
+sync pull my_inside_folder --to-folder=/data/local_sync @: name=serv_sync_pull_conf
 sync pull my_inside_folder --to-folder=/data/local_sync @json:'{"name":"serv_sync_pull_conf","reset":true,"transport":{"target_rate":my_bps}}'
-sync pull my_inside_folder --to-folder=/data/local_sync @json:'{"name":"serv_sync_pull_conf"}'
 upload 'faux:///test.bin?1k' --to-folder=my_upload_folder
 upload --sources=@ts --transfer.ascp_args=@list:,--file-list,file_list.txt --to-folder=my_inside_folder
 upload --sources=@ts --transfer.ascp_args=@list:,--file-pair-list,file_pair_list.txt
 upload --sources=@ts --ts=@json:'{"paths":[{"source":"test_file.bin","destination":"my_inside_folder/other_name_4"}]}' --transfer.agent=transferd
 upload --src-type=pair --sources=@json:'["test_file.bin","my_inside_folder/other_name_3"]' --transfer.quiet=false
 upload --src-type=pair test_file.bin my_inside_folder/other_name_2 --notify-to=my_email_external '--transfer.ascp_args=@list: -l 100m'
-upload --src-type=pair test_file.bin my_upload_folder/other_name_5 --ts=@json:'{"cipher":"aes-192-gcm","content_protection":"encrypt","content_protection_password":"my_secret_here","cookie":"biscuit","create_dir":true,"delete_before_transfer":false,"delete_source":false,"exclude_newer_than":"-1","exclude_older_than":"-10000","fasp_port":33001,"http_fallback":false,"multi_session":0,"overwrite":"diff+older","precalculate_job_size":true,"preserve_access_time":true,"preserve_creation_time":true,"rate_policy":"fair","resume_policy":"sparse_csum"}'
+upload --src-type=pair test_file.bin my_upload_folder/other_name_5 --ts=@json:'{"cipher":"aes-192-gcm","content_protection":"encrypt","content_protection_password":"<PASSWORD>","cookie":"biscuit","create_dir":true,"delete_before_transfer":false,"delete_source":false,"exclude_newer_than":"-1","exclude_older_than":"-10000","fasp_port":33001,"http_fallback":false,"multi_session":0,"overwrite":"diff+older","precalculate_job_size":true,"preserve_access_time":true,"preserve_creation_time":true,"rate_policy":"fair","resume_policy":"sparse_csum"}'
 upload --to-folder=my_upload_folder/target_hot --lock-port=50101 --transfer.ascp_args=@list:,--remove-after-transfer,--remove-empty-directories,--exclude-newer-than=-8,--src-base,hot_folder hot_folder
-upload /test_file.bin --to-folder=my_upload_folder --transfer.agent=node --transfer.url=http://localhost:12348 --transfer.username=sim --transfer.password=sim
+upload /test_file.bin --to-folder=my_upload_folder --transfer.agent=node --transfer.url=http://localhost:12348 --transfer.username=sim --transfer.password=<PASSWORD>
 upload test_file.bin --to-folder=my_inside_folder --ts=@json:'{"multi_session":3,"multi_session_threshold":1,"resume_policy":"none","target_rate_kbps":100000}' --transfer=@json:'{"spawn_delay_sec":2.5,"multi_incr_udp":false}' --progress-bar=yes
 ```
 
@@ -7743,7 +8109,7 @@ If neither SSH password nor key is provided and a transfer token is provided in
 Example:
 
 ```shell
-ascli server --url=ssh://_server_address_:33001 ... --ts=@json:'{"token":"Basic _token_here_"}'
+ascli server --url=ssh://<SERVER_ADDRESS>:33001 ... --ts=@json:'{"token":"Basic <TOKEN>"}'
 ```
 
 > [!NOTE]
@@ -7830,7 +8196,7 @@ ascli server download /aspera-test-dir-large/200MB
 If an SSH private key is used for authentication with a passphrase, the passphrase needs to be provided to both options: `ssh_options` (for browsing) and `ts` (for transfers):
 
 ```shell
-ascli server --url=ssh://_server_address_here_:33001 --username=_user_here_ --ssh-keys=_private_key_path_here_ --passphrase=_passphrase_here_
+ascli server --url=ssh://<SERVER_ADDRESS>:33001 --username=<USERNAME> --ssh-keys=<PRIVATE_KEY_PATH> --passphrase=<PASSPHRASE>
 ```
 
 ## Plugin: `node`: IBM Aspera High Speed Transfer Server Node
@@ -8113,7 +8479,7 @@ ascli aoc files thumbnail /preview_samples/Aspera.mpg
 ```
 
 > [!TIP]
-> To specify the file by its file ID, use the selector syntax: `%id:_file_id_here_`
+> To specify the file by its file ID, use the selector syntax: `%id:<FILE_ID>`
 
 > [!NOTE]
 > To force textual display of the preview on **iTerm**, prefix command with: `env -u TERM_PROGRAM -u LC_TERMINAL`
@@ -8259,7 +8625,7 @@ ascli node access_keys modify %id:self @ruby:'{token_verification_key: File.read
 - Create a Bearer token for the user:
 
   ```shell
-  ascli node bearer_token @file:./myorgkey.pem @json:'{"user_id":"'$my_user_id'","_validity":3600}' --out.file=bearer.txt
+  ascli node bearer_token @file:./myorgkey.pem @json:'{"user_id":"'$my_user_id'","_validity":3600}' --out.secrets=yes --out.file=bearer.txt
   ```
 
 > [!NOTE]
@@ -8287,26 +8653,26 @@ ascli node -N --url=https://... --password="Bearer $(cat bearer.txt)" --root-id=
 > Add `ascli node` in front of the following commands:
 
 ```shell
---url=http://localhost:12348 --username=sim --password=sim browse / --fields=path --format=csv --select=@json:'{"basename":"test_file.bin"}'
---url=http://localhost:12348 --username=sim --password=sim transfer list --fields=status
---url=https://tst.example.com/path --password='Bearer <nd_bearer_token>' --root-id=<id> access_key do self browse /
-access_key create @json:'{"id":"my_username","secret":"my_password_here","storage":{"type":"local","path":"/"}}'
+--url=http://localhost:12348 --username=sim --password=<PASSWORD> browse / --fields=path --format=csv --select=@json:'{"basename":"test_file.bin"}'
+--url=http://localhost:12348 --username=sim --password=<PASSWORD> transfer list --fields=status
+--url=https://tst.example.com/path --password 'Bearer <nd_bearer_token>' --root-id=<id> access_key do self browse /
+access_key create @json:'{"id":"my_username","secret":"<PASSWORD>","storage":{"type":"local","path":"/"}}'
 access_key delete my_username
-access_key do my_ak_name browse / --secret=my_ak_secret
-access_key do my_ak_name delete /test_nd_ak2 --secret=my_ak_secret
-access_key do my_ak_name delete test_nd_ak3 --secret=my_ak_secret
-access_key do my_ak_name download test_nd_ak3 --to-folder=. --secret=my_ak_secret
-access_key do my_ak_name find my_test_folder --secret=my_ak_secret
-access_key do my_ak_name find my_test_folder @re:'\.jpg$' --secret=my_ak_secret
+access_key do my_ak_name browse / --secret=<AK_SECRET>
+access_key do my_ak_name delete /test_nd_ak2 --secret=<AK_SECRET>
+access_key do my_ak_name delete test_nd_ak3 --secret=<AK_SECRET>
+access_key do my_ak_name download test_nd_ak3 --to-folder=. --secret=<AK_SECRET>
+access_key do my_ak_name find my_test_folder --secret=<AK_SECRET>
+access_key do my_ak_name find my_test_folder @re:'\.jpg$' --secret=<AK_SECRET>
 access_key do my_ak_name find my_test_folder @ruby:'->(f){f["name"].end_with?(".jpg")}'
- --secret=my_ak_secret
-access_key do my_ak_name mkdir /tst_nd_ak --secret=my_ak_secret
-access_key do my_ak_name mkfile /mkfile.txt 'hello world' --secret=my_ak_secret
-access_key do my_ak_name mklink /mklink.txt --query=@json:'{"target":"/mkfile.txt","target_node_id":"123"}' --secret=my_ak_secret
-access_key do my_ak_name node_info / --secret=my_ak_secret
-access_key do my_ak_name rename /tst_nd_ak test_nd_ak2 --secret=my_ak_secret
-access_key do my_ak_name show %id:1 --secret=my_ak_secret
-access_key do my_ak_name upload 'faux:///test_nd_ak3?100k' --node-api.standard_ports=false --secret=my_ak_secret
+ --secret=<AK_SECRET>
+access_key do my_ak_name mkdir /tst_nd_ak --secret=<AK_SECRET>
+access_key do my_ak_name mkfile /mkfile.txt 'hello world' --secret=<AK_SECRET>
+access_key do my_ak_name mklink /mklink.txt --query=@json:'{"target":"/mkfile.txt","target_node_id":"123"}' --secret=<AK_SECRET>
+access_key do my_ak_name node_info / --secret=<AK_SECRET>
+access_key do my_ak_name rename /tst_nd_ak test_nd_ak2 --secret=<AK_SECRET>
+access_key do my_ak_name show %id:1 --secret=<AK_SECRET>
+access_key do my_ak_name upload 'faux:///test_nd_ak3?100k' --node-api.standard_ports=false --secret=<AK_SECRET>
 access_key do self permission %id:<id> create @json:'{"access_type":"user","access_id":"666"}'
 access_key do self permission / delete 1
 access_key do self permission / modify 1 @: 'access_levels=@list: read list'
@@ -8333,7 +8699,7 @@ central session list
 delete @list:,my_upload_folder/a_folder,my_upload_folder/tdlink,my_upload_folder/a_file
 delete my_upload_folder/test_file.bin
 download my_upload_folder/test_file.bin --to-folder=.
-emulator @json:'{"url":"http://localhost:12348","username":"sim","password":"sim","docroot":"/data"}'
+emulator @json:'{"url":"http://localhost:12348","username":"sim","password":"<PASSWORD>","password_min_bits":0,"docroot":"/data"}'
 health
 info --fpac='function FindProxyForURL(url,host){return "DIRECT"}'
 license
@@ -8350,7 +8716,7 @@ space /
 spec
 ssync bandwidth %name:my_node_sync
 ssync counters %name:my_node_sync
-ssync create @json:'{"configuration":{"name":"my_node_sync","local":{"path":"my_local_path_real"},"remote":{"host":"my_host","port":my_port,"user":"my_username","pass":"my_password_here","path":"my_remote_path"}}}'
+ssync create @json:'{"configuration":{"name":"my_node_sync","local":{"path":"my_local_path_real"},"remote":{"host":"my_host","port":my_port,"user":"my_username","pass":"<PASSWORD>","path":"my_remote_path"}}}'
 ssync delete %name:my_node_sync
 ssync files %name:my_node_sync
 ssync list
@@ -8372,8 +8738,8 @@ transfer sessions
 transfer show <id>
 transport
 upload 'faux:///testfile1?1m' --to-folder=my_local_path
-upload --to-folder=my_upload_folder --sources=@ts --ts=@json:'{"paths":[{"source":"/aspera-test-dir-small/10MB.2"}],"precalculate_job_size":true}' --transfer.agent=node --transfer.url=https://node.example.com/path --transfer.username=my_username --transfer.password=my_password
-upload --username=my_ak_name --password=my_ak_secret test_file.bin
+upload --to-folder=my_upload_folder --sources=@ts --ts=@json:'{"paths":[{"source":"/aspera-test-dir-small/10MB.2"}],"precalculate_job_size":true}' --transfer.agent=node --transfer.url=https://node.example.com/path --transfer.username=my_username --transfer.password=<PASSWORD>
+upload --username=my_ak_name --password=<AK_SECRET> test_file.bin
 upload my_mxf my_docx --ts=@json:'{"target_rate_kbps":1000000,"resume_policy":"none"}'
 watch_folder list
 ```
@@ -8401,7 +8767,7 @@ Identify the region and the endpoint URL will be `https://otlp-[region]-saas.ins
 For convenience, those parameters can be provided in a preset, for example, named `otel_default`.
 
 ```shell
-ascli config preset initialize otel_default @json:'{"url":"https://otlp-orange-saas.instana.io:4318","key":"*********","interval":1.1}'
+ascli config preset initialize otel_default @json:'{"url":"https://otlp-orange-saas.instana.io:4318","key":"<KEY>","interval":1.1}'
 ```
 
 Then it is invoked like this (assuming a default node is configured):
@@ -8431,44 +8797,49 @@ The emulator starts its own `transferd`, and stops it on exit.
 It takes an optional `Hash` argument with the following parameters:
 
 | Field | Type | Description |
-|---------------|---------|----------------------------------------------------------------------------------|
+|-------------------|---------|----------------------------------------------------------------------------------|
 | `cert` | `String` | Path to the TLS certificate file. Accepted formats: PEM (`.pem`) or PKCS12 (`.p12` / `.pfx`).<br/>Example: `/path/to/cert.pem`. |
 | `chain` | `String` | Path to the PEM certificate chain file (appended as extra chain certificates).<br/>Example: `/path/to/chain.pem`. |
 | `docroot` | `String` | Local folder of the node files. Paths of `/files/browse` and local paths of transfers (sources of `send`, destination of `receive`) are relative to it, and confined in it. Defaults to the current working directory.<br/>Example: `/data/aspera`. |
 | `key` | `String` | Path to the PEM private key file, or the PKCS12 passphrase when `cert` is a `.p12`/`.pfx` file.<br/>Example: `/path/to/key.pem`. |
-| `password` | `String` | Password expected from clients in HTTP Basic authentication, for the above `username`.<br/>Example: `my_password`. |
+| `password_min_bits` | `Integer` | Minimum estimated strength of `password`, in bits (log2 of the number of guesses to find it). The strength is estimated with gem `zxcvbn` if installed, else with a built-in estimate that detects repeats, sequences, keyboard rows, words and years. `0` disables the check. A random password of 32 bytes (`openssl rand -hex 32`) is far above the default.<br/>Default: `80`. |
+| `password` | `String` | Password expected from clients in HTTP Basic authentication, for the above `username`. Generate it with `openssl rand -hex 32`: a weak password is refused (see `password_min_bits`).<br/>Example: `my_password`. |
 | `retention_sec` | `Integer` | Time in seconds a transfer stays in the list of transfers after it ended (completed, failed or canceled, and no more retried).<br/>Default: `86400`. |
 | `url` | `String` | Address and port the emulator listens on. Use `https://` with `cert`/`key` for TLS.<br/>Default: `http://localhost:8080`. |
-| `username` | `String` | Username expected from clients in HTTP Basic authentication. Set together with `password`. When not set, requests are accepted without authentication.<br/>Example: `node_user`. |
+| `username` | `String` | Username expected from clients in HTTP Basic authentication. Set together with `password`. When not set, requests are accepted without authentication. Mandatory when `url` is not a loopback address (`localhost`, `127.0.0.0/8`, `::1`).<br/>Example: `node_user`. |
 
 For details on `url` and HTTPS, see [Web service](#web-service).
 
 Like on a real node, the files of the emulator are in its `docroot`: paths of `browse`, and local paths of transfers, are relative to it.
 Local paths are the sources of an upload (`send`), and the destination of a download (`receive`).
-Paths leading out of the `docroot` are rejected.
+Paths leading out of the `docroot`, also through symbolic links, are rejected.
 
 Start the emulator, it runs until interrupted:
 
 ```shell
-ascli node emulator @json:'{"url":"http://localhost:12348","username":"sim","password":"sim","docroot":"/data"}'
+ascli node emulator @json:'{"url":"http://localhost:12348","username":"sim","password":"<PASSWORD>","docroot":"/data"}'
 ```
 
+Generate the password with `openssl rand -hex 32`.
+A weak password is refused at startup: its strength is estimated in bits, and shall be at least `password_min_bits`.
+`username` and `password` are mandatory when `url` is not a loopback address (`localhost`, `127.0.0.0/8`, `::1`): anyone reaching the emulator could send the files of the `docroot` to any host.
+
 Then, in another terminal, use it as a node, for example, to list the files in `/data`:
 
 ```shell
-ascli node --url=http://localhost:12348 --username=sim --password=sim browse /
+ascli node --url=http://localhost:12348 --username=sim --password=<PASSWORD> browse /
 ```
 
 Or as the transfer agent, for example, to upload the file `/data/my_file.dat` to a transfer server:
 
 ```shell
-ascli server upload /my_file.dat --transfer.agent=node --transfer.url=http://localhost:12348 --transfer.username=sim --transfer.password=sim
+ascli server upload /my_file.dat --transfer.agent=node --transfer.url=http://localhost:12348 --transfer.username=sim --transfer.password=<PASSWORD>
 ```
 
 The transfer is executed by `transferd`, and its status is available on the emulator:
 
 ```shell
-ascli node --url=http://localhost:12348 --username=sim --password=sim transfer list
+ascli node --url=http://localhost:12348 --username=sim --password=<PASSWORD> transfer list
 ```
 
 Supported endpoints:
@@ -8486,7 +8857,7 @@ Supported endpoints:
 Limitations:
 
 - Only transfers started through the emulator are known. They are kept in memory, and lost when the emulator stops. Ended transfers are removed from the list after `retention_sec` (default: one day).
-- Only Basic authentication is supported: when `username` and `password` are set, bearer tokens and access keys are rejected. When they are not set, all requests are accepted.
+- Only Basic authentication is supported: when `username` and `password` are set, bearer tokens and access keys are rejected. When they are not set (loopback `url` only), all requests are accepted.
 - Not supported: `files/upload_setup` and `files/download_setup` (so, `node upload|download` on the emulator), `ops/transfers/bandwidth`, pause and resume of transfers, query parameters `iteration_token` and `tag`.
 
 ## Plugin: `faspex5`: IBM Aspera Faspex v5
@@ -8618,9 +8989,9 @@ Then use these options:
 
 ```text
 --auth=jwt
---client-id=_client_id_here_
+--client-id=<CLIENT_ID>
 --client-secret=<SECRET>
---username=_username_here_
+--username=<USERNAME>
 --private-key=@file:.../path/to/key.pem
 ```
 
@@ -8633,7 +9004,7 @@ Typically, users create a preset so they don't have to enter these options each
 Example:
 
 ```shell
-ascli config preset update <F5_PRESET> --auth=jwt --client-id=_client_id_here_ --client-secret=<SECRET> --username=_username_here_ --private-key=@file:.../path/to/key.pem
+ascli config preset update <F5_PRESET> --auth=jwt --client-id=<CLIENT_ID> --client-secret=<SECRET> --username=<USERNAME> --private-key=@file:.../path/to/key.pem
 
 ascli config preset set default faspex5 <F5_PRESET>
 
@@ -8654,7 +9025,7 @@ The user will use the following options:
 
 ```text
 --auth=web
---client-id=_client_id_here_
+--client-id=<CLIENT_ID>
 --client-secret=<SECRET>
 --redirect-uri=https://127.0.0.1:8888
 ```
@@ -8666,7 +9037,7 @@ If all you have is a public link received by email or other, you can still do au
 For example, for a public link to post a package:
 
 ```shell
-ascli faspex5 packages send --url='https://faspex5.example.com/?context=_some_long_string_here_'
+ascli faspex5 packages send --url='https://faspex5.example.com/?context=<CONTEXT>'
 ```
 
 ### Faspex 5 bootstrap authentication
@@ -8681,7 +9052,7 @@ For `boot` method: (will be removed in future)
 Use this token as password and use `--auth=boot`.
 
 ```shell
-ascli config preset update f5boot --url=https://localhost/aspera/faspex --auth=boot --password=_token_here_
+ascli config preset update f5boot --url=https://localhost/aspera/faspex --auth=boot --password=<TOKEN>
 ```
 
 ### Tested commands for `faspex5`
@@ -8743,14 +9114,14 @@ packages receive --box=my_shared_box_name <id> --to-folder=.
 packages receive --box=my_workgroup --group-type=workgroups <id> --to-folder=.
 packages receive --url=my_public_link_recv_fr_user --to-folder=.
 packages receive --url=my_public_link_recv_fr_user ALL --to-folder=.
-packages receive <id> --to-folder=. --ts.content_protection_password=my_secret_here
-packages receive <id> <f5_pack_first_file> --to-folder=. --ts.content_protection_password=my_secret_here
+packages receive <id> --to-folder=. --ts.content_protection_password=<PASSWORD>
+packages receive <id> <f5_pack_first_file> --to-folder=. --ts.content_protection_password=<PASSWORD>
 packages receive ALL --once-only=yes --to-folder=. --query.max=5
 packages receive INIT --once-only=yes
 packages send --url=my_public_link_send_shared_box @json:'{"title":"test title"}' test_file.bin
 packages send --url=my_public_link_send_to_user @json:'{"title":"test title"}' test_file.bin
 packages send @: 'title=for shared inbox' recipients.0=my_shared_box_name metadata.Options=Opt1 'metadata.TextInput=example text' END test_file.bin
-packages send @: 'title=test title' recipients.0.name=my_username END test_file.bin --ts.content_protection_password=my_secret_here
+packages send @: 'title=test title' recipients.0.name=my_username END test_file.bin --ts.content_protection_password=<PASSWORD>
 packages send @json:'{"title":"test title","recipients":["my_workgroup"]}' test_file.bin
 packages send @json:'{"title":"test_webhook_ascli","recipients":["my_shared_box_name"]}' 'faux:///test1?1m'
 packages show --box=my_shared_box_name <id>
@@ -8758,7 +9129,7 @@ packages show --box=my_workgroup --group-type=workgroups <id>
 packages show <id>
 packages status <f5_pack_send_shared> @list:,failed,completed
 packages status <id>
-postprocessing @json:'{"url":"https://localhost:8553/asclihook","script_folder":"/path/to/scripts","cert":".../localhost.p12","key":"changeit"}'
+postprocessing @: url=https://localhost:8553/asclihook script_folder=/path/to/scripts cert=.../localhost.p12 key=<PASSWORD>
 shared browse %name:my_shared_folder_name
 shared list
 shared_folders browse %name:my_shared_folder_name
@@ -9056,7 +9427,7 @@ ascli faspex5 shared_folders browse %name:'Server Files' /folder
 ```
 
 ```shell
-ascli faspex5 packages send @json:'{"title":"hello","recipients":[{"name":"_recipient_here_"}]}' --shared-folder=%name:partages /folder/file
+ascli faspex5 packages send @json:'{"title":"hello","recipients":[{"name":"<RECIPIENT>"}]}' --shared-folder=%name:partages /folder/file
 ```
 
 > [!TIP]
@@ -9147,6 +9518,8 @@ To send a password reset link to a user, use command `faspex5 admin accounts res
 The command `ascli faspex5 postprocessing` emulates Faspex 4 post-processing script execution in Faspex 5.
 It implements a web hook for Faspex 5 and calls a script with the same environment variables as set by Faspex 4.
 Environment variables are set to the values provided by the web hook, which are the same as Faspex 4 post-processing.
+Only values whose key starts with `faspex_` are passed: other keys are ignored, as they could change the behavior of the script (e.g. `PATH`).
+A structured value (object or array) is passed as JSON.
 
 It allows migrating workflows from Faspex 4 to Faspex 5 while preserving scripts.
 Nevertheless, in the long term, a native approach shall be considered, such as using Aspera Orchestrator or other workflow engine, using Faspex 5 native web hooks or File Processing.
@@ -9159,37 +9532,71 @@ ascli faspex5 postprocessing
 
 An optional positional parameter can be provided as [Extended Value](#extended-value-syntax) `Hash`:
 
-| Parameter         | Type      | Default | Description                                       |
-|-------------------|-----------|-------|-----------------------------------------------------|
-| **server info**   | -         | -     | See [Web service](#web-service).                    |
-| `script_folder`   | `String`  | `.`   | Prefix added to script path (Default: CWD)          |
-| `fail_on_error`   | `Bool`    | false | Fail if true and process exits with non-zero code   |
-| `timeout_seconds` | `Integer` | 60    | Time out before script is killed                    |
+| Field | Type | Description |
+|-----------------------|-----------------------|----------------------------------------------------------------------------------|
+| `allowed_ips` | `String, Array[String]` | IP address or network (CIDR, e.g. `10.89.0.0/24`), or list of them, allowed to call the listener. Requests from any other source IP are rejected with HTTP 403. When not set, no IP restriction is applied. This parameter or `secret_token` is required when `url` is not a local address. |
+| `cert` | `String` | Path to the TLS certificate file. Accepted formats: PEM (`.pem`) or PKCS12 (`.p12` / `.pfx`).<br/>Example: `/path/to/cert.pem`. |
+| `chain` | `String` | Path to the PEM certificate chain file (appended as extra chain certificates).<br/>Example: `/path/to/chain.pem`. |
+| `fail_on_error` | `Bool` | When `true`, return HTTP 500 if the script exits with a non-zero status code. When `false` (default), the exit code is reported in the response body but HTTP 200 is returned.<br/>Default: `false`. |
+| `key` | `String` | Path to the PEM private key file, or the PKCS12 passphrase when `cert` is a `.p12`/`.pfx` file.<br/>Example: `/path/to/key.pem`. |
+| `script_folder` | `String` | Folder containing the post-processing scripts. The URL path (after the base path) is appended to this folder to locate the script to execute.<br/>Default: `.`.<br/>Example: `/opt/faspex/scripts`. |
+| `secret_token_min_bits` | `Integer` | Minimum estimated strength of `secret_token`, in bits (log2 of the number of guesses to find it). The strength is estimated with gem `zxcvbn` if installed, else with a built-in estimate that detects repeats, sequences, keyboard rows, words and years. `0` disables the check. A random token of 32 bytes (`openssl rand -hex 32`) is far above the default.<br/>Default: `80`. |
+| `secret_token` | `String` | Shared secret for webhook authentication. When set, every incoming request must include `?token=<value>` in the URL; requests without the correct token are rejected with HTTP 401. Configure the Faspex webhook URL as `http://host:port/path/script.sh?token=<value>`. This parameter or `allowed_ips` is required when `url` is not a local address. Generate it with `openssl rand -hex 32`: a weak token is refused (see `secret_token_min_bits`). |
+| `timeout_seconds` | `Integer` | Maximum time in seconds to wait for the script to complete before killing it.<br/>Default: `60`. |
+| `url` | `String` | Address and port the server listens on. Use `https://` with `cert`/`key` for TLS.<br/>Default: `http://localhost:8080`. |
+
+For details on `url` and HTTPS (`cert`, `key`, `chain`), see [Web service](#web-service).
 
 When a request on `ascli` is received the following happens:
 
-- `ascli` gets the path of the URL called
+- If `allowed_ips` is set, `ascli` checks the source IP address of the request (else HTTP 403).
+- If `secret_token` is set, `ascli` checks the `token` parameter of the URL (else HTTP 401).
+- `ascli` gets the path of the URL called.
 - It removes the **base path** of base URL.
-- It prepends it with the value of `script_folder`
-- It executes the script at that path
-- Upon success, a success code is returned
+- It prepends it with the value of `script_folder`.
+- It executes the script at that path, if it exists (else HTTP 404) and is inside `script_folder` (else HTTP 403).
+- The script is killed if it does not finish within `timeout_seconds`.
+- Upon success, a success code is returned.
 
 For example:
 
 ```shell
-ascli faspex5 postprocessing @json:'{"url":"http://localhost:8080/processing","script_folder":"/opt/scripts"}'
+ascli faspex5 postprocessing @json:'{"url":"http://0.0.0.0:8080/processing","script_folder":"/opt/scripts","secret_token":"<TOKEN>"}'
 ```
 
+Generate the token with `openssl rand -hex 32`.
+A weak token is refused at startup: its strength is estimated in bits, and shall be at least `secret_token_min_bits`.
+The estimate uses the optional gem `zxcvbn` if installed, else a built-in estimate.
+
 In Faspex 5, the URL of the webhook endpoint shall be reachable from within Faspex containers.
 For example, if `ascli` is running on the host, the URL hostname shall not be `localhost`, as this refers to the local address inside the Faspex container.
 Instead, one can specify the **IP address of the host** or `host.containers.internal` (Check `podman` manual).
+So, `ascli` shall listen on an address reachable from the containers: the IP address of the host, or `0.0.0.0` for all interfaces.
+
+> [!NOTE]
+> **Security**: by default the listener binds to loopback (`localhost`) and is not reachable from outside the host.
+> When `url` is not a loopback address (`localhost`, `127.0.0.0/8`, `::1`), at least one of the following protections is required:
+>
+> - **`secret_token`**: include the token in the Faspex webhook URL: `http://host:8080/processing/script1.sh?token=<TOKEN>`. Requests without the correct token are rejected with HTTP 401.
+> - **`allowed_ips`**: restrict the listener to the known Faspex container IPs or network, e.g. `@json:'{"allowed_ips":["192.168.1.10","10.89.0.0/24"]}'`. Requests from other IPs are rejected with HTTP 403.
 
 Define the web hook as follows:
 
-**Webhook endpoint URI**: `http://host.containers.internal:8080/processing/script1.sh`
+**Webhook endpoint URI**: `http://host.containers.internal:8080/processing/script1.sh?token=<TOKEN>`
 
 Then the post-processing script executed will be `/opt/scripts/script1.sh`.
 
+A Ruby script can also be evaluated in the process of `ascli`, instead of being executed in a new process.
+For this, add `lambda` to the query of the URL, e.g. `http://host.containers.internal:8080/processing/notify.rb?token=<TOKEN>&lambda`.
+The script shall have extension `.rb`, and return a lambda, which is called with all the webhook values (`Hash`).
+For example:
+
+```ruby
+->(params) { File.write('/tmp/last_package.txt', params['faspex_pkg_name']) }
+```
+
+The lambda runs with the privileges and configuration of `ascli`, and is stopped after `timeout_seconds`.
+
 ### Faspex 5: Faspex 4 Gateway
 
 > [!NOTE]
@@ -9198,33 +9605,48 @@ Then the post-processing script executed will be `/opt/scripts/script1.sh`.
 
 For legacy Faspex client applications that use the `send` API (only) of Faspex v4, the command `gateway` provides the capability to present an API compatible with Faspex 4, and it will call the Faspex 5 API.
 
-It takes a single argument which is the URL at which the gateway will be located (locally):
+It takes an optional `Hash` argument:
+
+| Field | Type | Description |
+|-------------------|---------|----------------------------------------------------------------------------------|
+| `cert` | `String` | Path to the TLS certificate file. Accepted formats: PEM (`.pem`) or PKCS12 (`.p12` / `.pfx`).<br/>Example: `/path/to/cert.pem`. |
+| `chain` | `String` | Path to the PEM certificate chain file (appended as extra chain certificates).<br/>Example: `/path/to/chain.pem`. |
+| `key` | `String` | Path to the PEM private key file, or the PKCS12 passphrase when `cert` is a `.p12`/`.pfx` file.<br/>Example: `/path/to/key.pem`. |
+| `password_min_bits` | `Integer` | Minimum estimated strength of `password`, in bits (log2 of the number of guesses to find it). The strength is estimated with gem `zxcvbn` if installed, else with a built-in estimate that detects repeats, sequences, keyboard rows, words and years. `0` disables the check. A random password of 32 bytes (`openssl rand -hex 32`) is far above the default.<br/>Default: `80`. |
+| `password` | `String` | Password expected from clients in HTTP Basic authentication, for the above `username`. Generate it with `openssl rand -hex 32`: a weak password is refused (see `password_min_bits`).<br/>Example: `my_password`. |
+| `url` | `String` | Address and port the server listens on. Use `https://` with `cert`/`key` for TLS.<br/>Default: `http://localhost:8080`. |
+| `username` | `String` | Username expected from clients in HTTP Basic authentication. Set together with `password`. When not set, requests are accepted without authentication. Mandatory when `url` is not a loopback address (`localhost`, `127.0.0.0/8`, `::1`).<br/>Example: `fx4_user`. |
+
+Example:
 
 ```shell
-ascli faspex5 gateway @json:'{"url":"https://localhost:12345/aspera/faspex"}'
+ascli faspex5 gateway @json:'{"url":"https://localhost:12345/aspera/faspex","username":"fx4","password":"<PASSWORD>"}'
 ```
 
+Clients authenticate with HTTP Basic, as on Faspex 4, with the `username` and `password` of the gateway.
+Generate the password with `openssl rand -hex 32`.
+A weak password is refused at startup: its strength is estimated in bits, and shall be at least `password_min_bits`.
+`username` and `password` are mandatory when `url` is not a loopback address (`localhost`, `127.0.0.0/8`, `::1`): anyone reaching the gateway could send packages to anyone, as the Faspex 5 user.
+When they are not set, requests are accepted without authentication.
+
 There are many limitations:
 
 - It's only to emulate the Faspex 4 `send` API (send package).
 - No support for remote sources, only for an actual file transfer by the client.
 - The client must use the transfer spec returned by the API (not `faspe:` URL).
 - Tags returned in transfer spec must be used in transfer.
-- Only a single authentication is possible (per gateway) on Faspex 5.
-- No authentication on the Faspex 4 side (ignored).
+- Only a single authentication is possible (per gateway) on Faspex 5: all packages are sent by the same Faspex 5 user.
 
 Behavior:
 The API client calls the Faspex 4 API on the gateway, then the gateway transforms this into a Faspex 5 API call, which returns a transfer spec, which is returned to the calling client.
 The calling client uses this to start a transfer to HSTS, which is managed by Faspex 5.
 
-For other parameters, see [Web service](#web-service).
-
 ### Faspex 5: Get Bearer token to use API
 
 If a command is missing, then it is still possible to call the API directly on the command line using `curl`:
 
 ```shell
-curl -H "Authorization: $(ascli faspex5 bearer_token)" https://faspex5.example.com/aspera/faspex/api/v5/api_endpoint_here
+curl -H "Authorization: $(ascli faspex5 bearer_token --out.secrets=yes)" https://faspex5.example.com/aspera/faspex/api/v5/<API_ENDPOINT>
 ```
 
 ## Plugin: `shares`: IBM Aspera Shares v1
@@ -9263,12 +9685,24 @@ ascli shares admin share user_permissions %name:test1 create @json:'{"user_id":'
 ascli shares admin share user_permissions %name:test1 list
 ```
 
-Share permissions (`user_permissions`, `group_permissions`) are identified by the user or group identifier: e.g. `show %username:john@example.com`.
+Share permissions are granted, modified and revoked on the share, with `share user_permissions` and `share group_permissions` (`create`, `list`, `show`, `modify`, `delete`).
+They are identified by the user or group identifier: e.g. `show %username:john@example.com`.
 Permissions not specified on creation take their default value.
 Available permissions: `browse_permission`, `download_permission`, `upload_permission`, `mkdir_permission`, `delete_permission`, `rename_permission`, `content_availability_permission`, `manage_permission`.
 
 > [!NOTE]
-> Permissions of a user or group on all shares (`user all share_permissions`, `group all share_permissions`) are read-only: only `list` and `show` are available.
+> The permissions of a user or group on all shares are listed with `user all share_permissions` and `group all share_permissions`.
+> These are read-only (`list` and `show`): to change them, use `share user_permissions` and `share group_permissions`.
+
+Example: Give a user (`jane@example.com`) the same share permissions as another user (`john@example.com`), using `jq`.
+
+```shell
+new_user_id=$(ascli shares admin user all show %username:jane@example.com --fields=id --out.level=data)
+ascli shares admin user all share_permissions %username:john@example.com list --format=json --out.level=data |
+  jq -c '.[]' | while read -r permission; do
+    ascli shares admin share user_permissions "$(jq .share_id <<< "$permission")" create @json:"$(jq -c --argjson id "$new_user_id" '{user_id: $id} + with_entries(select(.key | endswith("_permission")))' <<< "$permission")"
+  done
+```
 
 ### Tested commands for `shares`
 
@@ -9276,7 +9710,10 @@ Available permissions: `browse_permission`, `download_permission`, `upload_permi
 > Add `ascli shares` in front of the following commands:
 
 ```shell
+admin authenticate @: username=my_username password=<PASSWORD>
+admin directory list
 admin group all list
+admin group search list
 admin node list
 admin share list --fields=DEF,-status,status_message
 admin share user_permissions %name:my_share list
@@ -9291,6 +9728,7 @@ admin user all share_permissions %username:my_username show %name:my_share
 admin user ldap add the_name
 admin user local list
 admin user saml import @json:'{"id":"the_id","name_id":"the_name"}'
+admin user search list
 files browse /
 files delete my_share_folder/new_folder
 files delete my_share_folder/test_file.bin
@@ -9305,6 +9743,7 @@ files upload --to-folder=my_share_folder test_file.bin --transfer.agent=httpgw -
 files upload send_folder --to-folder=my_share_folder --transfer.agent=httpgw --transfer.url=https://tst.example.com/path --transfer.synchronous=true --transfer.api_version=v1 --transfer.upload_chunk_size=100000
 health --url=https://shares.example.com/path
 info
+share list
 ```
 
 ## Plugin: `console`: IBM Aspera Console
@@ -9338,6 +9777,32 @@ transfer smart sub my_smart_id @: source.paths.0=my_smart_file source_type=user_
 
 ## Plugin: `orchestrator`: IBM Aspera Orchestrator
 
+To write workflow files without the designer, refer to the [Workflow Authoring Guide](https://github.com/laurent-martin/aspera-orchestrator-plugins-doc/blob/main/docs/workflow-authoring-guide.md): file format, graph, execution, examples and REST API.
+
+Command `workflows development` displays the documentation for workflow development, read from GitHub: this guide (`authoring`), or the [Action Template Reference](https://github.com/laurent-martin/aspera-orchestrator-plugins-doc/blob/main/docs/action-template-reference.md) (`templates`).
+With `toc`, it lists the sections of the document, and with the anchor of a section, it displays only that section.
+It does not require access to Orchestrator.
+The [MCP server](#plugin-mcp-model-context-protocol-server) instructs AI assistants to read it before writing or modifying a workflow.
+
+```shell
+ascli orchestrator workflows development authoring toc
+ascli orchestrator workflows development templates customruby
+```
+
+Command `plugins spec` displays the specifications of action plugins, read from GitHub: [plugins.yml](https://github.com/laurent-martin/aspera-orchestrator-plugins-doc/blob/main/docs/plugins.yml).
+For each plugin: template attributes (label, allowed values, defaults), and inputs and outputs of its steps, with the template settings they depend on.
+The fields are described in section [Plugin specifications](https://github.com/laurent-martin/aspera-orchestrator-plugins-doc/blob/main/docs/workflow-authoring-guide.md#plugin-specifications) of the guide.
+Without argument, it lists the plugins.
+With a plugin name (class name, case insensitive), it displays its specification, or one section: `attributes`, `inputs` or `outputs`.
+It does not require access to Orchestrator.
+Option `plugin_specs` gives another URL or path of the file, for example for another version of Orchestrator.
+
+```shell
+ascli orchestrator plugins spec --select=@json:'{"category":"Triggers"}'
+ascli orchestrator plugins spec AmazonS3Operation --format=yaml
+ascli orchestrator plugins spec ascpclient inputs
+```
+
 ### Authentication
 
 The Orchestrator plugin supports different credentials and authentication styles configured via `--auth_style`:
@@ -9380,6 +9845,99 @@ ascli orchestrator workflows start 1234 @json:'{"Param":"world !"}' @json:'{"ste
 > [!NOTE]
 > Options `synchronous` and `result` (`--result=<WORK_STEP>:<VARIABLE>`) are deprecated: use `execution` instead.
 
+### Import a workflow
+
+Command `workflows export` displays a workflow in Orchestrator's export format (YAML).
+With option `dependencies`, it saves instead a package (`.wkf`) that also contains the sub-workflows and remote nodes used by the workflow, in the folder given by option `to_folder` (default: current folder).
+Command `workflows import` creates a new workflow from such a file, and displays it, including its new `id`.
+The imported workflow is a draft: publish it with `workflows publish` before starting it.
+
+Example: Copy workflow `1234` to another Orchestrator, where the imported workflow gets `id` `5678`:
+
+```shell
+ascli orchestrator workflows export 1234 --out.file=my_workflow.yml
+ascli orchestrator workflows import my_workflow.yml --preset=other_orchestrator --out.fields=id
+ascli orchestrator workflows publish 5678 --preset=other_orchestrator
+```
+
+Example: Save workflow `1234` with its dependencies in folder `/tmp`, and import the package:
+
+```shell
+ascli orchestrator workflows export 1234 @json:'{"dependencies":true}' --to-folder=/tmp
+ascli orchestrator workflows import /tmp/Workflow_my_workflow_v100.wkf
+```
+
+Command `workflows import` always creates a new workflow.
+Command `workflows import_with_constraints` imports a workflow file already present on the Orchestrator host, either as a new workflow or as a new revision of an existing workflow (`add_as_revision`), and resolves conflicts with existing global templates, sub-workflows and remote nodes.
+Command `workflows import` stores each uploaded file in folder `<run_dir>/workflows/import/` of the Orchestrator host.
+
+Example: Add the file uploaded by a previous `workflows import` as a new revision of workflow `1234`, and publish it:
+
+```shell
+ascli orchestrator workflows import_with_constraints @json:'{"filename":"/opt/aspera/orchestrator/var/run/orchestrator/workflows/import/my_workflow.yml","add_as_revision":1234}'
+ascli orchestrator workflows publish 1234
+```
+
+#### Check a workflow before import
+
+Orchestrator does not validate the graph of a workflow on import: an invalid workflow is imported, then fails to publish, or at run time.
+Command `workflows check_import` checks a workflow file (`.yml`) or package (`.wkf`) with the rules of the workflow designer, and does not need access to Orchestrator:
+
+```shell
+ascli orchestrator workflows check_import my_workflow.yml
+```
+
+It displays one line per issue, or `no problem found`.
+An issue has these fields:
+
+| Field      | Description |
+|------------|-------------|
+| `severity` | `error`: the workflow will not import, publish or run correctly. `warning`: to check. |
+| `code`     | Stable identifier of the rule, for programs, for example `graph.step_orphan`. |
+| `file`     | File of the package where the issue is (only for a `.wkf`). |
+| `path`     | Where in the file, for example `graph/Step[Say hello]`. |
+| `message`  | Description. |
+
+Checked: format of the file (YAML, number of elements, plain format layout), attributes, `error_free`, action template keys, XML of the graph, `Start`, `End`, `Fail` and `Error` nodes, unique step names, step template, prerequisites, `Synch_factor`, steps that have no output or no prerequisite, references to outputs and parameters.
+
+With the specifications of plugins (see `plugins spec`), it also checks action templates and the inputs of steps, for the settings of each template:
+
+- plugin class name, attributes of the template, and their values (type, allowed values),
+- required inputs not mapped (`step.input_missing`),
+- inputs that the plugin does not have with this template, which Orchestrator ignores (`step.input_unknown`),
+- mapped outputs that the source step does not produce (`step.output_not_produced`).
+
+If the specifications cannot be read (option `plugin_specs`), these checks are skipped, with a warning (`plugins.specs_unavailable`).
+Not checked: the plugins enabled on the server (see `workflows find_constraints`).
+
+Command `workflows import` runs the same check, and logs the issues as warnings; it does not stop the import.
+Use `--log-level=warn` to see them.
+
+The check is done by `ascli`, behind one method that has the shape of a REST operation: the file goes in, a structure with `valid`, `file_name` and the list of `issues` comes out.
+It can be replaced by a call to Orchestrator if such an API becomes available.
+
+#### Resolve conflicts before import
+
+The web interface of Orchestrator lists the conflicts with existing sub-workflows, global templates and remote nodes, and the plugins to enable, and asks for a choice for each of them.
+Command `workflows find_constraints` does the same for a file present on the Orchestrator host (see `workflows import_with_constraints`):
+
+```shell
+ascli orchestrator workflows find_constraints /opt/aspera/orchestrator/var/run/orchestrator/workflows/import/my_workflow.yml
+ascli orchestrator workflows find_constraints /opt/aspera/orchestrator/var/run/orchestrator/workflows/import/my_workflow.yml 1234
+```
+
+The optional second argument is the id of the workflow that receives the file as a new revision.
+Each line is a conflict (`type`: `subwf_constraints`, `action_template_constraints`, `remote_node_constraints`), with its `name` and the possible `choices`, or a plugin to enable (`missing_plugins`).
+The `type` is the key to use in the argument of `import_with_constraints`.
+Orchestrator does not check that the file exists: a wrong path gives the same answer as a file without conflict.
+
+Orchestrator does not refuse an incomplete resolution: `workflows import_with_constraints` checks with `find_constraints` first, and refuses to import in these cases:
+
+- Plugins are not enabled and `auto_enable_missing_plugins` is not `true` (Orchestrator fails with an internal error).
+- A resolution is given for some conflicts of a type, but not all (Orchestrator imports the others as copies, without error).
+
+`auto_enable_missing_plugins` must be a boolean (`true` or `false`): Orchestrator takes the string `"false"` as true, and `ascli` refuses a string.
+
 ### Tested commands for `orchestrator`
 
 > [!NOTE]
@@ -9390,9 +9948,16 @@ ascli orchestrator workflows start 1234 @json:'{"Param":"world !"}' @json:'{"ste
 --auth_style=token workflow list
 health
 info
-monitors
+journal files journal --query=@json:'{"details":"false"}'
+monitors list node
+monitors snapshot
 plugins list
+plugins spec --select=@json:'{"category":"Triggers"}'
+plugins spec AmazonS3Operation --format=yaml
+plugins spec ascpclient inputs
 processes
+queues list
+workflow check_import orch_wf_check.yml
 workflow details my_workflow_id
 workflow export my_workflow_id
 workflow inputs my_workflow_id
@@ -9405,6 +9970,8 @@ workflow status ALL
 workflow status my_workflow_id
 workflow workorders my_workflow_id
 workflow workorders my_workflow_id --fields=id --query.max_results=1
+workflows development authoring toc
+workflows development templates customruby
 workorder cancel <id>
 workorder output <id>
 workorder reset <id>
@@ -9443,7 +10010,7 @@ If you already have these parameters, provide the following options to `ascli`:
 Example: Create a Default Configuration
 
 ```shell
-ascli config preset update <COS_PRESET_NAME> --bucket=mybucket --endpoint=https://s3.us-east.cloud-object-storage.appdomain.cloud --apikey=abcdefgh --crn=crn:v1:bluemix:public:iam-identity::a/xxxxxxx
+ascli config preset update <COS_PRESET_NAME> --bucket=mybucket --endpoint=https://s3.us-east.cloud-object-storage.appdomain.cloud --apikey=<API_KEY> --crn=<CRN>
 ascli config preset set default cos <COS_PRESET_NAME>
 ```
 
@@ -9470,7 +10037,7 @@ Or, using the IBM Cloud CLI:
 
 ```shell
 ibmcloud resource service-keys
-ibmcloud resource service-key _service_key_name_here_ --output JSON|jq '.[0].credentials'>$HOME/service_creds.json
+ibmcloud resource service-key <SERVICE_KEY_NAME> --output JSON|jq '.[0].credentials'>$HOME/service_creds.json
 ```
 
 > [!NOTE]
@@ -9914,7 +10481,7 @@ The preview generator supports rendering of those file categories:
 - `office`
 - `video`
 
-To avoid generation for some categories, specify a list using option `skip_types`.
+To avoid generation for some categories, specify a list using option `skip_types`, for example, `--skip-types=office` or `--skip-types=@list:,office,video`.
 
 Each category has a specific rendering method to produce the PNG thumbnail.
 
@@ -9980,9 +10547,9 @@ The `mcp` plugin starts a [Model Context Protocol (MCP)](https://modelcontextpro
 The server registers a single tool, `execute_ascli_command`, which executes any `ascli` command in-process and returns the result as text.
 
 > [!IMPORTANT]
-> The `mcp` and `rack` gems are required.
-> Check section [Installing Optional Gems](#installing-optional-gems).
-> Install them with the following command:
+> The `mcp` and `rack` gems are required, see section [Installing Optional Gems](#installing-optional-gems).
+
+Install them with the following command:
 
 ```shell
 gem install mcp rack
@@ -9993,28 +10560,29 @@ gem install mcp rack
 ```shell
 ascli mcp server
 ascli mcp server @: instructions="Use this server to manage Aspera transfers"
-ascli mcp server @: transport=http port=3000
+ascli mcp server @: transport=http
 ```
 
 ### `server` command options
 
-The `server` command accepts an optional [Hash](#extended-value-syntax) argument with the following keys:
+The `server` command accepts an optional [Hash](#extended-value-syntax) argument with the following keys.
+Keys of a transport are refused with the other transport.
 
 #### General
 
 | Key | Type | Default | Description |
-|-----|------|---------|-------------|
-| `transport` | `string` | `stdio` | Transport to use: `stdio` or `http` |
-| `description` | `string` | - | Short description of the server shown in the AI client UI |
-| `instructions` | `string` | - | Longer hint shown to the AI client describing what the server does and how to use it |
+|---|---|---|---|
+| `transport`        | `string` | `stdio` | Transport to use: `stdio` or `http` |
+| `description`      | `string` | - | Short description of the server shown in the AI client UI |
+| `instructions`     | `string` | - | Longer hint shown to the AI client describing what the server does and how to use it |
 | `protocol_version` | `string` | - | MCP protocol version to advertise, for example, `2024-11-05` |
 | `validate_tool_call_arguments` | `boolean` | `true` | Whether to validate tool arguments against the input schema |
-| `max_text_bytes` | `integer` | `100000` | Maximum byte size of the JSON text content for list results. Items are appended whole until the limit is reached; the full list is always available in `structuredContent` |
+| `max_text_bytes`   | `integer` | `100000` | Maximum byte size of the JSON text content for list results. Items are appended whole until the limit is reached; the full list is always available in `structuredContent` |
 
 #### `stdio` transport
 
 | Key | Type | Default | Description |
-|-----|------|---------|-------------|
+|-----|-----|-----|-----|
 | `max_line_bytes` | `integer` | 4194304 (4 MiB) | Maximum JSON frame size in bytes |
 
 > [!NOTE]
@@ -10025,9 +10593,17 @@ The `server` command accepts an optional [Hash](#extended-value-syntax) argument
 #### `http` transport (Streamable HTTP)
 
 | Key | Type | Default | Description |
-|-----|------|---------|-------------|
-| `port` | `integer` | `3000` | TCP port to listen on |
-| `bind` | `string` | `127.0.0.1` | Bind address |
+|-----|-----|-----|-----|
+| `url` | `string` | `http://127.0.0.1:3000` | Address and port the server listens on, without path, for example, `http://0.0.0.0:3000`. Use `https://` for TLS. |
+| `cert` | `string` | - | With `https://`: path to the TLS certificate file, PEM or PKCS12 (`.p12`, `.pfx`). Without `cert` and `key`, a self-signed certificate is generated. |
+| `key` | `string` | - | With `https://`: path to the PEM private key file, or the PKCS12 passphrase. |
+| `chain` | `string` | - | With `https://`: path to the PEM certificate chain file. |
+| `public_url` | `string` | from `url` | URL of the server for clients, used in OAuth metadata and in the URL of secret pages, for example, `https://your-server:3000`. Mandatory with `oauth` when the host of `url` is `0.0.0.0` or `::`. |
+| `auth_token` | `string` | - | Static Bearer token. If set, all MCP requests must carry `Authorization: Bearer <token>`, else HTTP 401. Cannot be empty. It is also the access code asked on secret pages, and on the consent page with `oauth`. Generate it with `openssl rand -hex 32`. |
+| `auth_token_min_bits` | `integer` | `80` | Minimum estimated strength of `auth_token`, in bits: a weak token is refused at startup. The estimate uses the optional gem `zxcvbn` if installed, else a built-in estimate. `0` disables the check. |
+| `oauth` | `boolean` | `false` | Enable OAuth 2.0 PKCE flow with dynamic client registration. When `true`, clients register automatically and users authenticate via a browser consent page. |
+| `oauth_access_token_ttl` | `integer` | `3600` | OAuth access token lifetime in seconds. |
+| `oauth_refresh_token_ttl` | `integer` | `2592000` | OAuth refresh token lifetime in seconds (30 days). |
 | `stateless` | `boolean` | `false` | Enable stateless mode |
 | `allowed_origins` | `Array<string>` | - | List of allowed origins |
 | `allowed_hosts` | `Array<string>` | - | List of allowed hostnames |
@@ -10035,8 +10611,98 @@ The `server` command accepts an optional [Hash](#extended-value-syntax) argument
 | `max_sessions` | `integer` | - | Maximum number of concurrent sessions |
 
 > [!NOTE]
-> **HTTP transport discovery endpoint** - When using `http` transport, the server exposes a `GET /` endpoint that returns a JSON object with `name`, `version`, and `description` fields.
-> AI clients that support this convention (such as Bob) automatically read the description from this endpoint and display it in their MCP server list without any manual configuration.
+> `port` and `bind` are deprecated: use `url`, for example, `url=http://0.0.0.0:8080` instead of `port=8080 bind=0.0.0.0`.
+
+### Security
+
+> [!WARNING]
+> The tool executes any `ascli` command with the credentials and presets of the user running the server.
+> When the host of `url` or `public_url` is not a loopback address, `auth_token` is **mandatory**, also with `oauth`: the server refuses to start without it.
+
+With the `http` transport:
+
+- With `oauth`, the consent page asks for `auth_token` as access code, else anyone reaching the server could approve its own client.
+  It shows where the authorization is sent (origin of `redirect_uri`): allow only if it is the expected AI client, for example `http://127.0.0.1:<port>`.
+- For local-only deployments (hosts of `url` and `public_url` are loopback: `localhost`, `127.0.0.0/8`, `::1`), `auth_token` and `oauth` are optional but recommended.
+  Without `auth_token`, the consent page only asks to click **Allow**.
+- `auth_token` and `oauth` can coexist: a request is accepted if it carries a valid static token **or** a valid OAuth access token.
+- A weak `auth_token` is refused at startup (see `auth_token_min_bits`): generate it with `openssl rand -hex 32`.
+- On a network, use `https://` in `url` (or a reverse proxy with TLS): with `http://`, the token is sent in clear.
+- `allowed_hosts` and `allowed_origins` protect against DNS rebinding but do not authenticate clients.
+  They apply to all endpoints, also OAuth and secret pages, which also accept the origin of `public_url` (for a reverse proxy that changes header `Host`).
+
+With both transports:
+
+- Extended value `@stdin:` is refused.
+- `@secret:` is entered by the user on a web page, see [Secrets entered in a web page](#secrets-entered-in-a-web-page).
+- Secrets are hidden in responses, also a value shorter than 8 characters as a word in a text (for example, a short password in an error message).
+- The [Security Level](#security-level) is `high` by default: `@ruby:`, `@file:`, `@uri:`, and `@env:` are refused, and a secret must be the whole value: hidden in results, it cannot be processed by another extended value.
+  It applies to commands sent by the client, and to presets, because the client can modify presets.
+  Commands sent by the client cannot change option `security`.
+
+To use another level, set option `security` when starting the server, for example:
+
+```shell
+ascli mcp server --security.level=medium --security.allowed_paths.0=$HOME/.aspera/ascli/my_private_key
+```
+
+> [!NOTE]
+> A level set by option also applies to the parameters of the `server` command: for example, `auth_token=@env:MCP_TOKEN` requires level `low`.
+> Without option `security`, the parameters of the `server` command are not restricted.
+>
+> A preset created by `aoc wizard` or `faspex5 wizard` reads the private key with `@file:`.
+> With level `high`, either store the key in the preset (`ascli config preset set <AOC_ORG> private_key @file:<PATH>`, without `@val:`), or use level `medium` with the key in `allowed_paths`.
+
+### HTTP endpoints
+
+With the `http` transport, the server exposes the following endpoints:
+
+| Endpoint | Description |
+|---|---|
+| `GET /` | Discovery: JSON object with `name`, `version`, and `description` of the server, no authentication |
+| `POST`, `GET`, `DELETE` `/mcp` | MCP endpoint (Streamable HTTP), the URL to configure in the AI client. Requires `auth_token` or an OAuth access token, if configured |
+| `GET`, `POST` `/secret/<id>` | Secret pages, see [Secrets entered in a web page](#secrets-entered-in-a-web-page) |
+| `GET /.well-known/oauth-authorization-server` | With `oauth`: OAuth discovery metadata (RFC 8414) |
+| `POST /oauth/register` | With `oauth`: Dynamic client registration (RFC 7591) — any client may register and receive a `client_id`. At most 100 clients are kept: beyond, the least recently used is removed. At most 10 `redirect_uris`, absolute and without fragment |
+| `GET /oauth/authorize` | With `oauth`: Consent page shown to the user in a browser, with the `client_id` and where the code is sent (origin of `redirect_uri`) |
+| `POST /oauth/authorize` | With `oauth`: Processes the user decision (allow/deny) and issues an authorization code |
+| `POST /oauth/token` | With `oauth`: Exchanges the code for tokens (`authorization_code`) or renews them (`refresh_token`) |
+
+AI clients that support the discovery endpoint (such as Bob) read the description from it and display it in their MCP server list without any manual configuration.
+
+AI clients that support the MCP Authorization spec (such as Bob) detect the OAuth endpoints automatically via the `WWW-Authenticate` header returned on HTTP 401, register dynamically, and launch the browser-based login flow without any extra configuration.
+
+### Secrets entered in a web page
+
+[Extended Value](#extended-value-syntax) `@secret:[name]` asks for a secret, for example, a password.
+In MCP server mode, there is no terminal: the user enters the secret on a web page of the server instead, following the [URL mode elicitation](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation) of the MCP protocol.
+The secret goes from the browser to the MCP server only: it is not sent to the MCP client or the AI model, and it is hidden in the results of the command.
+
+`@secret:` can be used in commands sent by the AI client, for example, `--password=@secret:password`, and in presets of the user running the server.
+
+For a command that needs a secret:
+
+1. The server replies to the tool call with the URL of a secret page.
+1. The MCP client shows the URL and asks the user for consent to open it in a browser.
+1. The user enters the secret on the page and submits it, or cancels.
+1. The MCP client calls the tool again, and the server executes the command with the secret.
+
+If the command needs several secrets, these steps are repeated for each secret.
+
+The secret page is served:
+
+- With the `http` transport: by the MCP server, at `<public_url>/secret/<id>`.
+  If `auth_token` is set, the page also asks for it as access code.
+  Set `public_url` if the browser does not reach the server on the address of `url`.
+- With the `stdio` transport: by a local web server on `http://127.0.0.1` with a random port, started on first use.
+
+A secret request expires after 10 minutes.
+Secrets are kept in memory only, until the command completes.
+
+> [!NOTE]
+> The MCP client must support URL mode elicitation (capability `elicitation.url`), else the command fails with an error.
+> Protocol `2026-07-28` (result `input_required`) and `2025-11-25` (request `elicitation/create` from the server) are supported.
+> With protocol `2025-11-25`, the `http` transport must not be `stateless`.
 
 ### Examples
 
@@ -10049,7 +10715,13 @@ ascli mcp server
 Start an MCP server over HTTP on port 8080:
 
 ```shell
-ascli mcp server @: transport=http port=8080 bind=0.0.0.0
+ascli mcp server @: transport=http url=http://0.0.0.0:8080 auth_token=@env:MCP_TOKEN
+```
+
+Start an MCP server over HTTPS, with a certificate:
+
+```shell
+ascli mcp server @: transport=http url=https://0.0.0.0:8443 cert=<PATH>/cert.pem key=<PATH>/key.pem auth_token=@env:MCP_TOKEN
 ```
 
 Start with custom instructions and a specific protocol version:
@@ -10058,14 +10730,22 @@ Start with custom instructions and a specific protocol version:
 ascli mcp server @: instructions="Aspera transfer automation" protocol_version=2024-11-05
 ```
 
+Start an MCP server with OAuth 2.0 PKCE authentication (for AI clients such as Bob that support the MCP Authorization spec):
+
+```shell
+ascli mcp server @: transport=http url=http://0.0.0.0:3000 public_url=http://your-server:3000 oauth=true auth_token=@env:MCP_TOKEN
+```
+
 ### MCP client configuration
 
 #### Streamable HTTP transport
 
+##### Local server (no authentication required)
+
 Start the server in a separate terminal first:
 
 ```shell
-ascli mcp server @: transport=http port=3000
+ascli mcp server @: transport=http
 ```
 
 Then register it in the AI client's MCP configuration file.
@@ -10096,6 +10776,77 @@ For other clients (Claude Desktop, VS Code, and so on):
 }
 ```
 
+##### Remote server with static token
+
+When the server is exposed on a non-local address, `auth_token` is required.
+
+**Option A: static Bearer token** - suitable for all MCP clients.
+Set the token in the environment and start the server:
+
+```shell
+export MCP_TOKEN=$(openssl rand -hex 32)
+ascli mcp server @: transport=http url=http://0.0.0.0:3000 auth_token=@env:MCP_TOKEN
+```
+
+For [**IBM Bob**](https://bob.ibm.com/docs/ide/configuration/mcp/mcp-in-bob), pass the same token in the `Authorization` header:
+
+```json
+{
+  "mcpServers": {
+    "ascli": {
+      "type": "streamable-http",
+      "url": "http://your-server:3000/mcp",
+      "headers": {
+        "Authorization": "Bearer <TOKEN>"
+      }
+    }
+  }
+}
+```
+
+For other clients (Claude Desktop, VS Code, and so on):
+
+```json
+{
+  "mcpServers": {
+    "ascli": {
+      "type": "http",
+      "url": "http://your-server:3000/mcp",
+      "headers": {
+        "Authorization": "Bearer <TOKEN>"
+      }
+    }
+  }
+}
+```
+
+##### Remote server with OAuth 2.0 PKCE
+
+**Option B: OAuth 2.0 PKCE flow** - for AI clients that support the MCP Authorization spec (such as Bob).
+No token to configure in the client: the client registers dynamically and opens a browser window for user consent on first connection.
+The consent page asks for the access code: the value of `auth_token`.
+
+Start the server with OAuth enabled:
+
+```shell
+ascli mcp server @: transport=http url=http://0.0.0.0:3000 public_url=http://your-server:3000 oauth=true auth_token=@env:MCP_TOKEN
+```
+
+For [**IBM Bob**](https://bob.ibm.com/docs/ide/configuration/mcp/mcp-in-bob), register the URL with no extra configuration:
+
+```json
+{
+  "mcpServers": {
+    "ascli": {
+      "type": "streamable-http",
+      "url": "http://your-server:3000/mcp"
+    }
+  }
+}
+```
+
+Bob detects the OAuth endpoints via the `WWW-Authenticate` header on the first HTTP 401 response and triggers the browser-based login flow automatically.
+
 > [!NOTE]
 > With `http` transport, the client connects to a running server process.
 > The server must be started and kept running independently before the AI client tries to connect.
@@ -10174,18 +10925,14 @@ server @: transport=http port=13777
 
 ### End-to-end AI testing
 
-The file [`docs/test-mcp-with-ai.md`](test-mcp-with-ai.md) contains a step-by-step test
-procedure for validating the MCP server with a live AI assistant (Bob, Claude Desktop,
-VS Code Copilot, or any MCP-capable client).
-It covers tool visibility, self-discovery, Hash schema introspection, option listing,
-documentation retrieval, live transfer tasks, truncation handling, error handling, and
-credential safety.
+The file [`docs/test-mcp-with-ai.md`](test-mcp-with-ai.md) contains a step-by-step test procedure for validating the MCP server with a live AI assistant (Bob, Claude Desktop, VS Code Copilot, or any MCP-capable client).
+It covers tool visibility, self-discovery, Hash schema introspection, option listing, documentation retrieval, live transfer tasks, truncation handling, error handling, and credential safety.
 
 ### MCP usage patterns for AI
 
 > [!TIP]
-> This section is for AI assistants using the MCP server. Follow these patterns to avoid
-> common first-call failures and unnecessary retries.
+> This section is for AI assistants using the MCP server.
+> Follow these patterns to avoid common first-call failures and unnecessary retries.
 
 #### Session bootstrap
 
@@ -10196,8 +10943,7 @@ Always start a session with two discovery calls before doing anything else:
 ["config", "preset", "show", "default"]
 ```
 
-The second call returns the mapping from `plugin` to `preset_name` so you know which credentials
-are active for each plugin.
+The second call returns the mapping from `plugin` to `preset_name` so you know which credentials are active for each plugin.
 
 #### Command discovery
 
@@ -10206,8 +10952,7 @@ Add command words to list only the commands under that path, e.g. `["config", "c
 A line ending with `<command...>` provides the commands of another plugin, given by `(see: ...)`.
 Use option `--expand-mounts=yes` to list them in place.
 Omit `<plugin>` to list the commands of all plugins (much larger result).
-Never guess command names from training data: names like `shared_folders` vs
-`shared_inboxes` are easily confused.
+Never guess command names from training data: names like `shared_folders` vs `shared_inboxes` are easily confused.
 
 #### Schema introspection for Hash arguments
 
@@ -10217,13 +10962,22 @@ Whenever a command syntax shows a Hash argument (e.g. `<account:Hash>`), call `h
 ["<plugin>", "<cmd>", ..., "help"]
 ```
 
-This returns a table of field names, types, and descriptions. Never infer field names from
-server error messages.
+This returns a table of field names, types, and descriptions.
+Never infer field names from server error messages.
+
+#### Secrets
+
+To use a secret the user did not provide (password, passphrase), pass `@secret:<name>` as value.
+The user enters it on a web page and you never see it: prefer it to asking for the secret in the conversation.
+
+```json
+["server", "browse", "/", "--url=ssh://host:33001", "--username=user", "--password=@secret:password"]
+```
 
 #### Async transfers and cross-call status tracking
 
-The `direct` agent keeps transfer state in-memory. A job started in one MCP call **cannot**
-be monitored in a subsequent call: the in-memory agent is gone between calls.
+The `direct` agent keeps transfer state in-memory.
+A job started in one MCP call **cannot** be monitored in a subsequent call: the in-memory agent is gone between calls.
 
 Use the `transferd` agent when you need to check transfer status in a later call:
 
@@ -10235,8 +10989,8 @@ The `desktop` agent is also unaffected because it runs in an external process.
 
 #### Workspace context for AoC
 
-`aoc files` and `aoc packages` commands require a workspace context. If no default
-workspace is configured in the preset, always add `--workspace=NAME`:
+`aoc files` and `aoc packages` commands require a workspace context.
+If no default workspace is configured in the preset, always add `--workspace=NAME`:
 
 ```json
 ["aoc", "files", "ls", "/", "--workspace=MyWorkspace"]
@@ -10247,7 +11001,8 @@ List available workspaces with `["aoc", "user", "workspaces", "list"]`.
 #### Admin operations and privilege checks
 
 Before calling any `admin` sub-command, verify that the active preset has admin rights.
-`access_denied` typically means the wrong preset is active, not a syntax error. Check with:
+`access_denied` typically means the wrong preset is active, not a syntax error.
+Check with:
 
 ```json
 ["config", "preset", "show", "<preset_name>"]
@@ -10395,14 +11150,14 @@ ascli config sync spec
 | `exclude_dirs_older_than.absolute` | `String` | UTC timestamp. Empty value for disabled. |
 | `exclude_dirs_older_than.relative_seconds` | `Integer` | Relative to async start time. `-1` for disabled.<br/>Default: `-1`. |
 | `exclude_dirs_older_than` | `Hash` | Don't scan directories with a recursive modified time older than absolute or async start time - relative_seconds |
-| `filters[].rule` | `String` | The rule for the filter.<br/>Allowed values: `include`, `exclude`, `include_from`, `exclude_from`. |
-| `filters[].value` | `String` | On include or exclude, the filter's pattern. On include_from or exclude_from, the path containing filter specifications |
+| `filters[].rule` | `String` | The rule for the filter.<br/>Required.<br/>Allowed values: `include`, `exclude`, `include_from`, `exclude_from`. |
+| `filters[].value` | `String` | On include or exclude, the filter's pattern. On include_from or exclude_from, the path containing filter specifications<br/>Required. |
 | `filters` | `Array[Hash]` | The filters allow to further specify which files have to be excluded and included from the transfer list. Each filter is defined by a rule and a value. Order of filters matters |
 | `ignore_delete` | `Bool` | Do not copy removals to the peer.<br/>Default: `false`.<br/>(`--ignore-delete`) |
-| `ignore_mode` | `Bool` | Source files that have had their mode changed after the initial. transfer will not update the destination file mode.<br/>Default: `false`.<br/>(`--ignore-mode`) |
-| `ignore_remote_host_sync_name` | `Bool` | Do not check that the remote host being used for the current. transfer matches the host used when the local database was created<br/>Default: `false`. |
+| `ignore_mode` | `Bool` | Source files that have had their mode changed after the initial transfer will not update the destination file mode.<br/>Default: `false`.<br/>(`--ignore-mode`) |
+| `ignore_remote_host_sync_name` | `Bool` | Do not check that the remote host being used for the current transfer matches the host used when the local database was created<br/>Default: `false`. |
 | `local.pass` | `String` | Authenticate the local async with the specified password. |
-| `local.path` | `String` | The directory to be synchronized on the local host.<br/>(`--local-dir={string}`)(-d) |
+| `local.path` | `String` | The directory to be synchronized on the local host.<br/>Required.<br/>(`--local-dir={string}`)(-d) |
 | `local_apply_docroot` | `Bool` | Prepend the docroot to the directory on the local host.<br/>Default: `false`.<br/>(`--apply-local-docroot`) |
 | `local_checksum_threads` | `Integer` | Maximum number of threads to do checksum on the local host. Value must be between 1 and 99.<br/>Default: `4`.<br/>(`--local-checksum-threads={integer}`) |
 | `local_db_dir` | `String` | Use the specified database directory on the local host. Default is `.private-asp` at the root level of the synchronized directory.<br/>(`--local-db-dir={string}`)(-b) |
@@ -10414,19 +11169,19 @@ ascli config sync spec
 | `local_move_cache_timeout_seconds` | `Integer` | Delay in seconds before aborting moving a file from local cache to final destination. `-1` for disabled.<br/>Default: `-1`.<br/>(`--local-move-cache-timeout={integer}`) |
 | `local_preserve_acls` | `String` | Preserve access control lists on the local host.<br/>Allowed values: `native`, `metafile`, `none`.<br/>Default: `none`.<br/>(`--preserve-acls={enum}`) |
 | `local_preserve_xattrs` | `String` | Preserve extended attributes on the local.<br/>Allowed values: `native`, `metafile`, `none`.<br/>Default: `none`.<br/>(`--preserve-xattrs={enum}`) |
-| `local_scan_interval_milliseconds` | `Integer` | Enable periodic scans on the local host during a continuous sync. `-1` for disabled<br/>Default: `-1`.<br/>(`--scan-interval={integer}`) |
+| `local_scan_interval_milliseconds` | `Integer` | Enable periodic scans on the local host during a continuous sync. `-1` for disabled. On the command line, the value is a duration, e.g. `1h 30m`, `2s500ms`, `5:30`, `1d 02:00:00.250`. A plain number is in seconds. Stored in milliseconds.<br/>Default: `-1`.<br/>(`--scan-interval={integer}`) |
 | `local_scan_threads` | `Integer` | Number of directory scanning threads on the local host. Value must be between 1 and 99<br/>Default: `1`.<br/>(`--scan-threads={integer}`) |
 | `local_stat_cache_size` | `Integer` | Set stat cache size on the local host. 0 for disabled.<br/>Default: `0`. |
-| `local` | `Hash` | &nbsp; |
+| `local` | `Hash` | Required. |
 | `log.level` | `String` | Use the specified log level.<br/>Allowed values: `log`, `dbg1`, `dbg2`.<br/>Default: `log`.<br/>(special:`-D`) |
 | `log.local_dir` | `String` | Use the specified logging directory on the local host.<br/>(`--alt-logdir={string}`)(-L) |
 | `log.remote_dir` | `String` | Use the specified logging directory on the remote host.<br/>(`--remote-logdir={string}`)(-R) |
-| `log` | `Hash` | &nbsp; |
+| `log` | `Hash` |  |
 | `manifest_path` | `String` | A directory path where ascp will create manifest TEXT files (passed to ascp as --file-manifest-path) |
 | `mirror` | `Bool` | Force the pulling side to be exactly like the pushing side, removing files on the destination that don't exist on the source and resending source files that don't have an exact match on the destination. Cannot be used in bi-directional mode.<br/>Default: `false`.<br/>(`--mirror`) |
 | `mode` | `String` | Specify whether async runs continuously or not. In `one_time` mode, async stops after the first full synchronization. `continuous` supported only if the source is Windows or Linux.<br/>Allowed values: `one_time`, `continuous`.<br/>Default: `one_time`.<br/>(special:`--continuous`)(-C) |
 | `monitor_buffer_size` | `Integer` | Bytes to allocate for the change monitor buffer. Applies to any Windows machine on either side. `-1` to use the computed value.<br/>Default: `-1`. |
-| `name` | `String` | Name of the synchronization pair.<br/>(`--name={string}`)(-N) |
+| `name` | `String` | Name of the synchronization pair.<br/>Required.<br/>(`--name={string}`)(-N) |
 | `no_log` | `String` | Suppress log messages for ITEM. The only currently supported ITEM is 'stats', which suppresses both STATS and PROG log messages.<br/>(`--no-log={string}`) |
 | `no_preserve_root_attrs` | `Bool` | Disable the preservation of attributes on the Sync root.<br/>Default: `false`.<br/>(`--no-preserve-root-attrs`) |
 | `no_scan` | `Bool` | Skip initial scanning.<br/>Default: `false`.<br/>(`--no-scan`) |
@@ -10444,20 +11199,20 @@ ascli config sync spec
 | `quiet` | `Bool` | Disable progress display.<br/>Default: `true`.<br/>(`--quiet`)(-q) |
 | `remote.connect_mode` | `String` | Define how to connect to the remote.<br/>Allowed values: `ssh`, `ws`.<br/>Default: `ssh`.<br/>(special:`--ws-connect`) |
 | `remote.fingerprint` | `String` | Check it against server SSH host key fingerprint. |
-| `remote.host` | `String` | Use the specified host name or address of the remote host.<br/>(`--host={string}`) |
+| `remote.host` | `String` | Use the specified host name or address of the remote host.<br/>Required.<br/>(`--host={string}`) |
 | `remote.pass` | `String` | Authenticate the transfer with the specified password.<br/>(`--pass={string}`)(-w) |
-| `remote.path` | `String` | Synchronize the specified directory on the remote host.<br/>(`--remote-dir={string}`)(-r) |
+| `remote.path` | `String` | Synchronize the specified directory on the remote host.<br/>Required.<br/>(`--remote-dir={string}`)(-r) |
 | `remote.port` | `Integer` | Use the specified TCP port for SSH. Used when connect_mode is `ssh`<br/>Default: `22`.<br/>(`--tcp-port={integer}`)(-P) |
 | `remote.private_key_paths` | `Array[String]` | Authenticate with the specified SSH private key file.<br/>(`--private-key-path={array}`)(-i) |
 | `remote.proxy.host` | `String` | Use the specified host name or address of the proxy. |
 | `remote.proxy.pass` | `String` | Authenticate to the proxy with the specified password. |
-| `remote.proxy.port` | `Integer` | Use the specified port, default is 9091 for dnat, 9092. for dnats |
+| `remote.proxy.port` | `Integer` | Use the specified port. Default is 9091 for dnat, 9092 for dnats. |
 | `remote.proxy.protocol` | `String` | The protocol to be used.<br/>Allowed values: `none`, `dnat`, `dnats`.<br/>Default: `none`. |
 | `remote.proxy.user` | `String` | Authenticate to the proxy with the specified username. |
 | `remote.proxy` | `Hash` | Specify the address of the Aspera high-speed proxy server.<br/>(special:`--proxy={object}`) |
 | `remote.token_node_user` | `String` | Node API user identity associated with the token. Required for node user bearer tokens |
 | `remote.token` | `String` | Token string passed to server's authentication service. |
-| `remote.user` | `String` | Authenticate the transfer with the specified username.<br/>(`--user={string}`) |
+| `remote.user` | `String` | Authenticate the transfer with the specified username.<br/>Required.<br/>(`--user={string}`) |
 | `remote.ws_port` | `Integer` | Use the specified port for Websocket. Used when connect_mode is `ws`.<br/>Default: `9093`. |
 | `remote_checksum_threads` | `Integer` | Maximum number of threads to do checksum on the remote host. Value must be between 1 and 99<br/>Default: `4`.<br/>(`--remote-checksum-threads={integer}`) |
 | `remote_db_dir` | `String` | Use the specified database directory on the remote host. Default is `.private-asp` at the root level of the synchronized directory.<br/>(`--remote-db-dir={string}`)(-B) |
@@ -10469,10 +11224,10 @@ ascli config sync spec
 | `remote_move_cache_timeout_seconds` | `Integer` | Delay in seconds before aborting moving a file from remote cache to final destination. `-1` for disabled.<br/>Default: `-1`.<br/>(`--remote-move-cache-timeout={integer}`) |
 | `remote_preserve_acls` | `String` | Preserve access control lists on the remote host. If not specified, the default behavior is to use the same storage mode as specified by `preserve_acls`.<br/>Allowed values: `native`, `metafile`, `none`.<br/>(`--remote-preserve-acls={enum}`) |
 | `remote_preserve_xattrs` | `String` | Preserve extended attributes on the remote host. If not specified, the default behavior is to use the same storage mode as specified by `preserve_xattrs`.<br/>Allowed values: `native`, `metafile`, `none`.<br/>(`--remote-preserve-xattrs={enum}`) |
-| `remote_scan_interval_milliseconds` | `Integer` | Enable periodic scans on the remote host. `-1` for disabled.<br/>Default: `-1`.<br/>(special:`--remote-scan-interval={integer}`) |
+| `remote_scan_interval_milliseconds` | `Integer` | Enable periodic scans on the remote host. `-1` for disabled. On the command line, the value is a duration, e.g. `1h 30m`, `2s500ms`, `5:30`, `1d 02:00:00.250`. A plain number is in seconds. Stored in milliseconds.<br/>Default: `-1`.<br/>(special:`--remote-scan-interval={integer}`) |
 | `remote_scan_threads` | `Integer` | Number of directory scanning threads on the remote host. Value must be between 1 and 99.<br/>Default: `1`.<br/>(`--remote-scan-threads={integer}`) |
 | `remote_stat_cache_size` | `Integer` | Set stat cache size on the remote host. 0 for disabled.<br/>Default: `0`. |
-| `remote` | `Hash` | &nbsp; |
+| `remote` | `Hash` | Required. |
 | `remove_after_transfer` | `Bool` | Remove source files after they are successfully synchronized.<br/>Default: `false`.<br/>(`--remove-after-transfer`) |
 | `reset` | `Bool` | Clear the snapshot database and rescan the synchronized directories and files to create a fresh snapshot<br/>Default: `false`.<br/>(`--reset`)(-x) |
 | `resume.enabled` | `Bool` | Enable the possibility of resuming individual file transfers between async sessions.<br/>Default: `false`. |
@@ -10480,7 +11235,7 @@ ascli config sync spec
 | `resume.min_size` | `Integer` | This field specifies the minimum size of files that will be allowed to resume.<br/>Default: `1048576`.<br/>(`--support-resume={integer}`) |
 | `resume_scan` | `Bool` | Resume the scan from where the previous execution left off.<br/>Default: `false`.<br/>(`--resume-scan`) |
 | `resume` | `Hash` | Partial transfers may exist if communication disruptions caused the underlying ascp processes to terminate early. Note that transfer resumption can only happen if the `reset` option is disabled. If an async session starts with `reset` enabled and resume enabled, transfers interrupted during that session will be resumable, but only if async is then restarted with 'reset' disabled. |
-| `scan_dir_rename` | `Bool` | Enable the detection of renamed directories and files compared. to the previous scan, based on matching inodes<br/>Default: `false`.<br/>(`--scan-dir-rename`) |
+| `scan_dir_rename` | `Bool` | Enable the detection of renamed directories and files compared to the previous scan, based on matching inodes<br/>Default: `false`.<br/>(`--scan-dir-rename`) |
 | `scan_file_rename` | `Bool` | Enable the detection of renamed files compared to the previous scan, based on matching inodes.<br/>Default: `false`.<br/>(`--scan-file-rename`) |
 | `scan_intensity` | `String` | Scan at the set intensity. `vlow` minimizes system activity. `vhigh` maximizes system activity by continuously scanning files without rest.<br/>Allowed values: `vlow`, `low`, `medium`, `high`, `vhigh`.<br/>Default: `medium`.<br/>(`--scan-intensity={enum}`)(-H) |
 | `sharing_retry_max` | `Integer` | Retry synchronizations up to the specified maximum number after a sharing violation.<br/>Default: `3`.<br/>(`--sharing-retry-max={integer}`) |
@@ -10488,7 +11243,7 @@ ascli config sync spec
 | `symbolic_links` | `String` | Handle symbolic links with the specified method. Default is `skip` on windows, `copy` otherwise.<br/>Allowed values: `copy`, `skip`, `follow`.<br/>(`--symbolic-links={enum}`)(-n) |
 | `tags` | `Hash` | User-defined metadata tags.<br/>(special:`--tags64={object}`) |
 | `transfer_threads[].size` | `Integer` | Upper limit. `-1` for infinity.<br/>Default: `-1`. |
-| `transfer_threads[].threads` | `Integer` | The number of threads. |
+| `transfer_threads[].threads` | `Integer` | The number of threads.<br/>Required. |
 | `transfer_threads` | `Array[Hash]` | Use the specified number of dedicated transfer threads to process files smaller or equal to the specified size<br/>(special:`--transfer-threads={array}`) |
 | `transport.cipher` | `String` | Specify encryption algorithm for file data.<br/>Allowed values: `none`, `aes128`, `aes192`, `aes256`, `aes128cfb`, `aes192cfb`, `aes256cfb`, `aes128gcm`, `aes192gcm`, `aes256gcm`.<br/>Default: `aes128`.<br/>(`--cipher={enum}`)(-c) |
 | `transport.compression` | `String` | Compress a file before transfer using the specified MODE.<br/>Allowed values: `none`, `zlib`.<br/>Default: `none`.<br/>(`--compression={enum}`) |
@@ -10498,10 +11253,10 @@ ascli config sync spec
 | `transport.raw_options` | `Array[String]` | Pass arbitrary arguments to `ascp`.<br/>(special:`--raw-options={array}`) |
 | `transport.read_block_size` | `Integer` | Use the specified block size (in bytes) for reading. Default is determined by `aspera.conf`.<br/>(`--read-block-size={integer}`)(-g) |
 | `transport.rexmsg_size` | `Integer` | Use the specified size (in bytes) for a retransmission request. Default is determined by `aspera.conf`.<br/>(`--rexmsg-size={integer}`)(-X) |
-| `transport.target_rate` | `Integer` | Transfer no faster than the specified rate (in bps).<br/>Default: `10000000`.<br/>(`--target-rate={integer}`)(-l) |
+| `transport.target_rate` | `Integer` | Transfer no faster than the specified rate (in bps). A string with suffix `k`, `m` or `g` is converted to bps by `ascli` (e.g. `100m`).<br/>Default: `10000000`.<br/>(`--target-rate={integer}`)(-l) |
 | `transport.udp_port` | `Integer` | Use the specified UDP port for FASP data transfer.<br/>Default: `33001`.<br/>(`--udp-port={integer}`)(-O) |
 | `transport.write_block_size` | `Integer` | Use the specified block size (in bytes) for writing. Default is determined by `aspera.conf`.<br/>(`--write-block-size={integer}`)(-G) |
-| `transport` | `Hash` | &nbsp; |
+| `transport` | `Hash` |  |
 | `watchd.datastore` | `String` | Specify the type of datastore, `none` for disabled.<br/>Allowed values: `none`, `redis`, `scalekv`.<br/>Default: `none`. |
 | `watchd.domain` | `String` | Specify the domain. Default is the current username. |
 | `watchd.host` | `String` | Use the specified host name or address to connect to the datastore. |
@@ -10839,7 +11594,7 @@ The `smtp` option is a `Hash` ([Extended Value](#extended-value-syntax)) with th
 | `from_name` | `String` | Display name of the sender. Defaults to the local-part of `from_email`.<br/>Example: `John Wayne`. |
 | `password` | `String` | Password for the above `username`.<br/>Example: `my_password`. |
 | `port` | `Integer` | Port for the SMTP service.<br/>Defaults: `587` (TLS), `465` (SSL), `25` (plain).<br/>Example: `587`. |
-| `server` | `String` | SMTP server address.<br/>Example: `smtp.gmail.com`. |
+| `server` | `String` | SMTP server address.<br/>Required.<br/>Example: `smtp.gmail.com`. |
 | `ssl` | `Bool` | Enable `TLS/SSL` (port 465).<br/>Default: `false`. |
 | `tls` | `Bool` | Enable `STARTTLS` (port 587).<br/>Default: `true`. |
 | `username` | `String` | User to authenticate on the SMTP server. Leave empty for open (unauthenticated) relay.<br/>Example: `john@example.com`. |
@@ -11024,7 +11779,7 @@ USAGE
        {"type":"START","source":"xx","destination":"yy"}
        {"type":"DONE"}
 EXAMPLES
-    asession @json:'{"spec":{"remote_host":"demo.asperasoft.com","remote_user":"asperaweb","ssh_port":33001,"remote_password":"demoaspera","direction":"receive","destination_root":"./test.dir","paths":[{"source":"/aspera-test-dir-tiny/200KB.1"}]}}'
+    asession @json:'{"spec":{"remote_host":"demo.asperasoft.com","remote_user":"asperaweb","ssh_port":33001,"remote_password":"<PASSWORD>","direction":"receive","destination_root":"./test.dir","paths":[{"source":"/aspera-test-dir-tiny/200KB.1"}]}}'
     echo '{"spec":{"remote_host":...}}'|asession @json:@stdin:
 
 ```