bt-cli 0.4.60__tar.gz → 0.4.62__tar.gz

{bt_cli-0.4.60 → bt_cli-0.4.62}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.60**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.62**
 
 ## Setup
 
@@ -86,6 +86,7 @@ PASSWORD=$(bt pws quick checkout -s server -a admin --raw)
 - **PRA `export jump-items` defaults to a REAL export** (all types: shell/rdp/vnc/web/tunnel, full type-specific columns) that round-trips through `import jump-items`; `--sample` gives the blank template. `bt pra jump-items web create` exists.
 - **PRA vault `associate -t protocol_tunnel` is MSSQL-only** (live-verified): server rejects psql/mysql/tcp/k8s with "Only SQL Server Tunnels are allowed" — use tag/criteria association for those. **TCP `--ports` needs listen;destination *pairs*** (even count; odd → 400 "number of parameters is invalid"). Jumpoint listing is `bt pra jumpoints list` (plural).
 - **PWS `/Sessions` ignores `limit`/`offset`** and returns the full session *history* every call — never `paginate()` it (infinite loop); `list_sessions` does a single GET and `bt pws sessions list` caps display client-side. `Status` codes (live-confirmed): 0=Not started, 1=Active, 2=Completed, 5=Locked, 7=Terminated; `--active`=Status 1. Active sessions have `EndTime`==`StartTime` (placeholder, not null) — identify live sessions by Status, not timestamps. **`terminate` = `POST /Sessions/{id}/Terminate`** (symmetric w/ `/Lock`); `/Sessions/{id}` is GET/PUT only (DELETE → 405).
+- **PWS SSH/RDP session establishment = `POST /Requests/{id}/Sessions`** (`{"SessionType":"SSH"|"RDP"}`), NOT `POST /Sessions` (collection is GET-only → 405). Create the request with matching `AccessType` first. **SSH** returns a ready `Command` (`ssh -p 4422 <ticket>@<proxyhost>`) + `Link`; **RDP** returns `Host`/`Port`/`Ticket` only — the `.rdp` is built client-side (`full address` = proxy `Host:Port`, `username` = `Ticket`); there's no server-side launch file (`/Sessions/RDPFile` is audit-playback → 403). Ticket is the proxy username; password is proxy-injected. `bt pws quick checkout --access-type ssh|rdp` and `bt pws quick ssh`/`quick rdp` (with `--launch`); session commands do **not** auto-checkin.
 - Entitle permissions: Use server-side filters (`--resource`, `--user`, `--integration`) - dataset can be 20k+ records
 - Entitle users: Use `--all` flag only when needed - default fetches first page only
 - Windows builds: Rich must be pinned to `<14.0.0` (Rich 14 has PyInstaller unicode issues)

{bt_cli-0.4.60 → bt_cli-0.4.62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.60
+Version: 0.4.62
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.60 → bt_cli-0.4.62}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.60"
+version = "0.4.62"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.60 → bt_cli-0.4.62}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.60"
+__version__ = "0.4.62"

{bt_cli-0.4.60 → bt_cli-0.4.62}/src/bt_cli/data/skills/pws/SKILL.md

@@ -150,6 +150,36 @@ bt pws credentials show <request_id>
 bt pws credentials checkin <request_id>
 ```
 
+## SSH / RDP session checkout
+
+`bt pws quick checkout` handles three access types. Interactive runs prompt for
+the access type; scriptable via `--access-type`. There are also dedicated
+`quick ssh` / `quick rdp` wrappers.
+
+```bash
+# Credential (default) - password / dsskey (SSH key) / passphrase
+bt pws quick checkout -s server -a admin
+bt pws quick checkout -s server -a admin --credential-type dsskey --raw
+
+# SSH session - prints a ready-to-run ssh command (proxy injects the password)
+bt pws quick ssh -s linhost2 -a app_account02
+bt pws quick checkout -s linhost2 -a app_account02 --access-type ssh
+bt pws quick ssh -s linhost2 -a app --launch          # exec ssh in this terminal
+eval "$(bt pws quick ssh -s linhost2 -a app --raw)"   # raw = just the ssh command
+
+# RDP session - writes a launchable .rdp file (proxy target + one-time ticket)
+bt pws quick rdp -s WIN03-APP -a Administrator
+bt pws quick rdp -s WIN03-APP -a Administrator --out ~/win03.rdp
+bt pws quick rdp -s WIN03-APP -a Administrator --launch   # mstsc / xfreerdp / open
+```
+
+**How it works (live-verified):**
+- Session establishment is **`POST /Requests/{id}/Sessions`** (`{"SessionType":"SSH"|"RDP"}`), created after a request with the matching `AccessType`. The `/Sessions` collection is GET-only (POST → 405).
+- **SSH** response carries a ready `Command` (`ssh -p 4422 <ticket>@<proxyhost>`) and `Link` — just run it. The `<ticket>` is the proxy username; the password is injected by the proxy, so you never handle a credential.
+- **RDP** response gives `Host`/`Port`/`Ticket` only. There is **no server-side `.rdp`** (`/Sessions/RDPFile` is audit-playback → 403), so the CLI builds the file client-side (`full address:s:<Host>:<Port>` + `username:s:<Ticket>`).
+- `Host` is the **session proxy node** (same for every target), not the managed system's own host.
+- Session checkout does **not** auto-checkin — the session needs the request open. Check in when done: `bt pws credentials checkin <request_id>`.
+
 ## Sessions (view / suspend / terminate)
 
 ```bash
@@ -165,8 +195,17 @@ bt pws sessions suspend <session_id>
 # Terminate = end permanently (cannot be resumed) - prompts unless --force
 bt pws sessions terminate <session_id>
 bt pws sessions terminate <session_id> --force
+
+# Export session history as evidence (same filters as list, no display cap)
+bt pws sessions export --file sessions.json
+bt pws sessions export --active --file active-sessions.csv --format csv
+bt pws sessions export --system 13 -o json
 ```
 
+`sessions export` is a sessions-only shortcut; use `bt pws audit export` to pull
+requests + sessions together. Because `/Sessions` ignores server-side filters,
+`--system` and `--active` are applied **client-side** after the full fetch.
+
 **Gotchas:**
 - `/Sessions` returns session **history**, not just active sessions, and **ignores `limit`/`offset`** (returns the full set every call - the client does a single GET, the CLI caps display client-side). Use `--active` for the live ones.
 - `Status` codes confirmed live: **0 = Not started, 1 = Active, 2 = Completed, 5 = Locked, 7 = Terminated** (3/9 are other terminal states). `--active` filters on Status == 1.

{bt_cli-0.4.60 → bt_cli-0.4.62}/src/bt_cli/pws/client/passwordsafe.py

@@ -429,6 +429,35 @@ class PasswordSafeMixin:
             access_type=access_type,
         )
 
+    def create_session(
+        self: "PasswordSafeClient",
+        request_id: int,
+        session_type: str = "SSH",
+        node_id: Optional[str] = None,
+    ) -> dict[str, Any]:
+        """Establish an SSH/RDP session for an approved request.
+
+        Live-verified: session creation is POST /Requests/{id}/Sessions (the
+        /Sessions collection is GET-only - a POST there returns 405). Create the
+        request first with a matching AccessType (SSH/RDP), then call this.
+
+        Args:
+            request_id: Request ID (must have AccessType SSH or RDP)
+            session_type: "SSH", "RDP", or "App"
+            node_id: Optional session node (proxy) ID
+
+        Returns:
+            Session dict. Common keys: Host, Port, Ticket, SessionID, NodeID.
+            SSH also returns a ready-to-use Command ("ssh -p <port> <ticket>@<host>")
+            and Link ("ssh://..."). RDP returns Host/Port/Ticket only - the .rdp
+            file is built client-side (there is no server-side launch file; the
+            password is injected by the proxy, with Ticket as the proxy username).
+        """
+        data: dict[str, Any] = {"SessionType": session_type}
+        if node_id:
+            data["NodeID"] = node_id
+        return self.post(f"/Requests/{request_id}/Sessions", json=data)
+
     def get_credential(
         self: "PasswordSafeClient",
         request_id: int,

{bt_cli-0.4.60 → bt_cli-0.4.62}/src/bt_cli/pws/commands/quick.py

@@ -2,6 +2,11 @@
 
 from typing import Optional
 import json
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
 
 import httpx
 import typer
@@ -18,6 +23,129 @@ from ..models.common import CredentialType, CREDENTIAL_TYPE_META
 app = typer.Typer(no_args_is_help=True, help="Quick commands - common multi-step operations in one command")
 console = Console()
 
+# Access types accepted by POST /Requests (AccessType). "view" returns a
+# credential; "rdp"/"ssh" establish a proxied session.
+ACCESS_TYPES = {"view": "View", "rdp": "RDP", "ssh": "SSH"}
+
+
+def _resolve_target(client, system: Optional[str], account: Optional[str], quiet: bool) -> dict:
+    """Find a managed system + account by name, prompting when interactive.
+
+    Shared by checkout / ssh / rdp. Returns a dict with system_id, system_name,
+    account_id, account_name. Exits (typer.Exit) with a friendly message when a
+    system or account can't be resolved. `quiet` suppresses progress lines (set
+    for --raw and -o json so stdout stays clean for scripts/jq).
+    """
+    if not system:
+        system = prompt_if_missing(system, "System name (or partial match)")
+
+    console.print(f"[dim]Finding system '{system}'...[/dim]") if not quiet else None
+    systems = client.list_managed_systems(search=system)
+    if not systems:
+        print_error(f"No system found matching '{system}'")
+        raise typer.Exit(1)
+
+    matched_system = None
+    for s in systems:
+        if s.get("SystemName", "").lower() == system.lower():
+            matched_system = s
+            break
+    if not matched_system:
+        matched_system = systems[0]
+        if len(systems) > 1 and not quiet:
+            console.print(f"[yellow]Multiple matches found, using: {matched_system.get('SystemName')}[/yellow]")
+
+    system_id = matched_system.get("ManagedSystemID")
+    system_name = matched_system.get("SystemName")
+
+    accounts = client.list_managed_accounts(system_id=system_id)
+    if not account:
+        if not accounts:
+            print_error(f"No accounts found on system '{system_name}'")
+            raise typer.Exit(1)
+        account = prompt_from_list(
+            accounts, "Account name", "AccountName", "AccountName",
+            f"Accounts on {system_name}", str
+        )
+
+    console.print(f"[dim]Finding account '{account}' on {system_name}...[/dim]") if not quiet else None
+    matched_account = None
+    for acc in accounts:
+        if acc.get("AccountName", "").lower() == account.lower():
+            matched_account = acc
+            break
+    if not matched_account:
+        print_error(f"Account '{account}' not found on system '{system_name}'")
+        if accounts and not quiet:
+            console.print("[dim]Available accounts:[/dim]")
+            for acc in accounts[:10]:
+                console.print(f"  - {acc.get('AccountName')}")
+        raise typer.Exit(1)
+
+    return {
+        "system_id": system_id,
+        "system_name": system_name,
+        "account_id": matched_account.get("AccountId", matched_account.get("ManagedAccountID")),
+        "account_name": matched_account.get("AccountName"),
+    }
+
+
+def _build_rdp_file(session: dict) -> str:
+    """Build .rdp file content from a PWS RDP session response.
+
+    The proxy Host:Port is the connection target and Ticket is the proxy
+    username; the password is injected by the proxy. There is no server-side
+    .rdp file (verified), so we assemble the minimal working file client-side.
+    """
+    host = session.get("Host", "")
+    port = session.get("Port", "")
+    ticket = session.get("Ticket") or session.get("ID", "")
+    return (
+        f"full address:s:{host}:{port}\n"
+        f"username:s:{ticket}\n"
+        "prompt for credentials:i:0\n"
+        "administrative session:i:0\n"
+    )
+
+
+def _ssh_command(session: dict) -> str:
+    """Ready-to-run ssh command for a PWS SSH session (server usually provides it)."""
+    cmd = session.get("Command")
+    if cmd:
+        return cmd
+    return f"ssh -p {session.get('Port')} {session.get('Ticket') or session.get('ID')}@{session.get('Host')}"
+
+
+def _launch_ssh(command: str) -> None:
+    """Exec an ssh session in the current terminal (replaces the process)."""
+    parts = command.split()
+    exe = shutil.which(parts[0])
+    if not exe:
+        print_warning(f"'{parts[0]}' not found on PATH - run the command above manually.")
+        return
+    console.print(f"[dim]Launching: {command}[/dim]")
+    os.execvp(exe, parts)  # replaces this process with the ssh client
+
+
+def _launch_rdp(path: Path) -> None:
+    """Open a .rdp file with the platform RDP client."""
+    if sys.platform.startswith("win"):
+        candidates = [["mstsc", str(path)]]
+    elif sys.platform == "darwin":
+        candidates = [["open", str(path)]]
+    else:
+        candidates = [["xfreerdp", str(path)], ["xdg-open", str(path)]]
+
+    for cmd in candidates:
+        if shutil.which(cmd[0]):
+            console.print(f"[dim]Launching: {' '.join(cmd)}[/dim]")
+            subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            return
+    print_warning(
+        f"No RDP client found ({', '.join(c[0] for c in candidates)}). "
+        f"Open the file manually: {path}"
+    )
+
 
 @app.command("checkout")
 def quick_checkout(
@@ -25,90 +153,62 @@ def quick_checkout(
     account: Optional[str] = typer.Option(None, "--account", "-a", help="Account name"),
     duration: int = typer.Option(60, "--duration", "-d", help="Duration in minutes"),
     reason: Optional[str] = typer.Option(None, "--reason", "-r", help="Reason for checkout"),
-    credential_type: str = typer.Option("password", "--credential-type", help="Credential type: password, dsskey, passphrase"),
-    raw: bool = typer.Option(False, "--raw", help="Output only the credential value (for scripts)"),
+    access_type: Optional[str] = typer.Option(None, "--access-type", help="Access type: view (credential), rdp, or ssh session. Prompts interactively; defaults to view."),
+    credential_type: str = typer.Option("password", "--credential-type", help="For view access: password, dsskey, passphrase"),
+    launch: bool = typer.Option(False, "--launch", help="For rdp/ssh: launch the local client after establishing the session"),
+    out: Optional[str] = typer.Option(None, "--out", help="For rdp: path to write the .rdp file (default ./<account>@<system>.rdp)"),
+    raw: bool = typer.Option(False, "--raw", help="Output only the value (credential / ssh command / rdp path)"),
     output: str = typer.Option("table", "--output", "-o", help="Output format: table or json"),
 ) -> None:
-    """Checkout credentials and show password/SSH key in one step.
+    """Checkout a credential, or establish an RDP/SSH session, in one step.
 
-    Combines: find system -> find account -> checkout -> show credential
+    Combines: find system -> find account -> request -> deliver.
 
-    If system or account not provided, prompts interactively.
+    Access types:
+      view  Return the credential (password / dsskey SSH key / passphrase).
+      ssh   Establish an SSH proxy session and print the ready ssh command.
+      rdp   Establish an RDP proxy session and write a launchable .rdp file.
+
+    If system, account, or access type aren't provided, prompts interactively.
 
     Examples:
-        bt pws quick checkout                           # Interactive mode
-        bt pws quick checkout -s "axion-finapp-01" -a "root"
-        bt pws quick checkout -s axion -a root --duration 30
+        bt pws quick checkout                           # interactive (prompts for access type)
+        bt pws quick checkout -s axion -a root
         PASSWORD=$(bt pws quick checkout -s server -a admin --raw)
         KEY=$(bt pws quick checkout -s server -a admin --credential-type dsskey --raw)
+        bt pws quick checkout -s linhost -a app --access-type ssh --launch
+        bt pws quick checkout -s win03 -a Administrator --access-type rdp --out win03.rdp
     """
+    # Resolve access type (prompt when interactive, default to view)
+    if access_type is None:
+        access_type = "view" if raw else prompt_choice(
+            "Access type",
+            [("view", "credential"), ("ssh", "SSH session"), ("rdp", "RDP session")],
+            default="view",
+        )
+    access_type = access_type.lower()
+    if access_type not in ACCESS_TYPES:
+        print_error(f"Invalid access type: {access_type}. Must be: view, rdp, ssh")
+        raise typer.Exit(1)
+
+    if access_type in ("ssh", "rdp"):
+        _do_session_checkout(
+            system=system, account=account, session_type=access_type,
+            duration=duration, reason=reason, launch=launch, out=out,
+            raw=raw, output=output,
+        )
+        return
+
+    quiet = raw or output == "json"
     try:
         with get_client() as client:
             client.authenticate()
+            target = _resolve_target(client, system, account, quiet)
+            system_id, system_name = target["system_id"], target["system_name"]
+            account_id, account_name = target["account_id"], target["account_name"]
 
-            # Interactive prompt for system if not provided
-            if not system:
-                system = prompt_if_missing(system, "System name (or partial match)")
-
-            # Step 1: Find the system
-            console.print(f"[dim]Finding system '{system}'...[/dim]") if not raw else None
-            systems = client.list_managed_systems(search=system)
-
-            if not systems:
-                print_error(f"No system found matching '{system}'")
-                raise typer.Exit(1)
-
-            # Try exact match first, then partial
-            matched_system = None
-            for s in systems:
-                if s.get("SystemName", "").lower() == system.lower():
-                    matched_system = s
-                    break
-
-            if not matched_system:
-                # Use first partial match
-                matched_system = systems[0]
-                if len(systems) > 1 and not raw:
-                    console.print(f"[yellow]Multiple matches found, using: {matched_system.get('SystemName')}[/yellow]")
-
-            system_id = matched_system.get("ManagedSystemID")
-            system_name = matched_system.get("SystemName")
-
-            # Step 2: Find the account
-            accounts = client.list_managed_accounts(system_id=system_id)
-
-            # Interactive prompt for account if not provided
-            if not account:
-                if not accounts:
-                    print_error(f"No accounts found on system '{system_name}'")
-                    raise typer.Exit(1)
-                account = prompt_from_list(
-                    accounts, "Account name", "AccountName", "AccountName",
-                    f"Accounts on {system_name}", str
-                )
-
-            console.print(f"[dim]Finding account '{account}' on {system_name}...[/dim]") if not raw else None
-
-            matched_account = None
-            for acc in accounts:
-                if acc.get("AccountName", "").lower() == account.lower():
-                    matched_account = acc
-                    break
-
-            if not matched_account:
-                print_error(f"Account '{account}' not found on system '{system_name}'")
-                # Show available accounts
-                if accounts and not raw:
-                    console.print("[dim]Available accounts:[/dim]")
-                    for acc in accounts[:10]:
-                        console.print(f"  - {acc.get('AccountName')}")
-                raise typer.Exit(1)
-
-            account_id = matched_account.get("AccountId", matched_account.get("ManagedAccountID"))
-            account_name = matched_account.get("AccountName")
-
-            # Step 3: Checkout
-            console.print(f"[dim]Checking out {account_name}@{system_name}...[/dim]") if not raw else None
+            # Checkout
+            console.print(f"[dim]Checking out {account_name}@{system_name}...[/dim]") if not quiet else None
             request = client.create_request(
                 account_id=account_id,
                 system_id=system_id,
@@ -118,7 +218,7 @@ def quick_checkout(
             )
             request_id = request.get("RequestID")
 
-            # Step 4: Get the credential
+            # Get the credential
             try:
                 ctype = CredentialType(credential_type)
             except ValueError:
@@ -169,6 +269,174 @@ def quick_checkout(
         raise typer.Exit(1)
 
 
+def _do_session_checkout(
+    system: Optional[str],
+    account: Optional[str],
+    session_type: str,
+    duration: int,
+    reason: Optional[str],
+    launch: bool,
+    out: Optional[str],
+    raw: bool,
+    output: str,
+) -> None:
+    """Shared RDP/SSH session establishment for checkout / ssh / rdp commands.
+
+    Creates a request with the matching AccessType, establishes the proxy
+    session, then delivers the artifact: an ssh command (SSH) or a .rdp file
+    (RDP). Does NOT check the request in - the session needs it to stay open.
+    """
+    st = session_type.lower()
+    access = ACCESS_TYPES[st]
+    quiet = raw or output == "json"
+    try:
+        with get_client() as client:
+            client.authenticate()
+            target = _resolve_target(client, system, account, quiet)
+            system_id, system_name = target["system_id"], target["system_name"]
+            account_id, account_name = target["account_id"], target["account_name"]
+
+            console.print(f"[dim]Establishing {access} session to {account_name}@{system_name}...[/dim]") if not quiet else None
+            request = client.create_request(
+                account_id=account_id,
+                system_id=system_id,
+                duration_minutes=duration,
+                reason=reason,
+                access_type=access,
+            )
+            request_id = request.get("RequestID")
+            session = client.create_session(request_id, session_type=access)
+
+        session_id = session.get("SessionID")
+
+        if st == "ssh":
+            command = _ssh_command(session)
+            if raw:
+                print(command, end="")
+            elif output == "json":
+                console.print_json(json.dumps({
+                    "request_id": request_id,
+                    "session_id": session_id,
+                    "system": system_name,
+                    "account": account_name,
+                    "command": command,
+                    "link": session.get("Link"),
+                    "host": session.get("Host"),
+                    "port": session.get("Port"),
+                }, default=str))
+            else:
+                console.print(Panel(
+                    f"[green]SSH session established![/green]\n\n"
+                    f"System: [cyan]{system_name}[/cyan]   Account: [cyan]{account_name}[/cyan]\n"
+                    f"Request ID: [bold yellow]{request_id}[/bold yellow]   Session ID: {session_id}\n\n"
+                    f"Connect:\n  [bold green]{rich_escape(command)}[/bold green]\n\n"
+                    f"[dim]The proxy injects the password - no credential needed.\n"
+                    f"Checkin: bt pws credentials checkin {request_id}[/dim]",
+                    title="Quick SSH",
+                ))
+            if launch:
+                _launch_ssh(command)
+            return
+
+        # RDP
+        content = _build_rdp_file(session)
+        path = Path(out) if out else Path(f"{account_name}@{system_name}.rdp")
+        path.write_text(content)
+        abspath = str(path.resolve())
+
+        if raw:
+            print(abspath, end="")
+        elif output == "json":
+            console.print_json(json.dumps({
+                "request_id": request_id,
+                "session_id": session_id,
+                "system": system_name,
+                "account": account_name,
+                "rdp_file": abspath,
+                "host": session.get("Host"),
+                "port": session.get("Port"),
+            }, default=str))
+        else:
+            console.print(Panel(
+                f"[green]RDP session established![/green]\n\n"
+                f"System: [cyan]{system_name}[/cyan]   Account: [cyan]{account_name}[/cyan]\n"
+                f"Request ID: [bold yellow]{request_id}[/bold yellow]   Session ID: {session_id}\n\n"
+                f"RDP file: [bold green]{rich_escape(abspath)}[/bold green]\n"
+                f"Proxy: {session.get('Host')}:{session.get('Port')}\n\n"
+                f"[dim]Open the file with your RDP client (or pass --launch).\n"
+                f"Checkin: bt pws credentials checkin {request_id}[/dim]",
+                title="Quick RDP",
+            ))
+        if launch:
+            _launch_rdp(path)
+
+    except httpx.HTTPStatusError as e:
+        print_api_error(e, f"quick {st}")
+        raise typer.Exit(1)
+    except httpx.RequestError as e:
+        print_api_error(e, f"quick {st}")
+        raise typer.Exit(1)
+    except typer.Exit:
+        raise
+    except Exception as e:
+        print_api_error(e, f"quick {st}")
+        raise typer.Exit(1)
+
+
+@app.command("ssh")
+def quick_ssh(
+    system: Optional[str] = typer.Option(None, "--system", "-s", help="System name (partial match supported)"),
+    account: Optional[str] = typer.Option(None, "--account", "-a", help="Account name"),
+    duration: int = typer.Option(60, "--duration", "-d", help="Duration in minutes"),
+    reason: Optional[str] = typer.Option(None, "--reason", "-r", help="Reason for the session"),
+    launch: bool = typer.Option(False, "--launch", help="Launch the ssh client after establishing the session"),
+    raw: bool = typer.Option(False, "--raw", help="Output only the ssh command (for scripts)"),
+    output: str = typer.Option("table", "--output", "-o", help="Output format: table or json"),
+) -> None:
+    """Establish an SSH proxy session and print a ready-to-run ssh command.
+
+    The Password Safe proxy injects the credential - you never see the password.
+
+    Examples:
+        bt pws quick ssh -s linhost -a app_account02
+        bt pws quick ssh -s linhost -a app --launch
+        eval "$(bt pws quick ssh -s linhost -a app --raw)"
+    """
+    _do_session_checkout(
+        system=system, account=account, session_type="ssh",
+        duration=duration, reason=reason, launch=launch, out=None,
+        raw=raw, output=output,
+    )
+
+
+@app.command("rdp")
+def quick_rdp(
+    system: Optional[str] = typer.Option(None, "--system", "-s", help="System name (partial match supported)"),
+    account: Optional[str] = typer.Option(None, "--account", "-a", help="Account name"),
+    duration: int = typer.Option(60, "--duration", "-d", help="Duration in minutes"),
+    reason: Optional[str] = typer.Option(None, "--reason", "-r", help="Reason for the session"),
+    launch: bool = typer.Option(False, "--launch", help="Launch the RDP client on the generated file"),
+    out: Optional[str] = typer.Option(None, "--out", help="Path to write the .rdp file (default ./<account>@<system>.rdp)"),
+    raw: bool = typer.Option(False, "--raw", help="Output only the .rdp file path (for scripts)"),
+    output: str = typer.Option("table", "--output", "-o", help="Output format: table or json"),
+) -> None:
+    """Establish an RDP proxy session and write a launchable .rdp file.
+
+    The Password Safe proxy injects the credential; the .rdp file targets the
+    proxy with the one-time ticket as the username.
+
+    Examples:
+        bt pws quick rdp -s win03 -a Administrator
+        bt pws quick rdp -s win03 -a Administrator --launch
+        bt pws quick rdp -s win03 -a Administrator --out ~/sessions/win03.rdp
+    """
+    _do_session_checkout(
+        system=system, account=account, session_type="rdp",
+        duration=duration, reason=reason, launch=launch, out=out,
+        raw=raw, output=output,
+    )
+
+
 @app.command("checkin")
 def quick_checkin(
     request_id: int = typer.Argument(..., help="Request ID to check in"),

{bt_cli-0.4.60 → bt_cli-0.4.62}/src/bt_cli/pws/commands/sessions.py

@@ -9,6 +9,7 @@ from rich.table import Table
 
 from ...core.output import print_api_error
 from ..client.base import get_client
+from .audit import _write_csv
 
 app = typer.Typer(no_args_is_help=True, help="View and control active Password Safe sessions")
 console = Console()
@@ -167,6 +168,65 @@ def get_session(
         raise typer.Exit(1)
 
 
+@app.command("export")
+def export_sessions(
+    system: int = typer.Option(None, "--system", help="Filter by managed system ID"),
+    active: bool = typer.Option(False, "--active", help="Export only active (Status 1) sessions"),
+    status: str = typer.Option(None, "--status", "-s", help="Filter by raw numeric status code"),
+    file: str = typer.Option(None, "--file", help="Write to this file (otherwise prints to stdout)"),
+    fmt: str = typer.Option("json", "--format", help="File format: json or csv"),
+    output: str = typer.Option("json", "--output", "-o", help="Stdout format when no --file: json or table"),
+) -> None:
+    """Export session history as an evidence artifact.
+
+    Same filters as `sessions list`, but exports ALL matching rows (no display
+    cap). SIEM is the primary audit channel - this is for ad-hoc evidence pulls.
+    To export requests and sessions together, see `bt pws audit export`.
+
+    Examples:
+        bt pws sessions export --file sessions.json
+        bt pws sessions export --active --file active-sessions.csv --format csv
+        bt pws sessions export --system 13 -o json
+    """
+    try:
+        with get_client() as client:
+            client.authenticate()
+            sessions = client.list_sessions(system_id=system, status=status)
+
+        # /Sessions ignores server-side filters (returns full history every call),
+        # so filter client-side to make --system/--active actually apply.
+        if system is not None:
+            sessions = [s for s in sessions if s.get("ManagedSystemID") == system]
+        if active:
+            sessions = [s for s in sessions if is_active(s)]
+
+        if file:
+            if fmt == "csv":
+                _write_csv(file, sessions)
+            else:
+                with open(file, "w", encoding="utf-8") as f:
+                    json.dump(sessions, f, indent=2, default=str)
+            console.print(f"[green]Exported {len(sessions)} session(s).[/green]")
+            console.print(f"  [cyan]{file}[/cyan]")
+            return
+
+        # No file: print to stdout
+        if output == "json":
+            console.print_json(json.dumps(sessions, default=str))
+        else:
+            print_sessions_table(sessions, title=f"Sessions ({len(sessions)})")
+
+    except httpx.HTTPStatusError as e:
+        print_api_error(e, "export sessions")
+        raise typer.Exit(1)
+    except httpx.RequestError as e:
+        print_api_error(e, "export sessions")
+        raise typer.Exit(1)
+    except Exception as e:
+        print_api_error(e, "export sessions")
+        raise typer.Exit(1)
+
+
 @app.command("suspend")
 def suspend_session(
     session_id: int = typer.Argument(..., help="Session ID to lock/suspend"),