stado host exec
Invocation
stado host exec [OPTIONS] <TARGET> [-- <COMMAND>...]Purpose
Run one approved command on TARGET (allowlist, not a shell). Every entry is read-only except the declared provider sign-in repairs. Retained Tailscale logs are available without changing logging settings, restarting a service, or opening a test network connection. macOS: log show --last 1h --style compact --info --debug --no-pager --process Tailscale --process IPNExtension --process io.tailscale.ipn.macsys.network-extension --process tailscaled Linux: journalctl --unit tailscaled --since -1h --no-pager --output short-iso These commands retain the native timestamps and messages. Empty output does not establish that Funnel works. Missing tools and access refusals remain command failures. Changed arguments or an extra process, path, or time window are refused before the host is contacted.
Required inputs and options
| Input or option | Contract |
|---|---|
<TARGET> | [COMMAND]... The approved command, after `--`. Run with an unapproved one to see the allowlist |
--json | Emit the report as JSON instead of the host's raw output |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.