SSH & WebAssembly

SSH

SSH executes commands on remote machines directly over SSH. No agent required — connects with password or key authentication. UPLOAD and DOWNLOAD transfer files between your namespace and the remote machine.

Single command — password auth

Example
SSH "root" AT "123.45.67.89" PASSWORD "mypassword" ENTER `ls /var/www` SET ?result
AFTER EMIT ?result("stdout")

Key-based authentication

Example
SSH "deploy" AT "123.45.67.89" KEY "/root/keys/id_rsa" ENTER `git pull` SET ?result
AFTER EMIT ?result("stdout")

Custom port

Example
SSH "admin" AT "123.45.67.89" ON "2222" PASSWORD "mypassword" ENTER `uptime` SET ?result
AFTER EMIT ?result("stdout")

Multi-command block

Multiple commands are written as newlines inside the backtick block. They run sequentially in the same session.

Example
SSH "deploy" AT "123.45.67.89" KEY "/root/keys/id_rsa" ENTER `
cd /var/www/myapp
git pull
npm install --production
pm2 restart all
` SET ?result
AFTER EMIT ?result("stdout")

File transfer — namespace to remote

Example
SSH "deploy" AT "123.45.67.89" KEY "/root/keys/id_rsa" UPLOAD "/root/config.json" TO "/var/www/myapp/config.json"

File transfer — remote to namespace

Example
SSH "root" AT "123.45.67.89" PASSWORD "mypassword" DOWNLOAD "/var/log/app.log" INTO "/mounted/logs/app.log" SET ?path
AFTER EMIT ?path

Checking exit code

Example
SSH "root" AT "123.45.67.89" PASSWORD "mypassword" ENTER `systemctl is-active nginx` SET ?r
AFTER IF ?r("exit_code") IS EQUAL TO 0
OPEN
  EMIT "nginx is running"
CLOSE
OR
OPEN
  EMIT "nginx is down"
CLOSE

Return value

SSH returns an object for every ENTER call.

Field Type Description
stdoutstringStandard output from the command
stderrstringStandard error from the command
exit_codenumberProcess exit code — 0 is success
Verb Description
SSH "user" AT "host" PASSWORD "pass" ENTER `cmd` SET ?rSingle command via password auth. Default port 22.
SSH "user" AT "host" KEY "/root/key" ENTER `cmd` SET ?rSingle command via key auth.
SSH "user" AT "host" ON "port" [AUTH] ENTER `cmd` SET ?rCustom port.
SSH "user" AT "host" [AUTH] UPLOAD "/root/src" TO "/remote/dst"Copy file from namespace to remote machine.
SSH "user" AT "host" [AUTH] DOWNLOAD "/remote/src" INTO "/mounted/dst" SET ?pathCopy file from remote machine into namespace.

WebAssembly

The WEBASSEMBLY verb runs code in another language or a compiled binary, fully sandboxed from the rest of the server. Only your namespace’s /root and /mounted are visible inside the sandbox — nothing else on the server exists from its perspective.

GRANT

Before entering a sandbox, you choose exactly which OcaltQL variables it can see. WEBASSEMBLY GRANT exposes a variable under an alias. Nothing is shared unless explicitly granted.

Example
STRING "hello" SET ?var
AFTER WEBASSEMBLY GRANT ?var AS "varalias"

Multiple grants can be chained before a single ENTER block — each one adds another variable to the sandbox’s oql object.

Multiple Grants
STRING "Ocalt" SET ?name
AFTER NUMBER 5 SET ?count
AFTER WEBASSEMBLY GRANT ?name AS "name"
AFTER WEBASSEMBLY GRANT ?count AS "count"

TYPE & ENTER

WEBASSEMBLY TYPE "language" ENTER \`code\` SET ?result runs the code in the specified language, inside the sandbox, with access to anything granted beforehand. Whatever the code outputs becomes the result.

Example
STRING "hello" SET ?var
AFTER WEBASSEMBLY GRANT ?var AS "varalias"
AFTER WEBASSEMBLY TYPE "php" ENTER `
echo $oql['varalias'];
` SET ?result
AFTER EMIT ?result

Supported Types

Granted variables are available inside the sandbox as an oql object, in the idiomatic form for each language.

TYPE Access grants as
php$oql['alias']
pythonoql['alias']
nodeoql.alias
rubyoql['alias']
perl$oql{'alias'}
javaoql.get("alias")
bash$OQL_alias (env var)
wasmpassed as WASI env vars OQL_alias

Compiled WebAssembly

When TYPE is wasm, ENTER takes a namespace path to a compiled .wasm file instead of inline source.

Example
WEBASSEMBLY TYPE "wasm" ENTER "/root/modules/compute.wasm" SET ?result
AFTER EMIT ?result

Sandbox isolation

Every WEBASSEMBLY execution runs in an isolated filesystem view. The code being executed can only ever see two paths: /root and /mounted — both mapped directly to your own namespace. The real server filesystem, other users’ namespaces, and Ocalt’s internal infrastructure are completely invisible. There is no path traversal, no symlink escape, and no shared state with the host.

What runs inside the sandbox

Every WEBASSEMBLY block executes in an isolated jail. It sees your namespace as /root and /mounted and nothing else of the machine — no other account, no host filesystem, and no network at all. Code that needs the internet should fetch through OcaltQL's own verbs and hand the result in with GRANT.

TYPE What is available
"php"The full extension set — gd, imagick, zip, curl, mbstring, intl, bcmath, sodium, openssl, xml, dom, sqlite3, pdo, and the rest. Your code is appended to an opening <?php, so do not write the tag yourself.
"python"Pillow, NumPy, pandas, SciPy, scikit-learn, statsmodels, SymPy, NetworkX, Matplotlib, OpenCV, requests, BeautifulSoup, lxml, PyYAML, cryptography, openpyxl, python-docx, reportlab, pypdf, qrcode — plus PyTorch, torchvision, Transformers, sentence-transformers and ONNX Runtime for machine learning.
"node"lodash, axios, cheerio, node-fetch, dayjs, uuid, js-yaml, marked, mathjs, jimp, qrcode, csv-parse, csv-stringify.
"ruby"json, nokogiri, httparty.
"perl"JSON, XML::LibXML, LWP.
"bash"A shell inside the same jail, with the standard userland.
"java"JDK 11 in single-file source mode. Your statements run inside a generated main(), so write plain statements — no class or method declaration. java.util and java.io are imported already.
"wasm"A compiled .wasm module from your namespace, executed directly.
Drawing an image with PHP GD
WEBASSEMBLY TYPE "php" ENTER `
$im = imagecreatetruecolor(200, 120);
$bg  = imagecolorallocate($im, 20, 30, 60);
$fg  = imagecolorallocate($im, 232, 182, 44);
imagefilledrectangle($im, 0, 0, 199, 119, $bg);
imagefilledellipse($im, 100, 60, 80, 80, $fg);
imagepng($im, "/root/badge.png");
echo filesize("/root/badge.png") . " bytes";
` SET ?result
AFTER EMIT ?result
Numerical work with Python
WEBASSEMBLY TYPE "python" ENTER `
import numpy as np
from sklearn.linear_model import LinearRegression
x = np.array([[1],[2],[3],[4]])
y = np.array([3, 5, 7, 9])
m = LinearRegression().fit(x, y)
print("slope", round(float(m.coef_[0]), 3), "intercept", round(float(m.intercept_), 3))
` SET ?result
AFTER EMIT ?result
A tensor operation with PyTorch
WEBASSEMBLY TYPE "python" ENTER `
import torch
a = torch.tensor([[1., 2.], [3., 4.]])
print("determinant", float(torch.det(a)))
` SET ?result
AFTER EMIT ?result
Java
STRING "Ocalt" SET ?name
AFTER WEBASSEMBLY GRANT ?name AS "name"
AFTER WEBASSEMBLY TYPE "java" ENTER `
List<String> parts = new ArrayList<>(Arrays.asList("c", "a", "b"));
Collections.sort(parts);
System.out.println("hello " + oql.get("name") + " " + String.join(",", parts));
` SET ?result
AFTER EMIT ?result
(* Output: hello Ocalt a,b,c *)
Java runs in single-file source mode: write statements, not a class. They are placed inside a generated main(), with java.util and java.io already imported and the grants available as a Map<String,String> called oql.
The sandbox has a network — its own. A WEBASSEMBLY block is not cut off from the world; it is placed in a network that contains only your things. 127.0.0.1 is its own loopback, nothing of Ocalt’s is on it, and no other namespace is reachable because none is attached to it. A library that downloads on first use works. pip works. A request to your own database by name works, once you have mapped it.
WATCH & Triggers →