docs: describe SSH that sets itself up and the CLI inside a workspace

[jona62]

These are the docs for the rig CLI gap-report fixes:

• the CLI changes in rigbox-dev/cli#201;
• the SSH gateway and Claude Code catalog changes in jona62/rig-mvp#483;
• the VM bridge limits in jona62/rig-mvp#482.

What changes

• SSH access (guides/ssh-access.mdx, rewritten):
  • rig login, rig ssh add and workspace spawn/start/restart/ssh-info set up SSH themselves. They register the key, write a Host entry per workspace in ~/.config/rigbox/ssh_config, and trust the gateway's host keys. ssh <workspace> then works from a terminal, an editor or the Claude desktop app.
  • The guide also covers rig config set ssh-setup false, the stopped-workspace message on stderr, ssh -t with a command, and SFTP, scp and rsync by alias.
  • It says that port, agent and X11 forwarding aren't available.
  • The key, file-transfer and troubleshooting pages, the install guide, the quickstart, the workspace guide and the security page are updated to match. Legacy anchors are kept.
• Inside a workspace (cli-reference/execution-modes.mdx):
  • which commands work there, and the one-line refusal for laptop-only ones;
  • --workspace defaulting to the current workspace;
  • rig deploy deploying into the workspace it runs in;
  • what the bridge won't serve, or serves read-only.
  • The guides for the CLI, deploy, configuration, setup scripts, service specs and app logs link to it, and so does the security page.
• rig update (guides/install-cli.mdx): it replaces the running binary from the public mirror, inside workspaces too. The page covers --version, the update notice, RIGBOX_NO_UPDATE_CHECK and the workspace's own update timer.
• Managed proxy:
  • each client gets its base URL: Anthropic clients take the proxy root, and OpenAI-compatible ones take /v1;
  • rig proxy off only unsets variables that point at the proxy.
• Coding agents:
  • rig recipe app install --ref claude -w <ws> adds an agent to an existing workspace;
  • the guide lists all six built-in agents with their routing;
  • the Claude Code item keeps the user's own Claude login.
• Smaller guide fixes:
  • rig api --body takes inline JSON;
  • tool ids are real, and tools ls shows status and URL;
  • app new defaults --workspace to the current workspace, or to the one rig.yaml deploys to;
  • init --name is slugged;
  • rig login without a terminal points at RIG_API_KEY and --import-token.
• CLI reference: the command pages are regenerated for the new flags and the workspace-mode commands. ssh-info no longer describes a line for another tool.

Before merging

• Merge after rigbox-dev/cli#201 is released and jona62/rig-mvp#482 and jona62/rig-mvp#483 are deployed. These pages describe that behaviour.
• The CLI reference was not produced by export_docs. It was rebuilt from the branch's --help output, with argument metadata carried over from the rc.2 export. It reproduced every unchanged page byte for byte first. scripts/generate-cli-reference.md records this.
• Rerun the real export from the released CLI to replace it. The export also updates cli-reference/commands/ci/status.mdx, which still describes the old rig ci status.
• generate-cli-reference.py --check, check-docs.py and build-navigation.py --check pass.

🤖 Generated with Claude Code