(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'hostkey agent'>)}
          spids: [7]
        )
      ]
    )
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/agent-key.'> <Id.Lit_Star '*'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy.orig'>} {($ Id.VSub_DollarName '$OBJ') <'/known_hosts.orig'>}
    )
    (C {<trace>} {(DQ <'start agent'>)})
    (command.Simple
      words: [
        {<eval>}
        {(command_sub left_token:<Id.Left_Backtick '`'> child:(C {(${ Id.VSub_Name SSHAGENT)} {<-s>}))}
      ]
      redirects: [(redir op:<Id.Redir_Great '>'> loc:(redir_loc.Fd fd:1) arg:{<'/dev/null'>})]
      do_fork: T
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:r)
          op: assign_op.Equal
          rhs: {($ Id.VSub_QMark '$?')}
          spids: [50]
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (C {<Id.Lit_LBracket '['>} {($ Id.VSub_DollarName '$r')} {<-ne>} {<0>} {<Id.Lit_RBracket ']'>})
        (C {<fatal>} {(DQ <'could not start ssh-agent: exit code '> ($ Id.VSub_DollarName '$r'))})
      ]
    )
    (command.Simple
      words: [{<grep>} {<-vi>} {(SQ <hostkey>)} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}]
      redirects: [
        (redir
          op: <Id.Redir_Great '>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy.orig'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'HostKeyAgent '> ($ Id.VSub_DollarName '$SSH_AUTH_SOCK'))}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy.orig'>}
        )
      ]
      do_fork: T
    )
    (C {<trace>} {(DQ <'load hostkeys'>)})
    (command.ForEach
      iter_name: k
      iter_words: [
        {
          (command_sub
            left_token: <Id.Left_Backtick '`'>
            child: (C {(${ Id.VSub_Name SSH)} {<-Q>} {<key-plain>})
          )
        }
      ]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {(${ Id.VSub_Name SSHKEYGEN)} {<-qt>} {($ Id.VSub_DollarName '$k')} {<-f>} 
                  {($ Id.VSub_DollarName '$OBJ') <'/agent-key.'> ($ Id.VSub_DollarName '$k')} {<-N>} {(SQ )}
                )
                (C {<fatal>} {(DQ <'ssh-keygen '> ($ Id.VSub_DollarName '$k'))})
              ]
            )
            (command.Subshell
              child: 
                (command.CommandList
                  children: [
                    (C {<printf>} {(SQ <'localhost-with-alias,127.0.0.1,::1 '>)})
                    (C {<cat>} 
                      {($ Id.VSub_DollarName '$OBJ') <'/agent-key.'> ($ Id.VSub_DollarName '$k') <.pub>}
                    )
                  ]
                )
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {($ Id.VSub_DollarName '$OBJ') <'/known_hosts.orig'>}
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {(${ Id.VSub_Name SSHADD)}
                    {($ Id.VSub_DollarName '$OBJ') <'/agent-key.'> ($ Id.VSub_DollarName '$k')}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                    (redir
                      op: <Id.Redir_GreatAnd '2>&'>
                      loc: (redir_loc.Fd fd:2)
                      arg: {<1>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} 
                  {
                    (DQ <'couldn\'t load key '> ($ Id.VSub_DollarName '$OBJ') <'/agent-key.'> 
                      ($ Id.VSub_DollarName '$k')
                    )
                  }
                )
              ]
            )
            (command.Simple
              words: [
                {<echo>}
                {(DQ <'Hostkey '> ($ Id.VSub_DollarName '$OBJ') <'/agent-key.'> (${ Id.VSub_Name k))}
              ]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy.orig'>}
                )
              ]
              do_fork: T
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {<rm>} {($ Id.VSub_DollarName '$OBJ') <'/agent-key.'> ($ Id.VSub_DollarName '$k')})
                (C {<fatal>} 
                  {
                    (DQ <'couldn\'t rm '> ($ Id.VSub_DollarName '$OBJ') <'/agent-key.'> 
                      ($ Id.VSub_DollarName '$k')
                    )
                  }
                )
              ]
            )
          ]
        )
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/known_hosts.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/known_hosts'>}
    )
    (C {<unset>} {<SSH_AUTH_SOCK>})
    (command.ForEach
      iter_name: ps
      iter_words: [{<no>} {<yes>}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.ForEach
              iter_name: k
              iter_words: [
                {
                  (command_sub
                    left_token: <Id.Left_Backtick '`'>
                    child: (C {(${ Id.VSub_Name SSH)} {<-Q>} {<key-plain>})
                  )
                }
              ]
              do_arg_iter: F
              body: 
                (command.DoGroup
                  children: [
                    (C {<verbose>} 
                      {
                        (DQ <'key type '> ($ Id.VSub_DollarName '$k') <' privsep='> 
                          ($ Id.VSub_DollarName '$ps')
                        )
                      }
                    )
                    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy.orig'>} 
                      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
                    )
                    (command.Simple
                      words: [{<echo>} {(DQ <'UsePrivilegeSeparation '> ($ Id.VSub_DollarName '$ps'))}]
                      redirects: [
                        (redir
                          op: <Id.Redir_DGreat '>>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
                        )
                      ]
                      do_fork: T
                    )
                    (command.Simple
                      words: [{<echo>} {(DQ <'HostKeyAlgorithms '> ($ Id.VSub_DollarName '$k'))}]
                      redirects: [
                        (redir
                          op: <Id.Redir_DGreat '>>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
                        )
                      ]
                      do_fork: T
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:opts)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (DQ <'-oHostKeyAlgorithms='> ($ Id.VSub_DollarName '$k') <' -F '> 
                                ($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>
                              )
                            }
                          spids: [350]
                        )
                      ]
                    )
                    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/known_hosts.orig'>} 
                      {($ Id.VSub_DollarName '$OBJ') <'/known_hosts'>}
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:SSH_CONNECTION)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (command_sub
                                left_token: <Id.Left_Backtick '`'>
                                child: 
                                  (C {(${ Id.VSub_Name SSH)} {($ Id.VSub_DollarName '$opts')} {<host>} 
                                    {(SQ <'echo $SSH_CONNECTION'>)}
                                  )
                              )
                            }
                          spids: [369]
                        )
                      ]
                    )
                    (command.If
                      arms: [
                        (if_arm
                          cond: 
                            (condition.Shell
                              commands: [
                                (command.Sentence
                                  child: 
                                    (C {<Id.Lit_LBracket '['>} {($ Id.VSub_QMark '$?')} {<-ne>} {<0>} 
                                      {<Id.Lit_RBracket ']'>}
                                    )
                                  terminator: <Id.Op_Semi _>
                                )
                              ]
                            )
                          action: [
                            (C {<fail>} 
                              {
                                (DQ <'protocol '> ($ Id.VSub_DollarName '$p') <' privsep='> 
                                  ($ Id.VSub_DollarName '$ps') <' failed'>
                                )
                              }
                            )
                          ]
                          spids: [387 400]
                        )
                      ]
                    )
                    (command.If
                      arms: [
                        (if_arm
                          cond: 
                            (condition.Shell
                              commands: [
                                (command.Sentence
                                  child: 
                                    (C {<Id.Lit_LBracket '['>} 
                                      {(DQ ($ Id.VSub_DollarName '$SSH_CONNECTION'))} {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} {(DQ <'UNKNOWN 65535 UNKNOWN 65535'>)} {<Id.Lit_RBracket ']'>}
                                    )
                                  terminator: <Id.Op_Semi _>
                                )
                              ]
                            )
                          action: [
                            (C {<fail>} 
                              {
                                (DQ <'bad SSH_CONNECTION key type '> ($ Id.VSub_DollarName '$k') 
                                  <' privsep='> ($ Id.VSub_DollarName '$ps')
                                )
                              }
                            )
                          ]
                          spids: [417 435]
                        )
                      ]
                    )
                  ]
                )
            )
          ]
        )
    )
    (C {<trace>} {(DQ <'kill agent'>)})
    (command.Simple
      words: [{(${ Id.VSub_Name SSHAGENT)} {<-k>}]
      redirects: [(redir op:<Id.Redir_Great '>'> loc:(redir_loc.Fd fd:1) arg:{<'/dev/null'>})]
      do_fork: T
    )
  ]
)