Command suite

• "Does this command exist?"
• "Under which shell and help section?"
• "What sub-steps does the wizard walk through?"
• "Which aliases resolve to the canonical name?"
• "Which flags does the command accept?"

For one-liners / piping / non-interactive invocations see the CLI and Piping Cheatsheet. For the matrix of console scripts and python -m invocations see the CLI Matrix.

How to read this page

• Top-level entries are typed at a shell prompt (or menu pick).
• <required> / [optional] mirror the usage strings registered in source.
• "→ wizard" means the command enters a tag-granular interactive wizard whose sub-prompts are listed directly beneath it.
• Aliases resolve to the canonical handler and are listed explicitly.
• Commands marked (expert) only appear with HELP EXPERT / HELP-ALL (SCP11 Live / Test only).
• Commands marked (not in HELP) are registered but omitted from the default help screen; they still dispatch at the prompt.
• Commands marked (hidden) are dispatchable but removed from tab-completion.

Navigation cheat sheet

flowchart TD
    Launcher["main/main.py
top-level menu"] --> SCP03["SCP03 Admin Shell"]
    Launcher --> SCP80["SCP80 OTA Shell"]
    Launcher --> LiveShell["SCP11 Live relay"]
    Launcher --> TestShell["SCP11 Test relay"]
    Launcher --> LocalShell["SCP11 Local SMDPP"]
    Launcher --> EimShell["SCP11 Local eIM"]
    Launcher --> ProfileShell["Profile Package / SAIP shell"]
    Launcher --> SuciShell["SUCI Tool shell"]
    Launcher --> HilMenu["HIL Bridge session menu"]
    Launcher --> Backend["Card Backend menu"]
    Launcher --> Guides["Guides menu"]
    HilMenu -. spawns .-> HilBridge["yggdrasim-hil-bridge"]
    HilMenu -. spawns .-> HilSup["yggdrasim-hil-supervisor"]
    HilSup -. supervises .-> HilBridge
    HilSup -. spawns .-> Remsim["osmo-remsim-client-st2"]
    SCP03 -- WIZARD / PUT-KEY / SET-STATUS / MANAGE-* / CONFIG / FS-ADMIN / REPORT --> SCP03Wiz["SCP03 wizards"]
    SCP03 -- OTA --> SCP80
    SCP03 -- STK --> StkSub["STK sub-shell"]
    ProfileShell -->|"INSPECT / OPEN / TUI"| SaipTui["SAIP split-pane TUI"]
    SaipTui -- decoded edit --> SaipModal["Decoded editor modal"]
    LiveShell -. polling plugin .-> PollCmd["POLL / EIM-POLL"]
    TestShell -. polling plugin .-> PollCmd
    EimShell -. polling plugin .-> IpaeCmd["IPAE-LIVE / IPAE-TEST"]

Figure: Command-suite navigation — launcher to shells, wizards, and sub-commands

1. main/main.py — Top-level Menu Launcher

Invoke with python main/main.py or any wrapper console script (yggdrasim-scp03, yggdrasim-scp11, etc., which delegate to the launcher's helpers). The launcher is menu-driven, not a command-line shell; numeric or letter picks open another surface. All pre-shell options are consumed by argparse before the menu is drawn.

1.1 Launch-time CLI flags

1.2 Top-level numeric / letter menu

1.3 Legacy numeric aliases

Accepted by _dispatch_main_menu_choice:

1.4 [B] HIL Bridge sub-menu

Managed from main/main.py::manage_hil_bridge. Renders live status (service state, supervisor state, bridge/REMSIM presence, card-relay URL, ATR) each iteration.

Sub-tooling spawned from [B]:

• Wireshark live capture — wireshark -k -i <iface> -f "udp port 4729". iface defaults to lo/lo0; override via YGGDRASIM_HIL_CAPTURE_INTERFACE. Binary override via YGGDRASIM_HIL_WIRESHARK_BIN.
• Decoded-APDU Textual TUI — Tools.HilBridge.live_decode_tui.run_live_decode_tui driving either the live pcap with tshark -i (live mode) or a saved pcap with tshark -r (offline review mode). Override via YGGDRASIM_HIL_TERMSHARK_BIN, warmup via YGGDRASIM_HIL_TERMSHARK_WARMUP_SECONDS. In offline mode, a keybag JSON can be layered in via the [3] prompt or --keybag.
• Raw APDU stream view — tails journalctl --user -u yggdrasim-hil-supervisor.service -f -n 0 -o cat, filtered to APDU-flavored lines.
• Pcap writers — Tools/HilBridge/termshark_capture_pcap.py (preferred) or tshark/dumpcap. Mirror fan-out via termshark_capture_mirror.py when --gsmtap-capture-mirror-fifo-path is set.
• Offline replay engine — Tools.HilBridge.scp_replay.ScpReplayEngine unwraps secure-messaging APDUs (CLA bit 0x04) for SCP03 / SCP11c when a keybag JSON is loaded via load_keybag() / try_autodiscover_sidecar_keybag(). Keybags are produced by EXPORT-KEYBAG in SCP03 / SCP11 Local Access or by python -m SCP11.local_access --dump-keybag.

1.5 [C] Card Backend sub-menu

configure_card_backend() re-prints the live backend (reader / sim) plus paths for ISDR config, quirks, eIM identity, eUICC store, and profile store on every iteration.

1.6 [G] Guides sub-menu

Every pick paginates via _show_text_document (20 lines/page). Topic picks delegate to SCP03.interface.guides.ShellGuides.

1.7 Console-script entry points

Defined in pyproject.toml/yggdrasim_common/console_scripts.py:

2. SCP03 — GlobalPlatform Admin Shell

python -m SCP03 / yggdrasim-scp03. Command dispatcher: SCP03.interface.commands.CommandRegistry. Entry points: SCP03.main::entry, entry_cmd, entry_stdin, run_standalone, run_script, run_report_wizard.

2.1 Launcher flags

No --scp03-keys, --aid, --reader or similar flags — (not in source).

2.2 Session & card info

2.3 GlobalPlatform execution wizards

Each wizard is tag-granular — every sub-prompt is its own step.

WIZARD → GlobalPlatform Execution Wizards (Choice [0-8])

1. INSTALL [for load] (P1=02)
   1. lf_aid — Executable Load File AID [Hex, optional]
   2. sd_aid — Target Security Domain AID [Hex, optional]
   3. lf_hash — Load File Data Block Hash [Hex, optional]
   4. params — Launch Load Parameters TLV Builder? [y/N] → nested Install Parameters TLV Builder
   5. raw_params — Raw hex-only Load Parameters [Hex, optional]
   6. token — Load Token [Hex, optional]
2. INSTALL [for install] (P1=04)
   1. elf_aid — Executable Load File / Package AID [Hex, mandatory]
   2. em_aid — Executable Module AID [Hex, mandatory]
   3. app_aid — Target Application / Applet AID [Hex, mandatory]
   4. priv — Launch Privileges Builder? [y/N] → nested Privileges Builder
   5. raw_priv — Raw Privileges bitmask [Hex, default 00]
   6. params — Launch Install Parameters TLV Builder? [y/N] → nested builder
   7. raw_params — Raw Install Parameters [Hex, default C900]
   8. token — Install Token [Hex, optional]
3. INSTALL [for make selectable] (P1=08) — sub-steps: app_aid, priv, raw_priv, params, raw_params, token.
4. INSTALL [for extradition] (P1=10)
   1. sd_aid — Destination Security Domain AID [Hex]
   2. app_aid — Application / ELF AID [Hex]
   3. token — Extradition Token [Hex, optional]
5. INSTALL [for registry update] (P1=40) — sub-steps: app_aid, priv, raw_priv, params, raw_params, token.
6. INSTALL [for personalization] / STORE DATA helper (run_dgi_personalization)
   1. target_mode — Mode [1=INSTALL for personalization, 2=Direct STORE DATA only]
   2. target_aid — Target AID [Hex] (only when mode=1)
   3. input_mode — [1=Structured TLV builder, 2=Raw payload hex only]
   4. store_p1 — STORE DATA P1 [Hex, default 90]
   5. store_p2 — STORE DATA P2 [Hex, default 00]
   6. raw_payload — STORE DATA payload [Hex] (only when input_mode=2)
   7. 42 — Issuer/SD ID (Tag 42) [Hex, SKIP]
   8. 45 — Card/SD Image Number (Tag 45) [Hex, SKIP]
   9. 4F — Issuer SD AID (Tag 4F) [Hex, SKIP]
   10. 66 — Card/SD Recognition Data (Tag 66) [Hex, SKIP]
   11. 67 — Launch Card Capability Info Builder (Tag 67)? [y/N] → nested Tag 67 builder
   12. 5F50 — SD Manager URL (Tag 5F50) [Hex, SKIP]
   13. 86 — Security Level (Tag 86) [Hex, SKIP]
   14. 8A — Admin IP/Host (Tag 8A) [Hex, SKIP]
   15. 8C — Admin URL (Tag 8C) [Hex, SKIP]
   16. custom — Add Custom TLV String [Hex, SKIP]
   17. tx — Transmit Confirmation [y/N]
7. INSTALL [for install and make selectable] (P1=0C) — same surface as step 2.
8. Full CAP Install Sequence
   1. Prompt: path to CAP/IJC file
   2. app_aid — Target Applet AID [Hex, defaults from CAP]
   3. mod_aid — Target Module AID [Hex, default=MIRROR → same as applet]
   4. priv — Privileges bitmask [Hex, default 00]
   5. run_b — Launch Install Parameters TLV Builder? [y/N]
   6. raw_p — Raw Install Parameters [Hex, default C900]
   7. ota — Format LOAD blocks for OTA / SMS-PP size limits? [y/N]
   8. algo — Encryption profile [1=3DES-sized chunks, 2=AES-sized chunks]
   9. execute — Execute the full CAP install on the connected SIM? [y/N]
9. Exit Menu

Nested shared builders

• Install Parameters TLV Builder (_build_install_parameters_tlv):
  1. c9 — Application-Specific (Tag C9) [Hex, default C900]
  2. ef — Build GP System Parameters (Tag EF)? [y/N] → Tag EF builder (c6, c7, c8, c9, ca, cb)
  3. ca — SIM File Access (Tag CA) [Raw Hex, SKIP] (CA + EA cannot coexist per ETSI TS 102 226)
  4. ea — Build UICC System Parameters (Tag EA)? [y/N] (skipped if ca set) → Tag EA builder:
     • inc_80 — Toolkit Parameters (Tag 80)? [y/N] → prio, timers (max 08), text, menu, menu_list, msl, tar, chan, srv
     • inc_c3 — Toolkit Parameters DAP (Tag C3)? [y/N] → dap
     • inc_81 — Access Parameters (Tag 81)? [y/N] → Access Domain sub-wizard choice (1=Full 00, 2=UICC 02, 3=No Access FF, 4=Raw), add, raw
     • inc_82 — Admin Access Parameters (Tag 82)? [y/N] (same sub-wizard)
     • inc_83 — Update Access Parameters (Tag 83)? [y/N] (same sub-wizard)
• Privileges Builder (_build_privileges): bits b7 Security Domain, b6 DAP Verification, b5 Delegated Management, b4 Card Lock, b3 Card Terminate, b2 Default Selected, b1 CVM Management, b0 Mandated DAP Verification.
• Tag 67 builder (_build_tag_67): scp, scp_id, scp_opt, scp_mask, other.
• Transmit confirmation: every _finalize_and_transmit path ends with tx [y/N]; on yes, _ensure_auth_sd(gp_ctrl) runs first.

Other GP wizards

GP shortcuts

2.4 Telecom & eSIM lifecycle

MANAGE-PROFILE wizard

1. spec — Target spec [1=SGP.22, 2=SGP.32, 3=SGP.02]
2. action22 — SGP.22 Action [1=List, 2=Scan, 3=Enable, 4=Disable, 5=Delete, 6=GetConfiguredData, 7=GetCerts, 8=GetEID, 9=ReadMetadata] (spec=1)
3. action32 — SGP.32 Action [1=List, 2=Scan, 3=Enable, 4=Disable, 5=Delete, 6=GetAllData, 7=ReadMetadata] (spec=2)
4. action02 — SGP.02 Action [1=Scan] (spec=3)
5. target — Target Profile AID / ICCID / alias (only for actions ¾/5)

2.5 Security / PIN management

MANAGE-PIN [Args]

Interactive wizard (run_manage_pin_wizard):

1. action — [1=Verify, 2=Change, 3=Disable, 4=Enable, 5=Unblock]
2. pin_id — PIN ID [Hex, default 01]
3. curr — Enter PIN [ASCII] (action ≠ 5)
4. new — New PIN [ASCII] (action ∈ {2, 5})
5. puk — PUK [ASCII] (action = 5)

Non-interactive macro forms:

• MANAGE-PIN verify <pin_id> <pin>
• MANAGE-PIN change <pin_id> <curr> <new>
• MANAGE-PIN disable <pin_id> <curr>
• MANAGE-PIN enable <pin_id> <curr>
• MANAGE-PIN unblock <pin_id> <puk> <new>

2.6 Environment configuration

2.7 File system

REPORT → File System Reporting Wizard

1. choice — [1=Export FS to Disk (DUMP-FS), 2=Full YAML Report, 3=eUICC YAML, 4=Combined FS+eUICC YAML]
2. dest — Destination Directory [SKIP = default FS_DUMP] (choice=1)
3. yaml — YAML Filename [SKIP = default] (choice ∈ {2, 3, 4})
4. std — Target Standard [1=SGP.22, 2=SGP.32, 3=SGP.02] (choice ∈ {3, 4})
5. (choice=4 only) — free-form prompts: Enter ADM: (Skip if no) → Authenticate SD? (Y/N).

FS-ADMIN → ETSI File System Administration

1. action — [1=ACTIVATE, 2=DEACT, 3=SUSPEND, 4=SEARCH, 5=CREATE, 6=DELETE, 7=TERM DF, 8=TERM EF, 9=RESIZE]
2. target — Target FID / Path [SKIP for current / Suspend / Create]
3. search — Search string [Hex, SEARCH only]
4. create — Creation mode [1=Raw FCP, 2=Builder, SKIP for non-CREATE]
5. raw_fcp — Raw FCP Template [Hex, CREATE mode 1]
6. parent — Parent path [Hex, SKIP for current]
7. resize83 — FID for Resize (Tag 83) [Hex]
8. resize80 — New File Size (Tag 80) [Hex]
9. resize81 — New Total Size (Tag 81) [Hex]

When create=2 → ETSI TS 102 222 FCP Builder (_build_fcp_template):

1. type — File type [1=DF/ADF, 2=Transparent EF, 3=Linear Fixed EF]
2. path — Full path for new file [Hex]
3. sec — Security attribute TLV (Tag 8C / 8B / AB) [Hex]
4. size — File size / DF memory [Hex]
5. aid — ADF AID (Tag 84) [Hex, DF/EF skip]
6. c6 — PIN Status Template DO (Tag C6) [Hex, EF skip]
7. sfi — Short File Identifier [Hex, DF/none skip]
8. reclen — Record length [Hex, DF/Transparent skip]
9. numrec — Number of records [Hex, DF/Transparent skip]
10. prop — Proprietary Info (Tag A5) [Hex, SKIP to omit]

When the built file is an EF, an EF Initialization wizard asks upd [y/N]. On yes, EF Data Update appears:

• Transparent EF → t_data (max file_size bytes, hex)
• Linear Fixed EF → rec (record number) + l_data (max rec_len bytes, hex)

2.8 Gold profile and diffing

2.9 System & developer

2.10 STK sub-shell (STK → SCP03.interface.stk_shell.StkShell)

Opened by STK with no argument; accepts a semicolon batch when called as STK <commands>. Commands are handled by their upper-case keyword.

2.11 Argument-requirement classification

Enforced by CommandRegistry.get_arg_requirements:

• Mandatory argument (dispatcher errors out if absent): SET-AID-ALIAS, SELECT, UPDATE, LOCK, UNLOCK, DEL, SCRIPT, STORE-DATA, DECODE, DERIVE-OPC, SET-GOLD-PROFILE.
• Optional argument (handler called with or without tail): REPORT, KEYS, READ, RECORD, RUN, GUIDE, STK, DEBUG, VERBOSE, DUMP-FS, MANAGE-PIN, EXPORT-EUICC, EXPORT-KEYBAG, ARR, VALIDATE, GOLD-PROFILE, CLEAR-GOLD-PROFILE, PROFILE-DIFF.
• Everything else is called with no arguments; extra tokens are silently ignored.

Any line that starts with a pure-hex token routes to _exec_line → transport.transmit(line) and triggers auto-sync for A4 (SELECT), B0 (READ BINARY), B2 (READ RECORD), CA (GET DATA).

3. SCP80 — OTA Shell

python -m SCP80 / yggdrasim-scp80. Dispatcher: SCP80.cli.OtaShell. Command names registered as do_<lowercase>; runtime matching is case-insensitive.

3.1 Launcher flags

3.2 Commands

3.3 set <key> <value> — full key matrix

Strict validation in ConfigManager.set. Keys not in the table below are silently ignored.

Per-ICCID persistence covers cntr, header, spi, kic, kid, tar, key_enc, key_mac, cla, sender, concat_sms, tp_ud_max. payload, transport, reader_idx are module-level only.

4. SCP11 Live / Test consoles

python -m SCP11.live (yggdrasim-scp11-live), python -m SCP11.test (yggdrasim-scp11-test). Both consoles share the byte-identical _register_commands surface in SCP11/live/console.py and SCP11/test/console.py. python -m SCP11 delegates to the Live shell.

4.1 Launcher flags (Live, Test)

Env: SCP11_PINNED_HELP ∈ {1, true, yes, on} pins the command help pane to the top half of the terminal (TTY only, ≥24 rows).

4.2 Prompts / namespaces

4.3 HELP categories

Exact section titles emitted by the consoles:

• Relay Utilities
• LPAd
• IPAd
• IPAe
• Expert / Compatibility (only with HELP EXPERT / HELP ALL / HELP-ALL)

4.4 Relay Utilities

4.5 LPAd

4.6 IPAd

4.7 IPAe (plugin-injected)

Present only when the polling plugin is loaded. Host shells must call extend_target_with_plugins(self) (Live/Test constructors do).

Argument grammar (shared via yggdrasim_common.polling_plugin_support):

• Positional 1 → poll_attempts_per_fqdn.
• Positional 2 → timer_expiration_window_seconds.
• -t <n[s]> / --attempt-delay=<n> / --poll-delay=<n> / shorthand -Ns → poll_attempt_delay_seconds.
• -s <n> / --status-loops=<n> → poll_attempt_post_status_loops.
• --debug / -d / debug → debug mode.

4.8 Expert / Compatibility (HELP EXPERT / HELP-ALL only)

4.9 Flag reference (Live / Test)

--json / --yaml are (not in source) for Live/Test.

4.10 Divergences

Live ↔ Test: no semantic command differences. Housekeeping only — prompt string, module state name, inventory namespace, polling-surface key. No command exists in one shell and not the other. Test carries a dead-code _add_scaffold helper that is never called.

5. SCP11 Relay & top-level SCP11/console.py

python -m SCP11.relay (yggdrasim-scp11-relay) re-exports the standalone SCP11.console.SCP11Console. This is a narrower surface than Live/Test (no IPAe, no notification auto-sync, only two help sections).

5.1 Launcher flags

Same shape as Live/Test launchers (--debug, --flow, --cmd, --stdin). The relay launcher does not call ensure_plugins_loaded(), so the polling plugin never extends this shell — POLL / EIM-POLL are unavailable.

5.2 Prompt / namespace

5.3 HELP sections

Only two:

• Session & Utilities
• SGP.22 / SGP.32 Operations

5.4 Session & Utilities

5.5 SGP.22 / SGP.32 Operations

5.6 Commands present in Live/Test but not in Relay

RESET, HELP-ALL, CLEAR-NOTIFICATIONS, GET-ALL-DATA, POLL / EIM-POLL, METADATA alias for GET-METADATA, DOWNLOAD-PROFILE alias for DOWNLOAD-AC, DISCOVER alias for EIM-DISCOVER, DOWNLOAD alias for EIM-DOWNLOAD. No section-aware hidden / expert partitioning; no automatic notification sync.

6. SCP11 Local Access (python -m SCP11.local_access)

LocalAccessShell in SCP11/local_access/main.py. Prompt [Local SMDPP] >. Command registration lives in the module-level _COMMANDS / _COMMAND_ALIASES / _COMMAND_DOCS tables. --debug as a trailing token on any command enables per-call raw APDU logging via _extract_debug_flag.

6.1 Launcher flags

6.2 Session & Discovery

6.3 Profile state management

6.4 Metadata / ASN.1 runtime

6.5 File selection

6.6 Shell

6.7 Notification-sync callouts

Only LOAD-PROFILE triggers automatic notification sync in Local Access (run_load_profile_chain emits sync in the load loop and again in its finally block). EXPLAIN-LAST reports sync state but does not itself sync.

7. SCP11 Local eIM (python -m SCP11.eim_local)

EimLocalShell in SCP11/eim_local/main.py. Prompt [Local eIM] >. Commands are registered in __init__ via self._commands, self._command_aliases, self._command_docs.

7.1 Launcher flags

7.2 Local Profile Flow

7.3 Targets & Overrides

7.4 Localized Routing & Handover

7.5 eIM Packages & ISD-R

7.6 Queue Campaigns

7.7 Diagnostics & Runtime

7.8 Shell

7.9 Notification-sync callouts

Commands that automatically run _sync_pending_notifications (followed by load_notifications_synced = True):

• LOAD-PROFILE, IPAE-DOWNLOAD.
• EIM-PACKAGE-ISSUE, EIM-PACKAGE-ISSUE-ALL, HOTFOLDER-FETCH, POLL-CAMPAIGN, POLL-EXPORT — but only when the queued package is one of eim_package_result, euicc_package_result, ipa_euicc_data_response, profile_download_trigger_result, eim_acknowledgements.
• EIM-ACKNOWLEDGE (alias EIM-ACK).
• LOAD-EIM-PACKAGE on load-chain package types.

Commands that re-read BF55 without notification sync: ISDR-DELETE-EIM, ISDR-ADD-INITIAL-EIM, ISDR-ADD-EIM, EUICC-MEMORY-RESET, LOAD-EIM-PACKAGE (add/reset types).

7.10 --debug modifier semantics

EimLocalShell._execute_command_line strips --debug / -d unless the canonical command is in _commands_with_internal_debug_flags(): IPAD-LIVE, IPAD-TEST, IPAE-LIVE, IPAE-TEST. Those four keep the flag internal so their localized runner / polling plugin can parse it together with [matchingId] or [attempts] [timer-window] [-t 20s] [-s 5].

8. Tools.ProfilePackage — SAIP Tool Shell

python -m Tools.ProfilePackage / yggdrasim-profile-package. ProfilePackageShell in Tools/ProfilePackage/shell.py. Seeds Workspace/SAIP/profile and Workspace/SAIP/examples on startup. Preferences persisted in Workspace/SAIP/saip_tool_config.json.

8.1 Launcher flags

8.2 Shell commands

saip-tool resolution order: TOOL override → YGGDRASIM_SAIP_TOOL env → saip-tool.py / saip-tool on PATH → <workspace|bundle|module-root>/pysim/contrib/saip-tool.py. Subprocess timeout: 60 s (override via YGGDRASIM_SAIP_TOOL_TIMEOUT_SECONDS).

8.3 RAW — underlying saip-tool subcommands

8.4 OPEN picker TUI — saip_open_picker_tui.SaipOpenPickerApp

Filtering:

• Dotfiles hidden.
• Directories always shown (label DIR <name>/); first row is DIR ../ except at filesystem root.
• Files listed only if suffix ∈ {.bin, .der, .hex, .txt, .upp}.
• Directories sorted before files, case-insensitive.

Keybindings:

8.5 INSPECT TUI — saip_transcode_tui.run_saip_transcode_tui

Pane-mode cycle (_PANE_MODE_SEQUENCE): der, inspect, lint, none, decoded. Slot defaults: right=der, bottom_left=inspect, bottom_right=lint. Column sizes, pane modes, and theme persist to Tools/ProfilePackage/saip_transcode_tui_config.json.

Global keybindings

Mouse: tree double-click → jump JSON editor; tree right-click → context menu; DER double-click → jump DER↔JSON; split-handle drag → resize columns / rows.

PE block picker options: header, end, mf, telecom, cd, phonebook, gsm-access, df-5gs, eap, df-saip, df-snpn, df-5gprose, pinCodes, pukCodes, securityDomain, securityDomain_ssd, application, nonStandard, usim, opt-usim, isim, opt-isim, akaParameter, genericFileManagement. header / end / mf are at-most-once — blocked when already present.

8.6 Decoded edit modal — saip_decoded_edit.py

Global modal keybindings:

Three modal variants selected by editor_kind:

• ServiceTableEditorPicker (editor_kind=="service_table").
• StructuredDecodedFieldEditorPicker — kinds short_efid, byte_count, arr_reference, lcsi_state, fill_file_offset, file_id.
• DecodedValueEditorPicker — generic JSON textarea.

Supported decoded fields and validation (build_decoded_value_editor_model):

8.7 Placeholder syntax for GENERATE-*

Regex: {NAME} (default) or [NAME] when root JSON sets __ygg_placeholder_style__: "bracket". Names must match [A-Za-z][A-Za-z0-9_]*.

• GENERATE-TEMPLATE — only ICCID and IMSI accepted as typed injections. ICCID injects {ICCID} into header.iccid and {ICCID_EF} into every mf.ef-iccid fillFileContent. IMSI injects {IMSI} into every EF.IMSI fillFileContent.
• GENERATE-PROFILE — typed assignments derive hex encodings; unknown names become raw-hex overrides via normalize_raw_hex_token_value.
• GENERATE-BATCH — extension picks loader: .csv (header row), .json (list of objects), .jsonl/.ndjson (one per line), .yaml/.yml (list of mappings). ICCID implicitly supplies ICCID_EF; unknown placeholders fail the batch. Quote ICCID / IMSI in JSON / YAML to preserve leading zeros.

9. Tools.SuciTool — SUCI Key Shell

python -m Tools.SuciTool / yggdrasim-suci-tool. SuciToolShell in Tools/SuciTool/shell.py.

9.1 Launcher flags

9.2 Commands

suci-keytool resolution order: TOOL override → YGGDRASIM_SUCI_TOOL env → suci-keytool.py / suci-keytool on PATH. If none resolve: error "suci-keytool was not found. Install pySim suci-keytool or set YGGDRASIM_SUCI_TOOL."

Only two underlying suci-keytool subcommands are reachable from this shell: generate-key --curve {secp256r1, curve25519} and dump-pub-key [--compressed]. No RAW passthrough.

10. HIL Bridge daemons

Both binaries are non-interactive daemons — there is no shell and no command dispatcher. They run stand-alone or via the [B] HIL Bridge Session menu (§1.4).

10.1 yggdrasim-hil-bridge

Tools/HilBridge/main.py::entry. Signals: SIGTERM / SIGINT stop the server via an internal threading.Event. stdin is never read.

Environment variables consulted: YGGDRASIM_GLOBAL_DEBUG, PYTHONUNBUFFERED.

10.2 yggdrasim-hil-supervisor

Inherits every bridge runtime flag except --list-readers. Signals: SIGTERM / SIGINT → request_stop(); children escalated to SIGKILL after --termination-timeout.

10.3 Bridge flags forwarded to the child

HilBridgeSupervisor._build_bridge_command() composes <bridge_python> -m Tools.HilBridge.main plus:

[--debug]
--host <host>
--port <port>
--advertise-host <addr>
--apdu-relay-host <addr>
--apdu-relay-port <port>
--reader-index <n>
--reader-name <substring>
--client-id <n>
--client-slot <n>
--bank-id <n>
--bank-slot <n>
--bridge-name <name>
--bridge-software <name>
--bridge-version <version>
--gsmtap-host <host>
--gsmtap-port <port>
--gsmtap-compat <mode>
[--no-apdu-relay]
[--no-gsmtap]
[--gsmtap-capture-path <path>]

Not forwarded: --list-readers, --gsmtap-capture-mirror-fifo-path.

10.4 osmo-remsim-client-st2 flags forwarded

_build_remsim_command() always emits:

<remsim_binary> -i <host> -p <port> -c <client_id> -n <client_slot>

If none of ("-V","-P","-C","-I","-S","-A","-H") is already present in --remsim-arg, the supervisor auto-appends USB selectors:

-V 0x<vid> -P 0x<pid> -A <address> -C 1 -I 0 -S 0

Any --remsim-arg=<value> tokens are appended verbatim, allowing operators to inject -H, custom selectors, or bare switches.

10.5 Runtime files

• runtime/state/hil_bridge_supervisor.json — rewritten every _write_state() with status, reason, updatedAt, USB/bridge/ REMSIM running flags, PIDs and commands.
• runtime/state/hil_bridge_card_relay.json — written by the bridge; stale markers cleaned by the supervisor.

10.6 Offline pcap replay tooling

The decoded-APDU TUI doubles as an offline-review surface. Offline mode shares the same Tools.HilBridge.live_decode_tui.run_live_decode_tui entry point as live mode, but sets live_capture=False and feeds the capture via tshark -r instead of starting a FIFO / tshark -i child.

Keybag resolution order when no explicit --keybag is provided:

1. <pcap>.keys.json (path + .keys.json)
2. <stem>.keys.json (splitext + .keys.json)
3. none — ciphered APDUs stay wrapped in the TUI

Unwrapping is performed by Tools.HilBridge.scp_replay.ScpReplayEngine, which matches keybag entries by protocol (SCP03 / SCP11c) and AID against the SELECT history captured by LiveDecodeStateTracker. Matched APDUs gain a plaintext row in StatefulFrameAnnotation.context_lines.

Keybag files are produced by:

• EXPORT-KEYBAG in the SCP03 shell (§2.9)
• EXPORT-KEYBAG in SCP11 Local Access (§6.6)
• python -m SCP11.local_access --dump-keybag <path> (§6.1)

python -m SCP11.live --dump-keybag is the intentional no-op stub documented in §4.1 — live-mode BSP keys are derived inside the eUICC and never reach the host. - state/hil_termshark/live_capture.pcap and state/hil_termshark/{config,cache}/… — created by the launcher's [B] menu.

11. Plugin-injected commands

Plugins live under the runtime plugins/ directory (source tree during development, writable runtime path in frozen builds). ensure_plugins_loaded() discovers them; the launcher calls this on startup.

11.1 Discovery contract

• Sorted os.listdir(plugins_root); entries starting with . or _ skipped.
• <name>.py → synthetic module yggdrasim_plugin_<name>.
• <name>/__init__.py → synthetic module yggdrasim_plugin_<name>.
• Each module must export def register_plugins(manager).
• Per-module exceptions captured into PluginManager.load_errors() without aborting.

extend_target_with_plugins(target) calls manager.extend_target(target) plus every registered capability's extend_target(target) once per target (idempotent via a per-instance attribute).

11.2 Current plugin — plugins/polling_plugin.py

Registers capability polling → PollingCapability(). Dispatch rules:

Argument grammar (all three): yggdrasim_common.polling_plugin_support.parse_eim_local_ipae_options.

11.3 Capability contract for host shells

For Live / Test the plugin uses target._add_command(name, usage, description, handler, aliases=None, section=..., visible_in_help=True, trigger_notification_sync=False); the host console must expose:

• target._commands — dict keyed by canonical name.
• target._add_command(...) registration helper.
• target.HELP_SECTION_IPAE — section constant.
• target._cmd_eim_poll(self, argument) — pre-defined handler.

For eIM Local the plugin writes directly into the shell instance:

• target._commands (dict).
• target._command_docs (dict) — receives {"usage", "summary", "examples"} entries.
• target._plugin_path_sections — list for PATHS rendering.
• target._plugin_localized_help_rows — list for localized help rows.
• target._cmd_ipae_live / target._cmd_ipae_test — pre-defined handlers.

Runtime dispatch helpers in yggdrasim_common/polling_plugin_support.py:

• dispatch_poll_command(surface, command_name, target, argument) — routes to the capability.
• dispatch_poll_method(target, method_name, *args, **kwargs) — routes to polling-owned methods.
• install_poll_method_stubs(target_cls) — installs the 92-name POLLING_METHOD_NAMES forwarding stubs.
• require_polling_plugin() — raises with a helpful message when the plugin is absent.

See Plugin Contract for the formal spec.

12. Alphabetical index

The quickest way to find a command is the in-browser search or in-doc find (Ctrl+F). Every canonical command is listed once in the tables above. When the same name appears in multiple shells it means the surfaces intentionally mirror each other so operators can move between Live, Test, Local Access, and Local eIM without re-learning the prompt.