fix(cli)!: restore OpenSSH short flag semantics

.gitignore

@@ -23,6 +23,7 @@ Thumbs.db
 /output/
 .bssh/
 *.md
+!docs/openssh-short-flags-migration.md
 .claude/
 .gemini/
 references/

docs/README.md

@@ -39,6 +39,7 @@ Welcome to the bssh documentation. This documentation covers both the bssh clien
 
 | Document | Description |
 |----------|-------------|
+| [OpenSSH Short Flags for 3.0](./openssh-short-flags-migration.md) | Rewriting bssh scripts for the seven reassigned short options |
 | [pdsh Migration](./pdsh-migration.md) | Migrating from pdsh to bssh |
 | [pdsh Examples](./pdsh-examples.md) | pdsh-style command examples |
 | [pdsh Options](./pdsh-options.md) | pdsh option compatibility |
@@ -115,7 +116,7 @@ bssh user@host
 bssh -H host1,host2,host3 'uptime'
 
 # Using clusters
-bssh -C mycluster 'hostname'
+bssh --cluster mycluster 'hostname'
 ```
 
 ### bssh-server

docs/architecture/cli-interface.md

@@ -90,7 +90,7 @@ The `looks_like_host_specification` function uses the following detection patter
 
 - Detection happens BEFORE mode determination (`is_ssh_mode`)
 - Auto-sets `cli.cluster` to `"bai_auto"` when Backend.AI environment variables are present
-- Only activates when no explicit cluster (`-C`) or hosts (`-H`) specified
+- Only activates when no explicit cluster (`--cluster`) or hosts (`-H`) specified
 - Skips auto-detection if destination contains host indicators
 - Prevents commands from being misinterpreted as hostnames in SSH mode
 - Respects explicit user configuration over auto-detection

docs/architecture/executor.md

@@ -68,7 +68,7 @@ The executor supports two modes for handling Ctrl+C (SIGINT) signals during para
 3. **Time window reset**: If >1 second passes, next Ctrl+C restarts the sequence and shows status again
 4. Provides users visibility into execution progress before termination
 
-### Batch Mode (`--batch` / `-b`)
+### Batch Mode (`--batch`)
 
 - **Single Ctrl+C**: Immediately terminates all jobs with exit code 130
 - Optimized for non-interactive environments (CI/CD, scripts)
@@ -156,7 +156,9 @@ The batch flag is passed through the executor chain:
 
 ## Fail-Fast Mode
 
-The `--fail-fast` / `-k` option enables immediate termination when any node fails. This is compatible with pdsh's `-k` flag and useful for:
+The `--fail-fast` option enables immediate termination when any node fails. In
+pdsh compatibility mode, the equivalent spelling is `-k`. This behavior is
+useful for:
 - Critical operations where partial execution is unacceptable
 - Deployment scripts where all nodes must succeed
 - Validation checks across clusters

docs/architecture/ssh-client.md

@@ -279,7 +279,7 @@ src/executor/
 **Stream Mode:**
 ```bash
 # Real-time streaming output
-bssh -C production --stream "tail -f /var/log/app.log"
+bssh --cluster production --stream "tail -f /var/log/app.log"
 
 # With filtering
 bssh -H "web*" --stream "systemctl status nginx"
@@ -288,7 +288,7 @@ bssh -H "web*" --stream "systemctl status nginx"
 **File Mode:**
 ```bash
 # Save outputs to directory
-bssh -C cluster --output-dir ./results "ps aux"
+bssh --cluster cluster --output-dir ./results "ps aux"
 
 # Each node gets separate files with timestamps
 ls ./results/
@@ -666,7 +666,7 @@ Comprehensive test coverage including:
 **Status:** Implemented
 
 **Overview:**
-The sudo password module provides secure handling of sudo authentication for commands that require elevated privileges. When enabled with the `-S` flag, bssh automatically detects sudo password prompts in command output and injects the password without user intervention.
+The sudo password module provides secure handling of sudo authentication for commands that require elevated privileges. When enabled with `--sudo-password`, bssh automatically detects sudo password prompts in command output and injects the password without user intervention.
 
 **Architecture Components:**
 
@@ -749,7 +749,7 @@ pub async fn execute_with_sudo(
 - Environment variable option (`BSSH_SUDO_PASSWORD`) with security warnings
 
 **Execution Path Integration:**
-1. CLI flag `-S/--sudo-password` triggers password prompt
+1. CLI flag `--sudo-password` triggers password prompt
 2. Password wrapped in `Arc<SudoPassword>` for sharing across nodes
 3. `ExecutionConfig` carries optional `sudo_password` field
 4. Both streaming and non-streaming execution paths support sudo
@@ -758,14 +758,14 @@ pub async fn execute_with_sudo(
 **Usage Patterns:**
 ```bash
 # Basic usage - prompts for password before execution
-bssh -S -C production "sudo apt update"
+bssh --sudo-password --cluster production "sudo apt update"
 
 # Combined with SSH agent authentication
-bssh -A -S -C production "sudo systemctl restart nginx"
+bssh --use-agent --sudo-password --cluster production "sudo systemctl restart nginx"
 
 # Environment variable (not recommended)
 export BSSH_SUDO_PASSWORD="password"
-bssh -S -C production "sudo apt update"
+bssh --sudo-password --cluster production "sudo apt update"
 ```
 
 **Limitations:**

docs/architecture/ssh-jump-hosts.md

@@ -83,11 +83,11 @@ bssh -J "user@[::1]:2222" -H target "command"
 
 # File transfer through jump hosts
 bssh -J bastion.example.com -H internal upload app.tar.gz /opt/
-bssh -J "jump1,jump2" -C production download /etc/config ./backups/
+bssh -J "jump1,jump2" --cluster production download /etc/config ./backups/
 
 # Interactive mode through jump hosts
 bssh -J bastion.example.com user@internal-server
-bssh -J "jump1,jump2" -C production interactive
+bssh -J "jump1,jump2" --cluster production interactive
 ```
 
 ### Completed Features