more than one (instance) host is involved in this command, t

Error message

more than one (instance) host is involved in this command, this is only supported for openSSH v8.0 or higher

What it means

scp's legacy (pre-OpenSSH 8.0) protocol cannot combine multiple remote hosts with the -3 (third-party copy through the local host) option used by Command. The library therefore rejects commands that involve more than one instance host when the resolved scp/ssh is older than OpenSSH 8.0.

Source

Thrown at pkg/copytool/scp.go:91

	}
	legacySSH := sshutil.DetectOpenSSHVersion(ctx, sshExeForVersion).LessThan(*semver.New("8.0.0"))

	for _, cp := range copyPaths {
		if cp.IsRemote {
			if legacySSH {
				scpFlags = append(scpFlags, "-P", fmt.Sprintf("%d", cp.Instance.SSHLocalPort))
				scpArgs = append(scpArgs, fmt.Sprintf("%s:%s", *cp.Instance.Config.User.Name+"@"+cp.Instance.SSHAddress, cp.Path))
			} else {
				scpArgs = append(scpArgs, fmt.Sprintf("scp://%s:%d/%s", *cp.Instance.Config.User.Name+"@"+cp.Instance.SSHAddress, cp.Instance.SSHLocalPort, cp.Path))
			}
			instances[cp.InstanceName] = cp.Instance
		} else {
			scpArgs = append(scpArgs, cp.Path)
		}
	}

	if legacySSH && len(instances) > 1 {
		return nil, errors.New("more than one (instance) host is involved in this command, this is only supported for openSSH v8.0 or higher")
	}

	scpFlags = append(scpFlags, "-3", "--")
	scpArgs = append(scpFlags, scpArgs...)

	var sshOpts []string
	if len(instances) == 1 {
		// Only one (instance) host is involved; we can use the instance-specific
		// arguments such as ControlPath.  This is preferred as we can multiplex
		// sessions without re-authenticating (MaxSessions permitting).
		for _, inst := range instances {
			sshExe, err := sshutil.NewSSHExe()
			if err != nil {
				return nil, err
			}
			sshOpts, err = sshutil.SSHOpts(ctx, sshExe, inst.Dir, *inst.Config.User.Name, false, false, false, false)
			if err != nil {
				return nil, err

View on GitHub (pinned to dd909d0973)

Solutions

Upgrade OpenSSH on the host to 8.0 or higher so multi-host -3 copies are supported.
Restrict the command to a single instance host per invocation.
Use rsync backend instead, which supports multi-host copies on older ssh versions.

Example fix

// before (OpenSSH 7.4 host)
limactl cp instA:file instB:file
// after: upgrade openssh, or copy in two steps
// limactl cp instA:file ./file
// limactl cp ./file instB:file

Defensive patterns

Strategy: validation

Validate before calling

out, err := exec.Command("ssh", "-V").CombinedOutput()
// parse e.g. "OpenSSH_7.4"; if major < 8, avoid multi-instance cp

Try / catch

args, err := scpTool.Command(ctx, ...)
if err != nil && strings.Contains(err.Error(), "openSSH v8.0 or higher") {
    // degrade: split the copy into per-instance steps
}
return err

Prevention

Keep host OpenSSH at >= 8.0 (check with ssh -V).
Restrict multi-instance copies to environments where OpenSSH >= 8.0 is guaranteed.
Prefer rsync backend for multi-host transfers on legacy hosts.

When it happens

Trigger: Calling Command on an scpTool whose legacySSH flag is true (ssh version < 8.0 detected or version detection failed) while the command involves more than one instance (copying between two guests, or host-to-guest-to-host with multiple hosts).

Common situations: Older LTS distros (e.g. CentOS 7, Ubuntu 16.04) shipping OpenSSH 7.x where users attempt multi-instance `limactl cp` operations.

Related errors

scp not found on host: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/80b9fd08e5cf9d97. Report an issue: GitHub.