code: def _open_shell(
      sess: api.Session,
      master: str,
      shell: Dict[str, Any],
      additional_opts: List[str],
      retain_keys_and_print: bool,
      print_only: bool,
  ) -> None:
      cli.wait_ntsc_ready(sess, api.NTSC_Kind.shell, shell["id"])
  
      cache_dir = None
      if retain_keys_and_print:
          cache_dir = (
              Path(appdirs.user_cache_dir("determined"))
              / "shell"
              / shell["id"]
          )
          if not cache_dir.exists():
              cache_dir.mkdir(parents=True)
  
      f, keypath = _prepare_key(cache_dir)
      with f as keyfile:
          keyfile.write(shell["privateKey"])
          keyfile.flush()
  
          # Use determined.cli.tunnel as a portable script for using the HTTP CONNECT mechanism,
          # similar to `nc -X CONNECT -x ...` but without any dependency on external binaries.
          proxy_cmd = (
              f"{sys.executable} -m determined.cli.tunnel {master} %h"
          )
  
          cert_bundle_path = _prepare_cert_bundle(cache_dir)
          if cert_bundle_path is False:
              proxy_cmd += " --cert-file noverify"
          elif isinstance(cert_bundle_path, str):
              proxy_cmd += f' --cert-file "{cert_bundle_path}"'
          elif cert_bundle_path is not None:
              raise RuntimeError(
                  f"unexpected cert_bundle_path ({cert_bundle_path}) "
                  f"of type ({type(cert_bundle_path).__name__})"
              )
  
          cert = certs.cli_cert
          assert cert is not None, "cli_cert was not configured"
          if cert.name:
              proxy_cmd += f' --cert-name "{cert.name}"'
  
          username = shell["agentUserGroup"]["user"] or "root"
  
          unixy_keypath = str(keypath)
          if sys.platform == "win32":
              # Convert the backslashes of the -i argument to ssh to forwardslashes.  This is
              # important because when passing the output of ssh_show_command to VSCode, VSCode would
              # put backslashes in .ssh/config, which would not be handled correctly by ssh.  When
              # invoking ssh directly, it behaves the same whether -i has backslashes or not.
              unixy_keypath = unixy_keypath.replace("\\", "/")
  
          cmd = [
              "ssh",
              "-o",
              f"ProxyCommand={proxy_cmd}",
              "-o",
              "StrictHostKeyChecking=no",
              "-tt",
              "-o",
              "IdentitiesOnly=yes",
              "-i",
              unixy_keypath,
              f"{username}@{shell['id']}",
              *additional_opts,
          ]
  
          if retain_keys_and_print:
              print(colored(subprocess.list2cmdline(cmd), "green"))
              if print_only:
                  return
  
          subprocess.run(cmd)
  
          print(
              colored(
                  f"To reconnect, run: det shell open {shell['id']}",
                  "green",
              )
          )
  
imports: import argparse
  import contextlib
  import getpass
  import os
  import platform
  import shutil
  import subprocess
  import sys
  import tempfile
  from functools import partial
  from pathlib import Path
  from typing import IO, Any, ContextManager, Dict, Iterator, List, Tuple, Union, cast
  import appdirs
  from termcolor import colored
  from determined import cli
  from determined.cli import ntsc, render, task
  from determined.common import api
  from determined.common.api import authentication, bindings, certs
  from determined.common.declarative_argparse import Arg, ArgsDescription, Cmd, Group
label_desc: Use image node_id 7 for calling a global function with example usage: _open_shell(sess, master, shell, additional_opts, retain_keys_and_print, print_only) without return types