Index: src/cgi.c
==================================================================
--- src/cgi.c
+++ src/cgi.c
@@ -460,15 +460,15 @@
 */
 void cgi_replace_parameter(const char *zName, const char *zValue){
   int i;
   for(i=0; i<nUsedQP; i++){
     if( fossil_strcmp(aParamQP[i].zName,zName)==0 ){
-      aParamQP[i].zValue = mprintf("%s",zValue);
+      aParamQP[i].zValue = zValue;
       return;
     }
   }
-  cgi_set_parameter_nocopy(zName, mprintf("%s",zValue), 0);
+  cgi_set_parameter_nocopy(zName, zValue, 0);
 }
 
 /*
 ** Add a query parameter.  The zName portion is fixed but a copy
 ** must be made of zValue.
@@ -1391,11 +1391,11 @@
   for(i=0; zToken[i] && zToken[i]!='?'; i++){}
   if( zToken[i] ) zToken[i++] = 0;
   if( nCycles==0 ){
     cgi_setenv("PATH_INFO", zToken);
   }else{
-    cgi_replace_parameter("PATH_INFO", zToken);
+    cgi_replace_parameter("PATH_INFO", mprintf("%s",zToken));
   }
  
   /* Get all the optional fields that follow the first line.
   */
   while( fgets(zLine,sizeof(zLine),g.httpIn) ){

Index: src/clone.c
==================================================================
--- src/clone.c
+++ src/clone.c
@@ -90,29 +90,27 @@
 ** URL must be in one of the following form: ([...] mean optional)
 **   HTTP/HTTPS protocol:
 **     http[s]://[userid[:password]@]host[:port][/path]
 **
 **   SSH protocol:
-**     ssh://[userid[:password]@]host[:port]/path/to/repo.fossil
+**     ssh://[userid[:password]@]host[:port]/path/to/repo.fossil\\
+**     [?fossil=path/to/fossil.exe]
 **
 **   Filesystem:
 **     [file://]path/to/repo.fossil
 **
 **   Note: For ssh and filesystem, path must have an extra leading 
 **         '/' to use an absolute path.
 **
-**   Note: the userid for SSH is the SSH account, not the Fossil account.
-**
 ** By default, your current login name is used to create the default
 ** admin user. This can be overridden using the -A|--admin-user
 ** parameter.
 **
 ** Options:
 **    --admin-user|-A USERNAME   Make USERNAME the administrator
 **    --private                  Also clone private branches 
 **    --ssl-identity=filename    Use the SSL identity if requested by the server
-**    --ssh-fossil|-f /fossil    Use this path as remote fossil command
 **    --ssh-command|-c 'command' Use this SSH command
 **    --ssh-fossil-user|-l user  Fossil user to use for SSH if different.
 **
 ** See also: init
 */
@@ -199,18 +197,13 @@
 
 /*
 ** Look for SSH clone command line options and setup in globals.
 */
 void clone_ssh_find_options(void){
-  const char *zSshFossilCmd;  /* Path to remote fossil command for SSH */
   const char *zSshCmd;        /* SSH command string */
   const char *zFossilUser;    /* Fossil user if login specified for SSH */
 
-  zSshFossilCmd = find_option("ssh-fossil","f",1);
-  if( zSshFossilCmd && zSshFossilCmd[0] ){
-    g.zSshFossilCmd = mprintf("%s", zSshFossilCmd);
-  }
   zSshCmd = find_option("ssh-command","c",1);
   if( zSshCmd && zSshCmd[0] ){
     g.zSshCmd = mprintf("%s", zSshCmd);
   }
   zFossilUser = find_option("ssh-fossil-user","l",1);
@@ -222,15 +215,12 @@
 /*
 ** Set SSH options discovered in global variables (set from command line 
 ** options).
 */
 void clone_ssh_db_set_options(void){
-  if( g.zSshFossilCmd && g.zSshFossilCmd[0] ){
-    db_set("ssh-fossil", g.zSshFossilCmd, 0);
-  }
   if( g.zSshCmd && g.zSshCmd[0] ){
     db_set("ssh-command", g.zSshCmd, 0);
   }
   if( g.zFossilUser && g.zFossilUser[0] ){
     db_set("ssh-fossil-user", g.zFossilUser, 0);
   }
 }

Index: src/db.c
==================================================================
--- src/db.c
+++ src/db.c
@@ -2136,11 +2136,10 @@
   { "proxy",         0,               32, 0, "off"                 },
   { "relative-paths",0,                0, 0, "on"                  },
   { "repo-cksum",    0,                0, 0, "on"                  },
   { "self-register", 0,                0, 0, "off"                 },
   { "ssh-command",   0,               40, 0, ""                    },
-  { "ssh-fossil",    0,               40, 0, ""                    },
   { "ssl-ca-location",0,              40, 0, ""                    },
   { "ssl-identity",  0,               40, 0, ""                    },
 #ifdef FOSSIL_ENABLE_TCL
   { "tcl",           0,                0, 0, "off"                 },
   { "tcl-setup",     0,               40, 0, ""                    },
@@ -2308,12 +2307,10 @@
 **                     users can not be deleted. Default: off.
 **
 **    ssh-command      Command used to talk to a remote machine with
 **                     the "ssh://" protocol.
 **
-**    ssh-fossil       Remote fossil command to run with the "ssh://" protocol.
-**
 **    ssl-ca-location  The full pathname to a file containing PEM encoded
 **                     CA root certificates, or a directory of certificates
 **                     with filenames formed from the certificate hashes as
 **                     required by OpenSSL.
 **                     If set, this will override the OS default list of

Index: src/http_transport.c
==================================================================
--- src/http_transport.c
+++ src/http_transport.c
@@ -91,19 +91,17 @@
 int transport_ssh_open(void){
   /* For SSH we need to create and run SSH fossil http 
   ** to talk to the remote machine.
   */
   static int fPrintSshCmd = 1;  /* Print SSH command only once */
-  const char *zSshFossilCmd;    /* Path to fossil on remote host */
   const char *zSsh;  /* The base SSH command */
   Blob zCmd;         /* The SSH command */
   char *zHost;       /* The host name to contact */
   int n;             /* Size of prefix string */
 
   socket_ssh_resolve_addr();
   zSsh = db_get("ssh-command", zDefaultSshCmd);
-  zSshFossilCmd = db_get("ssh-fossil", "fossil");
   blob_init(&zCmd, zSsh, -1);
   if( g.urlPort!=g.urlDfltPort && g.urlPort ){
 #ifdef __MINGW32__
     blob_appendf(&zCmd, " -P %d", g.urlPort);
 #else
@@ -121,11 +119,11 @@
   }
   n = blob_size(&zCmd);
   blob_append(&zCmd, " ", 1);
   shell_escape(&zCmd, zHost);
   blob_append(&zCmd, " ", 1);
-  shell_escape(&zCmd, mprintf("%s", zSshFossilCmd));
+  shell_escape(&zCmd, mprintf("%s", g.urlFossil));
   if( url_ssh_use_http() ){
     blob_append(&zCmd, " http", 5);
   }else{
     blob_append(&zCmd, " test-http", 10);
   }

Index: src/json.c
==================================================================
--- src/json.c
+++ src/json.c
@@ -1307,10 +1307,11 @@
   CSTR(g, urlPath);
   CSTR(g, urlUser);
   CSTR(g, urlPasswd);
   CSTR(g, urlCanonical);
   CSTR(g, urlProxyAuth);
+  CSTR(g, urlFossil);
   CSTR(g, zLogin);
   CSTR(g, zSSLIdentity);
   CSTR(g, zIpAddr);
   CSTR(g, zNonce);
   CSTR(g, zCsrfToken);

Index: src/main.c
==================================================================
--- src/main.c
+++ src/main.c
@@ -136,11 +136,10 @@
   int fQuiet;             /* True if -quiet flag is present */
   int fHttpTrace;         /* Trace outbound HTTP requests */
   int fSystemTrace;       /* Trace calls to fossil_system(), --systemtrace */
   int fSshTrace;          /* Trace the SSH setup traffic */
   int fSshClient;         /* HTTP client flags for SSH client */
-  char *zSshFossilCmd;    /* Path to remoe fossil command for SSH */
   char *zSshCmd;          /* SSH command string */
   char *zFossilUser;      /* Fossil user if different from URL user */
   int fNoSync;            /* Do not do an autosync ever.  --nosync */
   char *zPath;            /* Name of webpage being served */
   char *zExtra;           /* Extra path information past the webpage name */
@@ -179,10 +178,11 @@
   char *urlPath;          /* Pathname for http: */
   char *urlUser;          /* User id for http: */
   char *urlPasswd;        /* Password for http: */
   char *urlCanonical;     /* Canonical representation of the URL */
   char *urlProxyAuth;     /* Proxy-Authorizer: string */
+  char *urlFossil;        /* The fossil query parameter on ssh: */
   unsigned urlFlags;      /* Boolean flags controlling URL processing */
 
   const char *zLogin;     /* Login name.  "" if not logged in. */
   const char *zSSLIdentity;  /* Value of --ssl-identity option, filename of
                              ** SSL client identity */
@@ -585,11 +585,10 @@
     g.fSqlTrace = find_option("sqltrace", 0, 0)!=0;
     g.fSqlStats = find_option("sqlstats", 0, 0)!=0;
     g.fSystemTrace = find_option("systemtrace", 0, 0)!=0;
     g.fSshTrace = find_option("sshtrace", 0, 0)!=0;
     g.fSshClient = 0;
-    g.zSshFossilCmd = 0;
     g.zSshCmd = 0;
     g.zFossilUser = 0;
     if( g.fSqlTrace ) g.fSqlStats = 1;
     g.fSqlPrint = find_option("sqlprint", 0, 0)!=0;
     g.fHttpTrace = find_option("httptrace", 0, 0)!=0;

Index: src/url.c
==================================================================
--- src/url.c
+++ src/url.c
@@ -64,11 +64,11 @@
 **
 **     http://userid:password@host:port/path
 **
 ** SSH url format is:
 **
-**     ssh://userid:password@host:port/path
+**     ssh://userid:password@host:port/path?fossil=path/to/fossil.exe
 **
 */
 void url_parse(const char *zUrl, unsigned int urlFlags){
   int i, j, c;
   char *zFile = 0;
@@ -107,10 +107,11 @@
       iStart = 8;
     }else if( zUrl[0]=='s' ){
       g.urlIsSsh = 1;
       g.urlProtocol = "ssh";
       g.urlDfltPort = 22;
+      g.urlFossil = "fossil";
       iStart = 6;
     }else{
       g.urlIsHttps = 0;
       g.urlProtocol = "http";
       g.urlDfltPort = 80;
@@ -157,21 +158,44 @@
     for(i=0; g.urlPath[i] && g.urlPath[i]!='?'; i++){}
     if( g.urlPath[i] ){
       g.urlPath[i] = 0;
       i++;
     }
+    zExe = mprintf("");
+    while( g.urlPath[i]!=0 ){
+      char *zName, *zValue;
+      zName = &g.urlPath[i];
+      zValue = zName;
+      while( g.urlPath[i] && g.urlPath[i]!='=' ){ i++; }
+      if( g.urlPath[i]=='=' ){
+        g.urlPath[i] = 0;
+        i++;
+        zValue = &g.urlPath[i];
+        while( g.urlPath[i] && g.urlPath[i]!='&' ){ i++; }
+      }
+      if( g.urlPath[i] ){
+        g.urlPath[i] = 0;
+        i++;
+      }
+      if( fossil_strcmp(zName,"fossil")==0 ){
+        g.urlFossil = zValue;
+        dehttpize(g.urlFossil);
+        zExe = mprintf("%cfossil=%T", cQuerySep, g.urlFossil);
+        cQuerySep = '&';
+      }
+    }
 
     dehttpize(g.urlPath);
     if( g.urlDfltPort==g.urlPort ){
       g.urlCanonical = mprintf(
-        "%s://%s%T%T", 
-        g.urlProtocol, zLogin, g.urlName, g.urlPath
+        "%s://%s%T%T%s", 
+        g.urlProtocol, zLogin, g.urlName, g.urlPath, zExe
       );
     }else{
       g.urlCanonical = mprintf(
-        "%s://%s%T:%d%T",
-        g.urlProtocol, zLogin, g.urlName, g.urlPort, g.urlPath
+        "%s://%s%T:%d%T%s",
+        g.urlProtocol, zLogin, g.urlName, g.urlPort, g.urlPath, zExe
       );
     }
     if( g.urlIsSsh && g.urlPath[1] ) g.urlPath++;
     free(zLogin);
   }else if( strncmp(zUrl, "file:", 5)==0 ){
@@ -254,10 +278,11 @@
     fossil_print("g.urlHostname  = %s\n", g.urlHostname);
     fossil_print("g.urlPath      = %s\n", g.urlPath);
     fossil_print("g.urlUser      = %s\n", g.urlUser);
     fossil_print("g.urlPasswd    = %s\n", g.urlPasswd);
     fossil_print("g.urlCanonical = %s\n", g.urlCanonical);
+    fossil_print("g.urlFossil    = %s\n", g.urlFossil);
     fossil_print("g.urlFlags     = 0x%02x\n", g.urlFlags);
     if( g.urlIsFile || g.urlIsSsh ) break;
     if( i==0 ){
       fossil_print("********\n");
       url_enable_proxy("Using proxy: ");