internal/ssh/, app.go::SSHConnect / SSHConnectWithVault SSH
Key + password + jump-host chains + agent forwarding. Saved hosts, vault auto-fill, snippets.
Saved SSH hosts support password, private key (with optional passphrase), and vault-credential auth. Setting auth_method=vault resolves at connect time via App.resolveCredentials, so the credential ID lives on the host but the secret never does.
Jump-host chains
Set jump_host_id on a connection and the SSH manager dials through that saved host’s session before opening yours. Chains can nest — a bastion → jump → target works as long as each hop is a saved connection.
Agent forwarding
Works when the connecting OS has SSH_AUTH_SOCK set. The manager forwards that socket end-to-end so a remote git pull uses your local key.
Snippets
A right-click on a saved host or an open terminal opens the snippet panel. Click to paste; {{var}} references substitute from the host’s metadata ({{host}}, {{user}}, custom tags).