SSH

Saved SSH hosts support password, private key (with optional passphrase), and vault-credential auth. Setting auth_method=vault resolves at connect time via App.resolveCredentials, so the credential ID lives on the host but the secret never does.

Jump-host chains

Set jump_host_id on a connection and the SSH manager dials through that saved host’s session before opening yours. Chains can nest — a bastion → jump → target works as long as each hop is a saved connection.

Agent forwarding

Works when the connecting OS has SSH_AUTH_SOCK set. The manager forwards that socket end-to-end so a remote git pull uses your local key.

Snippets

A right-click on a saved host or an open terminal opens the snippet panel. Click to paste; {{var}} references substitute from the host’s metadata ({{host}}, {{user}}, custom tags).

Health subtab

Every SSH session tab has Terminal | Health subtabs. The Health pane runs uname / uptime / free / df / systemctl --failed / journalctl in one shell round-trip and renders the results as a card grid — load average, free memory, disk usage by mount, failed units, recent journal lines. Magellan-attach has Explain and Suggest-next-steps presets.

If the host is a container — Docker, LXC, kubepods, Podman — Health detects it and shows a badge next to the hostname. The systemd / journalctl cards stay empty in that case (containers don’t run their own systemd) and the badge tells you why instead of the panel looking broken.

SFTP file browser

Right-click any remote file in the SFTP pane:

• View / Edit — in-app text editor (5 MB cap), preserves file mode on save
• Diff against local — side-by-side line diff against a chosen local file
• Permissions — rwx checkbox grid with the octal mode mirrored alongside
• Tail in Log Viewer — opens a new Log Viewer tab pre-filled with this path
• Download / Delete (two-click confirm)

Right-click an empty area: New file… / New folder… / Refresh.

Tunnel Manager

Local port forwards open through this session show up in Tools → Tunnel Manager alongside every other active session. Add or tear down forwards there without reopening connection settings.