feature: ProxyJump - stable v2.1.0

Author: madLinux7

.github/workflows/scoop.yml

@@ -0,0 +1,90 @@
+name: Update Scoop Bucket
+
+on:
+  release:
+    types: [published]
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v1.0.0)"
+        required: true
+
+jobs:
+  scoop:
+    if: github.server_url == 'https://github.com' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get release info
+        id: release
+        run: |
+          TAG="${{ github.event.release.tag_name || github.event.inputs.tag || github.event.workflow_run.head_branch }}"
+          VERSION="${TAG#v}"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Download Windows binary and compute checksum
+        id: checksum
+        run: |
+          TAG="${{ steps.release.outputs.tag }}"
+          BASE="https://github.com/madLinux7/dssh/releases/download/${TAG}"
+          curl -sL "${BASE}/dssh.exe" -o dssh.exe
+          if [ ! -s dssh.exe ]; then
+            echo "Failed to download dssh.exe from ${BASE}"
+            exit 1
+          fi
+          echo "sha256=$(sha256sum dssh.exe | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout scoop-bucket
+        uses: actions/checkout@v4
+        with:
+          repository: madLinux7/scoop-bucket
+          token: ${{ secrets.SCOOP_TOKEN }}
+
+      - name: Update manifest
+        run: |
+          VERSION="${{ steps.release.outputs.version }}"
+          TAG="${{ steps.release.outputs.tag }}"
+          SHA="${{ steps.checksum.outputs.sha256 }}"
+          URL="https://github.com/madLinux7/dssh/releases/download/${TAG}/dssh.exe"
+
+          cat > bucket/dssh.json << MANIFEST
+          {
+            "version": "${VERSION}",
+            "description": "The only SSH connection manager you'll ever need. TUI & CLI. ssh_config, SQLite or both.",
+            "homepage": "https://github.com/madLinux7/dssh",
+            "license": "MIT",
+            "architecture": {
+              "64bit": {
+                "url": "${URL}",
+                "hash": "${SHA}"
+              }
+            },
+            "bin": "dssh.exe",
+            "checkver": "github",
+            "autoupdate": {
+              "architecture": {
+                "64bit": {
+                  "url": "https://github.com/madLinux7/dssh/releases/download/v\$version/dssh.exe"
+                }
+              }
+            }
+          }
+          MANIFEST
+
+          # Remove leading whitespace from heredoc
+          sed -i 's/^          //' bucket/dssh.json
+
+      - name: Commit and push
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add bucket/dssh.json
+          if git diff --cached --quiet; then
+            echo "Manifest already up to date. Nothing to commit."
+          else
+            git commit -m "Update dssh to ${{ steps.release.outputs.version }}"
+            git push
+          fi

.github/workflows/winget.yml

@@ -0,0 +1,20 @@
+name: Update WinGet Package
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  winget:
+    name: Update winget-pkgs manifest
+    if: github.server_url == 'https://github.com'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Update Package
+        uses: michidk/winget-updater@v1
+        with:
+          komac-token: ${{ secrets.KOMAC_TOKEN }}
+          identifier: madLinux.dssh
+          repo: madLinux7/dssh
+          url: "https://github.com/madLinux7/dssh/releases/download/v{VERSION}/dssh.exe"

README.md

@@ -14,6 +14,8 @@ Store connections in **SQLite**, your **ssh_config** file, or **both** — your
 
 Passwords are encrypted using a master passphrase (_you should consider using pubkeys only tho ;))_.
 
+📚 **Full docs:** [dssh.grolmes.com](https://dssh.grolmes.com)
+
 <p align="center">
   <img src="demo_tabs.gif" alt="dssh tab navigation"><br>
   <sub>TUI navigation demo</sub>
@@ -59,6 +61,8 @@ Passwords are encrypted using a master passphrase (_you should consider using pu
   - [From GitHub Releases](#from-github-releases)
   - [From source](#from-source)
   - [Build locally](#build-locally)
+- [Documentation](#documentation)
+- [Contributing](#contributing)
 - [Acknowledgements](#-acknowledgements-)
 
 ## Features
@@ -82,11 +86,27 @@ Also:
 
 dssh is a thin wrapper around your system's `ssh` binary:
 
+```text
+  ┌──────────────┐   read/write    ┌──────────────────────┐
+  │  dssh (CLI   │◄───────────────►│  ~/.dssh/dssh.db     │
+  │   or TUI)    │                 │   • connections      │
+  └──────┬───────┘                 │   • encrypted passes │
+         │                         └──────────────────────┘
+         │  key auth: syscall.Exec → ssh  (zero overhead)
+         │  pw auth:  fork ssh + SSH_ASKPASS script
+         ▼
+  ┌──────────────┐
+  │     ssh      │────► remote host
+  └──────────────┘
+```
+
 - **Key auth** — `syscall.Exec` replaces the dssh process with ssh (zero overhead, full terminal control)
 - **Password auth** — ssh runs as a child process with `SSH_ASKPASS` to supply the decrypted password (no `sshpass` needed)
 - **Data** — connections stored in SQLite (`~/.dssh/dssh.db`), your `ssh_config` file, or both
 - **Crypto** — AES-256-GCM encryption with Argon2id key derivation for stored passwords
 
+More on the [security model](https://dssh.grolmes.com/guides/security/) and [configuration](https://dssh.grolmes.com/reference/config/) in the docs.
+
 ## Connection Modes
 
 On first launch, dssh asks you to choose a connection mode:
@@ -119,7 +139,7 @@ Change your mode anytime with `dssh config`. View current settings with `dssh co
 | `dssh` | Launch interactive connection picker |
 | `dssh <name>` | Connect to a saved host by name |
 | `dssh <name> -- <args>` | Connect with extra args forwarded to ssh |
-| `dssh add [-p PORT] [-d DIR] <name> <target> [password]` | Save a new connection |
+| `dssh add [-p PORT] [-d DIR] [-J JUMP] <name> <target> [password]` | Save a new connection |
 | `dssh rm <name>` | Delete a saved connection |
 | `dssh list` / `dssh ls` | List all saved connections |
 | `dssh create` / `dssh new` | Interactive form to create a connection |
@@ -134,12 +154,13 @@ Change your mode anytime with `dssh config`. View current settings with `dssh co
 
 | Key | Action |
 |---|---|
-| `Tab` / `Shift+Tab` | Switch between tabs |
-| `↑` / `↓` | Navigate lists |
+| `Tab` / `Shift+Tab` | Switch between tabs (always), or move between form fields (Create / Edit) |
+| `←` / `→` | Switch between tabs (Connect / Edit list / Delete always; Create / Edit forms when on an empty field, the Save button, or the Save-To toggle) |
+| `↑` / `↓` | Navigate lists / move between form fields |
 | `Enter` | Select / confirm |
 | `Ctrl+L` | Toggle SQLite / ssh_config list (both mode) |
 | `Ctrl+T` | Toggle key / password auth (create/edit) |
-| `ESC` / `Q` | Quit |
+| `ESC` / `Ctrl+C` | Quit |
 
 ### Quick start - Let's Go!
 
@@ -178,6 +199,12 @@ dssh add myserver ssh://root@192.168.1.10:2222
 # Start in a specific remote directory
 dssh add myserver -d /var/www root@192.168.1.10
 
+# Through a jump host (ProxyJump / ssh -J)
+dssh add db01 -J jumpuser@bastion.example.com dbadmin@10.0.1.50
+
+# Through a chain of jump hosts
+dssh add db01 -J jump1.example.com,jump2.example.com dbadmin@10.0.1.50
+
 # With password (will prompt for master passphrase)
 dssh add myserver root@192.168.1.10 'my-ssh-password'
 ```
@@ -229,12 +256,12 @@ dssh ls # alias
 ```
 
 ```
-NAME                USER       HOST            PORT   AUTH      DIR
-mike-pulse-001      nomad      10.51.140.154   22     key       -
-myserver            root       192.168.1.10    22     password  -
-rpg-server          npc        192.168.188.7   22222  key       /var/larp
-sharp-nexus-001     deploy     10.105.210.233  22     key       -
-skylink             root       skylink.vps     22     key       -
+NAME                USER       HOST            PORT   AUTH      DIR         JUMP
+mike-pulse-001      nomad      10.51.140.154   22     key       -           -
+myserver            root       192.168.1.10    22     password  -           -
+rpg-server          npc        192.168.188.7   22222  key       /var/larp   -
+sharp-nexus-001     deploy     10.105.210.233  22     key       -           jumpuser@bastion
+skylink             root       skylink.vps     22     key       -           -
 ```
 
 ### Remove a connection (CLI)
@@ -369,6 +396,27 @@ make build
 make release
 ```
 
+## Documentation
+
+Full docs live at **[dssh.grolmes.com](https://dssh.grolmes.com)**:
+
+- [Get started](https://dssh.grolmes.com/getting-started/) — install, pick a storage mode, save your first connection
+- [Command reference](https://dssh.grolmes.com/reference/commands/) — every CLI flag and example
+- [TUI keybindings](https://dssh.grolmes.com/reference/tui-keys/) — key map per screen
+- [Configuration](https://dssh.grolmes.com/reference/config/) — parse modes, file locations, session flags
+- [Security model](https://dssh.grolmes.com/guides/security/) — crypto flow, threat model, key vs password
+- [Migration](https://dssh.grolmes.com/guides/migration/) — from `ssh_config`, across machines, between modes
+- [Troubleshooting](https://dssh.grolmes.com/guides/troubleshooting/) — permission denied, lost passphrase, WSL quirks
+- [FAQ](https://dssh.grolmes.com/guides/faq/) — YubiKey, passphrase rotation, portability
+- [Limitations](https://dssh.grolmes.com/reference/limitations/) — what dssh deliberately doesn't do
+
+## Contributing
+
+PRs welcome. See the [Contributing guide](https://dssh.grolmes.com/contributing/) for the dev loop, package layout, and PR checklist.
+
+Bugs and feature requests: [github.com/madLinux7/dssh/issues](https://github.com/madLinux7/dssh/issues).
+Security disclosures: please use GitHub's [Security advisory](https://github.com/madLinux7/dssh/security/advisories/new) flow — don't file in the public tracker.
+
 ## ✨ Acknowledgements ✨
 
 dssh has no need for reinventing the wheel — thanks to the maintainers and contributors of these amazing projects:

internal/cli/add.go

@@ -15,11 +15,12 @@ import (
 func newAddCmd() *cobra.Command {
 	var port int
 	var directory string
+	var proxyJump string
 	var addToSQLite bool
 	var addToSSHConfig bool
 
 	cmd := &cobra.Command{
-		Use:   "add [-p PORT] [-d DIR] NAME target [password]",
+		Use:   "add [-p PORT] [-d DIR] [-J JUMP] NAME target [password]",
 		Short: "Add a new SSH connection",
 		Long: `Add a new SSH connection. Target can be user@host or ssh://user@host:port.
 If a password is provided, the connection uses password authentication
@@ -51,6 +52,7 @@ and the password is encrypted with your master passphrase.`,
 				Host:      host,
 				Port:      parsedPort,
 				Directory: directory,
+				ProxyJump: proxyJump,
 				AuthType:  model.AuthKey,
 			}
 
@@ -108,6 +110,7 @@ and the password is encrypted with your master passphrase.`,
 	cmd.Flags().StringVarP(&directory, "directory", "d", "", "Remote directory to cd into on connect")
 	cmd.Flags().StringVar(&directory, "cd", "", "Alias for --directory")
 	cmd.Flags().MarkHidden("cd")
+	cmd.Flags().StringVarP(&proxyJump, "proxy-jump", "J", "", "ProxyJump host (user@bastion / host1,host2)")
 	cmd.Flags().BoolVar(&addToSQLite, "sqlite", false, "Save to SQLite")
 	cmd.Flags().BoolVar(&addToSSHConfig, "sshconfig", false, "Save to ssh_config")
 	return cmd

internal/cli/create.go

@@ -54,6 +54,7 @@ func savePasswordAuth(d *sql.DB, wr *tui.WizardResult) error {
 		Host:      wr.Host,
 		Port:      port,
 		Directory: wr.Directory,
+		ProxyJump: wr.ProxyJump,
 		AuthType:  model.AuthPassword,
 	}
 

internal/cli/list.go

@@ -30,19 +30,23 @@ func newListCmd() *cobra.Command {
 
 			w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
 			if showSource {
-				fmt.Fprintln(w, "NAME\tUSER\tHOST\tPORT\tAUTH\tDIR\tSOURCE")
+				fmt.Fprintln(w, "NAME\tUSER\tHOST\tPORT\tAUTH\tDIR\tJUMP\tSOURCE")
 			} else {
-				fmt.Fprintln(w, "NAME\tUSER\tHOST\tPORT\tAUTH\tDIR")
+				fmt.Fprintln(w, "NAME\tUSER\tHOST\tPORT\tAUTH\tDIR\tJUMP")
 			}
 			for _, c := range conns {
 				dir := c.Directory
 				if dir == "" {
 					dir = "-"
 				}
+				jump := c.ProxyJump
+				if jump == "" {
+					jump = "-"
+				}
 				if showSource {
-					fmt.Fprintf(w, "%s\t%s\t%s\t%d\t%s\t%s\t%s\n", c.Name, c.User, c.Host, c.Port, c.AuthType, dir, c.Source)
+					fmt.Fprintf(w, "%s\t%s\t%s\t%d\t%s\t%s\t%s\t%s\n", c.Name, c.User, c.Host, c.Port, c.AuthType, dir, jump, c.Source)
 				} else {
-					fmt.Fprintf(w, "%s\t%s\t%s\t%d\t%s\t%s\n", c.Name, c.User, c.Host, c.Port, c.AuthType, dir)
+					fmt.Fprintf(w, "%s\t%s\t%s\t%d\t%s\t%s\t%s\n", c.Name, c.User, c.Host, c.Port, c.AuthType, dir, jump)
 				}
 			}
 			return w.Flush()

internal/db/connections.go

@@ -26,9 +26,9 @@ func Insert(db *sql.DB, c *model.Connection) error {
 		nonce = []byte{}
 	}
 	_, err := db.Exec(`
-		INSERT INTO connections (name, user, host, port, directory, auth_type, identity_file, encrypted_pass, pass_nonce)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		c.Name, c.User, c.Host, c.Port, c.Directory, string(c.AuthType), c.IdentityFile, encPass, nonce,
+		INSERT INTO connections (name, user, host, port, directory, auth_type, identity_file, proxy_jump, encrypted_pass, pass_nonce)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		c.Name, c.User, c.Host, c.Port, c.Directory, string(c.AuthType), c.IdentityFile, c.ProxyJump, encPass, nonce,
 	)
 	if err != nil {
 		if strings.Contains(err.Error(), "UNIQUE constraint failed") {
@@ -43,9 +43,9 @@ func Insert(db *sql.DB, c *model.Connection) error {
 func GetByName(db *sql.DB, name string) (*model.Connection, error) {
 	c := &model.Connection{}
 	err := db.QueryRow(`
-		SELECT id, name, user, host, port, directory, auth_type, identity_file, encrypted_pass, pass_nonce, created_at, updated_at
+		SELECT id, name, user, host, port, directory, auth_type, identity_file, proxy_jump, encrypted_pass, pass_nonce, created_at, updated_at
 		FROM connections WHERE name = ?`, name,
-	).Scan(&c.ID, &c.Name, &c.User, &c.Host, &c.Port, &c.Directory, &c.AuthType, &c.IdentityFile, &c.EncryptedPass, &c.PassNonce, &c.CreatedAt, &c.UpdatedAt)
+	).Scan(&c.ID, &c.Name, &c.User, &c.Host, &c.Port, &c.Directory, &c.AuthType, &c.IdentityFile, &c.ProxyJump, &c.EncryptedPass, &c.PassNonce, &c.CreatedAt, &c.UpdatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, fmt.Errorf("%w: %q", ErrNotFound, name)
 	}
@@ -58,7 +58,7 @@ func GetByName(db *sql.DB, name string) (*model.Connection, error) {
 // List returns all connections ordered by name.
 func List(db *sql.DB) ([]model.Connection, error) {
 	rows, err := db.Query(`
-		SELECT id, name, user, host, port, directory, auth_type, identity_file, encrypted_pass, pass_nonce, created_at, updated_at
+		SELECT id, name, user, host, port, directory, auth_type, identity_file, proxy_jump, encrypted_pass, pass_nonce, created_at, updated_at
 		FROM connections ORDER BY name`)
 	if err != nil {
 		return nil, fmt.Errorf("list connections: %w", err)
@@ -68,7 +68,7 @@ func List(db *sql.DB) ([]model.Connection, error) {
 	var conns []model.Connection
 	for rows.Next() {
 		var c model.Connection
-		if err := rows.Scan(&c.ID, &c.Name, &c.User, &c.Host, &c.Port, &c.Directory, &c.AuthType, &c.IdentityFile, &c.EncryptedPass, &c.PassNonce, &c.CreatedAt, &c.UpdatedAt); err != nil {
+		if err := rows.Scan(&c.ID, &c.Name, &c.User, &c.Host, &c.Port, &c.Directory, &c.AuthType, &c.IdentityFile, &c.ProxyJump, &c.EncryptedPass, &c.PassNonce, &c.CreatedAt, &c.UpdatedAt); err != nil {
 			return nil, fmt.Errorf("scan connection: %w", err)
 		}
 		conns = append(conns, c)
@@ -89,10 +89,10 @@ func Update(db *sql.DB, c *model.Connection) error {
 	_, err := db.Exec(`
 		UPDATE connections
 		SET name=?, user=?, host=?, port=?, directory=?, auth_type=?,
-		    identity_file=?, encrypted_pass=?, pass_nonce=?, updated_at=datetime('now')
+		    identity_file=?, proxy_jump=?, encrypted_pass=?, pass_nonce=?, updated_at=datetime('now')
 		WHERE id=?`,
 		c.Name, c.User, c.Host, c.Port, c.Directory, string(c.AuthType),
-		c.IdentityFile, encPass, nonce, c.ID,
+		c.IdentityFile, c.ProxyJump, encPass, nonce, c.ID,
 	)
 	if err != nil {
 		if strings.Contains(err.Error(), "UNIQUE constraint failed") {