Improve Client Config coverage for ProxyJump workflows and real-world SSH options

[luizomf]

This was generated by AI during triage.

What to build

Improve the SSH Toolkit Client Config page so it is a better companion for ProxyJump (ssh -J) teaching and for realistic ~/.ssh/config files.

The current /config page already supports basic host entries, ProxyJump, imports, forwarding options, and a simple visual chain. This parent tracks a focused set of vertical slices that extend that foundation without redesigning the site or expanding into broader bastion governance.

Why now

Otavio is preparing educational material about SSH ProxyJump / ssh -J. The tool should support the most useful workflows from that material:

• real-world client directives that commonly appear in developer SSH configs
• multi-hop ProxyJump values
• copyable command previews for one-liners and file transfer demos
• a video-ready recipe card that creates a realistic bastion/private-host setup

Scope

In scope:

• Client Config (/config) UI additions
• ~/.ssh/config type/generator/parser support for selected directives
• copyable command previews for ProxyJump hosts
• focused tests for generators/parsers/preview helpers
• build verification

Out of scope:

• Match support
• full bastion hardening recipes
• PermitOpen / jump-only user account generation
• Ansible previews
• SFTP previews
• cloud alternatives such as AWS SSM, GCP IAP, Azure Bastion
• MFA, SSO, RBAC, audit/session recording, governance
• site redesign
• large architecture refactors

Implementation order

1. Add standalone SSH client directives first.
2. Improve the ProxyJump chain model/visualization.
3. Add command previews that depend on correct jump-chain handling.
4. Add the final video-ready recipe card after the pieces it demonstrates exist.

Acceptance criteria

• Child issues cover the planned work as independent, agent-ready vertical slices.
• Each child issue states the visible behavior, generated config behavior, parser/import behavior, tests, and verification commands when applicable.
• The issue stack keeps Match and bastion hardening out of the initial implementation scope.
• The final implementation can be verified with npm test and npm run build.

Blocked by

None - can start immediately.

Agent notes

• Repository: luizomf/sshtoolkit
• Main instruction file: AGENTS.md
• Product requirements: PRD.md
• Agent docs: docs/agents/issue-tracker.md, docs/agents/triage-labels.md, docs/agents/domain.md
• Relevant implementation areas: /config, src/lib/config-generator.ts, src/lib/config-parser.ts, src/lib/types.ts, and the existing config generator/parser tests.
• Do not copy private hostnames, usernames, IPs, identity paths, or environment values from any personal SSH config into code, tests, docs, or issues.

[luizomf]

This was generated by AI during triage.

Issue stack for goal-driven implementation

Agent-ready issues:

1. Add IdentitiesOnly to Client Config #18 - Add IdentitiesOnly to Client Config
2. Add AddKeysToAgent to Client Config #19 - Add AddKeysToAgent to Client Config
3. Add logging and compatibility SSH options to Client Config #20 - Add logging and compatibility SSH options to Client Config
4. Add environment forwarding options to Client Config #21 - Add environment forwarding options to Client Config
5. Add host key policy options to Client Config #22 - Add host key policy options to Client Config
6. Add HostKeyAlias to Client Config #24 - Add HostKeyAlias to Client Config
7. Improve comma-separated ProxyJump chain visualization #23 - Improve comma-separated ProxyJump chain visualization
8. Add ProxyJump SSH command previews to Client Config #25 - Add ProxyJump SSH command previews to Client Config
9. Add SCP and rsync previews for ProxyJump hosts #26 - Add SCP and rsync previews for ProxyJump hosts
10. Add a video-ready ProxyJump recipe card #27 - Add a video-ready ProxyJump recipe card

Recommended implementation order:

1. Implement independent directive support first: Add IdentitiesOnly to Client Config #18, Add AddKeysToAgent to Client Config #19, Add logging and compatibility SSH options to Client Config #20, Add environment forwarding options to Client Config #21, Add host key policy options to Client Config #22, Add HostKeyAlias to Client Config #24.
2. Implement chain visualization next: Improve comma-separated ProxyJump chain visualization #23.
3. Implement previews after chain behavior is correct: Add ProxyJump SSH command previews to Client Config #25, then Add SCP and rsync previews for ProxyJump hosts #26.
4. Implement the final recipe card last: Add a video-ready ProxyJump recipe card #27.

Dependencies:

• Add ProxyJump SSH command previews to Client Config #25 is blocked by Improve comma-separated ProxyJump chain visualization #23.
• Add SCP and rsync previews for ProxyJump hosts #26 is blocked by Add ProxyJump SSH command previews to Client Config #25.
• Add a video-ready ProxyJump recipe card #27 is blocked by Add IdentitiesOnly to Client Config #18, Improve comma-separated ProxyJump chain visualization #23, Add HostKeyAlias to Client Config #24, Add ProxyJump SSH command previews to Client Config #25, and Add SCP and rsync previews for ProxyJump hosts #26.

Explicitly out of scope for this stack:

• Match support
• full bastion hardening recipes
• PermitOpen / jump-only user account generation
• Ansible previews
• SFTP previews
• cloud alternatives
• MFA, SSO, RBAC, audit/session recording, governance
• redesigning the site
• large refactors

Verification expectation for the full stack:

• npm test
• npm run build

Security/privacy expectation:

• Use only example values in code, tests, docs, and issue comments.
• Do not copy personal SSH hostnames, usernames, IPs, identity paths, or environment values.