bump version to 0.4.10

Add AuthMethod::Config: parse ~/.ssh/config and list concrete host
entries in the connection dialog. Selecting an entry pre-fills
host/port/user/identity file and connects.

- Extract shared key utilities into session::ssh_keys
  (private_keys_with_algs, normalize_inline_private_key,
  authenticate_with_default_keys, session_has_explicit_key), reused by
  backend::ssh and sftp to remove duplication.
- Add session::ssh_config parser for ~/.ssh/config (Host/HostName/User/
  Port/IdentityFile), skipping wildcard patterns and Match/Include.
- Key auth now falls back to default keys (~/.ssh/id_*) when no explicit
  key path or inline content is provided.
- Preserve escaped \r\n normalization in normalize_inline_private_key
  when refactoring into the shared module.

Cargo.lock

@@ -315,7 +315,7 @@ dependencies = [
 
 [[package]]
 name = "ashell"
-version = "0.4.9"
+version = "0.4.10"
 dependencies = [
  "alacritty_terminal",
  "anyhow",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ashell"
-version = "0.4.9"
+version = "0.4.10"
 edition = "2024"
 authors = ["ashell contributors"]
 description = "A GPUI Component based SSH and local terminal client"
@@ -54,6 +54,18 @@ rand = "0.8"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls"] }
 sha2 = "0.10"
 
+[package.metadata.deb]
+maintainer = "ashell contributors"
+license-file = ["LICENSE"]
+extended-description = "A GPUI Component based SSH and local terminal client"
+section = "terminal"
+priority = "optional"
+assets = [
+    ["target/release/ashell", "usr/bin/", "755"],
+    ["assets/ashell.desktop", "usr/share/applications/", "644"],
+    ["assets/icons/ashell.png", "usr/share/icons/hicolor/256x256/apps/", "644"],
+]
+
 [profile.release]
 opt-level = 3
 lto = "thin"

README.en.md

@@ -82,6 +82,39 @@ open target/release/ashell.app
 
 The packaging script creates a standard `.app` bundle. It does not attach an entitlements file, and after signing, it verifies that `com.apple.security.app-sandbox` is not present (meaning it runs non-sandboxed).
 
+## Package Linux (Debian/Ubuntu)
+
+### Prerequisites
+
+```bash
+sudo apt install pkg-config libfontconfig1-dev
+cargo install cargo-deb
+```
+
+### Build .deb
+
+```bash
+cargo build --release
+cargo deb
+```
+
+The `.deb` file will be generated at:
+
+```
+target/debian/ashell_0.4.8-1_amd64.deb
+```
+
+### Install
+
+```bash
+sudo dpkg -i target/debian/ashell_0.4.8-1_amd64.deb
+```
+
+After installation, you can launch from the application menu or by running `ashell` in the terminal. The `.deb` package includes:
+- `/usr/bin/ashell` — Main binary
+- `/usr/share/applications/ashell.desktop` — Desktop entry
+- `/usr/share/icons/hicolor/256x256/apps/ashell.png` — Application icon
+
 ## License
 
 This project is licensed under the [GPL-3.0-or-later License](LICENSE).

README.md

@@ -82,6 +82,39 @@ open target/release/ashell.app
 
 该打包脚本会创建一个标准的 `.app` 应用程序包。它没有附加 entitlements 文件，并且在签名后会验证是否不存在 `com.apple.security.app-sandbox`（这意味着它在非沙盒模式下运行）。
 
+## 打包 Linux (Debian/Ubuntu)
+
+### 前置条件
+
+```bash
+sudo apt install pkg-config libfontconfig1-dev
+cargo install cargo-deb
+```
+
+### 构建 .deb 包
+
+```bash
+cargo build --release
+cargo deb
+```
+
+生成的 `.deb` 文件位于：
+
+```
+target/debian/ashell_0.4.9-1_amd64.deb
+```
+
+### 安装
+
+```bash
+sudo dpkg -i target/debian/ashell_0.4.9-1_amd64.deb
+```
+
+安装后可通过应用菜单或命令行 `ashell` 启动。`.deb` 包包含以下内容：
+- `/usr/bin/ashell` — 主程序
+- `/usr/share/applications/ashell.desktop` — 桌面入口
+- `/usr/share/icons/hicolor/256x256/apps/ashell.png` — 应用图标
+
 ## 协议
 
 本项目采用 [GPL-3.0-or-later 协议](LICENSE) 开源。

assets/ashell.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Name=Ashell
+Comment=A GPUI Component based SSH and local terminal client
+Exec=ashell
+Icon=ashell
+Terminal=false
+Type=Application
+Categories=System;TerminalEmulator;Utility;
+StartupWMClass=ashell

locales/en.yml

@@ -33,6 +33,8 @@ port: "Port"
 user: "User"
 password: "Password"
 key: "Key"
+ssh_config: "Config(~/.ssh/config)"
+ssh_config_empty: "No entries found in ~/.ssh/config"
 private_key_path: "Private Key Path"
 private_key_data: "Private Key Data"
 save_and_connect: "Save & Connect"

locales/zh-CN.yml

@@ -34,6 +34,8 @@ port: "端口 (Port)"
 user: "用户 (User)"
 password: "密码 (Password)"
 key: "密钥 (Key)"
+ssh_config: "配置(~/.ssh/config)"
+ssh_config_empty: "~/.ssh/config 中未找到条目"
 private_key_path: "私钥路径"
 private_key_data: "私钥内容"
 save_and_connect: "保存并连接"

src/app/mod.rs

@@ -2,11 +2,11 @@ pub mod config_sync;
 pub mod constants;
 pub mod dialogs;
 pub mod keybinding_recorder;
+pub mod resizable;
 pub mod search;
 pub mod startup;
 pub mod theme;
 pub mod ui;
-pub mod resizable;
 
 use std::{
     cell::{Cell, RefCell},
@@ -17,6 +17,7 @@ use std::{
     time::{Duration, Instant},
 };
 
+use crate::app::resizable::ResizableState;
 use gpui::{
     AppContext as _, Bounds, Context, Entity, FocusHandle, Pixels, Point, SharedString, Size,
     UniformListScrollHandle, Window, point, px, size,
@@ -26,12 +27,12 @@ use gpui_component::{
     input::{InputEvent, InputState},
     scroll::ScrollbarHandle,
 };
-use crate::app::resizable::ResizableState;
 use rust_i18n::t;
 use tokio::runtime::Runtime;
 
 use crate::{
     session::config::{AuthMethod, ConfigStore},
+    session::ssh_config::SshConfigEntry,
     system::{SystemSampler, SystemSnapshot},
     terminal::{self, BackendEvent, TabKind, TerminalTab},
 };
@@ -236,6 +237,8 @@ pub(crate) struct Ashell {
     pub(crate) sync_status: SharedString,
     pub(crate) sftp_path_input: Entity<InputState>,
     pub(crate) ssh_auth_method: AuthMethod,
+    pub(crate) ssh_config_entries: Vec<SshConfigEntry>,
+    pub(crate) ssh_config_selected: Option<usize>,
     pub(crate) editing_session_id: Option<String>,
     pub(crate) follow_system_theme: bool,
     pub(crate) theme_mode: ThemeMode,
@@ -318,6 +321,7 @@ pub(crate) struct Ashell {
     pub(crate) events_tx: mpsc::Sender<BackendEvent>,
     pub(crate) last_window_size: Option<gpui::Size<Pixels>>,
     pub(crate) last_sidebar_width: Option<Pixels>,
+    pub(crate) should_move_window: bool,
     pub(crate) hovered_url: Option<HoveredUrl>,
     pub(crate) cmd_ctrl_pressed: bool,
     pub(crate) _subscriptions: Vec<gpui::Subscription>,
@@ -397,16 +401,22 @@ impl Ashell {
                 .placeholder("SSH private key passphrase (optional)")
                 .masked(true)
         });
-        let proxy_host_input = cx.new(|cx| InputState::new(window, cx).placeholder(t!("proxy_host").to_string()));
-        let proxy_port_input = cx.new(|cx| InputState::new(window, cx).placeholder(t!("proxy_port").to_string()));
-        let proxy_user_input = cx.new(|cx| InputState::new(window, cx).placeholder(t!("proxy_user").to_string()));
-        let proxy_password_input = cx.new(|cx| InputState::new(window, cx).placeholder(t!("proxy_password").to_string()).masked(true));
+        let proxy_host_input =
+            cx.new(|cx| InputState::new(window, cx).placeholder(t!("proxy_host").to_string()));
+        let proxy_port_input =
+            cx.new(|cx| InputState::new(window, cx).placeholder(t!("proxy_port").to_string()));
+        let proxy_user_input =
+            cx.new(|cx| InputState::new(window, cx).placeholder(t!("proxy_user").to_string()));
+        let proxy_password_input = cx.new(|cx| {
+            InputState::new(window, cx)
+                .placeholder(t!("proxy_password").to_string())
+                .masked(true)
+        });
         let sftp_path_input = cx.new(|cx| InputState::new(window, cx).default_value("/"));
         let sftp_new_folder_input =
             cx.new(|cx| InputState::new(window, cx).placeholder(t!("new_folder").to_string()));
-        let search_input = cx.new(|cx| {
-            InputState::new(window, cx).placeholder(t!("search").to_string())
-        });
+        let search_input =
+            cx.new(|cx| InputState::new(window, cx).placeholder(t!("search").to_string()));
         let config = ConfigStore::load().unwrap_or_else(|err| {
             tracing::warn!("failed to load config: {err:#}");
             ConfigStore::in_memory()
@@ -419,7 +429,12 @@ impl Ashell {
         let global_proxy_port_input = cx.new(|cx| {
             InputState::new(window, cx)
                 .placeholder(t!("proxy_port").to_string())
-                .default_value(config.global_proxy_port().map(|p| p.to_string()).unwrap_or_default())
+                .default_value(
+                    config
+                        .global_proxy_port()
+                        .map(|p| p.to_string())
+                        .unwrap_or_default(),
+                )
         });
         let global_proxy_user_input = cx.new(|cx| {
             InputState::new(window, cx)
@@ -598,6 +613,8 @@ impl Ashell {
             sync_status: t!("sync_not_run").into(),
             sftp_path_input,
             ssh_auth_method: AuthMethod::Password,
+            ssh_config_entries: crate::session::ssh_config::parse_ssh_config().unwrap_or_default(),
+            ssh_config_selected: None,
             editing_session_id: None,
             follow_system_theme,
             theme_mode,
@@ -691,6 +708,7 @@ impl Ashell {
             events_tx,
             last_window_size: None,
             last_sidebar_width,
+            should_move_window: false,
             hovered_url: None,
             cmd_ctrl_pressed: false,
             _subscriptions,
@@ -779,7 +797,9 @@ impl Ashell {
                                 | crate::session::config::CursorStyle::BeamBlink
                         );
                         let now = std::time::Instant::now();
-                        let blink_due = is_blinking && now.duration_since(last_blink_time) >= std::time::Duration::from_millis(600);
+                        let blink_due = is_blinking
+                            && now.duration_since(last_blink_time)
+                                >= std::time::Duration::from_millis(600);
                         if changed || system_sampled || blink_due {
                             cx.notify();
                             idle_frames = 0;
@@ -1233,13 +1253,28 @@ impl Ashell {
                     }
                 }
                 gpui::WindowBounds::Maximized(b) => {
-                    let mut restore_bounds = (b.origin.x.into(), b.origin.y.into(), b.size.width.into(), b.size.height.into());
+                    let mut restore_bounds = (
+                        b.origin.x.into(),
+                        b.origin.y.into(),
+                        b.size.width.into(),
+                        b.size.height.into(),
+                    );
                     if let Some(existing_bounds) = config.window_bounds() {
                         match existing_bounds {
-                            crate::session::config::SavedWindowBounds::Windowed { x, y, width, height } => {
+                            crate::session::config::SavedWindowBounds::Windowed {
+                                x,
+                                y,
+                                width,
+                                height,
+                            } => {
                                 restore_bounds = (*x, *y, *width, *height);
                             }
-                            crate::session::config::SavedWindowBounds::Maximized { x, y, width, height } => {
+                            crate::session::config::SavedWindowBounds::Maximized {
+                                x,
+                                y,
+                                width,
+                                height,
+                            } => {
                                 restore_bounds = (*x, *y, *width, *height);
                             }
                             _ => {}
@@ -1261,13 +1296,15 @@ impl Ashell {
                     }
                 }
             };
-            let workspace_sizes: Vec<f32> = self.workspace_panels
+            let workspace_sizes: Vec<f32> = self
+                .workspace_panels
                 .read(cx)
                 .sizes()
                 .iter()
                 .map(|s| s.into())
                 .collect();
-            let mut body_sizes: Vec<f32> = self.body_panels
+            let mut body_sizes: Vec<f32> = self
+                .body_panels
                 .read(cx)
                 .sizes()
                 .iter()

src/app/ui.rs

@@ -2812,19 +2812,42 @@ impl Render for Ashell {
                         .h(px(34.))
                         .w_full()
                         .bg(cx.theme().tab_bar)
-                        .window_control_area(gpui::WindowControlArea::Drag)
-                        .on_double_click(|_, window, _| {
-                            #[cfg(target_os = "macos")]
-                            window.titlebar_double_click();
-                            #[cfg(not(target_os = "macos"))]
-                            window.zoom_window();
-                        })
                         .child(self.render_window_controls(window, cx))
                         .child(
                             div()
+                                .id("tab-bar-drag")
                                 .flex_1()
                                 .min_w(px(0.))
                                 .h_full()
+                                .on_double_click(|_, window, _| {
+                                    #[cfg(target_os = "macos")]
+                                    window.titlebar_double_click();
+                                    #[cfg(not(target_os = "macos"))]
+                                    window.zoom_window();
+                                })
+                                .when(cfg!(target_os = "linux"), |this| {
+                                    this.on_mouse_down(
+                                        MouseButton::Left,
+                                        cx.listener(|this, _, _, _| {
+                                            this.should_move_window = true;
+                                        }),
+                                    )
+                                    .on_mouse_up(
+                                        MouseButton::Left,
+                                        cx.listener(|this, _, _, _| {
+                                            this.should_move_window = false;
+                                        }),
+                                    )
+                                    .on_mouse_down_out(cx.listener(|this, _, _, _| {
+                                        this.should_move_window = false;
+                                    }))
+                                    .on_mouse_move(cx.listener(|this, _, window, _| {
+                                        if this.should_move_window {
+                                            this.should_move_window = false;
+                                            window.start_window_move();
+                                        }
+                                    }))
+                                })
                                 .child(self.render_tab_bar(cx)),
                         ),
                 )

src/backend/ssh.rs

@@ -9,12 +9,18 @@ use directories::BaseDirs;
 use russh::{
     ChannelMsg, Disconnect,
     client::{self, Handler},
-    keys::{HashAlg, PrivateKey, decode_secret_key, key::PrivateKeyWithHashAlg, load_secret_key},
+    keys::{PrivateKey, decode_secret_key, load_secret_key},
 };
 use tokio::sync::mpsc;
 
 use crate::{
-    session::config::{AuthMethod, Session},
+    session::{
+        config::{AuthMethod, Session},
+        ssh_keys::{
+            authenticate_with_default_keys, normalize_inline_private_key, private_keys_with_algs,
+            session_has_explicit_key,
+        },
+    },
     system::{SystemSnapshot, remote_snapshot_from_kv},
     terminal::{BackendCommand, BackendEvent, BackendTx},
 };
@@ -230,12 +236,18 @@ async fn connect_and_authenticate(
         addr,
         session.user
     );
-    let status_text = if let Some((ptype, phost, pport)) = crate::session::config::active_proxy(session) {
-        let pport_val = pport.unwrap_or_else(|| if ptype == "http" { 8080 } else { 1080 });
-        format!("connecting to {addr} via {} proxy {}:{}", ptype.to_uppercase(), phost, pport_val)
-    } else {
-        format!("opening tcp connection to {addr}")
-    };
+    let status_text =
+        if let Some((ptype, phost, pport)) = crate::session::config::active_proxy(session) {
+            let pport_val = pport.unwrap_or_else(|| if ptype == "http" { 8080 } else { 1080 });
+            format!(
+                "connecting to {addr} via {} proxy {}:{}",
+                ptype.to_uppercase(),
+                phost,
+                pport_val
+            )
+        } else {
+            format!("opening tcp connection to {addr}")
+        };
     let _ = events.send(BackendEvent::Status {
         tab_id: tab_id.to_string(),
         text: status_text,
@@ -267,7 +279,12 @@ async fn connect_and_authenticate(
                 .context("password authentication failed")?
         }
         AuthMethod::Key => {
-            let source = key_source_label(session);
+            let has_explicit_key = session_has_explicit_key(session);
+            let source = if has_explicit_key {
+                key_source_label(session)
+            } else {
+                "~/.ssh/ default keys".to_string()
+            };
             tracing::info!(
                 "[ssh] sending key authentication for {}@{} (key source: {})",
                 session.user,
@@ -276,44 +293,143 @@ async fn connect_and_authenticate(
             );
             let _ = events.send(BackendEvent::Status {
                 tab_id: tab_id.to_string(),
-                text: format!("connected to {addr}, loading private key from {source}"),
+                text: if has_explicit_key {
+                    format!("connected to {addr}, loading private key from {source}")
+                } else {
+                    format!(
+                        "connected to {addr}, trying default keys from ~/.ssh/ for {}",
+                        session.user
+                    )
+                },
             });
-            let keypair = load_session_private_key(session)?;
-            let algorithm = format!("{:?}", keypair.algorithm());
-            let _ = events.send(BackendEvent::Status {
-                tab_id: tab_id.to_string(),
-                text: format!("private key loaded from {source}, algorithm {algorithm}, sending public key authentication for {}", session.user),
-            });
-            let keys = private_keys_with_algs(keypair).context("invalid private key")?;
-            let mut success = false;
-            for key in keys {
-                match handle.authenticate_publickey(&session.user, key).await {
-                    Ok(true) => {
-                        success = true;
-                        break;
-                    }
-                    Ok(false) => {
-                        tracing::debug!("[ssh] public key auth failed with algorithm, trying next");
-                        continue;
-                    }
-                    Err(e) => {
-                        tracing::debug!("[ssh] public key auth error: {:?}, trying next", e);
-                        continue;
+
+            let passphrase = session.passphrase.trim();
+            let passphrase = (!passphrase.is_empty()).then_some(passphrase);
+
+            let success = if has_explicit_key {
+                let keypair = load_session_private_key(session)?;
+                let algorithm = format!("{:?}", keypair.algorithm());
+                let _ = events.send(BackendEvent::Status {
+                    tab_id: tab_id.to_string(),
+                    text: format!("private key loaded from {source}, algorithm {algorithm}, sending public key authentication for {}", session.user),
+                });
+                let keys = private_keys_with_algs(keypair).context("invalid private key")?;
+                let mut success = false;
+                for key in keys {
+                    match handle.authenticate_publickey(&session.user, key).await {
+                        Ok(true) => {
+                            success = true;
+                            break;
+                        }
+                        Ok(false) => {
+                            tracing::debug!("[ssh] public key auth failed with algorithm, trying next");
+                            continue;
+                        }
+                        Err(e) => {
+                            tracing::debug!("[ssh] public key auth error: {:?}, trying next", e);
+                            continue;
+                        }
                     }
                 }
-            }
-            if !success {
-                return Err(anyhow::anyhow!(
-                    "public key authentication failed for {}@{}:{} using {} ({})",
-                    session.user,
-                    session.host,
-                    session.port,
-                    source,
-                    algorithm
-                ));
-            }
+                if !success {
+                    return Err(anyhow::anyhow!(
+                        "public key authentication failed for {}@{}:{} using {} ({})",
+                        session.user,
+                        session.host,
+                        session.port,
+                        source,
+                        algorithm
+                    ));
+                }
+                success
+            } else {
+                let success =
+                    authenticate_with_default_keys(&mut handle, &session.user, passphrase)
+                        .await?;
+                if !success {
+                    return Err(anyhow::anyhow!(
+                        "public key authentication failed for {}@{}:{} - no valid default key found in ~/.ssh/",
+                        session.user,
+                        session.host,
+                        session.port
+                    ));
+                }
+                success
+            };
             success
         }
+        AuthMethod::Config => {
+            // SSH Config auth: try the identity file from config, or default keys
+            let source = key_source_label(session);
+            tracing::info!(
+                "[ssh] sending ssh-config authentication for {}@{} (key source: {})",
+                session.user,
+                addr,
+                source
+            );
+            let _ = events.send(BackendEvent::Status {
+                tab_id: tab_id.to_string(),
+                text: format!("connected to {addr}, loading private key from {source}"),
+            });
+
+            // If an explicit key path is set from the SSH config IdentityFile, use it;
+            // otherwise try default keys from ~/.ssh/
+            // Note: for Config auth, we never use inline key content
+            let has_explicit_key = !session.private_key_path.trim().is_empty();
+            if has_explicit_key {
+                let keypair = load_session_private_key(session)?;
+                let algorithm = format!("{:?}", keypair.algorithm());
+                let keys = private_keys_with_algs(keypair).context("invalid private key")?;
+                let mut success = false;
+                for key in keys {
+                    match handle.authenticate_publickey(&session.user, key).await {
+                        Ok(true) => {
+                            success = true;
+                            break;
+                        }
+                        Ok(false) => {
+                            continue;
+                        }
+                        Err(_) => {
+                            continue;
+                        }
+                    }
+                }
+                if !success {
+                    return Err(anyhow::anyhow!(
+                        "ssh-config key authentication failed for {}@{}:{} using {} ({})",
+                        session.user,
+                        session.host,
+                        session.port,
+                        source,
+                        algorithm
+                    ));
+                }
+                success
+            } else {
+                let passphrase = session.passphrase.trim();
+                let passphrase = (!passphrase.is_empty()).then_some(passphrase);
+                let _ = events.send(BackendEvent::Status {
+                    tab_id: tab_id.to_string(),
+                    text: format!(
+                        "connected to {addr}, trying default keys from ~/.ssh/ for {}",
+                        session.user
+                    ),
+                });
+                let success =
+                    authenticate_with_default_keys(&mut handle, &session.user, passphrase)
+                        .await?;
+                if !success {
+                    return Err(anyhow::anyhow!(
+                        "ssh-config authentication failed for {}@{}:{} - no valid default key found",
+                        session.user,
+                        session.host,
+                        session.port
+                    ));
+                }
+                success
+            }
+        }
     };
 
     if !authed {
@@ -335,6 +451,10 @@ async fn connect_and_authenticate(
                     session.port,
                     key_source_label(session)
                 ),
+                AuthMethod::Config => format!(
+                    "authentication failed: server rejected ssh-config authentication for {}@{}:{}",
+                    session.user, session.host, session.port
+                ),
             }
         ));
     }
@@ -387,47 +507,6 @@ fn load_session_private_key(session: &Session) -> Result<PrivateKey> {
     Err(anyhow!(errors.join("; ")))
 }
 
-fn private_keys_with_algs(keypair: PrivateKey) -> Result<Vec<PrivateKeyWithHashAlg>> {
-    let mut algs = Vec::new();
-    let key_arc = Arc::new(keypair);
-
-    if key_arc.algorithm().is_rsa() {
-        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha512)) {
-            algs.push(k);
-        }
-        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha256)) {
-            algs.push(k);
-        }
-        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
-            algs.push(k);
-        }
-    } else {
-        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
-            algs.push(k);
-        }
-    }
-
-    if algs.is_empty() {
-        return Err(anyhow!(
-            "Failed to construct PrivateKeyWithHashAlg for any supported hash algorithm"
-        ));
-    }
-
-    Ok(algs)
-}
-
-fn normalize_inline_private_key(value: &str) -> String {
-    let mut normalized = value
-        .trim()
-        .replace("\\r\\n", "\n")
-        .replace("\\n", "\n")
-        .replace("\r\n", "\n");
-    if !normalized.ends_with('\n') {
-        normalized.push('\n');
-    }
-    normalized
-}
-
 fn expand_key_path(value: &str) -> Option<PathBuf> {
     if value.is_empty() {
         return None;

src/session/config.rs

@@ -10,6 +10,7 @@ use uuid::Uuid;
 pub enum AuthMethod {
     Password,
     Key,
+    Config,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -438,7 +439,11 @@ impl ConfigStore {
     }
 
     pub fn sync_s3_region(&self) -> &str {
-        if self.cache.sync_s3_region.is_empty() { "us-east-1" } else { &self.cache.sync_s3_region }
+        if self.cache.sync_s3_region.is_empty() {
+            "us-east-1"
+        } else {
+            &self.cache.sync_s3_region
+        }
     }
 
     pub fn sync_s3_bucket(&self) -> &str {
@@ -446,7 +451,11 @@ impl ConfigStore {
     }
 
     pub fn sync_s3_object_key(&self) -> &str {
-        if self.cache.sync_s3_object_key.is_empty() { "ashell-sync.json" } else { &self.cache.sync_s3_object_key }
+        if self.cache.sync_s3_object_key.is_empty() {
+            "ashell-sync.json"
+        } else {
+            &self.cache.sync_s3_object_key
+        }
     }
 
     pub fn set_sync_connection(&mut self, endpoint: String, username: String) {
@@ -766,8 +775,14 @@ impl ConfigStore {
     }
 }
 
-pub trait ProxyStream: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + Sync + 'static {}
-impl<T: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + Sync + 'static> ProxyStream for T {}
+pub trait ProxyStream:
+    tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + Sync + 'static
+{
+}
+impl<T: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + Sync + 'static> ProxyStream
+    for T
+{
+}
 
 use std::sync::OnceLock;
 
@@ -796,7 +811,9 @@ pub async fn connect_proxy(session: &Session) -> Result<Box<dyn ProxyStream>> {
                 session.proxy_user.clone(),
                 session.proxy_password.clone(),
             )
-        } else if config.cache.read_env_proxy && ENV_PROXY.get().and_then(|opt| opt.as_ref()).is_some() {
+        } else if config.cache.read_env_proxy
+            && ENV_PROXY.get().and_then(|opt| opt.as_ref()).is_some()
+        {
             let env_p = ENV_PROXY.get().and_then(|opt| opt.as_ref()).unwrap();
             (
                 env_p.proxy_type.clone(),
@@ -814,10 +831,16 @@ pub async fn connect_proxy(session: &Session) -> Result<Box<dyn ProxyStream>> {
                 config.cache.global_proxy_password.clone(),
             )
         } else {
-            ("none".to_string(), String::new(), None, String::new(), String::new())
+            (
+                "none".to_string(),
+                String::new(),
+                None,
+                String::new(),
+                String::new(),
+            )
         }
     };
-    
+
     if proxy_type != "none" && (proxy_host.is_empty() || proxy_port.is_none()) {
         let addr = format!("{}:{}", target_host, target_port);
         let stream = tokio::net::TcpStream::connect(&addr).await?;
@@ -900,7 +923,9 @@ pub fn active_proxy(session: &Session) -> Option<(String, String, Option<u16>)>
                 session.proxy_user.clone(),
                 session.proxy_password.clone(),
             )
-        } else if config.cache.read_env_proxy && ENV_PROXY.get().and_then(|opt| opt.as_ref()).is_some() {
+        } else if config.cache.read_env_proxy
+            && ENV_PROXY.get().and_then(|opt| opt.as_ref()).is_some()
+        {
             let env_p = ENV_PROXY.get().and_then(|opt| opt.as_ref()).unwrap();
             (
                 env_p.proxy_type.clone(),
@@ -918,10 +943,16 @@ pub fn active_proxy(session: &Session) -> Option<(String, String, Option<u16>)>
                 config.cache.global_proxy_password.clone(),
             )
         } else {
-            ("none".to_string(), String::new(), None, String::new(), String::new())
+            (
+                "none".to_string(),
+                String::new(),
+                None,
+                String::new(),
+                String::new(),
+            )
         }
     };
-    
+
     if proxy_type != "none" && !proxy_host.is_empty() && proxy_port.is_some() {
         Some((proxy_type, proxy_host, proxy_port))
     } else {

src/session/mod.rs

@@ -1,8 +1,10 @@
 pub mod config;
+pub mod ssh_config;
+pub mod ssh_keys;
 
 use gpui::{
-    AppContext as _, Context, Entity, KeyDownEvent, MouseButton, MouseDownEvent,
-    MouseMoveEvent, SharedString, Window, px,
+    AppContext as _, Context, Entity, KeyDownEvent, MouseButton, MouseDownEvent, MouseMoveEvent,
+    SharedString, Window, px,
 };
 use gpui_component::{Theme, WindowExt as _, input::InputState};
 use rust_i18n::t;
@@ -12,9 +14,7 @@ use self::config::{AuthMethod, Session};
 
 use crate::{
     Ashell, PaneLayout, SelectorEntry, TabGroup,
-    app::constants::{
-        DEFAULT_COLS, DEFAULT_ROWS,
-    },
+    app::constants::{DEFAULT_COLS, DEFAULT_ROWS},
     backend::{local, ssh},
     terminal::{BackendCommand, RenderSnapshot, TabKind, TerminalTab},
 };
@@ -103,13 +103,16 @@ impl Ashell {
         let mut session = match self.ssh_auth_method {
             AuthMethod::Password => Session::password(host, port, user, password),
             AuthMethod::Key => {
-                if key_path.is_empty() && key_inline.trim().is_empty() {
-                    self.status = "private key path or content is required".into();
-                    cx.notify();
-                    return;
-                }
                 Session::key(host, port, user, key_path, key_inline, passphrase)
             }
+            AuthMethod::Config => {
+                // Force key_inline to empty — config mode never uses inline key content.
+                // The backend will try default keys from ~/.ssh/ if no explicit key path is set.
+                let mut session =
+                    Session::key(host, port, user, key_path, String::new(), String::new());
+                session.auth = AuthMethod::Config;
+                session
+            }
         };
         session.name = name;
         if let Some(id) = existing_id {
@@ -151,6 +154,7 @@ impl Ashell {
     pub(crate) fn reset_ssh_form(&mut self, window: &mut Window, cx: &mut Context<Self>) {
         self.editing_session_id = None;
         self.ssh_auth_method = AuthMethod::Password;
+        self.ssh_config_selected = None;
         Self::set_input_value(&self.session_name_input, "", window, cx);
         Self::set_input_value(&self.host_input, "", window, cx);
         Self::set_input_value(&self.port_input, "22", window, cx);
@@ -202,15 +206,33 @@ impl Ashell {
         } else {
             session.proxy_type.clone()
         };
-        Self::set_input_value(&self.proxy_host_input, session.proxy_host.clone(), window, cx);
         Self::set_input_value(
+            &self.proxy_host_input,
+            session.proxy_host.clone(),
+            window,
+            cx,
+        );
+        Self::set_input_value(
             &self.proxy_port_input,
-            session.proxy_port.map(|p| p.to_string()).unwrap_or_default(),
+            session
+                .proxy_port
+                .map(|p| p.to_string())
+                .unwrap_or_default(),
+            window,
+            cx,
+        );
+        Self::set_input_value(
+            &self.proxy_user_input,
+            session.proxy_user.clone(),
+            window,
+            cx,
+        );
+        Self::set_input_value(
+            &self.proxy_password_input,
+            session.proxy_password.clone(),
             window,
             cx,
         );
-        Self::set_input_value(&self.proxy_user_input, session.proxy_user.clone(), window, cx);
-        Self::set_input_value(&self.proxy_password_input, session.proxy_password.clone(), window, cx);
     }
 
     pub(crate) fn pick_ssh_key_path(&mut self, window: &mut Window, cx: &mut Context<Self>) {
@@ -362,9 +384,57 @@ impl Ashell {
 
     pub(crate) fn set_ssh_auth_method(&mut self, method: AuthMethod, cx: &mut Context<Self>) {
         self.ssh_auth_method = method;
+        if method == AuthMethod::Config {
+            self.refresh_ssh_config();
+            self.ssh_config_selected = None;
+        }
         cx.notify();
     }
 
+    pub(crate) fn refresh_ssh_config(&mut self) {
+        self.ssh_config_entries =
+            crate::session::ssh_config::parse_ssh_config().unwrap_or_default();
+    }
+
+    pub(crate) fn select_ssh_config_entry(
+        &mut self,
+        index: usize,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.ssh_config_selected = Some(index);
+        if let Some(entry) = self.ssh_config_entries.get(index) {
+            Self::set_input_value(
+                &self.session_name_input,
+                entry.host_alias.clone(),
+                window,
+                cx,
+            );
+            Self::set_input_value(&self.host_input, entry.hostname.clone(), window, cx);
+            Self::set_input_value(&self.port_input, entry.port.to_string(), window, cx);
+            // If no user specified in config, use current system user
+            let user = if entry.user.is_empty() {
+                std::env::var("USER")
+                    .or_else(|_| std::env::var("USERNAME"))
+                    .unwrap_or_else(|_| "root".to_string())
+            } else {
+                entry.user.clone()
+            };
+            Self::set_input_value(&self.user_input, user, window, cx);
+            Self::set_input_value(
+                &self.key_path_input,
+                entry.identity_files.first().cloned().unwrap_or_default(),
+                window,
+                cx,
+            );
+            Self::set_input_value(&self.password_input, String::new(), window, cx);
+            Self::set_input_value(&self.key_inline_input, String::new(), window, cx);
+            Self::set_input_value(&self.passphrase_input, String::new(), window, cx);
+            // Auto-connect on selection
+            self.connect_ssh(window, cx);
+        }
+    }
+
     pub(crate) fn set_ssh_proxy_type(&mut self, proxy_type: String, cx: &mut Context<Self>) {
         self.ssh_proxy_type = proxy_type;
         cx.notify();
@@ -901,7 +971,12 @@ impl Ashell {
             if event.modifiers.platform {
                 if let Some((row, col, _side)) = self.terminal_grid_point_and_side(event.position) {
                     if let Some(snapshot) = self.active_snapshot() {
-                        if let Some((url, _)) = crate::terminal::highlight::find_url_at_cell(&snapshot.cells, snapshot.rows, row, col) {
+                        if let Some((url, _)) = crate::terminal::highlight::find_url_at_cell(
+                            &snapshot.cells,
+                            snapshot.rows,
+                            row,
+                            col,
+                        ) {
                             let _ = open::that(&url);
                             return;
                         }
@@ -913,7 +988,8 @@ impl Ashell {
                     if !text.is_empty() {
                         cx.write_to_clipboard(gpui::ClipboardItem::new_string(text));
                         if let Some(active_id) = &self.active_tab {
-                            if let Some(tab) = self.tabs.iter_mut().find(|tab| &tab.id == active_id) {
+                            if let Some(tab) = self.tabs.iter_mut().find(|tab| &tab.id == active_id)
+                            {
                                 tab.clear_selection();
                             }
                         }
@@ -968,10 +1044,6 @@ impl Ashell {
         format!("{}@{}:{}", session.user, session.host, session.port)
     }
 
-
-
-
-
     pub(crate) fn split_current_pane(&mut self, direction: &str, cx: &mut Context<Self>) {
         tracing::info!(
             "[split] direction={} pane_root={:?} focused_path={:?} active_tab={:?} tabs={}",

src/session/ssh_config.rs

@@ -0,0 +1,180 @@
+use std::fs;
+use std::path::PathBuf;
+
+use anyhow::{Context, Result};
+use directories::BaseDirs;
+
+/// A parsed entry from ~/.ssh/config
+#[derive(Debug, Clone)]
+pub struct SshConfigEntry {
+    /// The Host pattern (alias) from the config, e.g. "myserver"
+    pub host_alias: String,
+    /// The actual hostname (HostName), defaults to the host alias if not specified
+    pub hostname: String,
+    /// The user, defaults to empty (will use current OS user)
+    pub user: String,
+    /// The port, defaults to 22
+    pub port: u16,
+    /// Identity files specified for this host
+    pub identity_files: Vec<String>,
+    /// Whether this is a wildcard/pattern host (Host * or Host *)
+    pub is_wildcard: bool,
+}
+
+/// Parse ~/.ssh/config and return a list of concrete host entries.
+/// Wildcard patterns (Host *) are excluded.
+pub fn parse_ssh_config() -> Result<Vec<SshConfigEntry>> {
+    let config_path = ssh_config_path()?;
+    if !config_path.is_file() {
+        return Ok(Vec::new());
+    }
+
+    let content = fs::read_to_string(&config_path)
+        .with_context(|| format!("failed to read {}", config_path.display()))?;
+
+    parse_ssh_config_content(&content)
+}
+
+fn ssh_config_path() -> Result<PathBuf> {
+    BaseDirs::new()
+        .map(|dirs| dirs.home_dir().join(".ssh/config"))
+        .context("failed to determine home directory")
+}
+
+/// Parse the content of an ssh config file into entries.
+pub fn parse_ssh_config_content(content: &str) -> Result<Vec<SshConfigEntry>> {
+    let mut entries: Vec<SshConfigEntry> = Vec::new();
+    let mut current_host: Option<SshConfigEntry> = None;
+
+    for line in content.lines() {
+        let line = line.trim();
+
+        // Skip empty lines and comments
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+
+        // Split into keyword and value
+        // OpenSSH supports both "keyword value" and "keyword=value" formats
+        let (keyword, value) = if let Some(pos) = line.find('=') {
+            (&line[..pos], line[pos + 1..].trim())
+        } else if let Some(pos) = line.find(' ') {
+            (&line[..pos], line[pos..].trim())
+        } else {
+            continue;
+        };
+
+        let keyword_lower = keyword.trim().to_lowercase();
+        let value = value.trim();
+
+        match keyword_lower.as_str() {
+            "host" => {
+                // Save previous entry if it exists and is not a wildcard
+                if let Some(entry) = current_host.take() {
+                    if !entry.is_wildcard {
+                        entries.push(entry);
+                    }
+                }
+
+                // Host line may contain multiple patterns (Host a b c)
+                // Take the first non-wildcard pattern as the display alias
+                let patterns: Vec<&str> = value.split_whitespace().collect();
+                if patterns.is_empty() {
+                    continue;
+                }
+                let host_alias = patterns
+                    .iter()
+                    .find(|p| !p.contains('*') && !p.contains('?'))
+                    .map(|p| p.to_string())
+                    .unwrap_or_else(|| patterns[0].to_string());
+
+                let is_wildcard = value.contains('*') || value.contains('?');
+
+                current_host = Some(SshConfigEntry {
+                    host_alias: host_alias.clone(),
+                    hostname: host_alias,
+                    user: String::new(),
+                    port: 22,
+                    identity_files: Vec::new(),
+                    is_wildcard,
+                });
+            }
+            "hostname" => {
+                if let Some(entry) = current_host.as_mut() {
+                    entry.hostname = value.to_string();
+                }
+            }
+            "user" => {
+                if let Some(entry) = current_host.as_mut() {
+                    entry.user = value.to_string();
+                }
+            }
+            "port" => {
+                if let Some(entry) = current_host.as_mut() {
+                    entry.port = value.parse::<u16>().unwrap_or(22);
+                }
+            }
+            "identityfile" => {
+                if let Some(entry) = current_host.as_mut() {
+                    entry.identity_files.push(value.to_string());
+                }
+            }
+            // Skip Match blocks and Include directives — not supported yet
+            "match" | "include" => {
+                // If we encounter a Match block, flush the current Host entry
+                // since Match blocks apply to all subsequent hosts until the next Match/Host
+                if let Some(entry) = current_host.take() {
+                    if !entry.is_wildcard {
+                        entries.push(entry);
+                    }
+                }
+                // Don't create a new entry for Match/Include
+            }
+            _ => {}
+        }
+    }
+
+    // Save the last entry if it's not a wildcard
+    if let Some(entry) = current_host.take() {
+        if !entry.is_wildcard {
+            entries.push(entry);
+        }
+    }
+
+    Ok(entries)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_ssh_config_content() {
+        let content = r#"
+            Host myhost
+                HostName 1.2.3.4
+                User git
+                Port 2222
+                IdentityFile ~/.ssh/id_rsa
+
+            Host
+            Host = 
+
+            Host anotherhost
+                HostName 5.6.7.8
+        "#;
+
+        let entries = parse_ssh_config_content(content).unwrap();
+        assert_eq!(entries.len(), 2);
+
+        assert_eq!(entries[0].host_alias, "myhost");
+        assert_eq!(entries[0].hostname, "1.2.3.4");
+        assert_eq!(entries[0].user, "git");
+        assert_eq!(entries[0].port, 2222);
+        assert_eq!(entries[0].identity_files, vec!["~/.ssh/id_rsa".to_string()]);
+
+        assert_eq!(entries[1].host_alias, "anotherhost");
+        assert_eq!(entries[1].hostname, "5.6.7.8");
+    }
+}
+

src/session/ssh_keys.rs

@@ -0,0 +1,96 @@
+use std::sync::Arc;
+
+use anyhow::{Result, anyhow};
+use directories::BaseDirs;
+use russh::{
+    client::{self, Handler},
+    keys::{HashAlg, PrivateKey, key::PrivateKeyWithHashAlg, load_secret_key},
+};
+
+use crate::session::config::Session;
+
+pub const DEFAULT_KEY_NAMES: &[&str] = &["id_ed25519", "id_rsa", "id_ecdsa", "id_dsa"];
+
+pub fn session_has_explicit_key(session: &Session) -> bool {
+    !session.private_key_path.trim().is_empty()
+        || !normalize_inline_private_key(&session.private_key_inline).is_empty()
+}
+
+pub fn normalize_inline_private_key(value: &str) -> String {
+    let mut normalized = value
+        .trim()
+        .replace("\\r\\n", "\n")
+        .replace("\\n", "\n")
+        .replace("\r\n", "\n");
+    if normalized.is_empty() {
+        return String::new();
+    }
+    if !normalized.ends_with('\n') {
+        normalized.push('\n');
+    }
+    normalized
+}
+
+pub fn private_keys_with_algs(keypair: PrivateKey) -> Result<Vec<PrivateKeyWithHashAlg>> {
+    let mut algs = Vec::new();
+    let key_arc = Arc::new(keypair);
+
+    if key_arc.algorithm().is_rsa() {
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha512)) {
+            algs.push(k);
+        }
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha256)) {
+            algs.push(k);
+        }
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
+            algs.push(k);
+        }
+    } else if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
+        algs.push(k);
+    }
+
+    if algs.is_empty() {
+        return Err(anyhow!(
+            "Failed to construct PrivateKeyWithHashAlg for any supported hash algorithm"
+        ));
+    }
+
+    Ok(algs)
+}
+
+pub async fn authenticate_with_default_keys<H>(
+    handle: &mut client::Handle<H>,
+    user: &str,
+    passphrase: Option<&str>,
+) -> Result<bool>
+where
+    H: Handler + Send + Sync,
+    H::Error: Into<anyhow::Error>,
+{
+    let Some(ssh_dir) = BaseDirs::new().map(|d| d.home_dir().join(".ssh")) else {
+        return Ok(false);
+    };
+
+    for key_name in DEFAULT_KEY_NAMES {
+        let key_path = ssh_dir.join(key_name);
+        if !key_path.exists() {
+            continue;
+        }
+        tracing::debug!("[ssh] trying default key {}", key_path.display());
+        match load_secret_key(&key_path, passphrase) {
+            Ok(keypair) => {
+                if let Ok(keys) = private_keys_with_algs(keypair) {
+                    for key in keys {
+                        match handle.authenticate_publickey(user, key).await {
+                            Ok(true) => return Ok(true),
+                            Ok(false) | Err(_) => continue,
+                        }
+                    }
+                }
+            }
+            Err(_) => continue,
+        }
+    }
+
+    Ok(false)
+}

src/sftp/mod.rs

@@ -14,7 +14,7 @@ use flate2::read::GzDecoder;
 use russh::{
     Disconnect,
     client::{self, Handler},
-    keys::{HashAlg, PrivateKey, decode_secret_key, key::PrivateKeyWithHashAlg, load_secret_key},
+    keys::{PrivateKey, decode_secret_key, load_secret_key},
 };
 use russh_sftp::client::SftpSession;
 use tokio::{
@@ -29,7 +29,13 @@ use zip::read::ZipArchive;
 use rust_i18n::t;
 
 use crate::{
-    session::config::{AuthMethod, Session},
+    session::{
+        config::{AuthMethod, Session},
+        ssh_keys::{
+            authenticate_with_default_keys, normalize_inline_private_key, private_keys_with_algs,
+            session_has_explicit_key,
+        },
+    },
     terminal::BackendEvent,
 };
 
@@ -844,37 +850,109 @@ async fn connect_and_authenticate(
             .await
             .context("password authentication failed")?,
         AuthMethod::Key => {
-            let keypair = load_session_private_key(session)?;
-            let keys = private_keys_with_algs(keypair).context("invalid private key")?;
-            let mut success = false;
-            for key in keys {
-                match handle.authenticate_publickey(&session.user, key).await {
-                    Ok(true) => {
-                        success = true;
-                        break;
-                    }
-                    Ok(false) => {
-                        tracing::debug!(
-                            "[sftp] public key auth failed with algorithm, trying next"
-                        );
-                        continue;
-                    }
-                    Err(e) => {
-                        tracing::debug!("[sftp] public key auth error: {:?}, trying next", e);
-                        continue;
+            let has_explicit_key = session_has_explicit_key(session);
+            let success = if has_explicit_key {
+                let keypair = load_session_private_key(session)?;
+                let keys = private_keys_with_algs(keypair).context("invalid private key")?;
+                let mut success = false;
+                for key in keys {
+                    match handle.authenticate_publickey(&session.user, key).await {
+                        Ok(true) => {
+                            success = true;
+                            break;
+                        }
+                        Ok(false) => {
+                            tracing::debug!(
+                                "[sftp] public key auth failed with algorithm, trying next"
+                            );
+                            continue;
+                        }
+                        Err(e) => {
+                            tracing::debug!("[sftp] public key auth error: {:?}, trying next", e);
+                            continue;
+                        }
                     }
                 }
-            }
-            if !success {
-                return Err(anyhow!(
-                    "public key authentication failed for {}@{}:{}",
-                    session.user,
-                    session.host,
-                    session.port
-                ));
-            }
+                if !success {
+                    return Err(anyhow!(
+                        "public key authentication failed for {}@{}:{}",
+                        session.user,
+                        session.host,
+                        session.port
+                    ));
+                }
+                success
+            } else {
+                let passphrase = session.passphrase.trim();
+                let passphrase = (!passphrase.is_empty()).then_some(passphrase);
+                let success =
+                    authenticate_with_default_keys(&mut handle, &session.user, passphrase)
+                        .await?;
+                if !success {
+                    return Err(anyhow!(
+                        "public key authentication failed for {}@{}:{} - no valid default key found in ~/.ssh/",
+                        session.user,
+                        session.host,
+                        session.port
+                    ));
+                }
+                success
+            };
             success
         }
+        AuthMethod::Config => {
+            // For Config auth, try the identity file from config entry, or default keys
+            // Note: for Config auth, we never use inline key content
+            let has_explicit_key = !session.private_key_path.trim().is_empty();
+
+            if has_explicit_key {
+                let keypair = load_session_private_key(session)?;
+                let keys = private_keys_with_algs(keypair).context("invalid private key")?;
+                let mut success = false;
+                for key in keys {
+                    match handle.authenticate_publickey(&session.user, key).await {
+                        Ok(true) => {
+                            success = true;
+                            break;
+                        }
+                        Ok(false) => {
+                            tracing::debug!(
+                                "[sftp] public key auth failed with algorithm, trying next"
+                            );
+                            continue;
+                        }
+                        Err(e) => {
+                            tracing::debug!("[sftp] public key auth error: {:?}, trying next", e);
+                            continue;
+                        }
+                    }
+                }
+                if !success {
+                    return Err(anyhow!(
+                        "ssh-config key authentication failed for {}@{}:{}",
+                        session.user,
+                        session.host,
+                        session.port
+                    ));
+                }
+                success
+            } else {
+                let passphrase = session.passphrase.trim();
+                let passphrase = (!passphrase.is_empty()).then_some(passphrase);
+                let success =
+                    authenticate_with_default_keys(&mut handle, &session.user, passphrase)
+                        .await?;
+                if !success {
+                    return Err(anyhow!(
+                        "ssh-config authentication failed for {}@{}:{} - no valid default key found",
+                        session.user,
+                        session.host,
+                        session.port
+                    ));
+                }
+                success
+            }
+        }
     };
 
     if !authed {
@@ -886,6 +964,7 @@ async fn connect_and_authenticate(
             match session.auth {
                 AuthMethod::Password => "password",
                 AuthMethod::Key => "public key",
+                AuthMethod::Config => "ssh-config",
             },
             session.user,
             session.host,
@@ -927,47 +1006,6 @@ fn load_session_private_key(session: &Session) -> Result<PrivateKey> {
     Err(anyhow!(errors.join("; ")))
 }
 
-fn private_keys_with_algs(keypair: PrivateKey) -> Result<Vec<PrivateKeyWithHashAlg>> {
-    let mut algs = Vec::new();
-    let key_arc = Arc::new(keypair);
-
-    if key_arc.algorithm().is_rsa() {
-        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha512)) {
-            algs.push(k);
-        }
-        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha256)) {
-            algs.push(k);
-        }
-        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
-            algs.push(k);
-        }
-    } else {
-        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
-            algs.push(k);
-        }
-    }
-
-    if algs.is_empty() {
-        return Err(anyhow!(
-            "Failed to construct PrivateKeyWithHashAlg for any supported hash algorithm"
-        ));
-    }
-
-    Ok(algs)
-}
-
-fn normalize_inline_private_key(value: &str) -> String {
-    let mut normalized = value
-        .trim()
-        .replace("\\r\\n", "\n")
-        .replace("\\n", "\n")
-        .replace("\r\n", "\n");
-    if !normalized.ends_with('\n') {
-        normalized.push('\n');
-    }
-    normalized
-}
-
 fn expand_key_path(value: &str) -> Option<PathBuf> {
     if value.is_empty() {
         return None;