v1.3.0: SSH key auth release — docs, CHANGELOG, demo

- Bump version to 1.3.0.
- Make `credential_ref` optional in hosts.toml so a key-only host with an
  unencrypted key needs no placeholder credential.
- CHANGELOG: 1.3.0 section (SSH key auth, Shift+arrow reorder, optional
  credential_ref, in-session credential-failure and transient-status fixes).
- Demo: re-recorded gif showing the SSH-key host's edit form and Ctrl+arrow
  reorder; demo config gains a key-authenticated host. Taller capture so the
  9-field form fits. Quit with Esc (q now types into search).

Author: GokhanTurk

CHANGELOG.md

@@ -3,6 +3,31 @@
 All notable changes to **gukab** are documented here.
 This project follows [Semantic Versioning](https://semver.org).
 
+## [1.3.0] - 2026-06-23
+
+### Added
+- **SSH key authentication.** A host can set an `identity_file` (private key path,
+  e.g. `~/.ssh/id_ed25519`) — set it in the host form's new **SSH key file** field.
+  Only the path is stored; the key material is never copied into `hosts.toml` or the
+  keyring. Auth is tried in order: public key → password → keyboard-interactive →
+  none. An encrypted key's passphrase is read from the host's keyring `credential_ref`
+  (store it with `Ctrl+K`); a passphrase-less key needs no credential at all.
+  Keys load via OpenSSH, legacy PEM (PKCS#1 `BEGIN RSA PRIVATE KEY`), PKCS#8, and
+  PuTTY formats; a group/other-readable key file triggers a non-blocking warning.
+- **Reorder hosts with `Shift+↑` / `Shift+↓`** in addition to `Ctrl+↑` / `Ctrl+↓` —
+  on macOS `Ctrl+↑/↓` is intercepted by Mission Control before reaching the terminal.
+
+### Changed
+- `credential_ref` is now optional in `hosts.toml` — a key-only host (or an in-band
+  login switch) no longer needs a placeholder credential.
+
+### Fixed
+- A failed expect-rule credential lookup (a missing or mistyped keyring ref) no
+  longer tears down the live SSH session. It now warns once, disarms that rule, and
+  lets you answer the prompt by hand.
+- Status-bar messages are transient again: a warning (e.g. "clear the search to
+  reorder") is cleared on the next keypress, so the keybinding hints reappear.
+
 ## [1.2.0] - 2026-06-18
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "gukab"
-version = "1.2.0"
+version = "1.3.0"
 edition = "2024"
 description = "A terminal-only (TUI) SSH connection manager for network devices."
 license = "GPL-3.0-or-later"

Cargo.toml

@@ -3,19 +3,19 @@
 
 [[groups]]
 name = "Core"
-icon = ""
+icon = ""
 
 [[groups]]
 name = "Distribution"
-icon = ""
+icon = ""
 
 [[groups]]
 name = "Access"
-icon = ""
+icon = ""
 
 [[groups]]
 name = "Servers"
-icon = ""
+icon = ""
 
 [[hosts]]
 name = "core-switch-01"
@@ -97,12 +97,13 @@ username = "netadmin"
 credential_ref = "demo"
 group = "Access"
 
+# Key-authenticated host: only the key path is stored, no password/credential.
 [[hosts]]
 name = "srv-web-01"
 hostname = "10.0.3.10"
 port = 22
 username = "netadmin"
-credential_ref = "demo"
+identity_file = "~/.ssh/id_ed25519"
 group = "Servers"
 
 [[hosts]]

docs/demo-home/.config/gukab/hosts.toml

@@ -8,7 +8,7 @@ Set Shell "bash"
 Set FontFamily "FiraCode Nerd Font Mono"
 Set FontSize 18
 Set Width 1200
-Set Height 700
+Set Height 820
 Set Theme "Catppuccin Mocha"
 Set Padding 18
 Set TypingSpeed 85ms
@@ -26,8 +26,20 @@ Down Sleep 250ms
 Down Sleep 250ms
 Down Sleep 250ms
 Down Sleep 250ms
-Down Sleep 250ms
-Sleep 800ms
+Sleep 700ms
+
+# Reorder a host within its group (Ctrl+↑/↓; Shift+↑/↓ also works on macOS).
+Up Sleep 200ms
+Up Sleep 200ms
+Up Sleep 200ms
+Up Sleep 200ms
+Up Sleep 200ms
+Up Sleep 200ms
+Sleep 400ms
+Down Sleep 350ms
+Ctrl+Down Sleep 700ms
+Ctrl+Down Sleep 700ms
+Ctrl+Up   Sleep 800ms
 
 # Fuzzy search: substring filtering by group.
 Type "core"   Sleep 1.6s
@@ -37,19 +49,12 @@ Backspace 4   Sleep 300ms
 Type "r3"     Sleep 1.8s
 Backspace 2   Sleep 300ms
 
-# Another fuzzy filter.
-Type "acc"    Sleep 1.6s
-Backspace 3   Sleep 500ms
-
-# Navigate the list.
-Down Sleep 350ms
-Down Sleep 350ms
-Down Sleep 350ms
-Up   Sleep 450ms
-
-# Open the Add Host form, then close it.
-Ctrl+N        Sleep 2s
-Escape        Sleep 700ms
+# SSH key auth: open a key-authenticated host in the edit form — note the
+# "SSH key file" field pointing at a private key (only the path is stored).
+Type "web"    Sleep 1.2s
+Ctrl+E        Sleep 2.6s
+Escape        Sleep 600ms
+Backspace 3   Sleep 400ms
 
-# Quit.
-Type "q"      Sleep 1.2s
+# Quit (Esc — the search box is always live, so q types into it).
+Escape        Sleep 1.2s

docs/demo.gif

@@ -9,6 +9,10 @@ pub struct Host {
     #[serde(default = "default_port")]
     pub port: u16,
     pub username: String,
+    /// Keyring entry name for this host's secret: a login password, or the
+    /// passphrase of `identity_file`. Optional — a key-only host with an
+    /// unencrypted key (or a switch that logs in in-band) needs no secret.
+    #[serde(default)]
     pub credential_ref: String,
     /// Path to a private key file (e.g. `~/.ssh/id_ed25519`). Empty = password auth.
     /// The key material is never copied into config or keyring — only this path is