Interactive TUI, SSH 2FA, multi-forward tunnels, and connection testing

[aretcamgoz]

This is a sizeable, multi-feature contribution — four related additions plus a couple of fixes. I'm aware that's a lot for a single PR; I'm happy to split it into separate focused PRs, or to open issues to discuss scope first, if you'd prefer — just say the word.

Everything is backward compatible: existing configs and the existing CLI commands (open/close/list/edit) behave exactly as before.

Features

Interactive terminal UI — boring tui

A Bubble Tea dashboard for managing tunnels and editing the config without hand-editing .boring.toml:

• Live, colour-coded status (open / reconnecting / needs-auth / closed).
• Open, close and test connections; add / edit / delete tunnels through a form that writes back to .boring.toml (the original is backed up once as .boring.toml.bak).
• Multi-forward tunnels render as a grouped tree.

SSH interactive authentication — 2FA and key passphrases

• Keyboard-interactive (2FA / one-time codes) and passphrase-protected private keys are now supported. boring open prompts on the terminal; the TUI shows a modal.
• The daemon relays auth prompts to the connected client via a multi-message Open IPC exchange (AuthPrompt/AuthReply).
• A 2FA tunnel that drops is not blindly auto-reconnected (a fresh code is required); it rests at a new needs auth status so the user can re-open it.

Multiple forwards over one SSH connection

• One [[tunnels]] entry can carry multiple [[tunnels.forward]] blocks — one SSH connection serving many port forwards (one handshake, one authentication, one 2FA prompt). The legacy single-local/remote form is unchanged: it is simply a tunnel with one forward, so existing configs need no edits.

boring test (alias t)

• Verifies a tunnel's SSH handshake + authentication without opening a listener — boring test <patterns>....

Fixes

• Honour the IdentityAgent ssh_config directive, so agents configured that way (e.g. 1Password's SSH agent) are used — previously only $SSH_AUTH_SOCK was consulted.
• Offer an explicitly-configured identity key before unconfigured agent keys, so a server's MaxAuthTries limit no longer cuts off the right key when the agent holds many.

Notes

• New dependencies: charmbracelet/bubbletea, lipgloss, bubbles (TUI only).
• ~9k lines across 89 files. All five CI static-analysis gates pass (gofmt, go vet, gocyclo ≤ 15, ineffassign, misspell); combined unit + e2e coverage is 84.5%.
• README updated; the design rationale can be shared if useful.

Test plan

• `make test` — unit + e2e suites
• `make cover` — coverage report
• Static analysis: gofmt / go vet / gocyclo / ineffassign / misspell
• Manual: `boring tui`; `boring test`; a multi-forward `[[tunnels.forward]]` config; a 2FA-protected host

[alebeck]

Hi @aretcamgoz, thanks for your interest in the project and your contributions. My goal is to keep boring minimal/lightweight and to avoid scope creep, which means to be conservative regarding new features.

That said, I think there might be some interesting additions/fixes in your PR. Give me some time to experiment with it, and we can potentially formulate 1-2 issues for smaller-scoped changes based on that and work from there?

[alebeck]

Hi @aretcamgoz, I think two good first bug fixes that we can spin off into dedicated issues (and later PRs) would be:

• IdentityAgent ssh_config directive was ignored
• Explicitly-configured identity key offered too late

More on the scope-expanding side, but potentially worth exploring would be:

• Multi-forward tunnels
  but these would probably need some discussion on how to implement them best.

Would you like to open corresponding issues? Thanks again.

[mchrisb03]

Lack of multiple port forwards per ssh tunnel is the one thing that is preventing me from using this program and suggesting it to others.

It really needs to support something like:

   name = "dev"                                                                                                                                                                                                           
   forwards = [                                                                                                                                                                                                           
     { local = "3000", remote = "localhost:3000" },                                                                                                                                                                       
     { local = "5432", remote = "localhost:5432" },                                                                                                                                                                       
   ]