feat: netssh multi — several hosts side by side in tmux or zellij

netssh multi opens one pane per host in a tmux window or zellij tab.
Hosts come from names, tag:TAG (NetBox and static hosts), cluster:NAME
(NetBox virtualization clusters; devices by default, --kind vm|all),
and groups from the config (@name, nested, with cycle detection).
Every pane runs netssh HOST, so lookup, rules, and jump hosts apply.

- tmux: a new window inside tmux, else a new session that is attached;
  tiled layout, pane borders with the host and a [SYNC] marker.
- zellij: a generated grid layout; a new tab inside zellij, else a new
  session.
- --sync broadcasts typing to all panes; netssh sync toggles it in the
  current tmux window or zellij tab.
- TUI: Space marks hosts, Ctrl+A marks all, Enter opens them together.
- Configurator: multiplexer, panes per window, groups.

NetBox SearchAll gains a cluster filter (name to cluster IDs per
instance), and cache entries keep the host's cluster for completion
and an offline fallback. Panes skip the 24-hour background refresh
(checked once by multi) and get HOME/XDG paths but no NETSSH_* values,
which would expose tokens in the process list.

testenv/tests/15-multi.sh checks real tmux and zellij sessions,
including a broadcast command arriving on all three cluster nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -20,6 +20,9 @@ type Config struct {
 	Shortcuts  ShortcutsConfig  `mapstructure:"shortcuts"`
 	Completion CompletionConfig `mapstructure:"completion"`
 	Hosts      []StaticHost     `mapstructure:"hosts"`
+	// Groups name lists of hosts and selectors for netssh multi (@name).
+	Groups map[string][]string `mapstructure:"groups"`
+	Multi  MultiConfig         `mapstructure:"multi"`
 }
 
 type ShellConfig struct {
@@ -117,7 +120,7 @@ func Load() (*Config, error) {
 	v.SetEnvPrefix("NETSSH")
 	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
 	v.AutomaticEnv()
-	for _, key := range []string{"netbox.url", "netbox.token", "netbox.token_version", "resolver.strategies", "resolver.management_subnets", "resolver.interface_name", "resolver.hostname_domain", "cache.ttl", "cache.path", "ssh.default_user", "ssh.default_port", "shortcuts.domains", "shortcuts.strip_hyphens", "shell.alias", "ssh.proxy_jump", "ssh.host_key_checking", "ssh.target", "ssh.address_family", "completion.max_results"} {
+	for _, key := range []string{"netbox.url", "netbox.token", "netbox.token_version", "resolver.strategies", "resolver.management_subnets", "resolver.interface_name", "resolver.hostname_domain", "cache.ttl", "cache.path", "ssh.default_user", "ssh.default_port", "shortcuts.domains", "shortcuts.strip_hyphens", "shell.alias", "ssh.proxy_jump", "ssh.host_key_checking", "ssh.target", "ssh.address_family", "completion.max_results", "multi.multiplexer", "multi.panes_per_window"} {
 		if err := v.BindEnv(key); err != nil {
 			return nil, err
 		}
@@ -163,6 +166,9 @@ func Load() (*Config, error) {
 	if err := cfg.ValidateHosts(); err != nil {
 		return nil, err
 	}
+	if err := cfg.ValidateMulti(); err != nil {
+		return nil, err
+	}
 	for i := range cfg.NetBoxes {
 		source := &cfg.NetBoxes[i]
 		source.Name = strings.ToLower(source.Name)

internal/config/multi.go

@@ -0,0 +1,57 @@
+package config
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// MultiConfig controls netssh multi.
+type MultiConfig struct {
+	// Multiplexer is auto, tmux, or zellij; empty means auto.
+	Multiplexer string `mapstructure:"multiplexer"`
+	// PanesPerWindow splits larger host lists into more windows or tabs; 0 = 9.
+	PanesPerWindow int `mapstructure:"panes_per_window"`
+}
+
+// DefaultPanesPerWindow keeps panes readable on a normal screen (3×3).
+const DefaultPanesPerWindow = 9
+
+// ValidateMulti checks groups and the multi settings.
+func (c *Config) ValidateMulti() error {
+	switch c.Multi.Multiplexer {
+	case "", "auto", "tmux", "zellij":
+	default:
+		return fmt.Errorf("multi.multiplexer must be auto, tmux, or zellij")
+	}
+	if c.Multi.PanesPerWindow < 0 || c.Multi.PanesPerWindow > 64 {
+		return fmt.Errorf("multi.panes_per_window must be between 1 and 64")
+	}
+	names := make([]string, 0, len(c.Groups))
+	for name := range c.Groups {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		if !instanceName.MatchString(name) {
+			return fmt.Errorf("groups: name %q must contain only letters, digits, underscores, or hyphens", name)
+		}
+		if len(c.Groups[name]) == 0 {
+			return fmt.Errorf("groups.%s: needs at least one host or selector", name)
+		}
+		for _, selector := range c.Groups[name] {
+			if strings.TrimSpace(selector) == "" || strings.ContainsAny(selector, " \t\n") || strings.HasPrefix(selector, "-") {
+				return fmt.Errorf("groups.%s: invalid entry %q", name, selector)
+			}
+		}
+	}
+	return nil
+}
+
+// PanesPerWindowOrDefault returns the configured value or the default.
+func (m MultiConfig) PanesPerWindowOrDefault() int {
+	if m.PanesPerWindow > 0 {
+		return m.PanesPerWindow
+	}
+	return DefaultPanesPerWindow
+}

internal/config/ssh_test.go

@@ -190,3 +190,15 @@ func TestStaticHostsValidation(t *testing.T) {
 		}
 	}
 }
+
+func TestMultiConfig(t *testing.T) {
+	cfg, err := loadYAML(t, "groups:\n  K8s: [master1, \"tag:worker\"]\nmulti:\n  multiplexer: zellij\n")
+	if err != nil || len(cfg.Groups["k8s"]) != 2 || cfg.Multi.Multiplexer != "zellij" || cfg.Multi.PanesPerWindowOrDefault() != 9 {
+		t.Fatalf("%+v %v", cfg, err)
+	}
+	for _, bad := range []string{"multi: {multiplexer: screen}", "multi: {panes_per_window: 100}", "groups: {web: []}", "groups: {web: [\"a b\"]}"} {
+		if _, err := loadYAML(t, bad+"\n"); err == nil {
+			t.Errorf("%s accepted", bad)
+		}
+	}
+}