feat: netssh multi — several hosts side by side in tmux or zellij

netssh multi opens one pane per host in a tmux window or zellij tab.
Hosts come from names, tag:TAG (NetBox and static hosts), cluster:NAME
(NetBox virtualization clusters; devices by default, --kind vm|all),
and groups from the config (@name, nested, with cycle detection).
Every pane runs netssh HOST, so lookup, rules, and jump hosts apply.

- tmux: a new window inside tmux, else a new session that is attached;
  tiled layout, pane borders with the host and a [SYNC] marker.
- zellij: a generated grid layout; a new tab inside zellij, else a new
  session.
- --sync broadcasts typing to all panes; netssh sync toggles it in the
  current tmux window or zellij tab.
- TUI: Space marks hosts, Ctrl+A marks all, Enter opens them together.
- Configurator: multiplexer, panes per window, groups.

NetBox SearchAll gains a cluster filter (name to cluster IDs per
instance), and cache entries keep the host's cluster for completion
and an offline fallback. Panes skip the 24-hour background refresh
(checked once by multi) and get HOME/XDG paths but no NETSSH_* values,
which would expose tokens in the process list.

testenv/tests/15-multi.sh checks real tmux and zellij sessions,
including a broadcast command arriving on all three cluster nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/multiplex/multiplex_test.go

@@ -0,0 +1,211 @@
+package multiplex
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+)
+
+// fake records commands and answers like tmux and zellij would.
+type fake struct {
+	env       map[string]string
+	installed map[string]bool
+	sessions  map[string]bool
+	calls     []string
+	exec      []string
+	files     map[string]string
+	syncState string
+	n         int
+}
+
+func newFake(env map[string]string, installed ...string) *fake {
+	f := &fake{env: env, installed: map[string]bool{}, sessions: map[string]bool{}, files: map[string]string{}, syncState: "off"}
+	for _, name := range installed {
+		f.installed[name] = true
+	}
+	return f
+}
+
+func (f *fake) Output(argv ...string) (string, error) {
+	f.calls = append(f.calls, strings.Join(argv, " "))
+	f.n++
+	switch argv[1] {
+	case "new-window", "new-session":
+		return fmt.Sprintf("@%d %%%d", f.n, f.n), nil
+	case "split-window":
+		return fmt.Sprintf("%%%d", f.n), nil
+	case "has-session":
+		if f.sessions[strings.TrimPrefix(argv[3], "=")] {
+			return "", nil
+		}
+		return "", errors.New("can't find session")
+	case "show-window-options":
+		return f.syncState, nil
+	}
+	return "", nil
+}
+func (f *fake) Exec(argv ...string) error { f.exec = argv; return nil }
+func (f *fake) LookPath(name string) (string, error) {
+	if f.installed[name] {
+		return "/usr/bin/" + name, nil
+	}
+	return "", errors.New("not found")
+}
+func (f *fake) Getenv(key string) string { return f.env[key] }
+func (f *fake) WriteFile(path string, data []byte) error {
+	f.files[path] = string(data)
+	return nil
+}
+
+func panes(names ...string) []Pane {
+	out := make([]Pane, 0, len(names))
+	for _, name := range names {
+		out = append(out, Pane{Title: name, Argv: []string{"/usr/bin/netssh", name}})
+	}
+	return out
+}
+
+func TestDetect(t *testing.T) {
+	for _, tc := range []struct {
+		requested string
+		env       map[string]string
+		installed []string
+		want      string
+	}{
+		{"", map[string]string{"TMUX": "/tmp/tmux"}, []string{"tmux", "zellij"}, Tmux},
+		{"auto", map[string]string{"ZELLIJ": "0"}, []string{"tmux", "zellij"}, Zellij},
+		{"", nil, []string{"tmux", "zellij"}, Tmux},
+		{"", nil, []string{"zellij"}, Zellij},
+		{"zellij", map[string]string{"TMUX": "x"}, []string{"tmux", "zellij"}, Zellij},
+	} {
+		got, err := Detect(tc.requested, newFake(tc.env, tc.installed...))
+		if err != nil || got != tc.want {
+			t.Errorf("%+v: got %q %v", tc, got, err)
+		}
+	}
+	if _, err := Detect("", newFake(nil)); !errors.Is(err, ErrNone) {
+		t.Errorf("nothing installed: %v", err)
+	}
+	if _, err := Detect("tmux", newFake(nil, "zellij")); err == nil {
+		t.Error("missing requested multiplexer accepted")
+	}
+}
+
+func TestTmuxInside(t *testing.T) {
+	f := newFake(map[string]string{"TMUX": "/tmp/tmux-1/default"}, "tmux")
+	if err := Open(Tmux, panes("a", "b", "c"), Options{Label: "pve", Sync: true}, f); err != nil {
+		t.Fatal(err)
+	}
+	script := "sh -c " + paneScript + " netssh-pane /usr/bin/netssh "
+	want := []string{
+		"tmux new-window -P -F #{window_id} #{pane_id} -n pve " + script + "a",
+		"tmux split-window -t @1 -P -F #{pane_id} " + script + "b",
+		"tmux select-layout -t @1 tiled",
+		"tmux split-window -t @1 -P -F #{pane_id} " + script + "c",
+		"tmux select-layout -t @1 tiled",
+		"tmux set-option -p -t %1 @netssh_host a",
+		"tmux set-option -p -t %2 @netssh_host b",
+		"tmux set-option -p -t %4 @netssh_host c",
+		"tmux set-window-option -t @1 pane-border-status top",
+		"tmux set-window-option -t @1 pane-border-format  #{@netssh_host}#{?pane_synchronized, [SYNC],} ",
+		"tmux set-window-option -t @1 synchronize-panes on",
+		"tmux select-window -t @1",
+	}
+	if strings.Join(f.calls, "\n") != strings.Join(want, "\n") {
+		t.Fatalf("calls:\n%s\nwant:\n%s", strings.Join(f.calls, "\n"), strings.Join(want, "\n"))
+	}
+	if f.exec != nil {
+		t.Fatal("inside tmux must not attach")
+	}
+}
+
+func TestTmuxOutsideSplitsWindowsAndAvoidsSessionNames(t *testing.T) {
+	f := newFake(nil, "tmux")
+	f.sessions["netssh-pve"] = true
+	var hints []string
+	err := Open(Tmux, panes("a", "b", "c"), Options{Label: "pve", PerWindow: 2, Hint: func(s string) { hints = append(hints, s) }}, f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	joined := strings.Join(f.calls, "\n")
+	for _, want := range []string{
+		"tmux has-session -t =netssh-pve-2",
+		"tmux new-session -d -x 240 -y 70 -s netssh-pve-2 -P -F #{window_id} #{pane_id} -n pve-1 ",
+		"tmux new-window -t netssh-pve-2: -P -F #{window_id} #{pane_id} -n pve-2 ",
+	} {
+		if !strings.Contains(joined, want) {
+			t.Errorf("missing %q in\n%s", want, joined)
+		}
+	}
+	if strings.Contains(joined, "synchronize-panes") {
+		t.Error("sync set without --sync")
+	}
+	if strings.Join(f.exec, " ") != "tmux attach-session -t netssh-pve-2" || len(hints) != 1 {
+		t.Fatalf("exec %v hints %v", f.exec, hints)
+	}
+}
+
+func TestZellijOutsideWritesGridLayout(t *testing.T) {
+	f := newFake(nil, "zellij")
+	if err := Open(Zellij, panes("a", "b", "c", `q"x`), Options{Label: "pve", LayoutDir: "/tmp/l"}, f); err != nil {
+		t.Fatal(err)
+	}
+	layout := f.files["/tmp/l/netssh-multi.kdl"]
+	for _, want := range []string{
+		`plugin location="zellij:tab-bar"`,
+		`tab name="pve" focus=true {`,
+		`pane split_direction="vertical" {`,
+		`pane name="a" command="/usr/bin/netssh" {`,
+		`args "a"`,
+		`pane name="q\"x" command="/usr/bin/netssh" {`,
+	} {
+		if !strings.Contains(layout, want) {
+			t.Errorf("layout lacks %q:\n%s", want, layout)
+		}
+	}
+	// 4 panes → 2 columns × 2 rows.
+	if n := strings.Count(layout, `split_direction="vertical"`); n != 2 {
+		t.Errorf("%d rows, want 2:\n%s", n, layout)
+	}
+	if strings.Join(f.exec, " ") != "zellij --layout /tmp/l/netssh-multi.kdl" {
+		t.Fatalf("exec %v", f.exec)
+	}
+}
+
+func TestZellijInsideAddsTabs(t *testing.T) {
+	f := newFake(map[string]string{"ZELLIJ": "0"}, "zellij")
+	if err := Open(Zellij, panes("a", "b", "c"), Options{Label: "pve", PerWindow: 2, Sync: true, LayoutDir: "/tmp/l"}, f); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{
+		"zellij action new-tab --layout /tmp/l/netssh-multi-1.kdl",
+		"zellij action toggle-active-sync-tab",
+		"zellij action new-tab --layout /tmp/l/netssh-multi-2.kdl",
+		"zellij action toggle-active-sync-tab",
+	}
+	if strings.Join(f.calls, "\n") != strings.Join(want, "\n") {
+		t.Fatalf("calls:\n%s", strings.Join(f.calls, "\n"))
+	}
+	if !strings.Contains(f.files["/tmp/l/netssh-multi-2.kdl"], `tab name="pve-2"`) {
+		t.Fatalf("second tab: %s", f.files["/tmp/l/netssh-multi-2.kdl"])
+	}
+}
+
+func TestToggleSync(t *testing.T) {
+	f := newFake(map[string]string{"TMUX": "x"})
+	if state, err := ToggleSync(f); err != nil || state != "broadcast on" || f.calls[1] != "tmux set-window-option synchronize-panes on" {
+		t.Fatalf("%q %v %v", state, err, f.calls)
+	}
+	f.syncState = "on"
+	if state, _ := ToggleSync(f); state != "broadcast off" {
+		t.Fatalf("%q", state)
+	}
+	z := newFake(map[string]string{"ZELLIJ": "0"})
+	if _, err := ToggleSync(z); err != nil || z.calls[0] != "zellij action toggle-active-sync-tab" {
+		t.Fatalf("%v %v", err, z.calls)
+	}
+	if _, err := ToggleSync(newFake(nil)); err == nil {
+		t.Fatal("outside a multiplexer accepted")
+	}
+}