Offer to bring the keys an ssh_config points at

An import that recorded a key path and left every host asking for a password was
an import whose result did not connect. The answer to that was a manual paste per
key, which is the sort of thing people do once and then stop importing.

So there is a tick, and it starts off. With it off nothing changes: an
IdentityFile becomes a note and the host asks for a password. With it on, IMPORT
reads each host's first IdentityFile out of ~/.ssh, stores it in the vault
encrypted like any other key, and binds the host to it.

Three things about how it is drawn are load-bearing rather than tidy. It is a
default nobody arrives at by accident. The sentence beside it names the directory
rather than saying "your keys", because that is what somebody is agreeing to. And
nothing is read during SCAN — tick it, read what it says, untick it, and no
private key has been opened. This is the only place the application opens key
material out of a directory the user did not point at file by file, and the whole
of what makes that acceptable is that it took a deliberate press.

One vault key per file, however many entries named it: an ssh_config pointing
twelve hosts at one id_ed25519 is the ordinary shape, and twelve copies would be
twelve things to rotate and eleven to forget. A file whose material is already in
the keychain is bound to rather than stored again, which is what makes running
the import twice harmless.

What cannot be read off a disk is a passphrase, so a protected key arrives
without one — and the report under the button names those files rather than
leaving a host to fail at connect time with a message about a malformed key.
Telling them apart means decoding for OpenSSH's own container, whose cipher name
is the first field inside the base64 rather than anything in the armour, and that
is the format ssh-keygen has written by default for years. The 88 base64
characters it decodes need 66 bytes, not 64: with the smaller span every
protected key came back unprotected, which the tests now pin.

A path that is not on this machine leaves its host imported and unbound, exactly
as it would have been with the tick off, and is named in the same report. A
config carried from another machine is the ordinary case, not an error.

src/DodoSSH.Client.App/Views/ImportScreen.axaml

@@ -15,6 +15,17 @@
     Reachable from the preferences screen and not from the nav rail. It is a task rather than a
     destination — done once, or once a year — and a seventh rail entry would cost every screen a slot for
     something almost nobody is looking at.
+
+    ── ◆ THE ONE TICK THAT READS PRIVATE KEYS ─────────────────────────────────────────────────────────────
+    Below the list, off, and drawn only where the scan actually found an IdentityFile. It is the only control
+    in this application that opens private key material out of a directory the user did not point at file by
+    file, so three things about how it is drawn are load-bearing rather than tidy: it is a default nobody
+    arrives at by accident, the sentence beside it names the directory rather than saying "keys", and nothing
+    is read until IMPORT is pressed — so ticking it, reading the sentence and unticking it costs nothing.
+
+    What comes back afterwards is the report under the list: one line per key file, saying which were stored,
+    which are protected by a passphrase this cannot know, and which were not there at all. That is reported
+    rather than previewed for the same reason — previewing would mean reading them.
   -->
 
   <Grid RowDefinitions="Auto,Auto,Auto,*,Auto">
@@ -100,17 +111,57 @@
             IsVisible="{Binding HasRows}">
       <StackPanel Spacing="8">
         <!--
-          Said before the button, not after. A key path is recorded and the key itself is not read: that is
-          the difference between a bookmark that connects and one that asks for a password, and somebody
-          who is not told will conclude the import was broken.
+          Said before the button, not after. Whether the key material comes with the host is the difference
+          between a bookmark that connects and one that asks for a password, and somebody who is not told
+          will conclude the import was broken.
         -->
         <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
-                   Text="Key files are not read. Where ssh_config names an IdentityFile the path is recorded as a note, and the host asks for a password until you bind it to a key in your keychain. Nothing here reaches into ~/.ssh for private key material." />
+                   IsVisible="{Binding !ImportsKeys}"
+                   Text="Key files are not read. Where ssh_config names an IdentityFile the path is recorded as a note, and the host asks for a password until you bind it to a key in your keychain." />
+
+        <!--
+          ◆ THE TICK. Hidden entirely where the scan found no IdentityFile anywhere — an offer to read ~/.ssh
+          on a screen where it would read nothing is a control that teaches people to ignore it.
+
+          The warning sentence appears only when it is on, and it is the one place this application says out
+          loud that it is about to open private keys. It names the directory rather than saying "your keys",
+          because what somebody is agreeing to is a read of that directory.
+        -->
+        <StackPanel Spacing="6" IsVisible="{Binding HasKeyFiles}">
+          <CheckBox IsChecked="{Binding ImportsKeys}">
+            <TextBlock Classes="mono" FontSize="11.5" TextWrapping="Wrap"
+                       Text="Also import the private keys these hosts point at" />
+          </CheckBox>
+          <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                     IsVisible="{Binding ImportsKeys}" Foreground="{StaticResource WarnText}"
+                     Text="Pressing IMPORT will read each host's first IdentityFile out of ~/.ssh, store it in this vault encrypted, and bind the host to it. One key is stored per file however many hosts name it, and a file already in your keychain is bound to rather than stored twice. A key protected by a passphrase comes in without one — nothing on disk says what it is — and the report below will name it." />
+        </StackPanel>
+
         <StackPanel Orientation="Horizontal" Spacing="8">
           <Button Classes="accent" Content="{Binding ImportLabel}" Command="{Binding ImportCommand}"
                   IsEnabled="{Binding !IsBusy}" />
           <Button Classes="ghost" Content="TICK ALL / NONE" Command="{Binding ToggleAllCommand}" />
         </StackPanel>
+
+        <!--
+          ◆ What became of each key file, after the fact. Below the button because it is the answer rather
+          than the offer, and capped with a scroll viewer because a config with thirty keyed hosts would
+          otherwise push IMPORT off the window — the one control this screen must never lose.
+        -->
+        <Border IsVisible="{Binding HasKeyReport}" Padding="10,8" CornerRadius="4"
+                Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
+                BorderThickness="1">
+          <ScrollViewer MaxHeight="120">
+            <ItemsControl ItemsSource="{Binding KeyReport}">
+              <ItemsControl.ItemTemplate>
+                <DataTemplate x:DataType="x:String">
+                  <TextBlock Text="{Binding}" Classes="hint" FontSize="10.5" TextWrapping="Wrap"
+                             Margin="0,2" />
+                </DataTemplate>
+              </ItemsControl.ItemTemplate>
+            </ItemsControl>
+          </ScrollViewer>
+        </Border>
       </StackPanel>
     </Border>
 

src/DodoSSH.Client.Import/ImportedHost.cs

@@ -42,10 +42,17 @@ public sealed record ImportedHost(
     /// <summary>Turns this into the host that would be stored.</summary>
     /// <remarks>
     /// <para>
-    /// <b>The identity file becomes a note and a directive, not a key.</b> Reading somebody's
-    /// <c>~/.ssh/id_ed25519</c> into a keychain is exactly the act this product exists to make deliberate,
-    /// and doing it as a side effect of "import my config" is the wrong default. The path is recorded so it
-    /// is not lost; importing the material is a separate, per-row choice.
+    /// <b>The identity file becomes a note and a directive, not a key — here.</b> Reading somebody's
+    /// <c>~/.ssh/id_ed25519</c> into a keychain is exactly the act this product exists to make deliberate, so
+    /// nothing on this path does it: the value is recorded so it is not lost, and this record has no way to
+    /// reach a disk in any case.
+    /// <para>
+    /// ◆ The material <em>can</em> be imported, and the tick that does it is on the import screen, off by
+    /// default and beside a sentence saying what it will read. It runs through <see cref="SshIdentityFiles"/>
+    /// and binds the stored key to the host afterwards; what it does not do is change what this method
+    /// produces, so a host imported without it and a host imported with it differ by a binding rather than
+    /// by their contents.
+    /// </para>
     /// </para>
     /// <para>
     /// <b>ProxyJump records intent and changes nothing about connecting.</b> The SSH layer has no jump

src/DodoSSH.Client.Import/SshConfigLocator.cs

@@ -26,6 +26,17 @@ public sealed class SshConfigLocator
     /// <summary>Whether there is anything to read.</summary>
     public bool Exists => File.Exists(ConfigPath);
 
+    /// <summary>
+    /// Reads the private key an <c>IdentityFile</c> named.
+    /// </summary>
+    /// <remarks>
+    /// Here rather than on <see cref="SshIdentityFiles"/> directly because this type owns the one fact that
+    /// call needs and nothing else has: where <c>~/.ssh</c> is for this run. That is what a relative
+    /// <c>IdentityFile</c> resolves against, and it is what the tests override to point at a directory they
+    /// made — see the class remark on why the disk lives in exactly one type here.
+    /// </remarks>
+    public SshIdentityFile ReadIdentity(string path) => SshIdentityFiles.Read(path, sshDirectory);
+
     /// <summary>Reads and resolves the configuration.</summary>
     /// <exception cref="FileNotFoundException">There is no configuration file.</exception>
     public async Task<SshConfigImport> ReadAsync(CancellationToken cancellationToken)

src/DodoSSH.Client.Import/SshIdentityFile.cs

@@ -0,0 +1,279 @@
+using System.Diagnostics.CodeAnalysis;
+
+namespace DodoSSH.Client.Import;
+
+/// <summary>
+/// A private key file an <c>ssh_config</c> named, as the import screen has to describe it.
+/// </summary>
+/// <remarks>
+/// A record rather than a thrown exception per failure, because every outcome here is a row on a screen
+/// rather than an error: a path that does not exist is the ordinary shape of a config carried between
+/// machines, and a config with forty entries will have several. The import goes ahead without them and says
+/// which.
+/// </remarks>
+/// <param name="Path">The file this is about, resolved. What a message names, so it is never null.</param>
+/// <param name="PrivateKeyPem">The armour, verbatim, or null when it could not be read.</param>
+/// <param name="PublicKey">
+/// The <c>.pub</c> beside it, if there is one. Optional for the reason <c>SshKeySecret.PublicKey</c> is
+/// optional — it cannot be derived without parsing every format this stores verbatim — and worth taking
+/// while it is right there, because installing a key on a host needs exactly that line.
+/// </param>
+/// <param name="IsEncrypted">
+/// Whether the file is passphrase-protected. Not a failure: the key is worth importing either way, and the
+/// passphrase is the one thing on disk that cannot be read off it. The import says so and the keychain's
+/// editor is where it gets added.
+/// </param>
+/// <param name="Failure">Why there is no key, or null when there is one.</param>
+public sealed record SshIdentityFile(
+    string Path,
+    string? PrivateKeyPem,
+    string? PublicKey,
+    bool IsEncrypted,
+    string? Failure)
+{
+    /// <summary>Whether there is key material to store.</summary>
+    [MemberNotNullWhen(true, nameof(PrivateKeyPem))]
+    public bool WasRead => PrivateKeyPem is { Length: > 0 };
+}
+
+/// <summary>
+/// Reading the private keys an <c>ssh_config</c> points at, and telling encrypted ones apart.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>Nothing in here runs unless somebody ticked a box.</b> Pulling a private key out of a home directory
+/// is the act this product exists to make deliberate, so it is opt-in on the import screen, off by default,
+/// and said out loud beside the tick. What this type is responsible for is doing it honestly once asked:
+/// reading exactly the files the config named, saying which it could not, and never guessing at a path the
+/// config did not give.
+/// </para>
+/// <para>
+/// It does not parse key material. <c>SshKeySecret</c> stores whatever armour it is handed and declines to
+/// re-encode it, for reasons written there, and this keeps to the same rule — the one thing it looks
+/// <em>into</em> a key for is whether it is encrypted, because that decides what the screen has to say next.
+/// </para>
+/// </remarks>
+public static class SshIdentityFiles
+{
+    /// <summary>The OpenSSH v1 container's magic, which is what an armoured OPENSSH PRIVATE KEY holds.</summary>
+    private static readonly byte[] OpenSshMagic = "openssh-key-v1\0"u8.ToArray();
+
+    /// <summary>
+    /// Reads the key at a path an <c>ssh_config</c> gave.
+    /// </summary>
+    /// <param name="path">
+    /// The <c>IdentityFile</c> value. Already tilde-expanded by <see cref="SshConfigResolver"/>; a relative
+    /// one is resolved against <paramref name="sshDirectory"/>, which is OpenSSH's own rule.
+    /// </param>
+    /// <param name="sshDirectory">Where <c>~/.ssh</c> is for this run.</param>
+    /// <remarks>
+    /// <para>
+    /// The <c>.pub</c> is read as a side dish and never as a requirement: a missing one costs the public
+    /// half and nothing else, so it is silently absent rather than a failure. A <em>present</em> one is
+    /// worth having, and the mistake it heads off is the one <c>SshKeySecret.TryValidate</c> exists to
+    /// catch — somebody later pasting the wrong one of two files whose names differ by four characters.
+    /// </para>
+    /// <para>
+    /// Every failure is caught and returned rather than thrown. A config that names keys on a machine it
+    /// was copied from is the ordinary case, and one unreadable path must not stop the other thirty-nine
+    /// entries being imported.
+    /// </para>
+    /// </remarks>
+    public static SshIdentityFile Read(string path, string sshDirectory)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(path);
+        ArgumentNullException.ThrowIfNull(sshDirectory);
+
+        var resolved = System.IO.Path.IsPathRooted(path)
+            ? path
+            : System.IO.Path.Combine(sshDirectory, path);
+
+        try
+        {
+            if (!File.Exists(resolved))
+            {
+                return Refused(resolved, "there is no such file on this machine");
+            }
+
+            var material = File.ReadAllText(resolved);
+
+            if (material.TrimStart().StartsWith("ssh-", StringComparison.Ordinal)
+                || material.TrimStart().StartsWith("ecdsa-", StringComparison.Ordinal))
+            {
+                // The .pub, named as the IdentityFile. ssh itself tolerates this — it looks for the private
+                // half beside it — and importing the public one would produce a keychain entry that looks
+                // fine and fails at connect time saying nothing about which file was chosen.
+                return Refused(resolved, "that is the public half; the private key is the file without .pub");
+            }
+
+            if (!material.TrimStart().StartsWith("-----BEGIN", StringComparison.Ordinal))
+            {
+                return Refused(resolved, "it does not look like a private key");
+            }
+
+            return new SshIdentityFile(
+                resolved, material, ReadPublicHalf(resolved), IsEncrypted(material), Failure: null);
+        }
+        catch (IOException failure)
+        {
+            return Refused(resolved, failure.Message);
+        }
+        catch (UnauthorizedAccessException failure)
+        {
+            return Refused(resolved, failure.Message);
+        }
+    }
+
+    /// <summary>
+    /// Whether the armour is passphrase-protected.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Three formats and three tells. PKCS#8 says so in the header outright. Classic PEM carries a
+    /// <c>Proc-Type: 4,ENCRYPTED</c> line above the base64. OpenSSH's own container says nothing in the
+    /// armour at all — the cipher name is the first field <em>inside</em> the base64 — which is why this
+    /// decodes rather than reading headers, and it is the format <c>ssh-keygen</c> has written by default
+    /// for years, so it is the case that actually turns up.
+    /// </para>
+    /// <para>
+    /// Wrong in the safe direction when it cannot tell: anything it fails to decode is reported as
+    /// unencrypted, which means the key is imported with no warning and fails at connect time with SSH.NET's
+    /// own message. The opposite default would put a warning on every key, and a warning everybody sees is
+    /// one nobody reads.
+    /// </para>
+    /// </remarks>
+    internal static bool IsEncrypted(string material)
+    {
+        if (material.Contains("BEGIN ENCRYPTED PRIVATE KEY", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        if (material.Contains("Proc-Type:", StringComparison.Ordinal)
+            && material.Contains("ENCRYPTED", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        return TryReadOpenSshCipher(material, out var cipher)
+            && !string.Equals(cipher, "none", StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// Reads the cipher name out of an OpenSSH v1 private key container.
+    /// </summary>
+    /// <remarks>
+    /// The container is <c>openssh-key-v1\0</c> followed by SSH string fields, each a big-endian length and
+    /// then that many bytes. The first of them is the cipher, and <c>none</c> is what an unprotected key
+    /// carries. Only that first field is read: everything after it is key material, and this type does not
+    /// look at key material.
+    /// </remarks>
+    private static bool TryReadOpenSshCipher(string material, [NotNullWhen(true)] out string? cipher)
+    {
+        cipher = null;
+
+        const string header = "-----BEGIN OPENSSH PRIVATE KEY-----";
+        const string footer = "-----END OPENSSH PRIVATE KEY-----";
+
+        var start = material.IndexOf(header, StringComparison.Ordinal);
+        var end = material.IndexOf(footer, StringComparison.Ordinal);
+
+        if (start < 0 || end <= start)
+        {
+            return false;
+        }
+
+        var body = material[(start + header.Length)..end];
+
+        // 88 base64 characters decode to 66 bytes, so the destination is 72 rather than 64 — a span too
+        // small makes Convert.TryFromBase64Chars answer false, which this would read as "not an OpenSSH
+        // container" and report as unencrypted. Measured: every protected key came back unprotected.
+        Span<byte> decoded = stackalloc byte[72];
+
+        // Only the head of the container is needed and the whole of it may be megabytes, so just enough of
+        // the base64 is decoded for the magic and the first field.
+        var bytes = TryDecodeHead(body, decoded, out var written) ? decoded[..written] : default;
+
+        if (bytes.Length < OpenSshMagic.Length + 4)
+        {
+            return false;
+        }
+
+        if (!bytes[..OpenSshMagic.Length].SequenceEqual(OpenSshMagic))
+        {
+            return false;
+        }
+
+        var rest = bytes[OpenSshMagic.Length..];
+        var length = (rest[0] << 24) | (rest[1] << 16) | (rest[2] << 8) | rest[3];
+
+        if (length is < 1 or > 64 || rest.Length < 4 + length)
+        {
+            return false;
+        }
+
+        cipher = System.Text.Encoding.ASCII.GetString(rest.Slice(4, length));
+
+        return true;
+    }
+
+    /// <summary>Decodes the first few base64 characters of an armoured body.</summary>
+    /// <remarks>
+    /// The armour is wrapped at 70 characters and the destination is 64 bytes, so this takes the first
+    /// non-whitespace 88 characters — a multiple of four, decoding to 66 — and stops. Trailing padding never
+    /// enters into it because the slice never reaches the end of a real key.
+    /// </remarks>
+    private static bool TryDecodeHead(ReadOnlySpan<char> body, Span<byte> destination, out int written)
+    {
+        Span<char> head = stackalloc char[88];
+        var taken = 0;
+
+        foreach (var character in body)
+        {
+            if (char.IsWhiteSpace(character))
+            {
+                continue;
+            }
+
+            head[taken++] = character;
+
+            if (taken == head.Length)
+            {
+                break;
+            }
+        }
+
+        if (taken < head.Length)
+        {
+            written = 0;
+            return false;
+        }
+
+        return Convert.TryFromBase64Chars(head, destination, out written);
+    }
+
+    /// <remarks>
+    /// Absent is not a failure, so this answers null rather than a reason. Read with the same swallow the
+    /// private half uses: a <c>.pub</c> that cannot be read costs the public line and nothing else.
+    /// </remarks>
+    private static string? ReadPublicHalf(string privatePath)
+    {
+        try
+        {
+            var pub = privatePath + ".pub";
+
+            return File.Exists(pub) ? File.ReadAllText(pub).Trim() : null;
+        }
+        catch (IOException)
+        {
+            return null;
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return null;
+        }
+    }
+
+    private static SshIdentityFile Refused(string path, string reason) =>
+        new(path, PrivateKeyPem: null, PublicKey: null, IsEncrypted: false, Failure: reason);
+}

src/DodoSSH.Client.Shell/ViewModels/ImportViewModel.cs

@@ -6,6 +6,26 @@ using DodoSSH.Client.Import;
 
 namespace DodoSSH.Client.Shell.ViewModels;
 
+/// <summary>One host an import is about to store, with the key file it named if that is coming too.</summary>
+/// <remarks>
+/// The key travels beside the host rather than inside it because the two are separate vault items: a host
+/// carries an <c>SshKeyId</c>, and the id does not exist until the key has been written. So the screen says
+/// which file a host named and the vault decides what id that file ends up with — see
+/// <c>VaultViewModel.ImportHostsAsync</c>, which is where one key per file is enforced.
+/// </remarks>
+/// <param name="Host">The host as it would be stored, with no binding on it yet.</param>
+/// <param name="Key">The key read off the disk, or null when none was asked for or none could be read.</param>
+/// <param name="KeyPath">
+/// The file <paramref name="Key"/> came out of. It is what two hosts naming one key are compared on, so it
+/// travels even though nothing stores it.
+/// </param>
+internal sealed record ImportedHostRequest(HostSecret Host, SshKeySecret? Key, string? KeyPath);
+
+/// <summary>What an import stored.</summary>
+/// <param name="Hosts">Hosts written.</param>
+/// <param name="Keys">Private keys written. Counts files read, not hosts bound to one.</param>
+internal sealed record ImportOutcome(int Hosts, int Keys);
+
 /// <summary>One host an <c>ssh_config</c> offered, as a row somebody decides about.</summary>
 /// <remarks>
 /// The checkbox is the whole point of this type. Nothing is written until somebody has looked at the list
@@ -16,10 +36,11 @@ internal sealed partial class ImportRowViewModel : ObservableObject
 {
     private readonly ImportedHost host;
 
-    internal ImportRowViewModel(ImportedHost host, bool alreadyPresent)
+    internal ImportRowViewModel(ImportedHost host, bool alreadyPresent, bool importsItsKey)
     {
         this.host = host;
         AlreadyPresent = alreadyPresent;
+        this.importsItsKey = importsItsKey && HasKeyFile;
 
         // A host already in the keychain starts unticked. Importing it again is allowed — a second bookmark
         // for one machine is a thing people genuinely want — but it should take a click rather than be the
@@ -40,17 +61,36 @@ internal sealed partial class ImportRowViewModel : ObservableObject
 
     internal bool HasBadge => AlreadyPresent;
 
+    /// <summary>Whether this row's <c>ssh_config</c> entry named a key at all.</summary>
+    /// <remarks>
+    /// Most do not, and the tick above the list is about the ones that do. Kept as a property rather than
+    /// asked of <see cref="ImportedHost"/> at each call site so that "this row has a key file" is one
+    /// sentence in one place.
+    /// </remarks>
+    internal bool HasKeyFile => host.IdentityFiles.Count > 0;
+
+    /// <summary>What this row's <c>IdentityFile</c> named, or empty where it named none.</summary>
+    internal string KeyPath => HasKeyFile ? host.IdentityFiles[0] : string.Empty;
+
     /// <summary>How this would authenticate, in the terms the preview can honestly offer.</summary>
     /// <remarks>
-    /// "a key on disk" rather than "a key", because nothing is imported: the path is recorded and the host
-    /// will ask for a password until somebody binds it to a keychain key. Saying "key" here would promise a
-    /// connection that does not work.
+    /// <para>
+    /// "a key on disk" rather than "a key" when the material is staying where it is, because nothing is
+    /// imported then: the path is recorded and the host will ask for a password until somebody binds it to a
+    /// keychain key. Saying "key" there would promise a connection that does not work.
+    /// </para>
+    /// <para>
+    /// ◆ With the tick on it says the opposite, and has to: the same row now means a key that will be read,
+    /// stored and bound, and leaving it reading "on disk" would understate the one thing on this screen
+    /// somebody explicitly agreed to.
+    /// </para>
     /// </remarks>
-    internal string Authentication => host.IdentityFiles.Count switch
+    internal string Authentication => (host.IdentityFiles.Count, ImportsItsKey) switch
     {
-        0 => "password",
-        1 => $"a key on disk · {host.IdentityFiles[0]}",
-        var count => $"{count} keys on disk · {host.IdentityFiles[0]}",
+        (0, _) => "password",
+        (_, true) => $"a key, imported · {host.IdentityFiles[0]}",
+        (1, _) => $"a key on disk · {host.IdentityFiles[0]}",
+        var (count, _) => $"{count} keys on disk · {host.IdentityFiles[0]}",
     };
 
     internal bool HasWarnings => host.Warnings.Count > 0;
@@ -59,6 +99,17 @@ internal sealed partial class ImportRowViewModel : ObservableObject
 
     [ObservableProperty]
     private bool isSelected;
+
+    /// <summary>Whether the import will read this row's key file as well as its host.</summary>
+    /// <remarks>
+    /// Set from the one tick above the list rather than owned per row. A key file is very often shared by a
+    /// dozen entries, so a per-row choice would be a dozen ticks deciding one thing — and the decision being
+    /// made is about reading <c>~/.ssh</c> at all, which is a decision about the directory rather than about
+    /// any host in it.
+    /// </remarks>
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(Authentication))]
+    private bool importsItsKey;
 }
 
 /// <summary>
@@ -72,10 +123,19 @@ internal sealed partial class ImportRowViewModel : ObservableObject
 /// interesting question is not "can it be parsed" but "which of these did you actually want".
 /// </para>
 /// <para>
-/// <b>Nothing reads a private key.</b> An <c>IdentityFile</c> becomes a directive and a note recording the
-/// path. Pulling someone's <c>~/.ssh/id_ed25519</c> into a keychain as a side effect of importing a config
-/// is the one thing this screen must not do quietly; there is a GENERATE KEY button on the keychain screen
-/// for making one deliberately, and pasting an existing one is a deliberate act too.
+/// ◆ <b>Private keys are read only if somebody ticks the box, and it starts unticked.</b> Pulling a
+/// <c>~/.ssh/id_ed25519</c> into a keychain is exactly the act this product exists to make deliberate, and
+/// doing it as a side effect of "import my config" would be the wrong default — so it stays a default nobody
+/// gets by accident, and the sentence beside the tick names the directory it will read. What changed is that
+/// it is now <em>possible</em>: an import that recorded a path and left every host asking for a password was
+/// an import whose result did not connect, and the answer to that was a manual paste per key.
+/// </para>
+/// <para>
+/// With the tick on, each host's first <c>IdentityFile</c> is read, stored as a keychain key and bound to
+/// the host. One key per file however many hosts named it, and a file already in the keychain is bound to
+/// rather than stored twice; both of those live in <c>VaultViewModel.ImportHostsAsync</c>. What cannot be
+/// read off a disk is a passphrase, so a protected key arrives without one and the screen says which — see
+/// <see cref="KeyReport"/>.
 /// </para>
 /// </remarks>
 internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLocator locator) : ObservableObject
@@ -97,10 +157,47 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
     [ObservableProperty]
     private bool isBusy;
 
+    /// <summary>
+    /// Whether the import should also read the key files the config names.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Off, and it has to be the sort of off that survives somebody not reading the screen. This is the only
+    /// control in the application that reads private key material out of a directory the user did not point
+    /// at file by file, and the whole of what makes that acceptable is that it took a deliberate press.
+    /// </para>
+    /// <para>
+    /// Not persisted in <c>ClientSettings</c>, deliberately. A remembered "yes" would make the next import —
+    /// possibly on another machine, possibly of a colleague's config — read <c>~/.ssh</c> without asking
+    /// again, which is the answer to a question that was never put twice.
+    /// </para>
+    /// </remarks>
+    [ObservableProperty]
+    private bool importsKeys;
+
+    /// <summary>What happened to the key files, one line each. Empty until an import has run.</summary>
+    /// <remarks>
+    /// Reported after the fact rather than previewed, because previewing means reading them — and a screen
+    /// that read every key in order to tell you it had not imported them would be doing the thing the tick
+    /// exists to gate. So the list is what the import found: which were stored, which are protected by a
+    /// passphrase this cannot know, and which were not there at all.
+    /// </remarks>
+    internal ObservableCollection<string> KeyReport { get; } = [];
+
     internal bool HasRows => Rows.Count > 0;
 
     internal bool HasWarnings => Warnings.Count > 0;
 
+    internal bool HasKeyReport => KeyReport.Count > 0;
+
+    /// <summary>Whether anything in the scan named a key file at all.</summary>
+    /// <remarks>
+    /// The tick is drawn only when it would do something. A config of forty password hosts has no keys to
+    /// offer, and a permanently visible offer to read <c>~/.ssh</c> on a screen where it would read nothing
+    /// is a control that teaches people to ignore it.
+    /// </remarks>
+    internal bool HasKeyFiles => Rows.Any(row => row.HasKeyFile);
+
     internal int SelectedCount => Rows.Count(row => row.IsSelected);
 
     internal string ImportLabel => SelectedCount == 1 ? "IMPORT 1 HOST" : $"IMPORT {SelectedCount} HOSTS";
@@ -111,6 +208,7 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
     {
         Rows.Clear();
         Warnings.Clear();
+        KeyReport.Clear();
         HasScanned = false;
 
         if (!locator.Exists)
@@ -128,7 +226,7 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
 
             foreach (var host in import.Hosts)
             {
-                Rows.Add(new ImportRowViewModel(host, IsAlreadyPresent(host)));
+                Rows.Add(new ImportRowViewModel(host, IsAlreadyPresent(host), ImportsKeys));
             }
 
             foreach (var warning in import.Warnings)
@@ -157,7 +255,12 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
         }
     }
 
-    /// <summary>Stores the ticked hosts.</summary>
+    /// <summary>Stores the ticked hosts, and the keys they name if that was asked for.</summary>
+    /// <remarks>
+    /// The key files are read here rather than during the scan, and that ordering is the tick's whole
+    /// meaning: until this press nothing has opened a private key, so changing your mind after scanning
+    /// costs nothing and leaves nothing read.
+    /// </remarks>
     [RelayCommand]
     private async Task ImportAsync(CancellationToken cancellationToken)
     {
@@ -173,18 +276,24 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
 
         try
         {
-            var imported = await vault
-                .ImportHostsAsync([.. chosen.Select(row => row.Host.ToSecret())], cancellationToken)
-                .ConfigureAwait(true);
+            KeyReport.Clear();
+
+            var requests = chosen.Select(BuildRequest).ToList();
+
+            var outcome = await vault.ImportHostsAsync(requests, cancellationToken).ConfigureAwait(true);
 
             // Rebuilt rather than cleared, so the rows that were imported now say so — which is what makes
             // pressing the button twice harmless and visible rather than harmless and confusing.
             foreach (var row in Rows.ToList())
             {
-                Rows[Rows.IndexOf(row)] = new ImportRowViewModel(row.Host, IsAlreadyPresent(row.Host));
+                Rows[Rows.IndexOf(row)] =
+                    new ImportRowViewModel(row.Host, IsAlreadyPresent(row.Host), ImportsKeys);
             }
 
-            Status = $"Imported {imported} host(s). They are on the Hosts screen.";
+            // This screen's own sentence rather than the vault's. The vault writes one too and then pushes,
+            // and the push overwrites it with a sync report — which is right on a screen somebody is about
+            // to leave, and wrong on the one they are still standing on.
+            Status = Describe(outcome);
         }
         finally
         {
@@ -193,6 +302,77 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
         }
     }
 
+    /// <summary>What the import did, in this screen's own words.</summary>
+    /// <remarks>
+    /// The keys are counted separately and named only when there are any, because reading key material is
+    /// the half of this somebody agreed to rather than the half they asked for. The count is files, not
+    /// hosts: a dozen entries sharing one key is one key, and saying twelve would be describing the config
+    /// rather than what was stored.
+    /// </remarks>
+    private static string Describe(ImportOutcome outcome)
+    {
+        var material = outcome.Keys switch
+        {
+            0 => string.Empty,
+            1 => " 1 private key came with them, and every host that named it is bound to it.",
+            _ => $" {outcome.Keys} private keys came with them, and every host that named one is bound to it.",
+        };
+
+        return $"Imported {outcome.Hosts} host(s). They are on the Hosts screen.{material}";
+    }
+
+    /// <summary>
+    /// Turns a ticked row into what the vault stores, reading its key file where that was agreed to.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The first <c>IdentityFile</c> only, which is the same one <see cref="ImportedHost.ToSecret"/> records
+    /// as a directive. A host may list several and ssh tries each in turn; a keychain host binds one key, so
+    /// importing all of them would be storing keys nothing is bound to and calling it authentication.
+    /// </para>
+    /// <para>
+    /// Every outcome is a line in <see cref="KeyReport"/> rather than a failure, including the good one. A
+    /// key that could not be read leaves the host importable and unbound, which is exactly what the import
+    /// did for every host before the tick existed.
+    /// </para>
+    /// </remarks>
+    private ImportedHostRequest BuildRequest(ImportRowViewModel row)
+    {
+        var host = row.Host.ToSecret();
+
+        if (!ImportsKeys || !row.HasKeyFile)
+        {
+            return new ImportedHostRequest(host, Key: null, KeyPath: null);
+        }
+
+        var identity = locator.ReadIdentity(row.KeyPath);
+
+        if (!identity.WasRead)
+        {
+            KeyReport.Add($"{row.Alias}: {identity.Path} was not imported — {identity.Failure}.");
+
+            return new ImportedHostRequest(host, Key: null, KeyPath: null);
+        }
+
+        // Named for the file rather than for the host, because one file is very often a dozen hosts and a
+        // key called "web-01" that four other machines also use is a name that misleads on five screens.
+        var key = new SshKeySecret
+        {
+            Label = Path.GetFileName(identity.Path),
+            PrivateKeyPem = identity.PrivateKeyPem,
+            PublicKey = identity.PublicKey,
+            Notes = $"Imported from {identity.Path} with {locator.ConfigPath}.",
+        };
+
+        KeyReport.Add(identity.IsEncrypted
+            ? $"{row.Alias}: {identity.Path} was imported and is protected by a passphrase. Nothing on "
+                + "disk says what it is, so add it to the key on the keychain screen or the host will not "
+                + "connect."
+            : $"{row.Alias}: {identity.Path} was imported.");
+
+        return new ImportedHostRequest(host, key, identity.Path);
+    }
+
     /// <summary>Ticks or unticks everything at once.</summary>
     [RelayCommand]
     private void ToggleAll()
@@ -209,6 +389,20 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
 
     internal void NoteSelectionChanged() => RaiseListState();
 
+    /// <remarks>
+    /// The rows carry the answer as well as the view model, because each one says what it will authenticate
+    /// with and that sentence changes with the tick. Pushed rather than bound per row: a row cannot see a
+    /// property of the screen it is in without a parent binding, and that is markup for something the list
+    /// already has to be walked for.
+    /// </remarks>
+    partial void OnImportsKeysChanged(bool value)
+    {
+        foreach (var row in Rows)
+        {
+            row.ImportsItsKey = value && row.HasKeyFile;
+        }
+    }
+
     /// <remarks>
     /// Matched on where a host points rather than on what it is called. Two entries with different aliases
     /// for one machine are the ordinary shape of an <c>ssh_config</c>, and matching on the name would offer
@@ -243,6 +437,8 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
     {
         OnPropertyChanged(nameof(HasRows));
         OnPropertyChanged(nameof(HasWarnings));
+        OnPropertyChanged(nameof(HasKeyFiles));
+        OnPropertyChanged(nameof(HasKeyReport));
         OnPropertyChanged(nameof(SelectedCount));
         OnPropertyChanged(nameof(ImportLabel));
     }

src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.cs

@@ -5782,14 +5782,15 @@ internal sealed partial class VaultViewModel(
     }
 
     /// <summary>
-    /// Stores several hosts at once, the way one save does.
+    /// Stores several hosts at once, the way one save does, with the keys they named where those are coming
+    /// too.
     /// </summary>
     /// <remarks>
     /// <para>
     /// For the <c>ssh_config</c> import, which is the only thing that produces hosts in bulk. It goes
-    /// through the same repository, the same outbox and the same automatic push as saving one — the import
-    /// screen decides <em>which</em> hosts and nothing else, so there is no second way for a host to be
-    /// written and no second place for the sync wiring to be forgotten.
+    /// through the same repositories, the same outbox and the same automatic push as saving one — the import
+    /// screen decides <em>which</em> hosts and nothing else, so there is no second way for a host or a key to
+    /// be written and no second place for the sync wiring to be forgotten.
     /// </para>
     /// <para>
     /// One reload and one push for the whole batch, rather than per host: thirty saves would otherwise be
@@ -5800,47 +5801,142 @@ internal sealed partial class VaultViewModel(
     /// A host that fails validation is skipped and counted rather than aborting the batch. Twenty-nine good
     /// hosts thrown away because the thirtieth had no hostname is not what anybody wants from an import.
     /// </para>
+    /// <para>
+    /// ◆ <b>One vault key per file, however many hosts named it.</b> An <c>ssh_config</c> pointing twelve
+    /// entries at <c>~/.ssh/id_ed25519</c> is the ordinary shape, and twelve copies of one private key would
+    /// be twelve things to rotate and eleven to forget — which is the argument <c>HostSecret.SshKeyId</c>
+    /// already makes for referencing a key rather than embedding it. The path is what identifies a file here,
+    /// because it is the only thing the config gave that two entries can be compared on.
+    /// </para>
+    /// <para>
+    /// <b>A key whose material is already in the keychain is bound to rather than stored again</b>, which is
+    /// what makes running the import twice harmless. Compared on the armour verbatim, as the codec stores it:
+    /// a re-import of the same file is byte-identical, and anything that is not is a different key whatever
+    /// it is called.
+    /// </para>
     /// </remarks>
-    internal async Task<int> ImportHostsAsync(
-        IReadOnlyList<HostSecret> hosts,
+    internal async Task<ImportOutcome> ImportHostsAsync(
+        IReadOnlyList<ImportedHostRequest> requests,
         CancellationToken cancellationToken)
     {
-        ArgumentNullException.ThrowIfNull(hosts);
+        ArgumentNullException.ThrowIfNull(requests);
 
-        var imported = 0;
+        var hosts = 0;
+        var keys = 0;
         var refused = 0;
 
         await RunAsync(
-            hosts.Count == 1 ? "Importing 1 host…" : $"Importing {hosts.Count} hosts…",
+            requests.Count == 1 ? "Importing 1 host…" : $"Importing {requests.Count} hosts…",
             async () =>
             {
-                foreach (var host in hosts)
+                // Keyed on the path rather than on the material, and filled as the batch runs rather than up
+                // front: the second host naming a file has to land on the id the first one produced, and
+                // nothing is reloaded until the batch finishes.
+                var bound = new Dictionary<string, Guid>(StringComparer.OrdinalIgnoreCase);
+
+                foreach (var request in requests)
                 {
-                    if (!host.TryValidate(out _))
+                    if (!request.Host.TryValidate(out _))
                     {
                         refused++;
                         continue;
                     }
 
+                    var (keyId, created) = await BindImportedKeyAsync(request, bound, cancellationToken)
+                        .ConfigureAwait(true);
+
+                    if (created)
+                    {
+                        keys++;
+                    }
+
+                    var host = keyId is { } id ? request.Host with { SshKeyId = id } : request.Host;
+
                     await session.Hosts
                         .CreateAsync(session.ActiveVaultId, host, cancellationToken)
                         .ConfigureAwait(true);
 
-                    imported++;
+                    hosts++;
                 }
 
                 await ReloadAsync(cancellationToken).ConfigureAwait(true);
 
-                var refusals = refused == 0 ? string.Empty : $" {refused} could not be stored and were skipped.";
-
-                Status = connection() is null
-                    ? $"Imported {imported} host(s). They will sync when you are online.{refusals}"
-                    : $"Imported {imported} host(s).{refusals}";
+                Status = DescribeImport(hosts, keys, refused);
             }).ConfigureAwait(true);
 
         await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
 
-        return imported;
+        return new ImportOutcome(hosts, keys);
+    }
+
+    /// <summary>Finds or stores the key an imported host should be bound to.</summary>
+    /// <returns>
+    /// The key to bind to, and whether storing it was what put it there. The second half is what the count
+    /// reported afterwards is about: binding to a key the keychain already held reads nothing off a disk and
+    /// must not be reported as having.
+    /// </returns>
+    /// <remarks>
+    /// The keychain is searched as well as this batch's own map, and both are needed. The map answers within
+    /// one run, where nothing has been reloaded yet; the keychain answers for a run an hour ago, which is
+    /// what makes importing the same config twice leave one key rather than two.
+    /// </remarks>
+    private async Task<(Guid? Id, bool Created)> BindImportedKeyAsync(
+        ImportedHostRequest request,
+        Dictionary<string, Guid> bound,
+        CancellationToken cancellationToken)
+    {
+        if (request.Key is not { } key || request.KeyPath is not { } path)
+        {
+            return (null, false);
+        }
+
+        if (bound.TryGetValue(path, out var already))
+        {
+            return (already, false);
+        }
+
+        if (Keys.FirstOrDefault(row => string.Equals(
+            row.Key.PrivateKeyPem, key.PrivateKeyPem, StringComparison.Ordinal)) is { } existing)
+        {
+            bound[path] = existing.EntityId;
+
+            return (existing.EntityId, false);
+        }
+
+        if (!key.TryValidate(out _))
+        {
+            return (null, false);
+        }
+
+        var id = await session.SshKeys
+            .CreateAsync(session.ActiveVaultId, key, cancellationToken)
+            .ConfigureAwait(true);
+
+        bound[path] = id;
+
+        return (id, true);
+    }
+
+    /// <summary>What the import did, in one sentence.</summary>
+    /// <remarks>
+    /// The keys are named separately from the hosts and only when there are any, because importing key
+    /// material is the half of this somebody agreed to rather than the half they asked for — folded into
+    /// "imported 12 hosts" it would be the one number worth saying out loud, said quietly.
+    /// </remarks>
+    private string DescribeImport(int hosts, int keys, int refused)
+    {
+        var refusals = refused == 0 ? string.Empty : $" {refused} could not be stored and were skipped.";
+
+        var material = keys switch
+        {
+            0 => string.Empty,
+            1 => " 1 private key came with them.",
+            _ => $" {keys} private keys came with them.",
+        };
+
+        return connection() is null
+            ? $"Imported {hosts} host(s). They will sync when you are online.{material}{refusals}"
+            : $"Imported {hosts} host(s).{material}{refusals}";
     }
 
     /// <summary>