Fill in the Spelunk API key on the Security page, as a synced Spelunk key that goes only to its own address

Settings → Security gains a SPELUNK section: an API address and a key, saved as a new keychain item, a Spelunk key (SyncEntityType 14, AadResourceType 17, server table spelunk_key via the AddSpelunkKeyItem migration). It is ciphertext only on the server, lives in the personal vault, syncs like every secret, and holds the key together with the one address it may be sent to. The key box empties once saved; the list shows name, address and how many hosts use each key, never the key. Saving a key for an address that already has one replaces it, and deleting goes through the shared confirmation card with the hosts that would stop connecting.

A host's route names a saved key where it named a credential, in the same apiKeyCredentialId field, so no host schema changes and an older build reads such a host as one whose key credential has gone. At connect a saved key is sent only to its own address; a host naming it with another Spelunk address is refused in words. Keys kept as a credential's password still work. The editor offers saved keys first and picks the one saved for an address as it is typed.

A link from a Spelunk with a saved key now connects straight away, including the first one: saving the key is the user's say-so that the first-link editor used to ask for.

The address and key merge as one pair, so two concurrent edits can never pair one device's key with another's address, and the key never reaches the conflict log.

.github/workflows/ci.yml

@@ -1326,6 +1326,19 @@ jobs:
     # inspects — it is the thing that gets deployed.
     needs: [build]
     runs-on: [linux]
+    # Gitea's own container registry, on the forge this workflow runs on, under the same owner as
+    # the repository - so the image is listed with the repository's packages rather than on a
+    # registry of its own. Lowercase, because an image reference may not contain capitals and
+    # the owner is DodoTech-Public.
+    #
+    # REGISTRY_USERNAME and REGISTRY_PASSWORD are a Gitea account and a token of its own with
+    # package read and write, allowed to publish for that owner. Not the job's built-in
+    # GITEA_TOKEN, tempting as it is here: the container registry does not accept an Actions
+    # task token and answers `unauthorized` at /v2/ (go-gitea/gitea#23642). Spelunk's workflow
+    # pushes the same way, with the same two secrets.
+    env:
+      REGISTRY: git.dodotech.cloud
+      IMAGE: dodotech-public/dodossh-api
     steps:
       # Duplicated from the build job; see the comment there for why it cannot be factored
       # out. Any change here has to be made in all three.
@@ -1451,9 +1464,6 @@ jobs:
       # changes, and where setup-buildx-action starts earning its place.
       - name: work out the tags
         id: tags
-        env:
-          REGISTRY: registry-docker.dodotech.cloud
-          IMAGE: dodotech/dodossh-api
         run: |
           set -euo pipefail
           repo="$REGISTRY/$IMAGE"
@@ -1578,7 +1588,7 @@ jobs:
           echo "username: ${#REGISTRY_USERNAME} characters; password: set"
 
           printf '%s' "$REGISTRY_PASSWORD" \
-            | docker login registry-docker.dodotech.cloud \
+            | docker login "$REGISTRY" \
                 --username "$REGISTRY_USERNAME" --password-stdin
 
       - name: push
@@ -1596,7 +1606,7 @@ jobs:
       # does not leave it behind.
       - name: log out
         if: always() && github.event_name != 'pull_request'
-        run: docker logout registry-docker.dodotech.cloud
+        run: docker logout "$REGISTRY"
 
 # No job here publishes the desktop *release* channel, and there is not going to be one. The desktop
 # nightly job above publishes a different application — its own pack id, its own Velopack channel, its own

README.md

@@ -456,27 +456,55 @@ phone runs forwards too, listed behind a `⇄` in its terminal's bar, but cannot
 
 A server managed by Spelunk runs Spelunk's agent, which keeps a connection open to Spelunk. DodoSSH can use
 that connection instead of dialling: tick **Connect through Spelunk** in the host editor and fill in
-Spelunk's API address, the server's id in Spelunk, and the credential that holds your Spelunk API key. A
-connection then asks Spelunk for a ticket, opens a WebSocket, and the agent connects to the SSH server on
-the machine's own loopback — so the server needs no open SSH port at all. Shells and file transfers both go
-this way; the relay and Spelunk are one choice, and ticking one unticks the other.
+Spelunk's API address, the server's id in Spelunk, and your Spelunk API key. A connection then asks Spelunk
+for a ticket, opens a WebSocket, and the agent connects to the SSH server on the machine's own loopback — so
+the server needs no open SSH port at all. Shells and file transfers both go this way; the relay and Spelunk
+are one choice, and ticking one unticks the other.
 
-- **The API key is an ordinary keychain credential** — paste the key (`spelunk_…`, with the Admin role) as a
-  credential's password. It is encrypted, synced and rotated like every other secret, one credential serves
-  every server in that Spelunk organisation, and it is sent to the host's API address and nowhere else.
-  The API address must be `https://`, except for a Spelunk on this machine.
+- **Fill in the API key once, under Settings → Security → Spelunk.** Give Spelunk's API address and paste
+  the key (`spelunk_…`, with the Admin role). It is saved as a *Spelunk key* in your personal vault —
+  encrypted, synced to your other devices, never shown again — together with the address, and **it is only
+  ever sent to that address**: a host that names the key with any other address is refused at connect. One
+  key serves every server in that Spelunk organisation; saving a key for an address that already has one
+  replaces it, and every host using it connects with the new key. The host editor offers saved keys first
+  and picks the one for the address you type. The API address must be `https://`, except for a Spelunk on
+  this machine.
+- A key kept the older way, as a credential's password, still works and is still offered in the editor;
+  its password goes to whatever address the host names.
 - **The hostname and port still matter**, though nothing dials them: the host key is pinned under them as it
   is for every host, and the port is what the agent connects to on the server.
 - **There is no falling back to a direct dial**, and a refusal is said in Spelunk's terms: a key Spelunk will
   not take, a key whose role is too low, a server outside the key's organisation, an agent that is not
   connected, an agent that could not reach the SSH port or is too old to open terminals.
 
+**Sign in through Spelunk (no SSH key needed)**, the box under the key in the same card, lets Spelunk log
+you in instead of an SSH key or password of the host's own. For each connection DodoSSH makes a throwaway
+Ed25519 key pair in memory and sends the public half with the ticket request, which the API key authorises;
+the agent runs a one-connection `sshd -i` on the server whose only authorised key is that one, and says
+which account it logs in as (`root`). It is real SSH to the server's real host key, so shells, file
+transfers and port forwards all work, and the key is gone with the connection — it is never stored,
+synced or logged. The login and authentication choices are greyed out while it is ticked and saved as
+nothing. The server needs OpenSSH's `sshd` installed (not running, and no open port); an agent too old
+to sign in, or a server without `sshd`, is said so. Such a host is written at host schema version 10,
+so a DodoSSH older than this shows it read-only.
+
 **"Open in DodoSSH" in Spelunk** starts DodoSSH with a `dodossh://spelunk/connect?api=…&server=…&name=…&host=…`
-link, or hands the link to the copy already running. The link never carries a credential. If a saved host
-already reaches that server through that Spelunk, DodoSSH connects to it; otherwise it opens the host editor
-filled in for a new Spelunk host — name, address, API and server — and you choose how to log in and which
-credential holds the key, and save. Nothing is ever connected that you have not saved, and a link that
-arrives while the vault is locked waits for the unlock.
+link, or hands the link to the copy already running, and **connects straight away.** The link never
+carries a credential. The hosts links make live in your personal vault, tagged `spelunk`:
+
+- If your personal vault has a host tagged `spelunk` for that server on that Spelunk, DodoSSH connects to it.
+- Otherwise, when you have saved a Spelunk key for that Spelunk under Settings → Security — or a saved host
+  already sends an API key there — DodoSSH saves a new host in your personal vault — named as the link
+  names it, at the link's address (or `spelunk-<server id>`), port 22, signing in through Spelunk with that
+  key, tagged `spelunk` (the tag is made if the vault has none) — and connects to it. It syncs like any host
+  you saved yourself.
+- **A link from a Spelunk with no key** opens the host editor instead, filled in the same way with sign-in
+  ticked and the tag on, and you choose that Spelunk's API key once and save. Every later link from that
+  Spelunk connects straight away. A link can be sent by anything on this machine, so an API key is never
+  sent to an address you have not sent it to — saving the key under Security is how you say you have.
+
+A host you set up by hand, or one in a team's vault, is left as it is: a link for its server adds a host of
+its own. A link that arrives while the vault is locked waits for the unlock.
 
 The Windows installer registers the scheme for your user and removes it on uninstall, the macOS bundle
 declares it in its `Info.plist`, and the Linux package's desktop entry declares `x-scheme-handler/dodossh`.

docs/crypto.md

@@ -299,7 +299,8 @@ value can forge a field boundary. UUIDs must be serialised in RFC 4122 order —
 
 `1` User, `2` Device, `3` Vault, `4` Host, `5` Credential, `6` SshKey, `7` HostGroup,
 `8` Tag, `9` Snippet, `10` PortForward, `11` KnownHostKey, `12` HostTag,
-`13` HostCredential, `14` ConnectionLogEntry, `15` ActivityLogEntry, `16` ObjectStore.
+`13` HostCredential, `14` ConnectionLogEntry, `15` ActivityLogEntry, `16` ObjectStore,
+`17` SpelunkKey.
 
 > **Added 2026-07-29:** `12` and `13`. `Contracts.SyncEntityType` has listed `HostTag` and
 > `HostCredential` as syncable since the contract was frozen, but this table had no value for
@@ -318,6 +319,9 @@ value can forge a field boundary. UUIDs must be serialised in RFC 4122 order —
 > `ConnectionLogEntry` is `11` there and `14` here. Nothing casts between them, and
 > `AadResourceTypeTests` pins each pairing by name for exactly that reason.
 
+> **Added 2026-09-29:** `17` SpelunkKey, a Spelunk API key and the address it may be sent to. It is
+> `14` on the wire, three behind, as `16` ObjectStore is `13`.
+
 `0` means not applicable and is legal only where the table in §4.2 implies no resource.
 
 ### 4.4 What this prevents

src/DodoSSH.Api/Dockerfile

@@ -2,9 +2,18 @@
 #
 #   docker build -f src/DodoSSH.Api/Dockerfile .
 #
-# Directory.Build.props, Directory.Packages.props, NuGet.config and global.json all sit at
-# the root and all four are load-bearing here — central package management means a csproj
-# alone does not name a single version, and a build that cannot see them resolves nothing.
+# Directory.Build.props, Directory.Build.targets, Directory.Packages.props, NuGet.config and
+# global.json all sit at the root and all five are load-bearing here — central package
+# management means a csproj alone does not name a single version, and a build that cannot see
+# them resolves nothing.
+#
+# Directory.Build.targets is the one that is easy to forget, because leaving it out breaks
+# nothing until the day it does: it pins the version of the trimmer the SDK adds to
+# DodoSSH.Contracts and DodoSSH.Crypto by itself (see the comment there). Without it the restore
+# below asks for whatever ILLink the image's SDK bundles, which matches the lock files only
+# until .NET ships a servicing release — and then this image fails with NU1004 while ci.yml,
+# which does see the pin, stays green. That is how it was found: sdk:10.0-noble moved to
+# 10.0.401 (ILLink 10.0.12) and this build broke with no commit touching a package.
 
 # ---------------------------------------------------------------------------------------
 # Build
@@ -26,7 +35,7 @@ WORKDIR /src
 # dependency change and by nothing else. Every project in DodoSSH.Api's reference closure
 # has to be here — restore walks ProjectReference, and a missing csproj fails the graph
 # rather than skipping a node.
-COPY global.json NuGet.config Directory.Build.props Directory.Packages.props ./
+COPY global.json NuGet.config Directory.Build.props Directory.Build.targets Directory.Packages.props ./
 COPY src/DodoSSH.Api/DodoSSH.Api.csproj                       src/DodoSSH.Api/
 COPY src/DodoSSH.Api/packages.lock.json                       src/DodoSSH.Api/
 COPY src/DodoSSH.Contracts/DodoSSH.Contracts.csproj           src/DodoSSH.Contracts/

src/DodoSSH.Api/Features/Sync/ItemKinds.cs

@@ -73,6 +73,7 @@ internal static class ItemKinds
             (IItemKind)new HostKind(), new SshKeyKind(), new CredentialKind(), new KnownHostKeyKind(),
             new HostGroupKind(), new TagKind(), new SnippetKind(),
             new ConnectionLogEntryKind(), new ActivityLogEntryKind(), new ObjectStoreKind(),
+            new SpelunkKeyKind(),
         }.ToDictionary(kind => kind.WireType);
 
     /// <summary>The kind for a wire type, or null when this server does not synchronise it yet.</summary>
@@ -1093,3 +1094,98 @@ internal sealed class ObjectStoreKind : IItemKind
     /// <inheritdoc />
     public SyncPlaintextFields? Hydrate(IVaultItem item) => null;
 }
+
+/// <summary>Spelunk keys: an envelope and nothing else.</summary>
+/// <remarks>
+/// <see cref="ObjectStoreKind"/>'s rules, because it holds the same class of thing: an API key is a password,
+/// and the address beside it is where somebody manages their servers. Nothing on the server calls Spelunk.
+/// </remarks>
+internal sealed class SpelunkKeyKind : IItemKind
+{
+    /// <inheritdoc />
+    public SyncEntityType WireType => SyncEntityType.SpelunkKey;
+
+    /// <inheritdoc />
+    public ChangeEntityType ChangeType => ChangeEntityType.SpelunkKey;
+
+    /// <inheritdoc />
+    public async Task<IVaultItem?> FindAsync(
+        DodoDbContext database,
+        Guid id,
+        CancellationToken cancellationToken) =>
+        await database.SpelunkKeys.SingleOrDefaultAsync(s => s.Id == id, cancellationToken)
+            .ConfigureAwait(false);
+
+    /// <inheritdoc />
+    public async Task<Dictionary<Guid, IVaultItem>> LoadAsync(
+        DodoDbContext database,
+        Guid vaultId,
+        Guid[] ids,
+        CancellationToken cancellationToken)
+    {
+        var rows = await database.SpelunkKeys
+            .Where(s => s.VaultId == vaultId && ids.Contains(s.Id))
+            .ToListAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+        return rows.ToDictionary(row => row.Id, row => (IVaultItem)row);
+    }
+
+    /// <inheritdoc />
+    public IVaultItem Add(DodoDbContext database, Guid id, Guid vaultId)
+    {
+        var key = new VaultSpelunkKey { Id = id, VaultId = vaultId };
+
+        database.SpelunkKeys.Add(key);
+
+        return key;
+    }
+
+    /// <summary>Refuses every plaintext field there is.</summary>
+    /// <remarks>
+    /// The relay fields are refused although this type holds an address, as they are for a bucket: the
+    /// address belongs in the ciphertext, and the server has no business keeping a list of where its users
+    /// manage their servers from.
+    /// </remarks>
+    /// <inheritdoc />
+    public bool ValidateFields(SyncPlaintextFields fields, out string error)
+    {
+        ArgumentNullException.ThrowIfNull(fields);
+
+        error = string.Empty;
+
+        if (fields.RelayEnabled || fields.Hostname is not null || fields.Port is not null)
+        {
+            error = "A Spelunk key is not something the server dials; its address stays encrypted.";
+            return false;
+        }
+
+        if (fields.GroupId is not null || fields.ParentId is not null || fields.RelatedId is not null)
+        {
+            error = "A Spelunk key's contents are inside its payload.";
+            return false;
+        }
+
+        if (fields.Kind is not null || fields.PublicKeyFingerprint is not null)
+        {
+            error = "A Spelunk key carries no plaintext fields at all.";
+            return false;
+        }
+
+        return true;
+    }
+
+    /// <remarks>Nothing to copy: this type has no plaintext columns to copy anything into.</remarks>
+    /// <inheritdoc />
+    public void ApplyFields(IVaultItem item, SyncPlaintextFields fields)
+    {
+    }
+
+    /// <inheritdoc />
+    public void ClearFieldsOnDelete(IVaultItem item)
+    {
+    }
+
+    /// <inheritdoc />
+    public SyncPlaintextFields? Hydrate(IVaultItem item) => null;
+}

src/DodoSSH.Client.Android/Views/HostsScreen.axaml

@@ -1002,7 +1002,8 @@
                            FormatString="0" ShowButtonSpinner="False" MinHeight="44"
                            PlaceholderText="{Binding EditorPortPlaceholder}" />
             <TextBox Grid.Column="2" Classes="field" Text="{Binding EditorUsername}"
-                     PlaceholderText="{Binding EditorUsernamePlaceholder}" />
+                     PlaceholderText="{Binding EditorUsernamePlaceholder}"
+                     IsEnabled="{Binding EditorAsksForLogin}" />
           </Grid>
 
           <TextBox Classes="field" Text="{Binding EditorNotes}" PlaceholderText="notes" />
@@ -1016,6 +1017,7 @@
           <TextBlock Classes="label" Text="AUTHENTICATION" Margin="0,4,0,0" />
           <ComboBox ItemsSource="{Binding EditorAuthenticationChoices}"
                     SelectedItem="{Binding EditorSelectedAuthentication}"
+                    IsEnabled="{Binding EditorAsksForLogin}"
                     HorizontalAlignment="Stretch" MinHeight="44">
             <ComboBox.ItemTemplate>
               <DataTemplate x:DataType="vm:AuthenticationChoice">
@@ -1028,6 +1030,9 @@
               </DataTemplate>
             </ComboBox.ItemTemplate>
           </ComboBox>
+          <!-- Why the login is greyed out, as on the desktop. See VaultViewModel.EditorAsksForLogin. -->
+          <TextBlock Classes="detail" TextWrapping="Wrap" IsVisible="{Binding !EditorAsksForLogin}"
+                     Text="Spelunk signs you in to this host, so it needs no username, SSH key or password." />
 
           <!--
             Making a credential without leaving the host, as on the desktop and on the same reasoning: the
@@ -1227,7 +1232,7 @@
                      PlaceholderText="Spelunk API address (https://api.…)" />
             <TextBox Classes="field" Text="{Binding EditorSpelunkServerId}"
                      PlaceholderText="Spelunk server id" />
-            <TextBlock Classes="detail" Text="Credential holding the Spelunk API key" />
+            <TextBlock Classes="detail" Text="Spelunk API key" />
             <ComboBox ItemsSource="{Binding EditorSpelunkKeyChoices}"
                       SelectedItem="{Binding EditorSelectedSpelunkKey}"
                       HorizontalAlignment="Stretch" MinHeight="44">
@@ -1237,9 +1242,15 @@
                 </DataTemplate>
               </ComboBox.ItemTemplate>
             </ComboBox>
+            <!-- The desktop card's sign-in box. See SpelunkRoute.SignInThroughSpelunk. -->
+            <CheckBox IsChecked="{Binding EditorSpelunkSignIn}" MinHeight="44">
+              <TextBlock Classes="mono" FontSize="11.5"
+                         Text="Sign in through Spelunk (no SSH key needed)"
+                         TextWrapping="Wrap" />
+            </CheckBox>
           </StackPanel>
           <TextBlock Classes="body"
-                     Text="Spelunk's agent on the server connects to its SSH server for you, so the server needs no open SSH port. Save a Spelunk API key with the Admin role as a credential's password and choose it here; it is sent only to the address above. Connects only while Spelunk and its agent are reachable." />
+                     Text="Spelunk's agent on the server connects to its SSH server for you, so the server needs no open SSH port. Choose a Spelunk API key (Admin role) saved from the desktop's Settings → Security, or a credential whose password is the key; it is sent only to the address above. Signing in through Spelunk logs you in as the account Spelunk names, with a key made for each connection and never kept. Connects only while Spelunk and its agent are reachable." />
 
           <!--
             This page covers the whole screen while it is open, which is why it needs a Status line of its

src/DodoSSH.Client.App/Views/HostDrawer.axaml

@@ -578,7 +578,8 @@
                 -->
                 <Grid ColumnDefinitions="*,8,78">
                   <TextBox Grid.Column="0" Text="{Binding EditorUsername}"
-                           PlaceholderText="{Binding EditorUsernamePlaceholder}" Height="40" />
+                           PlaceholderText="{Binding EditorUsernamePlaceholder}" Height="40"
+                           IsEnabled="{Binding EditorAsksForLogin}" />
                   <NumericUpDown Grid.Column="2" FontFamily="{StaticResource MonoFont}"
                                  Value="{Binding EditorPort}" Minimum="1" Maximum="65535" FormatString="0"
                                  ShowButtonSpinner="False" PlaceholderText="{Binding EditorPortPlaceholder}"
@@ -599,6 +600,7 @@
                 -->
                 <ComboBox ItemsSource="{Binding EditorAuthenticationChoices}"
                           SelectedItem="{Binding EditorSelectedAuthentication}"
+                          IsEnabled="{Binding EditorAsksForLogin}"
                           HorizontalAlignment="Stretch" Height="40">
                   <ComboBox.ItemTemplate>
                     <DataTemplate x:DataType="vm:AuthenticationChoice">
@@ -612,6 +614,15 @@
                   </ComboBox.ItemTemplate>
                 </ComboBox>
 
+                <!--
+                  Why the two controls above are greyed out for a host Spelunk signs in to: disabled rather
+                  than hidden, so a login somebody chose is still there to see and comes back if the box in
+                  the Spelunk card is unticked before saving. See VaultViewModel.EditorAsksForLogin.
+                -->
+                <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                           IsVisible="{Binding !EditorAsksForLogin}"
+                           Text="Spelunk signs you in to this host, so it needs no username, SSH key or password." />
+
                 <!--
                   Making a credential without leaving the host. The moment one is wanted is this one: somebody
                   is deciding how a host authenticates and finds the password is not in the keychain yet, and
@@ -713,19 +724,34 @@
                       <TextBox Text="{Binding EditorSpelunkServerId}" Height="36"
                                PlaceholderText="Spelunk server id" />
                       <!--
-                        Credentials only: the key is the credential's password. A deleted one keeps a
-                        placeholder, as the authentication picker's does, so an unrelated edit cannot drop it.
+                        Saved Spelunk keys first (Settings → Security), each qualified by the one address it
+                        goes to, then credentials whose password is a key. A deleted one keeps a placeholder, as
+                        the authentication picker's does, so an unrelated edit cannot drop it. Typing an address
+                        a key is saved for picks that key when nothing is picked yet.
                       -->
-                      <TextBlock Classes="hint" FontSize="10.5" Text="Credential holding the Spelunk API key" />
+                      <TextBlock Classes="hint" FontSize="10.5" Text="Spelunk API key" />
                       <ComboBox ItemsSource="{Binding EditorSpelunkKeyChoices}"
                                 SelectedItem="{Binding EditorSelectedSpelunkKey}"
                                 HorizontalAlignment="Stretch" Height="40">
                         <ComboBox.ItemTemplate>
                           <DataTemplate x:DataType="vm:AuthenticationChoice">
-                            <TextBlock Text="{Binding Label}" />
+                            <StackPanel Orientation="Horizontal" Spacing="8">
+                              <TextBlock Text="{Binding Label}" />
+                              <TextBlock Text="{Binding Qualifier}" Classes="hint" FontSize="11"
+                                         VerticalAlignment="Center" />
+                            </StackPanel>
                           </DataTemplate>
                         </ComboBox.ItemTemplate>
                       </ComboBox>
+                      <!--
+                        Spelunk signs the user in: a key pair made in memory for each connection, its public
+                        half sent with the ticket, and the agent's one-connection SSH server accepting only
+                        that. Ticking it greys out the login above. See SpelunkRoute.SignInThroughSpelunk.
+                      -->
+                      <CheckBox IsChecked="{Binding EditorSpelunkSignIn}" VerticalContentAlignment="Center">
+                        <TextBlock Text="Sign in through Spelunk (no SSH key needed)" FontSize="12.5"
+                                   Foreground="{StaticResource Text}" TextWrapping="Wrap" />
+                      </CheckBox>
                     </StackPanel>
                     <!--
                       What the route asks for and what it costs, said where the decision is made: an Admin-role
@@ -733,7 +759,7 @@
                       only while Spelunk and its agent are.
                     -->
                     <TextBlock Classes="hint" FontSize="11.5"
-                               Text="Spelunk's agent on the server connects to its SSH server for you, so the server needs no open SSH port. Save a Spelunk API key with the Admin role as a credential's password and choose it here; it is sent only to the address above. The hostname and port still name this machine's host key. Connects only while Spelunk and its agent are reachable." />
+                               Text="Spelunk's agent on the server connects to its SSH server for you, so the server needs no open SSH port. Save your Spelunk API key (Admin role) under Settings → Security and choose it here, or keep it as a credential's password; it is sent only to the address above. Signing in through Spelunk logs you in as the account Spelunk names, with a key made for each connection and never kept. The hostname and port still name this machine's host key. Connects only while Spelunk and its agent are reachable." />
                   </StackPanel>
                 </Border>
 

src/DodoSSH.Client.App/Views/SettingsSecurityPage.axaml

@@ -1,8 +1,10 @@
 <UserControl xmlns="https://github.com/avaloniaui"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             xmlns:views="using:DodoSSH.Client.App.Views"
              x:Class="DodoSSH.Client.App.Views.SettingsSecurityPage"
-             x:DataType="vm:MainWindowViewModel">
+             x:DataType="vm:MainWindowViewModel"
+             x:Name="Root">
 
   <!--
     v5c: Security, against Settings-Security.dc.html.
@@ -24,6 +26,14 @@
     on purpose — known-hosts is a MAIN-chrome screen, and there is no honest way to show it without leaving;
     ShowScreenCommand already does that for any target that is not Preferences or Vaults.
 
+    SPELUNK is where a Spelunk API key is filled in: an address and a key, saved as a Spelunk key item in the
+    personal vault (VaultViewModel.SaveSpelunkKeyCommand) and synced like every secret. The address is the
+    point — a key saved here is only ever sent there, and links from that Spelunk connect straight away
+    because saving it is the user saying so. A second key for an address already saved replaces the first.
+    The key box is a password box and is emptied the moment the key is in the keychain; the list below it
+    shows the name, the address and how many hosts use each key, never the key. Deleting goes through the
+    same ConfirmDeleteCard every other deletion does, with a count of the hosts that would stop connecting.
+
     RECENT SECURITY EVENTS is the link row alone, not the design's own list of rows. A real list would mean
     building a filtered read over LogsViewModel's activity and connection logs — which entries count as
     "security" is itself a judgement call the design does not resolve — and the honest link is complete on
@@ -101,6 +111,86 @@
         </StackPanel>
       </Border>
 
+      <TextBlock Classes="settingssection" Text="SPELUNK" />
+
+      <Border Classes="settingscard">
+        <StackPanel>
+          <Border Classes="settingsrow">
+            <StackPanel Spacing="10">
+              <StackPanel Spacing="6" MaxWidth="640" HorizontalAlignment="Left">
+                <TextBlock Classes="settingsrowtitle" Text="Spelunk API key" />
+                <TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
+                           Text="Hosts reached through Spelunk use this key, and links from that Spelunk connect straight away. It is kept encrypted in your personal vault, syncs to your other devices, and is only ever sent to the address below. Use a key with the Admin role." />
+              </StackPanel>
+              <Grid ColumnDefinitions="*,*,Auto" ColumnSpacing="10"
+                    IsEnabled="{Binding Vault, Converter={x:Static ObjectConverters.IsNotNull}}">
+                <TextBox Grid.Column="0" Height="38" Text="{Binding Vault.SpelunkKeyFormApi}"
+                         PlaceholderText="Spelunk API address (https://api.…)" />
+                <TextBox Grid.Column="1" Height="38" PasswordChar="•" Text="{Binding Vault.SpelunkKeyFormKey}"
+                         PlaceholderText="API key (spelunk_…)">
+                  <TextBox.KeyBindings>
+                    <KeyBinding Gesture="Enter" Command="{Binding Vault.SaveSpelunkKeyCommand}" />
+                  </TextBox.KeyBindings>
+                </TextBox>
+                <Button Grid.Column="2" Classes="accent" Height="38" Content="SAVE KEY"
+                        Command="{Binding Vault.SaveSpelunkKeyCommand}"
+                        IsEnabled="{Binding !Vault.IsBusy, FallbackValue=False}" />
+              </Grid>
+              <TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
+                         Text="{Binding Vault.SpelunkKeyFormNote}"
+                         IsVisible="{Binding Vault.HasSpelunkKeyFormNote, FallbackValue=False}" />
+              <TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
+                         IsVisible="{Binding Vault, Converter={x:Static ObjectConverters.IsNull}}"
+                         Text="Unlock your keychain to save a Spelunk key." />
+            </StackPanel>
+          </Border>
+
+          <!-- The delete confirmation, in place, as the tags and groups pages draw it. -->
+          <Border Margin="24,12" Padding="20" CornerRadius="12"
+                  Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}"
+                  BorderThickness="1"
+                  IsVisible="{Binding Vault.PendingDeletion, Converter={x:Static ObjectConverters.IsNotNull}, FallbackValue=False}">
+            <views:ConfirmDeleteCard DataContext="{Binding Vault}" />
+          </Border>
+
+          <ItemsControl ItemsSource="{Binding Vault.SpelunkKeys}">
+            <ItemsControl.ItemsPanel>
+              <ItemsPanelTemplate>
+                <StackPanel />
+              </ItemsPanelTemplate>
+            </ItemsControl.ItemsPanel>
+            <ItemsControl.ItemTemplate>
+              <DataTemplate x:DataType="vm:SpelunkKeyRowViewModel">
+                <Border Classes="settingsrow" Padding="24,14">
+                  <Grid ColumnDefinitions="*,Auto,Auto" ColumnSpacing="12">
+                    <StackPanel Grid.Column="0" Spacing="4" VerticalAlignment="Center">
+                      <StackPanel Orientation="Horizontal" Spacing="8">
+                        <TextBlock Classes="settingsrowtitle" Text="{Binding Label}" />
+                        <Border Classes="chip" IsVisible="{Binding HasVaultBadge}" VerticalAlignment="Center">
+                          <TextBlock Text="{Binding VaultBadge}" />
+                        </Border>
+                        <TextBlock Classes="hint" FontSize="11" Text="{Binding Badge}" VerticalAlignment="Center" />
+                      </StackPanel>
+                      <TextBlock Classes="mono" FontSize="11.5" Foreground="{StaticResource TextFaint}"
+                                 Text="{Binding ApiBase}" />
+                    </StackPanel>
+                    <TextBlock Grid.Column="1" Classes="settingsrowcaption" VerticalAlignment="Center"
+                               Text="{Binding UsedBy}" />
+                    <Button Grid.Column="2" Classes="paneicon danger" Width="30" Height="30" FontSize="13"
+                            VerticalAlignment="Center"
+                            Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vault.DeleteSpelunkKeyRowCommand}"
+                            CommandParameter="{Binding}"
+                            ToolTip.Tip="Delete this key. Hosts that reach Spelunk with it stop connecting until they name another.">
+                      <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE872;" />
+                    </Button>
+                  </Grid>
+                </Border>
+              </DataTemplate>
+            </ItemsControl.ItemTemplate>
+          </ItemsControl>
+        </StackPanel>
+      </Border>
+
       <TextBlock Classes="settingssection" Text="RECENT SECURITY EVENTS" />
 
       <Border Classes="settingscard" Margin="0,12,0,40">

src/DodoSSH.Client.App/Views/SettingsSecurityPage.axaml.cs

@@ -2,7 +2,9 @@ using Avalonia.Controls;
 
 namespace DodoSSH.Client.App.Views;
 
-/// <summary>Settings mode's Security page: the E2E explainer, Windows Hello, and approved host keys.</summary>
+/// <summary>
+/// Settings mode's Security page: the E2E explainer, Windows Hello, approved host keys, and Spelunk API keys.
+/// </summary>
 internal sealed partial class SettingsSecurityPage : UserControl
 {
     public SettingsSecurityPage() => InitializeComponent();

src/DodoSSH.Client.Domain/HostSecret.cs

@@ -321,6 +321,10 @@ public sealed record HostSecret : IVaultSecret
     /// </remarks>
     public SpelunkRoute? Spelunk { get; init; }
 
+    /// <summary>Whether Spelunk signs the user in to this host, so it needs no login of its own.</summary>
+    /// <remarks>See <see cref="SpelunkRoute.SignInThroughSpelunk"/>.</remarks>
+    public bool SignsInThroughSpelunk => Spelunk?.SignInThroughSpelunk is true;
+
     /// <summary>
     /// Checks the fields that must hold before this can be stored.
     /// </summary>

src/DodoSSH.Client.Domain/HostSecretCodec.cs

@@ -135,12 +135,28 @@ public static class HostSecretCodec
     /// </remarks>
     public const int SpelunkSchemaVersion = 9;
 
+    /// <summary>The version that introduced <see cref="SpelunkRoute.SignInThroughSpelunk"/>.</summary>
+    /// <remarks>
+    /// <para>
+    /// Its own version, and nested in the existing <c>spelunk</c> object rather than beside it, because it
+    /// is part of that one decision. A build that knows 9 skips the unknown member and reads a valid host —
+    /// a Spelunk host with no login of its own — and it must not save that back: the flag would be dropped
+    /// and the host would start asking for a password it never had. Written at this version, that build
+    /// shows the host, refuses to edit it, and says to update.
+    /// </para>
+    /// <para>
+    /// Only a route that signs in is written here. Every other Spelunk host stays at
+    /// <see cref="SpelunkSchemaVersion"/>, byte for byte what it was.
+    /// </para>
+    /// </remarks>
+    public const int SpelunkSignInSchemaVersion = 10;
+
     /// <summary>The highest schema version this build can write.</summary>
     /// <remarks>
     /// Names the highest constant above, which <see cref="SchemaVersionFor"/> assumes when it takes a
     /// maximum. A new field added below this line has to be named here too.
     /// </remarks>
-    public const int CurrentSchemaVersion = SpelunkSchemaVersion;
+    public const int CurrentSchemaVersion = SpelunkSignInSchemaVersion;
 
     /// <summary>Serialises a host to the bytes that get sealed.</summary>
     /// <exception cref="ArgumentException">The host is not valid for storage.</exception>
@@ -193,14 +209,7 @@ public static class HostSecretCodec
                 : [.. host.PortForwards.Select(PortForwardDocument.From)],
             // Last of all, and absent for a host that is dialled, so every host without a route encodes
             // exactly as it did before routes existed.
-            Spelunk = host.Spelunk is { } route
-                ? new SpelunkPayloadDocument
-                {
-                    Api = route.ApiBase,
-                    ServerId = route.ServerId,
-                    ApiKeyCredentialId = route.ApiKeyCredentialId,
-                }
-                : null,
+            Spelunk = host.Spelunk is { } route ? SpelunkPayloadDocument.From(route) : null,
         };
 
         return JsonSerializer.SerializeToUtf8Bytes(
@@ -286,6 +295,11 @@ public static class HostSecretCodec
             version = Math.Max(version, SpelunkSchemaVersion);
         }
 
+        if (host.SignsInThroughSpelunk)
+        {
+            version = Math.Max(version, SpelunkSignInSchemaVersion);
+        }
+
         return version;
     }
 
@@ -437,6 +451,9 @@ public static class HostSecretCodec
                 ApiBase = parsed.Api ?? string.Empty,
                 ServerId = parsed.ServerId ?? Guid.Empty,
                 ApiKeyCredentialId = parsed.ApiKeyCredentialId ?? Guid.Empty,
+
+                // False folds to the default, as AsksForPassword's does: one state, one spelling.
+                SignInThroughSpelunk = parsed.SignIn is true,
             };
 }
 
@@ -528,6 +545,23 @@ internal sealed class SpelunkPayloadDocument
     public Guid? ServerId { get; set; }
 
     public Guid? ApiKeyCredentialId { get; set; }
+
+    /// <remarks>
+    /// Last, and null unless true, so a route that does not sign in keeps the bytes it had at version 9.
+    /// See <see cref="HostSecretCodec.SpelunkSignInSchemaVersion"/>.
+    /// </remarks>
+    public bool? SignIn { get; set; }
+
+    public static SpelunkPayloadDocument From(SpelunkRoute route) => new()
+    {
+        Api = route.ApiBase,
+        ServerId = route.ServerId,
+        ApiKeyCredentialId = route.ApiKeyCredentialId,
+
+        // Null rather than false, so a route that does not sign in encodes exactly as it did before the
+        // field existed — the rule AsksForPassword follows.
+        SignIn = route.SignInThroughSpelunk ? true : null,
+    };
 }
 
 /// <summary>One forward's serialised shape. Nullable throughout, because it models untrusted input.</summary>

src/DodoSSH.Client.Domain/SpelunkKeySecret.cs

@@ -0,0 +1,92 @@
+using System.Diagnostics.CodeAnalysis;
+
+namespace DodoSSH.Client.Domain;
+
+/// <summary>
+/// A Spelunk API key and the one Spelunk it may be sent to, decrypted.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>The address is what makes this an item of its own.</b> A key kept as a credential's password can be
+/// sent anywhere a host names, and a link from Spelunk can be sent by anything on the machine — so a link
+/// that is not already backed by a saved host has to stop and ask. A key stored with its address says, once
+/// and in the keychain, where the user agreed it may go: a link from that Spelunk connects straight away, and
+/// a host naming this key with any other address is refused at connect rather than sending it there. See
+/// <c>VaultViewModel.OpenSpelunkLinkAsync</c>.
+/// </para>
+/// <para>
+/// <b><see cref="ApiKey"/> is a password, and everything this codebase does about passwords applies to
+/// it</b>, as it does to <see cref="ObjectStoreSecret.SecretAccessKey"/>: it is inside the encrypted payload,
+/// the activity log records that it changed and never what it was, and the merge reports that it differed
+/// rather than either value.
+/// </para>
+/// </remarks>
+public sealed record SpelunkKeySecret : IVaultSecret
+{
+    /// <summary>The longest API key stored.</summary>
+    /// <remarks>
+    /// Far beyond any real key, for the reason <see cref="SpelunkRoute.MaxApiBaseLength"/> exists: an
+    /// unbounded string is the shape a corrupted payload takes, and this one goes into a request header.
+    /// </remarks>
+    public const int MaxApiKeyLength = 4096;
+
+    /// <summary>What the user calls this key.</summary>
+    public required string Label { get; init; }
+
+    /// <summary>
+    /// The Spelunk API this key is for, as <see cref="SpelunkRoute.TryNormalizeApiBase"/> writes it, and the
+    /// only address it is ever sent to.
+    /// </summary>
+    /// <remarks>
+    /// Normalised for the reason <see cref="SpelunkRoute.ApiBase"/> is: it is compared, byte for byte, with
+    /// the address a host or a link names.
+    /// </remarks>
+    public required string ApiBase { get; init; }
+
+    /// <summary>The API key itself, as Spelunk issued it.</summary>
+    public required string ApiKey { get; init; }
+
+    /// <summary>Whether this is storable, and why not if it is not.</summary>
+    public bool TryValidate([NotNullWhen(false)] out string? reason)
+    {
+        if (string.IsNullOrWhiteSpace(Label))
+        {
+            reason = "A Spelunk key needs a name.";
+            return false;
+        }
+
+        if (string.IsNullOrWhiteSpace(ApiBase))
+        {
+            reason = "A Spelunk key needs the address of the Spelunk it is for.";
+            return false;
+        }
+
+        if (!SpelunkRoute.TryNormalizeApiBase(ApiBase, out var normalized, out reason))
+        {
+            return false;
+        }
+
+        if (!string.Equals(normalized, ApiBase, StringComparison.Ordinal))
+        {
+            reason = "The Spelunk API address is not in its normal form.";
+            return false;
+        }
+
+        if (string.IsNullOrWhiteSpace(ApiKey))
+        {
+            reason = "A Spelunk key needs the key.";
+            return false;
+        }
+
+        // A header value cannot hold a line break, and a key with one would fail at the first connect with an
+        // HTTP error that names neither the key nor this item.
+        if (ApiKey.Length > MaxApiKeyLength || ApiKey.Any(char.IsControl))
+        {
+            reason = "That does not look like a Spelunk API key.";
+            return false;
+        }
+
+        reason = null;
+        return true;
+    }
+}

src/DodoSSH.Client.Domain/SpelunkKeySecretCodec.cs

@@ -0,0 +1,112 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace DodoSSH.Client.Domain;
+
+/// <summary>A decoded Spelunk key payload, together with the schema version it was written at.</summary>
+/// <param name="Key">The key.</param>
+/// <param name="SchemaVersion">The version the writing client used.</param>
+public sealed record SpelunkKeySecretDocument(SpelunkKeySecret Key, int SchemaVersion)
+{
+    /// <inheritdoc cref="HostSecretDocument.IsReadOnly" />
+    public bool IsReadOnly => SchemaVersion > SpelunkKeySecretCodec.CurrentSchemaVersion;
+}
+
+/// <summary>
+/// Encodes and decodes the plaintext inside a Spelunk key item's encrypted payload.
+/// </summary>
+/// <remarks>
+/// Mirrors <see cref="ObjectStoreSecretCodec"/>, for the same reasons and with the same guarantees.
+/// </remarks>
+public static class SpelunkKeySecretCodec
+{
+    /// <summary>The schema version this build writes.</summary>
+    public const int CurrentSchemaVersion = 1;
+
+    /// <summary>Serialises a key to the bytes that get sealed.</summary>
+    /// <exception cref="ArgumentException">The key is not valid for storage.</exception>
+    public static byte[] Encode(SpelunkKeySecret key)
+    {
+        ArgumentNullException.ThrowIfNull(key);
+
+        if (!key.TryValidate(out var reason))
+        {
+            throw new ArgumentException(reason, nameof(key));
+        }
+
+        var document = new SpelunkKeyPayloadDocument
+        {
+            SchemaVersion = CurrentSchemaVersion,
+            Label = key.Label,
+            ApiBase = key.ApiBase,
+            ApiKey = key.ApiKey,
+        };
+
+        return JsonSerializer.SerializeToUtf8Bytes(
+            document, SpelunkKeyPayloadJsonContext.Default.SpelunkKeyPayloadDocument);
+    }
+
+    /// <summary>Parses a decrypted payload.</summary>
+    /// <inheritdoc cref="HostSecretCodec.TryDecode" path="/remarks" />
+    public static bool TryDecode(
+        ReadOnlySpan<byte> payload,
+        [NotNullWhen(true)] out SpelunkKeySecretDocument? document)
+    {
+        document = null;
+
+        SpelunkKeyPayloadDocument? parsed;
+        try
+        {
+            parsed = JsonSerializer.Deserialize(
+                payload, SpelunkKeyPayloadJsonContext.Default.SpelunkKeyPayloadDocument);
+        }
+        catch (JsonException)
+        {
+            return false;
+        }
+
+        if (parsed is null || parsed.SchemaVersion < 1)
+        {
+            return false;
+        }
+
+        var candidate = new SpelunkKeySecret
+        {
+            Label = parsed.Label ?? string.Empty,
+            ApiBase = parsed.ApiBase ?? string.Empty,
+            ApiKey = parsed.ApiKey ?? string.Empty,
+        };
+
+        // A key whose address is not in its normal form is refused rather than normalised here: the address
+        // is what decides where the key may go, and a payload that disagrees with how every client writes it
+        // is not one to guess about.
+        if (!candidate.TryValidate(out _))
+        {
+            return false;
+        }
+
+        document = new SpelunkKeySecretDocument(candidate, parsed.SchemaVersion);
+        return true;
+    }
+}
+
+/// <summary>The serialised shape. Mutable and nullable because it models untrusted input.</summary>
+/// <inheritdoc cref="HostPayloadDocument" path="/remarks" />
+internal sealed class SpelunkKeyPayloadDocument
+{
+    public int SchemaVersion { get; set; }
+
+    public string? Label { get; set; }
+
+    public string? ApiBase { get; set; }
+
+    public string? ApiKey { get; set; }
+}
+
+[JsonSourceGenerationOptions(
+    PropertyNamingPolicy = JsonKnownNamingPolicy.CamelCase,
+    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+    UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip)]
+[JsonSerializable(typeof(SpelunkKeyPayloadDocument))]
+internal sealed partial class SpelunkKeyPayloadJsonContext : JsonSerializerContext;

src/DodoSSH.Client.Domain/SpelunkKeySecretMerge.cs

@@ -0,0 +1,89 @@
+namespace DodoSSH.Client.Domain;
+
+/// <summary>The merged Spelunk key, and everything that had to be overridden to produce it.</summary>
+/// <param name="Merged">The key to store and push.</param>
+/// <param name="Conflicts">Empty when the two sides were reconcilable field by field.</param>
+public sealed record SpelunkKeyMergeResult(
+    SpelunkKeySecret Merged,
+    IReadOnlyList<HostFieldConflict> Conflicts)
+{
+    /// <summary>Whether anything had to be overridden.</summary>
+    public bool HasConflicts => Conflicts.Count > 0;
+}
+
+/// <summary>
+/// Merges two divergent versions of a Spelunk key against the version they both started from.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>The address and the key merge as one value, not two.</b> The pair is the whole meaning of this item —
+/// "this key may go to this Spelunk" — and merging them apart could keep one device's new address beside the
+/// other device's new key, sending a key to a Spelunk nobody ever paired it with. So when both sides changed
+/// the pair, one side's pair is kept whole.
+/// </para>
+/// <para>
+/// <b>The key never reaches the conflict log</b>, for the reason a secret access key does not: a discarded
+/// one is very often still live. The addresses are shown, because which Spelunk the kept key goes to is the
+/// whole content of the notice.
+/// </para>
+/// </remarks>
+public static class SpelunkKeySecretMerge
+{
+    /// <summary>The name a conflict over the address and key is recorded under.</summary>
+    public const string PairField = "ApiBaseAndKey";
+
+    /// <summary>Produces the merged key.</summary>
+    /// <param name="ancestor">The version both sides branched from.</param>
+    /// <param name="local">The pending local version.</param>
+    /// <param name="remote">The server's current version.</param>
+    public static SpelunkKeyMergeResult Merge(
+        SpelunkKeySecret ancestor,
+        SpelunkKeySecret local,
+        SpelunkKeySecret remote)
+    {
+        ArgumentNullException.ThrowIfNull(ancestor);
+        ArgumentNullException.ThrowIfNull(local);
+        ArgumentNullException.ThrowIfNull(remote);
+
+        var conflicts = new List<HostFieldConflict>();
+
+        var label = ThreeWayMerge.Scalar(ancestor.Label, local.Label, remote.Label, StringComparer.Ordinal);
+
+        if (label.IsConflicted)
+        {
+            conflicts.Add(new HostFieldConflict(
+                nameof(SpelunkKeySecret.Label),
+                MergeSide.Local,
+                label.Value,
+                label.Discarded ?? "(none)",
+                DiscardedWasRemoval: false));
+        }
+
+        // A tuple of two strings compares both ordinally, which is the comparison each field needs.
+        var pair = ThreeWayMerge.Scalar(
+            (ancestor.ApiBase, ancestor.ApiKey),
+            (local.ApiBase, local.ApiKey),
+            (remote.ApiBase, remote.ApiKey));
+
+        if (pair.IsConflicted)
+        {
+            conflicts.Add(new HostFieldConflict(
+                PairField,
+                MergeSide.Local,
+                $"{pair.Value.ApiBase} (with its key)",
+                string.Equals(pair.Discarded.ApiBase, pair.Value.ApiBase, StringComparison.Ordinal)
+                    ? "(a different key for the same address was discarded)"
+                    : $"{pair.Discarded.ApiBase} (with its key)",
+                DiscardedWasRemoval: false));
+        }
+
+        var merged = new SpelunkKeySecret
+        {
+            Label = label.Value,
+            ApiBase = pair.Value.ApiBase,
+            ApiKey = pair.Value.ApiKey,
+        };
+
+        return new SpelunkKeyMergeResult(merged, conflicts);
+    }
+}

src/DodoSSH.Client.Domain/SpelunkRoute.cs

@@ -19,11 +19,11 @@ namespace DodoSSH.Client.Domain;
 /// the vault holds. So the concession ADR 0004 argues for the relay's address is not made for this.
 /// </para>
 /// <para>
-/// <b>The API key is referenced, not embedded.</b> <see cref="ApiKeyCredentialId"/> names an ordinary
-/// keychain credential whose password is the key, for the reason <see cref="HostSecret.CredentialId"/>
-/// gives: one Spelunk key is the key for every server in its organisation, and a copy per host is twenty
-/// places to rotate it and one to forget. It also means the key is encrypted, synced, merged and shown in
-/// the keychain exactly as a password is, with no item type of its own to build and keep in step.
+/// <b>The API key is referenced, not embedded.</b> <see cref="ApiKeyCredentialId"/> names the keychain item
+/// holding it, for the reason <see cref="HostSecret.CredentialId"/> gives: one Spelunk key is the key for
+/// every server in its organisation, and a copy per host is twenty places to rotate it and one to forget.
+/// That item is a <see cref="SpelunkKeySecret"/>, which also says the one address the key may go to, or —
+/// for a host set up before those existed — an ordinary credential whose password is the key.
 /// </para>
 /// </remarks>
 public sealed record SpelunkRoute
@@ -50,15 +50,50 @@ public sealed record SpelunkRoute
     /// <summary>The server's id in Spelunk.</summary>
     public required Guid ServerId { get; init; }
 
-    /// <summary>The keychain credential whose password is the Spelunk API key.</summary>
+    /// <summary>
+    /// The keychain item holding the Spelunk API key: a <see cref="SpelunkKeySecret"/>, or a credential whose
+    /// password is the key.
+    /// </summary>
     /// <remarks>
+    /// <para>
+    /// Named for the credential it always was, and kept so on the wire: item ids are unique across kinds, so
+    /// the one id says which, and a build that predates Spelunk keys reads a host naming one as a host whose
+    /// key credential has gone — refused at connect, and kept as it is by an edit — rather than as damage.
+    /// </para>
+    /// <para>
     /// Required rather than nullable. A route with no key can never be opened, and a host saved that way
     /// would refuse every connection with a sentence about something the editor let through. The reference
     /// can still dangle — the credential may be deleted on another machine — and that is refused where it
     /// is noticed, at connect, exactly as a missing SSH credential is.
+    /// </para>
     /// </remarks>
     public required Guid ApiKeyCredentialId { get; init; }
 
+    /// <summary>
+    /// Whether Spelunk signs the user in, so the host needs no SSH key, credential or password of its own.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// For each connection this client makes a throwaway key pair in memory and sends the public half with
+    /// the ticket request, which the API key authorises. The agent then runs a one-connection SSH server on
+    /// the machine whose only authorised key is that one, and says which account it logs in as. It is real
+    /// SSH to the server's own host key, so shells, file transfer and port forwards work as for any host,
+    /// and the key is gone when the connection is.
+    /// </para>
+    /// <para>
+    /// <b>What the host says about logging in is then not asked.</b> Its username, key, credential and
+    /// typed-password choice — its own or a group's — are left alone rather than refused, because they are
+    /// the host's answer for the day this is unticked, and refusing a host that carries them would make a
+    /// merge of two honest edits undecodable. The editor stores no binding beside this, and the connect path
+    /// never reads one for a host that has it. See <c>VaultViewModel.TryBuildAuthentication</c>.
+    /// </para>
+    /// <para>
+    /// Written from <see cref="HostSecretCodec.SpelunkSignInSchemaVersion"/>, and only when true, so a route
+    /// without it encodes exactly as it did before it existed.
+    /// </para>
+    /// </remarks>
+    public bool SignInThroughSpelunk { get; init; }
+
     /// <summary>Whether this is the route to the given server on the given Spelunk.</summary>
     /// <param name="apiBase">A normalised API base, as <see cref="TryNormalizeApiBase"/> writes it.</param>
     /// <param name="serverId">The server's id in Spelunk.</param>
@@ -88,7 +123,7 @@ public sealed record SpelunkRoute
 
         if (ApiKeyCredentialId == Guid.Empty)
         {
-            reason = "A host reached through Spelunk needs a credential holding its Spelunk API key.";
+            reason = "A host reached through Spelunk needs its Spelunk API key chosen.";
             return false;
         }
 

src/DodoSSH.Client.Session/SpelunkLink.cs

@@ -18,8 +18,10 @@ namespace DodoSSH.Client.Session;
 /// <para>
 /// <b>Anything on the machine can hand this application a link</b> — a web page, a mail, another program —
 /// so a link is data to check, never an instruction. It is refused whole unless it is exactly this shape,
-/// and the most it can ever do is select a host the user already saved, or open the editor on a new one
-/// that the user then has to finish and save. It never connects to anything the user has not saved.
+/// and the most it can ever do is connect to a host a link made before, add one for another server on a
+/// Spelunk a saved host already sends its API key to — with that same key — or open the editor on a new
+/// one that the user then has to finish and save. It never sends an API key anywhere a saved host does
+/// not already send it. See <c>VaultViewModel.OpenSpelunkLinkAsync</c>.
 /// </para>
 /// </remarks>
 /// <param name="ApiBase">The Spelunk API's base address, normalised as <see cref="SpelunkRoute"/> stores it.</param>

src/DodoSSH.Client.Session/SpelunkSignIn.cs

@@ -0,0 +1,81 @@
+using System.Text;
+using DodoSSH.Client.Ssh;
+
+namespace DodoSSH.Client.Session;
+
+/// <summary>
+/// The throwaway key one connection signs in to a Spelunk server with.
+/// </summary>
+/// <remarks>
+/// <para>
+/// For a host set to sign in through Spelunk — see <c>SpelunkRoute.SignInThroughSpelunk</c> — each connection
+/// makes one of these, sends <see cref="PublicKeyLine"/> with its ticket request, and authenticates with
+/// <see cref="Credential"/> once the tunnel is up. Spelunk's agent runs a one-connection SSH server whose only
+/// authorised key is this one, so the key is worth nothing after the connection it was made for.
+/// </para>
+/// <para>
+/// <b>Made in memory and never kept.</b> Nothing writes it to a disk or to the vault, and nothing logs it:
+/// <see cref="ToString"/> says what it is and nothing of what it holds. Ed25519, which is what
+/// <see cref="SshKeyGenerator"/> makes instantly and what every OpenSSH the agent could start accepts.
+/// </para>
+/// </remarks>
+public sealed class SpelunkSignIn
+{
+    /// <summary>The account Spelunk signs in as when its answer does not name one.</summary>
+    public const string DefaultUser = "root";
+
+    /// <summary>The comment the public key carries, which is what Spelunk and the server's logs see.</summary>
+    internal const string KeyComment = "dodossh-spelunk-sign-in";
+
+    private SpelunkSignIn(string publicKeyLine, SshPrivateKeyCredential credential)
+    {
+        PublicKeyLine = publicKeyLine;
+        Credential = credential;
+    }
+
+    /// <summary>The public half, as one OpenSSH <c>authorized_keys</c> line: <c>ssh-ed25519 AAAA… comment</c>.</summary>
+    public string PublicKeyLine { get; }
+
+    /// <summary>The private half, in the form a connection authenticates with.</summary>
+    public SshPrivateKeyCredential Credential { get; }
+
+    /// <summary>Makes a fresh key pair for one connection.</summary>
+    public static SpelunkSignIn Create()
+    {
+        var key = SshKeyGenerator.Generate(SshKeyAlgorithm.Ed25519, KeyComment);
+
+        return new SpelunkSignIn(
+            key.PublicKeyLine.Trim(),
+            new SshPrivateKeyCredential(Encoding.UTF8.GetBytes(key.PrivateKeyArmour), Passphrase: null));
+    }
+
+    /// <inheritdoc />
+    /// <remarks>Says nothing of the key, so one that reaches a log by accident takes nothing with it.</remarks>
+    public override string ToString() => "Spelunk sign-in key";
+}
+
+/// <summary>
+/// The credential of a connection that will sign in through Spelunk, before the tunnel has made its key.
+/// </summary>
+/// <remarks>
+/// <para>
+/// A host that signs in through Spelunk is resolved to a login before anything is opened — the same
+/// resolution every host goes through — but its key does not exist until the tunnel is opened, and the
+/// account is whatever Spelunk then says. This stands in for the key until the route replaces it, together
+/// with the username, as the connection is made through it.
+/// </para>
+/// <para>
+/// <b>It authenticates nothing.</b> The SSH layer knows only passwords and private keys, and refuses any other
+/// credential before it dials — so a path that forgot to take the route's key fails closed rather than
+/// sending something else in its place.
+/// </para>
+/// </remarks>
+public sealed record SpelunkSignInPending : SshCredential
+{
+    /// <summary>The one value; there is nothing in it to tell two apart.</summary>
+    public static SpelunkSignInPending Instance { get; } = new();
+
+    private SpelunkSignInPending()
+    {
+    }
+}

src/DodoSSH.Client.Session/SpelunkTunnel.cs

@@ -48,7 +48,10 @@ public static class SpelunkTunnelProtocol
     /// <summary>Close code for an agent that disconnected from Spelunk while the tunnel was open.</summary>
     public const int AgentDisconnectedCloseCode = 4503;
 
-    /// <summary>What an agent that predates tunnels says, inside a <see cref="TargetUnreachableCloseCode"/>.</summary>
+    /// <summary>
+    /// What an agent that predates tunnels — or, asked to sign in, predates that — says, inside a
+    /// <see cref="TargetUnreachableCloseCode"/>.
+    /// </summary>
     internal const string UnknownStreamKind = "Unknown stream kind";
 
     /// <summary>Where a ticket for one server is asked for.</summary>
@@ -67,7 +70,15 @@ public interface ISpelunkTunnel
     /// <param name="apiBase">The Spelunk API's base address, normalised by <see cref="SpelunkRoute"/>.</param>
     /// <param name="serverId">The server's id in Spelunk.</param>
     /// <param name="apiKey">The Spelunk API key, which authorises the ticket and is sent nowhere else.</param>
-    /// <param name="port">The port the agent is to connect to on the server's own loopback.</param>
+    /// <param name="port">
+    /// The port the agent is to connect to on the server's own loopback. Not sent when signing in, where the
+    /// agent starts an SSH server of its own and Spelunk ignores it.
+    /// </param>
+    /// <param name="signIn">
+    /// The throwaway key to have Spelunk sign in with, or null for a plain tunnel to <paramref name="port"/>.
+    /// Its public half goes with the ticket request; the route hands the whole of it back, with the account
+    /// Spelunk named, for the connection made through it.
+    /// </param>
     /// <param name="cancellationToken">Cancellation.</param>
     /// <remarks>
     /// Asks for a ticket, opens the socket and starts the bridge, in that order and at once — the ticket is
@@ -81,6 +92,7 @@ public interface ISpelunkTunnel
         Guid serverId,
         string apiKey,
         int port,
+        SpelunkSignIn? signIn,
         CancellationToken cancellationToken);
 }
 
@@ -99,32 +111,59 @@ public sealed class SpelunkTunnelRoute : IConnectionRoute
     private readonly RelayBridge bridge;
     private readonly int port;
 
-    internal SpelunkTunnelRoute(RelayBridge bridge, int port)
+    internal SpelunkTunnelRoute(RelayBridge bridge, int port, SpelunkSignIn? signIn = null, string? user = null)
     {
         this.bridge = bridge;
         this.port = port;
+        SignIn = signIn;
+        User = signIn is null ? null : user ?? SpelunkSignIn.DefaultUser;
     }
 
     /// <inheritdoc />
     public SshLoopbackProxy Proxy => bridge.Proxy;
 
+    /// <summary>The key Spelunk was asked to sign in with, or null for a plain tunnel.</summary>
+    /// <remarks>
+    /// Handed back rather than kept by whoever asked, so the connection made through this route takes its
+    /// credential from the same place it takes its proxy, and cannot be given one without the other.
+    /// </remarks>
+    public SpelunkSignIn? SignIn { get; }
+
+    /// <summary>
+    /// The account Spelunk signs in as — its answer's <c>user</c>, or <see cref="SpelunkSignIn.DefaultUser"/>
+    /// when it named none — or null for a plain tunnel.
+    /// </summary>
+    public string? User { get; }
+
     /// <inheritdoc />
     /// <remarks>
     /// A normal close is not a failure worth rewording: it is the SSH server hanging up, and SSH.NET's own
     /// account of that is the accurate one.
     /// </remarks>
     public string? Failure =>
-        bridge.CloseStatus is { } status ? Describe((int)status, bridge.CloseDescription, port) : null;
+        bridge.CloseStatus is { } status
+            ? Describe((int)status, bridge.CloseDescription, port, signingIn: SignIn is not null)
+            : null;
 
     /// <inheritdoc />
     public ValueTask DisposeAsync() => bridge.DisposeAsync();
 
     /// <summary>What a close code from Spelunk means, for someone who has to do something about it.</summary>
-    internal static string? Describe(int code, string? reason, int port) => code switch
+    internal static string? Describe(int code, string? reason, int port, bool signingIn = false) => code switch
     {
         SpelunkTunnelProtocol.TargetUnreachableCloseCode
             when reason?.Contains(SpelunkTunnelProtocol.UnknownStreamKind, StringComparison.OrdinalIgnoreCase) is true =>
-            "The Spelunk agent on this server is too old to open a terminal. Update the agent, then try again.",
+            signingIn
+                ? "The Spelunk agent on this server is too old to sign you in. Update the agent, then try again."
+                : "The Spelunk agent on this server is too old to open a terminal. Update the agent, then try again.",
+
+        // Signing in, the agent connects to nothing: it starts an SSH server of its own, and what it could not
+        // do is that — most often because the server has no OpenSSH server to start, which Spelunk's reason
+        // says in its own words.
+        SpelunkTunnelProtocol.TargetUnreachableCloseCode when signingIn =>
+            "The Spelunk agent could not sign you in on this server"
+            + (Readable(reason) is { } said ? $" ({said})" : string.Empty)
+            + ". Signing in through Spelunk needs OpenSSH's server (sshd) installed there.",
 
         SpelunkTunnelProtocol.TargetUnreachableCloseCode =>
             string.Create(
@@ -223,6 +262,9 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
     /// <summary>The longest ticket accepted. Far beyond Spelunk's; a bound on what goes into a header.</summary>
     private const int MaxTicketLength = 2048;
 
+    /// <summary>The longest account name taken from Spelunk's answer — well past what a Unix system allows.</summary>
+    private const int MaxUserLength = 64;
+
     /// <summary>The longest error body read, so a misbehaving proxy cannot hand this a gigabyte.</summary>
     private const int MaxProblemBytes = 16 * 1024;
 
@@ -263,6 +305,7 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
         Guid serverId,
         string apiKey,
         int port,
+        SpelunkSignIn? signIn,
         CancellationToken cancellationToken)
     {
         if (!SpelunkRoute.TryNormalizeApiBase(apiBase, out var normalized, out var reason))
@@ -270,7 +313,7 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
             throw new SpelunkTunnelException(reason);
         }
 
-        var ticket = await IssueTicketAsync(normalized, serverId, Sanitise(apiKey), port, cancellationToken)
+        var ticket = await IssueTicketAsync(normalized, serverId, Sanitise(apiKey), port, signIn, cancellationToken)
             .ConfigureAwait(false);
 
         var socket = await connect(
@@ -279,7 +322,7 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
                 cancellationToken)
             .ConfigureAwait(false);
 
-        return new SpelunkTunnelRoute(RelayBridge.Start(socket), port);
+        return new SpelunkTunnelRoute(RelayBridge.Start(socket), port, signIn, ticket.User);
     }
 
     /// <summary>
@@ -320,6 +363,7 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
         Guid serverId,
         string apiKey,
         int port,
+        SpelunkSignIn? signIn,
         CancellationToken cancellationToken)
     {
         using var request = new HttpRequestMessage(
@@ -330,8 +374,16 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
 
         // Serialised up front rather than streamed, so the request carries a Content-Length: a dozen bytes
         // do not need chunked encoding, and not every proxy in front of an API accepts it.
+        //
+        // Signing in sends the public key and no port: the agent starts an SSH server of its own rather than
+        // connecting to one, and Spelunk ignores the port beside a key anyway.
         request.Content = new ByteArrayContent(JsonSerializer.SerializeToUtf8Bytes(
-            new SpelunkTicketRequestDocument { Port = port },
+            signIn is null
+                ? new SpelunkTicketRequestDocument { Port = port }
+                : new SpelunkTicketRequestDocument
+                {
+                    SignIn = new SpelunkSignInRequestDocument { PublicKey = signIn.PublicKeyLine },
+                },
             SpelunkTunnelJsonContext.Default.SpelunkTicketRequestDocument))
         {
             Headers = { ContentType = new MediaTypeHeaderValue("application/json") },
@@ -365,13 +417,15 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
                 throw new SpelunkTunnelException(Describe(response.StatusCode, problem), response.StatusCode);
             }
 
-            return await ReadTicketAsync(response, cancellationToken).ConfigureAwait(false);
+            return await ReadTicketAsync(response, signingIn: signIn is not null, cancellationToken)
+                .ConfigureAwait(false);
         }
     }
 
     /// <summary>Reads the ticket, and refuses one this client would have to take on trust.</summary>
     private static async Task<SpelunkTicketDocument> ReadTicketAsync(
         HttpResponseMessage response,
+        bool signingIn,
         CancellationToken cancellationToken)
     {
         SpelunkTicketDocument? ticket;
@@ -397,7 +451,8 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
             || path.StartsWith("//", StringComparison.Ordinal)
             || path.Any(character => character is '?' or '#' or '\\' or '@' || char.IsWhiteSpace(character) || char.IsControl(character))
             || (ticket.Subprotocol is { } named
-                && !string.Equals(named, SpelunkTunnelProtocol.SubProtocol, StringComparison.Ordinal)))
+                && !string.Equals(named, SpelunkTunnelProtocol.SubProtocol, StringComparison.Ordinal))
+            || (signingIn && ticket.User is { } user && !IsAccountName(user)))
         {
             throw new SpelunkTunnelException(Unintelligible);
         }
@@ -412,6 +467,18 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
     private static bool IsBase64UrlCharacter(char character) =>
         char.IsAsciiLetterOrDigit(character) || character is '-' or '_';
 
+    /// <summary>
+    /// Whether the account Spelunk named is one an SSH login could be for: a short run of the characters
+    /// Unix account names are made of.
+    /// </summary>
+    /// <remarks>
+    /// Checked because it goes to the server as the login and onto the tab and the status line, and an
+    /// answer carrying anything else is not one this client understands.
+    /// </remarks>
+    private static bool IsAccountName(string user) =>
+        user.Length is > 0 and <= MaxUserLength
+        && user.All(character => char.IsAsciiLetterOrDigit(character) || character is '_' or '-' or '.');
+
     /// <summary>What a refused ticket means, in the words of the status and of Spelunk's own detail.</summary>
     private static string Describe(HttpStatusCode status, SpelunkProblemDocument? problem)
     {
@@ -419,6 +486,15 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
 
         return status switch
         {
+            // Spelunk's validation says which field and why; for a sign-in it is the public key.
+            HttpStatusCode.BadRequest =>
+                "Spelunk would not accept the request to open the tunnel"
+                + ((SpelunkTunnelRoute.Readable(PublicKeyError(problem))
+                        ?? detail
+                        ?? SpelunkTunnelRoute.Readable(problem?.Title)) is { } said
+                    ? $": {said}"
+                    : ". Update DodoSSH, or check that the API address is Spelunk's."),
+
             HttpStatusCode.Unauthorized =>
                 "Spelunk did not accept the API key. It may have been revoked or mistyped — create a new one in "
                 + "Spelunk and paste it into the credential this host uses for it.",
@@ -443,6 +519,17 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
         };
     }
 
+    /// <summary>What a validation problem says about the sign-in key, if it says anything.</summary>
+    /// <remarks>
+    /// Matched on the end of the name and without regard to case, because a validator may name the field
+    /// <c>publicKey</c>, <c>PublicKey</c> or <c>signIn.publicKey</c>, and all three mean this one.
+    /// </remarks>
+    private static string? PublicKeyError(SpelunkProblemDocument? problem) =>
+        problem?.Errors?
+            .FirstOrDefault(field => field.Key.EndsWith("publicKey", StringComparison.OrdinalIgnoreCase))
+            .Value?
+            .FirstOrDefault();
+
     /// <summary>Reads an RFC 7807 body if there is one; null when there is not, or it will not parse.</summary>
     private static async Task<SpelunkProblemDocument?> ReadProblemAsync(
         HttpResponseMessage response,
@@ -520,9 +607,21 @@ public sealed class SpelunkTunnel : ISpelunkTunnel
 }
 
 /// <summary>The body of a ticket request.</summary>
+/// <remarks>
+/// Either a port or a sign-in, never both: the one not asked for is null and left out of the JSON, so a plain
+/// tunnel still asks for exactly <c>{"port":22}</c>.
+/// </remarks>
 internal sealed class SpelunkTicketRequestDocument
 {
-    public int Port { get; set; }
+    public int? Port { get; set; }
+
+    public SpelunkSignInRequestDocument? SignIn { get; set; }
+}
+
+/// <summary>What a sign-in sends: the one-line OpenSSH public key the agent's SSH server is to accept.</summary>
+internal sealed class SpelunkSignInRequestDocument
+{
+    public string? PublicKey { get; set; }
 }
 
 /// <summary>A ticket as Spelunk returns it. Nullable because it models untrusted input.</summary>
@@ -535,19 +634,26 @@ internal sealed class SpelunkTicketDocument
     public string? Path { get; set; }
 
     public string? Subprotocol { get; set; }
+
+    /// <summary>The account a sign-in logs in as; absent or null for a plain tunnel.</summary>
+    public string? User { get; set; }
 }
 
-/// <summary>The two fields of an RFC 7807 problem this client repeats.</summary>
+/// <summary>The fields of an RFC 7807 problem this client repeats.</summary>
 internal sealed class SpelunkProblemDocument
 {
     public string? Title { get; set; }
 
     public string? Detail { get; set; }
+
+    /// <summary>A validation problem's messages by field, as ASP.NET Core writes them.</summary>
+    public Dictionary<string, string[]>? Errors { get; set; }
 }
 
 [JsonSourceGenerationOptions(
     PropertyNamingPolicy = JsonKnownNamingPolicy.CamelCase,
     PropertyNameCaseInsensitive = true,
+    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
     UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip)]
 [JsonSerializable(typeof(SpelunkTicketRequestDocument))]
 [JsonSerializable(typeof(SpelunkTicketDocument))]

src/DodoSSH.Client.Session/VaultSession.cs

@@ -125,6 +125,7 @@ public sealed partial class VaultSession : IAsyncDisposable
         Tags = new TagRepository(Items, Outbox, keyring, activity);
         Snippets = new SnippetRepository(Items, Outbox, keyring, activity);
         ObjectStores = new ObjectStoreRepository(Items, Outbox, keyring, activity);
+        SpelunkKeys = new SpelunkKeyRepository(Items, Outbox, keyring, activity);
     }
 
     /// <summary>Who this session belongs to, and the material that unlocked it.</summary>
@@ -200,6 +201,13 @@ public sealed partial class VaultSession : IAsyncDisposable
     /// </remarks>
     public ObjectStoreRepository ObjectStores { get; }
 
+    /// <summary>Spelunk API keys and the addresses they may be sent to, decrypted.</summary>
+    /// <remarks>
+    /// Read with the rest of the vault, and at connect from that list, as a credential's password is. The
+    /// address in each is what lets a link from Spelunk connect without asking.
+    /// </remarks>
+    public SpelunkKeyRepository SpelunkKeys { get; }
+
     /// <summary>The connections this vault has recorded, decrypted.</summary>
     /// <remarks>
     /// Written through <see cref="ConnectionRecorder"/> rather than directly by anything that connects. An

src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.Spelunk.cs

@@ -15,8 +15,8 @@ internal sealed partial class MainWindowViewModel
     /// Called by the head, on the UI thread, for a link this launch was started with, a link a second launch
     /// passed down the doorbell, or one the platform delivered to the running application. The link has
     /// already been checked by <see cref="SpelunkLink.TryParse"/>; what it may do is decided by
-    /// <see cref="VaultViewModel.OpenSpelunkLinkAsync"/>, which never connects to a host the user has not
-    /// saved.
+    /// <see cref="VaultViewModel.OpenSpelunkLinkAsync"/>, which never sends an API key to a Spelunk no saved
+    /// host already sends it to.
     /// </para>
     /// <para>
     /// <b>A locked application keeps it rather than dropping it.</b> Clicking a server in Spelunk and being

src/DodoSSH.Client.Shell/ViewModels/TransfersViewModel.cs

@@ -1158,7 +1158,8 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     internal bool SelectedHostAsksForAPassword =>
         ShowsHostPicker
         && (SelectedHost is null
-            || SelectedHost.Resolved.Binding.Kind is ResolvedBindingKind.TypedPassword);
+            || (!SelectedHost.Host.SignsInThroughSpelunk
+                && SelectedHost.Resolved.Binding.Kind is ResolvedBindingKind.TypedPassword));
 
     // ---- The remote pane ----
 
@@ -1796,14 +1797,14 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
                 await CloseSessionAsync().ConfigureAwait(true);
 
                 if (await OpenHostSessionAsync(open, row, request, cancellationToken).ConfigureAwait(true)
-                    is not { } opened)
+                    is not ({ } opened, { } dialled))
                 {
                     return;
                 }
 
                 session = opened;
                 TypedPassword = string.Empty;
-                MarkHostConnected(opened, request, row, identityLabel);
+                MarkHostConnected(opened, dialled, row, identityLabel);
 
                 reconnectTo = (RemoteKind.Host, row.EntityId);
 
@@ -1818,8 +1819,12 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     /// <summary>
     /// Opens the session on a host, through the relay or Spelunk when the host uses one, or says why not.
     /// </summary>
-    /// <returns>The session, or null with <see cref="Status"/> saying why there is none.</returns>
-    private async Task<ISftpSession?> OpenHostSessionAsync(
+    /// <returns>
+    /// The session and the request it was opened with — which, for a Spelunk sign-in, carries the account
+    /// Spelunk named rather than the one the host resolved to — or null with <see cref="Status"/> saying why
+    /// there is none.
+    /// </returns>
+    private async Task<(ISftpSession Session, SshConnectionRequest Request)?> OpenHostSessionAsync(
         VaultViewModel open,
         HostRowViewModel row,
         SshConnectionRequest request,
@@ -1833,9 +1838,9 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             // The session owns the route from here, on success and on failure alike.
             route = await open.OpenRouteAsync(row, cancellationToken).ConfigureAwait(true);
 
-            return await sftp
-                .OpenSftpAsync(route is null ? request : request with { Proxy = route.Proxy }, cancellationToken)
-                .ConfigureAwait(true);
+            var through = VaultViewModel.Through(request, route);
+
+            return (await sftp.OpenSftpAsync(through, cancellationToken).ConfigureAwait(true), through);
         }
         catch (Exception exception)
             when (route?.Failure is { } failure

src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.Spelunk.cs

@@ -2,6 +2,7 @@ using System.Collections.ObjectModel;
 using CommunityToolkit.Mvvm.ComponentModel;
 using DodoSSH.Client.Domain;
 using DodoSSH.Client.Session;
+using DodoSSH.Client.Ssh;
 
 namespace DodoSSH.Client.Shell.ViewModels;
 
@@ -16,6 +17,15 @@ namespace DodoSSH.Client.Shell.ViewModels;
 /// </remarks>
 internal sealed partial class VaultViewModel
 {
+    /// <summary>The tag every host made from a Spelunk link wears, and what a link looks for.</summary>
+    /// <remarks>
+    /// Matched without regard to case, as the editor matches every tag name — see <c>AddEditorTagAsync</c>.
+    /// </remarks>
+    internal const string SpelunkTag = "spelunk";
+
+    /// <summary>What the status bar and the log name as the identity of a Spelunk sign-in.</summary>
+    private const string SpelunkSignInIdentity = "Spelunk sign-in";
+
     /// <summary>What opens a tunnel when no caller supplied something else.</summary>
     /// <remarks>
     /// Static and shared for the reason <see cref="DefaultReachability"/> is: it holds nothing but a
@@ -32,8 +42,18 @@ internal sealed partial class VaultViewModel
     /// fact what these two boxes can simply not express.
     /// </remarks>
     [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(EditorAsksForLogin))]
     private bool editorThroughSpelunk;
 
+    /// <summary>Whether Spelunk signs the user in to the host being edited, so it needs no login of its own.</summary>
+    /// <remarks>
+    /// Inside the Spelunk card, and meaningful only while that is ticked. See
+    /// <see cref="SpelunkRoute.SignInThroughSpelunk"/>.
+    /// </remarks>
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(EditorAsksForLogin))]
+    private bool editorSpelunkSignIn;
+
     /// <summary>The Spelunk API address in the editor, as typed.</summary>
     [ObservableProperty]
     private string editorSpelunkApi = string.Empty;
@@ -42,11 +62,11 @@ internal sealed partial class VaultViewModel
     [ObservableProperty]
     private string editorSpelunkServerId = string.Empty;
 
-    /// <summary>The credentials the editor offers as the Spelunk API key.</summary>
+    /// <summary>What the editor offers as the Spelunk API key: saved Spelunk keys, then credentials.</summary>
     /// <remarks>
-    /// Credentials only, and no "none" entry: a route with no key cannot be opened, and nothing selected is
-    /// how a host made from a link says it has not been chosen yet. A key the host names that has since been
-    /// deleted keeps a placeholder, for the reason <see cref="BuildAuthenticationChoices"/> keeps one.
+    /// No "none" entry: a route with no key cannot be opened, and nothing selected is how a host made from a
+    /// link says it has not been chosen yet. A key the host names that has since been deleted keeps a
+    /// placeholder, for the reason <see cref="BuildAuthenticationChoices"/> keeps one.
     /// </remarks>
     internal ObservableCollection<AuthenticationChoice> EditorSpelunkKeyChoices { get; } = [];
 
@@ -54,6 +74,16 @@ internal sealed partial class VaultViewModel
     [ObservableProperty]
     private AuthenticationChoice? editorSelectedSpelunkKey;
 
+    /// <summary>
+    /// Whether the editor's username and login choice mean anything — false for a host Spelunk signs in to.
+    /// </summary>
+    /// <remarks>
+    /// The two controls are disabled rather than hidden while it is false, with a sentence saying why, so a
+    /// login somebody had chosen is still there to see — and comes back as it was if the box is unticked
+    /// before saving.
+    /// </remarks>
+    internal bool EditorAsksForLogin => !(EditorThroughSpelunk && EditorSpelunkSignIn);
+
     /// <inheritdoc cref="DefaultSpelunk" />
     private ISpelunkTunnel Spelunk => spelunk ?? DefaultSpelunk;
 
@@ -87,6 +117,10 @@ internal sealed partial class VaultViewModel
     /// <see cref="OpenRelayAsync"/> for the relay's half of that argument; Spelunk's is stronger still,
     /// because a Spelunk host's address may be nothing that answers at all.
     /// </para>
+    /// <para>
+    /// The request a route is used for is made with <see cref="Through"/>, which is where a Spelunk sign-in's
+    /// key and account replace the ones the host resolved to.
+    /// </para>
     /// </remarks>
     internal async Task<IConnectionRoute?> OpenRouteAsync(HostRowViewModel row, CancellationToken cancellationToken)
     {
@@ -103,33 +137,73 @@ internal sealed partial class VaultViewModel
     }
 
     /// <summary>
-    /// Opens a Spelunk tunnel to a host, with the key its credential holds.
+    /// The request to connect with once a route is open: through its proxy, and for a Spelunk sign-in, with
+    /// the key the tunnel was opened with and the account Spelunk named.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Both transports make their request through this, so a sign-in cannot reach one of them with the
+    /// stand-in credential <see cref="TryBuildAuthentication"/> gives it — which the SSH layer would refuse
+    /// before dialling anyway. See <see cref="SpelunkSignInPending"/>.
+    /// </para>
+    /// <para>
+    /// The host and port are left alone. The host key is pinned under them as for every host, and Spelunk's
+    /// SSH server presents the server's real host key, so a sign-in and a plain tunnel to one server are
+    /// checked against the same pin.
+    /// </para>
+    /// </remarks>
+    internal static SshConnectionRequest Through(SshConnectionRequest request, IConnectionRoute? route)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+
+        return route switch
+        {
+            null => request,
+            SpelunkTunnelRoute { SignIn: { } signIn, User: { } user } => request with
+            {
+                Proxy = route.Proxy,
+                Username = user,
+                Credential = signIn.Credential,
+            },
+            _ => request with { Proxy = route.Proxy },
+        };
+    }
+
+    /// <summary>
+    /// Opens a Spelunk tunnel to a host, with the key it names.
     /// </summary>
     /// <remarks>
     /// <para>
     /// The key is read from the keychain at the moment of connecting, like every other secret the connect
-    /// path uses, and goes only to the API address the host names. A credential that has gone is refused in
-    /// words, exactly as a missing SSH credential is — see <see cref="TryBuildAuthentication"/>.
+    /// path uses, and goes only to the API address the host names — and for a saved Spelunk key, only when
+    /// that is the address it was saved for. See <see cref="SpelunkApiKeyFor"/>.
     /// </para>
     /// <para>
     /// The port is the host's resolved one, group and all: it is the port the agent connects to on the
     /// server's own loopback, which is where the SSH server listens whatever address the world sees.
     /// </para>
+    /// <para>
+    /// <b>A host Spelunk signs in to gets a new key pair here, every time.</b> It is made in memory for this
+    /// one tunnel, its public half goes with the ticket request, and the route carries it to the connection —
+    /// see <see cref="SpelunkSignIn"/>. A retry after a host key question, or a reconnect, comes back through
+    /// here and makes another.
+    /// </para>
     /// </remarks>
     private async Task<IConnectionRoute> OpenSpelunkTunnelAsync(
         HostRowViewModel row,
         SpelunkRoute route,
         CancellationToken cancellationToken)
     {
-        if (Credentials.FirstOrDefault(credential => credential.EntityId == route.ApiKeyCredentialId) is not { } key)
-        {
-            throw new SpelunkTunnelException(
-                $"'{row.Label}' is reached through Spelunk with an API key credential that is not in this "
-                + "keychain any more. Edit the host to choose another one.");
-        }
+        var apiKey = SpelunkApiKeyFor(row, route);
 
         return await Spelunk
-            .OpenAsync(route.ApiBase, route.ServerId, key.Credential.Password, row.Resolved.Port.Value, cancellationToken)
+            .OpenAsync(
+                route.ApiBase,
+                route.ServerId,
+                apiKey,
+                row.Resolved.Port.Value,
+                route.SignInThroughSpelunk ? SpelunkSignIn.Create() : null,
+                cancellationToken)
             .ConfigureAwait(true);
     }
 
@@ -137,66 +211,253 @@ internal sealed partial class VaultViewModel
     /// Does what a <c>dodossh://spelunk/connect</c> link asks, as far as it is allowed to.
     /// </summary>
     /// <returns>
-    /// The connection attempt when a saved host was found, so a caller that wants to can wait for it; a
-    /// completed task otherwise.
+    /// The work the link started, connection attempt included, so a caller that wants to can wait for it.
     /// </returns>
     /// <remarks>
     /// <para>
-    /// <b>A saved host for that server on that Spelunk is connected to</b>, exactly as a tap on its row
-    /// would — a password prompt if it asks for one, a host key question if it has not been seen.
+    /// <b>A host for that server in the personal vault, tagged <see cref="SpelunkTag"/>, is connected to</b>,
+    /// exactly as a tap on its row would. Those are the hosts links make, and the only ones a link looks for:
+    /// a host somebody set up by hand, or one in a team's vault, is theirs to connect to and not the link's.
     /// </para>
     /// <para>
-    /// <b>Otherwise the editor opens on a new host, and nothing more.</b> The link came from outside, and
-    /// anything on this machine can make one; it must never be able to make this application connect
-    /// somewhere, or send an API key somewhere, that the user has not looked at and saved. So the host is
-    /// pre-filled — the name, the address its key will be pinned under, the Spelunk and the server — and
-    /// the user chooses how to log in and which credential holds the key, and presses SAVE.
+    /// <b>Otherwise, when that Spelunk already gets an API key, the host is made and connected to.</b> In the
+    /// personal vault, tagged, named as the link names it, and signing in through Spelunk — so it needs no
+    /// SSH key or password — with the key saved for that Spelunk under Settings → Security, or else the key
+    /// credential a saved host already sends there. It is saved the ordinary way and syncs like any host.
+    /// Nothing leaks by this: the key goes where the user already said it goes, and the server is one that
+    /// key's own organisation holds or Spelunk refuses it.
     /// </para>
     /// <para>
-    /// <b>The key is pre-chosen only when another host already sends it to the same Spelunk.</b> That is a
-    /// convenience that cannot leak anything — the key already goes there — whereas guessing a key for a
-    /// Spelunk no host uses would be offering to send it to whatever address the link named.
+    /// <b>The first link from a Spelunk with no key opens the editor instead, and nothing more.</b> Anything
+    /// on this machine can make a link, so it must never be able to send an API key to an address the user
+    /// has not sent it to. The host is pre-filled — signing in through Spelunk, tagged, in the personal
+    /// vault — and the user chooses the key and saves; every later link from that Spelunk connects straight
+    /// away.
     /// </para>
     /// </remarks>
-    internal Task OpenSpelunkLinkAsync(SpelunkLink link)
+    internal async Task OpenSpelunkLinkAsync(SpelunkLink link)
     {
         ArgumentNullException.ThrowIfNull(link);
 
-        if (Hosts.FirstOrDefault(row => row.Host.Spelunk?.IsFor(link.ApiBase, link.ServerId) is true) is { } saved)
+        var personal = PersonalVaultId();
+
+        if (personal is { } vaultId
+            && Hosts.FirstOrDefault(row =>
+                row.VaultId == vaultId
+                && row.Host.Spelunk?.IsFor(link.ApiBase, link.ServerId) is true
+                && WearsSpelunkTag(row.Host)) is { } saved)
         {
-            return ConnectToRowCommand.ExecuteAsync(saved);
+            await ConnectToRowCommand.ExecuteAsync(saved).ConfigureAwait(true);
+            return;
         }
 
+        var knownKey = KnownSpelunkKey(link.ApiBase, personal);
+
+        if (personal is { } into && knownKey is { } key)
+        {
+            await AddFromLinkAndConnectAsync(link, into, key).ConfigureAwait(true);
+            return;
+        }
+
+        await OpenLinkInEditorAsync(link, personal, knownKey).ConfigureAwait(true);
+    }
+
+    /// <summary>The personal vault, when this session can read and write it.</summary>
+    private Guid? PersonalVaultId() =>
+        session.ReadableVaults.FirstOrDefault(vault => vault.IsPersonal && vault.CanWrite)?.VaultId;
+
+    /// <summary>Whether a host wears a tag called <see cref="SpelunkTag"/>, from whichever vault.</summary>
+    private bool WearsSpelunkTag(HostSecret host) =>
+        host.TagIds.Any(id => tagsById.TryGetValue(id, out var tag) && IsSpelunkTag(tag));
+
+    private static bool IsSpelunkTag(TagSecret tag) =>
+        string.Equals(tag.Label.Trim(), SpelunkTag, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// The key the user has already agreed may go to this Spelunk, or null when there is none.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// A Spelunk key saved for that address first — it is the one thing that says so in as many words — and
+    /// otherwise the key a saved host already sends there, which is how the answer was reached before saved
+    /// keys existed and is still true of every host set up that way.
+    /// </para>
+    /// <para>
+    /// The personal vault's first, so the answer does not depend on the order vaults happen to load in; and
+    /// only a key still in the keychain, because a dangling one would make a host that cannot connect.
+    /// </para>
+    /// </remarks>
+    private Guid? KnownSpelunkKey(string apiBase, Guid? personal) =>
+        SavedSpelunkKeyFor(apiBase, personal)?.EntityId
+        ?? Hosts
+            .OrderByDescending(row => row.VaultId == personal)
+            .Select(row => row.Host.Spelunk)
+            .Where(route => route is not null && string.Equals(route.ApiBase, apiBase, StringComparison.Ordinal))
+            .Select(route => (Guid?)route!.ApiKeyCredentialId)
+            .FirstOrDefault(id =>
+                Credentials.Any(credential => credential.EntityId == id)
+                || SpelunkKeys.Any(key => key.EntityId == id && string.Equals(key.ApiBase, apiBase, StringComparison.Ordinal)));
+
+    /// <summary>The host a link makes: what the link says, signing in through Spelunk with a known key.</summary>
+    private static HostSecret HostFromLink(SpelunkLink link, Guid apiKeyCredentialId, TagSet tags) => new()
+    {
+        Label = link.Name,
+        Hostname = link.Hostname,
+        Port = HostSecret.DefaultPort,
+        TagIds = tags,
+        Spelunk = new SpelunkRoute
+        {
+            ApiBase = link.ApiBase,
+            ServerId = link.ServerId,
+            ApiKeyCredentialId = apiKeyCredentialId,
+            SignInThroughSpelunk = true,
+        },
+    };
+
+    /// <summary>Saves the host a link describes into the personal vault, tagged, and connects to it.</summary>
+    private async Task AddFromLinkAndConnectAsync(SpelunkLink link, Guid vaultId, Guid apiKeyCredentialId)
+    {
+        if (IsBusy)
+        {
+            // RunAsync would drop it without a word, and the user pressed a button somewhere else to get here.
+            Status = $"Busy — open {link.Name} from Spelunk again in a moment.";
+            return;
+        }
+
+        Guid? hostId = null;
+
+        await RunAsync(
+            $"Adding {link.Name} from Spelunk…",
+            async () =>
+            {
+                var tagId = await EnsureSpelunkTagAsync(vaultId, CancellationToken.None).ConfigureAwait(true);
+
+                hostId = await session.Hosts
+                    .CreateAsync(
+                        vaultId,
+                        HostFromLink(link, apiKeyCredentialId, TagSet.Create([tagId])),
+                        CancellationToken.None)
+                    .ConfigureAwait(true);
+
+                await ReloadAsync(CancellationToken.None).ConfigureAwait(true);
+            }).ConfigureAwait(true);
+
+        // A failure has said so on the status line already.
+        if (hostId is not { } id || Hosts.FirstOrDefault(row => row.EntityId == id) is not { } row)
+        {
+            return;
+        }
+
+        Status = $"Added {link.Name} from Spelunk at {link.ApiBase}.";
+
+        await ConnectToRowCommand.ExecuteAsync(row).ConfigureAwait(true);
+
+        // After the connect rather than before it: the host is saved either way, and the terminal is what the
+        // user is waiting for. As SaveHostAsync does, it goes to the server now rather than at the next tick.
+        await AutoSyncAsync(CancellationToken.None).ConfigureAwait(true);
+    }
+
+    /// <summary>
+    /// Opens the editor on a new host from a link, for the first link from a Spelunk no host sends a key to.
+    /// </summary>
+    /// <remarks>
+    /// Opened before anything is awaited, so the editor is up in the same turn the link arrived in. The tag is
+    /// made or found afterwards and added to the host being edited; a tag made for a host that is then
+    /// cancelled stays, as the editor's own new-tag box leaves it.
+    /// </remarks>
+    private async Task OpenLinkInEditorAsync(SpelunkLink link, Guid? personal, Guid? knownKey)
+    {
         // Refused while another host is half-edited, as NewHost refuses it, and said the same way: the link
         // is not worth somebody's unsaved host.
         if (AHostEditorIsInTheWay())
         {
-            return Task.CompletedTask;
+            return;
         }
 
         NewHost();
 
+        if (personal is { } vaultId
+            && EditorVaultChoices.FirstOrDefault(choice => choice.VaultId == vaultId) is { } choice)
+        {
+            EditorSelectedVault = choice;
+        }
+
         EditorLabel = link.Name;
         EditorHostname = link.Hostname;
         EditorPort = HostSecret.DefaultPort;
         EditorThroughSpelunk = true;
+        EditorSpelunkSignIn = true;
         EditorSpelunkApi = link.ApiBase;
         EditorSpelunkServerId = link.ServerId.ToString();
 
-        var knownKey = Hosts
-            .Select(row => row.Host.Spelunk)
-            .FirstOrDefault(route => route is not null && string.Equals(route.ApiBase, link.ApiBase, StringComparison.Ordinal))
-            ?.ApiKeyCredentialId;
-
-        BuildSpelunkKeyChoices(Credentials.Any(credential => credential.EntityId == knownKey) ? knownKey : null);
+        BuildSpelunkKeyChoices(knownKey);
 
         IsHostPaneOpen = true;
-        Status = EditorSelectedSpelunkKey is null
-            ? $"Adding {link.Name} from Spelunk at {link.ApiBase}. Choose how to log in and the credential "
-                + "holding your Spelunk API key, then save."
-            : $"Adding {link.Name} from Spelunk at {link.ApiBase}. Choose how to log in, then save.";
 
-        return Task.CompletedTask;
+        var said = EditorSelectedSpelunkKey is null
+            ? $"Adding {link.Name}, the first server from Spelunk at {link.ApiBase}. Choose your Spelunk API "
+                + "key and save — Spelunk signs you in, so no SSH key is needed, and later links from this "
+                + "Spelunk connect straight away. Saving the key under Settings → Security does the same."
+            : $"Adding {link.Name} from Spelunk at {link.ApiBase}. Check it and save.";
+
+        Status = said;
+
+        if (personal is { } into)
+        {
+            await TagHostFromLinkAsync(into, said).ConfigureAwait(true);
+        }
+    }
+
+    /// <summary>Adds the <see cref="SpelunkTag"/> tag to the host a link opened the editor on.</summary>
+    /// <param name="vaultId">The personal vault, where the host is to be saved and the tag is.</param>
+    /// <param name="said">What the status line says about the link, put back after the reload.</param>
+    private async Task TagHostFromLinkAsync(Guid vaultId, string said)
+    {
+        try
+        {
+            var tagId = await EnsureSpelunkTagAsync(vaultId, CancellationToken.None).ConfigureAwait(true);
+
+            // Only onto the host this link opened: the user may have cancelled it, or moved on to another, in
+            // the moment the tag took.
+            if (!IsEditing || editingEntityId is not null || editingHostVaultId != vaultId)
+            {
+                return;
+            }
+
+            editorTagIds = TagSet.Create([.. editorTagIds, tagId]);
+
+            if (!tagsById.ContainsKey(tagId))
+            {
+                await ReloadAsync(CancellationToken.None).ConfigureAwait(true);
+            }
+
+            BuildTagChoices();
+            Status = said;
+        }
+        catch (Exception exception) when (exception is not OutOfMemoryException)
+        {
+            // The host can still be saved; it is the tag that could not be made, and a later link would then
+            // not find it. Said, rather than failing the whole link over it.
+            Status = $"{said} (The '{SpelunkTag}' tag could not be added: {exception.Message})";
+        }
+    }
+
+    /// <summary>The <see cref="SpelunkTag"/> tag in a vault, made there if it has none.</summary>
+    private async Task<Guid> EnsureSpelunkTagAsync(Guid vaultId, CancellationToken cancellationToken)
+    {
+        var listing = await session.Tags.ListAsync(vaultId, cancellationToken).ConfigureAwait(true);
+
+        if (listing.Items
+            .Where(tag => IsSpelunkTag(tag.Secret))
+            .OrderBy(tag => tag.EntityId)
+            .FirstOrDefault() is { } existing)
+        {
+            return existing.EntityId;
+        }
+
+        return await session.Tags
+            .CreateAsync(vaultId, new TagSecret { Label = SpelunkTag }, cancellationToken)
+            .ConfigureAwait(true);
     }
 
     /// <summary>
@@ -207,15 +468,20 @@ internal sealed partial class VaultViewModel
     /// The one question the deletion warning, the table's USED BY column and the detail pane's list all ask,
     /// so a credential that is only somebody's Spelunk key is not deleted as though nothing used it. Spelunk
     /// keys are named by the host itself and never inherited, so the stored route is the whole answer there.
+    /// A host Spelunk signs in to uses no binding at all, whatever its group lends.
     /// </remarks>
     private static bool Uses(HostRowViewModel row, ResolvedBindingKind kind, Guid entityId) =>
-        (row.Resolved.Binding is { } binding && binding.Kind == kind && binding.EntityId == entityId)
+        (!row.Host.SignsInThroughSpelunk
+            && row.Resolved.Binding is { } binding
+            && binding.Kind == kind
+            && binding.EntityId == entityId)
         || (kind is ResolvedBindingKind.Credential && row.Host.Spelunk?.ApiKeyCredentialId == entityId);
 
     /// <summary>Puts a host's route into the editor, or clears it for a host that has none.</summary>
     private void LoadEditorSpelunk(SpelunkRoute? route)
     {
         EditorThroughSpelunk = route is not null;
+        EditorSpelunkSignIn = route?.SignInThroughSpelunk ?? false;
         EditorSpelunkApi = route?.ApiBase ?? string.Empty;
         EditorSpelunkServerId = route?.ServerId.ToString() ?? string.Empty;
 
@@ -223,10 +489,20 @@ internal sealed partial class VaultViewModel
     }
 
     /// <summary>Fills the API key picker, keeping whatever the host names selectable.</summary>
+    /// <remarks>
+    /// Saved Spelunk keys first, named for where they go, because that is the choice the Security page made
+    /// for exactly this; then every credential, for a key kept as a password before saved keys existed.
+    /// </remarks>
     private void BuildSpelunkKeyChoices(Guid? selectedId)
     {
         EditorSpelunkKeyChoices.Clear();
 
+        foreach (var key in SpelunkKeys)
+        {
+            EditorSpelunkKeyChoices.Add(new AuthenticationChoice(
+                AuthenticationKind.Credential, key.EntityId, key.Label, $"Spelunk key · {key.ApiBase}"));
+        }
+
         foreach (var credential in Credentials)
         {
             EditorSpelunkKeyChoices.Add(AuthenticationChoice.ForCredential(credential.EntityId, credential.Label));
@@ -261,6 +537,7 @@ internal sealed partial class VaultViewModel
                 : EditorSpelunkApi.Trim(),
             ServerId = Guid.TryParse(EditorSpelunkServerId.Trim(), out var serverId) ? serverId : Guid.Empty,
             ApiKeyCredentialId = EditorSelectedSpelunkKey?.EntityId ?? Guid.Empty,
+            SignInThroughSpelunk = EditorSpelunkSignIn,
         };
     }
 }

src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.SpelunkKeys.cs

@@ -0,0 +1,374 @@
+using System.Collections.ObjectModel;
+using System.Diagnostics.CodeAnalysis;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using DodoSSH.Client.Domain;
+using DodoSSH.Client.Session;
+using DodoSSH.Client.Sync;
+
+namespace DodoSSH.Client.Shell.ViewModels;
+
+/// <summary>One saved Spelunk key, as a row on the Security page.</summary>
+/// <remarks>
+/// Carries the decrypted key so the connect path needs no second decryption, and — as the credential row does
+/// — exposes nothing of it to the view: the XAML binds the name, the address and a count.
+/// </remarks>
+internal sealed class SpelunkKeyRowViewModel(VaultItem<SpelunkKeySecret> key, Guid vaultId, string vaultName)
+{
+    internal Guid EntityId => key.EntityId;
+
+    internal Guid VaultId { get; } = vaultId;
+
+    internal string VaultName { get; } = vaultName;
+
+    internal SpelunkKeySecret Key => key.Secret;
+
+    internal string Label => key.Secret.Label;
+
+    /// <summary>The one address this key is ever sent to.</summary>
+    internal string ApiBase => key.Secret.ApiBase;
+
+    /// <summary>The vault's name, when there is more than one to tell apart; empty otherwise.</summary>
+    internal string VaultBadge { get; init; } = string.Empty;
+
+    internal bool HasVaultBadge => VaultBadge.Length > 0;
+
+    /// <summary>How many hosts reach Spelunk with this key, in words.</summary>
+    internal string UsedBy { get; init; } = string.Empty;
+
+    internal bool IsReadOnly => key.IsReadOnly;
+
+    internal string Badge => ItemBadge.For(key.IsBlocked, key.IsReadOnly, key.HasUnsyncedChanges);
+}
+
+/// <summary>
+/// Spelunk keys: filling one in on the Security page, and what a saved one lets a host and a link do.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>A saved key says where it may go.</b> It is an API key and the one Spelunk address it belongs to, kept
+/// in the keychain and synced like any secret. A host can name it where it would name a credential, and it is
+/// then sent to that address and never to another — see <see cref="SpelunkApiKeyFor"/>. A link from that
+/// Spelunk connects straight away, because saving the key is the user saying so — see
+/// <see cref="KnownSpelunkKey"/>.
+/// </para>
+/// <para>
+/// The form saves into the personal vault, and a second key for an address the personal vault already has a
+/// key for replaces that key rather than adding a rival: one Spelunk, one key, which is also what makes the
+/// answer to "which key does a link use?" not depend on anything the user cannot see.
+/// </para>
+/// </remarks>
+internal sealed partial class VaultViewModel
+{
+    /// <summary>Every Spelunk key this session can read, the personal vault's first.</summary>
+    internal ObservableCollection<SpelunkKeyRowViewModel> SpelunkKeys { get; } = [];
+
+    /// <summary>Whether there is any saved key to list.</summary>
+    internal bool HasSpelunkKeys => SpelunkKeys.Count > 0;
+
+    /// <summary>The Spelunk API address in the Security page's form, as typed.</summary>
+    [ObservableProperty]
+    private string spelunkKeyFormApi = string.Empty;
+
+    /// <summary>The API key in the Security page's form, as pasted. Cleared the moment it is saved.</summary>
+    [ObservableProperty]
+    private string spelunkKeyFormKey = string.Empty;
+
+    /// <summary>What the form has to say about the last save, or empty.</summary>
+    /// <remarks>
+    /// Beside the form rather than only on the status line, because the Security page is a long way from the
+    /// status bar and a refusal nobody sees reads as a button that does nothing.
+    /// </remarks>
+    [ObservableProperty]
+    private string spelunkKeyFormNote = string.Empty;
+
+    /// <summary>Whether <see cref="SpelunkKeyFormNote"/> has anything in it.</summary>
+    internal bool HasSpelunkKeyFormNote => SpelunkKeyFormNote.Length > 0;
+
+    partial void OnSpelunkKeyFormNoteChanged(string value) => OnPropertyChanged(nameof(HasSpelunkKeyFormNote));
+
+    /// <summary>
+    /// Picks the saved key for the address being typed, when nothing is chosen yet.
+    /// </summary>
+    /// <remarks>
+    /// Only into an empty choice: a key somebody picked is theirs, and replacing it because they edited the
+    /// address would be choosing for them.
+    /// </remarks>
+    partial void OnEditorSpelunkApiChanged(string value)
+    {
+        if (EditorSelectedSpelunkKey is not null
+            || !SpelunkRoute.TryNormalizeApiBase(value, out var apiBase, out _)
+            || SavedSpelunkKeyFor(apiBase, PersonalVaultId()) is not { } saved)
+        {
+            return;
+        }
+
+        EditorSelectedSpelunkKey = EditorSpelunkKeyChoices.FirstOrDefault(choice => choice.EntityId == saved.EntityId);
+    }
+
+    /// <summary>Saves the key in the form for the address in the form.</summary>
+    [RelayCommand]
+    private async Task SaveSpelunkKeyAsync(CancellationToken cancellationToken)
+    {
+        if (!TryReadSpelunkKeyForm(out var vaultId, out var existing, out var key))
+        {
+            return;
+        }
+
+        var apiBase = key.ApiBase;
+
+        SpelunkKeyFormNote = string.Empty;
+
+        await RunAsync(
+            "Saving the Spelunk key…",
+            async () =>
+            {
+                if (existing is not null)
+                {
+                    await session.SpelunkKeys
+                        .UpdateAsync(vaultId, existing.EntityId, key, cancellationToken)
+                        .ConfigureAwait(true);
+                }
+                else
+                {
+                    await session.SpelunkKeys.CreateAsync(vaultId, key, cancellationToken).ConfigureAwait(true);
+                }
+
+                // The key leaves the form as soon as it is in the keychain; the address stays, as a reminder
+                // of what was just saved.
+                SpelunkKeyFormKey = string.Empty;
+                SpelunkKeyFormApi = apiBase;
+
+                await ReloadAsync(cancellationToken).ConfigureAwait(true);
+
+                var said = existing is null
+                    ? $"Saved the Spelunk key for {apiBase}. Links from that Spelunk now connect straight away."
+                    : $"Replaced the Spelunk key for {apiBase}. Every host using it connects with the new one.";
+
+                Status = connection() is null ? $"{said} It will sync when you are online." : said;
+                SpelunkKeyFormNote = said;
+            }).ConfigureAwait(true);
+
+        await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
+    }
+
+    /// <summary>
+    /// Reads the form into the key it would save, and where; or says on the form why it cannot.
+    /// </summary>
+    /// <param name="vaultId">The vault the key goes into: the personal one, when there is one.</param>
+    /// <param name="existing">The key already saved there for that address, which this one replaces.</param>
+    /// <param name="key">The key to save, keeping the existing one's name.</param>
+    private bool TryReadSpelunkKeyForm(
+        out Guid vaultId,
+        out SpelunkKeyRowViewModel? existing,
+        [NotNullWhen(true)] out SpelunkKeySecret? key)
+    {
+        vaultId = Guid.Empty;
+        existing = null;
+        key = null;
+
+        if (!SpelunkRoute.TryNormalizeApiBase(SpelunkKeyFormApi, out var apiBase, out var reason))
+        {
+            SpelunkKeyFormNote = reason;
+            return false;
+        }
+
+        if ((PersonalVaultId() ?? WritableActiveVault()) is not { } target)
+        {
+            SpelunkKeyFormNote = "There is no vault here this account can write to, so the key cannot be saved.";
+            return false;
+        }
+
+        vaultId = target;
+        existing = SpelunkKeys.FirstOrDefault(row =>
+            row.VaultId == target && string.Equals(row.ApiBase, apiBase, StringComparison.Ordinal));
+
+        var candidate = new SpelunkKeySecret
+        {
+            Label = existing?.Label ?? SpelunkKeyLabel(apiBase),
+            ApiBase = apiBase,
+            ApiKey = SpelunkKeyFormKey.Trim(),
+        };
+
+        if (!candidate.TryValidate(out reason))
+        {
+            SpelunkKeyFormNote = reason;
+            return false;
+        }
+
+        key = candidate;
+        return true;
+    }
+
+    /// <summary>Asks whether a saved Spelunk key should go.</summary>
+    [RelayCommand]
+    private void DeleteSpelunkKeyRow(SpelunkKeyRowViewModel? row)
+    {
+        if (row is null)
+        {
+            return;
+        }
+
+        PendingDeletion = new DeletionRequest(
+            DeletionTarget.SpelunkKey,
+            row.EntityId,
+            $"Delete the Spelunk key for {row.ApiBase}?",
+            HowFarADeletionGoes("The key"),
+            HostsReachingSpelunkWith(row.EntityId));
+    }
+
+    /// <summary>Queues a tombstone for the Spelunk key that was agreed to.</summary>
+    private async Task DeleteSpelunkKeyNowAsync(Guid entityId, CancellationToken cancellationToken)
+    {
+        if (SpelunkKeys.FirstOrDefault(row => row.EntityId == entityId) is not { } row)
+        {
+            Status = "That Spelunk key is no longer here, so nothing was deleted.";
+            return;
+        }
+
+        await RunAsync(
+            "Deleting…",
+            async () =>
+            {
+                await session.SpelunkKeys
+                    .DeleteAsync(row.VaultId, row.EntityId, cancellationToken)
+                    .ConfigureAwait(true);
+
+                await ReloadAsync(cancellationToken).ConfigureAwait(true);
+                Status = $"Deleted the Spelunk key for {row.ApiBase}.";
+            }).ConfigureAwait(true);
+
+        await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
+    }
+
+    /// <returns>How many Spelunk keys would not decrypt.</returns>
+    /// <remarks>
+    /// Read after the hosts, because each row says how many of them use it.
+    /// </remarks>
+    private async Task<int> ReloadSpelunkKeysAsync(CancellationToken cancellationToken)
+    {
+        var unreadable = 0;
+        var rows = new List<SpelunkKeyRowViewModel>();
+
+        var readableVaults = session.ReadableVaults.ToList();
+        var several = readableVaults.Count > 1;
+
+        foreach (var vault in readableVaults)
+        {
+            var listing = await session.SpelunkKeys
+                .ListAsync(vault.VaultId, cancellationToken)
+                .ConfigureAwait(true);
+
+            unreadable += listing.Unreadable;
+
+            rows.AddRange(listing.Items.Select(item => new SpelunkKeyRowViewModel(item, vault.VaultId, vault.Name)
+            {
+                VaultBadge = several ? vault.Name.ToUpperInvariant() : string.Empty,
+                UsedBy = UsedBySummary(Hosts.Count(host => host.Host.Spelunk?.ApiKeyCredentialId == item.EntityId)),
+            }));
+        }
+
+        var personal = PersonalVaultId();
+
+        SpelunkKeys.Clear();
+
+        foreach (var row in rows
+            .OrderByDescending(row => row.VaultId == personal)
+            .ThenBy(row => row.VaultName, StringComparer.CurrentCulture)
+            .ThenBy(row => row.ApiBase, StringComparer.Ordinal))
+        {
+            SpelunkKeys.Add(row);
+        }
+
+        OnPropertyChanged(nameof(HasSpelunkKeys));
+
+        return unreadable;
+    }
+
+    /// <summary>
+    /// The key to send to a host's Spelunk: a saved Spelunk key's, or a credential's password.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// <b>A saved Spelunk key goes to its own address or nowhere.</b> A host naming one with a different
+    /// address — edited by hand, or merged from two devices — is refused in words rather than sending the key
+    /// to a Spelunk it was never saved for. A credential carries no address, so its password goes where the
+    /// host says, as it always has.
+    /// </para>
+    /// <para>
+    /// Either can be gone, deleted on another machine, and that is refused exactly as a missing SSH credential
+    /// is — see <see cref="TryBuildAuthentication"/>.
+    /// </para>
+    /// </remarks>
+    /// <exception cref="SpelunkTunnelException">The key cannot be sent to this host's Spelunk.</exception>
+    private string SpelunkApiKeyFor(HostRowViewModel row, SpelunkRoute route)
+    {
+        if (SpelunkKeys.FirstOrDefault(key => key.EntityId == route.ApiKeyCredentialId) is { } saved)
+        {
+            if (!string.Equals(saved.ApiBase, route.ApiBase, StringComparison.Ordinal))
+            {
+                throw new SpelunkTunnelException(
+                    $"'{row.Label}' is reached through {route.ApiBase} with the Spelunk key saved for "
+                    + $"{saved.ApiBase}, and that key is never sent anywhere else. Edit the host to choose "
+                    + "the key for its own Spelunk.");
+            }
+
+            return saved.Key.ApiKey;
+        }
+
+        if (Credentials.FirstOrDefault(credential => credential.EntityId == route.ApiKeyCredentialId) is { } credential)
+        {
+            return credential.Credential.Password;
+        }
+
+        throw new SpelunkTunnelException(
+            $"'{row.Label}' is reached through Spelunk with an API key that is not in this keychain any more. "
+            + "Edit the host to choose another one, or save the key under Settings → Security.");
+    }
+
+    /// <summary>The saved key for a Spelunk, the given vault's first, or null when none is saved.</summary>
+    private SpelunkKeyRowViewModel? SavedSpelunkKeyFor(string apiBase, Guid? preferredVault) =>
+        SpelunkKeys
+            .Where(row => string.Equals(row.ApiBase, apiBase, StringComparison.Ordinal))
+            .OrderByDescending(row => row.VaultId == preferredVault)
+            .FirstOrDefault();
+
+    /// <summary>The active vault when this session may write to it, for a session with no personal vault.</summary>
+    private Guid? WritableActiveVault() =>
+        session.ReadableVaults.FirstOrDefault(vault => vault.VaultId == session.ActiveVaultId && vault.CanWrite)
+            ?.VaultId;
+
+    /// <summary>The name a key saved from the form is given: where it goes.</summary>
+    private static string SpelunkKeyLabel(string apiBase) =>
+        Uri.TryCreate(apiBase, UriKind.Absolute, out var uri) ? $"Spelunk at {uri.Authority}" : "Spelunk";
+
+    private static string UsedBySummary(int hosts) => hosts switch
+    {
+        0 => "No host uses it yet",
+        1 => "1 host uses it",
+        _ => $"{hosts} hosts use it",
+    };
+
+    /// <summary>What the hosts that reach Spelunk with a key would be left with, or nothing when none do.</summary>
+    private string HostsReachingSpelunkWith(Guid entityId)
+    {
+        var named = Hosts
+            .Where(row => row.Host.Spelunk?.ApiKeyCredentialId == entityId)
+            .Select(row => row.Label)
+            .ToArray();
+
+        if (named.Length == 0)
+        {
+            return string.Empty;
+        }
+
+        var list = named.Length <= 3
+            ? string.Join(", ", named)
+            : $"{string.Join(", ", named.Take(3))} and {named.Length - 3} more";
+
+        return named.Length == 1
+            ? $"{list} reaches Spelunk with it, and will refuse to connect until it names another key."
+            : $"{named.Length} hosts reach Spelunk with it — {list} — and will refuse to connect until they "
+                + "name another key.";
+    }
+}

src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.cs

@@ -1343,6 +1343,9 @@ internal enum DeletionTarget
 
     /// <summary>A tag, from the vault screen.</summary>
     Tag,
+
+    /// <summary>A saved Spelunk key, from the Security page.</summary>
+    SpelunkKey,
 }
 
 /// <summary>
@@ -4308,10 +4311,15 @@ internal sealed partial class VaultViewModel(
     /// and now means "take the group's" — so reading the ids directly would put a password box in front of
     /// every host under a group that binds a key, and the box would do nothing.
     /// </para>
+    /// <para>
+    /// False for a host Spelunk signs in to, whatever it resolves to: there is nothing to type, and a box —
+    /// or on the phone, a sheet — asking for a password there would be a question with no use for its answer.
+    /// </para>
     /// </remarks>
     internal bool SelectedHostAsksForAPassword =>
         SelectedHost is null
-        || SelectedHost.Resolved.Binding.Kind is ResolvedBindingKind.TypedPassword;
+        || (!SelectedHost.Host.SignsInThroughSpelunk
+            && SelectedHost.Resolved.Binding.Kind is ResolvedBindingKind.TypedPassword);
 
     /// <summary>
     /// What the terminal column says in place of the password box, or nothing when the box is showing.
@@ -4330,11 +4338,13 @@ internal sealed partial class VaultViewModel(
     /// changed.
     /// </para>
     /// </remarks>
-    internal string SelectedHostAuthenticationNote => SelectedHost?.Resolved.Binding switch
+    internal string SelectedHostAuthenticationNote => SelectedHost switch
     {
-        { Kind: ResolvedBindingKind.Credential } binding =>
+        { Host.SignsInThroughSpelunk: true } =>
+            "Spelunk signs you in to this host with a one-time key; no SSH key or password is needed.",
+        { Resolved.Binding: { Kind: ResolvedBindingKind.Credential } binding } =>
             $"This host uses a password stored in your keychain{From(binding)}.",
-        { Kind: ResolvedBindingKind.SshKey } binding =>
+        { Resolved.Binding: { Kind: ResolvedBindingKind.SshKey } binding } =>
             $"This host authenticates with an SSH key{From(binding)}.",
         _ => string.Empty,
     };
@@ -4363,14 +4373,19 @@ internal sealed partial class VaultViewModel(
     /// <remarks>
     /// A sentence for "nobody" rather than the em dash the card uses. The card is a column of aligned facts
     /// where a dash reads as "none"; this is a field in a form, and an empty-looking one would read as a
-    /// value that had not loaded.
+    /// value that had not loaded. A host Spelunk signs in to logs in as whatever Spelunk names, so it says
+    /// that rather than a username the connection will not use.
     /// </remarks>
-    internal string SelectedHostUsernameLabel => SelectedHost?.Resolved.Username.Value is { Length: > 0 } user
-        ? user
-        : "no account set";
+    internal string SelectedHostUsernameLabel => SelectedHost switch
+    {
+        { Host.SignsInThroughSpelunk: true } => "named by Spelunk",
+        { Resolved.Username.Value: { Length: > 0 } user } => user,
+        _ => "no account set",
+    };
 
     /// <inheritdoc cref="SelectedHostPortIsInherited" />
-    internal bool SelectedHostUsernameIsInherited => SelectedHost?.Resolved.Username.IsInherited ?? false;
+    internal bool SelectedHostUsernameIsInherited =>
+        SelectedHost is { Host.SignsInThroughSpelunk: false, Resolved.Username.IsInherited: true };
 
     /// <summary>
     /// What the pane names in the credentials row: the key or password this host authenticates with.
@@ -4386,11 +4401,12 @@ internal sealed partial class VaultViewModel(
     /// the reference is allowed to dangle, and a GUID in a field is not an answer to anything.
     /// </para>
     /// </remarks>
-    internal string SelectedHostBindingLabel => SelectedHost?.Resolved.Binding switch
+    internal string SelectedHostBindingLabel => SelectedHost switch
     {
-        { Kind: ResolvedBindingKind.SshKey, EntityId: { } id } =>
+        { Host.SignsInThroughSpelunk: true } => SpelunkSignInIdentity,
+        { Resolved.Binding: { Kind: ResolvedBindingKind.SshKey, EntityId: { } id } } =>
             Keys.FirstOrDefault(key => key.EntityId == id)?.Label ?? "(a key that is no longer here)",
-        { Kind: ResolvedBindingKind.Credential, EntityId: { } id } =>
+        { Resolved.Binding: { Kind: ResolvedBindingKind.Credential, EntityId: { } id } } =>
             Credentials.FirstOrDefault(credential => credential.EntityId == id)?.Label
             ?? "(a password that is no longer here)",
         _ => string.Empty,
@@ -4535,6 +4551,7 @@ internal sealed partial class VaultViewModel(
         unreadable += await ReloadKeysAsync(cancellationToken).ConfigureAwait(true);
         unreadable += await ReloadCredentialsAsync(cancellationToken).ConfigureAwait(true);
         unreadable += await ReloadObjectStoresAsync(cancellationToken).ConfigureAwait(true);
+        unreadable += await ReloadSpelunkKeysAsync(cancellationToken).ConfigureAwait(true);
         unreadable += await ReloadSnippetsAsync(cancellationToken).ConfigureAwait(true);
 
         // Last, because it reads the host list to work out which pins nothing dials any more.
@@ -11010,6 +11027,10 @@ internal sealed partial class VaultViewModel(
                 await DeleteTagNowAsync(request.EntityId, cancellationToken).ConfigureAwait(true);
                 break;
 
+            case DeletionTarget.SpelunkKey:
+                await DeleteSpelunkKeyNowAsync(request.EntityId, cancellationToken).ConfigureAwait(true);
+                break;
+
             default:
                 break;
         }
@@ -11991,7 +12012,11 @@ internal sealed partial class VaultViewModel(
             authentication.Username,
             authentication.Credential);
 
-        var sessionId = await OpenThroughAsync(target, request, reporter, cancellationToken).ConfigureAwait(true);
+        var (sessionId, dialled) = await OpenThroughAsync(target, request, reporter, cancellationToken)
+            .ConfigureAwait(true);
+
+        // The account the session actually logged in as, which a Spelunk sign-in learns only from the tunnel.
+        authentication = authentication with { Username = dialled.Username };
 
         // The workspace has already opened a ticket for this session, with the address and the moment it
         // connected. What it could not know is which keychain item this was — an SshConnectionRequest has no
@@ -12086,7 +12111,7 @@ internal sealed partial class VaultViewModel(
     /// bridge listening until its own timeout; disposing twice is safe.
     /// </para>
     /// </remarks>
-    private async Task<uint> OpenThroughAsync(
+    private async Task<(uint SessionId, SshConnectionRequest Request)> OpenThroughAsync(
         ConnectionTarget target,
         SshConnectionRequest request,
         PhaseReporter reporter,
@@ -12098,15 +12123,15 @@ internal sealed partial class VaultViewModel(
             ? await OpenRouteAsync(row, cancellationToken).ConfigureAwait(true)
             : null;
 
+        var through = Through(request, route);
+
         try
         {
-            return await workspace
-                .OpenSessionAsync(
-                    route is null ? request : request with { Proxy = route.Proxy },
-                    TerminalSize.Default,
-                    reporter,
-                    cancellationToken)
+            var sessionId = await workspace
+                .OpenSessionAsync(through, TerminalSize.Default, reporter, cancellationToken)
                 .ConfigureAwait(true);
+
+            return (sessionId, through);
         }
         catch (Exception exception) when (route is not null)
         {
@@ -12432,8 +12457,25 @@ internal sealed partial class VaultViewModel(
     /// authenticates with a key that is not in this keychain any more" would go looking at a host that says
     /// nothing about keys.
     /// </para>
+    /// <para>
+    /// <b>A host Spelunk signs in to is answered first, whatever it or its group binds</b> — see
+    /// <see cref="SignedInBySpelunk"/>. It is the one host that connects with no binding, because it says so;
+    /// every other host goes through <see cref="TryBuildBoundAuthentication"/> exactly as before.
+    /// </para>
     /// </remarks>
     private bool TryBuildAuthentication(
+        HostSecret host,
+        ResolvedHost resolved,
+        string typedPassword,
+        [NotNullWhen(true)] out HostAuthentication? authentication,
+        [NotNullWhen(false)] out string? reason) =>
+        host.SignsInThroughSpelunk
+            ? SignedInBySpelunk(out authentication, out reason)
+            : TryBuildBoundAuthentication(host, resolved, typedPassword, out authentication, out reason);
+
+    /// <summary>Turns a host's resolved binding into a key, a password or a prompt, or says why it cannot.</summary>
+    /// <remarks>See <see cref="TryBuildAuthentication"/>.</remarks>
+    private bool TryBuildBoundAuthentication(
         HostSecret host,
         ResolvedHost resolved,
         string typedPassword,
@@ -12498,6 +12540,27 @@ internal sealed partial class VaultViewModel(
             out reason);
     }
 
+    /// <summary>
+    /// How a host Spelunk signs in to authenticates, before the tunnel that decides it is open.
+    /// </summary>
+    /// <remarks>
+    /// Spelunk signs the host in with a key the tunnel makes and an account Spelunk names, neither of which
+    /// exists yet. These stand-ins are replaced as the connection is made through the route — see
+    /// <see cref="Through"/> — and refused by the SSH layer if they ever reach it. It is the only way to
+    /// connect without a binding, and only for a host that says so; every other host still needs one.
+    /// </remarks>
+    private static bool SignedInBySpelunk(
+        [NotNullWhen(true)] out HostAuthentication? authentication,
+        out string? reason)
+    {
+        authentication = new HostAuthentication(
+            SpelunkSignIn.DefaultUser,
+            SpelunkSignInPending.Instance,
+            SpelunkSignInIdentity);
+        reason = null;
+        return true;
+    }
+
     /// <summary>
     /// The last thing every branch has to agree on: there is somebody to log in as.
     /// </summary>
@@ -12570,7 +12633,9 @@ internal sealed partial class VaultViewModel(
             // an ungrouped host's picker offers no "Inherit", so its "Password (ask each time)" is the
             // absence of a decision rather than one, and storing it as a decision would pin every ungrouped
             // host in the vault the first time it was edited.
-            AsksForPassword = EditorSelectedAuthentication?.Kind == AuthenticationKind.Typed
+            // Never beside a Spelunk sign-in, nor are the bindings below: a host has one way to log in.
+            AsksForPassword = EditorAsksForLogin
+                && EditorSelectedAuthentication?.Kind == AuthenticationKind.Typed
                 && EditorSelectedGroup?.EntityId is not null
                     ? true
                     : null,
@@ -12605,7 +12670,9 @@ internal sealed partial class VaultViewModel(
 
     /// <summary>The picker's selection, if it names something of this kind.</summary>
     private Guid? Bound(AuthenticationKind kind) =>
-        EditorSelectedAuthentication is { } choice && choice.Kind == kind ? choice.EntityId : null;
+        EditorAsksForLogin && EditorSelectedAuthentication is { } choice && choice.Kind == kind
+            ? choice.EntityId
+            : null;
 
     /// <summary>
     /// Fills the authentication picker, keeping whatever the host is currently bound to selectable.

src/DodoSSH.Client.Storage/LocalCacheProtector.cs

@@ -141,6 +141,7 @@ internal static class AadResourceTypes
         SyncEntityType.ConnectionLogEntry => CryptoSpec.AadResourceType.ConnectionLogEntry,
         SyncEntityType.ActivityLogEntry => CryptoSpec.AadResourceType.ActivityLogEntry,
         SyncEntityType.ObjectStore => CryptoSpec.AadResourceType.ObjectStore,
+        SyncEntityType.SpelunkKey => CryptoSpec.AadResourceType.SpelunkKey,
 
         _ => throw new ArgumentOutOfRangeException(
             nameof(entityType), entityType, "No AAD resource type is defined for this entity type."),

src/DodoSSH.Client.Sync/ItemKinds.cs

@@ -170,6 +170,9 @@ internal static class ItemKinds
 
         (SyncEntityType.ObjectStore, static (outbox, conflicts, keyring) =>
             new ItemReconciler<ObjectStoreSecret>(ObjectStoreKind.Instance, outbox, conflicts, keyring)),
+
+        (SyncEntityType.SpelunkKey, static (outbox, conflicts, keyring) =>
+            new ItemReconciler<SpelunkKeySecret>(SpelunkKeyKind.Instance, outbox, conflicts, keyring)),
     ];
 
     /// <summary>The types to ask the server for, in a fixed order.</summary>
@@ -1058,3 +1061,82 @@ internal sealed class ObjectStoreKind : IItemKind<ObjectStoreSecret>
         return secret with { Label = label };
     }
 }
+
+/// <summary>Spelunk keys.</summary>
+internal sealed class SpelunkKeyKind : IItemKind<SpelunkKeySecret>
+{
+    internal static SpelunkKeyKind Instance { get; } = new();
+
+    /// <inheritdoc />
+    public SyncEntityType EntityType => SyncEntityType.SpelunkKey;
+
+    /// <inheritdoc />
+    public string Noun => "Spelunk key";
+
+    /// <inheritdoc />
+    public OpenedItem<SpelunkKeySecret>? TryOpen(
+        EncryptedPayload payload,
+        ReadOnlySpan<byte> vaultKey,
+        Guid entityId,
+        int itemVersion)
+    {
+        var document = SpelunkKeyCipher.TryOpen(payload, vaultKey, entityId, itemVersion);
+
+        return document is null
+            ? null
+            : new OpenedItem<SpelunkKeySecret>(document.Key, document.IsReadOnly);
+    }
+
+    /// <inheritdoc />
+    public EncryptedPayload Seal(
+        SpelunkKeySecret secret,
+        ReadOnlySpan<byte> vaultKey,
+        Guid entityId,
+        uint keyGeneration,
+        int itemVersion) =>
+        SpelunkKeyCipher.Seal(secret, vaultKey, entityId, keyGeneration, itemVersion);
+
+    /// <summary>
+    /// Nothing. The address is the only candidate and must not go: nothing on the server calls Spelunk.
+    /// </summary>
+    /// <inheritdoc />
+    public SyncPlaintextFields? Fields(SpelunkKeySecret secret) => null;
+
+    /// <inheritdoc />
+    public MergedItem<SpelunkKeySecret> Merge(
+        SpelunkKeySecret ancestor,
+        SpelunkKeySecret local,
+        SpelunkKeySecret remote)
+    {
+        var merged = SpelunkKeySecretMerge.Merge(ancestor, local, remote);
+
+        return new MergedItem<SpelunkKeySecret>(merged.Merged, merged.Conflicts);
+    }
+
+    /// <remarks>
+    /// The key is compared and never reported by value, which is the rule every credential-like field in this
+    /// file follows. The address is shown: it is where the key goes, and a change to it is worth reading.
+    /// </remarks>
+    /// <inheritdoc />
+    public IReadOnlyList<string> Changes(SpelunkKeySecret before, SpelunkKeySecret after)
+    {
+        ArgumentNullException.ThrowIfNull(before);
+        ArgumentNullException.ThrowIfNull(after);
+
+        var changed = new List<string>();
+
+        Note(changed, "Name", before.Label, after.Label);
+        Note(changed, "Spelunk address", before.ApiBase, after.ApiBase);
+        Note(changed, "API key", before.ApiKey, after.ApiKey);
+
+        return changed;
+    }
+
+    /// <inheritdoc />
+    public SpelunkKeySecret Relabel(SpelunkKeySecret secret, string label)
+    {
+        ArgumentNullException.ThrowIfNull(secret);
+
+        return secret with { Label = label };
+    }
+}

src/DodoSSH.Client.Sync/SpelunkKeyCipher.cs

@@ -0,0 +1,125 @@
+using System.Security.Cryptography;
+using DodoSSH.Client.Domain;
+using DodoSSH.Contracts;
+using DodoSSH.Crypto;
+
+namespace DodoSSH.Client.Sync;
+
+/// <summary>
+/// Turns a Spelunk key into an item payload and back.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Mirrors <see cref="ObjectStoreCipher"/> exactly, including the version rule in <see cref="SyncVersions"/>.
+/// </para>
+/// <para>
+/// <b>The resource type is named, never cast.</b> <c>SyncEntityType.SpelunkKey</c> is 14 and
+/// <c>CryptoSpec.AadResourceType.SpelunkKey</c> is 17; 14 in the crypto enum is a connection log entry, and a
+/// cast would seal an API key under that — which decrypts perfectly on the machine that wrote it and violates
+/// docs/crypto.md everywhere else.
+/// </para>
+/// </remarks>
+public static class SpelunkKeyCipher
+{
+    private const CryptoSpec.AadResourceType Resource = CryptoSpec.AadResourceType.SpelunkKey;
+
+    /// <summary>Encrypts a Spelunk key.</summary>
+    /// <param name="key">The key. Must be valid for storage.</param>
+    /// <param name="vaultKey">The vault key, which the data key is wrapped under.</param>
+    /// <param name="entityId">The item id, which the AAD binds.</param>
+    /// <param name="keyGeneration">The vault's current key generation.</param>
+    /// <param name="itemVersion">The version this payload will hold once the server accepts it.</param>
+    public static EncryptedPayload Seal(
+        SpelunkKeySecret key,
+        ReadOnlySpan<byte> vaultKey,
+        Guid entityId,
+        uint keyGeneration,
+        int itemVersion)
+    {
+        ArgumentNullException.ThrowIfNull(key);
+        ArgumentOutOfRangeException.ThrowIfLessThan(itemVersion, 1);
+
+        var plaintext = SpelunkKeySecretCodec.Encode(key);
+        var dataKey = ItemKeys.CreateDataKey();
+
+        try
+        {
+            var dataKeyId = Guid.CreateVersion7();
+
+            var wrappedDataKey = ItemKeys.WrapDataKey(
+                dataKey, vaultKey, Resource, entityId, keyGeneration, (uint)itemVersion);
+
+            var envelope = ItemKeys.SealPayload(
+                dataKey, plaintext, Resource, entityId, dataKeyId, keyGeneration, (uint)itemVersion);
+
+            return new EncryptedPayload(
+                envelope, wrappedDataKey, dataKeyId, keyGeneration, CryptoSpec.CurrentAadVersion);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(dataKey);
+
+            // It holds an API key, which is live on the Spelunk it belongs to.
+            CryptographicOperations.ZeroMemory(plaintext);
+        }
+    }
+
+    /// <summary>Decrypts a Spelunk key.</summary>
+    /// <inheritdoc cref="HostCipher.TryOpen" path="/returns" />
+    public static SpelunkKeySecretDocument? TryOpen(
+        EncryptedPayload payload,
+        ReadOnlySpan<byte> vaultKey,
+        Guid entityId,
+        int itemVersion)
+    {
+        ArgumentNullException.ThrowIfNull(payload);
+
+        if (itemVersion < 1 || payload.WrappedDataKey.Length == 0)
+        {
+            return null;
+        }
+
+        var dataKey = ItemKeys.TryUnwrapDataKey(
+            vaultKey,
+            payload.WrappedDataKey,
+            Resource,
+            entityId,
+            payload.KeyGeneration,
+            (uint)itemVersion);
+
+        if (dataKey is null)
+        {
+            return null;
+        }
+
+        try
+        {
+            var plaintext = ItemKeys.TryOpenPayload(
+                dataKey,
+                payload.Envelope,
+                Resource,
+                entityId,
+                payload.DataKeyId,
+                payload.KeyGeneration,
+                (uint)itemVersion);
+
+            if (plaintext is null)
+            {
+                return null;
+            }
+
+            try
+            {
+                return SpelunkKeySecretCodec.TryDecode(plaintext, out var document) ? document : null;
+            }
+            finally
+            {
+                CryptographicOperations.ZeroMemory(plaintext);
+            }
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(dataKey);
+        }
+    }
+}

src/DodoSSH.Client.Sync/SpelunkKeyRepository.cs

@@ -0,0 +1,46 @@
+using DodoSSH.Client.Domain;
+using DodoSSH.Client.Storage;
+
+namespace DodoSSH.Client.Sync;
+
+/// <summary>
+/// The Spelunk keys in this vault, decrypted, with unpushed local changes laid over them.
+/// </summary>
+/// <remarks>
+/// Another facade over the same generic repository. A key is read when the vault is listed and again at
+/// connect, from the list, like a credential's password.
+/// </remarks>
+public sealed class SpelunkKeyRepository(
+    ItemStore items,
+    OutboxStore outbox,
+    VaultKeyring keyring,
+    IActivityLogSink? activity = null)
+{
+    private readonly VaultItemRepository<SpelunkKeySecret> keys =
+        new(SpelunkKeyKind.Instance, items, outbox, keyring, activity);
+
+    /// <inheritdoc cref="VaultItemRepository{TSecret}.ListAsync" />
+    public Task<ItemListing<SpelunkKeySecret>> ListAsync(
+        Guid vaultId,
+        CancellationToken cancellationToken) =>
+        keys.ListAsync(vaultId, cancellationToken);
+
+    /// <inheritdoc cref="VaultItemRepository{TSecret}.CreateAsync" />
+    public Task<Guid> CreateAsync(
+        Guid vaultId,
+        SpelunkKeySecret key,
+        CancellationToken cancellationToken) =>
+        keys.CreateAsync(vaultId, key, cancellationToken);
+
+    /// <inheritdoc cref="VaultItemRepository{TSecret}.UpdateAsync" />
+    public Task UpdateAsync(
+        Guid vaultId,
+        Guid entityId,
+        SpelunkKeySecret key,
+        CancellationToken cancellationToken) =>
+        keys.UpdateAsync(vaultId, entityId, key, cancellationToken);
+
+    /// <inheritdoc cref="VaultItemRepository{TSecret}.DeleteAsync" />
+    public Task DeleteAsync(Guid vaultId, Guid entityId, CancellationToken cancellationToken) =>
+        keys.DeleteAsync(vaultId, entityId, cancellationToken);
+}

src/DodoSSH.Contracts/PublicAPI.Unshipped.txt

@@ -469,6 +469,7 @@ DodoSSH.Contracts.SyncEntityType.KnownHostKey = 10 -> DodoSSH.Contracts.SyncEnti
 DodoSSH.Contracts.SyncEntityType.ObjectStore = 13 -> DodoSSH.Contracts.SyncEntityType
 DodoSSH.Contracts.SyncEntityType.PortForward = 9 -> DodoSSH.Contracts.SyncEntityType
 DodoSSH.Contracts.SyncEntityType.Snippet = 8 -> DodoSSH.Contracts.SyncEntityType
+DodoSSH.Contracts.SyncEntityType.SpelunkKey = 14 -> DodoSSH.Contracts.SyncEntityType
 DodoSSH.Contracts.SyncEntityType.SshKey = 3 -> DodoSSH.Contracts.SyncEntityType
 DodoSSH.Contracts.SyncEntityType.Tag = 5 -> DodoSSH.Contracts.SyncEntityType
 DodoSSH.Contracts.SyncEntityType.Unspecified = 0 -> DodoSSH.Contracts.SyncEntityType

src/DodoSSH.Contracts/SyncEntityType.cs

@@ -66,4 +66,14 @@ public enum SyncEntityType
     /// the vendor. The interface says S3, which is what people call the protocol.
     /// </remarks>
     ObjectStore = 13,
+
+    /// <summary>
+    /// A Spelunk API key, and the one Spelunk address it may be sent to.
+    /// </summary>
+    /// <remarks>
+    /// An item of its own rather than a credential's password, because the address is the point: a link from
+    /// Spelunk can be sent by anything on the machine, so a key may only go where the user said it goes, and
+    /// only an item that carries both can say so. See <c>SpelunkKeySecret</c>.
+    /// </remarks>
+    SpelunkKey = 14,
 }

src/DodoSSH.Crypto/CryptoSpec.cs

@@ -173,6 +173,9 @@ public static class CryptoSpec
 
         /// <summary>An S3-compatible bucket, and the credentials that reach it.</summary>
         ObjectStore = 16,
+
+        /// <summary>A Spelunk API key, and the one Spelunk address it may be sent to.</summary>
+        SpelunkKey = 17,
     }
 
     /// <summary>HKDF info labels. Domain-separated so one subkey cannot stand in for another.</summary>

src/DodoSSH.Domain/Hosts.cs

@@ -556,6 +556,62 @@ public sealed class VaultObjectStore : IVaultItem
     public Guid UpdatedByUserId { get; set; }
 }
 
+/// <summary>
+/// A Spelunk API key and the Spelunk address it may be sent to, as ciphertext.
+/// </summary>
+/// <remarks>
+/// <see cref="VaultObjectStore"/>'s shape, for the same reason: the key is a password, and the address beside
+/// it is where the user's servers are managed. Nothing on the server calls Spelunk, so there is no plaintext
+/// column and no argument for one.
+/// </remarks>
+public sealed class VaultSpelunkKey : IVaultItem
+{
+    /// <summary>Primary key. UUIDv7, generated by the client so a key can be added offline.</summary>
+    public Guid Id { get; set; }
+
+    /// <summary>Owning vault.</summary>
+    public Guid VaultId { get; set; }
+
+    /// <summary>Owning vault.</summary>
+    public Vault? Vault { get; set; }
+
+    /// <summary>The encrypted key and its address: a DSH1 envelope. Opaque to the server.</summary>
+    public byte[] Payload { get; set; } = [];
+
+    /// <summary>The item's data key, wrapped under the vault key. Opaque.</summary>
+    public byte[]? DataKeyWrap { get; set; }
+
+    /// <summary>Reserved for per-item content keys wrapped to individual users; see docs/crypto.md §3.</summary>
+    public Guid? ContentKeyId { get; set; }
+
+    /// <summary>Vault key generation this payload was encrypted under.</summary>
+    public int KeyGeneration { get; set; }
+
+    /// <summary>AAD rule version, enabling a lazy re-encrypt-on-write migration later.</summary>
+    public short PayloadAadVersion { get; set; }
+
+    /// <summary>Client-visible, monotonic item version, used for <c>expectedVersion</c> checks.</summary>
+    public int Version { get; set; }
+
+    /// <summary>Latest change-log sequence touching this row, so a delta pull can join directly.</summary>
+    public long ChangeSequence { get; set; }
+
+    /// <summary>Creation timestamp.</summary>
+    public DateTimeOffset CreatedAtUtc { get; set; }
+
+    /// <summary>Last modification timestamp.</summary>
+    public DateTimeOffset UpdatedAtUtc { get; set; }
+
+    /// <summary>Soft-delete marker; a tombstone, so an offline client learns the key went away.</summary>
+    public DateTimeOffset? DeletedAtUtc { get; set; }
+
+    /// <summary>Who created it.</summary>
+    public Guid CreatedByUserId { get; set; }
+
+    /// <summary>Who last modified it.</summary>
+    public Guid UpdatedByUserId { get; set; }
+}
+
 /// <summary>
 /// One connection that was made, as ciphertext.
 /// </summary>

src/DodoSSH.Domain/SyncLog.cs

@@ -57,6 +57,9 @@ public enum ChangeEntityType
 
     /// <summary>An S3-compatible bucket, and the credentials that reach it. M2.</summary>
     ObjectStore = 13,
+
+    /// <summary>A Spelunk API key, and the one Spelunk address it may be sent to.</summary>
+    SpelunkKey = 14,
 }
 
 /// <summary>

src/DodoSSH.Infrastructure/Configurations/HostAndSyncConfigurations.cs

@@ -384,6 +384,41 @@ public sealed class ObjectStoreConfiguration : IEntityTypeConfiguration<VaultObj
     }
 }
 
+/// <summary>
+/// Maps <see cref="VaultSpelunkKey"/>.
+/// </summary>
+/// <remarks>
+/// <see cref="ObjectStoreConfiguration"/> again: a key and the address it goes to, neither of which belongs
+/// in a column.
+/// </remarks>
+public sealed class SpelunkKeyConfiguration : IEntityTypeConfiguration<VaultSpelunkKey>
+{
+    /// <inheritdoc />
+    public void Configure(EntityTypeBuilder<VaultSpelunkKey> builder)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+
+        builder.ToTable("spelunk_key");
+        builder.HasKey(s => s.Id);
+
+        // Client-generated UUIDv7: a key must be addable offline, with its id.
+        builder.Property(s => s.Id).ValueGeneratedNever();
+        builder.UseXminConcurrencyToken();
+
+        builder.Property(s => s.Payload).IsRequired();
+
+        builder.HasIndex(s => new { s.VaultId, s.ChangeSequence });
+
+        builder.HasIndex(s => s.VaultId)
+            .HasFilter("deleted_at_utc IS NULL")
+            .HasDatabaseName("ix_spelunk_key_vault_live");
+
+        builder.ToTable(t => t.HasCheckConstraint(
+            "ck_spelunk_key_version",
+            "version >= 1"));
+    }
+}
+
 /// <summary>Maps <see cref="VaultChange"/>.</summary>
 public sealed class SyncChangeConfiguration : IEntityTypeConfiguration<VaultChange>
 {

src/DodoSSH.Infrastructure/DodoDbContext.cs

@@ -81,6 +81,9 @@ public class DodoDbContext(DbContextOptions<DodoDbContext> options) : DbContext(
     /// <summary>S3-compatible buckets and their credentials, held as ciphertext.</summary>
     public DbSet<VaultObjectStore> ObjectStores => Set<VaultObjectStore>();
 
+    /// <summary>Spelunk API keys and the addresses they may be sent to, held as ciphertext.</summary>
+    public DbSet<VaultSpelunkKey> SpelunkKeys => Set<VaultSpelunkKey>();
+
     /// <summary>The per-vault change log that delta sync reads.</summary>
     public DbSet<VaultChange> VaultChanges => Set<VaultChange>();
 

src/DodoSSH.Infrastructure/Migrations/20260929073947_AddSpelunkKeyItem.cs

@@ -0,0 +1,76 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace DodoSSH.Infrastructure.Migrations
+{
+    /// <summary>
+    /// Adds the table for Spelunk keys: an API key and the one Spelunk address it may be sent to.
+    /// </summary>
+    /// <remarks>
+    /// New and empty, so this is additive and safe to roll back. The object-store table's shape: ciphertext
+    /// and bookkeeping, with no plaintext column, because nothing on the server calls Spelunk.
+    /// </remarks>
+    public partial class AddSpelunkKeyItem : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "spelunk_key",
+                schema: "dodo",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    vault_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    payload = table.Column<byte[]>(type: "bytea", nullable: false),
+                    data_key_wrap = table.Column<byte[]>(type: "bytea", nullable: true),
+                    content_key_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    key_generation = table.Column<int>(type: "integer", nullable: false),
+                    payload_aad_version = table.Column<short>(type: "smallint", nullable: false),
+                    version = table.Column<int>(type: "integer", nullable: false),
+                    change_sequence = table.Column<long>(type: "bigint", nullable: false),
+                    created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
+                    updated_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
+                    deleted_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
+                    created_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    updated_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_spelunk_key", x => x.id);
+                    table.CheckConstraint("ck_spelunk_key_version", "version >= 1");
+                    table.ForeignKey(
+                        name: "fk_spelunk_key_vaults_vault_id",
+                        column: x => x.vault_id,
+                        principalSchema: "dodo",
+                        principalTable: "vault",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_spelunk_key_vault_id_change_sequence",
+                schema: "dodo",
+                table: "spelunk_key",
+                columns: new[] { "vault_id", "change_sequence" });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_spelunk_key_vault_live",
+                schema: "dodo",
+                table: "spelunk_key",
+                column: "vault_id",
+                filter: "deleted_at_utc IS NULL");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "spelunk_key",
+                schema: "dodo");
+        }
+    }
+}

src/DodoSSH.Infrastructure/Migrations/DodoDbContextModelSnapshot.cs

@@ -1487,6 +1487,87 @@ namespace DodoSSH.Infrastructure.Migrations
                         });
                 });
 
+            modelBuilder.Entity("DodoSSH.Domain.VaultSpelunkKey", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<long>("ChangeSequence")
+                        .HasColumnType("bigint")
+                        .HasColumnName("change_sequence");
+
+                    b.Property<Guid?>("ContentKeyId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("content_key_id");
+
+                    b.Property<DateTimeOffset>("CreatedAtUtc")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at_utc");
+
+                    b.Property<Guid>("CreatedByUserId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("created_by_user_id");
+
+                    b.Property<byte[]>("DataKeyWrap")
+                        .HasColumnType("bytea")
+                        .HasColumnName("data_key_wrap");
+
+                    b.Property<DateTimeOffset?>("DeletedAtUtc")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("deleted_at_utc");
+
+                    b.Property<int>("KeyGeneration")
+                        .HasColumnType("integer")
+                        .HasColumnName("key_generation");
+
+                    b.Property<byte[]>("Payload")
+                        .IsRequired()
+                        .HasColumnType("bytea")
+                        .HasColumnName("payload");
+
+                    b.Property<short>("PayloadAadVersion")
+                        .HasColumnType("smallint")
+                        .HasColumnName("payload_aad_version");
+
+                    b.Property<DateTimeOffset>("UpdatedAtUtc")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at_utc");
+
+                    b.Property<Guid>("UpdatedByUserId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("updated_by_user_id");
+
+                    b.Property<Guid>("VaultId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("vault_id");
+
+                    b.Property<int>("Version")
+                        .HasColumnType("integer")
+                        .HasColumnName("version");
+
+                    b.Property<uint>("xmin")
+                        .IsConcurrencyToken()
+                        .ValueGeneratedOnAddOrUpdate()
+                        .HasColumnType("xid")
+                        .HasColumnName("xmin");
+
+                    b.HasKey("Id")
+                        .HasName("pk_spelunk_key");
+
+                    b.HasIndex("VaultId")
+                        .HasDatabaseName("ix_spelunk_key_vault_live")
+                        .HasFilter("deleted_at_utc IS NULL");
+
+                    b.HasIndex("VaultId", "ChangeSequence")
+                        .HasDatabaseName("ix_spelunk_key_vault_id_change_sequence");
+
+                    b.ToTable("spelunk_key", "dodo", t =>
+                        {
+                            t.HasCheckConstraint("ck_spelunk_key_version", "version >= 1");
+                        });
+                });
+
             modelBuilder.Entity("DodoSSH.Domain.VaultSshKey", b =>
                 {
                     b.Property<Guid>("Id")
@@ -1854,6 +1935,18 @@ namespace DodoSSH.Infrastructure.Migrations
                     b.Navigation("Vault");
                 });
 
+            modelBuilder.Entity("DodoSSH.Domain.VaultSpelunkKey", b =>
+                {
+                    b.HasOne("DodoSSH.Domain.Vault", "Vault")
+                        .WithMany()
+                        .HasForeignKey("VaultId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_spelunk_key_vaults_vault_id");
+
+                    b.Navigation("Vault");
+                });
+
             modelBuilder.Entity("DodoSSH.Domain.VaultSshKey", b =>
                 {
                     b.HasOne("DodoSSH.Domain.Vault", "Vault")

tests/DodoSSH.Api.Tests/SyncEndpointTests.cs

@@ -935,6 +935,55 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
         change.PlaintextFields.ShouldBeNull("where a user keeps their data is not something this server keeps");
     }
 
+    [Fact]
+    public async Task ASpelunkKey_RoundTripsAsCiphertextWithNoPlaintextAtAll()
+    {
+        var (subject, vaultId) = await SeedUserWithVaultAsync();
+        var client = fixture.CreateClientFor(subject);
+
+        var keyId = Guid.CreateVersion7();
+
+        var pushed = await client.PostContractAsync(
+            PushUrl(vaultId),
+            new SyncPushRequest(
+                [SpelunkKeyOperation(keyId, expectedVersion: null, envelope: [4, 2])]));
+
+        var results = await pushed.Content.ReadContractAsync<SyncPushResponse>();
+        results!.Results.ShouldHaveSingleItem().Status.ShouldBe(SyncOperationStatus.Applied);
+
+        var pulled = await client.PostContractAsync(
+            PullUrl(vaultId),
+            new SyncPullRequest(null, null, [SyncEntityType.SpelunkKey]));
+
+        var page = await pulled.Content.ReadContractAsync<SyncPullResponse>();
+        var change = page!.Changes.ShouldHaveSingleItem();
+
+        change.EntityType.ShouldBe(SyncEntityType.SpelunkKey);
+        change.EntityId.ShouldBe(keyId);
+        change.Payload.ShouldNotBeNull().Envelope.ShouldBe([4, 2]);
+
+        change.PlaintextFields.ShouldBeNull("where somebody manages their servers from is not this server's to keep");
+    }
+
+    [Fact]
+    public async Task ASpelunkKeyCarryingItsAddressInTheClear_IsRejected()
+    {
+        var (subject, vaultId) = await SeedUserWithVaultAsync();
+        var client = fixture.CreateClientFor(subject);
+
+        var operation = SpelunkKeyOperation(Guid.CreateVersion7(), null, [1])
+            with
+        { PlaintextFields = new SyncPlaintextFields(RelayEnabled: false, Hostname: "api.spelunk.example.com", Port: 443) };
+
+        var pushed = await client.PostContractAsync(PushUrl(vaultId), new SyncPushRequest([operation]));
+
+        var result = (await pushed.Content.ReadContractAsync<SyncPushResponse>())!.Results
+            .ShouldHaveSingleItem();
+
+        result.Status.ShouldBe(SyncOperationStatus.Invalid);
+        result.Detail.ShouldNotBeNull().ShouldContain("stays encrypted");
+    }
+
     [Fact]
     public async Task ABucketCarryingItsEndpointInTheClear_IsRejected()
     {
@@ -1425,6 +1474,19 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
             Payload(envelope),
             PlaintextFields: null);
 
+    private static SyncPushOperation SpelunkKeyOperation(
+        Guid entityId,
+        int? expectedVersion,
+        byte[] envelope) =>
+        new(
+            Guid.CreateVersion7(),
+            SyncEntityType.SpelunkKey,
+            entityId,
+            SyncOperation.Upsert,
+            expectedVersion,
+            Payload(envelope),
+            PlaintextFields: null);
+
     private static SyncPushRequest NewCreateBatch() =>
         new([NewOperation(Guid.CreateVersion7(), expectedVersion: null, envelope: [1, 2, 3, 4])]);
 

tests/DodoSSH.Client.App.Layout.Tests/SettingsPagesLayoutTests.cs

@@ -232,6 +232,41 @@ public sealed class SettingsPagesLayoutTests : IAsyncLifetime
             Token);
     }
 
+    /// <summary>
+    /// The SPELUNK section with a key saved: the form, its note, and the row listing the key all fit, and the
+    /// form's button is the real save.
+    /// </summary>
+    [Fact]
+    public async Task TheSecurityPageFitsWithASavedSpelunkKey()
+    {
+        vault.SpelunkKeyFormApi = "https://api.spelunk.example.com";
+        vault.SpelunkKeyFormKey = "spelunk_0123456789abcdefghijklmnopqrstuvwxyz";
+        await vault.SaveSpelunkKeyCommand.ExecuteAsync(null);
+
+        vault.SpelunkKeys.ShouldHaveSingleItem(vault.SpelunkKeyFormNote);
+
+        await MeasureAsync(() => new SettingsSecurityPage(), faults => faults.ShouldBeEmpty("with a Spelunk key saved"));
+
+        await LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var page = new SettingsSecurityPage { DataContext = shell };
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    page, LayoutHarness.SettingsContentWidth, LayoutHarness.SettingsContentHeight);
+
+                try
+                {
+                    ButtonNamed(window, "SAVE KEY").Command.ShouldBeSameAs(vault.SaveSpelunkKeyCommand);
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+    }
+
     // ---- v5c-2: Vaults, Groups, Tags ----
     //
     // Vaults replaces the old full-bleed VaultsScreen, which ScreenLayoutTests used to measure at

tests/DodoSSH.Client.App.Tests/ShellFlowTests.Spelunk.cs

@@ -20,8 +20,9 @@ namespace DodoSSH.Client.App.Tests;
 /// </para>
 /// <para>
 /// What these hold is what the tick box and the link promise: a Spelunk host is never dialled directly and
-/// never probed, a refusal is said in Spelunk's terms, the key goes only where the host says, and a link
-/// never connects anything the user has not saved.
+/// never probed, a refusal is said in Spelunk's terms, the key goes only where the host says, a sign-in
+/// connects with the tunnel's key and Spelunk's account and nothing of the host's, and a link connects
+/// straight away but never sends a key to a Spelunk no saved host already sends it to.
 /// </para>
 /// </remarks>
 public sealed partial class ShellFlowTests
@@ -173,6 +174,131 @@ public sealed partial class ShellFlowTests
         vault.SelectedItemUsedByHosts.ShouldHaveSingleItem().Label.ShouldBe("web-01");
     }
 
+    // ---- Signing in through Spelunk ----
+
+    [Fact]
+    public async Task ASignInHost_ConnectsWithAFreshKeyAndSpelunksAccount_AndNoLoginOfItsOwn()
+    {
+        spelunkTunnels.User = "ops";
+        var vault = await ReadyToSignInThroughSpelunkAsync();
+
+        vault.SelectedHostAsksForAPassword.ShouldBeFalse("there is nothing to type");
+        vault.SelectedHostAuthenticationNote.ShouldContain("Spelunk signs you in");
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        spelunkTunnels.Opened.ShouldHaveSingleItem().ShouldBe((SpelunkApi, SpelunkServer, SpelunkApiKey, 22));
+        var signIn = spelunkTunnels.SignIns.ShouldHaveSingleItem().ShouldNotBeNull();
+        signIn.PublicKeyLine.ShouldStartWith("ssh-ed25519 ");
+
+        // The account Spelunk named and the key the tunnel was opened with, through the tunnel, as the host.
+        var request = ssh.Requests.ShouldHaveSingleItem();
+        request.Username.ShouldBe("ops");
+        request.Credential.ShouldBeSameAs(signIn.Credential);
+        request.Host.ShouldBe("203.0.113.10");
+        request.Proxy.ShouldNotBeNull().Lifetime.ShouldBeOfType<RelayBridge>();
+
+        shell.IsTerminalShowing.ShouldBeTrue();
+        shell.Tabs.ShouldHaveSingleItem();
+        vault.Credentials.Count.ShouldBe(1, "nothing is remembered for a sign-in");
+
+        await request.Proxy.Lifetime.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task ASignInHostsForwards_StillStart_OverTheSignedInSession()
+    {
+        var vault = await ReadyToSignInThroughSpelunkAsync();
+
+        vault.EditSelectedHostCommand.Execute(null);
+        vault.EditorNewForwardKind = (int)Domain.PortForwardKind.Dynamic;
+        vault.EditorNewForwardBindPort = "1080";
+        vault.EditorNewForwardTarget = string.Empty;
+        vault.AddEditorForwardCommand.Execute(null);
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        var tab = shell.Tabs.ShouldHaveSingleItem();
+        await EventuallyAsync(() => tab.ListeningForwardCount == 1, "the forward should be listening");
+        ssh.Forwards.ShouldHaveSingleItem().Spec.ShouldBe(new SshPortForwardSpec(SshPortForwardKind.Dynamic, 1080));
+
+        await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+    }
+
+    [Fact]
+    public async Task ASignInHostsFileTransfer_SignsInThroughSpelunkToo()
+    {
+        var vault = await ReadyToSignInThroughSpelunkAsync();
+
+        shell.Transfers.Attach(vault, knownHosts);
+        shell.Transfers.SelectedHost = shell.Transfers.Hosts[0];
+        shell.Transfers.SelectedHostAsksForAPassword.ShouldBeFalse();
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+
+        var signIn = spelunkTunnels.SignIns.ShouldHaveSingleItem().ShouldNotBeNull();
+        var request = ssh.SftpRequests.ShouldHaveSingleItem();
+        request.Username.ShouldBe("root");
+        request.Credential.ShouldBeSameAs(signIn.Credential);
+        request.Proxy.ShouldNotBeNull().Lifetime.ShouldBeOfType<RelayBridge>();
+        shell.Transfers.ConnectedTo.ShouldStartWith("root@203.0.113.10");
+
+        await request.Proxy.Lifetime.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task ASpelunkHostThatDoesNotSignIn_StillNeedsALogin()
+    {
+        // The sign-in is what lets a host connect with no binding; without it, the old rule stands.
+        var vault = await ReadyToSignInThroughSpelunkAsync();
+
+        vault.EditSelectedHostCommand.Execute(null);
+        vault.EditorSpelunkSignIn = false;
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        vault.SelectedHost = vault.Hosts.Single();
+        vault.SelectedHostAsksForAPassword.ShouldBeTrue();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        vault.Status.ShouldNotBeNull().ShouldContain("no username");
+        spelunkTunnels.Opened.ShouldBeEmpty();
+        ssh.Requests.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task TickingSignIn_GreysOutTheLogin_AndTheSavedHostBindsNothing()
+    {
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+
+        vault.EditSelectedHostCommand.Execute(null);
+        vault.EditorAsksForLogin.ShouldBeTrue();
+
+        vault.EditorSpelunkSignIn = true;
+        vault.EditorAsksForLogin.ShouldBeFalse();
+
+        // The choice is still there to see, and to come back to, but it is not saved beside the sign-in.
+        vault.EditorSelectedAuthentication.ShouldNotBeNull().Label.ShouldBe("deploy password");
+
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        var host = vault.Hosts.ShouldHaveSingleItem().Host;
+        host.SignsInThroughSpelunk.ShouldBeTrue();
+        host.CredentialId.ShouldBeNull();
+        host.SshKeyId.ShouldBeNull();
+        host.AsksForPassword.ShouldBeNull();
+
+        // Unticking the route altogether gives the login back.
+        vault.EditSelectedHostCommand.Execute(null);
+        vault.EditorSpelunkSignIn.ShouldBeTrue();
+        vault.EditorThroughSpelunk = false;
+        vault.EditorAsksForLogin.ShouldBeTrue();
+    }
+
     // ---- A link from Spelunk ----
 
     [Fact]
@@ -188,12 +314,15 @@ public sealed partial class ShellFlowTests
         vault.EditorHostname.ShouldBe("203.0.113.10");
         vault.EditorPort.ShouldBe(22);
         vault.EditorThroughSpelunk.ShouldBeTrue();
+        vault.EditorSpelunkSignIn.ShouldBeTrue("a host from a link signs in through Spelunk");
+        vault.EditorAsksForLogin.ShouldBeFalse();
         vault.EditorSpelunkApi.ShouldBe(SpelunkApi);
         vault.EditorSpelunkServerId.ShouldBe(SpelunkServer.ToString());
 
         // No key chosen for a Spelunk no host already uses: the link named the address, and guessing a key
         // for it would be offering to send the key wherever a link says.
         vault.EditorSelectedSpelunkKey.ShouldBeNull();
+        vault.Status.ShouldNotBeNull().ShouldContain("first server");
 
         spelunkTunnels.Opened.ShouldBeEmpty();
         ssh.Requests.ShouldBeEmpty();
@@ -211,34 +340,138 @@ public sealed partial class ShellFlowTests
     }
 
     [Fact]
-    public async Task ALinkForASecondServerOnAKnownSpelunk_PicksTheKeyThatSpelunkAlreadyGets()
+    public async Task TheFirstLinkFromASpelunk_TagsTheHostItOpens_InThePersonalVault()
     {
-        var vault = await ReadyToConnectThroughSpelunkAsync();
+        await UnlockedAsync();
+        var vault = shell.Vault!;
 
-        shell.OpenLink(Link(server: Guid.Parse("0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c")));
+        await vault.OpenSpelunkLinkAsync(Link(host: "203.0.113.10"));
 
         vault.IsEditing.ShouldBeTrue();
-        vault.EditorSelectedSpelunkKey.ShouldNotBeNull().Label.ShouldBe("spelunk key");
+        vault.EditorSelectedVault.ShouldNotBeNull().IsPersonal.ShouldBeTrue();
+        vault.EditorTagChoices.ShouldHaveSingleItem().ShouldSatisfyAllConditions(
+            chip => chip.Label.ShouldBe(VaultViewModel.SpelunkTag),
+            chip => chip.IsWorn.ShouldBeTrue());
+
+        // So once it is saved, the next link for that server finds it rather than adding a second one.
+        await AddCredentialAsync(vault, "spelunk key", password: SpelunkApiKey);
+        vault.EditorSelectedSpelunkKey = vault.EditorSpelunkKeyChoices.Single(choice => choice.Label == "spelunk key");
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.OpenSpelunkLinkAsync(Link(host: "203.0.113.10"));
+
+        vault.Hosts.ShouldHaveSingleItem();
+        spelunkTunnels.SignIns.ShouldHaveSingleItem().ShouldNotBeNull();
+
+        await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
     }
 
     [Fact]
-    public async Task ALinkForASavedHost_ConnectsToIt()
+    public async Task ALinkForAnotherServerOnAKnownSpelunk_IsAddedAndConnected_WithoutTheEditor()
     {
         var vault = await ReadyToConnectThroughSpelunkAsync();
+        var other = Guid.Parse("0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c");
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.OpenSpelunkLinkAsync(Link(host: null, server: other));
+
+        vault.IsEditing.ShouldBeFalse("nothing to choose: the key already goes to this Spelunk");
+
+        // Saved as a host like any other: in the personal vault, tagged, signing in through Spelunk with the
+        // key that Spelunk already gets, and no login of its own.
+        var added = vault.Hosts.Single(row => row.Host.Spelunk?.ServerId == other);
+        added.VaultId.ShouldBe(vault.TargetVaults.Single(choice => choice.IsPersonal).VaultId);
+        added.Label.ShouldBe("web 01");
+        added.Host.Hostname.ShouldBe($"spelunk-{other}");
+        added.Host.Port.ShouldBe(22);
+        added.Host.Spelunk!.ApiBase.ShouldBe(SpelunkApi);
+        added.Host.Spelunk.SignInThroughSpelunk.ShouldBeTrue();
+        added.Host.Spelunk.ApiKeyCredentialId.ShouldBe(vault.Credentials.Single(row => row.Label == "spelunk key").EntityId);
+        added.Host.SshKeyId.ShouldBeNull();
+        added.Host.CredentialId.ShouldBeNull();
+        added.Host.Username.ShouldBeNull();
+        added.Host.TagIds.ShouldHaveSingleItem().ShouldBe(vault.Tags.Single(tag => tag.Label == VaultViewModel.SpelunkTag).EntityId);
+
+        // And connected, through Spelunk, signing in.
+        var opened = spelunkTunnels.Opened.ShouldHaveSingleItem();
+        opened.ShouldBe((SpelunkApi, other, SpelunkApiKey, 22));
+        var signIn = spelunkTunnels.SignIns.ShouldHaveSingleItem().ShouldNotBeNull();
+
+        var request = ssh.Requests.ShouldHaveSingleItem();
+        request.Username.ShouldBe("root");
+        request.Credential.ShouldBeSameAs(signIn.Credential);
+        shell.IsTerminalShowing.ShouldBeTrue();
+
+        await request.Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+    }
+
+    [Fact]
+    public async Task ASecondLinkForTheSameServer_ConnectsToTheHostTheFirstAdded()
+    {
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+        var other = Guid.Parse("0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c");
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.OpenSpelunkLinkAsync(Link(server: other));
+        await vault.OpenSpelunkLinkAsync(Link(server: other));
+
+        vault.Hosts.Count(row => row.Host.Spelunk?.ServerId == other).ShouldBe(1);
+        spelunkTunnels.Opened.Count.ShouldBe(2);
+
+        // The two SignIns are two keys: one per connection, never reused.
+        spelunkTunnels.SignIns[0].ShouldNotBeNull().PublicKeyLine
+            .ShouldNotBe(spelunkTunnels.SignIns[1].ShouldNotBeNull().PublicKeyLine);
+
+        foreach (var request in ssh.Requests)
+        {
+            await request.Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public async Task ALinkForATaggedHostInThePersonalVault_ConnectsToItAsSaved()
+    {
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+
+        vault.EditSelectedHostCommand.Execute(null);
+        vault.EditorNewTag = VaultViewModel.SpelunkTag;
+        await vault.AddEditorTagCommand.ExecuteAsync(null);
+        await vault.SaveHostCommand.ExecuteAsync(null);
 
         await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
         await vault.OpenSpelunkLinkAsync(Link(host: "198.51.100.7"));
 
         vault.IsEditing.ShouldBeFalse();
+        vault.Hosts.ShouldHaveSingleItem();
         spelunkTunnels.Opened.ShouldHaveSingleItem();
 
-        // The saved host, as saved — not the address the link happened to carry.
+        // The saved host, as saved — not the address the link happened to carry, and its own login, since
+        // this one does not sign in through Spelunk.
+        spelunkTunnels.SignIns.ShouldHaveSingleItem().ShouldBeNull();
         var request = ssh.Requests.ShouldHaveSingleItem();
         request.Host.ShouldBe("203.0.113.10");
+        request.Username.ShouldBe("deploy");
 
         await request.Proxy.ShouldNotBeNull().Lifetime.DisposeAsync();
     }
 
+    [Fact]
+    public async Task ALinkForAHostSetUpByHand_AddsOneOfItsOwn()
+    {
+        // Untagged, so not one a link made: it is left as it is, and the link gets the host links make.
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.OpenSpelunkLinkAsync(Link(host: "203.0.113.10"));
+
+        vault.Hosts.Count.ShouldBe(2);
+        vault.Hosts.Single(row => row.Label == "web-01").Host.TagIds.ShouldBeEmpty();
+        vault.Hosts.Single(row => row.Label == "web 01").Host.SignsInThroughSpelunk.ShouldBeTrue();
+
+        await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+    }
+
     [Fact]
     public async Task ALinkWhileLocked_WaitsForTheUnlock()
     {
@@ -255,6 +488,7 @@ public sealed partial class ShellFlowTests
         var vault = shell.Vault.ShouldNotBeNull();
         vault.IsEditing.ShouldBeTrue();
         vault.EditorSpelunkServerId.ShouldBe(SpelunkServer.ToString());
+        vault.EditorSpelunkSignIn.ShouldBeTrue();
     }
 
     [Fact]
@@ -273,6 +507,158 @@ public sealed partial class ShellFlowTests
         vault.Status.ShouldNotBeNull().ShouldContain("Finish or cancel");
     }
 
+    // ---- A Spelunk key saved on the Security page ----
+
+    [Fact]
+    public async Task AKeySavedOnTheSecurityPage_LetsTheFirstLinkConnectStraightAway()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await SaveSpelunkKeyAsync(vault, SpelunkApi + "/", SpelunkApiKey);
+
+        // Saved in the one form, in the personal vault, and gone from the form.
+        var saved = vault.SpelunkKeys.ShouldHaveSingleItem();
+        saved.ApiBase.ShouldBe(SpelunkApi);
+        saved.VaultId.ShouldBe(vault.TargetVaults.Single(choice => choice.IsPersonal).VaultId);
+        vault.SpelunkKeyFormKey.ShouldBeEmpty();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.OpenSpelunkLinkAsync(Link(host: "203.0.113.10"));
+
+        vault.IsEditing.ShouldBeFalse("saving the key for this Spelunk is the say-so the first link used to ask for");
+
+        var added = vault.Hosts.ShouldHaveSingleItem();
+        added.Host.Spelunk.ShouldNotBeNull().ApiKeyCredentialId.ShouldBe(saved.EntityId);
+        added.Host.SignsInThroughSpelunk.ShouldBeTrue();
+
+        spelunkTunnels.Opened.ShouldHaveSingleItem().ShouldBe((SpelunkApi, SpelunkServer, SpelunkApiKey, 22));
+
+        await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+    }
+
+    [Fact]
+    public async Task ASecondKeyForTheSameSpelunk_ReplacesTheFirst_AndHostsUseTheNewOne()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await SaveSpelunkKeyAsync(vault, SpelunkApi, "spelunk_the_old_key");
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.OpenSpelunkLinkAsync(Link());
+        await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+
+        await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
+
+        vault.SpelunkKeys.ShouldHaveSingleItem().UsedBy.ShouldBe("1 host uses it");
+        vault.SpelunkKeyFormNote.ShouldContain("Replaced");
+
+        await vault.OpenSpelunkLinkAsync(Link());
+
+        spelunkTunnels.Opened.Select(opened => opened.ApiKey).ShouldBe(["spelunk_the_old_key", SpelunkApiKey]);
+
+        await ssh.Requests[1].Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+    }
+
+    [Fact]
+    public async Task ASavedKey_IsNeverSentToAnotherSpelunk()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
+        var saved = vault.SpelunkKeys.ShouldHaveSingleItem();
+
+        // A host that names the key but another address — the one thing a key kept with its address refuses.
+        vault.NewHostCommand.Execute(null);
+        vault.EditorLabel = "web-01";
+        vault.EditorHostname = "203.0.113.10";
+        vault.EditorThroughSpelunk = true;
+        vault.EditorSpelunkSignIn = true;
+        vault.EditorSpelunkApi = "https://spelunk.somewhere-else.example";
+        vault.EditorSpelunkServerId = SpelunkServer.ToString();
+        vault.EditorSelectedSpelunkKey = vault.EditorSpelunkKeyChoices.Single(choice => choice.EntityId == saved.EntityId);
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        vault.SelectedHost = vault.Hosts.ShouldHaveSingleItem(vault.Status);
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        spelunkTunnels.Opened.ShouldBeEmpty();
+        ssh.Requests.ShouldBeEmpty();
+        vault.Status.ShouldNotBeNull().ShouldContain("never sent anywhere else");
+    }
+
+    [Fact]
+    public async Task TypingTheAddressOfASavedKey_PicksThatKey_InTheEditor()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await AddCredentialAsync(vault, "an older key", password: "spelunk_older");
+        await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
+
+        vault.NewHostCommand.Execute(null);
+        vault.EditorThroughSpelunk = true;
+        vault.EditorSpelunkApi = SpelunkApi + "/";
+
+        var chosen = vault.EditorSelectedSpelunkKey.ShouldNotBeNull();
+        chosen.EntityId.ShouldBe(vault.SpelunkKeys.Single().EntityId);
+        chosen.Qualifier.ShouldBe($"Spelunk key · {SpelunkApi}");
+
+        // Saved keys come before credentials, which stay on offer for keys kept the older way.
+        vault.EditorSpelunkKeyChoices.Select(choice => choice.Label)
+            .ShouldBe(["Spelunk at api.spelunk.example.com", "an older key"]);
+    }
+
+    [Fact]
+    public async Task AnAddressThatWouldSendTheKeyInClear_IsRefusedOnTheForm()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await SaveSpelunkKeyAsync(vault, "http://api.spelunk.example.com", SpelunkApiKey);
+
+        vault.SpelunkKeys.ShouldBeEmpty();
+        vault.SpelunkKeyFormNote.ShouldContain("https");
+        vault.SpelunkKeyFormKey.ShouldBe(SpelunkApiKey, "a refused key stays in the box to be saved once the address is fixed");
+    }
+
+    [Fact]
+    public async Task DeletingASavedKey_SaysWhichHostsWillStopConnecting()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.OpenSpelunkLinkAsync(Link());
+        await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+
+        vault.DeleteSpelunkKeyRowCommand.Execute(vault.SpelunkKeys.Single());
+
+        var request = vault.PendingDeletion.ShouldNotBeNull();
+        request.Usage.ShouldContain("web 01 reaches Spelunk with it");
+
+        await vault.ConfirmDeleteCommand.ExecuteAsync(null);
+
+        vault.SpelunkKeys.ShouldBeEmpty();
+
+        await vault.ConnectToRowCommand.ExecuteAsync(vault.Hosts.Single());
+        vault.Status.ShouldNotBeNull().ShouldContain("not in this keychain any more");
+    }
+
+    private static async Task SaveSpelunkKeyAsync(VaultViewModel vault, string apiBase, string apiKey)
+    {
+        vault.SpelunkKeyFormApi = apiBase;
+        vault.SpelunkKeyFormKey = apiKey;
+
+        await vault.SaveSpelunkKeyCommand.ExecuteAsync(null);
+    }
+
     /// <summary>A saved host through Spelunk, bound to a stored SSH password, with its key in the keychain.</summary>
     private async Task<VaultViewModel> ReadyToConnectThroughSpelunkAsync()
     {
@@ -304,6 +690,32 @@ public sealed partial class ShellFlowTests
         return vault;
     }
 
+    /// <summary>A saved host through Spelunk that Spelunk signs in to: no username, no key, no password.</summary>
+    private async Task<VaultViewModel> ReadyToSignInThroughSpelunkAsync()
+    {
+        await UnlockedAsync();
+
+        var vault = shell.Vault!;
+
+        await AddCredentialAsync(vault, "spelunk key", password: SpelunkApiKey);
+
+        vault.NewHostCommand.Execute(null);
+        vault.EditorLabel = "web-01";
+        vault.EditorHostname = "203.0.113.10";
+        vault.EditorThroughSpelunk = true;
+        vault.EditorSpelunkSignIn = true;
+        vault.EditorSpelunkApi = SpelunkApi;
+        vault.EditorSpelunkServerId = SpelunkServer.ToString();
+        vault.EditorSelectedSpelunkKey = vault.EditorSpelunkKeyChoices.Single(choice => choice.Label == "spelunk key");
+
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        vault.SelectedHost = vault.Hosts.ShouldHaveSingleItem(vault.Status);
+        vault.SelectedHost.Host.SignsInThroughSpelunk.ShouldBeTrue();
+
+        return vault;
+    }
+
     private static SpelunkLink Link(string? host = "203.0.113.10", Guid? server = null) =>
         new(SpelunkApi, server ?? SpelunkServer, "web 01", host);
 
@@ -338,6 +750,12 @@ public sealed partial class ShellFlowTests
     {
         internal List<(string ApiBase, Guid ServerId, string ApiKey, int Port)> Opened { get; } = [];
 
+        /// <summary>The sign-in key each tunnel was asked for, in order; null for a plain tunnel.</summary>
+        internal List<SpelunkSignIn?> SignIns { get; } = [];
+
+        /// <summary>The account a sign-in answer names.</summary>
+        internal string User { get; set; } = "root";
+
         internal SpelunkTunnelException? Refusal { get; set; }
 
         /// <summary>A close Spelunk sends as soon as the tunnel is open, or null to leave it open.</summary>
@@ -348,9 +766,11 @@ public sealed partial class ShellFlowTests
             Guid serverId,
             string apiKey,
             int port,
+            SpelunkSignIn? signIn,
             CancellationToken cancellationToken)
         {
             Opened.Add((apiBase, serverId, apiKey, port));
+            SignIns.Add(signIn);
 
             if (Refusal is { } refusal)
             {
@@ -364,7 +784,7 @@ public sealed partial class ShellFlowTests
                 await far.CloseOutputAsync((WebSocketCloseStatus)close.Code, close.Reason, cancellationToken);
             }
 
-            return new SpelunkTunnelRoute(RelayBridge.Start(client), port);
+            return new SpelunkTunnelRoute(RelayBridge.Start(client), port, signIn, signIn is null ? null : User);
         }
 
         private static async Task<(WebSocket Client, WebSocket Far)> PairAsync(CancellationToken cancellationToken)

tests/DodoSSH.Client.Domain.Tests/HostFactory.cs

@@ -45,9 +45,12 @@ internal static class HostFactory
     /// <summary>A server's id in Spelunk.</summary>
     internal static Guid SpelunkServer { get; } = Guid.Parse("0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d");
 
-    /// <summary>A route to <see cref="SpelunkServer"/>, with <see cref="SpelunkKey"/>.</summary>
-    internal static SpelunkRoute ThroughSpelunk(string apiBase = "https://api.spelunk.example.com") =>
-        new() { ApiBase = apiBase, ServerId = SpelunkServer, ApiKeyCredentialId = SpelunkKey };
+    /// <summary>
+    /// A route to <see cref="SpelunkServer"/>, with <see cref="SpelunkKey"/> — signing in through Spelunk
+    /// when <paramref name="signIn"/> says so.
+    /// </summary>
+    internal static SpelunkRoute ThroughSpelunk(string apiBase = "https://api.spelunk.example.com", bool signIn = false) =>
+        new() { ApiBase = apiBase, ServerId = SpelunkServer, ApiKeyCredentialId = SpelunkKey, SignInThroughSpelunk = signIn };
 
     /// <remarks>
     /// <paramref name="port"/> defaults to an explicit 22 rather than to null, so a test that says nothing

tests/DodoSSH.Client.Domain.Tests/HostSecretCodecTests.cs

@@ -18,7 +18,8 @@ public sealed class HostSecretCodecTests
     /// "Full" cannot mean every field: the two authentication bindings are mutually exclusive, so a host may
     /// carry a key or a credential and never both, and neither may sit beside <c>AsksForPassword</c>. This
     /// one carries the credential, because that is the newer of the two, plus a group, a pair of tags, a
-    /// pair of pinned paths, a pair of forwards and a Spelunk route — which are orthogonal to the binding and
+    /// pair of pinned paths, a pair of forwards and a Spelunk route that signs in — which are orthogonal to the
+    /// binding (a sign-in leaves a stored binding alone rather than refusing it) and
     /// are what make this host reach the highest schema version a valid host can. The route and the relay are
     /// exclusive in the same way the bindings are, so this carries the newer of those two as well; the relay's
     /// flag has its own tests.
@@ -41,7 +42,7 @@ public sealed class HostSecretCodecTests
             tags: [Pci, EuWest],
             pinnedPaths: ["/var/www/app", "/var/log"],
             portForwards: [Postgres, Socks],
-            spelunk: ThroughSpelunk());
+            spelunk: ThroughSpelunk(signIn: true));
 
         HostSecretCodec.TryDecode(HostSecretCodec.Encode(host), out var document).ShouldBeTrue();
 

tests/DodoSSH.Client.Domain.Tests/SpelunkKeySecretTests.cs

@@ -0,0 +1,131 @@
+using System.Text;
+
+namespace DodoSSH.Client.Domain.Tests;
+
+/// <summary>
+/// A Spelunk key: an API key and the one Spelunk it may be sent to.
+/// </summary>
+/// <remarks>
+/// What these pin is that the pair is stored as it will be compared — the address in its one normal form —
+/// that an address the key could leak across a network from is refused, and that a merge never pairs one
+/// device's key with another device's address.
+/// </remarks>
+public sealed class SpelunkKeySecretTests
+{
+    private const string Api = "https://api.spelunk.example.com";
+
+    [Fact]
+    public void AKey_RoundTrips()
+    {
+        var key = Key();
+
+        SpelunkKeySecretCodec.TryDecode(SpelunkKeySecretCodec.Encode(key), out var document).ShouldBeTrue();
+
+        document.ShouldNotBeNull();
+        document.Key.ShouldBe(key);
+        document.SchemaVersion.ShouldBe(SpelunkKeySecretCodec.CurrentSchemaVersion);
+        document.IsReadOnly.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void AKey_EncodesAtTheBaseVersion()
+    {
+        Encoding.UTF8.GetString(SpelunkKeySecretCodec.Encode(Key()))
+            .ShouldBe(
+                """{"schemaVersion":1,"label":"Spelunk","apiBase":"https://api.spelunk.example.com","apiKey":"spelunk_one"}""");
+    }
+
+    [Theory]
+    [InlineData("https://api.spelunk.example.com/")]
+    [InlineData("HTTPS://API.SPELUNK.EXAMPLE.COM")]
+    public void AnAddressNotInItsNormalForm_IsRefused(string apiBase)
+    {
+        // Stored the one way or not at all: it is compared byte for byte with what a host or a link names.
+        (Key() with { ApiBase = apiBase }).TryValidate(out var reason).ShouldBeFalse();
+        reason.ShouldNotBeNull().ShouldContain("normal form");
+    }
+
+    [Fact]
+    public void PlainHttpAcrossANetwork_IsRefused()
+    {
+        (Key() with { ApiBase = "http://api.spelunk.example.com" }).TryValidate(out var reason).ShouldBeFalse();
+        reason.ShouldNotBeNull().ShouldContain("https");
+    }
+
+    [Fact]
+    public void PlainHttpToThisMachine_IsAllowed()
+    {
+        (Key() with { ApiBase = "http://localhost:5080" }).TryValidate(out _).ShouldBeTrue();
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("spelunk_one\r\nX-Other: header")]
+    public void AKeyThatIsNotAKey_IsRefused(string apiKey)
+    {
+        (Key() with { ApiKey = apiKey }).TryValidate(out _).ShouldBeFalse();
+    }
+
+    [Fact]
+    public void APayloadWithAnAddressOutOfNormalForm_DoesNotDecode()
+    {
+        // The address decides where the key may go, so a payload that disagrees with how every client
+        // writes it is refused rather than normalised into something nobody chose.
+        var payload = Encoding.UTF8.GetBytes(
+            """{"schemaVersion":1,"label":"Spelunk","apiBase":"https://api.spelunk.example.com/","apiKey":"k"}""");
+
+        SpelunkKeySecretCodec.TryDecode(payload, out _).ShouldBeFalse();
+    }
+
+    [Fact]
+    public void AKeyChangedOnOneSide_AndAnAddressOnTheOther_IsKeptAsAPair()
+    {
+        // The case this merge exists for: merging field by field would send the new key to the new address,
+        // a pairing neither device made.
+        var ancestor = Key();
+        var local = ancestor with { ApiKey = "spelunk_two" };
+        var remote = ancestor with { ApiBase = "https://spelunk.other.example" };
+
+        var result = SpelunkKeySecretMerge.Merge(ancestor, local, remote);
+
+        (result.Merged.ApiBase, result.Merged.ApiKey).ShouldBeOneOf(
+            (local.ApiBase, local.ApiKey),
+            (remote.ApiBase, remote.ApiKey));
+
+        var conflict = result.Conflicts.ShouldHaveSingleItem();
+        conflict.Field.ShouldBe(SpelunkKeySecretMerge.PairField);
+    }
+
+    [Fact]
+    public void AKeyReplacedOnBothSides_NeverReachesTheConflictLog()
+    {
+        var ancestor = Key();
+        var local = ancestor with { ApiKey = "spelunk_local_secret" };
+        var remote = ancestor with { ApiKey = "spelunk_remote_secret" };
+
+        var result = SpelunkKeySecretMerge.Merge(ancestor, local, remote);
+
+        var conflict = result.Conflicts.ShouldHaveSingleItem();
+        $"{conflict.Kept} {conflict.Discarded}".ShouldNotContain("secret");
+    }
+
+    [Fact]
+    public void AKeyChangedOnOneSideOnly_IsTakenWithoutAConflict()
+    {
+        var ancestor = Key();
+        var local = ancestor with { ApiKey = "spelunk_two", Label = "renamed" };
+
+        var result = SpelunkKeySecretMerge.Merge(ancestor, local, ancestor);
+
+        result.Merged.ShouldBe(local);
+        result.HasConflicts.ShouldBeFalse();
+    }
+
+    private static SpelunkKeySecret Key() => new()
+    {
+        Label = "Spelunk",
+        ApiBase = Api,
+        ApiKey = "spelunk_one",
+    };
+}

tests/DodoSSH.Client.Domain.Tests/SpelunkRouteTests.cs

@@ -99,7 +99,7 @@ public sealed class SpelunkRouteTests
         document.ShouldNotBeNull();
         document.Host.ShouldBe(host);
         document.SchemaVersion.ShouldBe(HostSecretCodec.SpelunkSchemaVersion);
-        document.SchemaVersion.ShouldBe(HostSecretCodec.CurrentSchemaVersion);
+        document.IsReadOnly.ShouldBeFalse();
     }
 
     [Fact]
@@ -156,10 +156,10 @@ public sealed class SpelunkRouteTests
     public void ARouteWrittenByANewerClient_IsReadOnlyHere()
     {
         // The rule every version before this one relies on, checked from the far side: a build that knows
-        // version 9 reads a version 10 host, shows it, and refuses to re-encode what it cannot represent.
+        // version 10 reads a version 11 host, shows it, and refuses to re-encode what it cannot represent.
         var payload = Encoding.UTF8.GetBytes(
             """
-            {"schemaVersion":10,"label":"prod-db","hostname":"db.internal","port":22,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c"},"somethingNewer":true}
+            {"schemaVersion":11,"label":"prod-db","hostname":"db.internal","port":22,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c"},"somethingNewer":true}
             """);
 
         HostSecretCodec.TryDecode(payload, out var document).ShouldBeTrue();
@@ -168,6 +168,108 @@ public sealed class SpelunkRouteTests
         document.Host.Spelunk.ShouldBe(ThroughSpelunk());
     }
 
+    // ---- Signing in through Spelunk ----
+
+    [Fact]
+    public void AHostSpelunkSignsInTo_IsValid_WithNoLoginOfItsOwn()
+    {
+        // No username, no key, no credential, no typed password: Spelunk names the account and makes the key.
+        var host = Host(username: null, spelunk: ThroughSpelunk(signIn: true));
+
+        host.TryValidate(out var reason).ShouldBeTrue(reason);
+        host.SignsInThroughSpelunk.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void AHostSpelunkSignsInTo_KeepsALoginItStillCarries()
+    {
+        // Left alone rather than refused: it is the host's answer for the day the box is unticked, and a
+        // merge of one machine ticking it with another binding a key must still decode.
+        Host(sshKeyId: Guid.CreateVersion7(), spelunk: ThroughSpelunk(signIn: true))
+            .TryValidate(out var reason)
+            .ShouldBeTrue(reason);
+    }
+
+    [Fact]
+    public void AHostReachedThroughSpelunkWithoutSigningIn_DoesNotSignIn()
+    {
+        Host(spelunk: ThroughSpelunk()).SignsInThroughSpelunk.ShouldBeFalse();
+        Host().SignsInThroughSpelunk.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void ASignIn_RoundTrips_AtTheVersionThatIntroducedIt()
+    {
+        var host = Host(username: null, spelunk: ThroughSpelunk(signIn: true));
+
+        HostSecretCodec.TryDecode(HostSecretCodec.Encode(host), out var document).ShouldBeTrue();
+
+        document.ShouldNotBeNull();
+        document.Host.ShouldBe(host);
+        document.Host.Spelunk.ShouldNotBeNull().SignInThroughSpelunk.ShouldBeTrue();
+        document.SchemaVersion.ShouldBe(HostSecretCodec.SpelunkSignInSchemaVersion);
+        document.SchemaVersion.ShouldBe(HostSecretCodec.CurrentSchemaVersion);
+        document.IsReadOnly.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void ASignIn_IsWrittenInsideTheRoute_AndOnlyWhenOn()
+    {
+        var bytes = HostSecretCodec.Encode(Host(username: null, notes: null, spelunk: ThroughSpelunk(signIn: true)));
+
+        Encoding.UTF8.GetString(bytes).ShouldBe(
+            """
+            {"schemaVersion":10,"label":"prod-db","hostname":"db.internal","port":22,"jumpHostIds":[],"options":{},"relayEnabled":false,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c","signIn":true}}
+            """);
+    }
+
+    [Fact]
+    public void ARouteWrittenBeforeSignIn_DecodesAsNotSigningIn_AndStaysEditable()
+    {
+        var payload = Encoding.UTF8.GetBytes(
+            """
+            {"schemaVersion":9,"label":"prod-db","hostname":"db.internal","port":22,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c"}}
+            """);
+
+        HostSecretCodec.TryDecode(payload, out var document).ShouldBeTrue();
+
+        document.ShouldNotBeNull().Host.Spelunk.ShouldBe(ThroughSpelunk());
+        document.Host.SignsInThroughSpelunk.ShouldBeFalse();
+        document.IsReadOnly.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void ASignInWrittenAsFalse_ReadsAsTheRouteWithout()
+    {
+        // One state, one spelling — the merge would otherwise see a change nobody made.
+        var payload = Encoding.UTF8.GetBytes(
+            """
+            {"schemaVersion":10,"label":"prod-db","hostname":"db.internal","port":22,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c","signIn":false}}
+            """);
+
+        HostSecretCodec.TryDecode(payload, out var document).ShouldBeTrue();
+
+        document.ShouldNotBeNull().Host.Spelunk.ShouldBe(ThroughSpelunk());
+    }
+
+    [Fact]
+    public void TickingSignIn_MergesAsPartOfTheOneRoute()
+    {
+        var ancestor = Host(spelunk: ThroughSpelunk());
+        var local = ancestor with { Spelunk = ThroughSpelunk(signIn: true) };
+        var remote = ancestor with { Spelunk = ThroughSpelunk() with { ServerId = Guid.CreateVersion7() } };
+
+        // Alone, the tick arrives.
+        HostSecretMerge.Merge(ancestor, local, ancestor).Merged.ShouldBe(local);
+
+        // Beside a different edit to the route, the route is still one value: one side wins whole, with the
+        // other reported, rather than a sign-in to a server nobody chose it for.
+        var result = HostSecretMerge.Merge(ancestor, local, remote);
+
+        result.Merged.Spelunk.ShouldBe(remote.Spelunk);
+        result.Conflicts.ShouldHaveSingleItem().Field.ShouldBe(nameof(HostSecret.Spelunk));
+    }
+
     // ---- The merge ----
 
     [Fact]

tests/DodoSSH.Client.Session.Tests/SpelunkTunnelTests.cs

@@ -205,7 +205,7 @@ public sealed class SpelunkTunnelTests : IAsyncLifetime
     public async Task AKeyWithALineBreakInTheMiddle_IsRefusedBeforeAnythingIsSent()
     {
         var refusal = await Should.ThrowAsync<SpelunkTunnelException>(
-            new SpelunkTunnel().OpenAsync(spelunk.ApiBase, ServerId, "spelunk_abc\ndef", 22, Token));
+            new SpelunkTunnel().OpenAsync(spelunk.ApiBase, ServerId, "spelunk_abc\ndef", 22, signIn: null, Token));
 
         refusal.Message.ShouldContain("does not hold one");
         spelunk.Requests.ShouldBeEmpty();
@@ -215,7 +215,7 @@ public sealed class SpelunkTunnelTests : IAsyncLifetime
     public async Task AKeyPastedWithANewline_IsTrimmed()
     {
         await using var route = await new SpelunkTunnel()
-            .OpenAsync(spelunk.ApiBase, ServerId, ApiKey + "\r\n", 22, Token);
+            .OpenAsync(spelunk.ApiBase, ServerId, ApiKey + "\r\n", 22, signIn: null, Token);
 
         spelunk.Requests[0].Headers["Authorization"].ShouldBe($"Bearer {ApiKey}");
     }
@@ -230,11 +230,130 @@ public sealed class SpelunkTunnelTests : IAsyncLifetime
         closed.Stop();
 
         var refusal = await Should.ThrowAsync<SpelunkTunnelException>(
-            new SpelunkTunnel().OpenAsync($"http://127.0.0.1:{port}", ServerId, ApiKey, 22, Token));
+            new SpelunkTunnel().OpenAsync($"http://127.0.0.1:{port}", ServerId, ApiKey, 22, signIn: null, Token));
 
         refusal.Message.ShouldContain($"could not be reached at http://127.0.0.1:{port}");
     }
 
+    // ---- Signing in through Spelunk ----
+
+    [Fact]
+    public async Task ASignIn_SendsThePublicKeyAndNoPort_AndLogsInAsTheAccountSpelunkNames()
+    {
+        spelunk.OnTicket = SignedInAs("root");
+        var signIn = SpelunkSignIn.Create();
+
+        await using var route = await spelunk.ApiBase.OpenAsync(port: 22, signIn);
+
+        // The one-line OpenSSH public key and nothing else: the port means nothing beside a key.
+        // Read as JSON rather than compared as text: the serialiser escapes base64's '+' as +, which is
+        // the same string to anything that parses it.
+        using (var body = System.Text.Json.JsonDocument.Parse(spelunk.Requests[0].Body))
+        {
+            body.RootElement.EnumerateObject().Select(property => property.Name).ShouldBe(["signIn"]);
+            var sent = body.RootElement.GetProperty("signIn");
+            sent.EnumerateObject().Select(property => property.Name).ShouldBe(["publicKey"]);
+            sent.GetProperty("publicKey").GetString().ShouldBe(signIn.PublicKeyLine);
+        }
+
+        signIn.PublicKeyLine.ShouldStartWith("ssh-ed25519 AAAA");
+
+        // The same key comes back with the route, for the connection made through it, under Spelunk's account.
+        route.SignIn.ShouldBeSameAs(signIn);
+        route.User.ShouldBe("root");
+
+        // And the socket is spent exactly as a plain tunnel's is.
+        spelunk.Requests[1].Headers["Sec-WebSocket-Protocol"].ShouldBe($"spelunk.tunnel.v1, ticket.{FakeSpelunk.Ticket}");
+    }
+
+    [Fact]
+    public async Task ASignInAnswerNamingNoAccount_LogsInAsRoot()
+    {
+        await using var route = await spelunk.ApiBase.OpenAsync(port: 22, SpelunkSignIn.Create());
+
+        route.User.ShouldBe(SpelunkSignIn.DefaultUser);
+    }
+
+    [Fact]
+    public async Task APlainTunnel_HasNoSignIn_WhateverTheAnswerSays()
+    {
+        spelunk.OnTicket = SignedInAs("root");
+
+        await using var route = await OpenAsync();
+
+        route.SignIn.ShouldBeNull();
+        route.User.ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData("root; rm -rf /")]
+    [InlineData("root\\nsomeone")]
+    [InlineData("")]
+    public async Task ASignInAnswerNamingSomethingThatIsNotAnAccount_IsRefused(string user)
+    {
+        spelunk.OnTicket = SignedInAs(user);
+
+        var refusal = await Should.ThrowAsync<SpelunkTunnelException>(
+            spelunk.ApiBase.OpenAsync(port: 22, SpelunkSignIn.Create()));
+
+        refusal.Message.ShouldContain("does not understand");
+        spelunk.Requests.ShouldHaveSingleItem();
+    }
+
+    [Fact]
+    public async Task AKeySpelunkWillNotTake_IsExplainedInItsWords()
+    {
+        spelunk.OnTicket = _ => new FakeSpelunk.Answer(
+            HttpStatusCode.BadRequest,
+            "application/problem+json",
+            """{"title":"One or more validation errors occurred.","status":400,"errors":{"publicKey":["The public key must be an ssh-ed25519 key."]}}""");
+
+        var refusal = await Should.ThrowAsync<SpelunkTunnelException>(
+            spelunk.ApiBase.OpenAsync(port: 22, SpelunkSignIn.Create()));
+
+        refusal.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        refusal.Message.ShouldContain("would not accept");
+        refusal.Message.ShouldContain("must be an ssh-ed25519 key");
+        spelunk.Requests.ShouldHaveSingleItem();
+    }
+
+    [Theory]
+    [InlineData("no OpenSSH server on this machine", "could not sign you in on this server (no OpenSSH server on this machine)")]
+    [InlineData("Unknown stream kind: signIn", "too old to sign you in")]
+    public async Task AnAgentThatCouldNotSignIn_SaysSo(string reason, string explanation)
+    {
+        spelunk.OnTunnel = socket =>
+            socket.CloseOutputAsync((WebSocketCloseStatus)4502, reason, CancellationToken.None);
+
+        var route = await spelunk.ApiBase.OpenAsync(port: 22, SpelunkSignIn.Create());
+
+        await EndOfStreamAsync(route);
+
+        route.Failure.ShouldNotBeNull().ShouldContain(explanation);
+    }
+
+    [Fact]
+    public void ASignInKey_IsNewEachTime_AndNeverPrinted()
+    {
+        var first = SpelunkSignIn.Create();
+        var second = SpelunkSignIn.Create();
+
+        first.PublicKeyLine.ShouldNotBe(second.PublicKeyLine);
+        first.PublicKeyLine.Split(' ').Length.ShouldBe(3);
+        first.Credential.Passphrase.ShouldBeNull();
+        Encoding.UTF8.GetString(first.Credential.PrivateKeyPem).ShouldStartWith("-----BEGIN OPENSSH PRIVATE KEY-----");
+
+        first.ToString().ShouldNotContain("AAAA");
+        first.ToString().ShouldNotContain("PRIVATE");
+    }
+
+    /// <summary>A ticket answer for a sign-in, naming the account it logs in as.</summary>
+    private static Func<FakeSpelunk.Request, FakeSpelunk.Answer> SignedInAs(string user) => request => FakeSpelunk.Answer.Json(
+        HttpStatusCode.OK,
+        $$"""
+        {"ticket":"{{FakeSpelunk.Ticket}}","expiresAt":"2026-09-28T12:00:30Z","path":"{{request.Path.Replace("tunnel-tickets", "tunnel", StringComparison.Ordinal)}}","subprotocol":"spelunk.tunnel.v1","user":"{{user}}"}
+        """);
+
     private Task<SpelunkTunnelRoute> OpenAsync() => spelunk.ApiBase.OpenAsync(port: 22);
 
     /// <summary>Speaks SOCKS5 to the bridge as SSH.NET would, and hands back the open stream.</summary>
@@ -273,11 +392,12 @@ public sealed class SpelunkTunnelTests : IAsyncLifetime
 /// <summary>Opens a tunnel to the test server with the one key and server the suite uses.</summary>
 file static class Opening
 {
-    internal static Task<SpelunkTunnelRoute> OpenAsync(this string apiBase, int port) =>
+    internal static Task<SpelunkTunnelRoute> OpenAsync(this string apiBase, int port, SpelunkSignIn? signIn = null) =>
         new SpelunkTunnel().OpenAsync(
             apiBase,
             Guid.Parse("0192f0c8-bbbb-7c3d-8e4f-5a6b7c8d9e0b"),
             "spelunk_0123456789abcdefghijklmnopqrstuvwxyzABCDEFG",
             port,
+            signIn,
             TestContext.Current.CancellationToken);
 }

tests/DodoSSH.Client.Storage.Tests/CacheStoreTests.cs

@@ -420,6 +420,7 @@ public sealed class CacheStoreTests : IAsyncLifetime
     [InlineData(SyncEntityType.ConnectionLogEntry)]
     [InlineData(SyncEntityType.ActivityLogEntry)]
     [InlineData(SyncEntityType.ObjectStore)]
+    [InlineData(SyncEntityType.SpelunkKey)]
     public async Task AConflict_CanBeRecordedForEveryKindOfItem(SyncEntityType entityType)
     {
         var detail = System.Text.Encoding.UTF8.GetBytes($$"""{"kind":"{{entityType}}"}""");

tests/DodoSSH.Client.Sync.Tests/AadResourceTypeTests.cs

@@ -43,6 +43,7 @@ public sealed class AadResourceTypeTests
     [InlineData(SyncEntityType.ConnectionLogEntry, CryptoSpec.AadResourceType.ConnectionLogEntry)]
     [InlineData(SyncEntityType.ActivityLogEntry, CryptoSpec.AadResourceType.ActivityLogEntry)]
     [InlineData(SyncEntityType.ObjectStore, CryptoSpec.AadResourceType.ObjectStore)]
+    [InlineData(SyncEntityType.SpelunkKey, CryptoSpec.AadResourceType.SpelunkKey)]
     public void TheTwoEnums_AreNamedAlikeAndNumberedDifferently(
         SyncEntityType wire,
         CryptoSpec.AadResourceType resource)
@@ -77,6 +78,7 @@ public sealed class AadResourceTypeTests
         (SyncEntityType.ConnectionLogEntry, CryptoSpec.AadResourceType.ConnectionLogEntry),
         (SyncEntityType.ActivityLogEntry, CryptoSpec.AadResourceType.ActivityLogEntry),
         (SyncEntityType.ObjectStore, CryptoSpec.AadResourceType.ObjectStore),
+        (SyncEntityType.SpelunkKey, CryptoSpec.AadResourceType.SpelunkKey),
     ];
 
     public static TheoryData<SyncEntityType, CryptoSpec.AadResourceType> Pinned
@@ -253,6 +255,10 @@ public sealed class AadResourceTypeTests
             SyncEntityType.ObjectStore => ObjectStoreCipher.Seal(
                 NewBucket(), vaultKey, entityId, generation, version),
 
+            // 14 on the wire and 17 here, and 14 here is a connection log entry.
+            SyncEntityType.SpelunkKey => SpelunkKeyCipher.Seal(
+                NewSpelunkKey(), vaultKey, entityId, generation, version),
+
             _ => throw new ArgumentOutOfRangeException(
                 nameof(wire),
                 wire,
@@ -413,6 +419,13 @@ public sealed class AadResourceTypeTests
         Region = "eu-west-1",
     };
 
+    private static SpelunkKeySecret NewSpelunkKey() => new()
+    {
+        Label = "Spelunk at api.spelunk.example.com",
+        ApiBase = "https://api.spelunk.example.com",
+        ApiKey = "spelunk_an_example_key",
+    };
+
     private static HostGroupSecret NewGroup() => new() { Label = "production" };
 
     private static TagSecret NewTag() => new() { Label = "pci" };

tests/DodoSSH.Client.Sync.Tests/ItemKindsTests.cs

@@ -30,6 +30,7 @@ public sealed class ItemKindsTests
             SyncEntityType.ConnectionLogEntry,
             SyncEntityType.ActivityLogEntry,
             SyncEntityType.ObjectStore,
+            SyncEntityType.SpelunkKey,
         ]);
     }
 

tests/DodoSSH.Crypto.Tests/CryptoSpecTests.cs

@@ -96,6 +96,7 @@ public sealed class CryptoSpecTests
     [InlineData(CryptoSpec.AadResourceType.ConnectionLogEntry, 14)]
     [InlineData(CryptoSpec.AadResourceType.ActivityLogEntry, 15)]
     [InlineData(CryptoSpec.AadResourceType.ObjectStore, 16)]
+    [InlineData(CryptoSpec.AadResourceType.SpelunkKey, 17)]
     public void AadResourceType_HasStableWireValue(CryptoSpec.AadResourceType type, int expected)
     {
         ((int)type).ShouldBe(expected);