feat: focus search bar on startup by default

The search input is now focused when the TUI opens, so filtering works
immediately without an extra keystroke. This is especially helpful with
many hosts.

Removes the now-redundant -s/--search flag and updates the docs.

README.md

@@ -30,7 +30,7 @@ SSHM is a beautiful command-line tool that transforms how you manage and connect
 - **⚡ Quick Connect** - Connect to any host instantly through the TUI or the CLI with `sshm <host>`
 - **🔄 Port Forwarding** - Easy setup for Local, Remote, and Dynamic (SOCKS) forwarding with history persistence
 - **📝 Easy Management** - Add, edit, move, and manage SSH configurations seamlessly
-- **🏷️ Tag Support** - Organize your hosts with custom tags for better categorization
+- **🏷️ Tag Support** - Organize your hosts with custom tags for better categorization; use the special `hidden` tag to exclude hosts from the list while keeping them connectable
 - **🔍 Smart Search** - Find hosts quickly with built-in filtering and search
 - **📝 Real-time Status** - Live SSH connectivity indicators with asynchronous ping checks and color-coded status
 - **🔔 Smart Updates** - Automatic version checking with update notifications
@@ -106,8 +106,9 @@ sshm
 - `d` - Delete selected host
 - `m` - Move host to another config file (requires SSH Include directives)
 - `f` - Port forwarding setup
+- `H` - Toggle hidden hosts visibility
 - `q` - Quit
-- `/` - Search/filter hosts
+- `/` - Focus the search bar (already focused at startup; press `Enter` to jump back to the host list)
 
 **Real-time Status Indicators:**
 - 🟢 **Online** - Host is reachable via SSH
@@ -268,13 +269,40 @@ sshm move my-server -c /path/to/custom/ssh_config
 # Search for hosts (interactive filter)
 sshm search
 
-# Show version information (includes update check)
+# Print machine-readable info (JSON) for scripting
+sshm info prod-server
+sshm info prod-server --pretty
+
+# With a custom SSH config file
+sshm -c /path/to/custom/ssh_config info prod-server
+
+# Pipe to jq
+sshm info prod-server | jq -r '.result.target.hostname'
+sshm info prod-server | jq -r '.result.target.user'
+
+# Show version information
 sshm --version
 
+# Disable automatic update check (useful on air-gapped machines)
+sshm --no-update-check
+
 # Show help and available commands
 sshm --help
 ```
 
+### Host Info (JSON)
+
+`sshm info <hostname>` prints a single JSON object to stdout so you can script against it with `jq`.
+
+```bash
+# Extract fields
+sshm info prod-server | jq -r '.result.target.hostname'
+sshm info prod-server | jq -r '.result.target.port'
+
+# Check not-found (exit code 2)
+sshm info does-not-exist | jq -r '.error.code'
+```
+
 ### Shell Completion
 
 SSHM supports shell completion for host names, making it easy to connect to hosts without typing full names:
@@ -475,17 +503,31 @@ SSHM features asynchronous SSH connectivity checking that provides visual indica
 SSHM includes built-in version checking that notifies you of available updates:
 
 **Features:**
-- **Background checking** - Version check happens asynchronously
+- **Background checking** - Version check happens asynchronously, never blocking startup
 - **Release notifications** - Clear indicators when updates are available
 - **Pre-release detection** - Identifies beta and development versions
 - **GitHub integration** - Direct links to release pages
 - **Non-intrusive** - Updates don't interrupt your workflow
+- **Configurable** - Can be disabled for air-gapped or offline environments
 
 **Update notifications appear:**
 - In the main TUI interface as a subtle notification
-- In the `sshm --version` command output
 - Only when a newer stable version is available
 
+**Disabling update checks:**
+
+Via the CLI flag (one-time):
+```bash
+sshm --no-update-check
+```
+
+Via `~/.config/sshm/config.json` (persistent):
+```json
+{
+  "check_for_updates": false
+}
+```
+
 #### Port Forwarding History
 
 SSHM remembers your port forwarding configurations for easy reuse:
@@ -606,7 +648,7 @@ SSHM supports all standard SSH configuration options:
 - `IdentityFile` - Path to private key file
 - `ProxyJump` - Jump server for connection tunneling (e.g., `user@jumphost:port`)
 - `ProxyCommand` - Jump command for connection tunneling (e.g, `ssh -W %h:%p Jumphost`)
-- `Tags` - Custom tags (SSHM extension)
+- `Tags` - Custom tags (SSHM extension); the special tag `hidden` hides the host from the TUI and `sshm search` while keeping it connectable via `sshm <host>`
 
 **Additional SSH Options:**
 You can add any valid SSH option using the "SSH Options" field in the interactive forms. Enter them in command-line format (e.g., `-o Compression=yes -o ServerAliveInterval=60`) and SSHM will automatically convert them to the proper SSH config format.
@@ -639,9 +681,9 @@ This will be automatically converted to:
     StrictHostKeyChecking no
 ```
 
-### Custom Key Bindings
+### Application Configuration
 
-SSHM supports customizable key bindings through a configuration file. This is particularly useful for users who want to modify the default quit behavior.
+SSHM supports a configuration file to customize its behavior, including key bindings and update checking.
 
 **Configuration File Location:**
 - **Linux/macOS**: `~/.config/sshm/config.json`
@@ -650,6 +692,7 @@ SSHM supports customizable key bindings through a configuration file. This is pa
 **Example Configuration:**
 ```json
 {
+  "check_for_updates": false,
   "key_bindings": {
     "quit_keys": ["q", "ctrl+c"],
     "disable_esc_quit": true
@@ -658,12 +701,16 @@ SSHM supports customizable key bindings through a configuration file. This is pa
 ```
 
 **Available Options:**
+- **check_for_updates**: Boolean to enable or disable the automatic update check at startup. Default: `true`. Set to `false` on air-gapped or offline machines to avoid connection delays.
 - **quit_keys**: Array of keys that will quit the application. Default: `["q", "ctrl+c"]`
 - **disable_esc_quit**: Boolean flag to disable ESC key from quitting the application. Default: `false`
 
 **For Vim Users:**
 If you frequently press ESC accidentally causing the application to quit, set `disable_esc_quit` to `true`. This will disable ESC as a quit key while preserving all other functionality.
 
+**For Air-gapped Machines:**
+If SSHM is slow to start due to DNS timeouts when reaching GitHub, set `check_for_updates` to `false`. You can also use the `--no-update-check` CLI flag for a one-time override without editing the config file.
+
 **Default Configuration:**
 If no configuration file exists, SSHM will automatically create one with default settings that maintain backward compatibility.
 

cmd/info.go

@@ -0,0 +1,199 @@
+package cmd
+
+import (
+	"encoding/json"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/Gu1llaum-3/sshm/internal/config"
+
+	"github.com/spf13/cobra"
+)
+
+type infoResponse struct {
+	Schema   string      `json:"schema"`
+	OK       bool        `json:"ok"`
+	Hostname string      `json:"hostname"`
+	Result   *infoResult `json:"result"`
+	Error    *infoError  `json:"error"`
+}
+
+type infoResult struct {
+	CanonicalName string      `json:"canonical_name"`
+	Target        infoTarget  `json:"target"`
+	IdentityFile  *string     `json:"identity_file"`
+	ProxyJump     *string     `json:"proxy_jump"`
+	ProxyCommand  *string     `json:"proxy_command"`
+	Options       *string     `json:"options"`
+	Tags          []string    `json:"tags"`
+	RemoteCommand *string     `json:"remote_command"`
+	RequestTTY    *string     `json:"request_tty"`
+	Source        *infoSource `json:"source"`
+}
+
+type infoTarget struct {
+	Host     string  `json:"host"`
+	Hostname *string `json:"hostname"`
+	User     *string `json:"user"`
+	Port     *int    `json:"port"`
+}
+
+type infoSource struct {
+	File string `json:"file"`
+	Line int    `json:"line"`
+}
+
+type infoError struct {
+	Code    string          `json:"code"`
+	Message string          `json:"message"`
+	Details json.RawMessage `json:"details"`
+}
+
+func maybeString(v string) *string {
+	trimmed := strings.TrimSpace(v)
+	if trimmed == "" {
+		return nil
+	}
+	return &trimmed
+}
+
+func maybePort(v string) (*int, error) {
+	trimmed := strings.TrimSpace(v)
+	if trimmed == "" {
+		return nil, nil
+	}
+	port, err := strconv.Atoi(trimmed)
+	if err != nil {
+		return nil, err
+	}
+	return &port, nil
+}
+
+func writeInfoJSON(out io.Writer, pretty bool, resp infoResponse) {
+	var b []byte
+	var err error
+	if pretty {
+		b, err = json.MarshalIndent(resp, "", "  ")
+	} else {
+		b, err = json.Marshal(resp)
+	}
+	if err != nil {
+		_, _ = io.WriteString(out, `{"schema":"sshm.info.v1","ok":false,"hostname":"","result":null,"error":{"code":"INTERNAL","message":"failed to marshal JSON","details":null}}\n`)
+		return
+	}
+	_, _ = out.Write(append(b, '\n'))
+}
+
+func runInfo(out io.Writer, hostnameArg string, cfgFile string, pretty bool) int {
+	resp := infoResponse{
+		Schema:   "sshm.info.v1",
+		OK:       false,
+		Hostname: hostnameArg,
+		Result:   nil,
+		Error:    nil,
+	}
+
+	var host *config.SSHHost
+	var err error
+	if cfgFile != "" {
+		host, err = config.GetSSHHostFromFile(hostnameArg, cfgFile)
+	} else {
+		host, err = config.GetSSHHost(hostnameArg)
+	}
+	if err != nil {
+		code := 1
+		errCode := "CONFIG_ERROR"
+		msg := err.Error()
+		if strings.Contains(msg, "not found") {
+			code = 2
+			errCode = "NOT_FOUND"
+		}
+
+		resp.Error = &infoError{Code: errCode, Message: msg, Details: nil}
+		writeInfoJSON(out, pretty, resp)
+		return code
+	}
+
+	port, portErr := maybePort(host.Port)
+	if portErr != nil {
+		resp.Error = &infoError{Code: "CONFIG_ERROR", Message: "invalid port in host configuration", Details: nil}
+		writeInfoJSON(out, pretty, resp)
+		return 1
+	}
+
+	res := infoResult{
+		CanonicalName: host.Name,
+		Target: infoTarget{
+			Host:     hostnameArg,
+			Hostname: maybeString(host.Hostname),
+			User:     maybeString(host.User),
+			Port:     port,
+		},
+		IdentityFile:  maybeString(host.Identity),
+		ProxyJump:     maybeString(host.ProxyJump),
+		ProxyCommand:  maybeString(host.ProxyCommand),
+		Options:       maybeString(host.Options),
+		Tags:          host.Tags,
+		RemoteCommand: maybeString(host.RemoteCommand),
+		RequestTTY:    maybeString(host.RequestTTY),
+		Source: &infoSource{
+			File: host.SourceFile,
+			Line: host.LineNumber,
+		},
+	}
+
+	resp.OK = true
+	resp.Result = &res
+	writeInfoJSON(out, pretty, resp)
+	return 0
+}
+
+var infoPretty bool
+
+var infoCmd = &cobra.Command{
+	Use:           "info <hostname>",
+	Short:         "Print machine-readable information about a host",
+	Long:          "Print machine-readable information (JSON) about a configured SSH host.",
+	Args:          cobra.ExactArgs(1),
+	SilenceUsage:  true,
+	SilenceErrors: true,
+	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		if len(args) != 0 {
+			return nil, cobra.ShellCompDirectiveNoFileComp
+		}
+
+		var hosts []config.SSHHost
+		var err error
+		if configFile != "" {
+			hosts, err = config.ParseSSHConfigFile(configFile)
+		} else {
+			hosts, err = config.ParseSSHConfig()
+		}
+		if err != nil {
+			return nil, cobra.ShellCompDirectiveError
+		}
+
+		var completions []string
+		toCompleteLower := strings.ToLower(toComplete)
+		for _, host := range hosts {
+			if strings.HasPrefix(strings.ToLower(host.Name), toCompleteLower) {
+				completions = append(completions, host.Name)
+			}
+		}
+		return completions, cobra.ShellCompDirectiveNoFileComp
+	},
+	RunE: func(cmd *cobra.Command, args []string) error {
+		exitCode := runInfo(cmd.OutOrStdout(), args[0], configFile, infoPretty)
+		if exitCode != 0 {
+			os.Exit(exitCode)
+		}
+		return nil
+	},
+}
+
+func init() {
+	infoCmd.Flags().BoolVar(&infoPretty, "pretty", false, "Pretty-print JSON output")
+	RootCmd.AddCommand(infoCmd)
+}

cmd/info_test.go

@@ -0,0 +1,321 @@
+package cmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+type infoResponseForTest struct {
+	Schema   string             `json:"schema"`
+	OK       bool               `json:"ok"`
+	Hostname string             `json:"hostname"`
+	Result   *infoResultForTest `json:"result"`
+	Error    *infoErrorForTest  `json:"error"`
+}
+
+type infoResultForTest struct {
+	CanonicalName string             `json:"canonical_name"`
+	Target        infoTargetForTest  `json:"target"`
+	IdentityFile  *string            `json:"identity_file"`
+	ProxyJump     *string            `json:"proxy_jump"`
+	ProxyCommand  *string            `json:"proxy_command"`
+	Options       *string            `json:"options"`
+	Tags          []string           `json:"tags"`
+	RemoteCommand *string            `json:"remote_command"`
+	RequestTTY    *string            `json:"request_tty"`
+	Source        *infoSourceForTest `json:"source"`
+}
+
+type infoTargetForTest struct {
+	Host     string  `json:"host"`
+	Hostname *string `json:"hostname"`
+	User     *string `json:"user"`
+	Port     *int    `json:"port"`
+}
+
+type infoSourceForTest struct {
+	File string `json:"file"`
+	Line int    `json:"line"`
+}
+
+type infoErrorForTest struct {
+	Code    string          `json:"code"`
+	Message string          `json:"message"`
+	Details json.RawMessage `json:"details"`
+}
+
+func TestInfoCommandConfig(t *testing.T) {
+	if infoCmd.Use != "info <hostname>" {
+		t.Fatalf("infoCmd.Use=%q", infoCmd.Use)
+	}
+
+	err := infoCmd.Args(infoCmd, []string{})
+	if err == nil {
+		t.Fatalf("expected args error for no args")
+	}
+
+	err = infoCmd.Args(infoCmd, []string{"one", "two"})
+	if err == nil {
+		t.Fatalf("expected args error for too many args")
+	}
+
+	err = infoCmd.Args(infoCmd, []string{"host"})
+	if err != nil {
+		t.Fatalf("expected no args error, got %v", err)
+	}
+}
+
+func TestInfoCommandRegistration(t *testing.T) {
+	found := false
+	for _, c := range RootCmd.Commands() {
+		if c.Name() == "info" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("info command not registered")
+	}
+}
+
+func TestRunInfoSuccessJSON(t *testing.T) {
+	tempDir := t.TempDir()
+	cfg := filepath.Join(tempDir, "config")
+
+	cfgContent := `# Tags: prod, web
+Host prod-web
+    HostName 10.0.0.10
+    User deploy
+    Port 2222
+    IdentityFile ~/.ssh/id_prod
+    ProxyJump bastion
+    ServerAliveInterval 60
+`
+
+	if err := os.WriteFile(cfg, []byte(cfgContent), 0600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	buf := new(bytes.Buffer)
+	exitCode := runInfo(buf, "prod-web", cfg, false)
+	if exitCode != 0 {
+		t.Fatalf("exitCode=%d", exitCode)
+	}
+
+	out := buf.String()
+	if strings.TrimSpace(out) == "" {
+		t.Fatalf("expected output")
+	}
+
+	var resp infoResponseForTest
+	if err := json.Unmarshal([]byte(out), &resp); err != nil {
+		t.Fatalf("output not JSON: %v\noutput=%q", err, out)
+	}
+
+	if resp.Schema != "sshm.info.v1" {
+		t.Fatalf("schema=%q", resp.Schema)
+	}
+	if !resp.OK {
+		t.Fatalf("ok=false")
+	}
+	if resp.Result == nil {
+		t.Fatalf("result is nil")
+	}
+	if resp.Error != nil {
+		t.Fatalf("error is non-nil")
+	}
+
+	if resp.Result.CanonicalName != "prod-web" {
+		t.Fatalf("canonical_name=%q", resp.Result.CanonicalName)
+	}
+	if resp.Result.Target.Host != "prod-web" {
+		t.Fatalf("target.host=%q", resp.Result.Target.Host)
+	}
+	if resp.Result.Target.Hostname == nil || *resp.Result.Target.Hostname != "10.0.0.10" {
+		t.Fatalf("target.hostname=%v", resp.Result.Target.Hostname)
+	}
+	if resp.Result.Target.User == nil || *resp.Result.Target.User != "deploy" {
+		t.Fatalf("target.user=%v", resp.Result.Target.User)
+	}
+	if resp.Result.Target.Port == nil || *resp.Result.Target.Port != 2222 {
+		t.Fatalf("target.port=%v", resp.Result.Target.Port)
+	}
+	if resp.Result.Source == nil || resp.Result.Source.File == "" || resp.Result.Source.Line == 0 {
+		t.Fatalf("source missing: %#v", resp.Result.Source)
+	}
+	if resp.Result.IdentityFile == nil || *resp.Result.IdentityFile != "~/.ssh/id_prod" {
+		t.Fatalf("identity_file=%v", resp.Result.IdentityFile)
+	}
+	if resp.Result.ProxyJump == nil || *resp.Result.ProxyJump != "bastion" {
+		t.Fatalf("proxy_jump=%v", resp.Result.ProxyJump)
+	}
+}
+
+func TestRunInfoNotFoundJSON(t *testing.T) {
+	tempDir := t.TempDir()
+	cfg := filepath.Join(tempDir, "config")
+	cfgContent := `Host known
+    HostName example.com
+`
+	if err := os.WriteFile(cfg, []byte(cfgContent), 0600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	buf := new(bytes.Buffer)
+	exitCode := runInfo(buf, "missing", cfg, false)
+	if exitCode != 2 {
+		t.Fatalf("exitCode=%d", exitCode)
+	}
+
+	var resp infoResponseForTest
+	if err := json.Unmarshal(buf.Bytes(), &resp); err != nil {
+		t.Fatalf("output not JSON: %v", err)
+	}
+	if resp.OK {
+		t.Fatalf("ok=true")
+	}
+	if resp.Error == nil {
+		t.Fatalf("error is nil")
+	}
+	if resp.Error.Code != "NOT_FOUND" {
+		t.Fatalf("error.code=%q", resp.Error.Code)
+	}
+}
+
+func TestRunInfoPrettyJSON(t *testing.T) {
+	tempDir := t.TempDir()
+	cfg := filepath.Join(tempDir, "config")
+	cfgContent := `Host known
+    HostName 127.0.0.1
+`
+	if err := os.WriteFile(cfg, []byte(cfgContent), 0600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	buf := new(bytes.Buffer)
+	exitCode := runInfo(buf, "known", cfg, true)
+	if exitCode != 0 {
+		t.Fatalf("exitCode=%d", exitCode)
+	}
+
+	out := buf.String()
+	if !strings.Contains(out, "\n") {
+		t.Fatalf("expected pretty output")
+	}
+
+	var resp infoResponseForTest
+	if err := json.Unmarshal(buf.Bytes(), &resp); err != nil {
+		t.Fatalf("output not JSON: %v", err)
+	}
+	if !resp.OK {
+		t.Fatalf("ok=false")
+	}
+}
+
+func TestInfoValidArgsFunction(t *testing.T) {
+	if infoCmd.ValidArgsFunction == nil {
+		t.Fatalf("expected ValidArgsFunction to be set on infoCmd")
+	}
+}
+
+func TestInfoValidArgsFunctionWithSSHConfig(t *testing.T) {
+	tmpDir := t.TempDir()
+	testConfigFile := filepath.Join(tmpDir, "config")
+
+	sshConfig := `Host prod-server
+    HostName 192.168.1.1
+    User admin
+
+Host dev-server
+    HostName 192.168.1.2
+    User developer
+
+Host staging-db
+    HostName 192.168.1.3
+    User dbadmin
+`
+	if err := os.WriteFile(testConfigFile, []byte(sshConfig), 0600); err != nil {
+		t.Fatalf("Failed to write test config: %v", err)
+	}
+
+	originalConfigFile := configFile
+	defer func() { configFile = originalConfigFile }()
+	configFile = testConfigFile
+
+	tests := []struct {
+		name       string
+		toComplete string
+		args       []string
+		wantCount  int
+		wantHosts  []string
+	}{
+		{
+			name:       "empty prefix returns all hosts",
+			toComplete: "",
+			args:       []string{},
+			wantCount:  3,
+			wantHosts:  []string{"prod-server", "dev-server", "staging-db"},
+		},
+		{
+			name:       "prefix filters hosts",
+			toComplete: "prod",
+			args:       []string{},
+			wantCount:  1,
+			wantHosts:  []string{"prod-server"},
+		},
+		{
+			name:       "prefix case insensitive",
+			toComplete: "DEV",
+			args:       []string{},
+			wantCount:  1,
+			wantHosts:  []string{"dev-server"},
+		},
+		{
+			name:       "no match returns empty",
+			toComplete: "nonexistent",
+			args:       []string{},
+			wantCount:  0,
+			wantHosts:  []string{},
+		},
+		{
+			name:       "already has host arg returns nothing",
+			toComplete: "",
+			args:       []string{"existing-host"},
+			wantCount:  0,
+			wantHosts:  []string{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			completions, directive := infoCmd.ValidArgsFunction(infoCmd, tt.args, tt.toComplete)
+
+			if len(completions) != tt.wantCount {
+				t.Fatalf("Expected %d completions, got %d: %v", tt.wantCount, len(completions), completions)
+			}
+
+			if directive != cobra.ShellCompDirectiveNoFileComp {
+				t.Fatalf("Expected ShellCompDirectiveNoFileComp, got %v", directive)
+			}
+
+			for _, wantHost := range tt.wantHosts {
+				found := false
+				for _, comp := range completions {
+					if comp == wantHost {
+						found = true
+						break
+					}
+				}
+				if !found {
+					t.Fatalf("Expected completion %q not found in %v", wantHost, completions)
+				}
+			}
+		})
+	}
+}

cmd/root.go

@@ -1,19 +1,16 @@
 package cmd
 
 import (
-	"context"
 	"fmt"
 	"log"
 	"os"
 	"os/exec"
 	"strings"
 	"syscall"
-	"time"
 
 	"github.com/Gu1llaum-3/sshm/internal/config"
 	"github.com/Gu1llaum-3/sshm/internal/history"
 	"github.com/Gu1llaum-3/sshm/internal/ui"
-	"github.com/Gu1llaum-3/sshm/internal/version"
 
 	"github.com/spf13/cobra"
 )
@@ -27,8 +24,8 @@ var configFile string
 // forceTTY forces pseudo-TTY allocation for remote commands
 var forceTTY bool
 
-// searchMode enables the focus on search mode at startup
-var searchMode bool
+// noUpdateCheck disables the async update check in the TUI
+var noUpdateCheck bool
 
 // RootCmd is the base command when called without any subcommands
 var RootCmd = &cobra.Command{
@@ -75,6 +72,8 @@ Examples:
 			return nil, cobra.ShellCompDirectiveError
 		}
 
+		hosts = config.FilterVisibleHosts(hosts)
+
 		var completions []string
 		toCompleteLower := strings.ToLower(toComplete)
 		for _, host := range hosts {
@@ -143,7 +142,7 @@ func runInteractiveMode() {
 	}
 
 	// Run the interactive TUI
-	if err := ui.RunInteractiveMode(hosts, configFile, searchMode, AppVersion); err != nil {
+	if err := ui.RunInteractiveMode(hosts, configFile, AppVersion, noUpdateCheck); err != nil {
 		log.Fatalf("Error running interactive mode: %v", err)
 	}
 }
@@ -196,6 +195,15 @@ func connectToHost(hostName string, remoteCommand []string) {
 		fmt.Printf("Connecting to %s...\n", hostName)
 	}
 
+	sshPath, lookErr := exec.LookPath("ssh")
+	if lookErr == nil {
+		argv := append([]string{"ssh"}, args...)
+		// On Unix, Exec replaces the process and never returns on success.
+		// On Windows, Exec is not supported and returns an error; fall through to the exec.Command fallback.
+		_ = syscall.Exec(sshPath, argv, os.Environ())
+	}
+
+	// Fallback for Windows or if LookPath failed
 	sshCmd := exec.Command("ssh", args...)
 	sshCmd.Stdin = os.Stdin
 	sshCmd.Stdout = os.Stdout
@@ -213,30 +221,6 @@ func connectToHost(hostName string, remoteCommand []string) {
 	}
 }
 
-// getVersionWithUpdateCheck returns a custom version string with update check
-func getVersionWithUpdateCheck() string {
-	versionText := fmt.Sprintf("sshm version %s", AppVersion)
-
-	// Check for updates
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	updateInfo, err := version.CheckForUpdates(ctx, AppVersion)
-	if err != nil {
-		// Return just version if check fails
-		return versionText + "\n"
-	}
-
-	if updateInfo != nil && updateInfo.Available {
-		versionText += fmt.Sprintf("\n🚀 Update available: %s → %s (%s)",
-			updateInfo.CurrentVer,
-			updateInfo.LatestVer,
-			updateInfo.ReleaseURL)
-	}
-
-	return versionText + "\n"
-}
-
 // Execute adds all child commands to the root command and sets flags appropriately.
 func Execute() {
 	if err := RootCmd.Execute(); err != nil {
@@ -257,8 +241,7 @@ func Execute() {
 func init() {
 	RootCmd.PersistentFlags().StringVarP(&configFile, "config", "c", "", "SSH config file to use (default: ~/.ssh/config)")
 	RootCmd.Flags().BoolVarP(&forceTTY, "tty", "t", false, "Force pseudo-TTY allocation (useful for interactive remote commands)")
-	RootCmd.PersistentFlags().BoolVarP(&searchMode, "search", "s", false, "Focus on search input at startup")
+	RootCmd.PersistentFlags().BoolVar(&noUpdateCheck, "no-update-check", false, "Disable automatic update check")
 
-	// Set custom version template with update check
-	RootCmd.SetVersionTemplate(getVersionWithUpdateCheck())
+	RootCmd.SetVersionTemplate("{{.Name}} version {{.Version}}\n")
 }

cmd/root_test.go

@@ -45,7 +45,7 @@ func TestRootCommandFlags(t *testing.T) {
 func TestRootCommandSubcommands(t *testing.T) {
 	// Test that all expected subcommands are registered
 	// Note: completion and help are automatically added by Cobra and may not always appear in Commands()
-	expectedCommands := []string{"add", "edit", "search"}
+	expectedCommands := []string{"add", "edit", "search", "info"}
 
 	commands := RootCmd.Commands()
 	commandNames := make(map[string]bool)

cmd/search.go

@@ -55,6 +55,9 @@ func runSearch(cmd *cobra.Command, args []string) {
 		os.Exit(1)
 	}
 
+	// Filter out hidden hosts
+	hosts = config.FilterVisibleHosts(hosts)
+
 	// Get search query
 	var query string
 	if len(args) > 0 {

internal/config/appconfig.go

@@ -18,7 +18,16 @@ type KeyBindings struct {
 
 // AppConfig represents the main application configuration
 type AppConfig struct {
-	KeyBindings KeyBindings `json:"key_bindings"`
+	CheckForUpdates *bool       `json:"check_for_updates,omitempty"`
+	KeyBindings     KeyBindings `json:"key_bindings"`
+}
+
+// IsUpdateCheckEnabled returns true if the update check is enabled (default: true)
+func (c *AppConfig) IsUpdateCheckEnabled() bool {
+	if c == nil || c.CheckForUpdates == nil {
+		return true
+	}
+	return *c.CheckForUpdates
 }
 
 // GetDefaultKeyBindings returns the default key bindings configuration

internal/config/appconfig_test.go

@@ -104,6 +104,58 @@ func TestAppConfigBasics(t *testing.T) {
 	if len(defaultConfig.KeyBindings.QuitKeys) != len(expectedQuitKeys) {
 		t.Errorf("Expected %d quit keys, got %d", len(expectedQuitKeys), len(defaultConfig.KeyBindings.QuitKeys))
 	}
+
+	// CheckForUpdates should be nil by default
+	if defaultConfig.CheckForUpdates != nil {
+		t.Error("Default configuration should have CheckForUpdates as nil")
+	}
+
+	// IsUpdateCheckEnabled should return true by default
+	if !defaultConfig.IsUpdateCheckEnabled() {
+		t.Error("IsUpdateCheckEnabled should return true when CheckForUpdates is nil")
+	}
+}
+
+func boolPtr(b bool) *bool {
+	return &b
+}
+
+func TestIsUpdateCheckEnabled(t *testing.T) {
+	tests := []struct {
+		name     string
+		config   *AppConfig
+		expected bool
+	}{
+		{
+			name:     "nil AppConfig returns true",
+			config:   nil,
+			expected: true,
+		},
+		{
+			name:     "CheckForUpdates nil returns true",
+			config:   &AppConfig{},
+			expected: true,
+		},
+		{
+			name:     "CheckForUpdates true returns true",
+			config:   &AppConfig{CheckForUpdates: boolPtr(true)},
+			expected: true,
+		},
+		{
+			name:     "CheckForUpdates false returns false",
+			config:   &AppConfig{CheckForUpdates: boolPtr(false)},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.IsUpdateCheckEnabled()
+			if result != tt.expected {
+				t.Errorf("IsUpdateCheckEnabled() = %v, expected %v", result, tt.expected)
+			}
+		})
+	}
 }
 
 func TestMergeWithDefaults(t *testing.T) {
@@ -141,6 +193,7 @@ func TestSaveAndLoadAppConfigIntegration(t *testing.T) {
 	configPath := filepath.Join(tempDir, "config.json")
 
 	customConfig := AppConfig{
+		CheckForUpdates: boolPtr(false),
 		KeyBindings: KeyBindings{
 			QuitKeys:       []string{"q"},
 			DisableEscQuit: true,
@@ -178,4 +231,15 @@ func TestSaveAndLoadAppConfigIntegration(t *testing.T) {
 	if len(loadedConfig.KeyBindings.QuitKeys) != 1 || loadedConfig.KeyBindings.QuitKeys[0] != "q" {
 		t.Errorf("Expected quit keys to be ['q'], got %v", loadedConfig.KeyBindings.QuitKeys)
 	}
+
+	// Verify CheckForUpdates is correctly persisted and reloaded
+	if loadedConfig.CheckForUpdates == nil {
+		t.Fatal("CheckForUpdates should not be nil after round-trip")
+	}
+	if *loadedConfig.CheckForUpdates != false {
+		t.Errorf("CheckForUpdates should be false after round-trip, got %v", *loadedConfig.CheckForUpdates)
+	}
+	if loadedConfig.IsUpdateCheckEnabled() {
+		t.Error("IsUpdateCheckEnabled should return false when CheckForUpdates is false")
+	}
 }

internal/config/ssh.go

@@ -11,6 +11,18 @@ import (
 	"sync"
 )
 
+func getHomeDir() (string, error) {
+	home := os.Getenv("HOME")
+	if home != "" {
+		return home, nil
+	}
+	home = os.Getenv("USERPROFILE")
+	if home != "" {
+		return home, nil
+	}
+	return os.UserHomeDir()
+}
+
 // SSHHost represents an SSH host configuration
 type SSHHost struct {
 	Name          string
@@ -33,7 +45,7 @@ type SSHHost struct {
 
 // GetDefaultSSHConfigPath returns the default SSH config path for the current platform
 func GetDefaultSSHConfigPath() (string, error) {
-	homeDir, err := os.UserHomeDir()
+	homeDir, err := getHomeDir()
 	if err != nil {
 		return "", err
 	}
@@ -49,7 +61,7 @@ func GetDefaultSSHConfigPath() (string, error) {
 
 // GetSSHMConfigDir returns the SSHM config directory
 func GetSSHMConfigDir() (string, error) {
-	homeDir, err := os.UserHomeDir()
+	homeDir, err := getHomeDir()
 	if err != nil {
 		return "", err
 	}
@@ -88,7 +100,7 @@ func GetSSHMBackupDir() (string, error) {
 
 // GetSSHDirectory returns the .ssh directory path
 func GetSSHDirectory() (string, error) {
-	homeDir, err := os.UserHomeDir()
+	homeDir, err := getHomeDir()
 	if err != nil {
 		return "", err
 	}
@@ -386,7 +398,7 @@ func parseSSHConfigFileWithProcessedFiles(configPath string, processedFiles map[
 func processIncludeDirective(pattern string, baseConfigPath string, processedFiles map[string]bool) ([]SSHHost, error) {
 	// Expand tilde to home directory
 	if strings.HasPrefix(pattern, "~") {
-		homeDir, err := os.UserHomeDir()
+		homeDir, err := getHomeDir()
 		if err != nil {
 			return nil, fmt.Errorf("failed to get home directory: %w", err)
 		}
@@ -918,7 +930,7 @@ func quickHostSearchInFile(hostName string, configPath string, processedFiles ma
 func quickSearchInclude(hostName, pattern, baseConfigPath string, processedFiles map[string]bool) (bool, error) {
 	// Expand tilde to home directory
 	if strings.HasPrefix(pattern, "~") {
-		homeDir, err := os.UserHomeDir()
+		homeDir, err := getHomeDir()
 		if err != nil {
 			return false, fmt.Errorf("failed to get home directory: %w", err)
 		}
@@ -1612,6 +1624,27 @@ func GetAllConfigFiles() ([]string, error) {
 	return files, nil
 }
 
+// FilterVisibleHosts returns only hosts that do not have the "hidden" tag.
+func FilterVisibleHosts(hosts []SSHHost) []SSHHost {
+	var visible []SSHHost
+	for _, h := range hosts {
+		if !hostHasTag(h.Tags, "hidden") {
+			visible = append(visible, h)
+		}
+	}
+	return visible
+}
+
+// hostHasTag reports whether the given tag list contains the target tag (case-insensitive).
+func hostHasTag(tags []string, target string) bool {
+	for _, t := range tags {
+		if strings.EqualFold(t, target) {
+			return true
+		}
+	}
+	return false
+}
+
 // GetAllConfigFilesFromBase returns all SSH config files starting from a specific base config file
 func GetAllConfigFilesFromBase(baseConfigPath string) ([]string, error) {
 	if baseConfigPath == "" {

internal/config/ssh_test.go

@@ -456,15 +456,21 @@ func TestBackupConfigToSSHMDirectory(t *testing.T) {
 	// Create temporary directory for test files
 	tempDir := t.TempDir()
 
-	// Override the home directory for this test
 	originalHome := os.Getenv("HOME")
 	if originalHome == "" {
-		originalHome = os.Getenv("USERPROFILE") // Windows
+		originalHome = os.Getenv("USERPROFILE")
 	}
+	originalXDG := os.Getenv("XDG_CONFIG_HOME")
+	originalAppData := os.Getenv("APPDATA")
 
-	// Set test home directory
 	os.Setenv("HOME", tempDir)
-	defer os.Setenv("HOME", originalHome)
+	os.Setenv("XDG_CONFIG_HOME", tempDir)
+	os.Setenv("APPDATA", tempDir)
+	defer func() {
+		os.Setenv("HOME", originalHome)
+		os.Setenv("XDG_CONFIG_HOME", originalXDG)
+		os.Setenv("APPDATA", originalAppData)
+	}()
 
 	// Create a test SSH config file
 	sshDir := filepath.Join(tempDir, ".ssh")

internal/connectivity/ping.go

@@ -2,12 +2,15 @@ package connectivity
 
 import (
 	"context"
+	"fmt"
 	"net"
-	"github.com/Gu1llaum-3/sshm/internal/config"
+	"os/exec"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/Gu1llaum-3/sshm/internal/config"
+
 	"golang.org/x/crypto/ssh"
 )
 
@@ -45,16 +48,18 @@ type HostPingResult struct {
 
 // PingManager manages SSH connectivity checks for multiple hosts
 type PingManager struct {
-	results map[string]*HostPingResult
-	mutex   sync.RWMutex
-	timeout time.Duration
+	results    map[string]*HostPingResult
+	mutex      sync.RWMutex
+	timeout    time.Duration
+	configFile string
 }
 
 // NewPingManager creates a new ping manager with the specified timeout
-func NewPingManager(timeout time.Duration) *PingManager {
+func NewPingManager(timeout time.Duration, configFile string) *PingManager {
 	return &PingManager{
-		results: make(map[string]*HostPingResult),
-		timeout: timeout,
+		results:    make(map[string]*HostPingResult),
+		timeout:    timeout,
+		configFile: configFile,
 	}
 }
 
@@ -98,6 +103,14 @@ func (pm *PingManager) PingHost(ctx context.Context, host config.SSHHost) *HostP
 	// Mark as connecting
 	pm.updateStatus(host.Name, StatusConnecting, nil, 0)
 
+	// If the host uses a ProxyJump or ProxyCommand, we need to use the external SSH command
+	// because implementing jump host support with pure Go ssh library requires
+	// handling authentication for the jump host, which is complex and requires
+	// access to the user's SSH agent or keys.
+	if host.ProxyJump != "" || host.ProxyCommand != "" {
+		return pm.pingWithExternalCommand(ctx, host, start)
+	}
+
 	// Determine the actual hostname and port
 	hostname := host.Hostname
 	if hostname == "" {
@@ -159,6 +172,53 @@ func (pm *PingManager) PingHost(ctx context.Context, host config.SSHHost) *HostP
 	}
 }
 
+// pingWithExternalCommand pings a host using the external SSH command
+func (pm *PingManager) pingWithExternalCommand(ctx context.Context, host config.SSHHost, start time.Time) *HostPingResult {
+	// Construct the SSH command
+	// ssh -q -o BatchMode=yes -o StrictHostKeyChecking=no -o ConnectTimeout=5 host exit
+	args := []string{"-q", "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=no"}
+
+	// Set timeout matching the manager's timeout
+	// Convert duration to seconds (rounding up to ensure we don't timeout too early in the command)
+	timeoutSec := int(pm.timeout.Seconds())
+	if timeoutSec < 1 {
+		timeoutSec = 1
+	}
+	args = append(args, "-o", fmt.Sprintf("ConnectTimeout=%d", timeoutSec))
+
+	// If we have a specific config file, use it
+	if pm.configFile != "" {
+		args = append(args, "-F", pm.configFile)
+	}
+
+	// Add the host name and the command to run (exit)
+	args = append(args, host.Name, "exit")
+
+	// Create command with context for timeout cancellation
+	// Note: We used pm.timeout for the ssh command option, but we also respect the context deadline
+	cmd := exec.CommandContext(ctx, "ssh", args...)
+
+	// Run the command
+	err := cmd.Run()
+	duration := time.Since(start)
+
+	var status PingStatus
+	if err != nil {
+		// SSH returns non-zero exit code on connection failure
+		status = StatusOffline
+	} else {
+		status = StatusOnline
+	}
+
+	pm.updateStatus(host.Name, status, err, duration)
+	return &HostPingResult{
+		HostName: host.Name,
+		Status:   status,
+		Error:    err,
+		Duration: duration,
+	}
+}
+
 // PingAllHosts pings all hosts concurrently and returns a channel of results
 func (pm *PingManager) PingAllHosts(ctx context.Context, hosts []config.SSHHost) <-chan *HostPingResult {
 	resultChan := make(chan *HostPingResult, len(hosts))

internal/connectivity/ping_test.go

@@ -9,7 +9,7 @@ import (
 )
 
 func TestNewPingManager(t *testing.T) {
-	pm := NewPingManager(5 * time.Second)
+	pm := NewPingManager(5*time.Second, "")
 	if pm == nil {
 		t.Error("NewPingManager() returned nil")
 	}
@@ -19,7 +19,7 @@ func TestNewPingManager(t *testing.T) {
 }
 
 func TestPingManager_PingHost(t *testing.T) {
-	pm := NewPingManager(1 * time.Second)
+	pm := NewPingManager(1*time.Second, "")
 	ctx := context.Background()
 
 	// Test ping method exists and doesn't panic
@@ -38,7 +38,7 @@ func TestPingManager_PingHost(t *testing.T) {
 }
 
 func TestPingManager_GetStatus(t *testing.T) {
-	pm := NewPingManager(1 * time.Second)
+	pm := NewPingManager(1*time.Second, "")
 
 	// Test unknown host
 	status := pm.GetStatus("unknown.host")
@@ -57,7 +57,7 @@ func TestPingManager_GetStatus(t *testing.T) {
 }
 
 func TestPingManager_PingMultipleHosts(t *testing.T) {
-	pm := NewPingManager(1 * time.Second)
+	pm := NewPingManager(1*time.Second, "")
 	hosts := []config.SSHHost{
 		{Name: "localhost", Hostname: "127.0.0.1", Port: "22"},
 		{Name: "invalid", Hostname: "invalid.host.12345", Port: "22"},
@@ -81,7 +81,7 @@ func TestPingManager_PingMultipleHosts(t *testing.T) {
 }
 
 func TestPingManager_GetResult(t *testing.T) {
-	pm := NewPingManager(1 * time.Second)
+	pm := NewPingManager(1*time.Second, "")
 	ctx := context.Background()
 
 	// Test getting result for unknown host
@@ -126,7 +126,7 @@ func TestPingStatus_String(t *testing.T) {
 
 func TestPingHost_Basic(t *testing.T) {
 	// Test that the ping functionality exists
-	pm := NewPingManager(1 * time.Second)
+	pm := NewPingManager(1*time.Second, "")
 	ctx := context.Background()
 	host := config.SSHHost{Name: "test", Hostname: "127.0.0.1", Port: "22"}
 

internal/ui/add_form.go

@@ -438,7 +438,12 @@ func (m *addFormModel) renderGeneralTab() string {
 		b.WriteString(fieldStyle.Render(field.label))
 		b.WriteString("\n")
 		b.WriteString(m.inputs[field.index].View())
-		b.WriteString("\n\n")
+		b.WriteString("\n")
+		if field.index == tagsInput && m.focused == tagsInput {
+			b.WriteString(m.styles.FormHelp.Render(`  tip: use "hidden" to hide this host from the list`))
+			b.WriteString("\n")
+		}
+		b.WriteString("\n")
 	}
 
 	return b.String()

internal/ui/edit_form.go

@@ -599,7 +599,12 @@ func (m *editFormModel) renderEditGeneralTab() string {
 		b.WriteString(fieldStyle.Render(field.label))
 		b.WriteString("\n")
 		b.WriteString(m.inputs[field.index].View())
-		b.WriteString("\n\n")
+		b.WriteString("\n")
+		if field.index == 7 && m.focusArea == focusAreaProperties && m.focused == 7 {
+			b.WriteString(m.styles.FormHelp.Render(`  tip: use "hidden" to hide this host from the list`))
+			b.WriteString("\n")
+		}
+		b.WriteString("\n")
 	}
 
 	return b.String()

internal/ui/help_form.go

@@ -81,6 +81,9 @@ func (m *helpModel) View() string {
 		lipgloss.JoinHorizontal(lipgloss.Left,
 			m.styles.FocusedLabel.Render("p  "),
 			m.styles.HelpText.Render("ping all hosts")),
+		lipgloss.JoinHorizontal(lipgloss.Left,
+			m.styles.FocusedLabel.Render("H  "),
+			m.styles.HelpText.Render("toggle hidden hosts visibility")),
 		lipgloss.JoinHorizontal(lipgloss.Left,
 			m.styles.FocusedLabel.Render("f  "),
 			m.styles.HelpText.Render("setup port forwarding")),

internal/ui/model.go

@@ -70,8 +70,10 @@ func (p PortForwardType) String() string {
 type Model struct {
 	table          table.Model
 	searchInput    textinput.Model
-	hosts          []config.SSHHost
+	allHosts       []config.SSHHost // all parsed hosts, including hidden ones
+	hosts          []config.SSHHost // visible hosts (filtered by showHidden)
 	filteredHosts  []config.SSHHost
+	showHidden     bool // when true, hidden-tagged hosts are shown
 	searchMode     bool
 	deleteMode     bool
 	deleteHost     *config.SSHHost // Host to be deleted (with line number for precise targeting)
@@ -108,6 +110,14 @@ type Model struct {
 	showingError bool
 }
 
+// applyVisibilityFilter returns hosts filtered according to the showHidden flag.
+func (m Model) applyVisibilityFilter(hosts []config.SSHHost) []config.SSHHost {
+	if m.showHidden {
+		return hosts
+	}
+	return config.FilterVisibleHosts(hosts)
+}
+
 // updateTableStyles updates the table header border color based on focus state
 func (m *Model) updateTableStyles() {
 	s := table.DefaultStyles()

internal/ui/tui.go

@@ -15,8 +15,9 @@ import (
 	"github.com/charmbracelet/lipgloss"
 )
 
-// NewModel creates a new TUI model with the given SSH hosts
-func NewModel(hosts []config.SSHHost, configFile string, searchMode bool, currentVersion string) Model {
+// NewModel creates a new TUI model with the given SSH hosts.
+// The search input is focused at startup so users can filter hosts right away.
+func NewModel(hosts []config.SSHHost, configFile string, currentVersion string, noUpdateCheck bool) Model {
 	// Load application configuration
 	appConfig, err := config.LoadAppConfig()
 	if err != nil {
@@ -26,6 +27,12 @@ func NewModel(hosts []config.SSHHost, configFile string, searchMode bool, curren
 		appConfig = &defaultConfig
 	}
 
+	// CLI flag overrides config file setting
+	if noUpdateCheck {
+		f := false
+		appConfig.CheckForUpdates = &f
+	}
+
 	// Initialize the history manager
 	historyManager, err := history.NewHistoryManager()
 	if err != nil {
@@ -38,11 +45,11 @@ func NewModel(hosts []config.SSHHost, configFile string, searchMode bool, curren
 	styles := NewStyles(80) // Default width
 
 	// Initialize ping manager with 5 second timeout
-	pingManager := connectivity.NewPingManager(5 * time.Second)
+	pingManager := connectivity.NewPingManager(5*time.Second, configFile)
 
 	// Create the model with default sorting by name
 	m := Model{
-		hosts:          hosts,
+		allHosts:       hosts,
 		historyManager: historyManager,
 		pingManager:    pingManager,
 		sortMode:       SortByName,
@@ -54,20 +61,22 @@ func NewModel(hosts []config.SSHHost, configFile string, searchMode bool, curren
 		height:         24,
 		ready:          false,
 		viewMode:       ViewList,
-		searchMode:     searchMode,
+		searchMode:     true,
 	}
 
+	// Apply visibility filter (showHidden is false by default)
+	visibleHosts := m.applyVisibilityFilter(hosts)
+	m.hosts = visibleHosts
+
 	// Sort hosts according to the default sort mode
-	sortedHosts := m.sortHosts(hosts)
+	sortedHosts := m.sortHosts(visibleHosts)
 
 	// Create the search input
 	ti := textinput.New()
 	ti.Placeholder = "Search hosts or tags..."
 	ti.CharLimit = 50
 	ti.Width = 25
-	if searchMode {
-		ti.Focus()
-	}
+	ti.Focus()
 
 	// Use dynamic column width calculation (will fallback to static if width not available)
 	nameWidth, hostnameWidth, tagsWidth, lastLoginWidth := m.calculateDynamicColumnWidths(sortedHosts)
@@ -151,8 +160,8 @@ func NewModel(hosts []config.SSHHost, configFile string, searchMode bool, curren
 }
 
 // RunInteractiveMode starts the interactive TUI interface
-func RunInteractiveMode(hosts []config.SSHHost, configFile string, searchMode bool, currentVersion string) error {
-	m := NewModel(hosts, configFile, searchMode, currentVersion)
+func RunInteractiveMode(hosts []config.SSHHost, configFile string, currentVersion string, noUpdateCheck bool) error {
+	m := NewModel(hosts, configFile, currentVersion, noUpdateCheck)
 
 	// Start the application in alt screen mode for clean output
 	p := tea.NewProgram(m, tea.WithAltScreen())

internal/ui/update.go

@@ -74,8 +74,8 @@ func (m Model) Init() tea.Cmd {
 	// Basic initialization commands
 	cmds = append(cmds, textinput.Blink)
 
-	// Check for version updates if we have a current version
-	if m.currentVersion != "" {
+	// Check for version updates if we have a current version and updates are enabled
+	if m.currentVersion != "" && m.appConfig.IsUpdateCheckEnabled() {
 		cmds = append(cmds, checkVersionCmd(m.currentVersion))
 	}
 
@@ -187,7 +187,8 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if err != nil {
 				return m, tea.Quit
 			}
-			m.hosts = m.sortHosts(hosts)
+			m.allHosts = hosts
+			m.hosts = m.sortHosts(m.applyVisibilityFilter(hosts))
 
 			// Reapply search filter if there is one active
 			if m.searchInput.Value() != "" {
@@ -231,7 +232,8 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if err != nil {
 				return m, tea.Quit
 			}
-			m.hosts = m.sortHosts(hosts)
+			m.allHosts = hosts
+			m.hosts = m.sortHosts(m.applyVisibilityFilter(hosts))
 
 			// Reapply search filter if there is one active
 			if m.searchInput.Value() != "" {
@@ -276,7 +278,8 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if err != nil {
 				return m, tea.Quit
 			}
-			m.hosts = m.sortHosts(hosts)
+			m.allHosts = hosts
+			m.hosts = m.sortHosts(m.applyVisibilityFilter(hosts))
 
 			// Reapply search filter if there is one active
 			if m.searchInput.Value() != "" {
@@ -535,7 +538,8 @@ func (m Model) handleListViewKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 				m.table.Focus()
 				return m, nil
 			}
-			m.hosts = m.sortHosts(hosts)
+			m.allHosts = hosts
+			m.hosts = m.sortHosts(m.applyVisibilityFilter(hosts))
 
 			// Reapply search filter if there is one active
 			if m.searchInput.Value() != "" {
@@ -705,6 +709,19 @@ func (m Model) handleListViewKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 			m.viewMode = ViewHelp
 			return m, nil
 		}
+	case "H":
+		if !m.searchMode && !m.deleteMode {
+			// Toggle visibility of hidden hosts
+			m.showHidden = !m.showHidden
+			m.hosts = m.sortHosts(m.applyVisibilityFilter(m.allHosts))
+			if m.searchInput.Value() != "" {
+				m.filteredHosts = m.filterHosts(m.searchInput.Value())
+			} else {
+				m.filteredHosts = m.hosts
+			}
+			m.updateTableRows()
+			return m, nil
+		}
 	case "s":
 		if !m.searchMode && !m.deleteMode {
 			// Cycle through sort modes (only 2 modes now)

internal/ui/view.go

@@ -86,6 +86,14 @@ func (m Model) renderListView() string {
 		components = append(components, errorStyle.Render("❌ "+m.errorMessage))
 	}
 
+	// Add indicator when hidden hosts are shown
+	if m.showHidden {
+		hiddenBannerStyle := lipgloss.NewStyle().
+			Foreground(lipgloss.Color("11")).
+			Bold(true)
+		components = append(components, hiddenBannerStyle.Render("  [showing hidden hosts — press H to hide]"))
+	}
+
 	// Add the search bar with the appropriate style based on focus
 	searchPrompt := "Search (/ to focus): "
 	if m.searchMode {

internal/validation/ssh.go

@@ -66,6 +66,25 @@ func ValidateIdentityFile(path string) bool {
 	if path == "" {
 		return true // Optional field
 	}
+	// SSH tokens (e.g. %d, %h, %r, %u) are resolved by SSH at connection time
+	sshTokenRegex := regexp.MustCompile(`%[hprunCdiklLT]`)
+	if sshTokenRegex.MatchString(path) {
+		return true
+	}
+	// Expand environment variables ($VAR and ${VAR}); track undefined ones
+	hasUndefined := false
+	path = os.Expand(path, func(key string) string {
+		val, ok := os.LookupEnv(key)
+		if !ok {
+			hasUndefined = true
+			return "$" + key
+		}
+		return val
+	})
+	// If any variable was undefined, accept the path (SSH will report the error)
+	if hasUndefined {
+		return true
+	}
 	// Expand ~ to home directory
 	if strings.HasPrefix(path, "~/") {
 		homeDir, err := os.UserHomeDir()

internal/validation/ssh_test.go

@@ -133,6 +133,9 @@ func TestValidateIdentityFile(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	// Set up an env var pointing to the valid file's directory for env var tests
+	t.Setenv("TEST_SSHM_DIR", tmpDir)
+
 	tests := []struct {
 		name string
 		path string
@@ -143,6 +146,13 @@ func TestValidateIdentityFile(t *testing.T) {
 		{"non-existent file", "/path/to/nonexistent", false},
 		// Skip tilde path test in CI environments where ~/.ssh/id_rsa may not exist
 		// {"tilde path", "~/.ssh/id_rsa", true}, // Will pass if file exists
+		// Environment variable expansion (issue #33)
+		{"env var $VAR/key defined", "$TEST_SSHM_DIR/test_key", true},
+		{"env var ${VAR}/key defined", "${TEST_SSHM_DIR}/test_key", true},
+		{"env var undefined", "$UNDEFINED_SSHM_VAR_XYZ/key", true},
+		// SSH tokens
+		{"SSH token %d", "%d/.ssh/id_rsa", true},
+		{"SSH token %h", "%h-key", true},
 	}
 
 	for _, tt := range tests {
@@ -170,6 +180,7 @@ func TestValidateHost(t *testing.T) {
 	if err := os.WriteFile(validIdentity, []byte("test"), 0600); err != nil {
 		t.Fatal(err)
 	}
+	t.Setenv("TEST_SSHM_HOST_DIR", tmpDir)
 
 	tests := []struct {
 		name     string
@@ -187,6 +198,9 @@ func TestValidateHost(t *testing.T) {
 		{"invalid hostname", "myserver", "invalid..hostname", "22", "", true},
 		{"invalid port", "myserver", "example.com", "99999", "", true},
 		{"invalid identity", "myserver", "example.com", "22", "/nonexistent", true},
+		// Environment variables and SSH tokens in identity (issue #33)
+		{"identity with env var", "myserver", "example.com", "22", "$TEST_SSHM_HOST_DIR/test_key", false},
+		{"identity with SSH token", "myserver", "example.com", "22", "%d/.ssh/id_rsa", false},
 	}
 
 	for _, tt := range tests {