Starts from Surge Mac 4.6.0. You can now use SSH protocol as a proxy policy, an equivalent to ssh -D.

UI configuration for Surge Mac is now available.

Profile syntax:

Password authentication

[Proxy]
proxy = ssh, 1.2.3.4, 22, username=root, password=pw

Public key authentication

[Proxy]
proxy = ssh, 1.2.3.4, 22, username=root, private-key=key1

[Keystore]
key1 = type=openssh-private-key, base64=[The base64 encoded content of the private key file]

Please notice you must use base64 to encode the entire private key file again, even though the private key file uses the base64 encoding itself.
All the four types of private keys, RSA/ECDSA/ED25519/DSA, are supported.
Surge only supports curve25519-sha256 as the kex algorithm and aes128-gcm as the encryption algorithm. It means that the SSH server must use OpenSSH v7.3 or above. (It should not be a problem since OpenSSH 7.3 was released on 2016-08-01.)

You may specify the idle timeout parameter now. The default value is 180s.

[Proxy]
proxy = ssh, 1.2.3.4, 22, username=root, password=pw, idle-timeout=180