Improves 2FA and SSH authentication handling

Enhances keyboard-interactive (2FA/MFA) authentication by implementing a queue-based system, allowing multiple concurrent requests to be processed sequentially.

Previously, password prompts during keyboard-interactive authentication were auto-filled if a saved password was available. This change removes the auto-fill behavior to prevent issues with custom or ambiguous prompt texts, instead providing a user-initiated "Use saved password" option in the UI.

Increases the connection timeout to 120 seconds to provide ample time for users to complete 2FA challenges. A new UI indicator shows when additional 2FA requests are pending.

Also, refines SSH authentication logic to strictly respect explicit password authentication, preventing unintended attempts to use private keys when password authentication is selected.

App.tsx

@@ -151,8 +151,8 @@ function App({ settings }: { settings: SettingsState }) {
   const [protocolSelectHost, setProtocolSelectHost] = useState<Host | null>(null);
   // Navigation state for VaultView sections
   const [navigateToSection, setNavigateToSection] = useState<VaultSection | null>(null);
-  // Keyboard-interactive authentication state (2FA/MFA)
-  const [keyboardInteractiveRequest, setKeyboardInteractiveRequest] = useState<KeyboardInteractiveRequest | null>(null);
+  // Keyboard-interactive authentication queue (2FA/MFA) - queue-based to handle multiple concurrent sessions
+  const [keyboardInteractiveQueue, setKeyboardInteractiveQueue] = useState<KeyboardInteractiveRequest[]>([]);
 
   const {
     theme,
@@ -301,13 +301,15 @@ function App({ settings }: { settings: SettingsState }) {
 
     const unsubscribe = bridge.onKeyboardInteractive((request) => {
       console.log('[App] Keyboard-interactive request received:', request);
-      setKeyboardInteractiveRequest({
+      // Add to queue instead of replacing - supports multiple concurrent sessions
+      setKeyboardInteractiveQueue(prev => [...prev, {
         requestId: request.requestId,
         name: request.name,
         instructions: request.instructions,
         prompts: request.prompts,
         hostname: request.hostname,
-      });
+        savedPassword: request.savedPassword,
+      }]);
     });
 
     return () => {
@@ -321,7 +323,8 @@ function App({ settings }: { settings: SettingsState }) {
     if (bridge?.respondKeyboardInteractive) {
       void bridge.respondKeyboardInteractive(requestId, responses, false);
     }
-    setKeyboardInteractiveRequest(null);
+    // Remove from queue by requestId
+    setKeyboardInteractiveQueue(prev => prev.filter(r => r.requestId !== requestId));
   }, []);
 
   // Handle keyboard-interactive cancel
@@ -330,7 +333,8 @@ function App({ settings }: { settings: SettingsState }) {
     if (bridge?.respondKeyboardInteractive) {
       void bridge.respondKeyboardInteractive(requestId, [], true);
     }
-    setKeyboardInteractiveRequest(null);
+    // Remove from queue by requestId
+    setKeyboardInteractiveQueue(prev => prev.filter(r => r.requestId !== requestId));
   }, []);
 
   // Debounce ref for moveFocus to prevent double-triggering when focus switches
@@ -661,7 +665,7 @@ function App({ settings }: { settings: SettingsState }) {
   // Wrapper to connect to host with logging
   const handleConnectToHost = useCallback((host: Host) => {
     const { username, hostname: localHost } = systemInfoRef.current;
-    
+
     // Handle serial hosts separately
     if (host.protocol === 'serial') {
       const portName = host.hostname.split('/').pop() || host.hostname;
@@ -679,7 +683,7 @@ function App({ settings }: { settings: SettingsState }) {
       connectToHost(host);
       return;
     }
-    
+
     const protocol = host.moshEnabled ? 'mosh' : (host.protocol || 'ssh');
     const resolvedAuth = resolveHostAuth({ host, keys, identities });
     addConnectionLog({
@@ -1032,12 +1036,18 @@ function App({ settings }: { settings: SettingsState }) {
         </Suspense>
       )}
 
-      {/* Global Keyboard-Interactive Authentication Modal (2FA/MFA) */}
+      {/* Global Keyboard-Interactive Authentication Modal (2FA/MFA) - processes queue */}
       <KeyboardInteractiveModal
-        request={keyboardInteractiveRequest}
+        request={keyboardInteractiveQueue[0] || null}
         onSubmit={handleKeyboardInteractiveSubmit}
         onCancel={handleKeyboardInteractiveCancel}
       />
+      {/* Indicator when more 2FA requests are pending */}
+      {keyboardInteractiveQueue.length > 1 && (
+        <div className="fixed bottom-4 right-4 z-50 bg-muted/90 backdrop-blur-sm text-sm px-3 py-1.5 rounded-full border shadow-sm">
+          {keyboardInteractiveQueue.length - 1} more pending
+        </div>
+      )}
     </div>
   );
 }

application/i18n/locales/en.ts

@@ -610,6 +610,10 @@ const en: Messages = {
   'hostDetails.section.address': 'Address',
   'hostDetails.hostname.placeholder': 'IP or Hostname',
   'hostDetails.section.general': 'General',
+  'hostDetails.section.sftp': 'SFTP Settings',
+  'hostDetails.sftp.sudo': 'Sudo Mode',
+  'hostDetails.sftp.sudo.desc': 'Automatically acquire Root privileges using stored password',
+  'hostDetails.sftp.sudo.passwordWarning': 'Sudo mode requires a password. Configure one above, or ensure the server allows passwordless sudo.',
   'hostDetails.label.placeholder': 'Label (e.g., Production Server)',
   'hostDetails.group.placeholder': 'Parent Group',
   'hostDetails.section.credentials': 'Credentials',
@@ -1139,6 +1143,10 @@ const en: Messages = {
   'keyboard.interactive.enterResponse': 'Enter response',
   'keyboard.interactive.submit': 'Submit',
   'keyboard.interactive.verifying': 'Verifying...',
+  'keyboard.interactive.fill': 'Fill',
+  'keyboard.interactive.fillSaved': 'Fill with saved password',
+  'keyboard.interactive.useSaved': 'Use saved',
+  'keyboard.interactive.useSavedPassword': 'Use saved password',
 };
 
 export default en;

application/i18n/locales/zh-CN.ts

@@ -370,6 +370,10 @@ const zhCN: Messages = {
   'hostDetails.section.address': '地址',
   'hostDetails.hostname.placeholder': 'IP 或 主机名',
   'hostDetails.section.general': '通用',
+  'hostDetails.section.sftp': 'SFTP 设置',
+  'hostDetails.sftp.sudo': 'Sudo 提权模式',
+  'hostDetails.sftp.sudo.desc': '使用保存的密码自动获取 Root 权限',
+  'hostDetails.sftp.sudo.passwordWarning': 'Sudo 模式需要密码。请在上方配置密码，或确保服务器允许免密 sudo。',
   'hostDetails.label.placeholder': '名称（例如：Production Server）',
   'hostDetails.group.placeholder': '父级 Group',
   'hostDetails.section.credentials': '凭据',
@@ -1128,6 +1132,10 @@ const zhCN: Messages = {
   'keyboard.interactive.enterResponse': '输入响应',
   'keyboard.interactive.submit': '提交',
   'keyboard.interactive.verifying': '验证中...',
+  'keyboard.interactive.fill': '填入',
+  'keyboard.interactive.fillSaved': '填入已保存的密码',
+  'keyboard.interactive.useSaved': '使用已保存',
+  'keyboard.interactive.useSavedPassword': '使用已保存的密码',
 };
 
 export default zhCN;

application/state/useSftpState.ts

@@ -669,6 +669,7 @@ export const useSftpState = (
         keySource: key?.source,
         proxy: proxyConfig,
         jumpHosts: jumpHosts && jumpHosts.length > 0 ? jumpHosts : undefined,
+        sudo: host.sftpSudo,
       };
     },
     [hosts, identities, keys],
@@ -878,11 +879,15 @@ export const useSftpState = (
           if (hasKey) {
             try {
               // Prefer trying key/cert first when both are present.
-              sftpId = await openSftp({
+              const keyFirstCredentials = {
                 sessionId: `sftp-${connectionId}`,
                 ...credentials,
-                password: undefined,
-              });
+              };
+              // Preserve password for sudo when enabled (still prefer key auth).
+              if (!credentials.sudo) {
+                keyFirstCredentials.password = undefined;
+              }
+              sftpId = await openSftp(keyFirstCredentials);
             } catch (err) {
               if (hasPassword && isAuthError(err)) {
                 sftpId = await openSftp({
@@ -3196,4 +3201,3 @@ export const useSftpState = (
     stableMethods,
   ]);
 };
-

components/HostDetailsPanel.tsx

@@ -28,6 +28,7 @@ import {
 } from "./ui/aside-panel";
 import { Badge } from "./ui/badge";
 import { Button } from "./ui/button";
+import { Switch } from "./ui/switch";
 import { Card } from "./ui/card";
 import { Combobox, ComboboxOption, MultiCombobox } from "./ui/combobox";
 import { Input } from "./ui/input";
@@ -925,6 +926,31 @@ const HostDetailsPanel: React.FC<HostDetailsPanelProps> = ({
           </div>
         </Card>
 
+        <Card className="p-3 space-y-3 bg-card border-border/80">
+          <p className="text-xs font-semibold">
+            {t("hostDetails.section.sftp")}
+          </p>
+          <div className="flex items-center justify-between">
+            <div className="space-y-0.5">
+              <div className="text-sm font-medium">
+                {t("hostDetails.sftp.sudo")}
+              </div>
+              <div className="text-xs text-muted-foreground">
+                {t("hostDetails.sftp.sudo.desc")}
+              </div>
+            </div>
+            <Switch
+              checked={form.sftpSudo || false}
+              onCheckedChange={(val) => update("sftpSudo", val)}
+            />
+          </div>
+          {form.sftpSudo && !form.password && !selectedIdentity?.password && (
+            <p className="text-xs text-amber-500">
+              {t("hostDetails.sftp.sudo.passwordWarning")}
+            </p>
+          )}
+        </Card>
+
         <Card className="p-3 space-y-3 bg-card border-border/80">
           <p className="text-xs font-semibold">
             {t("hostDetails.section.appearance")}

components/HostForm.tsx

@@ -14,6 +14,7 @@ import {
 } from "./ui/dialog";
 import { Input } from "./ui/input";
 import { Label } from "./ui/label";
+import { Switch } from "./ui/switch";
 import {
   Select,
   SelectContent,
@@ -257,6 +258,29 @@ const HostForm: React.FC<HostFormProps> = ({
           </div>
 
           <div className="space-y-3 pt-2">
+            <div className="flex items-center justify-between space-x-2 border rounded-md p-3">
+              <div className="space-y-0.5">
+                <Label htmlFor="sftp-sudo" className="text-base">
+                  {t("hostDetails.sftp.sudo")}
+                </Label>
+                <p className="text-xs text-muted-foreground">
+                  {t("hostDetails.sftp.sudo.desc")}
+                </p>
+                {formData.sftpSudo && authType === "key" && (
+                  <p className="text-xs text-amber-500 mt-1">
+                    {t("hostDetails.sftp.sudo.passwordWarning")}
+                  </p>
+                )}
+              </div>
+              <Switch
+                id="sftp-sudo"
+                checked={formData.sftpSudo || false}
+                onCheckedChange={(checked) =>
+                  setFormData({ ...formData, sftpSudo: checked })
+                }
+              />
+            </div>
+
             <Label>{t("hostForm.auth.method")}</Label>
             <div className="grid grid-cols-2 gap-4">
               <div

components/KeyboardInteractiveModal.tsx

@@ -28,6 +28,7 @@ export interface KeyboardInteractiveRequest {
   instructions: string;
   prompts: KeyboardInteractivePrompt[];
   hostname?: string;
+  savedPassword?: string | null;
 }
 
 interface KeyboardInteractiveModalProps {
@@ -137,11 +138,7 @@ export const KeyboardInteractiveModal: React.FC<KeyboardInteractiveModalProps> =
                     value={responses[index] || ""}
                     onChange={(e) => handleResponseChange(index, e.target.value)}
                     onKeyDown={handleKeyDown}
-                    placeholder={
-                      isPassword
-                        ? t("keyboard.interactive.enterCode")
-                        : t("keyboard.interactive.enterResponse")
-                    }
+                    placeholder=""
                     className={isPassword ? "pr-10" : undefined}
                     autoFocus={index === 0}
                     disabled={isSubmitting}
@@ -149,7 +146,7 @@ export const KeyboardInteractiveModal: React.FC<KeyboardInteractiveModalProps> =
                   {isPassword && (
                     <button
                       type="button"
-                      className="absolute right-3 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground disabled:opacity-50"
+                      className="absolute right-2 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground disabled:opacity-50 p-1"
                       onClick={() => toggleShowPassword(index)}
                       disabled={isSubmitting}
                     >
@@ -157,6 +154,20 @@ export const KeyboardInteractiveModal: React.FC<KeyboardInteractiveModalProps> =
                     </button>
                   )}
                 </div>
+                {/* Use saved password button - shown below input, right-aligned */}
+                {isPassword && request.savedPassword && !responses[index] && (
+                  <div className="flex justify-end">
+                    <button
+                      type="button"
+                      className="flex items-center gap-1 text-xs text-primary hover:text-primary/80 disabled:opacity-50"
+                      onClick={() => handleResponseChange(index, request.savedPassword!)}
+                      disabled={isSubmitting}
+                    >
+                      <KeyRound size={12} />
+                      <span>{t("keyboard.interactive.useSavedPassword")}</span>
+                    </button>
+                  </div>
+                )}
               </div>
             );
           })}

components/SFTPModal.tsx

@@ -254,6 +254,7 @@ interface SFTPModalProps {
     keySource?: 'generated' | 'imported';
     proxy?: NetcattyProxyConfig;
     jumpHosts?: NetcattyJumpHost[];
+    sftpSudo?: boolean;
   };
   open: boolean;
   onClose: () => void;
@@ -521,6 +522,7 @@ const SFTPModal: React.FC<SFTPModalProps> = ({
       keySource: credentials.keySource,
       proxy: credentials.proxy,
       jumpHosts: credentials.jumpHosts,
+      sudo: credentials.sftpSudo,
     });
     sftpIdRef.current = sftpId;
     return sftpId;
@@ -539,6 +541,7 @@ const SFTPModal: React.FC<SFTPModalProps> = ({
     credentials.keySource,
     credentials.proxy,
     credentials.jumpHosts,
+    credentials.sftpSudo,
     openSftp,
   ]);
 
@@ -689,6 +692,7 @@ const SFTPModal: React.FC<SFTPModalProps> = ({
           keySource: credentials.keySource,
           proxy: credentials.proxy,
           jumpHosts: credentials.jumpHosts,
+          sudo: credentials.sftpSudo,
         });
         sftpIdRef.current = sftpId;
 

components/Terminal.tsx

@@ -128,7 +128,8 @@ const TerminalComponent: React.FC<TerminalProps> = ({
   onToggleBroadcast,
   onBroadcastInput,
 }) => {
-  const CONNECTION_TIMEOUT = 12000;
+  // Timeout for connection - increased to 120s to allow time for keyboard-interactive (2FA) authentication
+  const CONNECTION_TIMEOUT = 120000;
   const { t } = useI18n();
   const availableFonts = useAvailableFonts();
   const containerRef = useRef<HTMLDivElement>(null);
@@ -1079,6 +1080,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
               keySource: resolvedAuth.key?.source,
               proxy: proxyConfig,
               jumpHosts: jumpHosts && jumpHosts.length > 0 ? jumpHosts : undefined,
+              sftpSudo: host.sftpSudo,
             };
           })()}
           open={showSFTP && status === "connected"}

components/terminal/runtime/createTerminalSessionStarters.ts

@@ -218,12 +218,12 @@ export const createTerminalSessionStarters = (ctx: TerminalSessionStartersContex
       identities: ctx.identities,
       override: pendingAuth
         ? {
-            authMethod: pendingAuth.authMethod,
-            username: pendingAuth.username,
-            password: pendingAuth.password,
-            keyId: pendingAuth.keyId,
-            passphrase: pendingAuth.passphrase,
-          }
+          authMethod: pendingAuth.authMethod,
+          username: pendingAuth.username,
+          password: pendingAuth.password,
+          keyId: pendingAuth.keyId,
+          passphrase: pendingAuth.passphrase,
+        }
         : null,
     });
 
@@ -247,12 +247,12 @@ export const createTerminalSessionStarters = (ctx: TerminalSessionStartersContex
 
     const proxyConfig = ctx.host.proxyConfig
       ? {
-          type: ctx.host.proxyConfig.type,
-          host: ctx.host.proxyConfig.host,
-          port: ctx.host.proxyConfig.port,
-          username: ctx.host.proxyConfig.username,
-          password: ctx.host.proxyConfig.password,
-        }
+        type: ctx.host.proxyConfig.type,
+        host: ctx.host.proxyConfig.host,
+        port: ctx.host.proxyConfig.port,
+        username: ctx.host.proxyConfig.username,
+        password: ctx.host.proxyConfig.password,
+      }
       : undefined;
 
     const jumpHosts = ctx.resolvedChainHosts.map<NetcattyJumpHost>((jumpHost) => {
@@ -348,9 +348,12 @@ export const createTerminalSessionStarters = (ctx: TerminalSessionStartersContex
       };
 
       let id: string;
-      const hasKeyMaterial = !!key?.privateKey;
+      // Respect explicit auth method selection - don't use key if password auth was explicitly selected
+      const authMethod = resolvedAuth.authMethod;
+      const hasKeyMaterial = !!key?.privateKey && authMethod !== 'password';
       const hasPassword = !!effectivePassword;
 
+
       if (hasKeyMaterial) {
         try {
           id = await startAttempt({ key });

domain/models.ts

@@ -90,6 +90,8 @@ export interface Host {
   telnetPassword?: string; // Telnet-specific password
   // Serial-specific configuration (for protocol='serial' hosts)
   serialConfig?: SerialConfig;
+  // SFTP specific configuration
+  sftpSudo?: boolean; // Use sudo for SFTP operations (requires password)
 }
 
 export type KeyType = 'RSA' | 'ECDSA' | 'ED25519';

domain/sshAuth.ts

@@ -57,11 +57,12 @@ export const resolveHostAuth = (args: {
     host.username?.trim() ||
     "";
 
-  const keyId =
-    override?.keyId ||
-    identity?.keyId ||
-    host.identityFileId ||
-    undefined;
+  // Don't load key when explicit password auth is requested
+  // This ensures user's auth method selection is strictly respected
+  const keyId = override?.authMethod === 'password'
+    ? undefined
+    : (override?.keyId || identity?.keyId || host.identityFileId || undefined);
+
 
   const key = keyId ? keys.find((k) => k.id === keyId) : undefined;
 

electron/bridges/portForwardingBridge.cjs

@@ -90,60 +90,21 @@ async function startPortForward(event, payload) {
         return;
       }
 
-      // Check if all prompts are password prompts that we can auto-answer
-      const responses = [];
-      const promptsNeedingUserInput = [];
-
-      for (let i = 0; i < prompts.length; i++) {
-        const prompt = prompts[i];
-        const promptText = (prompt.prompt || '').toLowerCase().trim();
-
-        // Auto-answer password prompts if we have a configured password
-        if (password && (
-          promptText.includes('password') ||
-          promptText === 'password:' ||
-          promptText === 'password'
-        )) {
-          console.log(`[PortForward] Auto-answering password prompt at index ${i}`);
-          responses[i] = password;
-        } else {
-          // This prompt needs user input (likely 2FA)
-          promptsNeedingUserInput.push({ index: i, prompt: prompt });
-          responses[i] = null; // Placeholder
-        }
-      }
-
-      // If all prompts were auto-answered, finish immediately
-      if (promptsNeedingUserInput.length === 0) {
-        console.log(`[PortForward] All prompts auto-answered, finishing keyboard-interactive`);
-        finish(responses);
-        return;
-      }
-
-      // If some prompts need user input, show the modal
+      // Forward ALL prompts to user - no auto-fill to avoid semantic detection issues
+      // (Prompt text is admin-customizable and may not contain expected keywords)
       const requestId = keyboardInteractiveHandler.generateRequestId('pf');
 
-      // Store finish callback with context about which responses are already filled
       keyboardInteractiveHandler.storeRequest(requestId, (userResponses) => {
-        // Merge user responses with auto-filled responses
-        let userResponseIndex = 0;
-        for (let i = 0; i < prompts.length; i++) {
-          if (responses[i] === null) {
-            responses[i] = userResponses[userResponseIndex] || '';
-            userResponseIndex++;
-          }
-        }
-        console.log(`[PortForward] Merged responses, finishing keyboard-interactive`);
-        finish(responses);
+        console.log(`[PortForward] Received user responses, finishing keyboard-interactive`);
+        finish(userResponses);
       }, sender.id, tunnelId);
 
-      // Send only the prompts that need user input
-      const promptsData = promptsNeedingUserInput.map((item) => ({
-        prompt: item.prompt.prompt,
-        echo: item.prompt.echo,
+      const promptsData = prompts.map((p) => ({
+        prompt: p.prompt,
+        echo: p.echo,
       }));
 
-      console.log(`[PortForward] Showing modal for ${promptsData.length} prompts that need user input`);
+      console.log(`[PortForward] Showing modal for ${promptsData.length} prompts`);
 
       safeSend(sender, "netcatty:keyboard-interactive", {
         requestId,
@@ -152,9 +113,11 @@ async function startPortForward(event, payload) {
         instructions: instructions || "",
         prompts: promptsData,
         hostname: hostname,
+        savedPassword: password || null,
       });
     });
 
+
     conn.on('ready', () => {
       console.log(`[PortForward] SSH connection ready for tunnel ${tunnelId}`);
 

electron/bridges/sftpBridge.cjs

@@ -9,6 +9,14 @@ const os = require("node:os");
 const net = require("node:net");
 const SftpClient = require("ssh2-sftp-client");
 const { Client: SSHClient } = require("ssh2");
+let SFTPWrapper;
+try {
+  // Try to load SFTPWrapper from ssh2 internals for sudo support
+  const sftpModule = require("ssh2/lib/protocol/SFTP");
+  SFTPWrapper = sftpModule.SFTP || sftpModule;
+} catch (e) {
+  console.warn("[SFTP] Failed to load SFTPWrapper from ssh2, sudo mode will not work:", e.message);
+}
 const { NetcattyAgent } = require("./netcattyAgent.cjs");
 const fileWatcherBridge = require("./fileWatcherBridge.cjs");
 const keyboardInteractiveHandler = require("./keyboardInteractiveHandler.cjs");
@@ -184,6 +192,232 @@ async function connectThroughChainForSftp(event, options, jumpHosts, targetHost,
   }
 }
 
+/**
+ * Establish an SFTP connection using sudo
+ * @param {SSHClient} client - Connected SSH client
+ * @param {string} password - User password for sudo
+ */
+async function connectSudoSftp(client, password) {
+  if (!SFTPWrapper) {
+    throw new Error("SFTP sudo mode is not available on this platform. Please disable sudo mode in host settings.");
+  }
+
+  // Known sftp-server paths to try
+  const sftpPaths = [
+    "/usr/lib/openssh/sftp-server",
+    "/usr/libexec/openssh/sftp-server",
+    "/usr/lib/ssh/sftp-server",
+    "/usr/libexec/sftp-server",
+    "/usr/local/libexec/sftp-server",
+    "/usr/local/lib/sftp-server"
+  ];
+
+  console.log("[SFTP] Probing sftp-server path for sudo mode...");
+
+  let serverPath = null;
+  // Try to find the path
+  for (const p of sftpPaths) {
+    try {
+      await new Promise((resolve, reject) => {
+        client.exec(`test -x ${p}`, (err, stream) => {
+          if (err) return reject(err);
+          stream.on('exit', (code) => {
+            if (code === 0) resolve();
+            else reject(new Error('Not found'));
+          });
+        });
+      });
+      serverPath = p;
+      break;
+    } catch (e) {
+      // Continue probing
+    }
+  }
+
+  if (!serverPath) {
+    // Fallback: try to find it in path or assume standard location
+    console.warn("[SFTP] Could not probe sftp-server, trying default /usr/lib/openssh/sftp-server");
+    serverPath = "/usr/lib/openssh/sftp-server";
+  } else {
+    console.log(`[SFTP] Found sftp-server at ${serverPath}`);
+  }
+
+  return new Promise((resolve, reject) => {
+    // Use sudo -S to read password from stdin
+    // Use -p '' to set a specific prompt we can detect
+    // Use sh -c 'printf SFTPREADY; exec ...' to synchronize the start of sftp-server
+    // We use printf instead of echo to avoid trailing newline which could confuse SFTPWrapper
+    const prompt = "SUDOPASSWORD:";
+    const readyMarker = "SFTPREADY";
+    const readyMarkerBuffer = Buffer.from(readyMarker);
+    // Add -e to sftp-server to log to stderr for debugging
+    const cmd = `sudo -S -p '${prompt}' sh -c 'printf ${readyMarker}; exec ${serverPath} -e'`;
+
+    console.log(`[SFTP] Executing sudo command: ${cmd}`);
+
+    // Disable pty to ensure clean binary stream for SFTP
+    client.exec(cmd, { pty: false }, (err, stream) => {
+      if (err) return reject(err);
+
+      // Add stream lifecycle logging
+      stream.on('close', () => console.log("[SFTP] Stream closed"));
+      stream.on('end', () => console.log("[SFTP] Stream ended"));
+      stream.on('error', (e) => console.error("[SFTP] Stream error:", e.message));
+
+      let sftpInitialized = false;
+      let sftp = null;
+      let settled = false;
+      let stdoutBuffer = Buffer.alloc(0);
+      let stderrBuffer = "";
+      let pendingAfterMarker = null;
+      let sftpCreated = false;
+      const timeoutMs = 20000;
+      const timeoutId = setTimeout(() => {
+        if (sftpInitialized || settled) return;
+        settled = true;
+        stream.stderr?.removeListener('data', onStderr);
+        stream.removeListener('data', onStdout);
+        const error = new Error("SFTP sudo handshake timed out. This may happen if: (1) the password is incorrect, (2) sudo requires a TTY, or (3) the user does not have sudo privileges.");
+        reject(error);
+      }, timeoutMs);
+
+      const finalize = (err, result) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeoutId);
+        stream.stderr?.removeListener('data', onStderr);
+        stream.removeListener('data', onStdout);
+        if (err) reject(err);
+        else resolve(result);
+      };
+
+      const createSftp = () => {
+        if (sftpCreated) return;
+        sftpCreated = true;
+        try {
+          const chanInfo = {
+            type: 'sftp',
+            incoming: stream.incoming,
+            outgoing: stream.outgoing
+          };
+          sftp = new SFTPWrapper(client, chanInfo, {
+            // debug: (str) => console.log(`[SFTP DEBUG] ${str}`)
+          });
+
+          // Route any remaining channel data directly into the SFTP parser
+          if (client._chanMgr && typeof stream.incoming?.id === "number") {
+            client._chanMgr.update(stream.incoming.id, sftp);
+          }
+
+          sftp.on('ready', () => {
+            sftpInitialized = true;
+            console.log("[SFTP] Protocol ready");
+            finalize(null, sftp);
+          });
+
+          sftp.on('error', (err) => {
+            console.error("[SFTP] Protocol error:", err.message);
+            if (!sftpInitialized) {
+              finalize(err);
+            }
+          });
+
+          stream.on('end', () => {
+            try { sftp.push(null); } catch { }
+          });
+        } catch (e) {
+          console.error("[SFTP] Initialization failed:", e.message);
+          finalize(e);
+        }
+      };
+
+      const initSftp = () => {
+        if (sftpInitialized) return;
+        console.log("[SFTP] Sudo success, initializing SFTP protocol...");
+        if (!sftpCreated) createSftp();
+        try {
+          // Start the handshake
+          console.log("[SFTP] Sending INIT packet...");
+          sftp._init();
+          if (pendingAfterMarker && pendingAfterMarker.length > 0) {
+            try {
+              sftp.push(pendingAfterMarker);
+            } catch (pushErr) {
+              console.warn("[SFTP] Failed to push buffered data:", pushErr.message);
+            }
+            pendingAfterMarker = null;
+          }
+        } catch (e) {
+          console.error("[SFTP] Initialization failed:", e.message);
+          finalize(e);
+        }
+      };
+
+      const onStdout = (data) => {
+        const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+        stdoutBuffer = stdoutBuffer.length > 0 ? Buffer.concat([stdoutBuffer, chunk]) : chunk;
+        const markerIndex = stdoutBuffer.indexOf(readyMarkerBuffer);
+        if (markerIndex !== -1) {
+          const afterMarkerIndex = markerIndex + readyMarkerBuffer.length;
+          if (afterMarkerIndex < stdoutBuffer.length) {
+            pendingAfterMarker = stdoutBuffer.subarray(afterMarkerIndex);
+          }
+          // Found marker, stop listening to stdout here so SFTPWrapper can take over
+          stream.removeListener('data', onStdout);
+          stdoutBuffer = Buffer.alloc(0);
+
+          console.log("[SFTP] SFTPREADY detected, waiting for stream to stabilize...");
+
+          // Delay SFTP initialization to ensure sftp-server is fully started and stream is clean
+          // Increased timeout to 1000ms to be safe
+          setTimeout(() => {
+            initSftp();
+          }, 1000);
+        } else if (stdoutBuffer.length > 256) {
+          stdoutBuffer = stdoutBuffer.subarray(stdoutBuffer.length - 256);
+        }
+      };
+
+      const onStderr = (data) => {
+        const chunk = data.toString();
+        // Only log that we received stderr data, not the content (may contain sensitive prompts)
+        stderrBuffer += chunk;
+        if (stderrBuffer.includes(prompt)) {
+          console.log("[SFTP] Sudo requested password, sending...");
+          // Send password
+          if (password) {
+            stream.write(password + '\n');
+          } else {
+            console.warn('[SFTP] sudo requested password but none provided');
+            stream.write('\n');
+          }
+          stderrBuffer = "";
+        } else if (stderrBuffer.length > 256) {
+          stderrBuffer = stderrBuffer.slice(-256);
+        }
+      };
+
+      stream.on('data', onStdout);
+      stream.stderr.on('data', onStderr);
+
+      // Error handling
+      stream.on('exit', (code) => {
+        console.log(`[SFTP] Stream exited with code ${code}`);
+        if (!sftpInitialized && code !== 0) {
+          let errorMsg = `SFTP sudo failed with exit code ${code}.`;
+          if (code === 1) {
+            errorMsg += " The password may be incorrect or sudo privileges are denied.";
+          } else if (code === 127) {
+            errorMsg += " sftp-server was not found on the remote system.";
+          }
+          const error = new Error(errorMsg);
+          finalize(error);
+        }
+      });
+    });
+  });
+}
+
 /**
  * Open a new SFTP connection
  * Supports jump host connections when options.jumpHosts is provided
@@ -264,6 +498,9 @@ async function openSftp(event, options) {
     const order = ["agent"];
     if (connectOpts.password) order.push("password");
     connectOpts.authHandler = order;
+  } else if (options.privateKey && connectOpts.password) {
+    // Prefer key auth when both key and password are present (password still needed for sudo)
+    connectOpts.authHandler = ["publickey", "password"];
   }
 
   // Add keyboard-interactive authentication support
@@ -283,60 +520,21 @@ async function openSftp(event, options) {
       return;
     }
 
-    // Check if all prompts are password prompts that we can auto-answer
-    const responses = [];
-    const promptsNeedingUserInput = [];
-
-    for (let i = 0; i < prompts.length; i++) {
-      const prompt = prompts[i];
-      const promptText = (prompt.prompt || '').toLowerCase().trim();
-
-      // Auto-answer password prompts if we have a configured password
-      if (options.password && (
-        promptText.includes('password') ||
-        promptText === 'password:' ||
-        promptText === 'password'
-      )) {
-        console.log(`[SFTP] Auto-answering password prompt at index ${i}`);
-        responses[i] = options.password;
-      } else {
-        // This prompt needs user input (likely 2FA)
-        promptsNeedingUserInput.push({ index: i, prompt: prompt });
-        responses[i] = null; // Placeholder
-      }
-    }
-
-    // If all prompts were auto-answered, finish immediately
-    if (promptsNeedingUserInput.length === 0) {
-      console.log(`[SFTP] All prompts auto-answered, finishing keyboard-interactive`);
-      finish(responses);
-      return;
-    }
-
-    // If some prompts need user input, show the modal
+    // Forward ALL prompts to user - no auto-fill to avoid semantic detection issues
+    // (Prompt text is admin-customizable and may not contain expected keywords)
     const requestId = keyboardInteractiveHandler.generateRequestId('sftp');
 
-    // Store finish callback with context about which responses are already filled
     keyboardInteractiveHandler.storeRequest(requestId, (userResponses) => {
-      // Merge user responses with auto-filled responses
-      let userResponseIndex = 0;
-      for (let i = 0; i < prompts.length; i++) {
-        if (responses[i] === null) {
-          responses[i] = userResponses[userResponseIndex] || '';
-          userResponseIndex++;
-        }
-      }
-      console.log(`[SFTP] Merged responses, finishing keyboard-interactive`);
-      finish(responses);
+      console.log(`[SFTP] Received user responses, finishing keyboard-interactive`);
+      finish(userResponses);
     }, event.sender.id, connId);
 
-    // Send only the prompts that need user input
-    const promptsData = promptsNeedingUserInput.map((item) => ({
-      prompt: item.prompt.prompt,
-      echo: item.prompt.echo,
+    const promptsData = prompts.map((p) => ({
+      prompt: p.prompt,
+      echo: p.echo,
     }));
 
-    console.log(`[SFTP] Showing modal for ${promptsData.length} prompts that need user input`);
+    console.log(`[SFTP] Showing modal for ${promptsData.length} prompts`);
 
     safeSend(event.sender, "netcatty:keyboard-interactive", {
       requestId,
@@ -345,9 +543,11 @@ async function openSftp(event, options) {
       instructions: instructions || "",
       prompts: promptsData,
       hostname: options.hostname,
+      savedPassword: options.password || null,
     });
   };
 
+
   // Add keyboard-interactive listener BEFORE connecting
   client.on("keyboard-interactive", kiHandler);
 
@@ -370,8 +570,44 @@ async function openSftp(event, options) {
   connectOpts.readyTimeout = 120000; // 2 minutes for 2FA input
 
   try {
-    await client.connect(connectOpts);
+    if (options.sudo) {
+      console.log(`[SFTP] Using sudo mode for connection: ${connId}`);
+      const sshClient = client.client;
 
+      await new Promise((resolve, reject) => {
+        // Set up error handler for initial connection
+        const onConnectError = (err) => reject(err);
+        sshClient.once('error', onConnectError);
+
+        sshClient.once('ready', async () => {
+          sshClient.removeListener('error', onConnectError);
+          try {
+            // Use provided password or try empty if using key auth (and hope for nopasswd sudo)
+            const sudoPass = options.password || "";
+            const sftpWrapper = await connectSudoSftp(sshClient, sudoPass);
+
+            // Inject into sftp-client
+            client.sftp = sftpWrapper;
+
+            // Important: attach cleanup listener expected by sftp-client
+            client.sftp.on('close', () => client.end());
+
+            resolve();
+          } catch (e) {
+            sshClient.end();
+            reject(e);
+          }
+        });
+
+        try {
+          sshClient.connect(connectOpts);
+        } catch (e) {
+          reject(e);
+        }
+      });
+    } else {
+      await client.connect(connectOpts);
+    }
     // Increase max listeners AFTER connect, when the internal ssh2 Client exists
     // This prevents Node.js MaxListenersExceededWarning when performing many operations
     // ssh2-sftp-client adds temporary listeners for each operation, so we need a high limit

electron/bridges/sshBridge.cjs

@@ -522,61 +522,21 @@ async function startSSHSession(event, options) {
           return;
         }
 
-        // Check if all prompts are password prompts that we can auto-answer
-        const responses = [];
-        const promptsNeedingUserInput = [];
-
-        for (let i = 0; i < prompts.length; i++) {
-          const prompt = prompts[i];
-          const promptText = (prompt.prompt || '').toLowerCase().trim();
-
-          // Auto-answer password prompts if we have a configured password
-          if (options.password && (
-            promptText.includes('password') ||
-            promptText === 'password:' ||
-            promptText === 'password'
-          )) {
-            console.log(`${logPrefix} Auto-answering password prompt at index ${i}`);
-            responses[i] = options.password;
-          } else {
-            // This prompt needs user input (likely 2FA)
-            promptsNeedingUserInput.push({ index: i, prompt: prompt });
-            responses[i] = null; // Placeholder
-          }
-        }
-
-        // If all prompts were auto-answered, finish immediately
-        if (promptsNeedingUserInput.length === 0) {
-          console.log(`${logPrefix} All prompts auto-answered, finishing keyboard-interactive`);
-          finish(responses);
-          return;
-        }
-
-        // If some prompts need user input, show the modal
-        // But only send the prompts that need user input
+        // Forward ALL prompts to user - no auto-fill to avoid semantic detection issues
+        // (Prompt text is admin-customizable and may not contain expected keywords)
         const requestId = keyboardInteractiveHandler.generateRequestId('ssh');
 
-        // Store finish callback with context about which responses are already filled
         keyboardInteractiveHandler.storeRequest(requestId, (userResponses) => {
-          // Merge user responses with auto-filled responses
-          let userResponseIndex = 0;
-          for (let i = 0; i < prompts.length; i++) {
-            if (responses[i] === null) {
-              responses[i] = userResponses[userResponseIndex] || '';
-              userResponseIndex++;
-            }
-          }
-          console.log(`${logPrefix} Merged responses, finishing keyboard-interactive`);
-          finish(responses);
+          console.log(`${logPrefix} Received user responses, finishing keyboard-interactive`);
+          finish(userResponses);
         }, sender.id, sessionId);
 
-        // Send only the prompts that need user input
-        const promptsData = promptsNeedingUserInput.map((item) => ({
-          prompt: item.prompt.prompt,
-          echo: item.prompt.echo,
+        const promptsData = prompts.map((p) => ({
+          prompt: p.prompt,
+          echo: p.echo,
         }));
 
-        console.log(`${logPrefix} Showing modal for ${promptsData.length} prompts that need user input`);
+        console.log(`${logPrefix} Showing modal for ${promptsData.length} prompts`);
 
         safeSend(sender, "netcatty:keyboard-interactive", {
           requestId,
@@ -585,9 +545,11 @@ async function startSSHSession(event, options) {
           instructions: instructions || "",
           prompts: promptsData,
           hostname: options.hostname,
+          savedPassword: options.password || null, // Pass saved password for optional fill button
         });
       });
 
+
       // Enable keyboard-interactive authentication in authHandler
       if (connectOpts.authHandler) {
         // Add keyboard-interactive after the existing methods

global.d.ts

@@ -2,460 +2,463 @@ import type { RemoteFile } from "./types";
 import type { S3Config, SMBConfig, SyncedFile, WebDAVConfig } from "./domain/sync";
 
 declare global {
-// Proxy configuration for SSH connections
-interface NetcattyProxyConfig {
-  type: 'http' | 'socks5';
-  host: string;
-  port: number;
-  username?: string;
-  password?: string;
-}
-
-// Jump host configuration for SSH tunneling
-interface NetcattyJumpHost {
-  hostname: string;
-  port: number;
-  username: string;
-  password?: string;
-  privateKey?: string;
-  certificate?: string;
-  passphrase?: string;
-  publicKey?: string;
-  keyId?: string;
-  keySource?: 'generated' | 'imported';
-  label?: string; // Display label for UI
-}
-
-// Host key information for verification
-// Reserved for future host key verification UI feature
-interface _NetcattyHostKeyInfo {
-  hostname: string;
-  port: number;
-  keyType: string;
-  fingerprint: string;
-  publicKey?: string;
-}
-
-interface NetcattySSHOptions {
-  sessionId?: string;
-  hostname: string;
-  username: string;
-  port?: number;
-  password?: string;
-  privateKey?: string;
-  // Optional OpenSSH user certificate
-  certificate?: string;
-  publicKey?: string; // OpenSSH public key line
-  keyId?: string;
-  keySource?: 'generated' | 'imported';
-  agentForwarding?: boolean;
-  cols?: number;
-  rows?: number;
-  charset?: string;
-  extraArgs?: string[];
-  startupCommand?: string;
-  passphrase?: string;
-  // Environment variables to set in the remote shell
-  env?: Record<string, string>;
-  // Proxy configuration
-  proxy?: NetcattyProxyConfig;
-  // Jump hosts (bastion chain)
-  jumpHosts?: NetcattyJumpHost[];
-  // SSH-level keepalive interval in seconds (0 = disabled)
-  keepaliveInterval?: number;
-}
-
-interface SftpStatResult {
-  name: string;
-  type: 'file' | 'directory' | 'symlink';
-  size: number;
-  lastModified: number; // timestamp
-  permissions?: string; // e.g., "rwxr-xr-x"
-  owner?: string;
-  group?: string;
-}
-
-interface SftpTransferProgress {
-  transferId: string;
-  bytesTransferred: number;
-  totalBytes: number;
-  speed: number; // bytes per second
-}
-
-// Port Forwarding Types
-interface PortForwardOptions {
-  tunnelId: string;
-  type: 'local' | 'remote' | 'dynamic';
-  localPort: number;
-  bindAddress?: string;
-  remoteHost?: string;
-  remotePort?: number;
-  // SSH connection details
-  hostname: string;
-  port?: number;
-  username: string;
-  password?: string;
-  privateKey?: string;
-}
-
-interface PortForwardResult {
-  tunnelId: string;
-  success: boolean;
-  error?: string;
-}
-
-interface PortForwardStatusResult {
-  tunnelId: string;
-  status: 'inactive' | 'connecting' | 'active' | 'error';
-  type?: 'local' | 'remote' | 'dynamic';
-  error?: string;
-}
-
-type PortForwardStatusCallback = (status: 'inactive' | 'connecting' | 'active' | 'error', error?: string) => void;
-
-interface NetcattyBridge {
-  startSSHSession(options: NetcattySSHOptions): Promise<string>;
-  startTelnetSession?(options: {
-    sessionId?: string;
-    hostname: string;
-    port?: number;
-    cols?: number;
-    rows?: number;
-    charset?: string;
-    env?: Record<string, string>;
-  }): Promise<string>;
-  startMoshSession?(options: {
-    sessionId?: string;
-    hostname: string;
+  // Proxy configuration for SSH connections
+  interface NetcattyProxyConfig {
+    type: 'http' | 'socks5';
+    host: string;
+    port: number;
     username?: string;
-    port?: number;
-    moshServerPath?: string;
-    agentForwarding?: boolean;
-    cols?: number;
-    rows?: number;
-    charset?: string;
-    env?: Record<string, string>;
-  }): Promise<string>;
-  startLocalSession?(options: { sessionId?: string; cols?: number; rows?: number; shell?: string; cwd?: string; env?: Record<string, string> }): Promise<string>;
-  startSerialSession?(options: {
+    password?: string;
+  }
+
+  // Jump host configuration for SSH tunneling
+  interface NetcattyJumpHost {
+    hostname: string;
+    port: number;
+    username: string;
+    password?: string;
+    privateKey?: string;
+    certificate?: string;
+    passphrase?: string;
+    publicKey?: string;
+    keyId?: string;
+    keySource?: 'generated' | 'imported';
+    label?: string; // Display label for UI
+  }
+
+  // Host key information for verification
+  // Reserved for future host key verification UI feature
+  interface _NetcattyHostKeyInfo {
+    hostname: string;
+    port: number;
+    keyType: string;
+    fingerprint: string;
+    publicKey?: string;
+  }
+
+  interface NetcattySSHOptions {
     sessionId?: string;
-    path: string;
-    baudRate?: number;
-    dataBits?: 5 | 6 | 7 | 8;
-    stopBits?: 1 | 1.5 | 2;
-    parity?: 'none' | 'even' | 'odd' | 'mark' | 'space';
-    flowControl?: 'none' | 'xon/xoff' | 'rts/cts';
-  }): Promise<string>;
-  listSerialPorts?(): Promise<Array<{
-    path: string;
-    manufacturer: string;
-    serialNumber: string;
-    vendorId: string;
-    productId: string;
-    pnpId: string;
-  }>>;
-  getDefaultShell?(): Promise<string>;
-  validatePath?(path: string, type?: 'file' | 'directory' | 'any'): Promise<{ exists: boolean; isFile: boolean; isDirectory: boolean }>;
-  generateKeyPair?(options: {
-    type: 'RSA' | 'ECDSA' | 'ED25519';
-    bits?: number;
-    comment?: string;
-  }): Promise<{ success: boolean; privateKey?: string; publicKey?: string; error?: string }>;
-  execCommand(options: {
     hostname: string;
     username: string;
     port?: number;
     password?: string;
     privateKey?: string;
-    command: string;
-    timeout?: number;
-  }): Promise<{ stdout: string; stderr: string; code: number | null }>;
-  /** Get current working directory from an active SSH session */
-  getSessionPwd?(sessionId: string): Promise<{ success: boolean; cwd?: string; error?: string }>;
-  writeToSession(sessionId: string, data: string): void;
-  resizeSession(sessionId: string, cols: number, rows: number): void;
-  closeSession(sessionId: string): void;
-  onSessionData(sessionId: string, cb: (data: string) => void): () => void;
-  onSessionExit(
-    sessionId: string,
-    cb: (evt: { exitCode?: number; signal?: number }) => void
-  ): () => void;
-  onAuthFailed?(
-    sessionId: string,
-    cb: (evt: { sessionId: string; error: string; hostname: string }) => void
-  ): () => void;
-  
-  // Keyboard-interactive authentication (2FA/MFA)
-  onKeyboardInteractive?(
-    cb: (request: {
-      requestId: string;
-      sessionId: string;
-      name: string;
-      instructions: string;
-      prompts: Array<{ prompt: string; echo: boolean }>;
-      hostname: string;
-    }) => void
-  ): () => void;
-  respondKeyboardInteractive?(
-    requestId: string,
-    responses: string[],
-    cancelled?: boolean
-  ): Promise<{ success: boolean; error?: string }>;
-  
-  // SFTP operations
-  openSftp(options: NetcattySSHOptions): Promise<string>;
-  listSftp(sftpId: string, path: string): Promise<RemoteFile[]>;
-  readSftp(sftpId: string, path: string): Promise<string>;
-  readSftpBinary?(sftpId: string, path: string): Promise<ArrayBuffer>;
-  writeSftp(sftpId: string, path: string, content: string): Promise<void>;
-  writeSftpBinary?(sftpId: string, path: string, content: ArrayBuffer): Promise<void>;
-  closeSftp(sftpId: string): Promise<void>;
-  mkdirSftp(sftpId: string, path: string): Promise<void>;
-  deleteSftp?(sftpId: string, path: string): Promise<void>;
-  renameSftp?(sftpId: string, oldPath: string, newPath: string): Promise<void>;
-  statSftp?(sftpId: string, path: string): Promise<SftpStatResult>;
-  chmodSftp?(sftpId: string, path: string, mode: string): Promise<void>;
-  
-  // Write binary with real-time progress callback
-  writeSftpBinaryWithProgress?(
-    sftpId: string, 
-    path: string, 
-    content: ArrayBuffer, 
-    transferId: string,
-    onProgress?: (transferred: number, total: number, speed: number) => void,
-    onComplete?: () => void,
-    onError?: (error: string) => void
-  ): Promise<{ success: boolean; transferId: string }>;
-  
-  // Transfer with progress
-  uploadFile?(sftpId: string, localPath: string, remotePath: string, transferId: string): Promise<void>;
-  downloadFile?(sftpId: string, remotePath: string, localPath: string, transferId: string): Promise<void>;
-  cancelTransfer?(transferId: string): Promise<void>;
-  onTransferProgress?(transferId: string, cb: (progress: SftpTransferProgress) => void): () => void;
-  
-  // Streaming transfer with real progress and cancellation
-  startStreamTransfer?(
-    options: {
-      transferId: string;
-      sourcePath: string;
-      targetPath: string;
-      sourceType: 'local' | 'sftp';
-      targetType: 'local' | 'sftp';
-      sourceSftpId?: string;
-      targetSftpId?: string;
-      totalBytes?: number;
-    },
-    onProgress?: (transferred: number, total: number, speed: number) => void,
-    onComplete?: () => void,
-    onError?: (error: string) => void
-  ): Promise<{ transferId: string; totalBytes?: number; error?: string }>;
-  
-  // Local filesystem operations
-  listLocalDir?(path: string): Promise<RemoteFile[]>;
-  readLocalFile?(path: string): Promise<ArrayBuffer>;
-  writeLocalFile?(path: string, content: ArrayBuffer): Promise<void>;
-  deleteLocalFile?(path: string): Promise<void>;
-  renameLocalFile?(oldPath: string, newPath: string): Promise<void>;
-  mkdirLocal?(path: string): Promise<void>;
-  statLocal?(path: string): Promise<SftpStatResult>;
-  getHomeDir?(): Promise<string>;
-  getSystemInfo?(): Promise<{ username: string; hostname: string }>;
-  
-  setTheme?(theme: 'light' | 'dark'): Promise<boolean>;
-  setBackgroundColor?(color: string): Promise<boolean>;
-  setLanguage?(language: string): Promise<boolean>;
-  // Window controls for custom title bar (Windows/Linux)
-  windowMinimize?(): Promise<void>;
-  windowMaximize?(): Promise<boolean>;
-  windowClose?(): Promise<void>;
-  windowIsMaximized?(): Promise<boolean>;
-  windowIsFullscreen?(): Promise<boolean>;
-  onWindowFullScreenChanged?(cb: (isFullscreen: boolean) => void): () => void;
-  
-  // Settings window
-  openSettingsWindow?(): Promise<boolean>;
-  closeSettingsWindow?(): Promise<void>;
+    // Optional OpenSSH user certificate
+    certificate?: string;
+    publicKey?: string; // OpenSSH public key line
+    keyId?: string;
+    keySource?: 'generated' | 'imported';
+    agentForwarding?: boolean;
+    cols?: number;
+    rows?: number;
+    charset?: string;
+    extraArgs?: string[];
+    startupCommand?: string;
+    passphrase?: string;
+    // Environment variables to set in the remote shell
+    env?: Record<string, string>;
+    // Proxy configuration
+    proxy?: NetcattyProxyConfig;
+    // Jump hosts (bastion chain)
+    jumpHosts?: NetcattyJumpHost[];
+    // SSH-level keepalive interval in seconds (0 = disabled)
+    keepaliveInterval?: number;
+    // Use sudo for SFTP server
+    sudo?: boolean;
+  }
 
-  // Cross-window settings sync
-  notifySettingsChanged?(payload: { key: string; value: unknown }): void;
-  onSettingsChanged?(cb: (payload: { key: string; value: unknown }) => void): () => void;
+  interface SftpStatResult {
+    name: string;
+    type: 'file' | 'directory' | 'symlink';
+    size: number;
+    lastModified: number; // timestamp
+    permissions?: string; // e.g., "rwxr-xr-x"
+    owner?: string;
+    group?: string;
+  }
 
-  // Cloud sync master password (stored in-memory + persisted via Electron safeStorage)
-  cloudSyncSetSessionPassword?(password: string): Promise<boolean>;
-  cloudSyncGetSessionPassword?(): Promise<string | null>;
-  cloudSyncClearSessionPassword?(): Promise<boolean>;
+  interface SftpTransferProgress {
+    transferId: string;
+    bytesTransferred: number;
+    totalBytes: number;
+    speed: number; // bytes per second
+  }
 
-  // Cloud sync network operations (proxied via main process)
-  cloudSyncWebdavInitialize?(config: WebDAVConfig): Promise<{ resourceId: string | null }>;
-  cloudSyncWebdavUpload?(
-    config: WebDAVConfig,
-    syncedFile: SyncedFile
-  ): Promise<{ resourceId: string }>;
-  cloudSyncWebdavDownload?(config: WebDAVConfig): Promise<{ syncedFile: SyncedFile | null }>;
-  cloudSyncWebdavDelete?(config: WebDAVConfig): Promise<{ ok: true }>;
+  // Port Forwarding Types
+  interface PortForwardOptions {
+    tunnelId: string;
+    type: 'local' | 'remote' | 'dynamic';
+    localPort: number;
+    bindAddress?: string;
+    remoteHost?: string;
+    remotePort?: number;
+    // SSH connection details
+    hostname: string;
+    port?: number;
+    username: string;
+    password?: string;
+    privateKey?: string;
+  }
 
-  cloudSyncS3Initialize?(config: S3Config): Promise<{ resourceId: string | null }>;
-  cloudSyncS3Upload?(
-    config: S3Config,
-    syncedFile: SyncedFile
-  ): Promise<{ resourceId: string }>;
-  cloudSyncS3Download?(config: S3Config): Promise<{ syncedFile: SyncedFile | null }>;
-  cloudSyncS3Delete?(config: S3Config): Promise<{ ok: true }>;
-
-  cloudSyncSmbInitialize?(config: SMBConfig): Promise<{ resourceId: string | null }>;
-  cloudSyncSmbUpload?(
-    config: SMBConfig,
-    syncedFile: SyncedFile
-  ): Promise<{ resourceId: string }>;
-  cloudSyncSmbDownload?(config: SMBConfig): Promise<{ syncedFile: SyncedFile | null }>;
-  cloudSyncSmbDelete?(config: SMBConfig): Promise<{ ok: true }>;
-  
-  // Port Forwarding
-  startPortForward?(options: PortForwardOptions): Promise<PortForwardResult>;
-  stopPortForward?(tunnelId: string): Promise<PortForwardResult>;
-  getPortForwardStatus?(tunnelId: string): Promise<PortForwardStatusResult>;
-  listPortForwards?(): Promise<{ tunnelId: string; type: string; status: string }[]>;
-  onPortForwardStatus?(tunnelId: string, cb: PortForwardStatusCallback): () => void;
-  
-  // Known Hosts
-  readKnownHosts?(): Promise<string | null>;
-  
-  // Open URL in default browser
-  openExternal?(url: string): Promise<void>;
-
-  // App info (name/version/platform) for About screens
-  getAppInfo?(): Promise<{ name: string; version: string; platform: string }>;
-
-  // Notify main process the renderer has mounted/painted (used to avoid initial blank screen).
-  rendererReady?(): void;
-
-  onLanguageChanged?(cb: (language: string) => void): () => void;
-
-  // Chain progress listener for jump host connections
-  // Callback receives: (currentHop: number, totalHops: number, hostLabel: string, status: string)
-  onChainProgress?(cb: (hop: number, total: number, label: string, status: string) => void): () => void;
-  
-  // OAuth callback server for cloud sync
-  startOAuthCallback?(expectedState?: string): Promise<{ code: string; state?: string }>;
-  cancelOAuthCallback?(): Promise<void>;
-
-  // GitHub Device Flow (cloud sync)
-  githubStartDeviceFlow?(options?: { clientId?: string; scope?: string }): Promise<{
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    expiresAt: number;
-    interval: number;
-  }>;
-  githubPollDeviceFlowToken?(options: { clientId?: string; deviceCode: string }): Promise<{
-    access_token?: string;
-    token_type?: string;
-    scope?: string;
+  interface PortForwardResult {
+    tunnelId: string;
+    success: boolean;
     error?: string;
-    error_description?: string;
-  }>;
+  }
 
-  // Google OAuth (cloud sync) - proxied via main process to avoid CORS
-  googleExchangeCodeForTokens?(options: {
-    clientId: string;
-    clientSecret?: string;
-    code: string;
-    codeVerifier: string;
-    redirectUri: string;
-  }): Promise<{
-    accessToken: string;
-    refreshToken?: string;
-    expiresAt?: number;
-    tokenType: string;
-    scope?: string;
-  }>;
-  googleRefreshAccessToken?(options: {
-    clientId: string;
-    clientSecret?: string;
-    refreshToken: string;
-  }): Promise<{
-    accessToken: string;
-    refreshToken: string;
-    expiresAt?: number;
-    tokenType: string;
-    scope?: string;
-  }>;
-  googleGetUserInfo?(options: { accessToken: string }): Promise<{
-    id: string;
-    email: string;
-    name: string;
-    picture?: string;
-  }>;
+  interface PortForwardStatusResult {
+    tunnelId: string;
+    status: 'inactive' | 'connecting' | 'active' | 'error';
+    type?: 'local' | 'remote' | 'dynamic';
+    error?: string;
+  }
 
-  // Google Drive API (cloud sync) - proxied via main process to avoid CORS/COEP issues
-  googleDriveFindSyncFile?(options: { accessToken: string; fileName?: string }): Promise<{ fileId: string | null }>;
-  googleDriveCreateSyncFile?(options: { accessToken: string; fileName?: string; syncedFile: unknown }): Promise<{ fileId: string }>;
-  googleDriveUpdateSyncFile?(options: { accessToken: string; fileId: string; syncedFile: unknown }): Promise<{ ok: true }>;
-  googleDriveDownloadSyncFile?(options: { accessToken: string; fileId: string }): Promise<{ syncedFile: unknown | null }>;
-  googleDriveDeleteSyncFile?(options: { accessToken: string; fileId: string }): Promise<{ ok: true }>;
+  type PortForwardStatusCallback = (status: 'inactive' | 'connecting' | 'active' | 'error', error?: string) => void;
 
-  // OneDrive OAuth + Graph (cloud sync) - proxied via main process to avoid CORS
-  onedriveExchangeCodeForTokens?(options: {
-    clientId: string;
-    code: string;
-    codeVerifier: string;
-    redirectUri: string;
-    scope?: string;
-  }): Promise<{
-    accessToken: string;
-    refreshToken?: string;
-    expiresAt?: number;
-    tokenType: string;
-    scope?: string;
-  }>;
-  onedriveRefreshAccessToken?(options: {
-    clientId: string;
-    refreshToken: string;
-    scope?: string;
-  }): Promise<{
-    accessToken: string;
-    refreshToken: string;
-    expiresAt?: number;
-    tokenType: string;
-    scope?: string;
-  }>;
-  onedriveGetUserInfo?(options: { accessToken: string }): Promise<{
-    id: string;
-    email: string;
-    name: string;
-    avatarDataUrl?: string;
-  }>;
-  onedriveFindSyncFile?(options: { accessToken: string; fileName?: string }): Promise<{ fileId: string | null }>;
-  onedriveUploadSyncFile?(options: { accessToken: string; fileName?: string; syncedFile: unknown }): Promise<{ fileId: string | null }>;
-  onedriveDownloadSyncFile?(options: { accessToken: string; fileId?: string; fileName?: string }): Promise<{ syncedFile: unknown | null }>;
-  onedriveDeleteSyncFile?(options: { accessToken: string; fileId: string }): Promise<{ ok: true }>;
+  interface NetcattyBridge {
+    startSSHSession(options: NetcattySSHOptions): Promise<string>;
+    startTelnetSession?(options: {
+      sessionId?: string;
+      hostname: string;
+      port?: number;
+      cols?: number;
+      rows?: number;
+      charset?: string;
+      env?: Record<string, string>;
+    }): Promise<string>;
+    startMoshSession?(options: {
+      sessionId?: string;
+      hostname: string;
+      username?: string;
+      port?: number;
+      moshServerPath?: string;
+      agentForwarding?: boolean;
+      cols?: number;
+      rows?: number;
+      charset?: string;
+      env?: Record<string, string>;
+    }): Promise<string>;
+    startLocalSession?(options: { sessionId?: string; cols?: number; rows?: number; shell?: string; cwd?: string; env?: Record<string, string> }): Promise<string>;
+    startSerialSession?(options: {
+      sessionId?: string;
+      path: string;
+      baudRate?: number;
+      dataBits?: 5 | 6 | 7 | 8;
+      stopBits?: 1 | 1.5 | 2;
+      parity?: 'none' | 'even' | 'odd' | 'mark' | 'space';
+      flowControl?: 'none' | 'xon/xoff' | 'rts/cts';
+    }): Promise<string>;
+    listSerialPorts?(): Promise<Array<{
+      path: string;
+      manufacturer: string;
+      serialNumber: string;
+      vendorId: string;
+      productId: string;
+      pnpId: string;
+    }>>;
+    getDefaultShell?(): Promise<string>;
+    validatePath?(path: string, type?: 'file' | 'directory' | 'any'): Promise<{ exists: boolean; isFile: boolean; isDirectory: boolean }>;
+    generateKeyPair?(options: {
+      type: 'RSA' | 'ECDSA' | 'ED25519';
+      bits?: number;
+      comment?: string;
+    }): Promise<{ success: boolean; privateKey?: string; publicKey?: string; error?: string }>;
+    execCommand(options: {
+      hostname: string;
+      username: string;
+      port?: number;
+      password?: string;
+      privateKey?: string;
+      command: string;
+      timeout?: number;
+    }): Promise<{ stdout: string; stderr: string; code: number | null }>;
+    /** Get current working directory from an active SSH session */
+    getSessionPwd?(sessionId: string): Promise<{ success: boolean; cwd?: string; error?: string }>;
+    writeToSession(sessionId: string, data: string): void;
+    resizeSession(sessionId: string, cols: number, rows: number): void;
+    closeSession(sessionId: string): void;
+    onSessionData(sessionId: string, cb: (data: string) => void): () => void;
+    onSessionExit(
+      sessionId: string,
+      cb: (evt: { exitCode?: number; signal?: number }) => void
+    ): () => void;
+    onAuthFailed?(
+      sessionId: string,
+      cb: (evt: { sessionId: string; error: string; hostname: string }) => void
+    ): () => void;
 
-  // File opener helpers (for "Open With" feature)
-  selectApplication?(): Promise<{ path: string; name: string } | null>;
-  openWithApplication?(filePath: string, appPath: string): Promise<boolean>;
-  downloadSftpToTemp?(sftpId: string, remotePath: string, fileName: string): Promise<string>;
-  
-  // File watcher for auto-sync feature
-  startFileWatch?(localPath: string, remotePath: string, sftpId: string): Promise<{ watchId: string }>;
-  stopFileWatch?(watchId: string, cleanupTempFile?: boolean): Promise<{ success: boolean }>;
-  listFileWatches?(): Promise<Array<{ watchId: string; localPath: string; remotePath: string; sftpId: string }>>;
-  registerTempFile?(sftpId: string, localPath: string): Promise<{ success: boolean }>;
-  onFileWatchSynced?(cb: (payload: { watchId: string; localPath: string; remotePath: string; bytesWritten: number }) => void): () => void;
-  onFileWatchError?(cb: (payload: { watchId: string; localPath: string; remotePath: string; error: string }) => void): () => void;
-  
-  // Temp file cleanup
-  deleteTempFile?(filePath: string): Promise<{ success: boolean }>;
-  
-  // Temp directory management
-  getTempDirInfo?(): Promise<{ path: string; fileCount: number; totalSize: number }>;
-  clearTempDir?(): Promise<{ deletedCount: number; failedCount: number; error?: string }>;
-  getTempDirPath?(): Promise<string>;
-  openTempDir?(): Promise<{ success: boolean }>;
-}
+    // Keyboard-interactive authentication (2FA/MFA)
+    onKeyboardInteractive?(
+      cb: (request: {
+        requestId: string;
+        sessionId: string;
+        name: string;
+        instructions: string;
+        prompts: Array<{ prompt: string; echo: boolean }>;
+        hostname: string;
+        savedPassword?: string | null;
+      }) => void
+    ): () => void;
+    respondKeyboardInteractive?(
+      requestId: string,
+      responses: string[],
+      cancelled?: boolean
+    ): Promise<{ success: boolean; error?: string }>;
 
-interface Window {
-  netcatty?: NetcattyBridge;
-}
+    // SFTP operations
+    openSftp(options: NetcattySSHOptions): Promise<string>;
+    listSftp(sftpId: string, path: string): Promise<RemoteFile[]>;
+    readSftp(sftpId: string, path: string): Promise<string>;
+    readSftpBinary?(sftpId: string, path: string): Promise<ArrayBuffer>;
+    writeSftp(sftpId: string, path: string, content: string): Promise<void>;
+    writeSftpBinary?(sftpId: string, path: string, content: ArrayBuffer): Promise<void>;
+    closeSftp(sftpId: string): Promise<void>;
+    mkdirSftp(sftpId: string, path: string): Promise<void>;
+    deleteSftp?(sftpId: string, path: string): Promise<void>;
+    renameSftp?(sftpId: string, oldPath: string, newPath: string): Promise<void>;
+    statSftp?(sftpId: string, path: string): Promise<SftpStatResult>;
+    chmodSftp?(sftpId: string, path: string, mode: string): Promise<void>;
+
+    // Write binary with real-time progress callback
+    writeSftpBinaryWithProgress?(
+      sftpId: string,
+      path: string,
+      content: ArrayBuffer,
+      transferId: string,
+      onProgress?: (transferred: number, total: number, speed: number) => void,
+      onComplete?: () => void,
+      onError?: (error: string) => void
+    ): Promise<{ success: boolean; transferId: string }>;
+
+    // Transfer with progress
+    uploadFile?(sftpId: string, localPath: string, remotePath: string, transferId: string): Promise<void>;
+    downloadFile?(sftpId: string, remotePath: string, localPath: string, transferId: string): Promise<void>;
+    cancelTransfer?(transferId: string): Promise<void>;
+    onTransferProgress?(transferId: string, cb: (progress: SftpTransferProgress) => void): () => void;
+
+    // Streaming transfer with real progress and cancellation
+    startStreamTransfer?(
+      options: {
+        transferId: string;
+        sourcePath: string;
+        targetPath: string;
+        sourceType: 'local' | 'sftp';
+        targetType: 'local' | 'sftp';
+        sourceSftpId?: string;
+        targetSftpId?: string;
+        totalBytes?: number;
+      },
+      onProgress?: (transferred: number, total: number, speed: number) => void,
+      onComplete?: () => void,
+      onError?: (error: string) => void
+    ): Promise<{ transferId: string; totalBytes?: number; error?: string }>;
+
+    // Local filesystem operations
+    listLocalDir?(path: string): Promise<RemoteFile[]>;
+    readLocalFile?(path: string): Promise<ArrayBuffer>;
+    writeLocalFile?(path: string, content: ArrayBuffer): Promise<void>;
+    deleteLocalFile?(path: string): Promise<void>;
+    renameLocalFile?(oldPath: string, newPath: string): Promise<void>;
+    mkdirLocal?(path: string): Promise<void>;
+    statLocal?(path: string): Promise<SftpStatResult>;
+    getHomeDir?(): Promise<string>;
+    getSystemInfo?(): Promise<{ username: string; hostname: string }>;
+
+    setTheme?(theme: 'light' | 'dark'): Promise<boolean>;
+    setBackgroundColor?(color: string): Promise<boolean>;
+    setLanguage?(language: string): Promise<boolean>;
+    // Window controls for custom title bar (Windows/Linux)
+    windowMinimize?(): Promise<void>;
+    windowMaximize?(): Promise<boolean>;
+    windowClose?(): Promise<void>;
+    windowIsMaximized?(): Promise<boolean>;
+    windowIsFullscreen?(): Promise<boolean>;
+    onWindowFullScreenChanged?(cb: (isFullscreen: boolean) => void): () => void;
+
+    // Settings window
+    openSettingsWindow?(): Promise<boolean>;
+    closeSettingsWindow?(): Promise<void>;
+
+    // Cross-window settings sync
+    notifySettingsChanged?(payload: { key: string; value: unknown }): void;
+    onSettingsChanged?(cb: (payload: { key: string; value: unknown }) => void): () => void;
+
+    // Cloud sync master password (stored in-memory + persisted via Electron safeStorage)
+    cloudSyncSetSessionPassword?(password: string): Promise<boolean>;
+    cloudSyncGetSessionPassword?(): Promise<string | null>;
+    cloudSyncClearSessionPassword?(): Promise<boolean>;
+
+    // Cloud sync network operations (proxied via main process)
+    cloudSyncWebdavInitialize?(config: WebDAVConfig): Promise<{ resourceId: string | null }>;
+    cloudSyncWebdavUpload?(
+      config: WebDAVConfig,
+      syncedFile: SyncedFile
+    ): Promise<{ resourceId: string }>;
+    cloudSyncWebdavDownload?(config: WebDAVConfig): Promise<{ syncedFile: SyncedFile | null }>;
+    cloudSyncWebdavDelete?(config: WebDAVConfig): Promise<{ ok: true }>;
+
+    cloudSyncS3Initialize?(config: S3Config): Promise<{ resourceId: string | null }>;
+    cloudSyncS3Upload?(
+      config: S3Config,
+      syncedFile: SyncedFile
+    ): Promise<{ resourceId: string }>;
+    cloudSyncS3Download?(config: S3Config): Promise<{ syncedFile: SyncedFile | null }>;
+    cloudSyncS3Delete?(config: S3Config): Promise<{ ok: true }>;
+
+    cloudSyncSmbInitialize?(config: SMBConfig): Promise<{ resourceId: string | null }>;
+    cloudSyncSmbUpload?(
+      config: SMBConfig,
+      syncedFile: SyncedFile
+    ): Promise<{ resourceId: string }>;
+    cloudSyncSmbDownload?(config: SMBConfig): Promise<{ syncedFile: SyncedFile | null }>;
+    cloudSyncSmbDelete?(config: SMBConfig): Promise<{ ok: true }>;
+
+    // Port Forwarding
+    startPortForward?(options: PortForwardOptions): Promise<PortForwardResult>;
+    stopPortForward?(tunnelId: string): Promise<PortForwardResult>;
+    getPortForwardStatus?(tunnelId: string): Promise<PortForwardStatusResult>;
+    listPortForwards?(): Promise<{ tunnelId: string; type: string; status: string }[]>;
+    onPortForwardStatus?(tunnelId: string, cb: PortForwardStatusCallback): () => void;
+
+    // Known Hosts
+    readKnownHosts?(): Promise<string | null>;
+
+    // Open URL in default browser
+    openExternal?(url: string): Promise<void>;
+
+    // App info (name/version/platform) for About screens
+    getAppInfo?(): Promise<{ name: string; version: string; platform: string }>;
+
+    // Notify main process the renderer has mounted/painted (used to avoid initial blank screen).
+    rendererReady?(): void;
+
+    onLanguageChanged?(cb: (language: string) => void): () => void;
+
+    // Chain progress listener for jump host connections
+    // Callback receives: (currentHop: number, totalHops: number, hostLabel: string, status: string)
+    onChainProgress?(cb: (hop: number, total: number, label: string, status: string) => void): () => void;
+
+    // OAuth callback server for cloud sync
+    startOAuthCallback?(expectedState?: string): Promise<{ code: string; state?: string }>;
+    cancelOAuthCallback?(): Promise<void>;
+
+    // GitHub Device Flow (cloud sync)
+    githubStartDeviceFlow?(options?: { clientId?: string; scope?: string }): Promise<{
+      deviceCode: string;
+      userCode: string;
+      verificationUri: string;
+      expiresAt: number;
+      interval: number;
+    }>;
+    githubPollDeviceFlowToken?(options: { clientId?: string; deviceCode: string }): Promise<{
+      access_token?: string;
+      token_type?: string;
+      scope?: string;
+      error?: string;
+      error_description?: string;
+    }>;
+
+    // Google OAuth (cloud sync) - proxied via main process to avoid CORS
+    googleExchangeCodeForTokens?(options: {
+      clientId: string;
+      clientSecret?: string;
+      code: string;
+      codeVerifier: string;
+      redirectUri: string;
+    }): Promise<{
+      accessToken: string;
+      refreshToken?: string;
+      expiresAt?: number;
+      tokenType: string;
+      scope?: string;
+    }>;
+    googleRefreshAccessToken?(options: {
+      clientId: string;
+      clientSecret?: string;
+      refreshToken: string;
+    }): Promise<{
+      accessToken: string;
+      refreshToken: string;
+      expiresAt?: number;
+      tokenType: string;
+      scope?: string;
+    }>;
+    googleGetUserInfo?(options: { accessToken: string }): Promise<{
+      id: string;
+      email: string;
+      name: string;
+      picture?: string;
+    }>;
+
+    // Google Drive API (cloud sync) - proxied via main process to avoid CORS/COEP issues
+    googleDriveFindSyncFile?(options: { accessToken: string; fileName?: string }): Promise<{ fileId: string | null }>;
+    googleDriveCreateSyncFile?(options: { accessToken: string; fileName?: string; syncedFile: unknown }): Promise<{ fileId: string }>;
+    googleDriveUpdateSyncFile?(options: { accessToken: string; fileId: string; syncedFile: unknown }): Promise<{ ok: true }>;
+    googleDriveDownloadSyncFile?(options: { accessToken: string; fileId: string }): Promise<{ syncedFile: unknown | null }>;
+    googleDriveDeleteSyncFile?(options: { accessToken: string; fileId: string }): Promise<{ ok: true }>;
+
+    // OneDrive OAuth + Graph (cloud sync) - proxied via main process to avoid CORS
+    onedriveExchangeCodeForTokens?(options: {
+      clientId: string;
+      code: string;
+      codeVerifier: string;
+      redirectUri: string;
+      scope?: string;
+    }): Promise<{
+      accessToken: string;
+      refreshToken?: string;
+      expiresAt?: number;
+      tokenType: string;
+      scope?: string;
+    }>;
+    onedriveRefreshAccessToken?(options: {
+      clientId: string;
+      refreshToken: string;
+      scope?: string;
+    }): Promise<{
+      accessToken: string;
+      refreshToken: string;
+      expiresAt?: number;
+      tokenType: string;
+      scope?: string;
+    }>;
+    onedriveGetUserInfo?(options: { accessToken: string }): Promise<{
+      id: string;
+      email: string;
+      name: string;
+      avatarDataUrl?: string;
+    }>;
+    onedriveFindSyncFile?(options: { accessToken: string; fileName?: string }): Promise<{ fileId: string | null }>;
+    onedriveUploadSyncFile?(options: { accessToken: string; fileName?: string; syncedFile: unknown }): Promise<{ fileId: string | null }>;
+    onedriveDownloadSyncFile?(options: { accessToken: string; fileId?: string; fileName?: string }): Promise<{ syncedFile: unknown | null }>;
+    onedriveDeleteSyncFile?(options: { accessToken: string; fileId: string }): Promise<{ ok: true }>;
+
+    // File opener helpers (for "Open With" feature)
+    selectApplication?(): Promise<{ path: string; name: string } | null>;
+    openWithApplication?(filePath: string, appPath: string): Promise<boolean>;
+    downloadSftpToTemp?(sftpId: string, remotePath: string, fileName: string): Promise<string>;
+
+    // File watcher for auto-sync feature
+    startFileWatch?(localPath: string, remotePath: string, sftpId: string): Promise<{ watchId: string }>;
+    stopFileWatch?(watchId: string, cleanupTempFile?: boolean): Promise<{ success: boolean }>;
+    listFileWatches?(): Promise<Array<{ watchId: string; localPath: string; remotePath: string; sftpId: string }>>;
+    registerTempFile?(sftpId: string, localPath: string): Promise<{ success: boolean }>;
+    onFileWatchSynced?(cb: (payload: { watchId: string; localPath: string; remotePath: string; bytesWritten: number }) => void): () => void;
+    onFileWatchError?(cb: (payload: { watchId: string; localPath: string; remotePath: string; error: string }) => void): () => void;
+
+    // Temp file cleanup
+    deleteTempFile?(filePath: string): Promise<{ success: boolean }>;
+
+    // Temp directory management
+    getTempDirInfo?(): Promise<{ path: string; fileCount: number; totalSize: number }>;
+    clearTempDir?(): Promise<{ deletedCount: number; failedCount: number; error?: string }>;
+    getTempDirPath?(): Promise<string>;
+    openTempDir?(): Promise<{ success: boolean }>;
+  }
+
+  interface Window {
+    netcatty?: NetcattyBridge;
+  }
 
 }
 

infrastructure/config/fonts.ts

@@ -216,6 +216,13 @@ const BASE_TERMINAL_FONTS: TerminalFont[] = [
     description: 'Highly customizable monospace font',
     category: 'monospace',
   },
+  {
+    id: 'ioskeley-mono',
+    name: 'Ioskeley Mono',
+    family: '"Ioskeley Mono", monospace',
+    description: 'Iosevka variant mimicking Berkeley Mono style',
+    category: 'monospace',
+  },
   {
     id: 'mononoki',
     name: 'Mononoki',