Merge pull request #143 from binaricat/feat/snippet-package-rename

feat(snippets): add rename functionality for packages

.github/scripts/generate-release-note.js

@@ -0,0 +1,104 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// Determine version priority:
+// 1. VERSION env variable
+// 2. Valid version tag (v1.2.3 format)
+// 3. Short commit ID (first 7 chars of GITHUB_SHA)
+// 4. package.json version as fallback
+function getVersion() {
+  if (process.env.VERSION) {
+    return process.env.VERSION;
+  }
+
+  const refName = process.env.GITHUB_REF_NAME;
+  // Check if refName is a valid version tag (e.g., v1.2.3)
+  if (refName && /^v\d+\.\d+\.\d+/.test(refName)) {
+    return refName.replace(/^v/, '');
+  }
+
+  // Use short commit ID
+  const sha = process.env.GITHUB_SHA;
+  if (sha) {
+    return sha.substring(0, 7);
+  }
+
+  // Fall back to package.json version
+  try {
+    const pkgPath = path.join(__dirname, '..', '..', 'package.json');
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    return pkg.version;
+  } catch {
+    return '0.0.0';
+  }
+}
+
+const version = getVersion();
+const repo = process.env.GITHUB_REPOSITORY || 'binaricat/netcatty';
+// For tag releases, use the tag; for workflow_dispatch, create a tag from version
+const tag = (process.env.GITHUB_REF_NAME && /^v\d+\.\d+\.\d+/.test(process.env.GITHUB_REF_NAME))
+  ? process.env.GITHUB_REF_NAME
+  : `v${version}`;
+const baseUrl = `https://github.com/${repo}/releases/download/${tag}`;
+
+// Filename patterns based on electron-builder.config.cjs artifactName: '${productName}-${version}-${os}-${arch}.${ext}'
+const files = {
+  mac: {
+    arm64: `Netcatty-${version}-mac-arm64.dmg`,
+    x64: `Netcatty-${version}-mac-x64.dmg`
+  },
+  win: {
+    x64: `Netcatty-${version}-win-x64.exe`,
+    arm64: `Netcatty-${version}-win-arm64.exe`
+  },
+  linux: {
+    appimage: {
+      x64: `Netcatty-${version}-linux-x64.AppImage`,
+      arm64: `Netcatty-${version}-linux-arm64.AppImage`
+    },
+    deb: {
+      x64: `Netcatty-${version}-linux-x64.deb`,
+      arm64: `Netcatty-${version}-linux-arm64.deb`
+    },
+    rpm: {
+      x64: `Netcatty-${version}-linux-x64.rpm`,
+      arm64: `Netcatty-${version}-linux-arm64.rpm`
+    }
+  }
+};
+
+const badges = {
+  win: {
+    setup_x64: `[![Setup x64](https://img.shields.io/badge/Setup-x64-0078D6?style=flat-square&logo=windows)](${baseUrl}/${files.win.x64})`,
+    setup_arm64: `[![Setup arm64](https://img.shields.io/badge/Setup-arm64-0078D6?style=flat-square&logo=windows)](${baseUrl}/${files.win.arm64})`
+  },
+  mac: {
+    apple_silicon: `[![DMG Apple Silicon](https://img.shields.io/badge/DMG-Apple_Silicon-000000?style=flat-square&logo=apple)](${baseUrl}/${files.mac.arm64})`,
+    intel: `[![DMG Intel X64](https://img.shields.io/badge/DMG-Intel_X64-000000?style=flat-square&logo=apple)](${baseUrl}/${files.mac.x64})`
+  },
+  linux: {
+    appimage_x64: `[![AppImage x64](https://img.shields.io/badge/AppImage-x64-FCC624?style=flat-square&logo=linux)](${baseUrl}/${files.linux.appimage.x64})`,
+    appimage_arm64: `[![AppImage arm64](https://img.shields.io/badge/AppImage-arm64-FCC624?style=flat-square&logo=linux)](${baseUrl}/${files.linux.appimage.arm64})`,
+    deb_x64: `[![DebPackage x64](https://img.shields.io/badge/DebPackage-x64-A80030?style=flat-square&logo=debian)](${baseUrl}/${files.linux.deb.x64})`,
+    deb_arm64: `[![DebPackage arm64](https://img.shields.io/badge/DebPackage-arm64-A80030?style=flat-square&logo=debian)](${baseUrl}/${files.linux.deb.arm64})`,
+    rpm_x64: `[![RpmPackage x64](https://img.shields.io/badge/RpmPackage-x64-CC0000?style=flat-square&logo=redhat)](${baseUrl}/${files.linux.rpm.x64})`,
+    rpm_arm64: `[![RpmPackage arm64](https://img.shields.io/badge/RpmPackage-arm64-CC0000?style=flat-square&logo=redhat)](${baseUrl}/${files.linux.rpm.arm64})`
+  }
+};
+
+const content = `
+## Download based on your OS:
+
+| OS | Download |
+| :--- | :--- |
+| **Windows** | ${badges.win.setup_x64} ${badges.win.setup_arm64} |
+| **macOS** | ${badges.mac.apple_silicon} ${badges.mac.intel} |
+| **Linux** | ${badges.linux.appimage_x64} ${badges.linux.deb_x64} ${badges.linux.rpm_x64} <br> ${badges.linux.appimage_arm64} ${badges.linux.deb_arm64} ${badges.linux.rpm_arm64} |
+`;
+
+fs.writeFileSync('release_notes.md', content);
+console.log('Generated release_notes.md');

.github/workflows/build.yml

@@ -37,11 +37,16 @@ jobs:
       - name: Install deps
         run: npm ci
 
-      - name: Set version from tag
-        if: startsWith(github.ref, 'refs/tags/v')
+      - name: Set version
         shell: bash
         run: |
-          VERSION="${GITHUB_REF_NAME#v}"
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            # Tag release: use version from tag
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            # workflow_dispatch: use short commit ID
+            VERSION="${GITHUB_SHA:0:7}"
+          fi
           echo "Setting version to ${VERSION}"
           npm pkg set version="${VERSION}"
 
@@ -70,15 +75,12 @@ jobs:
           name: netcatty-${{ matrix.os }}
           path: |
             release/*.dmg
-            release/*.zip
             release/*.exe
             release/*.msi
             release/*.AppImage
             release/*.deb
             release/*.rpm
             release/*.tar.gz
-            release/*.blockmap
-            release/latest*.yml
           if-no-files-found: ignore
 
   release:
@@ -101,20 +103,23 @@ jobs:
       - name: List artifacts
         run: ls -la artifacts/
 
+      - name: Generate Release Body
+        run: node .github/scripts/generate-release-note.js
+        env:
+          GITHUB_REF_NAME: ${{ github.ref_name }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_SHA: ${{ github.sha }}
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          body_path: release_notes.md
           files: |
             artifacts/*.dmg
-            artifacts/*.zip
             artifacts/*.exe
-            artifacts/*.msi
             artifacts/*.AppImage
             artifacts/*.deb
             artifacts/*.rpm
-            artifacts/*.tar.gz
-            artifacts/*.blockmap
-            artifacts/latest*.yml
           generate_release_notes: true
           fail_on_unmatched_files: false
           token: ${{ secrets.RELEASE_TOKEN }}

.github/workflows/sync.yml

@@ -0,0 +1,42 @@
+name: Sync Upstream
+
+env:
+  UPSTREAM_URL: "https://github.com/binaricat/Netcatty.git"
+  UPSTREAM_BRANCH: "main"
+  TARGET_BRANCH: "main"
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Run daily at midnight
+  workflow_dispatch:      # Allow manual trigger
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Merge Upstream
+        run: |
+          echo "Adding upstream remote..."
+          git remote add upstream ${{ env.UPSTREAM_URL }}
+          git fetch upstream ${{ env.UPSTREAM_BRANCH }}
+          
+          echo "Merging upstream/${{ env.UPSTREAM_BRANCH }} into ${{ env.TARGET_BRANCH }}..."
+          # This will fail if there are conflicts, which is the desired behavior (notify user via failure)
+          git merge upstream/${{ env.UPSTREAM_BRANCH }} --no-edit
+          
+          echo "Pushing changes..."
+          git push origin ${{ env.TARGET_BRANCH }}

App.tsx

@@ -21,6 +21,7 @@ import { Label } from './components/ui/label';
 import { ToastProvider, toast } from './components/ui/toast';
 import { VaultView, VaultSection } from './components/VaultView';
 import { KeyboardInteractiveModal, KeyboardInteractiveRequest } from './components/KeyboardInteractiveModal';
+import { PassphraseModal, PassphraseRequest } from './components/PassphraseModal';
 import { cn } from './lib/utils';
 import { ConnectionLog, Host, HostProtocol, SerialConfig, TerminalTheme } from './types';
 import { LogView as LogViewType } from './application/state/useSessionState';
@@ -155,6 +156,8 @@ function App({ settings }: { settings: SettingsState }) {
   const [navigateToSection, setNavigateToSection] = useState<VaultSection | null>(null);
   // Keyboard-interactive authentication queue (2FA/MFA) - queue-based to handle multiple concurrent sessions
   const [keyboardInteractiveQueue, setKeyboardInteractiveQueue] = useState<KeyboardInteractiveRequest[]>([]);
+  // Passphrase request queue for encrypted SSH keys
+  const [passphraseQueue, setPassphraseQueue] = useState<PassphraseRequest[]>([]);
 
   const {
     theme,
@@ -242,6 +245,7 @@ function App({ settings }: { settings: SettingsState }) {
     logViews,
     openLogView,
     closeLogView,
+    copySession,
   } = useSessionState();
 
   // isMacClient is used for window controls styling
@@ -348,6 +352,76 @@ function App({ settings }: { settings: SettingsState }) {
     setKeyboardInteractiveQueue(prev => prev.filter(r => r.requestId !== requestId));
   }, []);
 
+  // Passphrase request event listener for encrypted SSH keys
+  useEffect(() => {
+    const bridge = netcattyBridge.get();
+    if (!bridge?.onPassphraseRequest) return;
+
+    const unsubscribe = bridge.onPassphraseRequest((request) => {
+      console.log('[App] Passphrase request received:', request);
+      setPassphraseQueue(prev => [...prev, {
+        requestId: request.requestId,
+        keyPath: request.keyPath,
+        keyName: request.keyName,
+        hostname: request.hostname,
+      }]);
+    });
+
+    return () => {
+      unsubscribe?.();
+    };
+  }, []);
+
+  // Handle passphrase submit
+  const handlePassphraseSubmit = useCallback((requestId: string, passphrase: string) => {
+    const bridge = netcattyBridge.get();
+    if (bridge?.respondPassphrase) {
+      void bridge.respondPassphrase(requestId, passphrase, false);
+    }
+    setPassphraseQueue(prev => prev.filter(r => r.requestId !== requestId));
+  }, []);
+
+  // Handle passphrase cancel
+  const handlePassphraseCancel = useCallback((requestId: string) => {
+    const bridge = netcattyBridge.get();
+    if (bridge?.respondPassphrase) {
+      // Cancel = stop the entire passphrase flow
+      void bridge.respondPassphrase(requestId, '', true);
+    }
+    setPassphraseQueue(prev => prev.filter(r => r.requestId !== requestId));
+  }, []);
+
+  // Handle passphrase skip (skip this key, continue with others)
+  const handlePassphraseSkip = useCallback((requestId: string) => {
+    const bridge = netcattyBridge.get();
+    if (bridge?.respondPassphraseSkip) {
+      // Skip = skip this key but continue asking for others
+      void bridge.respondPassphraseSkip(requestId);
+    } else if (bridge?.respondPassphrase) {
+      // Fallback for older API
+      void bridge.respondPassphrase(requestId, '', false);
+    }
+    setPassphraseQueue(prev => prev.filter(r => r.requestId !== requestId));
+  }, []);
+
+  // Handle passphrase timeout (request expired on backend)
+  useEffect(() => {
+    const bridge = netcattyBridge.get();
+    if (!bridge?.onPassphraseTimeout) return;
+
+    const unsubscribe = bridge.onPassphraseTimeout((event) => {
+      console.log('[App] Passphrase request timed out:', event.requestId);
+      // Remove from queue - the modal will close automatically
+      setPassphraseQueue(prev => prev.filter(r => r.requestId !== event.requestId));
+      // Show a toast notification to inform user
+      toast.error('Passphrase request timed out. Please try connecting again.');
+    });
+
+    return () => {
+      unsubscribe?.();
+    };
+  }, []);
+
   // Debounce ref for moveFocus to prevent double-triggering when focus switches
   const lastMoveFocusTimeRef = useRef<number>(0);
   const MOVE_FOCUS_DEBOUNCE_MS = 200;
@@ -864,6 +938,7 @@ function App({ settings }: { settings: SettingsState }) {
         isMacClient={isMacClient}
         onCloseSession={closeSession}
         onRenameSession={startSessionRename}
+        onCopySession={copySession}
         onRenameWorkspace={startWorkspaceRename}
         onCloseWorkspace={closeWorkspace}
         onCloseLogView={closeLogView}
@@ -1081,6 +1156,14 @@ function App({ settings }: { settings: SettingsState }) {
           {keyboardInteractiveQueue.length - 1} more pending
         </div>
       )}
+
+      {/* Global Passphrase Modal for encrypted SSH keys */}
+      <PassphraseModal
+        request={passphraseQueue[0] || null}
+        onSubmit={handlePassphraseSubmit}
+        onCancel={handlePassphraseCancel}
+        onSkip={handlePassphraseSkip}
+      />
     </div>
   );
 }

README.ja-JP.md

@@ -98,6 +98,8 @@
 
 ### 📁 SFTP
 - **デュアルペインファイルブラウザ** — ローカル ↔ リモート または リモート ↔ リモート
+- **Sudo 特権昇格** — sudo を使用して root 権限のファイルを閲覧および編集
+- **ドラッグ＆ドロップ** アップロードおよびダウンロード
 - **ドラッグ＆ドロップ**ファイル転送
 - **キュー管理**でバッチ転送
 - **進捗追跡**、転送速度表示
@@ -278,11 +280,11 @@ Netcatty は接続したホストの OS アイコンを自動的に検出・表
 
 [GitHub Releases](https://github.com/binaricat/Netcatty/releases/latest) からお使いのプラットフォームに対応した最新版をダウンロードしてください。
 
-| プラットフォーム | アーキテクチャ | ステータス |
-|------------------|----------------|------------|
-| **macOS** | Apple Silicon (M1/M2/M3) | ✅ サポート |
-| **macOS** | Intel | ✅ サポート |
-| **Windows** | x64 | ✅ サポート |
+| OS | サポート状況 |
+| :--- | :--- |
+| **macOS** | Universal (x64 / arm64) |
+| **Windows** | x64 / arm64 |
+| **Linux** | x64 / arm64 |
 
 または [GitHub Releases](https://github.com/binaricat/Netcatty/releases) ですべてのリリースを参照してください。
 

README.md

@@ -98,7 +98,8 @@
 
 ### 📁 SFTP
 - **Dual-pane file browser** — local ↔ remote or remote ↔ remote
-- **Drag & drop** file transfers
+- **Sudo Privilege Escalation** — Browse and edit root-owned files with sudo
+- **Drag & Drop** uploads and downloads
 - **Queue management** for batch transfers
 - **Progress tracking** with transfer speed
 
@@ -278,11 +279,11 @@ Netcatty automatically detects and displays OS icons for connected hosts:
 
 Download the latest release for your platform from [GitHub Releases](https://github.com/binaricat/Netcatty/releases/latest).
 
-| Platform | Architecture | Status |
-|----------|--------------|--------|
-| **macOS** | Apple Silicon (M1/M2/M3) | ✅ Supported |
-| **macOS** | Intel | ✅ Supported |
-| **Windows** | x64 | ✅ Supported |
+| OS | Support |
+| :--- | :--- |
+| **macOS** | Universal (x64 / arm64) |
+| **Windows** | x64 / arm64 |
+| **Linux** | x64 / arm64 |
 
 Or browse all releases at [GitHub Releases](https://github.com/binaricat/Netcatty/releases).
 

README.zh-CN.md

@@ -98,6 +98,8 @@
 
 ### 📁 SFTP
 - **双窗格文件浏览器** —— 本地 ↔ 远程 或 远程 ↔ 远程
+- **Sudo 提权支持** —— 使用 sudo 浏览和编辑 root 权限文件
+- **拖放操作** —— 支持上传和下载
 - **拖放传输** 文件
 - **队列管理** 批量传输
 - **进度跟踪** 显示传输速度
@@ -278,11 +280,11 @@ Netcatty 自动检测并显示已连接主机的操作系统图标：
 
 从 [GitHub Releases](https://github.com/binaricat/Netcatty/releases/latest) 下载适合您平台的最新版本。
 
-| 平台 | 架构 | 状态 |
-|------|------|------|
-| **macOS** | Apple Silicon (M1/M2/M3) | ✅ 支持 |
-| **macOS** | Intel | ✅ 支持 |
-| **Windows** | x64 | ✅ 支持 |
+| 操作系统 | 支持情况 |
+| :--- | :--- |
+| **macOS** | Universal (x64 / arm64) |
+| **Windows** | x64 / arm64 |
+| **Linux** | x64 / arm64 |
 
 或在 [GitHub Releases](https://github.com/binaricat/Netcatty/releases) 浏览所有版本。
 

application/i18n/locales/en.ts

@@ -313,6 +313,8 @@ const en: Messages = {
   'vault.groups.createDialog.desc': 'Create a new group for organizing hosts.',
   'vault.groups.renameDialogTitle': 'Rename Group',
   'vault.groups.renameDialog.desc': 'Rename an existing group.',
+  'vault.groups.deleteDialogTitle': 'Delete Group',
+  'vault.groups.deleteDialog.desc': 'This will permanently delete the group and move all hosts to the root level.',
   'vault.groups.field.name': 'Group Name',
   'vault.groups.placeholder.example': 'e.g. Production',
   'vault.groups.parentLabel': 'Parent',
@@ -328,10 +330,20 @@ const en: Messages = {
   'vault.hosts.connect': 'Connect',
   'vault.view.grid': 'Grid',
   'vault.view.list': 'List',
+  'vault.view.tree': 'Tree',
+  'vault.tree.expandAll': 'Expand All',
+  'vault.tree.collapseAll': 'Collapse All',
   'vault.hosts.newHost': 'New Host',
   'vault.hosts.newGroup': 'New Group',
   'vault.hosts.import': 'Import',
+  'vault.hosts.export': 'Export',
+  'vault.hosts.export.toast.success': 'Exported {count} hosts to CSV',
+  'vault.hosts.export.toast.successWithSkipped': 'Exported {count} hosts to CSV ({skipped} unsupported hosts skipped)',
+  'vault.hosts.export.toast.noHosts': 'No hosts to export',
   'vault.hosts.allHosts': 'All hosts',
+  'vault.hosts.copyCredentials': 'Copy Credentials',
+  'vault.hosts.copyCredentials.toast.success': 'Credentials copied to clipboard',
+  'vault.hosts.copyCredentials.toast.noPassword': 'No password saved for this host',
 
   // Vault import
   'vault.import.title': 'Add data to your vault',
@@ -662,6 +674,9 @@ const en: Messages = {
   'hostDetails.section.mosh': 'Mosh',
   'hostDetails.username.placeholder': 'Username',
   'hostDetails.password.placeholder': 'Password',
+  'hostDetails.password.show': 'Show password',
+  'hostDetails.password.hide': 'Hide password',
+  'hostDetails.password.save': 'Save password',
   'hostDetails.identity.suggestions': 'Identities',
   'hostDetails.identity.missing': 'Identity not found',
   'hostDetails.credential.keyCertificate': 'Key, Certificate',
@@ -1100,6 +1115,7 @@ const en: Messages = {
   'tabs.closeLogViewAria': 'Close log view',
   'tabs.logPrefix': 'Log:',
   'tabs.logLocal': 'Local',
+  'tabs.copyTab': 'Copy Tab',
   'keychain.edit.labelRequired': 'Label *',
   'keychain.edit.keyLabelPlaceholder': 'Key label',
   'keychain.edit.privateKeyRequired': 'Private key *',
@@ -1151,6 +1167,14 @@ const en: Messages = {
   'snippets.packageDialog.placeholder': 'e.g. ops/maintenance',
   'snippets.packageDialog.hint': 'Use "/" to create nested packages.',
 
+  // Snippets Rename Dialog
+  'snippets.renameDialog.title': 'Rename Package',
+  'snippets.renameDialog.currentPath': 'Current path: {path}',
+  'snippets.renameDialog.placeholder': 'Enter new name',
+  'snippets.renameDialog.error.empty': 'Package name cannot be empty',
+  'snippets.renameDialog.error.duplicate': 'A package with this name already exists',
+  'snippets.renameDialog.error.invalidChars': 'Package name can only contain letters, numbers, hyphens, and underscores',
+
   // Serial Port
   'serial.button': 'Serial',
   'serial.modal.title': 'Connect to Serial Port',
@@ -1205,6 +1229,16 @@ const en: Messages = {
   'keyboard.interactive.fillSaved': 'Fill with saved password',
   'keyboard.interactive.useSaved': 'Use saved',
   'keyboard.interactive.useSavedPassword': 'Use saved password',
+
+  // Passphrase Modal for encrypted SSH keys
+  'passphrase.title': 'SSH Key Passphrase',
+  'passphrase.desc': 'Enter the passphrase for {keyName}',
+  'passphrase.descWithHost': 'Enter the passphrase for {keyName} to connect to {hostname}',
+  'passphrase.label': 'Passphrase',
+  'passphrase.keyPath': 'Key',
+  'passphrase.unlock': 'Unlock',
+  'passphrase.unlocking': 'Unlocking...',
+  'passphrase.skip': 'Skip',
 };
 
 export default en;

application/i18n/locales/zh-CN.ts

@@ -184,6 +184,8 @@ const zhCN: Messages = {
   'vault.groups.createDialog.desc': '创建新的分组用于组织主机。',
   'vault.groups.renameDialogTitle': '重命名分组',
   'vault.groups.renameDialog.desc': '重命名已有分组。',
+  'vault.groups.deleteDialogTitle': '删除分组',
+  'vault.groups.deleteDialog.desc': '这将永久删除该分组并将所有主机移动到根级别。',
   'vault.groups.field.name': '分组名称',
   'vault.groups.placeholder.example': '例如：Production',
   'vault.groups.parentLabel': '父级',
@@ -199,10 +201,20 @@ const zhCN: Messages = {
   'vault.hosts.connect': '连接',
   'vault.view.grid': '网格',
   'vault.view.list': '列表',
+  'vault.view.tree': '树形',
+  'vault.tree.expandAll': '展开全部',
+  'vault.tree.collapseAll': '折叠全部',
   'vault.hosts.newHost': '新建主机',
   'vault.hosts.newGroup': '新建分组',
   'vault.hosts.import': '导入',
+  'vault.hosts.export': '导出',
+  'vault.hosts.export.toast.success': '已导出 {count} 个主机到 CSV',
+  'vault.hosts.export.toast.successWithSkipped': '已导出 {count} 个主机到 CSV（跳过 {skipped} 个不支持的主机）',
+  'vault.hosts.export.toast.noHosts': '没有主机可导出',
   'vault.hosts.allHosts': '全部主机',
+  'vault.hosts.copyCredentials': '复制账密信息',
+  'vault.hosts.copyCredentials.toast.success': '账密信息已复制到剪贴板',
+  'vault.hosts.copyCredentials.toast.noPassword': '该主机未保存密码',
 
   // Vault import
   'vault.import.title': '添加数据到你的 Vault',
@@ -409,6 +421,9 @@ const zhCN: Messages = {
   'hostDetails.section.mosh': 'Mosh',
   'hostDetails.username.placeholder': '用户名',
   'hostDetails.password.placeholder': '密码',
+  'hostDetails.password.show': '显示密码',
+  'hostDetails.password.hide': '隐藏密码',
+  'hostDetails.password.save': '保存密码',
   'hostDetails.identity.suggestions': '身份',
   'hostDetails.identity.missing': '身份不存在',
   'hostDetails.credential.keyCertificate': '密钥 / 证书',
@@ -1089,6 +1104,7 @@ const zhCN: Messages = {
   'tabs.closeLogViewAria': '关闭日志视图',
   'tabs.logPrefix': '日志：',
   'tabs.logLocal': '本地',
+  'tabs.copyTab': '复制标签页',
   'keychain.edit.labelRequired': 'Label *',
   'keychain.edit.keyLabelPlaceholder': '密钥 Label',
   'keychain.edit.privateKeyRequired': '私钥 *',
@@ -1140,6 +1156,14 @@ const zhCN: Messages = {
   'snippets.packageDialog.placeholder': '例如：ops/maintenance',
   'snippets.packageDialog.hint': '使用 "/" 创建嵌套代码包。',
 
+  // Snippets Rename Dialog
+  'snippets.renameDialog.title': '重命名代码包',
+  'snippets.renameDialog.currentPath': '当前路径：{path}',
+  'snippets.renameDialog.placeholder': '输入新名称',
+  'snippets.renameDialog.error.empty': '代码包名称不能为空',
+  'snippets.renameDialog.error.duplicate': '已存在同名的代码包',
+  'snippets.renameDialog.error.invalidChars': '代码包名称只能包含字母、数字、连字符和下划线',
+
   // Serial Port
   'serial.button': '串口',
   'serial.modal.title': '连接串口',
@@ -1194,6 +1218,16 @@ const zhCN: Messages = {
   'keyboard.interactive.fillSaved': '填入已保存的密码',
   'keyboard.interactive.useSaved': '使用已保存',
   'keyboard.interactive.useSavedPassword': '使用已保存的密码',
+
+  // Passphrase Modal for encrypted SSH keys
+  'passphrase.title': 'SSH 密钥密码',
+  'passphrase.desc': '请输入 {keyName} 的密码',
+  'passphrase.descWithHost': '请输入 {keyName} 的密码以连接到 {hostname}',
+  'passphrase.label': '密码',
+  'passphrase.keyPath': '密钥',
+  'passphrase.unlock': '解锁',
+  'passphrase.unlocking': '解锁中...',
+  'passphrase.skip': '跳过',
 };
 
 export default zhCN;

application/state/sftp/useSftpDirectoryListing.ts

@@ -2,7 +2,7 @@ import { useCallback } from "react";
 import { netcattyBridge } from "../../../infrastructure/services/netcattyBridge";
 import type { SftpFileEntry, SftpFilenameEncoding } from "../../../domain/models";
 import { buildMockLocalFiles } from "./mockLocalFiles";
-import { formatFileSize } from "./utils";
+import { formatFileSize, formatDate } from "./utils";
 
 export const useSftpDirectoryListing = () => {
   const getMockLocalFiles = useCallback((path: string): SftpFileEntry[] => {
@@ -18,13 +18,14 @@ export const useSftpDirectoryListing = () => {
 
       return rawFiles.map((f) => {
         const size = parseInt(f.size) || 0;
+        const lastModified = new Date(f.lastModified).getTime();
         return {
           name: f.name,
           type: f.type as "file" | "directory" | "symlink",
           size,
           sizeFormatted: formatFileSize(size),
-          lastModified: new Date(f.lastModified).getTime(),
-          lastModifiedFormatted: f.lastModified,
+          lastModified,
+          lastModifiedFormatted: formatDate(lastModified),
           linkTarget: f.linkTarget as "file" | "directory" | null | undefined,
           hidden: f.hidden,
         };
@@ -40,13 +41,14 @@ export const useSftpDirectoryListing = () => {
 
       return rawFiles.map((f) => {
         const size = parseInt(f.size) || 0;
+        const lastModified = new Date(f.lastModified).getTime();
         return {
           name: f.name,
           type: f.type as "file" | "directory" | "symlink",
           size,
           sizeFormatted: formatFileSize(size),
-          lastModified: new Date(f.lastModified).getTime(),
-          lastModifiedFormatted: f.lastModified,
+          lastModified,
+          lastModifiedFormatted: formatDate(lastModified),
           linkTarget: f.linkTarget as "file" | "directory" | null | undefined,
         };
       });

application/state/sftp/useSftpExternalOperations.ts

@@ -344,6 +344,25 @@ export const useSftpExternalOperations = (
           }
         : undefined,
       cancelSftpUpload: bridge?.cancelSftpUpload,
+      // Stream transfer for large files (avoids loading into memory)
+      startStreamTransfer: bridge?.startStreamTransfer
+        ? async (options, onProgress, onComplete, onError) => {
+            const b = netcattyBridge.get();
+            if (!b?.startStreamTransfer) {
+              return { transferId: options.transferId, error: 'Stream transfer not available' };
+            }
+            try {
+              const result = await b.startStreamTransfer(options, onProgress, onComplete, onError);
+              return result;
+            } catch (error) {
+              return {
+                transferId: options.transferId,
+                error: error instanceof Error ? error.message : String(error),
+              };
+            }
+          }
+        : undefined,
+      cancelTransfer: bridge?.cancelTransfer,
     };
   }, []);
 

application/state/sftp/utils.ts

@@ -11,13 +11,9 @@ export const formatFileSize = (bytes: number): string => {
 export const formatDate = (timestamp: number): string => {
   if (!timestamp) return "--";
   const date = new Date(timestamp);
-  return date.toLocaleDateString("en-US", {
-    month: "short",
-    day: "numeric",
-    year: "numeric",
-    hour: "numeric",
-    minute: "2-digit",
-  });
+  if (isNaN(date.getTime())) return "--";
+  const pad = (n: number) => n.toString().padStart(2, "0");
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
 };
 
 export const getFileExtension = (name: string): string => {

application/state/useSessionState.ts

@@ -547,6 +547,31 @@ export const useSessionState = () => {
     });
   }, [setActiveTabId]);
 
+  // Copy a session - creates a new session with the same host connection
+  const copySession = useCallback((sessionId: string) => {
+    setSessions(prevSessions => {
+      const session = prevSessions.find(s => s.id === sessionId);
+      if (!session) return prevSessions;
+
+      // Create a new session with the same connection info
+      const newSession: TerminalSession = {
+        id: crypto.randomUUID(),
+        hostId: session.hostId,
+        hostLabel: session.hostLabel,
+        hostname: session.hostname,
+        username: session.username,
+        status: 'connecting',
+        protocol: session.protocol,
+        port: session.port,
+        moshEnabled: session.moshEnabled,
+        serialConfig: session.serialConfig,
+      };
+
+      setActiveTabId(newSession.id);
+      return [...prevSessions, newSession];
+    });
+  }, [setActiveTabId]);
+
   // Toggle broadcast mode for a workspace
   const toggleBroadcast = useCallback((workspaceId: string) => {
     setBroadcastWorkspaceIds(prev => {
@@ -662,5 +687,7 @@ export const useSessionState = () => {
     logViews,
     openLogView,
     closeLogView,
+    // Copy session
+    copySession,
   };
 };

application/state/useStoredViewMode.ts

@@ -1,10 +1,10 @@
 import { useEffect, useState } from "react";
 import { localStorageAdapter } from "../../infrastructure/persistence/localStorageAdapter";
 
-export type ViewMode = "grid" | "list";
+export type ViewMode = "grid" | "list" | "tree";
 
 const isViewMode = (value: string | null): value is ViewMode =>
-  value === "grid" || value === "list";
+  value === "grid" || value === "list" || value === "tree";
 
 export const useStoredViewMode = (
   storageKey: string,

application/state/useTreeExpandedState.ts

@@ -0,0 +1,47 @@
+import { useEffect, useState } from "react";
+import { localStorageAdapter } from "../../infrastructure/persistence/localStorageAdapter";
+
+export const useTreeExpandedState = (storageKey: string) => {
+  const [expandedPaths, setExpandedPaths] = useState<Set<string>>(() => {
+    const stored = localStorageAdapter.readString(storageKey);
+    if (stored) {
+      try {
+        const paths = JSON.parse(stored) as string[];
+        return new Set(paths);
+      } catch {
+        return new Set();
+      }
+    }
+    return new Set();
+  });
+
+  useEffect(() => {
+    const pathsArray = Array.from(expandedPaths);
+    localStorageAdapter.writeString(storageKey, JSON.stringify(pathsArray));
+  }, [storageKey, expandedPaths]);
+
+  const togglePath = (path: string) => {
+    const newExpanded = new Set(expandedPaths);
+    if (newExpanded.has(path)) {
+      newExpanded.delete(path);
+    } else {
+      newExpanded.add(path);
+    }
+    setExpandedPaths(newExpanded);
+  };
+
+  const expandAll = (allPaths: string[]) => {
+    setExpandedPaths(new Set(allPaths));
+  };
+
+  const collapseAll = () => {
+    setExpandedPaths(new Set());
+  };
+
+  return {
+    expandedPaths,
+    togglePath,
+    expandAll,
+    collapseAll,
+  };
+};

components/HostDetailsPanel.tsx

@@ -2,6 +2,8 @@ import {
   AlertTriangle,
   Check,
   ChevronDown,
+  Eye,
+  EyeOff,
   FolderLock,
   FolderPlus,
   Forward,
@@ -123,6 +125,9 @@ const HostDetailsPanel: React.FC<HostDetailsPanelProps> = ({
   // Identity suggestion dropdown state (popover anchored to username input)
   const [identitySuggestionsOpen, setIdentitySuggestionsOpen] = useState(false);
 
+  // Password visibility state
+  const [showPassword, setShowPassword] = useState(false);
+
   // New group creation state
   const [newGroupName, setNewGroupName] = useState("");
   const [newGroupParent, setNewGroupParent] = useState("");
@@ -164,6 +169,8 @@ const HostDetailsPanel: React.FC<HostDetailsPanelProps> = ({
       }
       setForm(updatedData);
       setGroupInputValue(initialData.group || "");
+      // Reset password visibility when host changes for privacy
+      setShowPassword(false);
     }
   }, [initialData]);
 
@@ -244,12 +251,17 @@ const HostDetailsPanel: React.FC<HostDetailsPanelProps> = ({
   };
 
   const handleSubmit = () => {
-    if (!form.hostname || !form.label) return;
+    if (!form.hostname) return;
+    // If label is empty, use hostname as label
+    const finalLabel = form.label?.trim() || form.hostname;
     const cleaned: Host = {
       ...form,
+      label: finalLabel,
       group: groupInputValue.trim() || form.group,
       tags: form.tags || [],
       port: form.port || 22,
+      // Clear password if savePassword is explicitly set to false
+      password: form.savePassword === false ? undefined : form.password,
     };
     onSave(cleaned);
   };
@@ -499,7 +511,7 @@ const HostDetailsPanel: React.FC<HostDetailsPanelProps> = ({
           size="icon"
           className="h-8 w-8"
           onClick={handleSubmit}
-          disabled={!form.hostname || !form.label}
+          disabled={!form.hostname}
           aria-label={t("hostDetails.saveAria")}
         >
           <Check size={16} />
@@ -798,13 +810,36 @@ const HostDetailsPanel: React.FC<HostDetailsPanelProps> = ({
             )}
 
             {!selectedIdentity && !form.identityId && (
-              <Input
-                placeholder={t("hostDetails.password.placeholder")}
-                type="password"
-                value={form.password || ""}
-                onChange={(e) => update("password", e.target.value)}
-                className="h-10"
-              />
+              <div className="relative">
+                <Input
+                  placeholder={t("hostDetails.password.placeholder")}
+                  type={showPassword ? "text" : "password"}
+                  value={form.password || ""}
+                  onChange={(e) => update("password", e.target.value)}
+                  className="h-10 pr-10"
+                />
+                <button
+                  type="button"
+                  onClick={() => setShowPassword(!showPassword)}
+                  className="absolute right-2 top-1/2 -translate-y-1/2 p-1 text-muted-foreground hover:text-foreground transition-colors"
+                  title={showPassword ? t("hostDetails.password.hide") : t("hostDetails.password.show")}
+                >
+                  {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
+                </button>
+              </div>
+            )}
+
+            {/* Save Password toggle - shown when password is entered */}
+            {!selectedIdentity && !form.identityId && form.password && (
+              <div className="flex items-center justify-between py-1">
+                <span className="text-xs text-muted-foreground">
+                  {t("hostDetails.password.save")}
+                </span>
+                <Switch
+                  checked={form.savePassword ?? true}
+                  onCheckedChange={(val) => update("savePassword" as keyof Host, val)}
+                />
+              </div>
             )}
 
             {/* Selected credential display */}
@@ -1445,7 +1480,7 @@ const HostDetailsPanel: React.FC<HostDetailsPanelProps> = ({
         <Button
           className="w-full h-10"
           onClick={handleSubmit}
-          disabled={!form.hostname || !form.label}
+          disabled={!form.hostname}
         >
           {t("common.save")}
         </Button>

components/HostTreeView.tsx

@@ -0,0 +1,477 @@
+import { ChevronRight, Folder, FolderOpen, Monitor, Server, Expand, Minimize2 } from 'lucide-react';
+import React, { useMemo } from 'react';
+import { useI18n } from '../application/i18n/I18nProvider';
+import { useTreeExpandedState } from '../application/state/useTreeExpandedState';
+import { sanitizeHost } from '../domain/host';
+import { STORAGE_KEY_VAULT_HOSTS_TREE_EXPANDED } from '../infrastructure/config/storageKeys';
+import { cn } from '../lib/utils';
+import { GroupNode, Host } from '../types';
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from './ui/collapsible';
+import { ContextMenu, ContextMenuContent, ContextMenuItem, ContextMenuTrigger } from './ui/context-menu';
+import { DistroAvatar } from './DistroAvatar';
+import { Button } from './ui/button';
+
+interface HostTreeViewProps {
+  groupTree: GroupNode[];
+  hosts: Host[];
+  sortMode?: 'az' | 'za' | 'newest' | 'oldest';
+  expandedPaths?: Set<string>;
+  onTogglePath?: (path: string) => void;
+  onExpandAll?: (paths: string[]) => void;
+  onCollapseAll?: () => void;
+  onConnect: (host: Host) => void;
+  onEditHost: (host: Host) => void;
+  onDuplicateHost: (host: Host) => void;
+  onDeleteHost: (host: Host) => void;
+  onCopyCredentials: (host: Host) => void;
+  onNewHost: (groupPath?: string) => void;
+  onNewGroup: (parentPath?: string) => void;
+  onEditGroup: (groupPath: string) => void;
+  onDeleteGroup: (groupPath: string) => void;
+  moveHostToGroup: (hostId: string, groupPath: string | null) => void;
+  moveGroup: (sourcePath: string, targetPath: string) => void;
+}
+
+interface TreeNodeProps {
+  node: GroupNode;
+  depth: number;
+  sortMode: 'az' | 'za' | 'newest' | 'oldest';
+  expandedPaths: Set<string>;
+  onToggle: (path: string) => void;
+  onConnect: (host: Host) => void;
+  onEditHost: (host: Host) => void;
+  onDuplicateHost: (host: Host) => void;
+  onDeleteHost: (host: Host) => void;
+  onCopyCredentials: (host: Host) => void;
+  onNewHost: (groupPath?: string) => void;
+  onNewGroup: (parentPath?: string) => void;
+  onEditGroup: (groupPath: string) => void;
+  onDeleteGroup: (groupPath: string) => void;
+  moveHostToGroup: (hostId: string, groupPath: string | null) => void;
+  moveGroup: (sourcePath: string, targetPath: string) => void;
+}
+
+const TreeNode: React.FC<TreeNodeProps> = ({
+  node,
+  depth,
+  sortMode,
+  expandedPaths,
+  onToggle,
+  onConnect,
+  onEditHost,
+  onDuplicateHost,
+  onDeleteHost,
+  onCopyCredentials,
+  onNewHost,
+  onNewGroup,
+  onEditGroup,
+  onDeleteGroup,
+  moveHostToGroup,
+  moveGroup,
+}) => {
+  const { t } = useI18n();
+  const isExpanded = expandedPaths.has(node.path);
+  const hasChildren = node.children && Object.keys(node.children).length > 0;
+  const paddingLeft = `${depth * 20 + 12}px`;
+
+  const childNodes = useMemo(() => {
+    if (!node.children) return [];
+    const nodes = Object.values(node.children) as unknown as GroupNode[];
+    return nodes.sort((a, b) => {
+      switch (sortMode) {
+        case 'za':
+          return b.name.localeCompare(a.name);
+        case 'newest':
+        case 'oldest':
+          // For groups, fall back to name sorting since groups don't have creation dates
+          return a.name.localeCompare(b.name);
+        case 'az':
+        default:
+          return a.name.localeCompare(b.name);
+      }
+    });
+  }, [node.children, sortMode]);
+
+  const sortedHosts = useMemo(() => {
+    return [...node.hosts].sort((a, b) => {
+      switch (sortMode) {
+        case 'az':
+          return a.label.localeCompare(b.label);
+        case 'za':
+          return b.label.localeCompare(a.label);
+        case 'newest':
+          return (b.createdAt || 0) - (a.createdAt || 0);
+        case 'oldest':
+          return (a.createdAt || 0) - (b.createdAt || 0);
+        default:
+          return a.label.localeCompare(b.label);
+      }
+    });
+  }, [node.hosts, sortMode]);
+
+  return (
+    <div>
+      {/* Group Node */}
+      <Collapsible open={isExpanded} onOpenChange={() => onToggle(node.path)}>
+        <ContextMenu>
+          <ContextMenuTrigger>
+            <CollapsibleTrigger asChild>
+              <div
+                className={cn(
+                  "flex items-center py-2 pr-3 text-sm font-medium cursor-pointer transition-colors select-none group hover:bg-secondary/60 rounded-lg",
+                )}
+                style={{ paddingLeft }}
+                draggable
+                onDragStart={(e) => e.dataTransfer.setData("group-path", node.path)}
+                onDragOver={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                }}
+                onDrop={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  const hostId = e.dataTransfer.getData("host-id");
+                  const groupPath = e.dataTransfer.getData("group-path");
+                  if (hostId) moveHostToGroup(hostId, node.path);
+                  if (groupPath) moveGroup(groupPath, node.path);
+                }}
+              >
+                <div className="mr-2 flex-shrink-0 w-4 h-4 flex items-center justify-center">
+                  {(hasChildren || node.hosts.length > 0) && (
+                    <div className={cn("transition-transform duration-200", isExpanded ? "rotate-90" : "")}>
+                      <ChevronRight size={14} />
+                    </div>
+                  )}
+                </div>
+                <div className="mr-3 text-primary/80 group-hover:text-primary transition-colors">
+                  {isExpanded ? <FolderOpen size={18} /> : <Folder size={18} />}
+                </div>
+                <span className="truncate flex-1 font-semibold">{node.name}</span>
+                {(node.hosts.length > 0 || hasChildren) && (
+                  <span className="text-xs opacity-70 bg-background/50 px-2 py-0.5 rounded-full border border-border">
+                    {node.hosts.length}
+                  </span>
+                )}
+              </div>
+            </CollapsibleTrigger>
+          </ContextMenuTrigger>
+          <ContextMenuContent>
+            <ContextMenuItem onClick={() => onNewHost(node.path)}>
+              <Server className="mr-2 h-4 w-4" /> {t("vault.hosts.newHost")}
+            </ContextMenuItem>
+            <ContextMenuItem onClick={() => onNewGroup(node.path)}>
+              <Folder className="mr-2 h-4 w-4" /> {t("vault.hosts.newGroup")}
+            </ContextMenuItem>
+            <ContextMenuItem onClick={() => onEditGroup(node.path)}>
+              <FolderOpen className="mr-2 h-4 w-4" /> {t("vault.groups.rename")}
+            </ContextMenuItem>
+            <ContextMenuItem 
+              onClick={() => onDeleteGroup(node.path)}
+              className="text-destructive focus:text-destructive"
+            >
+              <FolderOpen className="mr-2 h-4 w-4" /> {t("vault.groups.delete")}
+            </ContextMenuItem>
+          </ContextMenuContent>
+        </ContextMenu>
+
+        <CollapsibleContent>
+          {/* Child Groups */}
+          {childNodes.map((child) => (
+            <TreeNode
+              key={child.path}
+              node={child}
+              depth={depth + 1}
+              sortMode={sortMode}
+              expandedPaths={expandedPaths}
+              onToggle={onToggle}
+              onConnect={onConnect}
+              onEditHost={onEditHost}
+              onDuplicateHost={onDuplicateHost}
+              onDeleteHost={onDeleteHost}
+              onCopyCredentials={onCopyCredentials}
+              onNewHost={onNewHost}
+              onNewGroup={onNewGroup}
+              onEditGroup={onEditGroup}
+              onDeleteGroup={onDeleteGroup}
+              moveHostToGroup={moveHostToGroup}
+              moveGroup={moveGroup}
+            />
+          ))}
+          
+          {/* Hosts in this group */}
+          {sortedHosts.map((host) => (
+            <HostTreeItem
+              key={host.id}
+              host={host}
+              depth={depth + 1}
+              onConnect={onConnect}
+              onEditHost={onEditHost}
+              onDuplicateHost={onDuplicateHost}
+              onDeleteHost={onDeleteHost}
+              onCopyCredentials={onCopyCredentials}
+              moveHostToGroup={moveHostToGroup}
+            />
+          ))}
+        </CollapsibleContent>
+      </Collapsible>
+    </div>
+  );
+};
+
+interface HostTreeItemProps {
+  host: Host;
+  depth: number;
+  onConnect: (host: Host) => void;
+  onEditHost: (host: Host) => void;
+  onDuplicateHost: (host: Host) => void;
+  onDeleteHost: (host: Host) => void;
+  onCopyCredentials: (host: Host) => void;
+  moveHostToGroup: (hostId: string, groupPath: string | null) => void;
+}
+
+const HostTreeItem: React.FC<HostTreeItemProps> = ({
+  host,
+  depth,
+  onConnect,
+  onEditHost,
+  onDuplicateHost,
+  onDeleteHost,
+  onCopyCredentials,
+  moveHostToGroup: _moveHostToGroup,
+}) => {
+  const { t } = useI18n();
+  const paddingLeft = `${depth * 20 + 12}px`;
+  const safeHost = sanitizeHost(host);
+  const tags = host.tags || [];
+  const isTelnet = host.protocol === 'telnet';
+  const displayUsername = isTelnet
+    ? (host.telnetUsername?.trim() || host.username?.trim() || '')
+    : (host.username?.trim() || '');
+  const displayPort = isTelnet
+    ? (host.telnetPort ?? host.port ?? 23)
+    : (host.port ?? 22);
+
+  return (
+    <ContextMenu>
+      <ContextMenuTrigger>
+        <div
+          className="flex items-center py-2 pr-3 text-sm cursor-pointer transition-colors select-none group hover:bg-secondary/40 rounded-lg"
+          style={{ paddingLeft }}
+          draggable
+          onDragStart={(e) => e.dataTransfer.setData("host-id", host.id)}
+          onClick={() => onConnect(safeHost)}
+        >
+          <div className="mr-2 flex-shrink-0 w-4 h-4" />
+          <div className="mr-3 flex-shrink-0">
+            <DistroAvatar host={host} fallback={(host.os || "L")[0].toUpperCase()} size="sm" />
+          </div>
+          <div className="flex-1 min-w-0">
+            <div className="font-medium truncate">{host.label}</div>
+            <div className="text-xs text-muted-foreground truncate">
+              {displayUsername}@{host.hostname}:{displayPort}
+            </div>
+          </div>
+          <div className="flex items-center gap-2 opacity-0 group-hover:opacity-100 transition-opacity">
+            {host.protocol && host.protocol !== 'ssh' && (
+              <span className="text-xs px-1.5 py-0.5 bg-primary/10 text-primary rounded">
+                {host.protocol.toUpperCase()}
+              </span>
+            )}
+            {tags.length > 0 && (
+              <span className="text-xs opacity-60">
+                {tags.slice(0, 2).join(', ')}
+                {tags.length > 2 && '...'}
+              </span>
+            )}
+          </div>
+        </div>
+      </ContextMenuTrigger>
+      <ContextMenuContent>
+        <ContextMenuItem onClick={() => onConnect(safeHost)}>
+          <Monitor className="mr-2 h-4 w-4" /> {t("vault.hosts.connect")}
+        </ContextMenuItem>
+        <ContextMenuItem onClick={() => onEditHost(host)}>
+          <Server className="mr-2 h-4 w-4" /> {t("action.edit")}
+        </ContextMenuItem>
+        <ContextMenuItem onClick={() => onDuplicateHost(host)}>
+          <Server className="mr-2 h-4 w-4" /> {t("action.duplicate")}
+        </ContextMenuItem>
+        <ContextMenuItem onClick={() => onCopyCredentials(host)}>
+          <Server className="mr-2 h-4 w-4" /> {t("vault.hosts.copyCredentials")}
+        </ContextMenuItem>
+        <ContextMenuItem 
+          onClick={() => onDeleteHost(host)}
+          className="text-destructive focus:text-destructive"
+        >
+          <Server className="mr-2 h-4 w-4" /> {t("action.delete")}
+        </ContextMenuItem>
+      </ContextMenuContent>
+    </ContextMenu>
+  );
+};
+
+export const HostTreeView: React.FC<HostTreeViewProps> = ({
+  groupTree,
+  hosts,
+  sortMode = 'az',
+  expandedPaths: externalExpandedPaths,
+  onTogglePath: externalOnTogglePath,
+  onExpandAll: externalOnExpandAll,
+  onCollapseAll: externalOnCollapseAll,
+  onConnect,
+  onEditHost,
+  onDuplicateHost,
+  onDeleteHost,
+  onCopyCredentials,
+  onNewHost,
+  onNewGroup,
+  onEditGroup,
+  onDeleteGroup,
+  moveHostToGroup,
+  moveGroup,
+}) => {
+  const { t } = useI18n();
+  
+  // Use external state if provided, otherwise use local persistent state
+  const localTreeState = useTreeExpandedState(STORAGE_KEY_VAULT_HOSTS_TREE_EXPANDED);
+  
+  const expandedPaths = externalExpandedPaths || localTreeState.expandedPaths;
+  const togglePath = externalOnTogglePath || localTreeState.togglePath;
+  const expandAll = externalOnExpandAll || localTreeState.expandAll;
+  const collapseAll = externalOnCollapseAll || localTreeState.collapseAll;
+
+  // Get all possible group paths for expand/collapse all functionality
+  const getAllGroupPaths = (nodes: GroupNode[]): string[] => {
+    const paths: string[] = [];
+    const traverse = (nodeList: GroupNode[]) => {
+      nodeList.forEach(node => {
+        paths.push(node.path);
+        if (node.children) {
+          traverse(Object.values(node.children) as GroupNode[]);
+        }
+      });
+    };
+    traverse(nodes);
+    return paths;
+  };
+
+  const allGroupPaths = useMemo(() => getAllGroupPaths(groupTree), [groupTree]);
+
+  const handleExpandAll = () => {
+    expandAll(allGroupPaths);
+  };
+
+  const handleCollapseAll = () => {
+    collapseAll();
+  };
+
+  // Get ungrouped hosts (hosts without a group or with empty group) and sort them
+  const ungroupedHosts = useMemo(() => {
+    const hosts_without_group = hosts.filter(host => !host.group || host.group === '');
+    return hosts_without_group.sort((a, b) => {
+      switch (sortMode) {
+        case 'az':
+          return a.label.localeCompare(b.label);
+        case 'za':
+          return b.label.localeCompare(a.label);
+        case 'newest':
+          return (b.createdAt || 0) - (a.createdAt || 0);
+        case 'oldest':
+          return (a.createdAt || 0) - (b.createdAt || 0);
+        default:
+          return a.label.localeCompare(b.label);
+      }
+    });
+  }, [hosts, sortMode]);
+
+  // Sort group tree based on sort mode
+  const sortedGroupTree = useMemo(() => {
+    return [...groupTree].sort((a, b) => {
+      switch (sortMode) {
+        case 'za':
+          return b.name.localeCompare(a.name);
+        case 'newest':
+        case 'oldest':
+          // For groups, fall back to name sorting since groups don't have creation dates
+          return a.name.localeCompare(b.name);
+        case 'az':
+        default:
+          return a.name.localeCompare(b.name);
+      }
+    });
+  }, [groupTree, sortMode]);
+
+  return (
+    <div className="space-y-1">
+      {/* Expand/Collapse controls */}
+      {groupTree.length > 0 && (
+        <div className="flex items-center gap-2 mb-3 pb-2 border-b border-border/30">
+          <Button
+            variant="ghost"
+            size="sm"
+            onClick={handleExpandAll}
+            className="h-7 px-2 text-xs"
+          >
+            <Expand size={12} className="mr-1" />
+            {t("vault.tree.expandAll")}
+          </Button>
+          <Button
+            variant="ghost"
+            size="sm"
+            onClick={handleCollapseAll}
+            className="h-7 px-2 text-xs"
+          >
+            <Minimize2 size={12} className="mr-1" />
+            {t("vault.tree.collapseAll")}
+          </Button>
+        </div>
+      )}
+
+      {/* Group tree */}
+      {sortedGroupTree.map((node) => (
+        <TreeNode
+          key={node.path}
+          node={node}
+          depth={0}
+          sortMode={sortMode}
+          expandedPaths={expandedPaths}
+          onToggle={togglePath}
+          onConnect={onConnect}
+          onEditHost={onEditHost}
+          onDuplicateHost={onDuplicateHost}
+          onDeleteHost={onDeleteHost}
+          onCopyCredentials={onCopyCredentials}
+          onNewHost={onNewHost}
+          onNewGroup={onNewGroup}
+          onEditGroup={onEditGroup}
+          onDeleteGroup={onDeleteGroup}
+          moveHostToGroup={moveHostToGroup}
+          moveGroup={moveGroup}
+        />
+      ))}
+
+      {/* Ungrouped hosts at root level */}
+      {ungroupedHosts.map((host) => (
+        <HostTreeItem
+          key={host.id}
+          host={host}
+          depth={0}
+          onConnect={onConnect}
+          onEditHost={onEditHost}
+          onDuplicateHost={onDuplicateHost}
+          onDeleteHost={onDeleteHost}
+          onCopyCredentials={onCopyCredentials}
+          moveHostToGroup={moveHostToGroup}
+        />
+      ))}
+      
+      {/* Empty state */}
+      {ungroupedHosts.length === 0 && groupTree.length === 0 && (
+        <div className="text-center py-12 text-muted-foreground">
+          <Server size={48} className="mx-auto mb-4 opacity-50" />
+          <p className="text-sm">{t("vault.hosts.empty")}</p>
+        </div>
+      )}
+    </div>
+  );
+};

components/PassphraseModal.tsx

@@ -0,0 +1,169 @@
+/**
+ * Passphrase Modal
+ * Modal for requesting passphrase for encrypted SSH keys
+ */
+import { Eye, EyeOff, KeyRound, Loader2 } from "lucide-react";
+import React, { useCallback, useEffect, useState } from "react";
+import { useI18n } from "../application/i18n/I18nProvider";
+import { Button } from "./ui/button";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "./ui/dialog";
+import { Input } from "./ui/input";
+import { Label } from "./ui/label";
+
+export interface PassphraseRequest {
+  requestId: string;
+  keyPath: string;
+  keyName: string;
+  hostname?: string;
+}
+
+interface PassphraseModalProps {
+  request: PassphraseRequest | null;
+  onSubmit: (requestId: string, passphrase: string) => void;
+  onCancel: (requestId: string) => void;
+  onSkip?: (requestId: string) => void;
+}
+
+export const PassphraseModal: React.FC<PassphraseModalProps> = ({
+  request,
+  onSubmit,
+  onCancel,
+  onSkip,
+}) => {
+  const { t } = useI18n();
+  const [passphrase, setPassphrase] = useState("");
+  const [showPassphrase, setShowPassphrase] = useState(false);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  // Reset state when request changes
+  useEffect(() => {
+    if (request) {
+      setPassphrase("");
+      setShowPassphrase(false);
+      setIsSubmitting(false);
+    }
+  }, [request]);
+
+  const handleSubmit = useCallback(() => {
+    if (!request || isSubmitting || !passphrase) return;
+    setIsSubmitting(true);
+    onSubmit(request.requestId, passphrase);
+  }, [request, passphrase, onSubmit, isSubmitting]);
+
+  const handleCancel = useCallback(() => {
+    if (!request) return;
+    onCancel(request.requestId);
+  }, [request, onCancel]);
+
+  const handleSkip = useCallback(() => {
+    if (!request || !onSkip) return;
+    onSkip(request.requestId);
+  }, [request, onSkip]);
+
+  const handleKeyDown = useCallback(
+    (e: React.KeyboardEvent) => {
+      if (e.key === "Enter" && !isSubmitting && passphrase) {
+        e.preventDefault();
+        handleSubmit();
+      }
+    },
+    [handleSubmit, isSubmitting, passphrase]
+  );
+
+  if (!request) return null;
+
+  const keyDisplayName = request.keyName || request.keyPath.split("/").pop() || "SSH Key";
+
+  return (
+    <Dialog open={!!request} onOpenChange={(open) => !open && handleCancel()}>
+      <DialogContent className="sm:max-w-[425px]" hideCloseButton>
+        <DialogHeader>
+          <div className="flex items-center gap-3 mb-2">
+            <div className="h-10 w-10 rounded-full bg-primary/10 flex items-center justify-center">
+              <KeyRound className="h-5 w-5 text-primary" />
+            </div>
+            <div>
+              <DialogTitle>{t("passphrase.title")}</DialogTitle>
+              <DialogDescription className="mt-1">
+                {request.hostname
+                  ? t("passphrase.descWithHost", { keyName: keyDisplayName, hostname: request.hostname })
+                  : t("passphrase.desc", { keyName: keyDisplayName })}
+              </DialogDescription>
+            </div>
+          </div>
+        </DialogHeader>
+
+        <div className="space-y-4 py-2">
+          <div className="space-y-2">
+            <Label htmlFor="passphrase-input">
+              {t("passphrase.label")}
+            </Label>
+            <div className="relative">
+              <Input
+                id="passphrase-input"
+                type={showPassphrase ? "text" : "password"}
+                value={passphrase}
+                onChange={(e) => setPassphrase(e.target.value)}
+                onKeyDown={handleKeyDown}
+                placeholder=""
+                className="pr-10"
+                autoFocus
+                disabled={isSubmitting}
+              />
+              <button
+                type="button"
+                className="absolute right-2 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground disabled:opacity-50 p-1"
+                onClick={() => setShowPassphrase(!showPassphrase)}
+                disabled={isSubmitting}
+              >
+                {showPassphrase ? <EyeOff size={16} /> : <Eye size={16} />}
+              </button>
+            </div>
+            <p className="text-xs text-muted-foreground">
+              {t("passphrase.keyPath")}: <code className="text-xs">{request.keyPath}</code>
+            </p>
+          </div>
+        </div>
+
+        <div className="flex items-center justify-between pt-2">
+          <div className="flex gap-2">
+            <Button
+              variant="secondary"
+              onClick={handleCancel}
+              disabled={isSubmitting}
+            >
+              {t("common.cancel")}
+            </Button>
+            {onSkip && (
+              <Button
+                variant="ghost"
+                onClick={handleSkip}
+                disabled={isSubmitting}
+              >
+                {t("passphrase.skip")}
+              </Button>
+            )}
+          </div>
+          <Button onClick={handleSubmit} disabled={isSubmitting || !passphrase}>
+            {isSubmitting ? (
+              <>
+                <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                {t("passphrase.unlocking")}
+              </>
+            ) : (
+              t("passphrase.unlock")
+            )}
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+};
+
+export default PassphraseModal;

components/SFTPModal.tsx

@@ -76,8 +76,10 @@ const SFTPModal: React.FC<SFTPModalProps> = ({
     selectApplication,
     downloadSftpToTempAndOpen,
     cancelSftpUpload,
+    startStreamTransfer,
+    cancelTransfer,
   } = useSftpBackend();
-  const { t, resolvedLocale } = useI18n();
+  const { t } = useI18n();
   const { sftpAutoSync, sftpShowHiddenFiles } = useSettingsState();
   const isLocalSession = host.protocol === "local";
   const [filenameEncoding, setFilenameEncoding] = useState<SftpFilenameEncoding>(
@@ -365,6 +367,8 @@ const SFTPModal: React.FC<SFTPModalProps> = ({
     mkdirLocal,
     mkdirSftp: mkdirSftpWithEncoding,
     cancelSftpUpload,
+    startStreamTransfer,
+    cancelTransfer,
     setLoading,
     t,
   });
@@ -540,7 +544,6 @@ const SFTPModal: React.FC<SFTPModalProps> = ({
           loading={loading}
           loadingTextContent={loadingTextContent}
           reconnecting={reconnecting}
-          resolvedLocale={resolvedLocale}
           columnWidths={columnWidths}
           sortField={sortField}
           sortOrder={sortOrder}

components/SnippetsManager.tsx

@@ -67,6 +67,12 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
   const [newPackageName, setNewPackageName] = useState('');
   const [isPackageDialogOpen, setIsPackageDialogOpen] = useState(false);
 
+  // Rename package state
+  const [isRenameDialogOpen, setIsRenameDialogOpen] = useState(false);
+  const [renamingPackagePath, setRenamingPackagePath] = useState<string | null>(null);
+  const [renamePackageName, setRenamePackageName] = useState('');
+  const [renameError, setRenameError] = useState('');
+
   // Search, sort, and view mode state
   const [search, setSearch] = useState('');
   const [viewMode, setViewMode] = useStoredViewMode(
@@ -144,23 +150,60 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
 
   const displayedPackages = useMemo(() => {
     if (!selectedPackage) {
-      const roots = packages
+      // Separate absolute paths (starting with /) from relative paths
+      const absolutePaths = packages.filter(p => p.startsWith('/'));
+      const relativePaths = packages.filter(p => !p.startsWith('/'));
+      
+      const results: { name: string; path: string; count: number }[] = [];
+      
+      // Process relative paths (traditional behavior)
+      const relativeRoots = relativePaths
         .map((p) => p.split('/')[0])
-        .filter(Boolean);
-      return Array.from(new Set(roots)).map((name) => {
-        const path = name;
-        const count = snippets.filter((s) => (s.package || '') === path).length;
-        return { name, path, count };
+        .filter((name): name is string => Boolean(name) && name.length > 0);
+      
+      Array.from(new Set(relativeRoots)).forEach((name: string) => {
+        const path: string = name;
+        const count = snippets.filter((s) => {
+          const pkg = s.package || '';
+          return pkg === path || pkg.startsWith(path + '/');
+        }).length;
+        results.push({ name, path, count });
       });
+      
+      // Process absolute paths - show them as separate roots with "/" prefix
+      const absoluteRoots = absolutePaths
+        .map((p) => {
+          const cleanPath = p.substring(1); // Remove leading slash
+          const firstSegment = cleanPath.split('/')[0];
+          return firstSegment;
+        })
+        .filter((name): name is string => Boolean(name) && name.length > 0);
+      
+      Array.from(new Set(absoluteRoots)).forEach((name: string) => {
+        const path: string = `/${name}`;
+        const displayName: string = `/${name}`; // Show with leading slash to distinguish
+        const count = snippets.filter((s) => {
+          const pkg = s.package || '';
+          return pkg === path || pkg.startsWith(path + '/');
+        }).length;
+        results.push({ name: displayName, path, count });
+      });
+      
+      return results;
     }
+    
     const prefix = selectedPackage + '/';
     const children = packages
       .filter((p) => p.startsWith(prefix))
       .map((p) => p.replace(prefix, '').split('/')[0])
-      .filter(Boolean);
+      .filter((name): name is string => Boolean(name) && name.length > 0);
     return Array.from(new Set(children)).map((name) => {
       const path = `${selectedPackage}/${name}`;
-      const count = snippets.filter((s) => (s.package || '') === path).length;
+      // Count snippets in this package AND all nested packages
+      const count = snippets.filter((s) => {
+        const pkg = s.package || '';
+        return pkg === path || pkg.startsWith(path + '/');
+      }).length;
       return { name, path, count };
     });
   }, [packages, selectedPackage, snippets]);
@@ -191,28 +234,76 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
 
   const breadcrumb = useMemo(() => {
     if (!selectedPackage) return [];
+    const isAbsolute = selectedPackage.startsWith('/');
     const parts = selectedPackage.split('/').filter(Boolean);
-    return parts.map((name, idx) => ({ name, path: parts.slice(0, idx + 1).join('/') }));
+    return parts.map((name, idx) => {
+      const pathSegments = parts.slice(0, idx + 1);
+      const path = isAbsolute ? `/${pathSegments.join('/')}` : pathSegments.join('/');
+      return { name, path };
+    });
   }, [selectedPackage]);
 
   const createPackage = () => {
     const name = newPackageName.trim();
     if (!name) return;
-    const full = selectedPackage ? `${selectedPackage}/${name}` : name;
-    if (!packages.includes(full)) onPackagesChange([...packages, full]);
+    
+    // Allow leading slash and validate the rest - allow hyphens anywhere in package names
+    if (!/^\/?([\w-]+(\/[\w-]+)*)\/?$/.test(name)) {
+      // Could add toast notification here for invalid characters
+      return;
+    }
+    
+    // Normalize path construction to avoid double slashes
+    let full: string;
+    if (selectedPackage) {
+      // Strip leading slash from name when we're inside a package to avoid double slashes
+      const normalizedName = name.startsWith('/') ? name.substring(1) : name;
+      full = `${selectedPackage}/${normalizedName}`;
+    } else {
+      // At root level, preserve the leading slash if user intended it
+      full = name;
+    }
+
+    // Strip trailing slash to ensure consistent path handling
+    if (full.endsWith('/')) {
+      full = full.slice(0, -1);
+    }
+    
+    // Check for duplicate package names (case-insensitive)
+    const existingPackage = packages.find(p => p.toLowerCase() === full.toLowerCase());
+    if (existingPackage) {
+      // Could add toast notification here for duplicate package
+      return;
+    }
+    
+    onPackagesChange([...packages, full]);
     setNewPackageName('');
     setIsPackageDialogOpen(false);
   };
 
   const deletePackage = (path: string) => {
+    // Remove the package and all its children
     const keep = packages.filter((p) => !(p === path || p.startsWith(path + '/')));
+    
+    // Move all snippets from deleted packages to root
     const updatedSnippets = snippets.map((s) => {
       if (!s.package) return s;
-      if (s.package === path || s.package.startsWith(path + '/')) return { ...s, package: '' };
+      if (s.package === path || s.package.startsWith(path + '/')) {
+        return { ...s, package: '' };
+      }
       return s;
     });
+    
+    // Update packages first, then save snippets
     onPackagesChange(keep);
-    updatedSnippets.forEach(onSave);
+    
+    // Only save snippets that were actually modified
+    const modifiedSnippets = updatedSnippets.filter((s, index) => 
+      s.package !== snippets[index].package
+    );
+    modifiedSnippets.forEach(onSave);
+    
+    // Reset selected package if it was deleted
     if (selectedPackage && (selectedPackage === path || selectedPackage.startsWith(path + '/'))) {
       setSelectedPackage(null);
     }
@@ -220,24 +311,125 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
 
   const movePackage = (source: string, target: string | null) => {
     const name = source.split('/').pop() || '';
-    const newPath = target ? `${target}/${name}` : name;
+    const isAbsolute = source.startsWith('/');
+    const newPath = target ? `${target}/${name}` : (isAbsolute ? `/${name}` : name);
     if (newPath === source || newPath.startsWith(source + '/')) return;
+
+    // Check if target path already exists
+    if (packages.includes(newPath)) return;
+
     const updatedPackages = packages.map((p) => {
       if (p === source) return newPath;
-      if (p.startsWith(source + '/')) return p.replace(source, newPath);
+      // Use more precise replacement to avoid substring issues
+      if (p.startsWith(source + '/')) {
+        return newPath + p.substring(source.length);
+      }
       return p;
     });
+
     const updatedSnippets = snippets.map((s) => {
       if (!s.package) return s;
       if (s.package === source) return { ...s, package: newPath };
-      if (s.package.startsWith(source + '/')) return { ...s, package: s.package.replace(source, newPath) };
+      // Use more precise replacement to avoid substring issues
+      if (s.package.startsWith(source + '/')) {
+        return { ...s, package: newPath + s.package.substring(source.length) };
+      }
       return s;
     });
+
     onPackagesChange(Array.from(new Set(updatedPackages)));
     updatedSnippets.forEach(onSave);
     if (selectedPackage === source) setSelectedPackage(newPath);
   };
 
+  const openRenameDialog = (path: string) => {
+    const name = path.split('/').pop() || '';
+    setRenamingPackagePath(path);
+    setRenamePackageName(name);
+    setRenameError('');
+    setIsRenameDialogOpen(true);
+  };
+
+  const renamePackage = () => {
+    if (!renamingPackagePath) return;
+
+    const newName = renamePackageName.trim();
+
+    // Validate: empty name
+    if (!newName) {
+      setRenameError(t('snippets.renameDialog.error.empty'));
+      return;
+    }
+
+    // Validate: same rules as createPackage - only allow letters, numbers, hyphens, underscores
+    // Since we're renaming a single segment (no slashes allowed), use the segment-level pattern
+    if (!/^[\w-]+$/.test(newName)) {
+      setRenameError(t('snippets.renameDialog.error.invalidChars'));
+      return;
+    }
+
+    // Build new path
+    const parts = renamingPackagePath.split('/');
+    parts[parts.length - 1] = newName;
+    const newPath = parts.join('/');
+
+    // Validate: same name
+    if (newPath === renamingPackagePath) {
+      setIsRenameDialogOpen(false);
+      return;
+    }
+
+    // Validate: duplicate (case-insensitive)
+    const existingPackage = packages.find(p => p.toLowerCase() === newPath.toLowerCase());
+    if (existingPackage) {
+      setRenameError(t('snippets.renameDialog.error.duplicate'));
+      return;
+    }
+
+    // Update all packages with this path or nested under it
+    const updatedPackages = packages.map((p) => {
+      if (p === renamingPackagePath) return newPath;
+      if (p.startsWith(renamingPackagePath + '/')) {
+        return newPath + p.substring(renamingPackagePath.length);
+      }
+      return p;
+    });
+
+    // Update all snippets with this package or nested under it
+    const updatedSnippets = snippets.map((s) => {
+      if (!s.package) return s;
+      if (s.package === renamingPackagePath) return { ...s, package: newPath };
+      if (s.package.startsWith(renamingPackagePath + '/')) {
+        return { ...s, package: newPath + s.package.substring(renamingPackagePath.length) };
+      }
+      return s;
+    });
+
+    onPackagesChange(Array.from(new Set(updatedPackages)));
+    updatedSnippets.forEach(onSave);
+
+    // Update selected package if it was renamed
+    if (selectedPackage === renamingPackagePath) {
+      setSelectedPackage(newPath);
+    } else if (selectedPackage?.startsWith(renamingPackagePath + '/')) {
+      setSelectedPackage(newPath + selectedPackage.substring(renamingPackagePath.length));
+    }
+
+    // Update editingSnippet.package if it's in the renamed package (fixes stale state when editing)
+    if (editingSnippet.package) {
+      if (editingSnippet.package === renamingPackagePath) {
+        setEditingSnippet(prev => ({ ...prev, package: newPath }));
+      } else if (editingSnippet.package.startsWith(renamingPackagePath + '/')) {
+        setEditingSnippet(prev => ({
+          ...prev,
+          package: newPath + prev.package!.substring(renamingPackagePath.length)
+        }));
+      }
+    }
+
+    setIsRenameDialogOpen(false);
+  };
+
   const moveSnippet = (id: string, pkg: string | null) => {
     const sn = snippets.find((s) => s.id === id);
     if (!sn) return;
@@ -246,11 +438,36 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
 
   // Package options for Combobox
   const packageOptions: ComboboxOption[] = useMemo(() => {
-    return packages.map(p => ({
-      value: p,
-      label: p.includes('/') ? p.split('/').pop()! : p,
-      sublabel: p.includes('/') ? p : undefined,
-    }));
+    // Generate all possible parent paths for each package
+    const allPaths = new Set<string>();
+    
+    packages.forEach(pkg => {
+      // Add the full package path
+      allPaths.add(pkg);
+      
+      // Add all parent paths
+      const parts = pkg.split('/').filter(Boolean);
+      const isAbsolute = pkg.startsWith('/');
+      
+      for (let i = 1; i < parts.length; i++) {
+        const parentPath = (isAbsolute ? '/' : '') + parts.slice(0, i).join('/');
+        allPaths.add(parentPath);
+      }
+    });
+    
+    return Array.from(allPaths)
+      .sort((a, b) => {
+        // Sort by depth first (shorter paths first), then alphabetically
+        const depthA = (a.match(/\//g) || []).length;
+        const depthB = (b.match(/\//g) || []).length;
+        if (depthA !== depthB) return depthA - depthB;
+        return a.localeCompare(b);
+      })
+      .map(p => ({
+        value: p,
+        label: p.includes('/') ? p.split('/').pop()! : p,
+        sublabel: p.includes('/') ? p : undefined,
+      }));
   }, [packages]);
 
   // Shell history lazy loading
@@ -354,7 +571,13 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
               <Combobox
                 options={packageOptions}
                 value={editingSnippet.package || selectedPackage || ''}
-                onValueChange={(val) => setEditingSnippet({ ...editingSnippet, package: val })}
+                onValueChange={(val) => {
+                  setEditingSnippet({ ...editingSnippet, package: val });
+                  // If selecting an implicit parent path, persist it to packages
+                  if (val && !packages.includes(val)) {
+                    onPackagesChange([...packages, val]);
+                  }
+                }}
                 placeholder={t('snippets.field.packagePlaceholder')}
                 allowCreate={true}
                 onCreateNew={(val) => {
@@ -624,6 +847,7 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
                     </ContextMenuTrigger>
                     <ContextMenuContent>
                       <ContextMenuItem onClick={() => setSelectedPackage(pkg.path)}>{t('action.open')}</ContextMenuItem>
+                      <ContextMenuItem onClick={() => openRenameDialog(pkg.path)}>{t('common.rename')}</ContextMenuItem>
                       <ContextMenuItem className="text-destructive" onClick={() => deletePackage(pkg.path)}>{t('action.delete')}</ContextMenuItem>
                     </ContextMenuContent>
                   </ContextMenu>
@@ -729,6 +953,8 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
                 value={newPackageName}
                 onChange={(e) => setNewPackageName(e.target.value)}
                 onKeyDown={(e) => e.key === 'Enter' && createPackage()}
+                pattern="^/?([\w-]+(/[\w-]+)*)?/?$"
+                title="Package names can contain letters, numbers, hyphens, underscores, and forward slashes. Can optionally start with /"
               />
               <p className="text-[11px] text-muted-foreground">{t('snippets.packageDialog.hint')}</p>
             </div>
@@ -742,6 +968,40 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
         </div>
       )}
 
+      {/* Rename Package Dialog */}
+      {isRenameDialogOpen && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50">
+          <Card className="w-full max-w-sm p-4 space-y-4">
+            <div>
+              <p className="text-sm font-semibold">{t('snippets.renameDialog.title')}</p>
+              <p className="text-xs text-muted-foreground">{t('snippets.renameDialog.currentPath', { path: renamingPackagePath })}</p>
+            </div>
+            <div className="space-y-2">
+              <Label>{t('field.name')}</Label>
+              <Input
+                autoFocus
+                placeholder={t('snippets.renameDialog.placeholder')}
+                value={renamePackageName}
+                onChange={(e) => {
+                  setRenamePackageName(e.target.value);
+                  setRenameError('');
+                }}
+                onKeyDown={(e) => e.key === 'Enter' && renamePackage()}
+              />
+              {renameError && (
+                <p className="text-[11px] text-destructive">{renameError}</p>
+              )}
+            </div>
+            <div className="flex justify-end gap-2">
+              <Button variant="ghost" onClick={() => setIsRenameDialogOpen(false)}>
+                {t('common.cancel')}
+              </Button>
+              <Button onClick={renamePackage}>{t('common.rename')}</Button>
+            </div>
+          </Card>
+        </div>
+      )}
+
       {/* Right Panel */}
       {renderRightPanel()}
     </div>

components/Terminal.tsx

@@ -919,6 +919,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
     <TerminalContextMenu
       hasSelection={hasSelection}
       hotkeyScheme={hotkeyScheme}
+      keyBindings={keyBindings}
       rightClickBehavior={terminalSettings?.rightClickBehavior}
       onCopy={terminalContextActions.onCopy}
       onPaste={terminalContextActions.onPaste}

components/TextEditorModal.tsx

@@ -7,7 +7,7 @@ import {
   Search,
   X,
 } from 'lucide-react';
-import Editor, { type OnMount, loader } from '@monaco-editor/react';
+import Editor, { type OnMount, loader, useMonaco } from '@monaco-editor/react';
 import type * as Monaco from 'monaco-editor';
 import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
@@ -82,6 +82,50 @@ const languageIdToMonaco = (langId: string): string => {
   return mapping[langId] || 'plaintext';
 };
 
+// Convert HSL string "h s% l%" to hex color
+const hslToHex = (hslString: string): string => {
+  const parts = hslString.trim().split(/\s+/);
+  if (parts.length < 3) return '#1e1e1e';
+  const h = parseFloat(parts[0]) / 360;
+  const s = parseFloat(parts[1].replace('%', '')) / 100;
+  const l = parseFloat(parts[2].replace('%', '')) / 100;
+
+  const hue2rgb = (p: number, q: number, t: number) => {
+    if (t < 0) t += 1;
+    if (t > 1) t -= 1;
+    if (t < 1 / 6) return p + (q - p) * 6 * t;
+    if (t < 1 / 2) return q;
+    if (t < 2 / 3) return p + (q - p) * (2 / 3 - t) * 6;
+    return p;
+  };
+
+  let r: number, g: number, b: number;
+  if (s === 0) {
+    r = g = b = l;
+  } else {
+    const q = l < 0.5 ? l * (1 + s) : l + s - l * s;
+    const p = 2 * l - q;
+    r = hue2rgb(p, q, h + 1 / 3);
+    g = hue2rgb(p, q, h);
+    b = hue2rgb(p, q, h - 1 / 3);
+  }
+
+  const toHex = (x: number) => {
+    const hex = Math.round(x * 255).toString(16);
+    return hex.length === 1 ? '0' + hex : hex;
+  };
+
+  return `#${toHex(r)}${toHex(g)}${toHex(b)}`;
+};
+
+// Get background color from CSS variable
+const getBackgroundColor = (): string => {
+  const bgValue = getComputedStyle(document.documentElement)
+    .getPropertyValue('--background')
+    .trim();
+  return bgValue ? hslToHex(bgValue) : '#1e1e1e';
+};
+
 export const TextEditorModal: React.FC<TextEditorModalProps> = ({
   open,
   onClose,
@@ -90,12 +134,13 @@ export const TextEditorModal: React.FC<TextEditorModalProps> = ({
   onSave,
 }) => {
   const { t } = useI18n();
+  const monaco = useMonaco();
   const [content, setContent] = useState(initialContent);
   const [saving, setSaving] = useState(false);
   const [hasChanges, setHasChanges] = useState(false);
   const [languageId, setLanguageId] = useState(() => getLanguageId(fileName));
   const editorRef = useRef<Monaco.editor.IStandaloneCodeEditor | null>(null);
-  
+
   // Ref to store the latest save function to avoid stale closure in keyboard shortcut
   const handleSaveRef = useRef<() => Promise<void>>(() => Promise.resolve());
 
@@ -104,13 +149,49 @@ export const TextEditorModal: React.FC<TextEditorModalProps> = ({
     document.documentElement.classList.contains('dark')
   );
 
-  // Listen for theme changes via MutationObserver on <html> class
+  // Track background color for custom theme
+  const [bgColor, setBgColor] = useState(() => getBackgroundColor());
+
+  // Custom theme name
+  const customThemeName = isDarkTheme ? 'netcatty-dark' : 'netcatty-light';
+
+  // Define and update custom Monaco themes based on UI background color
+  useEffect(() => {
+    if (!monaco) return;
+
+    // Define dark theme with custom background
+    monaco.editor.defineTheme('netcatty-dark', {
+      base: 'vs-dark',
+      inherit: true,
+      rules: [],
+      colors: {
+        'editor.background': bgColor,
+      },
+    });
+
+    // Define light theme with custom background
+    monaco.editor.defineTheme('netcatty-light', {
+      base: 'vs',
+      inherit: true,
+      rules: [],
+      colors: {
+        'editor.background': bgColor,
+      },
+    });
+
+    // Apply the current theme
+    monaco.editor.setTheme(customThemeName);
+  }, [monaco, isDarkTheme, bgColor, customThemeName]);
+
+  // Listen for theme changes via MutationObserver on <html> class and style
   useEffect(() => {
     const root = document.documentElement;
-    const observer = new MutationObserver(() => {
+    const updateTheme = () => {
       setIsDarkTheme(root.classList.contains('dark'));
-    });
-    observer.observe(root, { attributes: true, attributeFilter: ['class'] });
+      setBgColor(getBackgroundColor());
+    };
+    const observer = new MutationObserver(updateTheme);
+    observer.observe(root, { attributes: true, attributeFilter: ['class', 'style'] });
     return () => observer.disconnect();
   }, []);
 
@@ -185,7 +266,6 @@ export const TextEditorModal: React.FC<TextEditorModalProps> = ({
 
   const supportedLanguages = useMemo(() => getSupportedLanguages(), []);
   const monacoLanguage = useMemo(() => languageIdToMonaco(languageId), [languageId]);
-  const monacoTheme = isDarkTheme ? 'vs-dark' : 'light';
   const languageOptions = useMemo(
     () => supportedLanguages.map((lang) => ({ value: lang.id, label: lang.name })),
     [supportedLanguages],
@@ -265,7 +345,7 @@ export const TextEditorModal: React.FC<TextEditorModalProps> = ({
             value={content}
             onChange={handleEditorChange}
             onMount={handleEditorMount}
-            theme={monacoTheme}
+            theme={customThemeName}
             loading={
               <div className="absolute inset-0 flex items-center justify-center bg-background">
                 <Loader2 size={32} className="animate-spin text-muted-foreground" />

components/TopTabs.tsx

@@ -25,6 +25,7 @@ interface TopTabsProps {
   isMacClient: boolean;
   onCloseSession: (sessionId: string, e?: React.MouseEvent) => void;
   onRenameSession: (sessionId: string) => void;
+  onCopySession: (sessionId: string) => void;
   onRenameWorkspace: (workspaceId: string) => void;
   onCloseWorkspace: (workspaceId: string) => void;
   onCloseLogView: (logViewId: string) => void;
@@ -121,6 +122,7 @@ const TopTabsInner: React.FC<TopTabsProps> = ({
   isMacClient,
   onCloseSession,
   onRenameSession,
+  onCopySession,
   onRenameWorkspace,
   onCloseWorkspace,
   onCloseLogView,
@@ -410,6 +412,9 @@ const TopTabsInner: React.FC<TopTabsProps> = ({
               <ContextMenuItem onClick={() => onRenameSession(session.id)}>
                 {t('common.rename')}
               </ContextMenuItem>
+              <ContextMenuItem onClick={() => onCopySession(session.id)}>
+                {t('tabs.copyTab')}
+              </ContextMenuItem>
               <ContextMenuItem className="text-destructive" onClick={() => onCloseSession(session.id)}>
                 {t('common.close')}
               </ContextMenuItem>

components/VaultView.tsx

@@ -2,6 +2,9 @@ import {
   Activity,
   BookMarked,
   ChevronDown,
+  ClipboardCopy,
+  Copy,
+  Download,
   Edit2,
   FileCode,
   FolderPlus,
@@ -9,6 +12,7 @@ import {
   Key,
   LayoutGrid,
   List,
+  Network,
   Plug,
   Plus,
   Search,
@@ -22,10 +26,11 @@ import {
 import React, { Suspense, lazy, memo, useCallback, useEffect, useMemo, useState } from "react";
 import { useI18n } from "../application/i18n/I18nProvider";
 import { useStoredViewMode } from "../application/state/useStoredViewMode";
+import { useTreeExpandedState } from "../application/state/useTreeExpandedState";
 import { sanitizeHost } from "../domain/host";
-import { importVaultHostsFromText } from "../domain/vaultImport";
+import { importVaultHostsFromText, exportHostsToCsvWithStats } from "../domain/vaultImport";
 import type { VaultImportFormat } from "../domain/vaultImport";
-import { STORAGE_KEY_VAULT_HOSTS_VIEW_MODE } from "../infrastructure/config/storageKeys";
+import { STORAGE_KEY_VAULT_HOSTS_VIEW_MODE, STORAGE_KEY_VAULT_HOSTS_TREE_EXPANDED } from "../infrastructure/config/storageKeys";
 import { cn } from "../lib/utils";
 import {
   ConnectionLog,
@@ -43,6 +48,7 @@ import {
 import { AppLogo } from "./AppLogo";
 import { DistroAvatar } from "./DistroAvatar";
 import HostDetailsPanel from "./HostDetailsPanel";
+import { HostTreeView } from "./HostTreeView";
 import KeychainManager from "./KeychainManager";
 import KnownHostsManager from "./KnownHostsManager";
 import PortForwarding from "./PortForwardingNew";
@@ -163,6 +169,8 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
   const [renameGroupError, setRenameGroupError] = useState<string | null>(null);
   const [isImportOpen, setIsImportOpen] = useState(false);
   const [isSerialModalOpen, setIsSerialModalOpen] = useState(false);
+  const [isDeleteGroupOpen, setIsDeleteGroupOpen] = useState(false);
+  const [deleteTargetPath, setDeleteTargetPath] = useState<string | null>(null);
 
   // Handle external navigation requests
   useEffect(() => {
@@ -177,12 +185,14 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
     STORAGE_KEY_VAULT_HOSTS_VIEW_MODE,
     "grid",
   );
+  const treeExpandedState = useTreeExpandedState(STORAGE_KEY_VAULT_HOSTS_TREE_EXPANDED);
   const [sortMode, setSortMode] = useState<SortMode>("az");
   const [selectedTags, setSelectedTags] = useState<string[]>([]);
 
   // Host panel state (local to hosts section)
   const [isHostPanelOpen, setIsHostPanelOpen] = useState(false);
   const [editingHost, setEditingHost] = useState<Host | null>(null);
+  const [newHostGroupPath, setNewHostGroupPath] = useState<string | null>(null);
 
   // Quick connect state
   const [quickConnectTarget, setQuickConnectTarget] = useState<{
@@ -293,6 +303,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
 
   const handleNewHost = useCallback(() => {
     setEditingHost(null);
+    setNewHostGroupPath(null);
     setIsHostPanelOpen(true);
   }, []);
 
@@ -301,6 +312,96 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
     setIsHostPanelOpen(true);
   }, []);
 
+  const handleDuplicateHost = useCallback((host: Host) => {
+    // Create a copy of the host with a new ID and modified label
+    const duplicatedHost: Host = {
+      ...host,
+      id: crypto.randomUUID(),
+      label: `${host.label} (${t('action.copy')})`,
+      createdAt: Date.now(),
+    };
+    // Open the edit panel with the duplicated host for modification
+    setEditingHost(duplicatedHost);
+    setIsHostPanelOpen(true);
+  }, [t]);
+
+  // Export hosts to CSV
+  const handleExportHosts = useCallback(() => {
+    if (hosts.length === 0) {
+      toast.warning(t('vault.hosts.export.toast.noHosts'));
+      return;
+    }
+
+    const { csv, exportedCount, skippedCount } = exportHostsToCsvWithStats(hosts);
+
+    if (exportedCount === 0) {
+      toast.warning(t('vault.hosts.export.toast.noHosts'));
+      return;
+    }
+
+    const blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' });
+    const url = URL.createObjectURL(blob);
+    const link = document.createElement('a');
+    link.href = url;
+    link.download = `hosts_export_${new Date().toISOString().slice(0, 10)}.csv`;
+    document.body.appendChild(link);
+    link.click();
+    document.body.removeChild(link);
+    URL.revokeObjectURL(url);
+
+    if (skippedCount > 0) {
+      toast.warning(t('vault.hosts.export.toast.successWithSkipped', { count: exportedCount, skipped: skippedCount }));
+    } else {
+      toast.success(t('vault.hosts.export.toast.success', { count: exportedCount }));
+    }
+  }, [hosts, t]);
+
+  // Copy host credentials to clipboard
+  const handleCopyCredentials = useCallback((host: Host) => {
+    // Only use telnet-specific port and credentials when protocol is explicitly telnet
+    // Don't treat telnetEnabled as primary - that's just an optional protocol
+    const isTelnet = host.protocol === "telnet";
+
+    const defaultPort = isTelnet ? 23 : 22;
+    const effectivePort = isTelnet
+      ? (host.telnetPort ?? host.port ?? 23)
+      : (host.port ?? 22);
+
+    // Bracket IPv6 addresses when appending non-default port
+    let address: string;
+    if (effectivePort !== defaultPort) {
+      const isIPv6 = host.hostname.includes(":") && !host.hostname.startsWith("[");
+      const hostname = isIPv6 ? `[${host.hostname}]` : host.hostname;
+      address = `${hostname}:${effectivePort}`;
+    } else {
+      address = host.hostname;
+    }
+
+    // Resolve credentials from identity if configured, otherwise use host credentials
+    // For telnet hosts, use telnet-specific credentials
+    const identity = host.identityId
+      ? identities.find((i) => i.id === host.identityId)
+      : undefined;
+
+    const username = isTelnet
+      ? (host.telnetUsername?.trim() || host.username?.trim())
+      : (identity?.username?.trim() || host.username?.trim());
+
+    const password = isTelnet
+      ? (host.telnetPassword || host.password)
+      : (identity?.password || host.password);
+
+    if (!password) {
+      toast.warning(t('vault.hosts.copyCredentials.toast.noPassword'));
+      return;
+    }
+
+    const text = `host: ${address}\nusername: ${username ?? ''}\npassword: ${password}`;
+    navigator.clipboard.writeText(text).then(() => {
+      toast.success(t('vault.hosts.copyCredentials.toast.success'));
+    });
+  }, [identities, t]);
+
   const readTextFile = useCallback(async (file: File): Promise<string> => {
     const buf = await file.arrayBuffer();
     const bytes = new Uint8Array(buf);
@@ -447,6 +548,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
     return root;
   }, [hosts, customGroups]);
 
+
   const findGroupNode = (path: string | null): GroupNode | null => {
     if (!path)
       return {
@@ -470,7 +572,15 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
   const displayedHosts = useMemo(() => {
     let filtered = hosts;
     if (selectedGroupPath) {
-      filtered = filtered.filter((h) => (h.group || "") === selectedGroupPath);
+      // Match hosts whose group equals the selected path
+      // For "General" group, also match hosts with empty/undefined group
+      filtered = filtered.filter((h) => {
+        const hostGroup = h.group || "";
+        if (selectedGroupPath === "General") {
+          return hostGroup === "" || hostGroup === "General";
+        }
+        return hostGroup === selectedGroupPath;
+      });
     }
     if (search.trim()) {
       const s = search.toLowerCase();
@@ -505,6 +615,79 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
     return filtered;
   }, [hosts, selectedGroupPath, search, selectedTags, sortMode]);
 
+  // For tree view: apply search, tag filter, and sorting, but not group filtering
+  const treeViewHosts = useMemo(() => {
+    let filtered = hosts;
+    if (search.trim()) {
+      const s = search.toLowerCase();
+      filtered = filtered.filter(
+        (h) =>
+          h.label.toLowerCase().includes(s) ||
+          h.hostname.toLowerCase().includes(s) ||
+          h.tags.some((t) => t.toLowerCase().includes(s)),
+      );
+    }
+    // Apply tag filter
+    if (selectedTags.length > 0) {
+      filtered = filtered.filter((h) =>
+        selectedTags.some((t) => h.tags?.includes(t)),
+      );
+    }
+    // Apply sorting
+    filtered = [...filtered].sort((a, b) => {
+      switch (sortMode) {
+        case "az":
+          return a.label.localeCompare(b.label);
+        case "za":
+          return b.label.localeCompare(a.label);
+        case "newest":
+          return (b.createdAt || 0) - (a.createdAt || 0);
+        case "oldest":
+          return (a.createdAt || 0) - (b.createdAt || 0);
+        default:
+          return 0;
+      }
+    });
+    return filtered;
+  }, [hosts, search, selectedTags, sortMode]);
+
+  // Create a separate group tree for tree view that uses filtered hosts
+  const buildTreeViewGroupTree = useMemo<Record<string, GroupNode>>(() => {
+    const root: Record<string, GroupNode> = {};
+    const insertPath = (path: string, host?: Host) => {
+      const parts = path.split("/").filter(Boolean);
+      let currentLevel = root;
+      let currentPath = "";
+      parts.forEach((part, index) => {
+        currentPath = currentPath ? `${currentPath}/${part}` : part;
+        if (!currentLevel[part]) {
+          currentLevel[part] = {
+            name: part,
+            path: currentPath,
+            children: {},
+            hosts: [],
+          };
+        }
+        if (host && index === parts.length - 1)
+          currentLevel[part].hosts.push(host);
+        currentLevel = currentLevel[part].children;
+      });
+    };
+    customGroups.forEach((path) => insertPath(path));
+    // Use filtered hosts (treeViewHosts) instead of all hosts to respect search/tag filters
+    treeViewHosts.forEach((host) => {
+      if (host.group && host.group.trim() !== "") {
+        insertPath(host.group, host);
+      }
+    });
+    return root;
+  }, [treeViewHosts, customGroups]);
+
+  // Create tree view specific group tree that excludes ungrouped hosts
+  const treeViewGroupTree = useMemo<GroupNode[]>(() => {
+    return (Object.values(buildTreeViewGroupTree) as GroupNode[]).sort((a, b) => a.name.localeCompare(b.name));
+  }, [buildTreeViewGroupTree]);
+
   // Compute all unique tags across all hosts
   const allTags = useMemo(() => {
     const tagSet = new Set<string>();
@@ -545,9 +728,20 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
 
   const displayedGroups = useMemo(() => {
     if (!selectedGroupPath) {
-      return (Object.values(buildGroupTree) as GroupNode[]).sort((a, b) =>
-        a.name.localeCompare(b.name),
+      // Hide "General" group at root level only if it's auto-generated
+      // (not user-created and has no subgroups)
+      const isGeneralUserCreated = customGroups.some(
+        (g) => g === "General" || g.startsWith("General/")
       );
+      return (Object.values(buildGroupTree) as GroupNode[])
+        .filter((node) => {
+          if (node.name !== "General") return true;
+          // Keep General if user explicitly created it or it has subgroups
+          if (isGeneralUserCreated) return true;
+          if (Object.keys(node.children).length > 0) return true;
+          return false;
+        })
+        .sort((a, b) => a.name.localeCompare(b.name));
     }
     const node = findGroupNode(selectedGroupPath);
     if (!node || !node.children) return [];
@@ -555,7 +749,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
       a.name.localeCompare(b.name),
     );
     // eslint-disable-next-line react-hooks/exhaustive-deps -- findGroupNode is derived from buildGroupTree
-  }, [buildGroupTree, selectedGroupPath]);
+  }, [buildGroupTree, selectedGroupPath, customGroups]);
 
   // Known Hosts callbacks - use refs to keep stable references
   // Store latest values in refs so callbacks don't need to depend on them
@@ -747,7 +941,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
             className={cn(
               "w-full justify-start gap-3 h-10",
               currentSection === "hosts" &&
-              "bg-foreground/5 text-foreground hover:bg-foreground/10 border-border/40",
+              "bg-foreground/10 text-foreground hover:bg-foreground/15 border-border/40",
             )}
             onClick={() => {
               setCurrentSection("hosts");
@@ -761,7 +955,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
             className={cn(
               "w-full justify-start gap-3 h-10",
               currentSection === "keys" &&
-              "bg-foreground/5 text-foreground hover:bg-foreground/10 border-border/40",
+              "bg-foreground/10 text-foreground hover:bg-foreground/15 border-border/40",
             )}
             onClick={() => {
               setCurrentSection("keys");
@@ -774,7 +968,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
             className={cn(
               "w-full justify-start gap-3 h-10",
               currentSection === "port" &&
-              "bg-foreground/5 text-foreground hover:bg-foreground/10 border-border/40",
+              "bg-foreground/10 text-foreground hover:bg-foreground/15 border-border/40",
             )}
             onClick={() => setCurrentSection("port")}
           >
@@ -785,7 +979,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
             className={cn(
               "w-full justify-start gap-3 h-10",
               currentSection === "snippets" &&
-              "bg-foreground/5 text-foreground hover:bg-foreground/10 border-border/40",
+              "bg-foreground/10 text-foreground hover:bg-foreground/15 border-border/40",
             )}
             onClick={() => {
               setCurrentSection("snippets");
@@ -798,7 +992,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
             className={cn(
               "w-full justify-start gap-3 h-10",
               currentSection === "knownhosts" &&
-              "bg-foreground/5 text-foreground hover:bg-foreground/10 border-border/40",
+              "bg-foreground/10 text-foreground hover:bg-foreground/15 border-border/40",
             )}
             onClick={() => setCurrentSection("knownhosts")}
           >
@@ -809,7 +1003,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
             className={cn(
               "w-full justify-start gap-3 h-10",
               currentSection === "logs" &&
-              "bg-foreground/5 text-foreground hover:bg-foreground/10 border-border/40",
+              "bg-foreground/10 text-foreground hover:bg-foreground/15 border-border/40",
             )}
             onClick={() => setCurrentSection("logs")}
           >
@@ -874,8 +1068,10 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
                     <Button variant="ghost" size="icon" className="h-10 w-10 app-no-drag">
                       {viewMode === "grid" ? (
                         <LayoutGrid size={16} />
-                      ) : (
+                      ) : viewMode === "list" ? (
                         <List size={16} />
+                      ) : (
+                        <Network size={16} />
                       )}
                       <ChevronDown size={10} className="ml-0.5" />
                     </Button>
@@ -895,6 +1091,13 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
                     >
                       <List size={14} /> {t("vault.view.list")}
                     </Button>
+                    <Button
+                      variant={viewMode === "tree" ? "secondary" : "ghost"}
+                      className="w-full justify-start gap-2 h-9"
+                      onClick={() => setViewMode("tree")}
+                    >
+                      <Network size={14} /> {t("vault.view.tree")}
+                    </Button>
                   </DropdownContent>
                 </Dropdown>
                 <TagFilterDropdown
@@ -952,6 +1155,13 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
                     >
                       <Upload size={14} /> {t("vault.hosts.import")}
                     </Button>
+                    <Button
+                      variant="ghost"
+                      className="w-full justify-start gap-2"
+                      onClick={handleExportHosts}
+                    >
+                      <Download size={14} /> {t("vault.hosts.export")}
+                    </Button>
                   </DropdownContent>
                 </Dropdown>
               </div>
@@ -992,43 +1202,45 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
               {currentSection === "hosts" && (
                 <>
                   <section className="space-y-2">
-                    <div className="flex items-center gap-2 text-sm font-semibold">
-                      <button
-                        className="text-primary hover:underline"
-                        onClick={() => setSelectedGroupPath(null)}
-                      >
-                        {t("vault.hosts.allHosts")}
-                      </button>
-                      {selectedGroupPath &&
-                        selectedGroupPath
-                          .split("/")
-                          .filter(Boolean)
-                          .map((part, idx, arr) => {
-                            const crumbPath = arr.slice(0, idx + 1).join("/");
-                            const isLast = idx === arr.length - 1;
-                            return (
-                              <span
-                                key={crumbPath}
-                                className="flex items-center gap-2"
-                              >
-                                <span className="text-muted-foreground">›</span>
-                                <button
-                                  className={cn(
-                                    isLast
-                                      ? "text-foreground font-semibold"
-                                      : "text-primary hover:underline",
-                                  )}
-                                  onClick={() =>
-                                    setSelectedGroupPath(crumbPath)
-                                  }
+                    {viewMode !== "tree" && (
+                      <div className="flex items-center gap-2 text-sm font-semibold">
+                        <button
+                          className="text-primary hover:underline"
+                          onClick={() => setSelectedGroupPath(null)}
+                        >
+                          {t("vault.hosts.allHosts")}
+                        </button>
+                        {selectedGroupPath &&
+                          selectedGroupPath
+                            .split("/")
+                            .filter(Boolean)
+                            .map((part, idx, arr) => {
+                              const crumbPath = arr.slice(0, idx + 1).join("/");
+                              const isLast = idx === arr.length - 1;
+                              return (
+                                <span
+                                  key={crumbPath}
+                                  className="flex items-center gap-2"
                                 >
-                                  {part}
-                                </button>
-                              </span>
-                            );
-                          })}
-                    </div>
-                    {displayedGroups.length > 0 && (
+                                  <span className="text-muted-foreground">›</span>
+                                  <button
+                                    className={cn(
+                                      isLast
+                                        ? "text-foreground font-semibold"
+                                        : "text-primary hover:underline",
+                                    )}
+                                    onClick={() =>
+                                      setSelectedGroupPath(crumbPath)
+                                    }
+                                  >
+                                    {part}
+                                  </button>
+                                </span>
+                              );
+                            })}
+                      </div>
+                    )}
+                    {viewMode !== "tree" && displayedGroups.length > 0 && (
                       <>
                         <div className="flex items-center justify-between">
                           <h3 className="text-sm font-semibold text-muted-foreground">
@@ -1040,26 +1252,27 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
                         </div>
                       </>
                     )}
-                    <div
-                      className={cn(
-                        displayedGroups.length === 0 ? "hidden" : "",
-                        viewMode === "grid"
-                          ? "grid gap-3 grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4"
-                          : "flex flex-col gap-0",
-                      )}
-                      onDragOver={(e) => {
-                        e.preventDefault();
-                      }}
-                      onDrop={(e) => {
-                        e.preventDefault();
-                        e.stopPropagation();
-                        const hostId = e.dataTransfer.getData("host-id");
-                        const groupPath = e.dataTransfer.getData("group-path");
-                        if (hostId) moveHostToGroup(hostId, selectedGroupPath);
-                        if (groupPath && selectedGroupPath !== null)
-                          moveGroup(groupPath, selectedGroupPath);
-                      }}
-                    >
+                    {viewMode !== "tree" && (
+                      <div
+                        className={cn(
+                          displayedGroups.length === 0 ? "hidden" : "",
+                          viewMode === "grid"
+                            ? "grid gap-3 grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4"
+                            : "flex flex-col gap-0",
+                        )}
+                        onDragOver={(e) => {
+                          e.preventDefault();
+                        }}
+                        onDrop={(e) => {
+                          e.preventDefault();
+                          e.stopPropagation();
+                          const hostId = e.dataTransfer.getData("host-id");
+                          const groupPath = e.dataTransfer.getData("group-path");
+                          if (hostId) moveHostToGroup(hostId, selectedGroupPath);
+                          if (groupPath && selectedGroupPath !== null)
+                            moveGroup(groupPath, selectedGroupPath);
+                        }}
+                      >
                       {displayedGroups.map((node) => (
                         <ContextMenu key={node.path}>
                           <ContextMenuTrigger asChild>
@@ -1138,6 +1351,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
                         </ContextMenu>
                       ))}
                     </div>
+                    )}
                   </section>
 
                   <section className="space-y-2">
@@ -1147,110 +1361,161 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
                       </h3>
                       <div className="flex items-center gap-2 text-xs text-muted-foreground">
                         <span>
-                          {t("vault.hosts.header.entries", { count: displayedHosts.length })}
+                          {t("vault.hosts.header.entries", { count: viewMode === "tree" ? treeViewHosts.length : displayedHosts.length })}
                         </span>
                         <div className="bg-secondary/80 border border-border/70 rounded-md px-2 py-1 text-[11px]">
                           {t("vault.hosts.header.live", { count: sessions.length })}
                         </div>
                       </div>
                     </div>
-                    <div
-                      className={cn(
-                        viewMode === "grid"
-                          ? "grid gap-3 grid-cols-1 md:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4"
-                          : "flex flex-col gap-0",
-                      )}
-                    >
-                      {displayedHosts.map((host) => {
-                        const safeHost = sanitizeHost(host);
-                        const distroBadge = {
-                          text: (safeHost.os || "L")[0].toUpperCase(),
-                          label: safeHost.distro || safeHost.os || "Linux",
-                        };
-                        return (
-                          <ContextMenu key={host.id}>
-                            <ContextMenuTrigger>
-                              <div
-                                className={cn(
-                                  "group cursor-pointer",
-                                  viewMode === "grid"
-                                    ? "soft-card elevate rounded-xl h-[68px] px-3 py-2"
-                                    : "h-14 px-3 py-2 hover:bg-secondary/60 rounded-lg transition-colors",
-                                )}
-                                draggable
-                                onDragStart={(e) => {
-                                  e.dataTransfer.effectAllowed = "move";
-                                  e.dataTransfer.setData("host-id", host.id);
-                                }}
-                                onClick={() => handleHostConnect(safeHost)}
-                              >
-                                <div className="flex items-center gap-3 h-full">
-                                  <DistroAvatar
-                                    host={safeHost}
-                                    fallback={distroBadge.text}
-                                  />
-                                  <div className="min-w-0 flex flex-col justify-center gap-0.5 flex-1">
-                                    <div className="text-sm font-semibold truncate leading-5">
-                                      {safeHost.label}
-                                    </div>
-                                    <div className="text-[11px] text-muted-foreground font-mono truncate leading-4">
-                                      {safeHost.username}@{safeHost.hostname}
-                                    </div>
-                                  </div>
-                                  {viewMode === "list" && (
-                                    <>
-                                      <Button
-                                        variant="ghost"
-                                        size="icon"
-                                        className="h-8 w-8 opacity-0 group-hover:opacity-100 transition-opacity shrink-0"
-                                        onClick={(e) => {
-                                          e.stopPropagation();
-                                          handleEditHost(host);
-                                        }}
-                                      >
-                                        <Edit2 size={14} />
-                                      </Button>
-                                    </>
+                    
+                    {viewMode === "tree" ? (
+                      <HostTreeView
+                        groupTree={treeViewGroupTree}
+                        hosts={treeViewHosts} // Use filtered and sorted hosts for tree view
+                        sortMode={sortMode}
+                        expandedPaths={treeExpandedState.expandedPaths}
+                        onTogglePath={treeExpandedState.togglePath}
+                        onExpandAll={treeExpandedState.expandAll}
+                        onCollapseAll={treeExpandedState.collapseAll}
+                        onConnect={handleHostConnect}
+                        onEditHost={handleEditHost}
+                        onDuplicateHost={handleDuplicateHost}
+                        onDeleteHost={(host) => onDeleteHost(host.id)}
+                        onCopyCredentials={handleCopyCredentials}
+                        onNewHost={(groupPath) => {
+                          setEditingHost(null);
+                          setNewHostGroupPath(groupPath || null);
+                          setIsHostPanelOpen(true);
+                        }}
+                        onNewGroup={(parentPath) => {
+                          setTargetParentPath(parentPath || null);
+                          setNewFolderName("");
+                          setIsNewFolderOpen(true);
+                        }}
+                        onEditGroup={(groupPath) => {
+                          setRenameTargetPath(groupPath);
+                          const groupName = groupPath.split('/').pop() || '';
+                          setRenameGroupName(groupName);
+                          setRenameGroupError(null);
+                          setIsRenameGroupOpen(true);
+                        }}
+                        onDeleteGroup={(groupPath) => {
+                          setDeleteTargetPath(groupPath);
+                          setIsDeleteGroupOpen(true);
+                        }}
+                        moveHostToGroup={moveHostToGroup}
+                        moveGroup={moveGroup}
+                      />
+                    ) : (
+                      <div
+                        className={cn(
+                          viewMode === "grid"
+                            ? "grid gap-3 grid-cols-1 md:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4"
+                            : "flex flex-col gap-0",
+                        )}
+                      >
+                        {displayedHosts.map((host) => {
+                          const safeHost = sanitizeHost(host);
+                          const distroBadge = {
+                            text: (safeHost.os || "L")[0].toUpperCase(),
+                            label: safeHost.distro || safeHost.os || "Linux",
+                          };
+                          return (
+                            <ContextMenu key={host.id}>
+                              <ContextMenuTrigger>
+                                <div
+                                  className={cn(
+                                    "group cursor-pointer",
+                                    viewMode === "grid"
+                                      ? "soft-card elevate rounded-xl h-[68px] px-3 py-2"
+                                      : "h-14 px-3 py-2 hover:bg-secondary/60 rounded-lg transition-colors",
                                   )}
+                                  draggable
+                                  onDragStart={(e) => {
+                                    e.dataTransfer.effectAllowed = "move";
+                                    e.dataTransfer.setData("host-id", host.id);
+                                  }}
+                                  onClick={() => handleHostConnect(safeHost)}
+                                >
+                                  <div className="flex items-center gap-3 h-full">
+                                    <DistroAvatar
+                                      host={safeHost}
+                                      fallback={distroBadge.text}
+                                    />
+                                    <div className="min-w-0 flex flex-col justify-center gap-0.5 flex-1">
+                                      <div className="text-sm font-semibold truncate leading-5">
+                                        {safeHost.label}
+                                      </div>
+                                      <div className="text-[11px] text-muted-foreground font-mono truncate leading-4">
+                                        {safeHost.username}@{safeHost.hostname}
+                                      </div>
+                                    </div>
+                                    {viewMode === "list" && (
+                                      <>
+                                        <Button
+                                          variant="ghost"
+                                          size="icon"
+                                          className="h-8 w-8 opacity-0 group-hover:opacity-100 transition-opacity shrink-0"
+                                          onClick={(e) => {
+                                            e.stopPropagation();
+                                            handleEditHost(host);
+                                          }}
+                                        >
+                                          <Edit2 size={14} />
+                                        </Button>
+                                      </>
+                                    )}
+                                  </div>
                                 </div>
-                              </div>
-                            </ContextMenuTrigger>
-                            <ContextMenuContent>
-                              <ContextMenuItem
-                                onClick={() => handleHostConnect(host)}
-                              >
-                                <Plug className="mr-2 h-4 w-4" /> Connect
-                              </ContextMenuItem>
-                              <ContextMenuItem
-                                onClick={() => handleEditHost(host)}
-                              >
-                                <Edit2 className="mr-2 h-4 w-4" /> Edit
-                              </ContextMenuItem>
-                              <ContextMenuItem
-                                className="text-destructive"
-                                onClick={() => onDeleteHost(host.id)}
-                              >
-                                <Trash2 className="mr-2 h-4 w-4" /> Delete
-                              </ContextMenuItem>
-                            </ContextMenuContent>
-                          </ContextMenu>
-                        );
-                      })}
-                      {displayedHosts.length === 0 && (
-                        <div className="col-span-full flex flex-col items-center justify-center py-24 text-muted-foreground">
-                          <div className="h-16 w-16 rounded-2xl bg-secondary/80 flex items-center justify-center mb-4">
-                            <LayoutGrid size={32} className="opacity-60" />
+                              </ContextMenuTrigger>
+                              <ContextMenuContent>
+                                <ContextMenuItem
+                                  onClick={() => handleHostConnect(host)}
+                                >
+                                  <Plug className="mr-2 h-4 w-4" /> {t('vault.hosts.connect')}
+                                </ContextMenuItem>
+                                <ContextMenuItem
+                                  onClick={() => handleEditHost(host)}
+                                >
+                                  <Edit2 className="mr-2 h-4 w-4" /> {t('action.edit')}
+                                </ContextMenuItem>
+                                <ContextMenuItem
+                                  onClick={() => handleDuplicateHost(host)}
+                                >
+                                  <Copy className="mr-2 h-4 w-4" /> {t('action.duplicate')}
+                                </ContextMenuItem>
+                                <ContextMenuItem
+                                  onClick={() => handleCopyCredentials(host)}
+                                >
+                                  <ClipboardCopy className="mr-2 h-4 w-4" /> {t('vault.hosts.copyCredentials')}
+                                </ContextMenuItem>
+                                <ContextMenuItem
+                                  className="text-destructive"
+                                  onClick={() => onDeleteHost(host.id)}
+                                >
+                                  <Trash2 className="mr-2 h-4 w-4" /> {t('action.delete')}
+                                </ContextMenuItem>
+                              </ContextMenuContent>
+                            </ContextMenu>
+                          );
+                        })}
+                        {displayedHosts.length === 0 && (
+                          <div className="col-span-full flex flex-col items-center justify-center py-24 text-muted-foreground">
+                            <div className="h-16 w-16 rounded-2xl bg-secondary/80 flex items-center justify-center mb-4">
+                              <LayoutGrid size={32} className="opacity-60" />
+                            </div>
+                            <h3 className="text-lg font-semibold text-foreground mb-2">
+                              Set up your hosts
+                            </h3>
+                            <p className="text-sm text-center max-w-sm">
+                              Save hosts to quickly connect to your servers, VMs,
+                              and containers.
+                            </p>
                           </div>
-                          <h3 className="text-lg font-semibold text-foreground mb-2">
-                            Set up your hosts
-                          </h3>
-                          <p className="text-sm text-center max-w-sm">
-                            Save hosts to quickly connect to your servers, VMs,
-                            and containers.
-                          </p>
-                        </div>
-                      )}
-                    </div>
+                        )}
+                      </div>
+                    )}
                   </section>
                 </>
               )}
@@ -1377,19 +1642,23 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
           )}
           allTags={allTags}
           allHosts={hosts}
-          defaultGroup={editingHost ? undefined : selectedGroupPath}
+          defaultGroup={editingHost ? undefined : (newHostGroupPath || selectedGroupPath)}
           onSave={(host) => {
+            // Check if host already exists in the list (for updates vs. new/duplicate)
+            const hostExists = hosts.some((h) => h.id === host.id);
             onUpdateHosts(
-              editingHost
+              hostExists
                 ? hosts.map((h) => (h.id === host.id ? host : h))
                 : [...hosts, host],
             );
             setIsHostPanelOpen(false);
             setEditingHost(null);
+            setNewHostGroupPath(null);
           }}
           onCancel={() => {
             setIsHostPanelOpen(false);
             setEditingHost(null);
+            setNewHostGroupPath(null);
           }}
           onCreateGroup={(groupPath) => {
             onUpdateCustomGroups(
@@ -1516,6 +1785,49 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
         </DialogContent>
       </Dialog>
 
+      <Dialog
+        open={isDeleteGroupOpen}
+        onOpenChange={(open) => {
+          setIsDeleteGroupOpen(open);
+          if (!open) {
+            setDeleteTargetPath(null);
+          }
+        }}
+      >
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>{t("vault.groups.deleteDialogTitle")}</DialogTitle>
+            <DialogDescription>
+              {t("vault.groups.deleteDialog.desc")}
+            </DialogDescription>
+          </DialogHeader>
+          <div className="py-4">
+            {deleteTargetPath && (
+              <p className="text-sm text-muted-foreground">
+                {t("vault.groups.pathLabel")}:{" "}
+                <span className="font-mono">{deleteTargetPath}</span>
+              </p>
+            )}
+          </div>
+          <DialogFooter>
+            <Button variant="ghost" onClick={() => setIsDeleteGroupOpen(false)}>
+              {t("common.cancel")}
+            </Button>
+            <Button 
+              variant="destructive" 
+              onClick={() => {
+                if (deleteTargetPath) {
+                  deleteGroupPath(deleteTargetPath);
+                }
+                setIsDeleteGroupOpen(false);
+              }}
+            >
+              {t("common.delete")}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+
       <ImportVaultDialog
         open={isImportOpen}
         onOpenChange={setIsImportOpen}

components/sftp-modal/SftpModalFileList.tsx

@@ -23,7 +23,6 @@ interface SftpModalFileListProps {
   loading: boolean;
   loadingTextContent: boolean;
   reconnecting: boolean;
-  resolvedLocale: string | undefined;
   columnWidths: { name: number; size: number; modified: number; actions: number };
   sortField: "name" | "size" | "modified";
   sortOrder: "asc" | "desc";
@@ -53,7 +52,7 @@ interface SftpModalFileListProps {
   handleDeleteSelected: () => void;
   loadFiles: (path: string, options?: { force?: boolean }) => void;
   formatBytes: (bytes: number | string) => string;
-  formatDate: (dateStr: string | number | undefined, locale?: string) => string;
+  formatDate: (dateStr: string | number | undefined) => string;
 }
 
 export const SftpModalFileList: React.FC<SftpModalFileListProps> = ({
@@ -66,7 +65,6 @@ export const SftpModalFileList: React.FC<SftpModalFileListProps> = ({
   loading,
   loadingTextContent,
   reconnecting,
-  resolvedLocale,
   columnWidths,
   sortField,
   sortOrder,
@@ -279,7 +277,7 @@ export const SftpModalFileList: React.FC<SftpModalFileListProps> = ({
                         {isNavigableDirectory ? "--" : formatBytes(file.size)}
                       </div>
                       <div className="text-xs text-muted-foreground truncate">
-                        {formatDate(file.lastModified, resolvedLocale)}
+                        {formatDate(file.lastModified)}
                       </div>
                       <div className="flex items-center justify-end gap-1">
                         {isDownloadableFile && (

components/sftp-modal/hooks/useSftpModalTransfers.ts

@@ -49,6 +49,22 @@ interface UseSftpModalTransfersParams {
   mkdirLocal: (path: string) => Promise<void>;
   mkdirSftp: (sftpId: string, path: string) => Promise<void>;
   cancelSftpUpload?: (taskId: string) => Promise<unknown>;
+  startStreamTransfer?: (
+    options: {
+      transferId: string;
+      sourcePath: string;
+      targetPath: string;
+      sourceType: 'local' | 'sftp';
+      targetType: 'local' | 'sftp';
+      sourceSftpId?: string;
+      targetSftpId?: string;
+      totalBytes?: number;
+    },
+    onProgress?: (transferred: number, total: number, speed: number) => void,
+    onComplete?: () => void,
+    onError?: (error: string) => void
+  ) => Promise<{ transferId: string; totalBytes?: number; error?: string }>;
+  cancelTransfer?: (transferId: string) => Promise<void>;
   setLoading: (loading: boolean) => void;
   t: (key: string, params?: Record<string, unknown>) => string;
 }
@@ -81,6 +97,8 @@ export const useSftpModalTransfers = ({
   mkdirLocal,
   mkdirSftp,
   cancelSftpUpload,
+  startStreamTransfer,
+  cancelTransfer,
   setLoading,
   t,
 }: UseSftpModalTransfersParams): UseSftpModalTransfersResult => {
@@ -174,8 +192,35 @@ export const useSftpModalTransfers = ({
         }
       },
       cancelSftpUpload,
+      startStreamTransfer: startStreamTransfer ? async (
+        options,
+        onProgress,
+        onComplete,
+        onError
+      ) => {
+        try {
+          const result = await startStreamTransfer(options, onProgress, onComplete, onError);
+          const wasCancelled = cancelledTransferIdsRef.current.has(options.transferId);
+          if (wasCancelled) {
+            cancelledTransferIdsRef.current.delete(options.transferId);
+          }
+          // Handle case where result might be undefined (bridge not available)
+          if (!result) {
+            return { transferId: options.transferId, error: 'Stream transfer not available' };
+          }
+          return { ...result, cancelled: wasCancelled };
+        } catch (error) {
+          const wasCancelled = cancelledTransferIdsRef.current.has(options.transferId);
+          if (wasCancelled) {
+            cancelledTransferIdsRef.current.delete(options.transferId);
+            return { transferId: options.transferId, cancelled: true };
+          }
+          return { transferId: options.transferId, error: error instanceof Error ? error.message : String(error) };
+        }
+      } : undefined,
+      cancelTransfer,
     };
-  }, [writeLocalFile, mkdirLocal, mkdirSftp, writeSftpBinary, writeSftpBinaryWithProgress, cancelSftpUpload]);
+  }, [writeLocalFile, mkdirLocal, mkdirSftp, writeSftpBinary, writeSftpBinaryWithProgress, cancelSftpUpload, startStreamTransfer, cancelTransfer]);
 
   // Create upload callbacks
   const createUploadCallbacks = useCallback((): UploadCallbacks => {
@@ -290,6 +335,11 @@ export const useSftpModalTransfers = ({
 
   const handleUploadMultiple = useCallback(
     async (fileList: FileList) => {
+      console.log('[useSftpModalTransfers] handleUploadMultiple called', {
+        length: fileList.length,
+        currentPath,
+        isLocalSession
+      });
       if (fileList.length === 0) return;
 
       setUploading(true);
@@ -392,14 +442,85 @@ export const useSftpModalTransfers = ({
     [currentPath, createUploadBridge, createUploadCallbacks, ensureSftp, isLocalSession, joinPath, loadFiles, t],
   );
 
+  // Handle upload from File array (used by file input after copying files)
+  const handleUploadFromFiles = useCallback(
+    async (files: File[]) => {
+      console.log('[useSftpModalTransfers] handleUploadFromFiles called', {
+        length: files.length,
+        currentPath,
+        isLocalSession
+      });
+      if (files.length === 0) return;
+
+      setUploading(true);
+
+      // Get SFTP ID for remote sessions
+      let sftpId: string | null = null;
+      if (!isLocalSession) {
+        sftpId = await ensureSftp();
+        cachedSftpIdRef.current = sftpId;
+      }
+
+      // Create controller for cancellation
+      const controller = new UploadController();
+      uploadControllerRef.current = controller;
+
+      const callbacks = createUploadCallbacks();
+
+      try {
+        await uploadFromFileList(
+          files,
+          {
+            targetPath: currentPath,
+            sftpId,
+            isLocal: isLocalSession,
+            bridge: createUploadBridge,
+            joinPath,
+            callbacks,
+          },
+          controller
+        );
+
+        await loadFiles(currentPath, { force: true });
+
+        // Auto-clear completed tasks after 3 seconds
+        setTimeout(() => {
+          setUploadTasks(prev => prev.filter(t => t.status !== "completed"));
+        }, 3000);
+      } catch (error) {
+        toast.error(
+          error instanceof Error ? error.message : t("sftp.error.uploadFailed"),
+          "SFTP"
+        );
+      } finally {
+        setUploading(false);
+        uploadControllerRef.current = null;
+        cachedSftpIdRef.current = null;
+      }
+    },
+    [currentPath, createUploadBridge, createUploadCallbacks, ensureSftp, isLocalSession, joinPath, loadFiles, t],
+  );
+
   const handleFileSelect = useCallback(
     (e: React.ChangeEvent<HTMLInputElement>) => {
+      console.log('[useSftpModalTransfers] handleFileSelect called', {
+        files: e.target.files,
+        length: e.target.files?.length
+      });
       if (e.target.files && e.target.files.length > 0) {
-        void handleUploadMultiple(e.target.files);
+        console.log('[useSftpModalTransfers] Starting upload for', e.target.files.length, 'files');
+        // Copy the files before clearing the input, because clearing the input
+        // will also clear the FileList reference
+        const files = Array.from(e.target.files);
+        // Clear input first to allow selecting the same file again
+        e.target.value = "";
+        // Now start the upload with the copied files
+        void handleUploadFromFiles(files);
+      } else {
+        e.target.value = "";
       }
-      e.target.value = "";
     },
-    [handleUploadMultiple],
+    [handleUploadFromFiles],
   );
 
   const handleDrag = useCallback((e: React.DragEvent) => {
@@ -425,14 +546,19 @@ export const useSftpModalTransfers = ({
   );
 
   const cancelUpload = useCallback(async () => {
+    console.log('[useSftpModalTransfers] cancelUpload called');
     const controller = uploadControllerRef.current;
     if (controller) {
       // Mark all active transfer IDs as cancelled before calling cancel
       const activeIds = controller.getActiveTransferIds();
+      console.log('[useSftpModalTransfers] Active transfer IDs:', activeIds);
       for (const id of activeIds) {
         cancelledTransferIdsRef.current.add(id);
       }
       await controller.cancel();
+      console.log('[useSftpModalTransfers] controller.cancel() completed');
+    } else {
+      console.log('[useSftpModalTransfers] No controller found');
     }
 
     // Always clear all uploading/pending tasks immediately, even without controller

components/sftp-modal/utils.ts

@@ -7,9 +7,10 @@ export const formatBytes = (bytes: number | string): string => {
   return `${size.toFixed(i === 0 ? 0 : 1)} ${units[i]}`;
 };
 
-export const formatDate = (dateStr: string | number | undefined, locale?: string): string => {
+export const formatDate = (dateStr: string | number | undefined): string => {
   if (!dateStr) return "--";
   const date = typeof dateStr === "number" ? new Date(dateStr) : new Date(dateStr);
   if (isNaN(date.getTime())) return String(dateStr);
-  return date.toLocaleString(locale || undefined);
+  const pad = (value: number) => value.toString().padStart(2, "0");
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
 };

components/sftp/utils.ts

@@ -48,14 +48,14 @@ export const formatTransferBytes = (bytes: number): string => {
 };
 
 /**
- * Format date as YYYY-MM-DD HH:mm:ss in local timezone
+ * Format date as YYYY-MM-DD hh:mm in local timezone
  */
 export const formatDate = (timestamp: number | undefined): string => {
     if (!timestamp) return '--';
     const date = new Date(timestamp);
     if (isNaN(date.getTime())) return '--';
     const pad = (n: number) => n.toString().padStart(2, '0');
-    return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
+    return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
 };
 
 /**

components/terminal/TerminalContextMenu.tsx

@@ -12,7 +12,7 @@ import {
 } from 'lucide-react';
 import React, { useCallback } from 'react';
 import { useI18n } from '../../application/i18n/I18nProvider';
-import { RightClickBehavior } from '../../domain/models';
+import { KeyBinding, RightClickBehavior } from '../../domain/models';
 import {
   ContextMenu,
   ContextMenuContent,
@@ -26,6 +26,7 @@ export interface TerminalContextMenuProps {
   children: React.ReactNode;
   hasSelection?: boolean;
   hotkeyScheme?: 'disabled' | 'mac' | 'pc';
+  keyBindings?: KeyBinding[];
   rightClickBehavior?: RightClickBehavior;
   onCopy?: () => void;
   onPaste?: () => void;
@@ -41,6 +42,7 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
   children,
   hasSelection = false,
   hotkeyScheme = 'mac',
+  keyBindings,
   rightClickBehavior = 'context-menu',
   onCopy,
   onPaste,
@@ -54,12 +56,24 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
   const { t } = useI18n();
   const isMac = hotkeyScheme === 'mac';
 
-  const copyShortcut = isMac ? '⌘C' : 'Ctrl+Shift+C';
-  const pasteShortcut = isMac ? '⌘V' : 'Ctrl+Shift+V';
-  const selectAllShortcut = isMac ? '⌘A' : 'Ctrl+Shift+A';
-  const splitHShortcut = isMac ? '⌘D' : 'Ctrl+Shift+D';
-  const splitVShortcut = isMac ? '⌘E' : 'Ctrl+Shift+E';
-  const clearShortcut = isMac ? '⌘K' : 'Ctrl+L';
+  // Helper to get shortcut from keyBindings and format for display
+  const getShortcut = (bindingId: string): string => {
+    const binding = keyBindings?.find(b => b.id === bindingId);
+    if (!binding) return '';
+    const key = isMac ? binding.mac : binding.pc;
+    if (!key || key === 'Disabled') return '';
+    // Replace " + " with space for cleaner display (e.g., "⌘ + Shift + D" → "⌘ Shift D")
+    return key.replace(/\s*\+\s*/g, ' ').trim();
+  };
+
+  const copyShortcut = getShortcut('copy');
+  const pasteShortcut = getShortcut('paste');
+  const selectAllShortcut = getShortcut('select-all');
+  const splitHShortcut = getShortcut('split-horizontal');
+  const splitVShortcut = getShortcut('split-vertical');
+  const clearShortcut = getShortcut('clear-buffer');
+
+  const showContextMenu = rightClickBehavior === 'context-menu';
 
   const handleRightClick = useCallback(
     (e: React.MouseEvent) => {
@@ -76,71 +90,72 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
     [rightClickBehavior, onPaste, onSelectWord],
   );
 
-  if (rightClickBehavior !== 'context-menu') {
-    return (
-      <div onContextMenu={handleRightClick} className="contents">
-        {children}
-      </div>
-    );
-  }
-
+  // Always use ContextMenu wrapper to maintain consistent React tree structure
+  // This prevents terminal from unmounting when rightClickBehavior changes
   return (
     <ContextMenu>
-      <ContextMenuTrigger asChild>{children}</ContextMenuTrigger>
-      <ContextMenuContent className="w-56">
-        <ContextMenuItem onClick={onCopy} disabled={!hasSelection}>
-          <Copy size={14} className="mr-2" />
-          {t('terminal.menu.copy')}
-          <ContextMenuShortcut>{copyShortcut}</ContextMenuShortcut>
-        </ContextMenuItem>
-        <ContextMenuItem onClick={onPaste}>
-          <ClipboardPaste size={14} className="mr-2" />
-          {t('terminal.menu.paste')}
-          <ContextMenuShortcut>{pasteShortcut}</ContextMenuShortcut>
-        </ContextMenuItem>
-        <ContextMenuItem onClick={onSelectAll}>
-          <TerminalIcon size={14} className="mr-2" />
-          {t('terminal.menu.selectAll')}
-          <ContextMenuShortcut>{selectAllShortcut}</ContextMenuShortcut>
-        </ContextMenuItem>
+      <ContextMenuTrigger
+        asChild
+        disabled={!showContextMenu}
+        onContextMenu={!showContextMenu ? handleRightClick : undefined}
+      >
+        {children}
+      </ContextMenuTrigger>
+      {showContextMenu && (
+        <ContextMenuContent className="w-56">
+          <ContextMenuItem onClick={onCopy} disabled={!hasSelection}>
+            <Copy size={14} className="mr-2" />
+            {t('terminal.menu.copy')}
+            <ContextMenuShortcut>{copyShortcut}</ContextMenuShortcut>
+          </ContextMenuItem>
+          <ContextMenuItem onClick={onPaste}>
+            <ClipboardPaste size={14} className="mr-2" />
+            {t('terminal.menu.paste')}
+            <ContextMenuShortcut>{pasteShortcut}</ContextMenuShortcut>
+          </ContextMenuItem>
+          <ContextMenuItem onClick={onSelectAll}>
+            <TerminalIcon size={14} className="mr-2" />
+            {t('terminal.menu.selectAll')}
+            <ContextMenuShortcut>{selectAllShortcut}</ContextMenuShortcut>
+          </ContextMenuItem>
 
-        <ContextMenuSeparator />
+          <ContextMenuSeparator />
 
-        <ContextMenuItem onClick={onSplitVertical}>
-          <SplitSquareHorizontal size={14} className="mr-2" />
-          {t('terminal.menu.splitHorizontal')}
-          <ContextMenuShortcut>{splitVShortcut}</ContextMenuShortcut>
-        </ContextMenuItem>
-        <ContextMenuItem onClick={onSplitHorizontal}>
-          <SplitSquareVertical size={14} className="mr-2" />
-          {t('terminal.menu.splitVertical')}
-          <ContextMenuShortcut>{splitHShortcut}</ContextMenuShortcut>
-        </ContextMenuItem>
+          <ContextMenuItem onClick={onSplitVertical}>
+            <SplitSquareHorizontal size={14} className="mr-2" />
+            {t('terminal.menu.splitHorizontal')}
+            <ContextMenuShortcut>{splitVShortcut}</ContextMenuShortcut>
+          </ContextMenuItem>
+          <ContextMenuItem onClick={onSplitHorizontal}>
+            <SplitSquareVertical size={14} className="mr-2" />
+            {t('terminal.menu.splitVertical')}
+            <ContextMenuShortcut>{splitHShortcut}</ContextMenuShortcut>
+          </ContextMenuItem>
 
-        <ContextMenuSeparator />
+          <ContextMenuSeparator />
 
-        <ContextMenuItem onClick={onClear}>
-          <Trash2 size={14} className="mr-2" />
-          {t('terminal.menu.clearBuffer')}
-          <ContextMenuShortcut>{clearShortcut}</ContextMenuShortcut>
-        </ContextMenuItem>
+          <ContextMenuItem onClick={onClear}>
+            <Trash2 size={14} className="mr-2" />
+            {t('terminal.menu.clearBuffer')}
+            <ContextMenuShortcut>{clearShortcut}</ContextMenuShortcut>
+          </ContextMenuItem>
 
-        {onClose && (
-          <>
-            <ContextMenuSeparator />
-            <ContextMenuItem
-              onClick={onClose}
-              className="text-destructive focus:text-destructive"
-            >
-              <Trash2 size={14} className="mr-2" />
-              {t('terminal.menu.closeTerminal')}
-            </ContextMenuItem>
-          </>
-        )}
-      </ContextMenuContent>
+          {onClose && (
+            <>
+              <ContextMenuSeparator />
+              <ContextMenuItem
+                onClick={onClose}
+                className="text-destructive focus:text-destructive"
+              >
+                <Trash2 size={14} className="mr-2" />
+                {t('terminal.menu.closeTerminal')}
+              </ContextMenuItem>
+            </>
+          )}
+        </ContextMenuContent>
+      )}
     </ContextMenu>
   );
 };
 
 export default TerminalContextMenu;
-

domain/models.ts

@@ -65,6 +65,7 @@ export interface Host {
   identityFileId?: string; // Reference to SSHKey
   protocol?: 'ssh' | 'telnet' | 'local' | 'serial'; // Default/primary protocol
   password?: string;
+  savePassword?: boolean; // Whether to save the password (default: true)
   authMethod?: 'password' | 'key' | 'certificate';
   agentForwarding?: boolean;
   createdAt?: number; // Timestamp when host was created
@@ -308,7 +309,7 @@ export const DEFAULT_KEY_BINDINGS: KeyBinding[] = [
   { id: 'copy', action: 'copy', label: 'Copy from Terminal', mac: '⌘ + C', pc: 'Ctrl + Shift + C', category: 'terminal' },
   { id: 'paste', action: 'paste', label: 'Paste to Terminal', mac: '⌘ + V', pc: 'Ctrl + Shift + V', category: 'terminal' },
   { id: 'select-all', action: 'selectAll', label: 'Select All in Terminal', mac: '⌘ + A', pc: 'Ctrl + Shift + A', category: 'terminal' },
-  { id: 'clear-buffer', action: 'clearBuffer', label: 'Clear Terminal Buffer', mac: '⌘ + K', pc: 'Ctrl + L', category: 'terminal' },
+  { id: 'clear-buffer', action: 'clearBuffer', label: 'Clear Terminal Buffer', mac: '⌘ + ⌃ + K', pc: 'Ctrl + Shift + K', category: 'terminal' },
   { id: 'search-terminal', action: 'searchTerminal', label: 'Open Terminal Search', mac: '⌘ + F', pc: 'Ctrl + Shift + F', category: 'terminal' },
 
   // Navigation / Split View
@@ -319,11 +320,11 @@ export const DEFAULT_KEY_BINDINGS: KeyBinding[] = [
   // App Features
   { id: 'open-hosts', action: 'openHosts', label: 'Open Hosts Page', mac: 'Disabled', pc: 'Disabled', category: 'app' },
   { id: 'open-local', action: 'openLocal', label: 'Open Local Terminal', mac: '⌘ + L', pc: 'Ctrl + L', category: 'app' },
-  { id: 'open-sftp', action: 'openSftp', label: 'Open SFTP', mac: '⌘ + Shift + S', pc: 'Ctrl + Shift + S', category: 'app' },
+  { id: 'open-sftp', action: 'openSftp', label: 'Open SFTP', mac: '⌘ + Shift + O', pc: 'Ctrl + Shift + O', category: 'app' },
   { id: 'port-forwarding', action: 'portForwarding', label: 'Open Port Forwarding', mac: '⌘ + P', pc: 'Ctrl + P', category: 'app' },
   { id: 'command-palette', action: 'commandPalette', label: 'Open Command Palette', mac: '⌘ + K', pc: 'Ctrl + K', category: 'app' },
   { id: 'quick-switch', action: 'quickSwitch', label: 'Quick Switch', mac: '⌘ + J', pc: 'Ctrl + J', category: 'app' },
-  { id: 'snippets', action: 'snippets', label: 'Open Snippets', mac: '⌘ + Shift + S', pc: 'Ctrl + Alt + S', category: 'app' },
+  { id: 'snippets', action: 'snippets', label: 'Open Snippets', mac: '⌘ + Shift + S', pc: 'Ctrl + Shift + S', category: 'app' },
   { id: 'broadcast', action: 'broadcast', label: 'Switch the Broadcast Mode', mac: '⌘ + B', pc: 'Ctrl + B', category: 'app' },
 ];
 

domain/vaultImport.ts

@@ -998,3 +998,77 @@ export const getVaultCsvTemplate = (
   return rows.map((r) => r.map((c) => escapeCsv(c)).join(",")).join("\r\n") + "\r\n";
 };
 
+export const exportHostsToCsv = (hosts: Host[]): string => {
+  const header = ["Groups", "Label", "Tags", "Hostname/IP", "Protocol", "Port", "Username"];
+  const rows: string[][] = [header];
+
+  const escapeCsv = (value: string) => {
+    // Prevent CSV formula injection by prefixing dangerous characters with a single quote
+    // These characters can be interpreted as formulas by spreadsheet applications
+    if (/^[=+\-@\t\r]/.test(value)) {
+      value = "'" + value;
+    }
+    if (value.includes('"')) value = value.replace(/"/g, '""');
+    if (/[",\r\n]/.test(value)) return `"${value}"`;
+    return value;
+  };
+
+  // Filter out serial hosts - CSV format doesn't support serial port configuration
+  // Note: mosh-enabled hosts are exported as SSH (losing mosh flag) rather than being skipped,
+  // since exporting partial data is better than losing the entire host entry
+  const isUnsupported = (h: Host) => h.protocol === "serial";
+  const exportableHosts = hosts.filter((h) => !isUnsupported(h));
+
+  // Helper to bracket IPv6 addresses for CSV export
+  // IPv6 addresses contain colons which would be misinterpreted as port separators on import
+  const formatHostname = (hostname: string): string => {
+    // Check if it looks like an IPv6 address (contains colons but not already bracketed)
+    if (hostname.includes(":") && !hostname.startsWith("[")) {
+      return `[${hostname}]`;
+    }
+    return hostname;
+  };
+
+  for (const host of exportableHosts) {
+    // For telnet hosts, use telnet-specific port and username
+    const isTelnet = host.protocol === "telnet";
+    const effectivePort = isTelnet
+      ? (host.telnetPort ?? host.port ?? 23)
+      : (host.port ?? 22);
+    const effectiveUsername = isTelnet
+      ? (host.telnetUsername ?? host.username ?? "")
+      : (host.username ?? "");
+
+    rows.push([
+      host.group ?? "",
+      host.label ?? "",
+      (host.tags ?? []).join(","),
+      formatHostname(host.hostname),
+      host.protocol ?? "ssh",
+      String(effectivePort),
+      effectiveUsername,
+    ]);
+  }
+
+  return rows.map((r) => r.map((c) => escapeCsv(c)).join(",")).join("\r\n") + "\r\n";
+};
+
+export interface ExportHostsResult {
+  csv: string;
+  exportedCount: number;
+  skippedCount: number;
+}
+
+export const exportHostsToCsvWithStats = (hosts: Host[]): ExportHostsResult => {
+  // Only serial hosts are truly unsupported - mosh hosts are exported as SSH
+  const isUnsupported = (h: Host) => h.protocol === "serial";
+  const skippedHosts = hosts.filter((h) => isUnsupported(h));
+  const exportableHosts = hosts.filter((h) => !isUnsupported(h));
+
+  return {
+    csv: exportHostsToCsv(hosts),
+    exportedCount: exportableHosts.length,
+    skippedCount: skippedHosts.length,
+  };
+};
+

electron-builder.config.cjs

@@ -73,11 +73,7 @@ module.exports = {
         target: [
             {
                 target: 'nsis',
-                arch: ['x64']
-            },
-            {
-                target: 'dir',
-                arch: ['x64']
+                arch: ['x64', 'arm64']
             }
         ]
     },

electron/bridges/localFsBridge.cjs

@@ -6,19 +6,23 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const os = require("node:os");
-const { execSync } = require("node:child_process");
+const { exec } = require("node:child_process");
+const { promisify } = require("node:util");
+
+const execAsync = promisify(exec);
 
 /**
  * Check if a file is hidden on Windows using the attrib command
  * Returns true if the file has the hidden attribute set
+ * Uses async exec to avoid blocking the main process
  */
-function isWindowsHiddenFile(filePath) {
+async function isWindowsHiddenFile(filePath) {
   if (process.platform !== "win32") return false;
   try {
-    const output = execSync(`attrib "${filePath}"`, { encoding: "utf8" });
+    const { stdout } = await execAsync(`attrib "${filePath}"`);
     // attrib output format: "     H  R  filename" where H = hidden, R = read-only, etc.
     // The attributes appear in the first ~10 characters before the path
-    const attrPart = output.substring(0, output.indexOf(filePath)).toUpperCase();
+    const attrPart = stdout.substring(0, stdout.indexOf(filePath)).toUpperCase();
     return attrPart.includes("H");
   } catch (err) {
     console.warn(`Could not check hidden attribute for ${filePath}:`, err.message);
@@ -67,7 +71,7 @@ async function listLocalDir(event, payload) {
         }
         
         // Check for Windows hidden attribute
-        const hidden = isWindows ? isWindowsHiddenFile(fullPath) : false;
+        const hidden = isWindows ? await isWindowsHiddenFile(fullPath) : false;
         
         result[i] = {
           name: entry.name,
@@ -86,7 +90,7 @@ async function listLocalDir(event, payload) {
             const lstat = await fs.promises.lstat(fullPath);
             if (lstat.isSymbolicLink()) {
               // Broken symlink
-              const hidden = isWindows ? isWindowsHiddenFile(fullPath) : false;
+              const hidden = isWindows ? await isWindowsHiddenFile(fullPath) : false;
               result[i] = {
                 name: brokenEntry.name,
                 type: "symlink",

electron/bridges/passphraseHandler.cjs

@@ -0,0 +1,141 @@
+/**
+ * Passphrase Handler - Handles passphrase requests for encrypted SSH keys
+ * This module provides a mechanism to request passphrase input from the user
+ * when encountering encrypted default SSH keys in ~/.ssh
+ */
+
+// Passphrase request pending map
+// Map of requestId -> { resolveCallback, rejectCallback, webContentsId, keyPath, createdAt, timeoutId }
+const passphraseRequests = new Map();
+
+// TTL for abandoned requests (2 minutes)
+const REQUEST_TTL_MS = 2 * 60 * 1000;
+
+/**
+ * Generate a unique request ID for passphrase requests
+ */
+function generateRequestId(prefix = 'pp') {
+  return `${prefix}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+}
+
+/**
+ * Request passphrase from user via IPC
+ * @param {Object} sender - Electron webContents sender
+ * @param {string} keyPath - Path to the encrypted key
+ * @param {string} keyName - Name of the key (e.g., id_rsa)
+ * @param {string} [hostname] - Optional hostname for context
+ * @returns {Promise<{ passphrase?: string, cancelled?: boolean, skipped?: boolean } | null>}
+ */
+function requestPassphrase(sender, keyPath, keyName, hostname) {
+  return new Promise((resolve) => {
+    if (!sender || sender.isDestroyed()) {
+      console.warn('[Passphrase] Sender is destroyed, cannot request passphrase');
+      resolve(null);
+      return;
+    }
+    
+    const requestId = generateRequestId();
+    
+    // Set up TTL timeout to clean up abandoned requests
+    const timeoutId = setTimeout(() => {
+      const pending = passphraseRequests.get(requestId);
+      if (pending) {
+        console.warn(`[Passphrase] Request ${requestId} timed out after ${REQUEST_TTL_MS / 1000}s`);
+        passphraseRequests.delete(requestId);
+        
+        // Notify renderer to close the modal
+        try {
+          if (!sender.isDestroyed()) {
+            sender.send('netcatty:passphrase-timeout', { requestId });
+          }
+        } catch (err) {
+          console.warn('[Passphrase] Failed to send timeout notification:', err.message);
+        }
+        
+        resolve(null);
+      }
+    }, REQUEST_TTL_MS);
+    
+    passphraseRequests.set(requestId, {
+      resolveCallback: resolve,
+      webContentsId: sender.id,
+      keyPath,
+      keyName,
+      createdAt: Date.now(),
+      timeoutId,
+    });
+    
+    console.log(`[Passphrase] Requesting passphrase for ${keyName} (${requestId})`);
+    
+    try {
+      sender.send('netcatty:passphrase-request', {
+        requestId,
+        keyPath,
+        keyName,
+        hostname,
+      });
+    } catch (err) {
+      console.error('[Passphrase] Failed to send passphrase request:', err);
+      passphraseRequests.delete(requestId);
+      clearTimeout(timeoutId);
+      resolve(null);
+    }
+  });
+}
+
+/**
+ * Handle passphrase response from renderer
+ */
+function handleResponse(_event, payload) {
+  const { requestId, passphrase, cancelled, skipped } = payload;
+  const pending = passphraseRequests.get(requestId);
+  
+  if (!pending) {
+    console.warn(`[Passphrase] No pending request for ${requestId}`);
+    return { success: false, error: 'Request not found' };
+  }
+  
+  // Clear the TTL timeout
+  if (pending.timeoutId) {
+    clearTimeout(pending.timeoutId);
+  }
+  
+  passphraseRequests.delete(requestId);
+  
+  if (cancelled) {
+    // User clicked Cancel - stop the entire passphrase flow
+    console.log(`[Passphrase] Request ${requestId} cancelled by user`);
+    pending.resolveCallback({ cancelled: true });
+  } else if (skipped) {
+    // User clicked Skip - skip this key but continue with others
+    console.log(`[Passphrase] Request ${requestId} skipped by user`);
+    pending.resolveCallback({ skipped: true });
+  } else {
+    console.log(`[Passphrase] Received passphrase for ${requestId}`);
+    pending.resolveCallback({ passphrase: passphrase || null });
+  }
+  
+  return { success: true };
+}
+
+/**
+ * Register IPC handler for passphrase responses
+ */
+function registerHandler(ipcMain) {
+  ipcMain.handle('netcatty:passphrase:respond', handleResponse);
+}
+
+/**
+ * Get pending requests (for debugging)
+ */
+function getRequests() {
+  return passphraseRequests;
+}
+
+module.exports = {
+  generateRequestId,
+  requestPassphrase,
+  handleResponse,
+  registerHandler,
+  getRequests,
+};

electron/bridges/portForwardingBridge.cjs

@@ -6,6 +6,11 @@
 const net = require("node:net");
 const { Client: SSHClient } = require("ssh2");
 const keyboardInteractiveHandler = require("./keyboardInteractiveHandler.cjs");
+const { 
+  buildAuthHandler, 
+  createKeyboardInteractiveHandler, 
+  applyAuthToConnOpts,
+} = require("./sshAuthHelper.cjs");
 
 // Active port forwarding tunnels
 const portForwardingTunnels = new Map();
@@ -38,6 +43,7 @@ async function startPortForward(event, payload) {
     username,
     password,
     privateKey,
+    passphrase,
   } = payload;
 
   return new Promise((resolve, reject) => {
@@ -63,59 +69,31 @@ async function startPortForward(event, payload) {
     if (privateKey) {
       connectOpts.privateKey = privateKey;
     }
+    if (passphrase) {
+      connectOpts.passphrase = passphrase;
+    }
     if (password) {
       connectOpts.password = password;
     }
 
-    // Build auth handler with keyboard-interactive support
-    const authMethods = [];
-    if (privateKey) authMethods.push("publickey");
-    if (password) authMethods.push("password");
-    authMethods.push("keyboard-interactive");
-    connectOpts.authHandler = authMethods;
+    // Build auth handler using shared helper
+    const authConfig = buildAuthHandler({
+      privateKey,
+      password,
+      passphrase,
+      username: connectOpts.username,
+      logPrefix: "[PortForward]",
+    });
+    applyAuthToConnOpts(connectOpts, authConfig);
 
     // Handle keyboard-interactive authentication (2FA/MFA)
-    conn.on("keyboard-interactive", (name, instructions, instructionsLang, prompts, finish) => {
-      console.log(`[PortForward] ${hostname} keyboard-interactive auth requested`, {
-        name,
-        instructions,
-        promptCount: prompts?.length || 0,
-        prompts: prompts?.map(p => ({ prompt: p.prompt, echo: p.echo })),
-      });
-
-      // If there are no prompts, just call finish with empty array
-      if (!prompts || prompts.length === 0) {
-        console.log(`[PortForward] No prompts, finishing keyboard-interactive`);
-        finish([]);
-        return;
-      }
-
-      // Forward ALL prompts to user - no auto-fill to avoid semantic detection issues
-      // (Prompt text is admin-customizable and may not contain expected keywords)
-      const requestId = keyboardInteractiveHandler.generateRequestId('pf');
-
-      keyboardInteractiveHandler.storeRequest(requestId, (userResponses) => {
-        console.log(`[PortForward] Received user responses, finishing keyboard-interactive`);
-        finish(userResponses);
-      }, sender.id, tunnelId);
-
-      const promptsData = prompts.map((p) => ({
-        prompt: p.prompt,
-        echo: p.echo,
-      }));
-
-      console.log(`[PortForward] Showing modal for ${promptsData.length} prompts`);
-
-      safeSend(sender, "netcatty:keyboard-interactive", {
-        requestId,
-        sessionId: tunnelId,
-        name: name || "",
-        instructions: instructions || "",
-        prompts: promptsData,
-        hostname: hostname,
-        savedPassword: password || null,
-      });
-    });
+    conn.on("keyboard-interactive", createKeyboardInteractiveHandler({
+      sender,
+      sessionId: tunnelId,
+      hostname,
+      password,
+      logPrefix: "[PortForward]",
+    }));
 
 
     conn.on('ready', () => {

electron/bridges/sftpBridge.cjs

@@ -23,6 +23,12 @@ const { NetcattyAgent } = require("./netcattyAgent.cjs");
 const fileWatcherBridge = require("./fileWatcherBridge.cjs");
 const keyboardInteractiveHandler = require("./keyboardInteractiveHandler.cjs");
 const { createProxySocket } = require("./proxyUtils.cjs");
+const { 
+  buildAuthHandler, 
+  createKeyboardInteractiveHandler, 
+  applyAuthToConnOpts,
+  safeSend: authSafeSend,
+} = require("./sshAuthHelper.cjs");
 
 // SFTP clients storage - shared reference passed from main
 let sftpClients = null;
@@ -258,7 +264,8 @@ function init(deps) {
 /**
  * Connect through a chain of jump hosts for SFTP
  */
-async function connectThroughChainForSftp(event, options, jumpHosts, targetHost, targetPort) {
+async function connectThroughChainForSftp(event, options, jumpHosts, targetHost, targetPort, connId) {
+  const sender = event.sender;
   const connections = [];
   let currentSocket = null;
 
@@ -282,7 +289,7 @@ async function connectThroughChainForSftp(event, options, jumpHosts, targetHost,
         host: jump.hostname,
         port: jump.port || 22,
         username: jump.username || 'root',
-        readyTimeout: 20000,
+        readyTimeout: 120000, // 2 minutes to allow for keyboard-interactive (2FA/MFA)
         keepaliveInterval: 10000,
         keepaliveCountMax: 3,
         // Enable keyboard-interactive authentication (required for 2FA/MFA)
@@ -318,11 +325,18 @@ async function connectThroughChainForSftp(event, options, jumpHosts, targetHost,
 
       if (jump.password) connOpts.password = jump.password;
 
-      if (authAgent) {
-        const order = ["agent"];
-        if (connOpts.password) order.push("password");
-        connOpts.authHandler = order;
-      }
+      // Build auth handler using shared helper
+      // Pass unlocked encrypted keys from options so jump hosts can use them for retry
+      const authConfig = buildAuthHandler({
+        privateKey: connOpts.privateKey,
+        password: connOpts.password,
+        passphrase: connOpts.passphrase,
+        agent: connOpts.agent,
+        username: connOpts.username,
+        logPrefix: `[SFTP Chain] Hop ${i + 1}`,
+        unlockedEncryptedKeys: options._unlockedEncryptedKeys || [],
+      });
+      applyAuthToConnOpts(connOpts, authConfig);
 
       // If first hop and proxy is configured, connect through proxy
       if (isFirst && options.proxy) {
@@ -351,6 +365,14 @@ async function connectThroughChainForSftp(event, options, jumpHosts, targetHost,
           console.error(`[SFTP Chain] Hop ${i + 1}/${jumpHosts.length}: ${hopLabel} timeout`);
           reject(new Error(`Connection timeout to ${hopLabel}`));
         });
+        // Handle keyboard-interactive authentication for jump hosts (2FA/MFA)
+        conn.on('keyboard-interactive', createKeyboardInteractiveHandler({
+          sender,
+          sessionId: connId,
+          hostname: hopLabel,
+          password: jump.password,
+          logPrefix: `[SFTP Chain] Hop ${i + 1}/${jumpHosts.length}`,
+        }));
         conn.connect(connOpts);
       });
 
@@ -648,7 +670,8 @@ async function openSftp(event, options) {
       options,
       jumpHosts,
       options.hostname,
-      options.port || 22
+      options.port || 22,
+      connId
     );
     connectionSocket = chainResult.socket;
     chainConnections = chainResult.connections;
@@ -700,78 +723,29 @@ async function openSftp(event, options) {
 
   if (options.password) connectOpts.password = options.password;
 
-  if (authAgent) {
-    const order = ["agent"];
-    if (connectOpts.password) order.push("password");
-    connectOpts.authHandler = order;
-  } else if (options.privateKey && connectOpts.password) {
-    // Prefer key auth when both key and password are present (password still needed for sudo)
-    connectOpts.authHandler = ["publickey", "password"];
-  }
-
-  // Add keyboard-interactive authentication support
-  // ssh2-sftp-client exposes the underlying ssh2 Client through its `on` method
-  const kiHandler = (name, instructions, instructionsLang, prompts, finish) => {
-    console.log(`[SFTP] ${options.hostname} keyboard-interactive auth requested`, {
-      name,
-      instructions,
-      promptCount: prompts?.length || 0,
-      prompts: prompts?.map(p => ({ prompt: p.prompt, echo: p.echo })),
-    });
-
-    // If there are no prompts, just call finish with empty array
-    if (!prompts || prompts.length === 0) {
-      console.log(`[SFTP] No prompts, finishing keyboard-interactive`);
-      finish([]);
-      return;
-    }
-
-    // Forward ALL prompts to user - no auto-fill to avoid semantic detection issues
-    // (Prompt text is admin-customizable and may not contain expected keywords)
-    const requestId = keyboardInteractiveHandler.generateRequestId('sftp');
-
-    keyboardInteractiveHandler.storeRequest(requestId, (userResponses) => {
-      console.log(`[SFTP] Received user responses, finishing keyboard-interactive`);
-      finish(userResponses);
-    }, event.sender.id, connId);
-
-    const promptsData = prompts.map((p) => ({
-      prompt: p.prompt,
-      echo: p.echo,
-    }));
-
-    console.log(`[SFTP] Showing modal for ${promptsData.length} prompts`);
-
-    safeSend(event.sender, "netcatty:keyboard-interactive", {
-      requestId,
-      sessionId: connId,
-      name: name || "",
-      instructions: instructions || "",
-      prompts: promptsData,
-      hostname: options.hostname,
-      savedPassword: options.password || null,
-    });
-  };
+  // Build auth handler using shared helper
+  const authConfig = buildAuthHandler({
+    privateKey: connectOpts.privateKey,
+    password: connectOpts.password,
+    passphrase: connectOpts.passphrase,
+    agent: connectOpts.agent,
+    username: connectOpts.username,
+    logPrefix: "[SFTP]",
+  });
+  applyAuthToConnOpts(connectOpts, authConfig);
 
+  // Create keyboard-interactive handler using shared helper
+  const kiHandler = createKeyboardInteractiveHandler({
+    sender: event.sender,
+    sessionId: connId,
+    hostname: options.hostname,
+    password: options.password,
+    logPrefix: "[SFTP]",
+  });
 
   // Add keyboard-interactive listener BEFORE connecting
   client.on("keyboard-interactive", kiHandler);
 
-  // Enable keyboard-interactive authentication in authHandler
-  if (connectOpts.authHandler) {
-    // Add keyboard-interactive after the existing methods
-    if (!connectOpts.authHandler.includes("keyboard-interactive")) {
-      connectOpts.authHandler.push("keyboard-interactive");
-    }
-  } else {
-    // Create authHandler with keyboard-interactive support
-    const authMethods = [];
-    if (connectOpts.privateKey) authMethods.push("publickey");
-    if (connectOpts.password) authMethods.push("password");
-    authMethods.push("keyboard-interactive");
-    connectOpts.authHandler = authMethods;
-  }
-
   // Increase timeout to allow for keyboard-interactive auth
   connectOpts.readyTimeout = 120000; // 2 minutes for 2FA input
 

electron/bridges/sshAuthHelper.cjs

@@ -0,0 +1,533 @@
+ /**
+  * SSH Authentication Helper - Shared authentication logic for SSH connections
+  * Used by sshBridge, sftpBridge, and portForwardingBridge
+  */
+ 
+ const fs = require("node:fs");
+ const path = require("node:path");
+ const os = require("node:os");
+ const keyboardInteractiveHandler = require("./keyboardInteractiveHandler.cjs");
+const passphraseHandler = require("./passphraseHandler.cjs");
+ 
+ // Default SSH key names in priority order
+ const DEFAULT_KEY_NAMES = ["id_ed25519", "id_ecdsa", "id_rsa"];
+ 
+ /**
+  * Check if an SSH private key is encrypted (requires passphrase)
+  * @param {string} keyContent - The content of the private key file
+  * @returns {boolean} - True if the key is encrypted
+  */
+ function isKeyEncrypted(keyContent) {
+   if (!keyContent || typeof keyContent !== "string") return false;
+  
+  // Check for PKCS#8 encrypted format (-----BEGIN ENCRYPTED PRIVATE KEY-----)
+  if (keyContent.includes("-----BEGIN ENCRYPTED PRIVATE KEY-----")) {
+    return true;
+  }
+  
+  // Check for legacy PEM format encryption (e.g., RSA PRIVATE KEY with encryption)
+  if (keyContent.includes("Proc-Type:") && keyContent.includes("ENCRYPTED")) {
+    return true;
+  }
+  
+  // Check for DEK-Info header (legacy PEM encryption indicator)
+   if (keyContent.includes("DEK-Info:")) return true;
+  
+  // Check for OpenSSH format keys
+  if (keyContent.includes("-----BEGIN OPENSSH PRIVATE KEY-----")) {
+    try {
+      // Extract the base64 content between the markers
+      const base64Match = keyContent.match(
+        /-----BEGIN OPENSSH PRIVATE KEY-----\s*([\s\S]*?)\s*-----END OPENSSH PRIVATE KEY-----/
+      );
+      if (base64Match) {
+        const base64Content = base64Match[1].replace(/\s/g, "");
+        const keyBuffer = Buffer.from(base64Content, "base64");
+        
+        // OpenSSH key format: "openssh-key-v1\0" followed by cipher name
+        // If ciphername is "none", the key is not encrypted
+        const authMagic = "openssh-key-v1\0";
+        if (keyBuffer.toString("ascii", 0, authMagic.length) === authMagic) {
+          // After magic, read ciphername (length-prefixed string)
+          let offset = authMagic.length;
+          const cipherNameLen = keyBuffer.readUInt32BE(offset);
+          offset += 4;
+          const cipherName = keyBuffer.toString("ascii", offset, offset + cipherNameLen);
+          return cipherName !== "none";
+        }
+      }
+    } catch {
+      // If parsing fails, assume it might be encrypted to be safe
+      return true;
+    }
+  }
+  
+   return false;
+ }
+ 
+ /**
+  * Find default SSH private key from user's ~/.ssh directory
+  * Skips encrypted keys that require a passphrase
+  * @returns {{ privateKey: string, keyPath: string, keyName: string } | null}
+  */
+ function findDefaultPrivateKey() {
+   const sshDir = path.join(os.homedir(), ".ssh");
+   for (const name of DEFAULT_KEY_NAMES) {
+     const keyPath = path.join(sshDir, name);
+     if (fs.existsSync(keyPath)) {
+       try {
+         const privateKey = fs.readFileSync(keyPath, "utf8");
+         if (isKeyEncrypted(privateKey)) {
+           continue;
+         }
+         return { privateKey, keyPath, keyName: name };
+       } catch {
+         continue;
+       }
+     }
+   }
+   return null;
+ }
+ 
+ /**
+  * Find ALL default SSH private keys from user's ~/.ssh directory
+ * @param {Object} [options]
+ * @param {boolean} [options.includeEncrypted=false] - If true, include encrypted keys with isEncrypted flag
+ * @returns {Array<{ privateKey: string, keyPath: string, keyName: string, isEncrypted?: boolean }>}
+  */
+function findAllDefaultPrivateKeys(options = {}) {
+  const { includeEncrypted = false } = options;
+   const sshDir = path.join(os.homedir(), ".ssh");
+   const keys = [];
+   for (const name of DEFAULT_KEY_NAMES) {
+     const keyPath = path.join(sshDir, name);
+     if (fs.existsSync(keyPath)) {
+       try {
+         const privateKey = fs.readFileSync(keyPath, "utf8");
+        const encrypted = isKeyEncrypted(privateKey);
+        if (encrypted && !includeEncrypted) {
+          continue; // Skip encrypted keys when not including them
+         }
+        keys.push({ 
+          privateKey, 
+          keyPath, 
+          keyName: name,
+          ...(includeEncrypted ? { isEncrypted: encrypted } : {})
+        });
+       } catch {
+         continue;
+       }
+     }
+   }
+   return keys;
+ }
+ 
+ /**
+  * Get ssh-agent socket path based on platform
+  * @returns {string|null}
+  */
+ function getSshAgentSocket() {
+   if (process.platform === "win32") {
+     return "\\\\.\\pipe\\openssh-ssh-agent";
+   }
+   return process.env.SSH_AUTH_SOCK || null;
+ }
+ 
+ /**
+  * Build authentication handler with default key fallback support
+  * @param {Object} options
+  * @param {string} [options.privateKey] - Explicitly configured private key
+  * @param {string} [options.password] - Password for authentication
+ * @param {string} [options.passphrase] - Passphrase for encrypted private key
+  * @param {Object} [options.agent] - SSH agent (NetcattyAgent or socket path)
+  * @param {string} options.username - SSH username
+  * @param {string} [options.logPrefix] - Log prefix for debugging
+  * @returns {{ authHandler: Function|Array, privateKey: string|null, agent: string|Object|null, usedDefaultKeys: boolean }}
+ * @param {Array} [options.unlockedEncryptedKeys] - Array of unlocked encrypted keys with passphrases
+  */
+ function buildAuthHandler(options) {
+  const { privateKey, password, passphrase, agent, username, logPrefix = "[SSH]", unlockedEncryptedKeys = [] } = options;
+   
+  // Determine what type of explicit auth the user configured
+  const hasExplicitKey = !!privateKey;
+  const hasExplicitPassword = !!password;
+  const hasExplicitAgent = !!agent;
+  const hasExplicitAuth = hasExplicitKey || hasExplicitPassword || hasExplicitAgent;
+  
+  // Determine if this is a password-only or key-only connection
+  const isPasswordOnly = hasExplicitPassword && !hasExplicitKey && !hasExplicitAgent;
+  const isKeyOnly = hasExplicitKey && !hasExplicitAgent;
+  
+   const sshAgentSocket = getSshAgentSocket();
+   const defaultKeys = findAllDefaultPrivateKeys();
+   
+  // Only use system ssh-agent BEFORE user's auth when:
+  // - User explicitly configured agent, OR
+  // - No explicit auth is configured (pure fallback mode)
+  // When user configured key/password, system agent should only be used AFTER as fallback
+  const useAgentFirst = hasExplicitAgent || !hasExplicitAuth;
+  
+  // Determine effective agent
+  const effectiveAgent = agent || (useAgentFirst ? sshAgentSocket : null);
+  
+  // Determine effective privateKey (user-provided takes priority)
+  const effectivePrivateKey = privateKey || (!hasExplicitAuth && defaultKeys.length > 0 ? defaultKeys[0].privateKey : null);
+  
+  // Determine fallback keys (keys to try after user's primary auth fails)
+  // - If user provided a key: all default keys are fallbacks
+  // - If no explicit auth: first default key is primary, rest are fallbacks  
+  // - If password-only or agent-only: all default keys are fallbacks (tried after primary)
+  const fallbackKeys = hasExplicitKey 
+    ? defaultKeys 
+    : !hasExplicitAuth 
+      ? defaultKeys.slice(1) 
+      : defaultKeys;
+  
+  // Check if we need dynamic handler (have fallback options)
+  const hasFallbackOptions = fallbackKeys.length > 0 || 
+    (!hasExplicitAgent && sshAgentSocket) || 
+    (isPasswordOnly && defaultKeys.length > 0);
+  
+  // If only simple auth methods and no fallback keys needed, use array-based handler
+  if (hasExplicitAuth && !hasFallbackOptions) {
+    const authMethods = [];
+    if (effectiveAgent) authMethods.push("agent");
+    if (privateKey) authMethods.push("publickey");
+    if (password) authMethods.push("password");
+    authMethods.push("keyboard-interactive");
+    
+    return {
+      authHandler: authMethods,
+      privateKey: effectivePrivateKey,
+      agent: effectiveAgent,
+      usedDefaultKeys: false,
+    };
+   }
+   
+  // Build comprehensive authMethods array with all auth options
+  // Order depends on what user explicitly configured:
+  // - Password-only: password -> agent -> default keys -> keyboard-interactive
+  // - Key-only: user key -> password -> agent -> default keys -> keyboard-interactive  
+  // - Agent configured: agent -> user key -> password -> default keys -> keyboard-interactive
+  // - No explicit auth: agent -> default keys -> keyboard-interactive
+  const authMethods = [];
+  
+  if (isPasswordOnly) {
+    // Password-only: password first, then fallbacks
+    authMethods.push({ type: "password", id: "password" });
+    
+    // Add agent and default keys AFTER password as fallback
+    if (sshAgentSocket) {
+      authMethods.push({ type: "agent", id: "agent" });
+    }
+    for (const keyInfo of defaultKeys) {
+      authMethods.push({ 
+        type: "publickey", 
+        key: keyInfo.privateKey, 
+        id: `publickey-default-${keyInfo.keyName}` 
+      });
+    }
+  } else if (isKeyOnly) {
+    // Key-only: user key first, then password (if any), then agent/default keys as fallback
+    
+    // 1. User-provided key first
+    authMethods.push({ 
+      type: "publickey", 
+      key: privateKey, 
+      passphrase: passphrase,
+      id: "publickey-user" 
+    });
+    
+    // 2. Password (if configured alongside key)
+    if (password) {
+      authMethods.push({ type: "password", id: "password" });
+    }
+    
+    // 3. System agent as fallback (AFTER user's key)
+    if (sshAgentSocket) {
+      authMethods.push({ type: "agent", id: "agent" });
+    }
+    
+    // 4. Default keys as fallback
+    for (const keyInfo of fallbackKeys) {
+      authMethods.push({ 
+        type: "publickey", 
+        key: keyInfo.privateKey, 
+        id: `publickey-default-${keyInfo.keyName}` 
+      });
+    }
+  } else {
+    // Agent configured or no explicit auth: agent -> user key -> password -> default keys
+    
+    // 1. Agent (user-provided or system)
+    if (effectiveAgent) {
+      authMethods.push({ type: "agent", id: "agent" });
+    }
+    
+    // 2. User-provided key
+    if (privateKey) {
+      authMethods.push({ 
+        type: "publickey", 
+        key: privateKey, 
+        passphrase: passphrase,
+        id: "publickey-user" 
+      });
+    }
+    
+    // 3. Password (if configured)
+    if (password) {
+      authMethods.push({ type: "password", id: "password" });
+    }
+    
+    // 4. Default keys as fallback
+    for (const keyInfo of fallbackKeys) {
+      authMethods.push({ 
+        type: "publickey", 
+        key: keyInfo.privateKey, 
+        id: `publickey-default-${keyInfo.keyName}` 
+      });
+    }
+    
+    // 5. If no user key provided, add first default key at the beginning (after agent)
+    if (!privateKey && defaultKeys.length > 0) {
+      const insertIndex = effectiveAgent ? 1 : 0;
+      authMethods.splice(insertIndex, 0, { 
+        type: "publickey", 
+        key: defaultKeys[0].privateKey, 
+        id: `publickey-default-${defaultKeys[0].keyName}` 
+      });
+    }
+  }
+  
+  // Add unlocked encrypted default keys (user provided passphrases for these)
+  for (const keyInfo of unlockedEncryptedKeys) {
+    authMethods.push({ 
+      type: "publickey", 
+      key: keyInfo.privateKey, 
+      passphrase: keyInfo.passphrase,
+      id: `publickey-encrypted-${keyInfo.keyName}` 
+    });
+  }
+  
+  // Keyboard-interactive as last resort
+  authMethods.push({ type: "keyboard-interactive", id: "keyboard-interactive" });
+   
+  console.log(`${logPrefix} Auth methods configured`, { 
+      isPasswordOnly,
+      hasUserKey: !!privateKey,
+      hasPassword: !!password,
+      hasAgent: !!effectiveAgent,
+      methodCount: authMethods.length,
+      methods: authMethods.map(m => m.id),
+    });
+  
+   // Use dynamic authHandler to try all keys
+   let authIndex = 0;
+   const attemptedMethodIds = new Set();
+   
+   const authHandler = (methodsLeft, partialSuccess, callback) => {
+     const availableMethods = methodsLeft || ["publickey", "password", "keyboard-interactive", "agent"];
+     
+     while (authIndex < authMethods.length) {
+       const method = authMethods[authIndex];
+       authIndex++;
+       
+       if (attemptedMethodIds.has(method.id)) continue;
+       attemptedMethodIds.add(method.id);
+       
+      if (method.type === "agent" && (availableMethods.includes("publickey") || availableMethods.includes("agent"))) {
+        console.log(`${logPrefix} Trying agent auth`);
+        return callback("agent");
+      } else if (method.type === "publickey" && availableMethods.includes("publickey")) {
+         console.log(`${logPrefix} Trying publickey auth:`, method.id);
+         const pubkeyAuth = {
+           type: "publickey",
+           username,
+           key: method.key,
+         };
+         if (method.passphrase) {
+           pubkeyAuth.passphrase = method.passphrase;
+         }
+         return callback(pubkeyAuth);
+      } else if (method.type === "password" && availableMethods.includes("password")) {
+        console.log(`${logPrefix} Trying password auth`);
+        return callback({
+          type: "password",
+          username,
+          password,
+        });
+       } else if (method.type === "keyboard-interactive" && availableMethods.includes("keyboard-interactive")) {
+         return callback("keyboard-interactive");
+       }
+     }
+     return callback(false);
+   };
+   
+  // Determine the agent to return - if authMethods includes agent, we need to provide the socket
+  // even if effectiveAgent is null (for fallback scenarios)
+  const hasAgentInMethods = authMethods.some(m => m.type === "agent");
+  const returnAgent = effectiveAgent || (hasAgentInMethods ? sshAgentSocket : null);
+  
+   return {
+     authHandler,
+    privateKey: effectivePrivateKey,
+    agent: returnAgent,
+     usedDefaultKeys: true,
+   };
+ }
+ 
+ /**
+  * Create a keyboard-interactive event handler
+  * @param {Object} options
+  * @param {Object} options.sender - Electron webContents sender
+  * @param {string} options.sessionId - Session/connection ID
+  * @param {string} options.hostname - Host being connected to
+  * @param {string} [options.password] - Saved password for fill button
+  * @param {string} [options.logPrefix] - Log prefix for debugging
+  * @returns {Function} - Event handler for 'keyboard-interactive' event
+  */
+ function createKeyboardInteractiveHandler(options) {
+   const { sender, sessionId, hostname, password, logPrefix = "[SSH]" } = options;
+   
+   return (name, instructions, instructionsLang, prompts, finish) => {
+     console.log(`${logPrefix} ${hostname} keyboard-interactive auth requested`, {
+       name,
+       instructions,
+       promptCount: prompts?.length || 0,
+     });
+     
+     // If there are no prompts, just call finish with empty array
+     if (!prompts || prompts.length === 0) {
+       console.log(`${logPrefix} No prompts, finishing keyboard-interactive`);
+       finish([]);
+       return;
+     }
+     
+     // Forward prompts to user via IPC
+     const requestId = keyboardInteractiveHandler.generateRequestId('ssh');
+     keyboardInteractiveHandler.storeRequest(requestId, (userResponses) => {
+       console.log(`${logPrefix} Received user responses, finishing keyboard-interactive`);
+       finish(userResponses);
+     }, sender.id, sessionId);
+     
+     const promptsData = prompts.map((p) => ({
+       prompt: p.prompt,
+       echo: p.echo,
+     }));
+     
+     console.log(`${logPrefix} Showing modal for ${promptsData.length} prompts`);
+     
+     safeSend(sender, "netcatty:keyboard-interactive", {
+       requestId,
+       sessionId,
+       name: name || hostname,
+       instructions: instructions || "",
+       prompts: promptsData,
+      hostname: hostname,
+       savedPassword: password || null,
+     });
+   };
+ }
+ 
+ /**
+  * Send message to renderer safely
+  */
+ function safeSend(sender, channel, payload) {
+   try {
+     if (!sender || sender.isDestroyed()) return;
+     sender.send(channel, payload);
+   } catch {
+     // Ignore destroyed webContents during shutdown.
+   }
+ }
+ 
+ /**
+  * Apply auth configuration to connection options
+  * Convenience function that combines buildAuthHandler results with connOpts
+  * @param {Object} connOpts - SSH connection options to modify
+  * @param {Object} authConfig - Auth configuration from buildAuthHandler
+  */
+ function applyAuthToConnOpts(connOpts, authConfig) {
+   connOpts.authHandler = authConfig.authHandler;
+   if (authConfig.privateKey) {
+     connOpts.privateKey = authConfig.privateKey;
+   }
+   if (authConfig.agent) {
+     connOpts.agent = authConfig.agent;
+   }
+ }
+ 
+/**
+ * Request passphrases for encrypted default keys
+ * Shows a modal for each encrypted key and collects passphrases
+ * @param {Object} sender - Electron webContents sender
+ * @param {string} [hostname] - Optional hostname for context
+ * @returns {Promise<{ keys: Array<{ privateKey: string, keyPath: string, keyName: string, passphrase: string }>, cancelled: boolean }>}
+ */
+async function requestPassphrasesForEncryptedKeys(sender, hostname) {
+  const allKeys = findAllDefaultPrivateKeys({ includeEncrypted: true });
+  const encryptedKeys = allKeys.filter(k => k.isEncrypted);
+  
+  if (encryptedKeys.length === 0) {
+    return { keys: [], cancelled: false };
+  }
+  
+  console.log(`[SSHAuth] Found ${encryptedKeys.length} encrypted default key(s), requesting passphrases`);
+  
+  const unlockedKeys = [];
+  let wasCancelled = false;
+  
+  for (const keyInfo of encryptedKeys) {
+    const result = await passphraseHandler.requestPassphrase(
+      sender,
+      keyInfo.keyPath,
+      keyInfo.keyName,
+      hostname
+    );
+    
+    // Handle different response types
+    if (!result) {
+      // Timeout or error - continue with next key
+      console.log(`[SSHAuth] No response for ${keyInfo.keyName}, continuing...`);
+      continue;
+    }
+    
+    if (result.cancelled) {
+      // User clicked Cancel - stop the entire flow
+      console.log(`[SSHAuth] User cancelled passphrase flow at ${keyInfo.keyName}`);
+      wasCancelled = true;
+      break;
+    }
+    
+    if (result.skipped) {
+      // User clicked Skip - continue with next key
+      console.log(`[SSHAuth] User skipped passphrase for ${keyInfo.keyName}`);
+      continue;
+    }
+    
+    if (result.passphrase) {
+      // User provided passphrase
+      unlockedKeys.push({
+        privateKey: keyInfo.privateKey,
+        keyPath: keyInfo.keyPath,
+        keyName: keyInfo.keyName,
+        passphrase: result.passphrase,
+      });
+    }
+  }
+  
+  return { keys: unlockedKeys, cancelled: wasCancelled };
+}
+
+ module.exports = {
+   DEFAULT_KEY_NAMES,
+   isKeyEncrypted,
+   findDefaultPrivateKey,
+   findAllDefaultPrivateKeys,
+   getSshAgentSocket,
+   buildAuthHandler,
+   createKeyboardInteractiveHandler,
+   applyAuthToConnOpts,
+   safeSend,
+  requestPassphrasesForEncryptedKeys,
+ };

electron/bridges/sshBridge.cjs

@@ -11,7 +11,16 @@ const { exec } = require("node:child_process");
 const { Client: SSHClient, utils: sshUtils } = require("ssh2");
 const { NetcattyAgent } = require("./netcattyAgent.cjs");
 const keyboardInteractiveHandler = require("./keyboardInteractiveHandler.cjs");
+const passphraseHandler = require("./passphraseHandler.cjs");
 const { createProxySocket } = require("./proxyUtils.cjs");
+const { 
+  buildAuthHandler, 
+  createKeyboardInteractiveHandler, 
+  applyAuthToConnOpts,
+  safeSend: authSafeSend,
+  requestPassphrasesForEncryptedKeys,
+  findAllDefaultPrivateKeys: findAllDefaultPrivateKeysFromHelper,
+} = require("./sshAuthHelper.cjs");
 
 // Default SSH key names in priority order
 const DEFAULT_KEY_NAMES = ["id_ed25519", "id_ecdsa", "id_rsa"];
@@ -71,14 +80,18 @@ function isKeyEncrypted(keyContent) {
  */
 function findDefaultPrivateKey() {
   const sshDir = path.join(os.homedir(), ".ssh");
+  log("Searching for default SSH keys", { sshDir, keyNames: DEFAULT_KEY_NAMES });
   for (const name of DEFAULT_KEY_NAMES) {
     const keyPath = path.join(sshDir, name);
+    log("Checking key file", { keyPath, exists: fs.existsSync(keyPath) });
     if (fs.existsSync(keyPath)) {
       try {
         const privateKey = fs.readFileSync(keyPath, "utf8");
         // Skip encrypted keys - they require a passphrase and would abort
         // authentication before password/keyboard-interactive can be tried
-        if (isKeyEncrypted(privateKey)) {
+        const encrypted = isKeyEncrypted(privateKey);
+        log("Key file read", { keyPath, keyName: name, encrypted, keyLength: privateKey.length });
+        if (encrypted) {
           log("Skipping encrypted default key", { keyPath, keyName: name });
           continue;
         }
@@ -90,9 +103,40 @@ function findDefaultPrivateKey() {
       }
     }
   }
+  log("No suitable default SSH key found");
   return null;
 }
 
+/**
+ * Find ALL default SSH private keys from user's ~/.ssh directory
+ * Returns all non-encrypted keys for fallback authentication
+ * @returns {Array<{ privateKey: string, keyPath: string, keyName: string }>}
+ */
+function findAllDefaultPrivateKeys() {
+  const sshDir = path.join(os.homedir(), ".ssh");
+  const keys = [];
+  log("Searching for ALL default SSH keys", { sshDir, keyNames: DEFAULT_KEY_NAMES });
+  for (const name of DEFAULT_KEY_NAMES) {
+    const keyPath = path.join(sshDir, name);
+    if (fs.existsSync(keyPath)) {
+      try {
+        const privateKey = fs.readFileSync(keyPath, "utf8");
+        const encrypted = isKeyEncrypted(privateKey);
+        if (!encrypted) {
+          keys.push({ privateKey, keyPath, keyName: name });
+          log("Found default key for fallback", { keyPath, keyName: name });
+        } else {
+          log("Skipping encrypted key", { keyPath, keyName: name });
+        }
+      } catch (e) {
+        log("Failed to read key", { keyPath, error: e.message });
+      }
+    }
+  }
+  log("Found default SSH keys", { count: keys.length, keyNames: keys.map(k => k.keyName) });
+  return keys;
+}
+
 /**
  * Check if Windows SSH Agent service is running
  * @returns {Promise<{ running: boolean, startupType: string | null, error: string | null }>}
@@ -124,13 +168,45 @@ const logFile = path.join(require("os").tmpdir(), "netcatty-ssh.log");
 const log = (msg, data) => {
   const line = `[${new Date().toISOString()}] ${msg} ${data ? JSON.stringify(data) : ""}\n`;
   try { fs.appendFileSync(logFile, line); } catch { }
-  console.log("[SSH]", msg, data || "");
+  console.log("[SSH]", msg, data ? JSON.stringify(data, null, 2) : "");
 };
 
 // Session storage - shared reference passed from main
 let sessions = null;
 let electronModule = null;
 
+// Authentication method cache - remembers successful auth methods per host
+// Key format: "username@hostname:port"
+// Value: { method: "password" | "publickey" | "publickey-default" }
+// Cache persists until auth failure, then cleared to retry all methods
+const authMethodCache = new Map();
+
+function getAuthCacheKey(username, hostname, port) {
+  return `${username}@${hostname}:${port || 22}`;
+}
+
+function getCachedAuthMethod(username, hostname, port) {
+  const key = getAuthCacheKey(username, hostname, port);
+  const cached = authMethodCache.get(key);
+  if (cached) {
+    log("Using cached auth method", { key, method: cached.method });
+    return cached.method;
+  }
+  return null;
+}
+
+function setCachedAuthMethod(username, hostname, port, method) {
+  const key = getAuthCacheKey(username, hostname, port);
+  log("Caching successful auth method", { key, method });
+  authMethodCache.set(key, { method });
+}
+
+function clearCachedAuthMethod(username, hostname, port) {
+  const key = getAuthCacheKey(username, hostname, port);
+  log("Clearing cached auth method", { key });
+  authMethodCache.delete(key);
+}
+
 // Normalize charset inputs (often provided as bare encodings like "UTF-8")
 // into a usable LANG locale for remote shells.
 function resolveLangFromCharset(charset) {
@@ -162,7 +238,7 @@ function init(deps) {
 /**
  * Connect through a chain of jump hosts
  */
-async function connectThroughChain(event, options, jumpHosts, targetHost, targetPort) {
+async function connectThroughChain(event, options, jumpHosts, targetHost, targetPort, sessionId) {
   const sender = event.sender;
   const connections = [];
   let currentSocket = null;
@@ -192,7 +268,7 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
         host: jump.hostname,
         port: jump.port || 22,
         username: jump.username || 'root',
-        readyTimeout: 20000, // Reduced from 60s for faster failure detection
+        readyTimeout: 120000, // 2 minutes to allow for keyboard-interactive (2FA/MFA)
         // Use user-configured keepalive interval from options (in seconds -> convert to ms)
         // If 0 or not provided, use 10000ms as default
         keepaliveInterval: options.keepaliveInterval && options.keepaliveInterval > 0 ? options.keepaliveInterval * 1000 : 10000,
@@ -208,7 +284,7 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
         },
       };
 
-      // Auth - support agent (certificate), key, and password fallback
+      // Auth - support agent (certificate), key, password, and default key fallback
       const hasCertificate =
         typeof jump.certificate === "string" && jump.certificate.trim().length > 0;
 
@@ -232,11 +308,18 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
 
       if (jump.password) connOpts.password = jump.password;
 
-      if (authAgent) {
-        const order = ["agent"];
-        if (connOpts.password) order.push("password");
-        connOpts.authHandler = order;
-      }
+      // Build auth handler using shared helper
+      // Pass unlocked encrypted keys from options so jump hosts can use them for retry
+      const authConfig = buildAuthHandler({
+        privateKey: connOpts.privateKey,
+        password: connOpts.password,
+        passphrase: connOpts.passphrase,
+        agent: connOpts.agent,
+        username: connOpts.username,
+        logPrefix: `[Chain] Hop ${i + 1}`,
+        unlockedEncryptedKeys: options._unlockedEncryptedKeys || [],
+      });
+      applyAuthToConnOpts(connOpts, authConfig);
 
       // If first hop and proxy is configured, connect through proxy
       if (isFirst && options.proxy) {
@@ -267,6 +350,14 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
           console.error(`[Chain] Hop ${i + 1}/${totalHops}: ${hopLabel} timeout`);
           reject(new Error(`Connection timeout to ${hopLabel}`));
         });
+        // Handle keyboard-interactive authentication for jump hosts (2FA/MFA)
+        conn.on('keyboard-interactive', createKeyboardInteractiveHandler({
+          sender,
+          sessionId,
+          hostname: hopLabel,
+          password: jump.password,
+          logPrefix: `[Chain] Hop ${i + 1}/${totalHops}`,
+        }));
         console.log(`[Chain] Hop ${i + 1}/${totalHops}: Connecting to ${hopLabel}...`);
         conn.connect(connOpts);
       });
@@ -408,21 +499,63 @@ async function startSSHSession(event, options) {
       }
     }
 
-    if (options.password) {
+    if (options.password && typeof options.password === "string" && options.password.trim().length > 0) {
       connectOpts.password = options.password;
     }
 
-    // Fallback to default SSH key if no authentication method is configured
-    let usedDefaultKey = null;
+    // Always try to find default SSH keys for fallback authentication
+    // This allows fallback even when password auth fails
+    let defaultKeyInfo = null;
+    let allDefaultKeys = [];
+    let usedDefaultKeyAsPrimary = false;
+    const defaultKey = findDefaultPrivateKey();
+    if (defaultKey) {
+      defaultKeyInfo = defaultKey;
+      log("Found default SSH key for fallback", { keyPath: defaultKey.keyPath, keyName: defaultKey.keyName });
+    }
+    // Also find ALL default keys for comprehensive fallback
+    allDefaultKeys = findAllDefaultPrivateKeys();
+
+    // Use unlocked encrypted keys if provided (from retry after auth failure)
+    // These are passed via _unlockedEncryptedKeys from startSSHSessionWrapper
+    const unlockedEncryptedKeys = options._unlockedEncryptedKeys || [];
+    if (unlockedEncryptedKeys.length > 0) {
+      log("Using unlocked encrypted keys from retry", { 
+        count: unlockedEncryptedKeys.length,
+        keyNames: unlockedEncryptedKeys.map(k => k.keyName)
+      });
+    }
+
+    // If no primary auth method configured, try ssh-agent first, then ALL default keys
     if (!connectOpts.privateKey && !connectOpts.password && !connectOpts.agent) {
-      const defaultKey = findDefaultPrivateKey();
-      if (defaultKey) {
-        log("Using default SSH key as fallback", { keyPath: defaultKey.keyPath });
-        connectOpts.privateKey = defaultKey.privateKey;
-        usedDefaultKey = defaultKey;
+      // First, try to use ssh-agent if available (this is what regular SSH does)
+      const sshAgentSocket = process.platform === "win32" 
+        ? "\\\\.\\pipe\\openssh-ssh-agent" 
+        : process.env.SSH_AUTH_SOCK;
+      
+      if (sshAgentSocket) {
+        log("No auth method configured, trying ssh-agent first", { agentSocket: sshAgentSocket });
+        connectOpts.agent = sshAgentSocket;
+      }
+      
+      // Mark that we need to try all default keys (handled in authMethods below)
+      if (allDefaultKeys.length > 0) {
+        log("Will try all default SSH keys as fallback", { count: allDefaultKeys.length, keyNames: allDefaultKeys.map(k => k.keyName) });
+        // Set first key for connectOpts.privateKey (required for ssh2 to allow publickey auth)
+        connectOpts.privateKey = allDefaultKeys[0].privateKey;
+        usedDefaultKeyAsPrimary = true;
+      } else {
+        log("No default SSH key found in ~/.ssh directory");
       }
     }
 
+    log("Final auth configuration", {
+      hasPrivateKey: !!connectOpts.privateKey,
+      hasPassword: !!connectOpts.password,
+      hasAgent: !!connectOpts.agent,
+      hasDefaultKeyFallback: !!defaultKeyInfo,
+    });
+
     // Agent forwarding
     if (options.agentForwarding) {
       connectOpts.agentForward = true;
@@ -435,12 +568,248 @@ async function startSSHSession(event, options) {
       }
     }
 
-    // Prefer agent-based auth when we created an in-process agent (cert)
+    // Build authentication handler with fallback support
+    // ssh2 authHandler can be a function that returns the next auth method to try
+
+    // Check if we have a cached successful auth method for this host
+    const cachedMethod = getCachedAuthMethod(connectOpts.username, options.hostname, options.port);
+
+    // Track which method succeeded for caching
+    let lastTriedMethod = null;
+
     if (authAgent) {
       const order = ["agent"];
-      // Allow password fallback if provided
       if (connectOpts.password) order.push("password");
+      // Add default key fallback if available and no user key configured
+      // Must also set connectOpts.privateKey for ssh2 to actually try publickey auth
+      if (defaultKeyInfo && !options.privateKey) {
+        connectOpts.privateKey = defaultKeyInfo.privateKey;
+        order.push("publickey");
+      }
+      order.push("keyboard-interactive");
       connectOpts.authHandler = order;
+      log("Auth order (agent mode)", { order });
+    } else {
+      // Build dynamic auth handler for fallback support
+      const authMethods = [];
+
+      // First try user-configured key if available (explicit user choice)
+      if (connectOpts.privateKey && !usedDefaultKeyAsPrimary) {
+        authMethods.push({ type: "publickey", key: connectOpts.privateKey, passphrase: connectOpts.passphrase, id: "publickey-user" });
+      }
+
+      // Then try agent if configured (try agent before password since it's usually faster)
+      if (connectOpts.agent) {
+        authMethods.push({ type: "agent", id: "agent" });
+      }
+
+      // Then try password if available (explicit user choice)
+      if (connectOpts.password) {
+        authMethods.push({ type: "password", id: "password" });
+      }
+
+      // Then try ALL default SSH keys as fallback (not just the first one!)
+      // This is critical because different servers may have different keys in authorized_keys
+      if (usedDefaultKeyAsPrimary && allDefaultKeys.length > 0) {
+        for (const keyInfo of allDefaultKeys) {
+          authMethods.push({ 
+            type: "publickey", 
+            key: keyInfo.privateKey, 
+            isDefault: true, 
+            id: `publickey-default-${keyInfo.keyName}` 
+          });
+        }
+      } else if (defaultKeyInfo && !options.privateKey && !usedDefaultKeyAsPrimary) {
+        // Single default key fallback (when user has configured other auth methods)
+        authMethods.push({ type: "publickey", key: defaultKeyInfo.privateKey, isDefault: true, id: "publickey-default" });
+      }
+
+      // Add unlocked encrypted default keys (user provided passphrases for these)
+      for (const keyInfo of unlockedEncryptedKeys) {
+        authMethods.push({ 
+          type: "publickey", 
+          key: keyInfo.privateKey, 
+          passphrase: keyInfo.passphrase,
+          isDefault: true, 
+          id: `publickey-encrypted-${keyInfo.keyName}` 
+        });
+      }
+
+      // Finally try keyboard-interactive
+      authMethods.push({ type: "keyboard-interactive", id: "keyboard-interactive" });
+
+      log("Auth methods configured", {
+        methods: authMethods.map(m => ({ type: m.type, id: m.id, isDefault: m.isDefault || false })),
+        cachedMethod,
+        usedDefaultKeyAsPrimary
+      });
+
+      // Reorder methods based on cached successful method
+      if (cachedMethod) {
+        const cachedIndex = authMethods.findIndex(m => m.id === cachedMethod);
+        if (cachedIndex > 0) {
+          const [cachedAuthMethod] = authMethods.splice(cachedIndex, 1);
+          authMethods.unshift(cachedAuthMethod);
+          log("Reordered auth methods based on cache", {
+            methods: authMethods.map(m => m.id)
+          });
+        }
+      }
+
+      // Use dynamic authHandler if we have multiple auth options
+      if (authMethods.length > 1) {
+        let authIndex = 0;
+        // Track methods that have been attempted (to avoid re-trying on failure)
+        // This prevents reusing the same key when server requires multiple publickey auth steps
+        // and also prevents re-attempting failed methods
+        const attemptedMethodIds = new Set();
+        // Track the first successful method for caching (not the last one in multi-step flows)
+        let firstSuccessfulMethod = null;
+        // Track if we've gone through a partialSuccess flow (multi-step auth)
+        let hadPartialSuccess = false;
+
+        connectOpts.authHandler = (methodsLeft, partialSuccess, callback) => {
+          log("authHandler called", { methodsLeft, partialSuccess, authIndex, attemptedMethodIds: Array.from(attemptedMethodIds) });
+
+          // methodsLeft can be null on first call (before server responds with available methods)
+          // Include "agent" for SSH agent-based auth (used with agentForwarding)
+          const availableMethods = methodsLeft || ["publickey", "password", "keyboard-interactive", "agent"];
+
+          // Handle partialSuccess case (e.g., password succeeded but server requires additional auth like MFA)
+          // When partialSuccess is true, we should try the remaining methods the server is asking for
+          if (partialSuccess && methodsLeft && methodsLeft.length > 0) {
+            hadPartialSuccess = true;
+            // Record the first successful method (the one that triggered partialSuccess)
+            if (lastTriedMethod && !firstSuccessfulMethod) {
+              firstSuccessfulMethod = lastTriedMethod;
+              log("Recorded first successful method for caching", { method: firstSuccessfulMethod });
+            }
+            // Mark the last tried method as attempted (it succeeded, so we shouldn't retry it)
+            if (lastTriedMethod) {
+              attemptedMethodIds.add(lastTriedMethod);
+              log("Marked method as attempted (partial success)", { method: lastTriedMethod });
+            }
+
+            log("Partial success - server requires additional auth", { methodsLeft, attemptedMethodIds: Array.from(attemptedMethodIds) });
+
+            // Find a method from our list that matches what the server wants
+            // Skip methods that have already been attempted
+            for (const serverMethod of methodsLeft) {
+              // Map server method names to our method types
+              const matchingMethod = authMethods.find(m => {
+                // Skip already attempted methods
+                if (attemptedMethodIds.has(m.id)) return false;
+                if (serverMethod === "keyboard-interactive" && m.type === "keyboard-interactive") return true;
+                if (serverMethod === "password" && m.type === "password") return true;
+                if (serverMethod === "publickey" && (m.type === "publickey" || m.type === "agent")) return true;
+                return false;
+              });
+
+              if (matchingMethod) {
+                log("Found matching method for partial success", { serverMethod, matchingMethod: matchingMethod.id });
+                // Mark as attempted BEFORE returning to prevent re-use on failure
+                attemptedMethodIds.add(matchingMethod.id);
+                lastTriedMethod = matchingMethod.id;
+
+                if (matchingMethod.type === "keyboard-interactive") {
+                  log("Trying keyboard-interactive auth (partial success)", { id: matchingMethod.id });
+                  return callback("keyboard-interactive");
+                } else if (matchingMethod.type === "password") {
+                  log("Trying password auth (partial success)", { id: matchingMethod.id });
+                  return callback({
+                    type: "password",
+                    username: connectOpts.username,
+                    password: connectOpts.password,
+                  });
+                } else if (matchingMethod.type === "agent") {
+                  const agentType = typeof connectOpts.agent === "string" ? "path" : "NetcattyAgent";
+                  log("Trying agent auth (partial success)", { id: matchingMethod.id, agentType });
+                  return callback("agent");
+                } else if (matchingMethod.type === "publickey") {
+                  log("Trying publickey auth (partial success)", { id: matchingMethod.id });
+                  return callback({
+                    type: "publickey",
+                    username: connectOpts.username,
+                    key: matchingMethod.key,
+                    passphrase: matchingMethod.passphrase,
+                  });
+                }
+              }
+            }
+            // No matching method found for partial success
+            log("No matching method found for partial success requirements", { methodsLeft });
+            return callback(false);
+          }
+
+          while (authIndex < authMethods.length) {
+            const method = authMethods[authIndex];
+            authIndex++;
+
+            // Skip methods that have already been attempted (e.g., during partial success handling)
+            if (attemptedMethodIds.has(method.id)) {
+              log("Skipping already attempted method", { method: method.id });
+              continue;
+            }
+
+            // Check if this method is still available on server
+            // Note: "agent" uses "publickey" as the underlying method type
+            const methodName = method.type === "password" ? "password" :
+                method.type === "publickey" ? "publickey" :
+                method.type === "agent" ? "publickey" : "keyboard-interactive";
+            if (!availableMethods.includes(methodName) && !availableMethods.includes(method.type)) {
+              log("Auth method not available on server, skipping", { method: method.id });
+              continue;
+            }
+
+            // Mark as attempted BEFORE returning
+            attemptedMethodIds.add(method.id);
+            lastTriedMethod = method.id;
+
+            if (method.type === "agent") {
+              // Only log safe identifier, not the full agent object which may contain private keys
+              const agentType = typeof connectOpts.agent === "string" ? "path" : "NetcattyAgent";
+              log("Trying agent auth", { id: method.id, agentType });
+              // Return "agent" string to use SSH agent for authentication
+              return callback("agent");
+            } else if (method.type === "publickey") {
+              log("Trying publickey auth", { id: method.id, isDefault: method.isDefault || false });
+              return callback({
+                type: "publickey",
+                username: connectOpts.username,
+                key: method.key,
+                passphrase: method.passphrase,
+              });
+            } else if (method.type === "password") {
+              log("Trying password auth", { id: method.id });
+              return callback({
+                type: "password",
+                username: connectOpts.username,
+                password: connectOpts.password,
+              });
+            } else if (method.type === "keyboard-interactive") {
+              log("Trying keyboard-interactive auth", { id: method.id });
+              // Return string instead of object - ssh2 requires a prompt function
+              // for keyboard-interactive objects. Returning the string lets ssh2
+              // use its default handling and trigger the keyboard-interactive event.
+              return callback("keyboard-interactive");
+            }
+          }
+
+          log("All auth methods exhausted");
+          return callback(false);
+        };
+
+        // Store method reference for success callback
+        // For multi-step auth (partialSuccess), cache the first successful method, not the last
+        // This ensures next connection starts with the correct first factor
+        connectOpts._lastTriedMethodRef = () => {
+          if (hadPartialSuccess && firstSuccessfulMethod) {
+            log("Using first successful method for cache (multi-step auth)", { firstSuccessfulMethod });
+            return firstSuccessfulMethod;
+          }
+          return lastTriedMethod;
+        };
+      }
     }
 
     // Handle chain/proxy connections
@@ -450,7 +819,8 @@ async function startSSHSession(event, options) {
         options,
         jumpHosts,
         options.hostname,
-        options.port || 22
+        options.port || 22,
+        sessionId
       );
       connectionSocket = chainResult.socket;
       chainConnections = chainResult.connections;
@@ -476,6 +846,15 @@ async function startSSHSession(event, options) {
       const logPrefix = hasJumpHosts ? '[Chain]' : '[SSH]';
       conn.on("ready", () => {
         console.log(`${logPrefix} ${options.hostname} ready`);
+
+        // Cache the successful auth method
+        if (connectOpts._lastTriedMethodRef) {
+          const successMethod = connectOpts._lastTriedMethodRef();
+          if (successMethod) {
+            setCachedAuthMethod(connectOpts.username, options.hostname, options.port, successMethod);
+          }
+        }
+
         if (hasJumpHosts || hasProxy) {
           sendProgress(totalHops, totalHops, options.hostname, 'connected');
         }
@@ -584,8 +963,9 @@ async function startSSHSession(event, options) {
           err.message?.toLowerCase().includes('password') ||
           err.level === 'client-authentication';
 
-        // Use log instead of error for auth failures (normal fallback scenario)
+        // Clear cached auth method on auth failure so next attempt tries all methods
         if (isAuthError) {
+          clearCachedAuthMethod(connectOpts.username, options.hostname, options.port);
           console.log(`${logPrefix} ${options.hostname} auth failed:`, err.message);
           safeSend(contents, "netcatty:auth:failed", {
             sessionId,
@@ -670,23 +1050,39 @@ async function startSSHSession(event, options) {
 
 
       // Enable keyboard-interactive authentication in authHandler
-      if (connectOpts.authHandler) {
+      // Note: If authHandler is a function (for fallback support), keyboard-interactive
+      // is already included in the auth methods list
+      if (Array.isArray(connectOpts.authHandler)) {
         // Add keyboard-interactive after the existing methods
         if (!connectOpts.authHandler.includes("keyboard-interactive")) {
           connectOpts.authHandler.push("keyboard-interactive");
         }
-      } else {
+      } else if (typeof connectOpts.authHandler !== "function") {
         // Create authHandler with keyboard-interactive support
+        // This path is taken when usedDefaultKeyAsPrimary=true (only keyboard-interactive in authMethods)
+        // Using array format is more reliable - ssh2 uses connectOpts credentials directly
         const authMethods = [];
+        // Try agent FIRST (this is what regular SSH does - it checks ssh-agent before key files)
+        if (connectOpts.agent) authMethods.push("agent");
         if (connectOpts.privateKey) authMethods.push("publickey");
         if (connectOpts.password) authMethods.push("password");
         authMethods.push("keyboard-interactive");
         connectOpts.authHandler = authMethods;
+        log("Using simple array authHandler", { authMethods, usedDefaultKeyAsPrimary });
       }
+      // If authHandler is a function, it already handles keyboard-interactive
 
       // Increase timeout to allow for keyboard-interactive auth
       connectOpts.readyTimeout = 120000; // 2 minutes for 2FA input
 
+      // Enable debug logging for ssh2 to diagnose auth issues
+      connectOpts.debug = (msg) => {
+        // Only log auth-related messages to avoid noise
+        if (msg.includes('Auth') || msg.includes('auth') || msg.includes('publickey') || msg.includes('keyboard')) {
+          log("ssh2 debug", { msg });
+        }
+      };
+
       console.log(`${logPrefix} Connecting to ${options.hostname}...`);
       conn.connect(connectOpts);
     });
@@ -858,6 +1254,57 @@ async function startSSHSessionWrapper(event, options) {
       err.level === 'client-authentication';
 
     if (isAuthError) {
+      // Check if there are encrypted default keys we haven't tried yet
+      // Only offer retry if no unlocked keys were provided in this attempt
+      if (!options._unlockedEncryptedKeys || options._unlockedEncryptedKeys.length === 0) {
+        const allKeysWithEncrypted = findAllDefaultPrivateKeysFromHelper({ includeEncrypted: true });
+        const encryptedKeys = allKeysWithEncrypted.filter(k => k.isEncrypted);
+        
+        if (encryptedKeys.length > 0) {
+          console.log('[SSH] Auth failed, found encrypted default keys. Requesting passphrases for retry...');
+          
+          // Request passphrases from user
+          const passphraseResult = await requestPassphrasesForEncryptedKeys(
+            event.sender,
+            options.hostname
+          );
+          
+          // If user cancelled, don't retry even if some keys were unlocked
+          if (passphraseResult.cancelled) {
+            console.log('[SSH] User cancelled passphrase flow, not retrying');
+          } else if (passphraseResult.keys.length > 0) {
+            console.log('[SSH] User unlocked keys, retrying connection...', {
+              count: passphraseResult.keys.length,
+              keyNames: passphraseResult.keys.map(k => k.keyName)
+            });
+            
+            // Retry connection with unlocked keys
+            // Wrap in try-catch to ensure consistent error handling for retry failures
+            try {
+              return await startSSHSession(event, {
+                ...options,
+                _unlockedEncryptedKeys: passphraseResult.keys,
+              });
+            } catch (retryErr) {
+              // Re-wrap retry errors the same way as initial errors
+              const isRetryAuthError = retryErr.message?.toLowerCase().includes('authentication') ||
+                retryErr.message?.toLowerCase().includes('auth') ||
+                retryErr.level === 'client-authentication';
+              
+              if (isRetryAuthError) {
+                const authError = new Error(retryErr.message);
+                authError.level = 'client-authentication';
+                authError.isAuthError = true;
+                throw authError;
+              }
+              throw retryErr;
+            }
+          } else {
+            console.log('[SSH] User did not unlock any keys, not retrying');
+          }
+        }
+      }
+      
       // Re-throw with a clean error to avoid Electron printing full stack trace
       // The frontend will handle this as a normal auth failure for fallback
       const authError = new Error(err.message);
@@ -1281,6 +1728,8 @@ function registerHandlers(ipcMain) {
   });
   // Register the shared keyboard-interactive response handler
   keyboardInteractiveHandler.registerHandler(ipcMain);
+  // Register the passphrase response handler
+  passphraseHandler.registerHandler(ipcMain);
 }
 
 module.exports = {
@@ -1294,4 +1743,8 @@ module.exports = {
   generateKeyPair,
   checkWindowsSshAgent,
   findDefaultPrivateKey,
+  findAllDefaultPrivateKeys,
+  isKeyEncrypted,
+  findAllDefaultPrivateKeys,
+  isKeyEncrypted,
 };

electron/bridges/transferBridge.cjs

@@ -23,6 +23,138 @@ function init(deps) {
   electronModule = deps.electronModule;
 }
 
+/**
+ * Upload a local file to SFTP using streams (supports cancellation)
+ */
+async function uploadWithStreams(localPath, remotePath, client, fileSize, transfer, sendProgress) {
+  return new Promise((resolve, reject) => {
+    const readStream = fs.createReadStream(localPath);
+
+    // Get the underlying sftp object from ssh2-sftp-client
+    const sftp = client.sftp;
+    if (!sftp) {
+      reject(new Error("SFTP client not ready"));
+      return;
+    }
+
+    const writeStream = sftp.createWriteStream(remotePath);
+    let transferred = 0;
+    let finished = false;
+
+    // Store streams for cancellation
+    transfer.readStream = readStream;
+    transfer.writeStream = writeStream;
+
+    const cleanup = (err) => {
+      if (finished) return;
+      finished = true;
+
+      // Remove listeners to prevent memory leaks
+      readStream.removeAllListeners();
+      writeStream.removeAllListeners();
+
+      if (err) {
+        // Destroy streams on error
+        try { readStream.destroy(); } catch {}
+        try { writeStream.destroy(); } catch {}
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+
+    readStream.on('data', (chunk) => {
+      if (transfer.cancelled) {
+        cleanup(new Error('Transfer cancelled'));
+        return;
+      }
+      transferred += chunk.length;
+      sendProgress(transferred, fileSize);
+    });
+
+    readStream.on('error', (err) => cleanup(err));
+    writeStream.on('error', (err) => cleanup(err));
+    writeStream.on('close', () => {
+      if (transfer.cancelled) {
+        cleanup(new Error('Transfer cancelled'));
+      } else {
+        cleanup(null);
+      }
+    });
+
+    readStream.pipe(writeStream);
+  });
+}
+
+/**
+ * Download from SFTP to local file using streams (supports cancellation)
+ */
+async function downloadWithStreams(remotePath, localPath, client, fileSize, transfer, sendProgress) {
+  return new Promise((resolve, reject) => {
+    // Get the underlying sftp object from ssh2-sftp-client
+    const sftp = client.sftp;
+    if (!sftp) {
+      reject(new Error("SFTP client not ready"));
+      return;
+    }
+
+    const readStream = sftp.createReadStream(remotePath);
+    const writeStream = fs.createWriteStream(localPath);
+    let transferred = 0;
+    let finished = false;
+
+    // Store streams for cancellation
+    transfer.readStream = readStream;
+    transfer.writeStream = writeStream;
+
+    const cleanup = (err) => {
+      if (finished) return;
+      finished = true;
+
+      // Remove listeners to prevent memory leaks
+      readStream.removeAllListeners();
+      writeStream.removeAllListeners();
+
+      if (err) {
+        // Destroy streams on error
+        try { readStream.destroy(); } catch {}
+        try { writeStream.destroy(); } catch {}
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+
+    readStream.on('data', (chunk) => {
+      if (transfer.cancelled) {
+        cleanup(new Error('Transfer cancelled'));
+        return;
+      }
+      transferred += chunk.length;
+      sendProgress(transferred, fileSize);
+    });
+
+    readStream.on('error', (err) => cleanup(err));
+    writeStream.on('error', (err) => cleanup(err));
+    // Handle normal completion
+    writeStream.on('finish', () => {
+      if (transfer.cancelled) {
+        cleanup(new Error('Transfer cancelled'));
+      } else {
+        cleanup(null);
+      }
+    });
+    // Handle stream destruction (destroy() emits 'close' but not 'finish')
+    writeStream.on('close', () => {
+      if (transfer.cancelled) {
+        cleanup(new Error('Transfer cancelled'));
+      }
+    });
+
+    readStream.pipe(writeStream);
+  });
+}
+
 /**
  * Start a file transfer
  */
@@ -40,17 +172,18 @@ async function startTransfer(event, payload) {
     targetEncoding,
   } = payload;
   const sender = event.sender;
-  
+
   // Register transfer for cancellation
-  activeTransfers.set(transferId, { cancelled: false });
-  
+  const transfer = { cancelled: false, readStream: null, writeStream: null };
+  activeTransfers.set(transferId, transfer);
+
   let lastTime = Date.now();
   let lastTransferred = 0;
   let speed = 0;
-  
+
   const sendProgress = (transferred, total) => {
-    if (activeTransfers.get(transferId)?.cancelled) return;
-    
+    if (transfer.cancelled) return;
+
     const now = Date.now();
     const elapsed = now - lastTime;
     if (elapsed >= 100) {
@@ -58,25 +191,23 @@ async function startTransfer(event, payload) {
       lastTime = now;
       lastTransferred = transferred;
     }
-    
+
     sender.send("netcatty:transfer:progress", { transferId, transferred, speed, totalBytes: total });
   };
-  
+
   const sendComplete = () => {
     activeTransfers.delete(transferId);
     sender.send("netcatty:transfer:complete", { transferId });
   };
-  
+
   const sendError = (error) => {
     activeTransfers.delete(transferId);
     sender.send("netcatty:transfer:error", { transferId, error: error.message || String(error) });
   };
-  
-  const isCancelled = () => activeTransfers.get(transferId)?.cancelled;
-  
+
   try {
     let fileSize = totalBytes || 0;
-    
+
     // Get file size if not provided
     if (!fileSize) {
       if (sourceType === 'local') {
@@ -90,123 +221,124 @@ async function startTransfer(event, payload) {
         fileSize = stat.size;
       }
     }
-    
+
     // Send initial progress
     sendProgress(0, fileSize);
-    
+
     // Handle different transfer scenarios
     if (sourceType === 'local' && targetType === 'sftp') {
-      // Upload: Local -> SFTP
+      // Upload: Local -> SFTP using streams (supports cancellation)
       const client = sftpClients.get(targetSftpId);
       if (!client) throw new Error("Target SFTP session not found");
-      
+
       const dir = path.dirname(targetPath).replace(/\\/g, '/');
       try { await ensureRemoteDirForSession(targetSftpId, dir, targetEncoding); } catch {}
-      
+
       const encodedTargetPath = encodePathForSession(targetSftpId, targetPath, targetEncoding);
-      await client.fastPut(sourcePath, encodedTargetPath, {
-        step: (totalTransferred, chunk, total) => {
-          if (isCancelled()) {
-            throw new Error('Transfer cancelled');
-          }
-          sendProgress(totalTransferred, total);
-        }
-      });
-      
+      await uploadWithStreams(sourcePath, encodedTargetPath, client, fileSize, transfer, sendProgress);
+
     } else if (sourceType === 'sftp' && targetType === 'local') {
-      // Download: SFTP -> Local
+      // Download: SFTP -> Local using streams (supports cancellation)
       const client = sftpClients.get(sourceSftpId);
       if (!client) throw new Error("Source SFTP session not found");
-      
+
       const dir = path.dirname(targetPath);
       await fs.promises.mkdir(dir, { recursive: true });
-      
+
       const encodedSourcePath = encodePathForSession(sourceSftpId, sourcePath, sourceEncoding);
-      await client.fastGet(encodedSourcePath, targetPath, {
-        step: (totalTransferred, chunk, total) => {
-          if (isCancelled()) {
-            throw new Error('Transfer cancelled');
-          }
-          sendProgress(totalTransferred, total);
-        }
-      });
-      
+      await downloadWithStreams(encodedSourcePath, targetPath, client, fileSize, transfer, sendProgress);
+
     } else if (sourceType === 'local' && targetType === 'local') {
       // Local copy: use streams
       const dir = path.dirname(targetPath);
       await fs.promises.mkdir(dir, { recursive: true });
-      
+
       await new Promise((resolve, reject) => {
         const readStream = fs.createReadStream(sourcePath);
         const writeStream = fs.createWriteStream(targetPath);
         let transferred = 0;
-        
-        const transfer = activeTransfers.get(transferId);
-        if (transfer) {
-          transfer.readStream = readStream;
-          transfer.writeStream = writeStream;
-        }
-        
+        let finished = false;
+
+        transfer.readStream = readStream;
+        transfer.writeStream = writeStream;
+
+        const cleanup = (err) => {
+          if (finished) return;
+          finished = true;
+          readStream.removeAllListeners();
+          writeStream.removeAllListeners();
+          if (err) {
+            try { readStream.destroy(); } catch {}
+            try { writeStream.destroy(); } catch {}
+            reject(err);
+          } else {
+            resolve();
+          }
+        };
+
         readStream.on('data', (chunk) => {
-          if (isCancelled()) {
-            readStream.destroy();
-            writeStream.destroy();
-            reject(new Error('Transfer cancelled'));
+          if (transfer.cancelled) {
+            cleanup(new Error('Transfer cancelled'));
             return;
           }
           transferred += chunk.length;
           sendProgress(transferred, fileSize);
         });
-        
-        readStream.on('error', reject);
-        writeStream.on('error', reject);
-        writeStream.on('finish', resolve);
-        
+
+        readStream.on('error', cleanup);
+        writeStream.on('error', cleanup);
+        // Handle normal completion
+        writeStream.on('finish', () => {
+          if (transfer.cancelled) {
+            cleanup(new Error('Transfer cancelled'));
+          } else {
+            cleanup(null);
+          }
+        });
+        // Handle stream destruction (destroy() emits 'close' but not 'finish')
+        writeStream.on('close', () => {
+          if (transfer.cancelled) {
+            cleanup(new Error('Transfer cancelled'));
+          }
+        });
+
         readStream.pipe(writeStream);
       });
-      
+
     } else if (sourceType === 'sftp' && targetType === 'sftp') {
-      // SFTP to SFTP: download to temp then upload
+      // SFTP to SFTP: download to temp then upload using streams
       const tempPath = path.join(os.tmpdir(), `netcatty-transfer-${transferId}`);
-      
+
       const sourceClient = sftpClients.get(sourceSftpId);
       const targetClient = sftpClients.get(targetSftpId);
       if (!sourceClient) throw new Error("Source SFTP session not found");
       if (!targetClient) throw new Error("Target SFTP session not found");
-      
-      // Download phase (0-50%)
+
+      // Download phase (0-50%) - wrap progress to show 0-50%
       const encodedSourcePath = encodePathForSession(sourceSftpId, sourcePath, sourceEncoding);
-      await sourceClient.fastGet(encodedSourcePath, tempPath, {
-        step: (totalTransferred, chunk, total) => {
-          if (isCancelled()) {
-            throw new Error('Transfer cancelled');
-          }
-          sendProgress(Math.floor(totalTransferred / 2), fileSize);
-        }
-      });
-      
-      if (isCancelled()) {
+      const downloadProgress = (transferred, total) => {
+        sendProgress(Math.floor(transferred / 2), fileSize);
+      };
+      await downloadWithStreams(encodedSourcePath, tempPath, sourceClient, fileSize, transfer, downloadProgress);
+
+      if (transfer.cancelled) {
         try { await fs.promises.unlink(tempPath); } catch {}
         throw new Error('Transfer cancelled');
       }
-      
-      // Upload phase (50-100%)
+
+      // Upload phase (50-100%) - wrap progress to show 50-100%
       const dir = path.dirname(targetPath).replace(/\\/g, '/');
       try { await ensureRemoteDirForSession(targetSftpId, dir, targetEncoding); } catch {}
-      
+
       const encodedTargetPath = encodePathForSession(targetSftpId, targetPath, targetEncoding);
-      await targetClient.fastPut(tempPath, encodedTargetPath, {
-        step: (totalTransferred, chunk, total) => {
-          if (isCancelled()) {
-            throw new Error('Transfer cancelled');
-          }
-          sendProgress(Math.floor(fileSize / 2) + Math.floor(totalTransferred / 2), fileSize);
-        }
-      });
-      
+      const uploadProgress = (transferred, total) => {
+        sendProgress(Math.floor(fileSize / 2) + Math.floor(transferred / 2), fileSize);
+      };
+      await uploadWithStreams(tempPath, encodedTargetPath, targetClient, fileSize, transfer, uploadProgress);
+
       // Cleanup temp file
       try { await fs.promises.unlink(tempPath); } catch {}
-      
+
     } else {
       throw new Error("Invalid transfer configuration");
     }
@@ -232,16 +364,24 @@ async function startTransfer(event, payload) {
  */
 async function cancelTransfer(event, payload) {
   const { transferId } = payload;
+  console.log('[transferBridge] cancelTransfer called for:', transferId);
   const transfer = activeTransfers.get(transferId);
+  console.log('[transferBridge] Found transfer:', !!transfer, 'activeTransfers keys:', Array.from(activeTransfers.keys()));
   if (transfer) {
     transfer.cancelled = true;
+    console.log('[transferBridge] Set cancelled=true for transfer:', transferId);
+
+    // Destroy streams to immediately stop the transfer
     if (transfer.readStream) {
-      try { transfer.readStream.destroy(); } catch {}
+      console.log('[transferBridge] Destroying read stream');
+      try { transfer.readStream.destroy(); } catch (e) { console.log('[transferBridge] Error destroying readStream:', e); }
     }
     if (transfer.writeStream) {
-      try { transfer.writeStream.destroy(); } catch {}
+      console.log('[transferBridge] Destroying write stream');
+      try { transfer.writeStream.destroy(); } catch (e) { console.log('[transferBridge] Error destroying writeStream:', e); }
     }
-    activeTransfers.delete(transferId);
+
+    console.log('[transferBridge] Transfer marked for cancellation');
   }
   return { success: true };
 }

electron/preload.cjs

@@ -1,4 +1,4 @@
-const { ipcRenderer, contextBridge } = require("electron");
+const { ipcRenderer, contextBridge, webUtils } = require("electron");
 
 const dataListeners = new Map();
 const exitListeners = new Map();
@@ -10,6 +10,8 @@ const authFailedListeners = new Map();
 const languageChangeListeners = new Set();
 const fullscreenChangeListeners = new Set();
 const keyboardInteractiveListeners = new Set();
+const passphraseListeners = new Set();
+const passphraseTimeoutListeners = new Set();
 
 ipcRenderer.on("netcatty:data", (_event, payload) => {
   const set = dataListeners.get(payload.sessionId);
@@ -98,6 +100,28 @@ ipcRenderer.on("netcatty:keyboard-interactive", (_event, payload) => {
   });
 });
 
+// Passphrase request events for encrypted SSH keys
+ipcRenderer.on("netcatty:passphrase-request", (_event, payload) => {
+  passphraseListeners.forEach((cb) => {
+    try {
+      cb(payload);
+    } catch (err) {
+      console.error("Passphrase request callback failed", err);
+    }
+  });
+});
+
+// Passphrase timeout events (request expired)
+ipcRenderer.on("netcatty:passphrase-timeout", (_event, payload) => {
+  passphraseTimeoutListeners.forEach((cb) => {
+    try {
+      cb(payload);
+    } catch (err) {
+      console.error("Passphrase timeout callback failed", err);
+    }
+  });
+});
+
 // Transfer progress events
 ipcRenderer.on("netcatty:transfer:progress", (_event, payload) => {
   const cb = transferProgressListeners.get(payload.transferId);
@@ -318,6 +342,29 @@ const api = {
       cancelled,
     });
   },
+  // Passphrase request for encrypted SSH keys
+  onPassphraseRequest: (cb) => {
+    passphraseListeners.add(cb);
+    return () => passphraseListeners.delete(cb);
+  },
+  respondPassphrase: async (requestId, passphrase, cancelled = false) => {
+    return ipcRenderer.invoke("netcatty:passphrase:respond", {
+      requestId,
+      passphrase,
+      cancelled,
+    });
+  },
+  respondPassphraseSkip: async (requestId) => {
+    return ipcRenderer.invoke("netcatty:passphrase:respond", {
+      requestId,
+      passphrase: '',
+      skipped: true,
+    });
+  },
+  onPassphraseTimeout: (cb) => {
+    passphraseTimeoutListeners.add(cb);
+    return () => passphraseTimeoutListeners.delete(cb);
+  },
   openSftp: async (options) => {
     const result = await ipcRenderer.invoke("netcatty:sftp:open", options);
     return result.sftpId;
@@ -626,6 +673,15 @@ const api = {
     ipcRenderer.invoke("netcatty:sessionLogs:autoSave", payload),
   openSessionLogsDir: (directory) =>
     ipcRenderer.invoke("netcatty:sessionLogs:openDir", { directory }),
+
+  // Get file path from File object (for drag-and-drop)
+  getPathForFile: (file) => {
+    try {
+      return webUtils.getPathForFile(file);
+    } catch {
+      return undefined;
+    }
+  },
 };
 
 // Merge with existing netcatty (if any) to avoid stale objects on hot reload

eslint.config.js

@@ -7,7 +7,7 @@ import reactHooks from "eslint-plugin-react-hooks";
 export default [
   js.configs.recommended,
   {
-    ignores: ["node_modules/**", "dist/**", "electron/**", "scripts/**", "public/monaco/**"],
+    ignores: ["node_modules/**", "dist/**", "electron/**", "scripts/**", "public/monaco/**", ".github/**"],
   },
   {
     files: ["**/*.{ts,tsx}"],

global.d.ts

@@ -245,6 +245,27 @@ declare global {
       cancelled?: boolean
     ): Promise<{ success: boolean; error?: string }>;
 
+    // Passphrase request for encrypted SSH keys
+    onPassphraseRequest?(
+      cb: (request: {
+        requestId: string;
+        keyPath: string;
+        keyName: string;
+        hostname?: string;
+      }) => void
+    ): () => void;
+    respondPassphrase?(
+      requestId: string,
+      passphrase: string,
+      cancelled?: boolean
+    ): Promise<{ success: boolean; error?: string }>;
+    respondPassphraseSkip?(
+      requestId: string
+    ): Promise<{ success: boolean; error?: string }>;
+    onPassphraseTimeout?(
+      cb: (event: { requestId: string }) => void
+    ): () => void;
+
     // SFTP operations
     openSftp(options: NetcattySSHOptions): Promise<string>;
     listSftp(sftpId: string, path: string, encoding?: SftpFilenameEncoding): Promise<RemoteFile[]>;
@@ -520,6 +541,9 @@ declare global {
       directory: string;
     }): Promise<{ success: boolean; error?: string; filePath?: string }>;
     openSessionLogsDir?(directory: string): Promise<{ success: boolean; error?: string }>;
+
+    // Get file path from File object (for drag-and-drop, uses Electron's webUtils)
+    getPathForFile?(file: File): string | undefined;
   }
 
   interface Window {

infrastructure/config/storageKeys.ts

@@ -28,6 +28,7 @@ export const STORAGE_KEY_SHELL_HISTORY = 'netcatty_shell_history_v1';
 export const STORAGE_KEY_CONNECTION_LOGS = 'netcatty_connection_logs_v1';
 export const STORAGE_KEY_IDENTITIES = 'netcatty_identities_v1';
 export const STORAGE_KEY_VAULT_HOSTS_VIEW_MODE = 'netcatty_vault_hosts_view_mode_v1';
+export const STORAGE_KEY_VAULT_HOSTS_TREE_EXPANDED = 'netcatty_vault_hosts_tree_expanded_v1';
 export const STORAGE_KEY_VAULT_KEYS_VIEW_MODE = 'netcatty_vault_keys_view_mode_v1';
 export const STORAGE_KEY_VAULT_SNIPPETS_VIEW_MODE = 'netcatty_vault_snippets_view_mode_v1';
 export const STORAGE_KEY_VAULT_KNOWN_HOSTS_VIEW_MODE = 'netcatty_vault_known_hosts_view_mode_v1';

infrastructure/config/uiThemes.ts

@@ -177,9 +177,59 @@ export const LIGHT_UI_THEMES: UiThemePreset[] = [
       ring: "24 80% 50%",
     },
   },
+  {
+    id: "lavender",
+    name: "Lavender",
+    tokens: {
+      background: "270 30% 97%",
+      foreground: "222 47% 12%",
+      card: "270 30% 99%",
+      cardForeground: "222 47% 12%",
+      popover: "270 30% 99%",
+      popoverForeground: "222 47% 12%",
+      primary: "270 70% 55%",
+      primaryForeground: "0 0% 100%",
+      secondary: "270 20% 92%",
+      secondaryForeground: "222 47% 12%",
+      muted: "270 20% 92%",
+      mutedForeground: "220 10% 45%",
+      accent: "270 70% 55%",
+      accentForeground: "222 47% 12%",
+      destructive: "0 70% 50%",
+      destructiveForeground: "0 0% 100%",
+      border: "270 18% 86%",
+      input: "270 18% 86%",
+      ring: "270 70% 55%",
+    },
+  },
 ];
 
 export const DARK_UI_THEMES: UiThemePreset[] = [
+  {
+    id: "pure-black",
+    name: "Pure Black",
+    tokens: {
+      background: "0 0% 0%",
+      foreground: "0 0% 95%",
+      card: "0 0% 5%",
+      cardForeground: "0 0% 95%",
+      popover: "0 0% 5%",
+      popoverForeground: "0 0% 95%",
+      primary: "210 90% 60%",
+      primaryForeground: "0 0% 100%",
+      secondary: "0 0% 0%",
+      secondaryForeground: "0 0% 92%",
+      muted: "0 0% 15%",
+      mutedForeground: "0 0% 65%",
+      accent: "210 90% 60%",
+      accentForeground: "0 0% 100%",
+      destructive: "0 70% 50%",
+      destructiveForeground: "0 0% 100%",
+      border: "0 0% 12%",
+      input: "0 0% 12%",
+      ring: "210 90% 60%",
+    },
+  },
   {
     id: "midnight",
     name: "Midnight",

lib/sftpFileUtils.ts

@@ -3,6 +3,8 @@
  * Helper functions for file type detection and extension handling
  */
 
+import { netcattyBridge } from "../infrastructure/services/netcattyBridge";
+
 // Common text file extensions
 const TEXT_EXTENSIONS = new Set([
   // Code/Scripts
@@ -538,6 +540,22 @@ async function processEntriesIteratively(
   return results;
 }
 
+/**
+ * Get the local file path for a File object using Electron's webUtils API
+ * Falls back to the legacy file.path property if webUtils is not available
+ */
+export function getPathForFile(file: File): string | undefined {
+  try {
+    // Try Electron's webUtils API (exposed via preload)
+    const path = netcattyBridge.get()?.getPathForFile?.(file);
+    if (path) return path;
+    // Fallback: try legacy file.path property
+    return (file as File & { path?: string }).path;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Extract all files and directories from a DataTransfer object
  * Supports both regular files and folders dropped from the OS
@@ -553,6 +571,20 @@ export async function extractDropEntries(
 ): Promise<DropEntry[]> {
   const items = dataTransfer.items;
 
+  // Build a map of file/folder name to path from the original files in DataTransfer.files
+  const filePathMap = new Map<string, string>();
+  const filesWithPath = dataTransfer.files;
+  console.log('[extractDropEntries] DataTransfer.files count:', filesWithPath.length);
+  for (let i = 0; i < filesWithPath.length; i++) {
+    const f = filesWithPath[i];
+    const path = getPathForFile(f);
+    console.log('[extractDropEntries] File:', { name: f.name, path, size: f.size });
+    if (path) {
+      filePathMap.set(f.name, path);
+    }
+  }
+  console.log('[extractDropEntries] filePathMap:', Object.fromEntries(filePathMap));
+
   // Check if webkitGetAsEntry is supported (for folder access)
   if (items && items.length > 0 && typeof items[0].webkitGetAsEntry === 'function') {
     // Collect all entries first (getAsEntry must be called synchronously)
@@ -568,9 +600,46 @@ export async function extractDropEntries(
     }
 
     // Process entries iteratively (non-recursive) to avoid stack overflow
-    return await processEntriesIteratively(entries);
+    const results = await processEntriesIteratively(entries);
+
+    // Restore the 'path' property for all files
+    // Try to get the path directly from webUtils.getPathForFile for each file
+    // This is more reliable than trying to reconstruct from folder paths
+    for (const result of results) {
+      if (result.file) {
+        // First try to get path directly from the file
+        const directPath = getPathForFile(result.file);
+        if (directPath) {
+          (result.file as File & { path?: string }).path = directPath;
+          console.log('[extractDropEntries] Direct path for:', { relativePath: result.relativePath, path: directPath });
+        } else {
+          // Fallback: try to reconstruct from root folder path
+          const pathParts = result.relativePath.split('/');
+          const rootName = pathParts[0];
+          const rootPath = filePathMap.get(rootName);
+          console.log('[extractDropEntries] Fallback matching:', { relativePath: result.relativePath, rootName, rootPath });
+
+          if (rootPath) {
+            if (pathParts.length === 1) {
+              // Root-level file: use the path directly
+              (result.file as File & { path?: string }).path = rootPath;
+            } else {
+              // Nested file in a folder: construct full path
+              // rootPath is the path to the root folder, we need to append the rest
+              const restOfPath = pathParts.slice(1).join('/');
+              const separator = rootPath.includes('\\') ? '\\' : '/';
+              const fullPath = rootPath + separator + restOfPath.replace(/\//g, separator);
+              (result.file as File & { path?: string }).path = fullPath;
+            }
+          }
+        }
+      }
+    }
+
+    return results;
   } else {
     // Fallback: use regular FileList (no folder support)
+    // Files from FileList in Electron already have the 'path' property
     const results: DropEntry[] = [];
     const files = dataTransfer.files;
     for (let i = 0; i < files.length; i++) {

lib/uploadService.ts

@@ -6,7 +6,7 @@
  * cancellation support, and works for both local and remote (SFTP) uploads.
  */
 
-import { extractDropEntries, DropEntry } from "./sftpFileUtils";
+import { extractDropEntries, DropEntry, getPathForFile } from "./sftpFileUtils";
 
 // ============================================================================
 // Types
@@ -72,6 +72,23 @@ export interface UploadBridge {
     onError?: (error: string) => void
   ) => Promise<{ success: boolean; cancelled?: boolean } | undefined>;
   cancelSftpUpload?: (taskId: string) => Promise<unknown>;
+  /** Stream transfer using local file path (avoids loading file into memory) */
+  startStreamTransfer?: (
+    options: {
+      transferId: string;
+      sourcePath: string;
+      targetPath: string;
+      sourceType: 'local' | 'sftp';
+      targetType: 'local' | 'sftp';
+      sourceSftpId?: string;
+      targetSftpId?: string;
+      totalBytes?: number;
+    },
+    onProgress?: (transferred: number, total: number, speed: number) => void,
+    onComplete?: () => void,
+    onError?: (error: string) => void
+  ) => Promise<{ transferId: string; totalBytes?: number; error?: string; cancelled?: boolean }>;
+  cancelTransfer?: (transferId: string) => Promise<void>;
 }
 
 export interface UploadConfig {
@@ -150,17 +167,24 @@ export class UploadController {
    */
   async cancel(): Promise<void> {
     this.cancelled = true;
-
-    if (!this.bridge?.cancelSftpUpload) {
-      return;
-    }
+    console.log('[UploadController] Cancelling uploads, active IDs:', Array.from(this.activeFileTransferIds));
 
     // Cancel all active file uploads
     const activeIds = Array.from(this.activeFileTransferIds);
     for (const transferId of activeIds) {
       try {
-        await this.bridge.cancelSftpUpload(transferId);
-      } catch {
+        // Try cancelTransfer first (for stream transfers)
+        if (this.bridge?.cancelTransfer) {
+          console.log('[UploadController] Calling cancelTransfer for:', transferId);
+          await this.bridge.cancelTransfer(transferId);
+        }
+        // Also try cancelSftpUpload (for legacy uploads)
+        if (this.bridge?.cancelSftpUpload) {
+          console.log('[UploadController] Calling cancelSftpUpload for:', transferId);
+          await this.bridge.cancelSftpUpload(transferId);
+        }
+      } catch (e) {
+        console.log('[UploadController] Cancel error:', e);
         // Ignore cancel errors
       }
     }
@@ -168,8 +192,16 @@ export class UploadController {
     // Also cancel current one if not in the set
     if (this.currentTransferId && !activeIds.includes(this.currentTransferId)) {
       try {
-        await this.bridge.cancelSftpUpload(this.currentTransferId);
-      } catch {
+        if (this.bridge?.cancelTransfer) {
+          console.log('[UploadController] Calling cancelTransfer for current:', this.currentTransferId);
+          await this.bridge.cancelTransfer(this.currentTransferId);
+        }
+        if (this.bridge?.cancelSftpUpload) {
+          console.log('[UploadController] Calling cancelSftpUpload for current:', this.currentTransferId);
+          await this.bridge.cancelSftpUpload(this.currentTransferId);
+        }
+      } catch (e) {
+        console.log('[UploadController] Cancel current error:', e);
         // Ignore cancel errors
       }
     }
@@ -279,14 +311,16 @@ export async function uploadFromDataTransfer(
 }
 
 /**
- * Upload a FileList with bundled folder support
+ * Upload a FileList or File array with bundled folder support
  */
 export async function uploadFromFileList(
-  fileList: FileList,
+  fileList: FileList | File[],
   config: UploadConfig,
   controller?: UploadController
 ): Promise<UploadResult[]> {
+  console.log('[uploadFromFileList] Called with', fileList.length, 'files');
   const { targetPath, sftpId, isLocal, bridge, joinPath, callbacks } = config;
+  console.log('[uploadFromFileList] Config:', { targetPath, sftpId, isLocal });
 
   if (controller) {
     controller.reset();
@@ -294,16 +328,29 @@ export async function uploadFromFileList(
   }
 
   // Convert FileList to DropEntry array (simple files, no folders)
-  const entries: DropEntry[] = Array.from(fileList).map(file => ({
-    file,
-    relativePath: file.name,
-    isDirectory: false,
-  }));
+  // Use getPathForFile to get the local file path for stream transfer
+  const entries: DropEntry[] = Array.from(fileList).map(file => {
+    const localPath = getPathForFile(file);
+    console.log('[uploadFromFileList] File:', { name: file.name, size: file.size, localPath });
+    if (localPath) {
+      // Set the path property on the file for stream transfer
+      (file as File & { path?: string }).path = localPath;
+    }
+    return {
+      file,
+      relativePath: file.name,
+      isDirectory: false,
+    };
+  });
+
+  console.log('[uploadFromFileList] Created', entries.length, 'entries');
 
   if (entries.length === 0) {
+    console.log('[uploadFromFileList] No entries, returning empty');
     return [];
   }
 
+  console.log('[uploadFromFileList] Calling uploadEntries');
   return uploadEntries(entries, targetPath, sftpId, isLocal, bridge, joinPath, callbacks, controller);
 }
 
@@ -470,96 +517,196 @@ async function uploadEntries(
             }
           }
 
-          const arrayBuffer = await entry.file.arrayBuffer();
+          // Check if file has a local path (Electron provides file.path for dropped files)
+          const localFilePath = (entry.file as File & { path?: string }).path;
 
-          if (isLocal) {
-            if (!bridge.writeLocalFile) {
-              throw new Error("writeLocalFile not available");
-            }
-            await bridge.writeLocalFile(entryTargetPath, arrayBuffer);
-          } else if (sftpId) {
-            if (bridge.writeSftpBinaryWithProgress) {
-              let pendingProgressUpdate: { transferred: number; total: number; speed: number } | null = null;
-              let rafScheduled = false;
+          console.log('[UploadService] Processing file:', {
+            relativePath: entry.relativePath,
+            localFilePath,
+            hasStreamTransfer: !!bridge.startStreamTransfer,
+            sftpId,
+            isLocal,
+            fileSize: fileTotalBytes,
+          });
 
-              const onProgress = (transferred: number, total: number, speed: number) => {
-                if (controller?.isCancelled()) return;
+          // Use stream transfer if available and we have a local file path (avoids loading file into memory)
+          if (localFilePath && bridge.startStreamTransfer && sftpId && !isLocal) {
+            console.log('[UploadService] Using stream transfer for:', localFilePath);
+            let pendingProgressUpdate: { transferred: number; total: number; speed: number } | null = null;
+            let rafScheduled = false;
 
-                pendingProgressUpdate = { transferred, total, speed };
+            const onProgress = (transferred: number, total: number, speed: number) => {
+              if (controller?.isCancelled()) return;
 
-                if (!rafScheduled) {
-                  rafScheduled = true;
-                  requestAnimationFrame(() => {
-                    rafScheduled = false;
-                    const update = pendingProgressUpdate;
-                    pendingProgressUpdate = null;
+              pendingProgressUpdate = { transferred, total, speed };
 
-                    if (update && !controller?.isCancelled() && callbacks?.onTaskProgress) {
-                      if (bundleTaskId) {
-                        const progress = bundleProgress.get(bundleTaskId);
-                        if (progress) {
-                          const newTransferred = progress.completedFilesBytes + update.transferred;
-                          progress.transferredBytes = newTransferred;
-                          progress.currentSpeed = update.speed;
-                          callbacks.onTaskProgress(bundleTaskId, {
-                            transferred: newTransferred,
-                            total: progress.totalBytes,
-                            speed: update.speed,
-                            percent: progress.totalBytes > 0 ? (newTransferred / progress.totalBytes) * 100 : 0,
-                          });
-                        }
-                      } else if (standaloneTransferId) {
-                        callbacks.onTaskProgress(standaloneTransferId, {
-                          transferred: update.transferred,
-                          total: update.total,
+              if (!rafScheduled) {
+                rafScheduled = true;
+                requestAnimationFrame(() => {
+                  rafScheduled = false;
+                  const update = pendingProgressUpdate;
+                  pendingProgressUpdate = null;
+
+                  if (update && !controller?.isCancelled() && callbacks?.onTaskProgress) {
+                    if (bundleTaskId) {
+                      const progress = bundleProgress.get(bundleTaskId);
+                      if (progress) {
+                        const newTransferred = progress.completedFilesBytes + update.transferred;
+                        progress.transferredBytes = newTransferred;
+                        progress.currentSpeed = update.speed;
+                        callbacks.onTaskProgress(bundleTaskId, {
+                          transferred: newTransferred,
+                          total: progress.totalBytes,
                           speed: update.speed,
-                          percent: update.total > 0 ? (update.transferred / update.total) * 100 : 0,
+                          percent: progress.totalBytes > 0 ? (newTransferred / progress.totalBytes) * 100 : 0,
                         });
                       }
+                    } else if (standaloneTransferId) {
+                      callbacks.onTaskProgress(standaloneTransferId, {
+                        transferred: update.transferred,
+                        total: update.total,
+                        speed: update.speed,
+                        percent: update.total > 0 ? (update.transferred / update.total) * 100 : 0,
+                      });
                     }
-                  });
-                }
-              };
-
-              // Use unique file transfer ID for backend cancellation tracking
-              const fileTransferId = crypto.randomUUID();
-              controller?.addActiveTransfer(fileTransferId);
-
-              let result;
-              try {
-                result = await bridge.writeSftpBinaryWithProgress(
-                  sftpId,
-                  entryTargetPath,
-                  arrayBuffer,
-                  fileTransferId,
-                  onProgress,
-                  undefined,
-                  undefined
-                );
-              } finally {
-                controller?.removeActiveTransfer(fileTransferId);
+                  }
+                });
               }
+            };
 
-              if (result?.cancelled) {
-                wasCancelled = true;
-                const taskId = bundleTaskId || standaloneTransferId;
-                if (taskId) {
-                  callbacks?.onTaskCancelled?.(taskId);
-                }
-                break;
-              }
+            const fileTransferId = crypto.randomUUID();
+            controller?.addActiveTransfer(fileTransferId);
 
-              if (!result || result.success === false) {
-                if (bridge.writeSftpBinary) {
-                  await bridge.writeSftpBinary(sftpId, entryTargetPath, arrayBuffer);
-                } else {
-                  throw new Error("Upload failed and no fallback method available");
-                }
+            let streamResult: { transferId: string; totalBytes?: number; error?: string; cancelled?: boolean } | undefined;
+            try {
+              streamResult = await bridge.startStreamTransfer(
+                {
+                  transferId: fileTransferId,
+                  sourcePath: localFilePath,
+                  targetPath: entryTargetPath,
+                  sourceType: 'local',
+                  targetType: 'sftp',
+                  targetSftpId: sftpId,
+                  totalBytes: fileTotalBytes,
+                },
+                onProgress,
+                undefined,
+                undefined
+              );
+            } finally {
+              controller?.removeActiveTransfer(fileTransferId);
+            }
+
+            if (streamResult?.cancelled || streamResult?.error?.includes('cancelled')) {
+              wasCancelled = true;
+              const taskId = bundleTaskId || standaloneTransferId;
+              if (taskId) {
+                callbacks?.onTaskCancelled?.(taskId);
+              }
+              break;
+            }
+
+            if (streamResult?.error) {
+              throw new Error(streamResult.error);
+            }
+          } else {
+            // Fallback: load file into memory (for small files or when stream transfer is not available)
+            console.log('[UploadService] FALLBACK: Loading file into memory:', {
+              relativePath: entry.relativePath,
+              fileSize: fileTotalBytes,
+              reason: !localFilePath ? 'no local path' : !bridge.startStreamTransfer ? 'no stream transfer' : 'other',
+            });
+            const arrayBuffer = await entry.file.arrayBuffer();
+
+            if (isLocal) {
+              if (!bridge.writeLocalFile) {
+                throw new Error("writeLocalFile not available");
+              }
+              await bridge.writeLocalFile(entryTargetPath, arrayBuffer);
+            } else if (sftpId) {
+              if (bridge.writeSftpBinaryWithProgress) {
+                let pendingProgressUpdate: { transferred: number; total: number; speed: number } | null = null;
+                let rafScheduled = false;
+
+                const onProgress = (transferred: number, total: number, speed: number) => {
+                  if (controller?.isCancelled()) return;
+
+                  pendingProgressUpdate = { transferred, total, speed };
+
+                  if (!rafScheduled) {
+                    rafScheduled = true;
+                    requestAnimationFrame(() => {
+                      rafScheduled = false;
+                      const update = pendingProgressUpdate;
+                      pendingProgressUpdate = null;
+
+                      if (update && !controller?.isCancelled() && callbacks?.onTaskProgress) {
+                        if (bundleTaskId) {
+                          const progress = bundleProgress.get(bundleTaskId);
+                          if (progress) {
+                            const newTransferred = progress.completedFilesBytes + update.transferred;
+                            progress.transferredBytes = newTransferred;
+                            progress.currentSpeed = update.speed;
+                            callbacks.onTaskProgress(bundleTaskId, {
+                              transferred: newTransferred,
+                              total: progress.totalBytes,
+                              speed: update.speed,
+                              percent: progress.totalBytes > 0 ? (newTransferred / progress.totalBytes) * 100 : 0,
+                            });
+                          }
+                        } else if (standaloneTransferId) {
+                          callbacks.onTaskProgress(standaloneTransferId, {
+                            transferred: update.transferred,
+                            total: update.total,
+                            speed: update.speed,
+                            percent: update.total > 0 ? (update.transferred / update.total) * 100 : 0,
+                          });
+                        }
+                      }
+                    });
+                  }
+                };
+
+                // Use unique file transfer ID for backend cancellation tracking
+                const fileTransferId = crypto.randomUUID();
+                controller?.addActiveTransfer(fileTransferId);
+
+                let result;
+                try {
+                  result = await bridge.writeSftpBinaryWithProgress(
+                    sftpId,
+                    entryTargetPath,
+                    arrayBuffer,
+                    fileTransferId,
+                    onProgress,
+                    undefined,
+                    undefined
+                  );
+                } finally {
+                  controller?.removeActiveTransfer(fileTransferId);
+                }
+
+                if (result?.cancelled) {
+                  wasCancelled = true;
+                  const taskId = bundleTaskId || standaloneTransferId;
+                  if (taskId) {
+                    callbacks?.onTaskCancelled?.(taskId);
+                  }
+                  break;
+                }
+
+                if (!result || result.success === false) {
+                  if (bridge.writeSftpBinary) {
+                    await bridge.writeSftpBinary(sftpId, entryTargetPath, arrayBuffer);
+                  } else {
+                    throw new Error("Upload failed and no fallback method available");
+                  }
+                }
+              } else if (bridge.writeSftpBinary) {
+                await bridge.writeSftpBinary(sftpId, entryTargetPath, arrayBuffer);
+              } else {
+                throw new Error("No SFTP write method available");
               }
-            } else if (bridge.writeSftpBinary) {
-              await bridge.writeSftpBinary(sftpId, entryTargetPath, arrayBuffer);
-            } else {
-              throw new Error("No SFTP write method available");
             }
           }
 

package-lock.json

@@ -1007,7 +1007,6 @@
       "integrity": "sha512-H3mcG6ZDLTlYfaSNi0iOKkigqMFvkTKlGUYlD8GW7nNOYRrevuA46iTypPyv+06V3fEmvvazfntkBU34L0azAw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.28.6",
         "@babel/generator": "^7.28.6",
@@ -1654,6 +1653,7 @@
       "dev": true,
       "license": "BSD-2-Clause",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "cross-dirname": "^0.1.0",
         "debug": "^4.3.4",
@@ -1675,6 +1675,7 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "graceful-fs": "^4.2.0",
         "jsonfile": "^6.0.1",
@@ -1691,6 +1692,7 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "universalify": "^2.0.0"
       },
@@ -1705,6 +1707,7 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "engines": {
         "node": ">= 10.0.0"
       }
@@ -5618,7 +5621,6 @@
       "integrity": "sha512-eEXsVvLPu8Z4PkFibtuFJLJOTAV/nPdgtSjkGoPpddpFk3/ym2oy97jynY6ic2m6+nc5M8SE1e9v/mHKsulcJg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
         "@typescript-eslint/scope-manager": "8.53.0",
@@ -5648,7 +5650,6 @@
       "integrity": "sha512-npiaib8XzbjtzS2N4HlqPvlpxpmZ14FjSJrteZpPxGUaYPlvhzlzUZ4mZyABo0EFrOWnvyd0Xxroq//hKhtAWg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.53.0",
         "@typescript-eslint/types": "8.53.0",
@@ -5927,8 +5928,7 @@
       "version": "5.5.0",
       "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-5.5.0.tgz",
       "integrity": "sha512-hqJHYaQb5OptNunnyAnkHyM8aCjZ1MEIDTQu1iIbbTD/xops91NB5yq1ZK/dC2JDbVWtF23zUtl9JE2NqwT87A==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@yarnpkg/lockfile": {
       "version": "1.1.0",
@@ -5960,7 +5960,6 @@
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5993,7 +5992,6 @@
       "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
         "fast-json-stable-stringify": "^2.0.0",
@@ -6401,7 +6399,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -7061,7 +7058,8 @@
       "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
       "dev": true,
       "license": "MIT",
-      "optional": true
+      "optional": true,
+      "peer": true
     },
     "node_modules/cross-env": {
       "version": "10.1.0",
@@ -7301,7 +7299,6 @@
       "integrity": "sha512-ce4Ogns4VMeisIuCSK0C62umG0lFy012jd8LMZ6w/veHUeX4fqfDrGe+HTWALAEwK6JwKP+dhPvizhArSOsFbg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "app-builder-lib": "26.4.0",
         "builder-util": "26.3.4",
@@ -7627,6 +7624,7 @@
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@electron/asar": "^3.2.1",
         "debug": "^4.1.1",
@@ -7647,6 +7645,7 @@
       "integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "graceful-fs": "^4.1.2",
         "jsonfile": "^4.0.0",
@@ -7871,7 +7870,6 @@
       "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -10154,7 +10152,6 @@
       "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.55.1.tgz",
       "integrity": "sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "dompurify": "3.2.7",
         "marked": "14.0.0"
@@ -10780,7 +10777,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -10839,6 +10835,7 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "commander": "^9.4.0"
       },
@@ -10856,6 +10853,7 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "engines": {
         "node": "^12.20.0 || >=14"
       }
@@ -10956,7 +10954,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.3.tgz",
       "integrity": "sha512-Ku/hhYbVjOQnXDZFv2+RibmLFGwFdeeKHFcOTlrt7xplBnya5OGn/hIRDsqDiSUcfORsDC7MPxwork8jBwsIWA==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -10966,7 +10963,6 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.3.tgz",
       "integrity": "sha512-yELu4WmLPw5Mr/lmeEpox5rw3RETacE++JgHqQzd2dg+YbJuat3jH4ingc+WPZhxaoFzdv9y33G+F7Nl5O0GBg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "scheduler": "^0.27.0"
       },
@@ -11895,6 +11891,7 @@
       "integrity": "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mkdirp": "^0.5.1",
         "rimraf": "~2.6.2"
@@ -11958,6 +11955,7 @@
       "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "minimist": "^1.2.6"
       },
@@ -11972,6 +11970,7 @@
       "deprecated": "Rimraf versions prior to v4 are no longer supported",
       "dev": true,
       "license": "ISC",
+      "peer": true,
       "dependencies": {
         "glob": "^7.1.3"
       },
@@ -12133,7 +12132,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -12336,7 +12334,6 @@
       "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.27.0",
         "fdir": "^6.5.0",
@@ -12691,7 +12688,6 @@
       "integrity": "sha512-k7Nwx6vuWx1IJ9Bjuf4Zt1PEllcwe7cls3VNzm4CQ1/hgtFUK2bRNG3rvnpPUhFjmqJKAKtjV576KnUkHocg/g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }