Show connection details in host selector (#173 )

* Show user@host:port in host selector Replace the host selector subtitle with username, hostname, and port to surface the actual connection target details. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Filter serial hosts from selector Exclude serial protocol entries from SelectHostPanel results and counts to avoid offering non-SSH targets in selection flows. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Enable opt-in MFA for SSH exec export (#172 )
2026-02-02 01:56:07 +08:00 · 2026-02-02 01:32:41 +08:00 · 2026-02-02 01:05:59 +08:00 · 2026-02-02 00:58:44 +08:00 · 2026-02-01 23:06:01 +08:00 · 2026-02-01 23:04:08 +08:00
26 changed files with 1045 additions and 345 deletions
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -1,19 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(npx tsc:*)",
-      "Bash(npm run lint:*)",
-      "Bash(npm run build:*)",
-      "Bash(gh pr view:*)",
-      "Bash(gh pr list:*)",
-      "Bash(gh api:*)",
-      "Bash(ls:*)",
-      "Bash(gh issue view:*)",
-      "Bash(npm run dev:*)",
-      "Bash(git checkout:*)",
-      "Bash(git commit -m \"$\\(cat <<''EOF''\nfeat\\(sftp\\): bundle folder uploads and improve cancel/delete operations\n\n- Bundle folder uploads as single tasks showing aggregate progress\n- Add unique file transfer IDs for proper cancellation tracking\n- Fix cancel button to call cancelExternalUpload for external uploads\n- Improve backend cancel detection using cancelled flag instead of error message\n- Use SSH exec with rm -rf for fast folder deletion on remote servers\n- Add FolderUp icon for folder upload tasks in transfer queue\n- Add i18n key for upload cancelled message\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nEOF\n\\)\")",
-      "Bash(git push:*)",
-      "Bash(gh pr create --title \"feat\\(sftp\\): bundle folder uploads and improve cancel/delete operations\" --body \"$\\(cat <<''EOF''\n## Summary\n\n- **Bundle folder uploads as single tasks** - When uploading a folder from computer, show it as one aggregated task with total progress instead of individual files\n- **Fix cancel upload** - Properly cancel external uploads by calling the correct cancel function and using unique file transfer IDs for backend tracking\n- **Fast folder deletion** - Use SSH exec with `rm -rf` command for remote folder deletion instead of slow recursive SFTP rmdir\n- **UI improvements** - Add FolderUp icon for folder upload tasks, add cancelled status toast message\n\n## Changes\n\n### Bundle folder uploads\n- Added `detectRootFolders` helper to group entries by root folder\n- Create single bundled task per folder with aggregate byte count\n- Track progress across all files in the bundle\n\n### Fix cancel upload\n- Each file now uses unique `fileTransferId` for backend cancellation tracking\n- Added `activeFileTransferIdsRef` to track all active uploads\n- Modified `cancelExternalUpload` to cancel all active file uploads\n- Backend now checks `uploadState.cancelled` flag instead of just error message\n- Frontend catch block checks `cancelUploadRef.current` to break out of loop\n\n### Fast folder deletion\n- Added `execSshCommand` helper function in sftpBridge.cjs\n- Uses `client.client` \\(underlying ssh2 Client\\) to execute `rm -rf` command\n- Falls back to SFTP rmdir if SSH exec fails\n\n## Test plan\n- [ ] Drag a folder from computer to SFTP pane - should show as single task with aggregate progress\n- [ ] Click cancel button during folder upload - should stop immediately without errors\n- [ ] Delete a large folder on remote server - should complete quickly using rm -rf\n\n🤖 Generated with [Claude Code]\\(https://claude.com/claude-code\\)\nEOF\n\\)\")"
-    ]
-  }
-}
--- a/.gitignore
+++ b/.gitignore
@@ -33,3 +33,6 @@ coverage
 *.njsproj
 *.sln
 *.sw?
+
+# Claude Code local settings
+/.claude/settings.local.json
--- a/App.tsx
+++ b/App.tsx
@@ -3,6 +3,7 @@ import { activeTabStore, useActiveTabId, useIsSftpActive, useIsTerminalLayerVisi
 import { useAutoSync } from './application/state/useAutoSync';
 import { useManagedSourceSync } from './application/state/useManagedSourceSync';
 import { usePortForwardingAutoStart } from './application/state/usePortForwardingAutoStart';
+import { usePortForwardingState } from './application/state/usePortForwardingState';
 import { useSessionState } from './application/state/useSessionState';
 import { useSettingsState } from './application/state/useSettingsState';
 import { useUpdateCheck } from './application/state/useUpdateCheck';
@@ -86,6 +87,9 @@ const LazyProtocolSelectDialog = lazy(() => import('./components/ProtocolSelectD
 const LazyQuickSwitcher = lazy(() =>
  import('./components/QuickSwitcher').then((m) => ({ default: m.QuickSwitcher })),
 );
+const LazyCreateWorkspaceDialog = lazy(() =>
+  import('./components/CreateWorkspaceDialog').then((m) => ({ default: m.CreateWorkspaceDialog })),
+);

 const IS_DEV = import.meta.env.DEV;
 const HOTKEY_DEBUG =
@@ -150,6 +154,7 @@ function App({ settings }: { settings: SettingsState }) {
  const { t } = useI18n();

  const [isQuickSwitcherOpen, setIsQuickSwitcherOpen] = useState(false);
+  const [isCreateWorkspaceOpen, setIsCreateWorkspaceOpen] = useState(false);
  const [quickSearch, setQuickSearch] = useState('');
  // Protocol selection dialog state for QuickSwitcher
  const [protocolSelectHost, setProtocolSelectHost] = useState<Host | null>(null);
@@ -232,6 +237,7 @@ function App({ settings }: { settings: SettingsState }) {
    closeSession,
    closeWorkspace,
    updateSessionStatus,
+    createWorkspaceWithHosts,
    createWorkspaceFromSessions,
    addSessionToWorkspace,
    updateSplitSizes,
@@ -254,6 +260,20 @@ function App({ settings }: { settings: SettingsState }) {
  // isMacClient is used for window controls styling
  const isMacClient = typeof navigator !== 'undefined' && /Mac|Macintosh/.test(navigator.userAgent);

+  // Get port forwarding rules and import function
+  const { rules: portForwardingRules, importRules: importPortForwardingRules } = usePortForwardingState();
+
+  const portForwardingRulesForSync = useMemo(
+    () =>
+      portForwardingRules.map((rule) => ({
+        ...rule,
+        status: "inactive",
+        error: undefined,
+        lastUsedAt: undefined,
+      })),
+    [portForwardingRules],
+  );
+
  // Auto-sync hook for cloud sync
  const { syncNow: handleSyncNow } = useAutoSync({
    hosts,
@@ -261,7 +281,7 @@ function App({ settings }: { settings: SettingsState }) {
    identities,
    snippets,
    customGroups,
-    portForwardingRules: undefined, // TODO: Add port forwarding rules from usePortForwardingState
+    portForwardingRules: portForwardingRulesForSync,
    knownHosts,
    onApplyPayload: (payload) => {
      importDataFromString(JSON.stringify({
@@ -271,6 +291,10 @@ function App({ settings }: { settings: SettingsState }) {
        snippets: payload.snippets,
        customGroups: payload.customGroups,
      }));
+
+      if (payload.portForwardingRules) {
+        importPortForwardingRules(payload.portForwardingRules);
+      }
    },
  });

@@ -1081,8 +1105,8 @@ function App({ settings }: { settings: SettingsState }) {
              setQuickSearch('');
            }}
            onCreateWorkspace={() => {
-              // TODO: Implement workspace creation
              setIsQuickSwitcherOpen(false);
+              setIsCreateWorkspaceOpen(true);
            }}
            onClose={() => {
              setIsQuickSwitcherOpen(false);
@@ -1147,6 +1171,17 @@ function App({ settings }: { settings: SettingsState }) {
        </DialogContent>
      </Dialog>

+      {isCreateWorkspaceOpen && (
+        <Suspense fallback={null}>
+          <LazyCreateWorkspaceDialog
+            isOpen={isCreateWorkspaceOpen}
+            onClose={() => setIsCreateWorkspaceOpen(false)}
+            hosts={hosts}
+            onCreate={createWorkspaceWithHosts}
+          />
+        </Suspense>
+      )}
+
      {/* Protocol Select Dialog for QuickSwitcher */}
      {protocolSelectHost && (
        <Suspense fallback={null}>
--- a/application/i18n/locales/en.ts
+++ b/application/i18n/locales/en.ts
@@ -48,11 +48,14 @@ const en: Messages = {
  // Dialogs / prompts
  'confirm.deleteHost': 'Delete Host "{name}"?',
  'confirm.deleteIdentity': 'Delete Identity "{name}"?',
+  'dialog.createWorkspace.title': 'Create Workspace',
  'dialog.renameWorkspace.title': 'Rename workspace',
  'dialog.renameSession.title': 'Rename session',
  'field.name': 'Name',
+  'field.selectHosts': 'Select Hosts',
  'placeholder.workspaceName': 'Workspace name',
  'placeholder.sessionName': 'Session name',
+  'placeholder.searchHosts': 'Search hosts...',
  'toast.settingsUnavailable': 'Settings window is unavailable on this platform.',

  // Settings shell
--- a/application/state/useCloudSync.ts
+++ b/application/state/useCloudSync.ts
@@ -358,8 +358,8 @@ export const useCloudSync = (): CloudSyncHook => {
    manager.setAutoSync(enabled, intervalMinutes);
  }, []);
  
-  const setDeviceName = useCallback((_name: string) => {
-    // TODO: Add setDeviceName to CloudSyncManager if needed
+  const setDeviceName = useCallback((name: string) => {
+    manager.setDeviceName(name);
  }, []);
  
  // ========== Utilities ==========
--- a/application/state/useKeychainBackend.ts
+++ b/application/state/useKeychainBackend.ts
@@ -15,6 +15,8 @@ export const useKeychainBackend = () => {
    privateKey?: string;
    command: string;
    timeout?: number;
+    enableKeyboardInteractive?: boolean;
+    sessionId?: string;
  }) => {
    const bridge = netcattyBridge.get();
    if (!bridge?.execCommand) throw new Error("execCommand unavailable");
--- a/application/state/useManagedSourceSync.ts
+++ b/application/state/useManagedSourceSync.ts
@@ -233,6 +233,31 @@ export const useManagedSourceSync = ({
      const prevHostMap = new Map<string, Host>(prevHosts.map((h) => [h.id, h]));
      const currHostMap = new Map<string, Host>(hosts.map((h) => [h.id, h]));

+      // Index hosts by managedSourceId to avoid O(N*M) lookups
+      const prevHostsBySource = new Map<string, Host[]>();
+      for (const h of prevHosts) {
+        if (h.managedSourceId) {
+          let list = prevHostsBySource.get(h.managedSourceId);
+          if (!list) {
+            list = [];
+            prevHostsBySource.set(h.managedSourceId, list);
+          }
+          list.push(h);
+        }
+      }
+
+      const currHostsBySource = new Map<string, Host[]>();
+      for (const h of hosts) {
+        if (h.managedSourceId) {
+          let list = currHostsBySource.get(h.managedSourceId);
+          if (!list) {
+            list = [];
+            currHostsBySource.set(h.managedSourceId, list);
+          }
+          list.push(h);
+        }
+      }
+
      // Helper to check if a host's SSH-relevant fields changed
      const hostChanged = (prevHost: Host | undefined, currHost: Host | undefined): boolean => {
        if (!prevHost || !currHost) return prevHost !== currHost;
@@ -245,8 +270,8 @@ export const useManagedSourceSync = ({
      };

      for (const source of managedSources) {
-        const prevManaged = prevHosts.filter((h) => h.managedSourceId === source.id);
-        const currManaged = hosts.filter((h) => h.managedSourceId === source.id);
+        const prevManaged = prevHostsBySource.get(source.id) || [];
+        const currManaged = currHostsBySource.get(source.id) || [];

        console.log(`[ManagedSourceSync] Source ${source.groupName}: prev=${prevManaged.length}, curr=${currManaged.length}`);

--- a/application/state/usePortForwardingState.ts
+++ b/application/state/usePortForwardingState.ts
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 import { Host, PortForwardingRule } from "../../domain/models";
 import {
  STORAGE_KEY_PF_PREFER_FORM_MODE,
@@ -9,7 +9,6 @@ import { localStorageAdapter } from "../../infrastructure/persistence/localStora
 import {
  clearReconnectTimer,
  getActiveConnection,
-  getActiveRuleIds,
  startPortForward,
  stopPortForward,
  syncWithBackend,
@@ -40,6 +39,7 @@ export interface UsePortForwardingStateResult {
  updateRule: (id: string, updates: Partial<PortForwardingRule>) => void;
  deleteRule: (id: string) => void;
  duplicateRule: (id: string) => void;
+  importRules: (rules: PortForwardingRule[]) => void;

  setRuleStatus: (
    id: string,
@@ -63,8 +63,58 @@ export interface UsePortForwardingStateResult {
  selectedRule: PortForwardingRule | undefined;
 }

+// Global Store State
+let globalRules: PortForwardingRule[] = [];
+let isInitialized = false;
+const listeners = new Set<(rules: PortForwardingRule[]) => void>();
+
+// Store Actions
+const notifyListeners = () => {
+  listeners.forEach((listener) => listener(globalRules));
+};
+
+const setGlobalRules = (newRules: PortForwardingRule[]) => {
+  globalRules = newRules;
+  notifyListeners();
+  localStorageAdapter.write(STORAGE_KEY_PORT_FORWARDING, newRules);
+};
+
+const normalizeRulesWithConnections = (rules: PortForwardingRule[]) => {
+  return rules.map((rule) => {
+    const connection = getActiveConnection(rule.id);
+    if (connection) {
+      return {
+        ...rule,
+        status: connection.status,
+        error: connection.error,
+      };
+    }
+
+    return {
+      ...rule,
+      status: "inactive",
+      error: undefined,
+    };
+  });
+};
+
+// Initialization Logic
+const initializeStore = async () => {
+  if (isInitialized) return;
+  isInitialized = true;
+
+  await syncWithBackend();
+
+  const saved = localStorageAdapter.read<PortForwardingRule[]>(
+    STORAGE_KEY_PORT_FORWARDING,
+  );
+  if (saved && Array.isArray(saved)) {
+    setGlobalRules(normalizeRulesWithConnections(saved));
+  }
+};
+
 export const usePortForwardingState = (): UsePortForwardingStateResult => {
-  const [rules, setRules] = useState<PortForwardingRule[]>([]);
+  const [rules, setRules] = useState<PortForwardingRule[]>(globalRules);
  const [selectedRuleId, setSelectedRuleId] = useState<string | null>(null);
  const [viewMode, setViewMode] = useStoredViewMode(
    STORAGE_KEY_PF_VIEW_MODE,
@@ -76,49 +126,31 @@ export const usePortForwardingState = (): UsePortForwardingStateResult => {
    return localStorageAdapter.readBoolean(STORAGE_KEY_PF_PREFER_FORM_MODE) ?? false;
  });

-  // Track if sync has been executed for this component instance
-  const syncExecutedRef = useRef(false);
-
  const setPreferFormMode = useCallback((prefer: boolean) => {
    setPreferFormModeState(prefer);
    localStorageAdapter.writeBoolean(STORAGE_KEY_PF_PREFER_FORM_MODE, prefer);
  }, []);

-  // Load rules from storage on mount and sync with backend
+  // Initialize store on mount (only once globally)
  useEffect(() => {
-    const loadAndSync = async () => {
-      // Only sync once per component instance (prevents duplicate calls from React StrictMode)
-      if (!syncExecutedRef.current) {
-        syncExecutedRef.current = true;
-        await syncWithBackend();
-      }
+    void initializeStore();
+  }, []);

-      const saved = localStorageAdapter.read<PortForwardingRule[]>(
-        STORAGE_KEY_PORT_FORWARDING,
-      );
-      if (saved && Array.isArray(saved)) {
-        // Sync status with active connections in the service layer
-        const _activeRuleIds = getActiveRuleIds();
-        const withSyncedStatus = saved.map((r) => {
-          const conn = getActiveConnection(r.id);
-          if (conn) {
-            // This rule has an active connection, preserve its status
-            return { ...r, status: conn.status, error: conn.error };
-          }
-          // No active connection, reset to inactive
-          return { ...r, status: "inactive" as const, error: undefined };
-        });
-        setRules(withSyncedStatus);
-      }
+  // Subscribe to global store
+  useEffect(() => {
+    // If global state was updated before we subscribed (e.g. init finished), update local state
+    if (rules !== globalRules) {
+      setRules(globalRules);
+    }
+
+    const listener = (newRules: PortForwardingRule[]) => {
+      setRules(newRules);
    };
-    
-    void loadAndSync();
-  }, []);
-
-  // Persist rules to storage whenever they change
-  const persistRules = useCallback((updatedRules: PortForwardingRule[]) => {
-    localStorageAdapter.write(STORAGE_KEY_PORT_FORWARDING, updatedRules);
-  }, []);
+    listeners.add(listener);
+    return () => {
+      listeners.delete(listener);
+    };
+  }, [rules]);

  const addRule = useCallback(
    (
@@ -130,47 +162,38 @@ export const usePortForwardingState = (): UsePortForwardingStateResult => {
        createdAt: Date.now(),
        status: "inactive",
      };
-      setRules((prev) => {
-        const updated = [...prev, newRule];
-        persistRules(updated);
-        return updated;
-      });
+      const updated = [...globalRules, newRule];
+      setGlobalRules(updated);
      setSelectedRuleId(newRule.id);
      return newRule;
    },
-    [persistRules],
+    [],
  );

  const updateRule = useCallback(
    (id: string, updates: Partial<PortForwardingRule>) => {
-      setRules((prev) => {
-        const updated = prev.map((r) =>
-          r.id === id ? { ...r, ...updates } : r,
-        );
-        persistRules(updated);
-        return updated;
-      });
+      const updated = globalRules.map((r) =>
+        r.id === id ? { ...r, ...updates } : r,
+      );
+      setGlobalRules(updated);
    },
-    [persistRules],
+    [],
  );

  const deleteRule = useCallback(
    (id: string) => {
-      setRules((prev) => {
-        const updated = prev.filter((r) => r.id !== id);
-        persistRules(updated);
-        return updated;
-      });
+      const updated = globalRules.filter((r) => r.id !== id);
+      setGlobalRules(updated);
      if (selectedRuleId === id) {
        setSelectedRuleId(null);
      }
    },
-    [selectedRuleId, persistRules],
+    [selectedRuleId],
  );

  const duplicateRule = useCallback(
    (id: string) => {
-      const original = rules.find((r) => r.id === id);
+      const original = globalRules.find((r) => r.id === id);
      if (!original) return;

      const copy: PortForwardingRule = {
@@ -182,33 +205,31 @@ export const usePortForwardingState = (): UsePortForwardingStateResult => {
        error: undefined,
        lastUsedAt: undefined,
      };
-      setRules((prev) => {
-        const updated = [...prev, copy];
-        persistRules(updated);
-        return updated;
-      });
+      const updated = [...globalRules, copy];
+      setGlobalRules(updated);
      setSelectedRuleId(copy.id);
    },
-    [rules, persistRules],
+    [],
  );

+  const importRules = useCallback((newRules: PortForwardingRule[]) => {
+    setGlobalRules(normalizeRulesWithConnections(newRules));
+  }, []);
+
  const setRuleStatus = useCallback(
    (id: string, status: PortForwardingRule["status"], error?: string) => {
-      setRules((prev) => {
-        const updated = prev.map((r) => {
-          if (r.id !== id) return r;
-          return {
-            ...r,
-            status,
-            error,
-            lastUsedAt: status === "active" ? Date.now() : r.lastUsedAt,
-          };
-        });
-        persistRules(updated);
-        return updated;
+      const updated = globalRules.map((r) => {
+        if (r.id !== id) return r;
+        return {
+          ...r,
+          status,
+          error,
+          lastUsedAt: status === "active" ? Date.now() : r.lastUsedAt,
+        };
      });
+      setGlobalRules(updated);
    },
-    [persistRules],
+    [],
  );

  const startTunnel = useCallback(
@@ -301,6 +322,7 @@ export const usePortForwardingState = (): UsePortForwardingStateResult => {
    updateRule,
    deleteRule,
    duplicateRule,
+    importRules,

    setRuleStatus,
    startTunnel,
--- a/application/state/useSessionState.ts
+++ b/application/state/useSessionState.ts
@@ -286,6 +286,69 @@ export const useSessionState = () => {
    setWorkspaceRenameValue('');
  }, []);

+  const createWorkspaceWithHosts = useCallback((name: string, hosts: Host[]) => {
+    if (hosts.length === 0) return;
+
+    // Create sessions for each host
+    const newSessions: TerminalSession[] = hosts.map(host => {
+      // Handle serial hosts specially
+      if (host.protocol === 'serial') {
+        const serialConfig: SerialConfig = host.serialConfig || {
+          path: host.hostname,
+          baudRate: host.port || 115200,
+          dataBits: 8,
+          stopBits: 1,
+          parity: 'none',
+          flowControl: 'none',
+          localEcho: false,
+          lineMode: false,
+        };
+
+        const portName = serialConfig.path.split('/').pop() || serialConfig.path;
+        return {
+          id: crypto.randomUUID(),
+          hostId: host.id,
+          hostLabel: host.label || `Serial: ${portName}`,
+          hostname: serialConfig.path,
+          username: '',
+          status: 'connecting',
+          protocol: 'serial',
+          serialConfig: serialConfig,
+        };
+      }
+
+      return {
+        id: crypto.randomUUID(),
+        hostId: host.id,
+        hostLabel: host.label,
+        hostname: host.hostname,
+        username: host.username,
+        status: 'connecting',
+        protocol: host.protocol,
+        port: host.port,
+        moshEnabled: host.moshEnabled,
+      };
+    });
+
+    const sessionIds = newSessions.map(s => s.id);
+
+    // Create workspace
+    const workspace = createWorkspaceFromSessionIds(sessionIds, {
+      title: name,
+      viewMode: 'split',
+    });
+
+    // Assign workspaceId to sessions
+    const sessionsWithWorkspace = newSessions.map(s => ({
+      ...s,
+      workspaceId: workspace.id
+    }));
+
+    setSessions(prev => [...prev, ...sessionsWithWorkspace]);
+    setWorkspaces(prev => [...prev, workspace]);
+    setActiveTabId(workspace.id);
+  }, [setActiveTabId]);
+
  const createWorkspaceFromSessions = useCallback((
    baseSessionId: string,
    joiningSessionId: string,
@@ -669,6 +732,7 @@ export const useSessionState = () => {
    closeSession,
    closeWorkspace,
    updateSessionStatus,
+    createWorkspaceWithHosts,
    createWorkspaceFromSessions,
    addSessionToWorkspace,
    updateSplitSizes,
--- a/components/CreateWorkspaceDialog.tsx
+++ b/components/CreateWorkspaceDialog.tsx
@@ -0,0 +1,143 @@
+import { Search } from 'lucide-react';
+import React, { useMemo, useState, useEffect } from 'react';
+import { useI18n } from '../application/i18n/I18nProvider';
+import { Host } from '../types';
+import { DistroAvatar } from './DistroAvatar';
+import { Button } from './ui/button';
+import { Dialog, DialogContent, DialogFooter, DialogHeader, DialogTitle } from './ui/dialog';
+import { Input } from './ui/input';
+import { Label } from './ui/label';
+import { ScrollArea } from './ui/scroll-area';
+
+interface CreateWorkspaceDialogProps {
+  isOpen: boolean;
+  onClose: () => void;
+  hosts: Host[];
+  onCreate: (name: string, selectedHosts: Host[]) => void;
+}
+
+export const CreateWorkspaceDialog: React.FC<CreateWorkspaceDialogProps> = ({
+  isOpen,
+  onClose,
+  hosts,
+  onCreate,
+}) => {
+  const { t } = useI18n();
+  const [name, setName] = useState('');
+  const [search, setSearch] = useState('');
+  const [selectedHostIds, setSelectedHostIds] = useState<Set<string>>(new Set());
+
+  const filteredHosts = useMemo(() => {
+    if (!search.trim()) return hosts;
+    const term = search.toLowerCase();
+    return hosts.filter(h =>
+      h.label.toLowerCase().includes(term) ||
+      h.hostname.toLowerCase().includes(term) ||
+      (h.group || '').toLowerCase().includes(term)
+    );
+  }, [hosts, search]);
+
+  const toggleHost = (hostId: string) => {
+    setSelectedHostIds(prev => {
+      const next = new Set(prev);
+      if (next.has(hostId)) {
+        next.delete(hostId);
+      } else {
+        next.add(hostId);
+      }
+      return next;
+    });
+  };
+
+  const handleCreate = () => {
+    const selected = hosts.filter(h => selectedHostIds.has(h.id));
+    onCreate(name, selected);
+    onClose();
+  };
+
+  useEffect(() => {
+    if (isOpen) {
+        setName('');
+        setSearch('');
+        setSelectedHostIds(new Set());
+    }
+  }, [isOpen]);
+
+  return (
+    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="max-w-md flex flex-col max-h-[80vh]">
+        <DialogHeader>
+          <DialogTitle>{t('dialog.createWorkspace.title', 'Create Workspace')}</DialogTitle>
+        </DialogHeader>
+
+        <div className="space-y-4 py-2 flex-1 flex flex-col min-h-0">
+          <div className="space-y-2">
+            <Label htmlFor="workspace-name">{t('field.name', 'Name')}</Label>
+            <Input
+              id="workspace-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              placeholder={t('placeholder.workspaceName', 'Workspace Name')}
+              autoFocus
+            />
+          </div>
+
+          <div className="space-y-2 flex-1 flex flex-col min-h-0">
+            <Label>{t('field.selectHosts', 'Select Hosts')}</Label>
+            <div className="relative">
+                <Search className="absolute left-2 top-2.5 h-4 w-4 text-muted-foreground" />
+                <Input
+                placeholder={t('placeholder.searchHosts', 'Search hosts...')}
+                value={search}
+                onChange={(e) => setSearch(e.target.value)}
+                className="pl-8"
+                />
+            </div>
+
+            <div className="border rounded-md flex-1 min-h-[200px]">
+                <ScrollArea className="h-full max-h-[300px]">
+                    <div className="p-2 space-y-1">
+                        {filteredHosts.length === 0 ? (
+                            <div className="text-center py-4 text-sm text-muted-foreground">
+                                {t('common.noResults', 'No hosts found')}
+                            </div>
+                        ) : (
+                            filteredHosts.map(host => {
+                                const isSelected = selectedHostIds.has(host.id);
+                                return (
+                                    <div
+                                        key={host.id}
+                                        className={`flex items-center gap-3 p-2 rounded-md cursor-pointer hover:bg-muted/50 ${isSelected ? 'bg-primary/10' : ''}`}
+                                        onClick={() => toggleHost(host.id)}
+                                    >
+                                        <div className={`h-4 w-4 border rounded flex items-center justify-center ${isSelected ? 'bg-primary border-primary' : 'border-muted-foreground'}`}>
+                                            {isSelected && <div className="h-2 w-2 bg-primary-foreground rounded-sm" />}
+                                        </div>
+                                        <DistroAvatar host={host} size="sm" fallback={host.label.slice(0, 2).toUpperCase()} />
+                                        <div className="flex-1 min-w-0">
+                                            <div className="font-medium truncate">{host.label}</div>
+                                            <div className="text-xs text-muted-foreground truncate">{host.hostname}</div>
+                                        </div>
+                                    </div>
+                                );
+                            })
+                        )}
+                    </div>
+                </ScrollArea>
+            </div>
+            <div className="text-xs text-muted-foreground text-right">
+                {selectedHostIds.size} {t('common.selected', 'selected')}
+            </div>
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button variant="ghost" onClick={onClose}>{t('common.cancel', 'Cancel')}</Button>
+          <Button onClick={handleCreate} disabled={!name.trim() || selectedHostIds.size === 0}>
+            {t('common.create', 'Create')}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};
--- a/components/KeychainManager.tsx
+++ b/components/KeychainManager.tsx
@@ -916,6 +916,8 @@ echo $3 >> "$FILE"`);
              <ImportKeyPanel
                draftKey={draftKey}
                setDraftKey={setDraftKey}
+                showPassphrase={showPassphrase}
+                setShowPassphrase={setShowPassphrase}
                onImport={handleImport}
              />
            )}
@@ -1114,6 +1116,8 @@ echo $3 >> "$FILE"`);
                        privateKey: hostPrivateKey,
                        command,
                        timeout: 30000,
+                        enableKeyboardInteractive: true,
+                        sessionId: `export-key:${exportHost.id}:${panel.key.id}`,
                      });

                      // Check result - code 0, null, or undefined with no stderr is success
--- a/components/QuickSwitcher.tsx
+++ b/components/QuickSwitcher.tsx
@@ -94,7 +94,6 @@ const QuickSwitcherInner: React.FC<QuickSwitcherProps> = ({
    return IS_MAC ? binding.mac : binding.pc;
  }, [keyBindings]);
  const quickSwitchKey = getHotkeyLabel('quick-switch');
-  const [isFocused, setIsFocused] = useState(false);
  const [selectedIndex, setSelectedIndex] = useState(0);
  const inputRef = useRef<HTMLInputElement>(null);
  const containerRef = useRef<HTMLDivElement>(null);
@@ -102,7 +101,6 @@ const QuickSwitcherInner: React.FC<QuickSwitcherProps> = ({
  // Reset state when opening
  useEffect(() => {
    if (isOpen) {
-      setIsFocused(false);
      setSelectedIndex(0);
      // Auto focus the input after a short delay
      setTimeout(() => {
@@ -134,7 +132,7 @@ const QuickSwitcherInner: React.FC<QuickSwitcherProps> = ({
    [sessions]
  );

-  const showCategorized = isFocused || query.trim().length > 0;
+  const showCategorized = query.trim().length > 0;

  // Memoize flat items list and index map
  const { flatItems, itemIndexMap } = useMemo(() => {
@@ -232,7 +230,6 @@ const QuickSwitcherInner: React.FC<QuickSwitcherProps> = ({
              onQueryChange(e.target.value);
              setSelectedIndex(0);
            }}
-            onFocus={() => setIsFocused(true)}
            onKeyDown={handleKeyDown}
            placeholder={t("qs.search.placeholder")}
            className="flex-1 h-8 border-0 bg-transparent focus-visible:ring-0 focus-visible:ring-offset-0 px-0 text-sm"
--- a/components/SelectHostPanel.tsx
+++ b/components/SelectHostPanel.tsx
@@ -66,21 +66,26 @@ const SelectHostPanel: React.FC<SelectHostPanelProps> = ({
  const [selectedTags, setSelectedTags] = useState<string[]>([]);
  const [showNewHostPanel, setShowNewHostPanel] = useState(false);

+  const selectableHosts = useMemo(
+    () => hosts.filter((host) => host.protocol !== "serial"),
+    [hosts]
+  );
+
  // Get all unique tags from hosts
  const allTags = useMemo(() => {
    const tagSet = new Set<string>();
-    hosts.forEach((h) => {
+    selectableHosts.forEach((h) => {
      if (h.tags) {
        h.tags.forEach((tag) => tagSet.add(tag));
      }
    });
    return Array.from(tagSet).sort();
-  }, [hosts]);
+  }, [selectableHosts]);

  // Get unique group paths from both hosts and customGroups
  const allGroupPaths = useMemo(() => {
    const pathSet = new Set<string>();
-    hosts.forEach((h) => {
+    selectableHosts.forEach((h) => {
      if (h.group) {
        // Add all parent paths as well
        const parts = h.group.split("/");
@@ -91,7 +96,7 @@ const SelectHostPanel: React.FC<SelectHostPanelProps> = ({
    });
    customGroups.forEach((g) => pathSet.add(g));
    return Array.from(pathSet).sort();
-  }, [hosts, customGroups]);
+  }, [selectableHosts, customGroups]);

  // Get groups at current level
  const groupsWithCounts = useMemo(() => {
@@ -105,7 +110,7 @@ const SelectHostPanel: React.FC<SelectHostPanelProps> = ({
        const topLevel = path.split("/")[0];
        if (!seen.has(topLevel)) {
          seen.add(topLevel);
-          const count = hosts.filter(
+          const count = selectableHosts.filter(
            (h) =>
              h.group &&
              (h.group === topLevel || h.group.startsWith(`${topLevel}/`)),
@@ -119,7 +124,7 @@ const SelectHostPanel: React.FC<SelectHostPanelProps> = ({
        const fullPath = `${prefix}${nextLevel}`;
        if (!seen.has(fullPath)) {
          seen.add(fullPath);
-          const count = hosts.filter(
+          const count = selectableHosts.filter(
            (h) =>
              h.group &&
              (h.group === fullPath || h.group.startsWith(`${fullPath}/`)),
@@ -130,11 +135,11 @@ const SelectHostPanel: React.FC<SelectHostPanelProps> = ({
    });

    return groups;
-  }, [allGroupPaths, currentPath, hosts]);
+  }, [allGroupPaths, currentPath, selectableHosts]);

  // Get hosts at current level with filtering and sorting
  const filteredHosts = useMemo(() => {
-    let result = hosts;
+    let result = selectableHosts;

    // Filter by current path
    if (currentPath) {
@@ -180,7 +185,7 @@ const SelectHostPanel: React.FC<SelectHostPanelProps> = ({
    });

    return result;
-  }, [hosts, currentPath, searchQuery, selectedTags, sortMode]);
+  }, [selectableHosts, currentPath, searchQuery, selectedTags, sortMode]);

  // Build breadcrumb from current path
  const breadcrumbs = useMemo(() => {
@@ -359,7 +364,7 @@ const SelectHostPanel: React.FC<SelectHostPanelProps> = ({
                      <div className="flex-1 min-w-0">
                        <div className="font-medium">{host.label}</div>
                        <div className="text-xs text-muted-foreground truncate">
-                          {host.protocol || "ssh"}, {host.username}
+                          {host.username}@{host.hostname}:{host.port || 22}
                        </div>
                      </div>
                      {isSelected && (
@@ -390,7 +395,7 @@ const SelectHostPanel: React.FC<SelectHostPanelProps> = ({
            if (onContinue) {
              onContinue();
            } else {
-              const host = hosts.find((h) => selectedHostIds.includes(h.id));
+              const host = selectableHosts.find((h) => selectedHostIds.includes(h.id));
              if (host) {
                onSelect(host);
              }
--- a/components/keychain/ExportKeyPanel.tsx
+++ b/components/keychain/ExportKeyPanel.tsx
@@ -97,6 +97,8 @@ export const ExportKeyPanel: React.FC<ExportKeyPanelProps> = ({
                privateKey: hostPrivateKey,
                command,
                timeout: 30000,
+                enableKeyboardInteractive: true,
+                sessionId: `export-key:${exportHost.id}:${keyItem.id}`,
            });

            // Check result
--- a/components/keychain/ImportKeyPanel.tsx
+++ b/components/keychain/ImportKeyPanel.tsx
@@ -2,7 +2,7 @@
 * Import Key Panel - Import existing SSH key
 */

-import { Upload } from 'lucide-react';
+import { Eye, EyeOff, Upload } from 'lucide-react';
 import React,{ useCallback,useRef } from 'react';
 import { useI18n } from '../../application/i18n/I18nProvider';
 import { SSHKey } from '../../types';
@@ -15,12 +15,16 @@ import { detectKeyType } from './utils';
 interface ImportKeyPanelProps {
    draftKey: Partial<SSHKey>;
    setDraftKey: (key: Partial<SSHKey>) => void;
+    showPassphrase: boolean;
+    setShowPassphrase: (show: boolean) => void;
    onImport: () => void;
 }

 export const ImportKeyPanel: React.FC<ImportKeyPanelProps> = ({
    draftKey,
    setDraftKey,
+    showPassphrase,
+    setShowPassphrase,
    onImport,
 }) => {
    const { t } = useI18n();
@@ -132,6 +136,41 @@ export const ImportKeyPanel: React.FC<ImportKeyPanelProps> = ({
                />
            </div>

+            <div className="space-y-2">
+                <Label>{t('terminal.auth.passphrase')}</Label>
+                <div className="relative">
+                    <Input
+                        type={showPassphrase ? 'text' : 'password'}
+                        value={draftKey.passphrase || ''}
+                        onChange={e => setDraftKey({ ...draftKey, passphrase: e.target.value })}
+                        placeholder={t('keychain.generate.passphrasePlaceholder')}
+                        className="pr-10"
+                    />
+                    <Button
+                        type="button"
+                        variant="ghost"
+                        size="icon"
+                        className="absolute right-1 top-1/2 -translate-y-1/2 h-8 w-8"
+                        onClick={() => setShowPassphrase(!showPassphrase)}
+                    >
+                        {showPassphrase ? <EyeOff size={14} /> : <Eye size={14} />}
+                    </Button>
+                </div>
+            </div>
+
+            <div className="flex items-center gap-2">
+                <input
+                    type="checkbox"
+                    id="savePassphraseImport"
+                    checked={draftKey.savePassphrase || false}
+                    onChange={e => setDraftKey({ ...draftKey, savePassphrase: e.target.checked })}
+                    className="h-4 w-4 rounded border-border"
+                />
+                <Label htmlFor="savePassphraseImport" className="text-sm font-normal cursor-pointer">
+                    {t('keychain.generate.savePassphrase')}
+                </Label>
+            </div>
+
            <div
                className="border border-dashed border-border/80 rounded-xl p-4 text-center space-y-2 bg-background/60 transition-colors hover:border-primary/50"
                onDrop={handleDrop}
--- a/components/sftp-modal/hooks/useSftpModalTransfers.ts
+++ b/components/sftp-modal/hooks/useSftpModalTransfers.ts
@@ -101,7 +101,6 @@ export const useSftpModalTransfers = ({
  ensureSftp,
  loadFiles,
  readLocalFile,
-  readSftp,
  writeLocalFile,
  writeSftpBinaryWithProgress,
  writeSftpBinary,
@@ -768,7 +767,7 @@ export const useSftpModalTransfers = ({
      if (cancelTransfer) {
        try {
          await cancelTransfer(taskId);
-        } catch (e) {
+        } catch {
          // Ignore cancellation errors
        }
      }
--- a/electron/bridges/portForwardingBridge.cjs
+++ b/electron/bridges/portForwardingBridge.cjs
@@ -10,6 +10,7 @@ const {
  buildAuthHandler, 
  createKeyboardInteractiveHandler, 
  applyAuthToConnOpts,
+  findAllDefaultPrivateKeys: findAllDefaultPrivateKeysFromHelper,
 } = require("./sshAuthHelper.cjs");

 // Active port forwarding tunnels
@@ -46,55 +47,59 @@ async function startPortForward(event, payload) {
    passphrase,
  } = payload;

+  const conn = new SSHClient();
+  const sender = event.sender;
+
+  const sendStatus = (status, error = null) => {
+    if (!sender.isDestroyed()) {
+      sender.send("netcatty:portforward:status", { tunnelId, status, error });
+    }
+  };
+
+  const connectOpts = {
+    host: hostname,
+    port: port,
+    username: username || 'root',
+    readyTimeout: 120000, // 2 minutes for 2FA input
+    keepaliveInterval: 10000,
+    // Enable keyboard-interactive authentication (required for 2FA/MFA)
+    tryKeyboard: true,
+  };
+
+  if (privateKey) {
+    connectOpts.privateKey = privateKey;
+  }
+  if (passphrase) {
+    connectOpts.passphrase = passphrase;
+  }
+  if (password) {
+    connectOpts.password = password;
+  }
+
+  // Get default keys
+  const defaultKeys = await findAllDefaultPrivateKeysFromHelper();
+
+  // Build auth handler using shared helper
+  const authConfig = buildAuthHandler({
+    privateKey,
+    password,
+    passphrase,
+    username: connectOpts.username,
+    logPrefix: "[PortForward]",
+    defaultKeys,
+  });
+  applyAuthToConnOpts(connectOpts, authConfig);
+
+  // Handle keyboard-interactive authentication (2FA/MFA)
+  conn.on("keyboard-interactive", createKeyboardInteractiveHandler({
+    sender,
+    sessionId: tunnelId,
+    hostname,
+    password,
+    logPrefix: "[PortForward]",
+  }));
+
  return new Promise((resolve, reject) => {
-    const conn = new SSHClient();
-    const sender = event.sender;
-
-    const sendStatus = (status, error = null) => {
-      if (!sender.isDestroyed()) {
-        sender.send("netcatty:portforward:status", { tunnelId, status, error });
-      }
-    };
-
-    const connectOpts = {
-      host: hostname,
-      port: port,
-      username: username || 'root',
-      readyTimeout: 120000, // 2 minutes for 2FA input
-      keepaliveInterval: 10000,
-      // Enable keyboard-interactive authentication (required for 2FA/MFA)
-      tryKeyboard: true,
-    };
-
-    if (privateKey) {
-      connectOpts.privateKey = privateKey;
-    }
-    if (passphrase) {
-      connectOpts.passphrase = passphrase;
-    }
-    if (password) {
-      connectOpts.password = password;
-    }
-
-    // Build auth handler using shared helper
-    const authConfig = buildAuthHandler({
-      privateKey,
-      password,
-      passphrase,
-      username: connectOpts.username,
-      logPrefix: "[PortForward]",
-    });
-    applyAuthToConnOpts(connectOpts, authConfig);
-
-    // Handle keyboard-interactive authentication (2FA/MFA)
-    conn.on("keyboard-interactive", createKeyboardInteractiveHandler({
-      sender,
-      sessionId: tunnelId,
-      hostname,
-      password,
-      logPrefix: "[PortForward]",
-    }));
-

    conn.on('ready', () => {
      console.log(`[PortForward] SSH connection ready for tunnel ${tunnelId}`);
--- a/electron/bridges/sftpBridge.cjs
+++ b/electron/bridges/sftpBridge.cjs
@@ -28,6 +28,7 @@ const {
  createKeyboardInteractiveHandler, 
  applyAuthToConnOpts,
  safeSend: authSafeSend,
+  findAllDefaultPrivateKeys: findAllDefaultPrivateKeysFromHelper,
 } = require("./sshAuthHelper.cjs");

 // SFTP clients storage - shared reference passed from main
@@ -171,6 +172,18 @@ const ensureRemoteDirInternal = async (sftp, dirPath, encoding) => {
  const normalized = path.posix.normalize(dirPath);
  if (!normalized || normalized === ".") return;

+  // Optimization: Check if the full path already exists to avoid O(N) round trips
+  // This is the common case (e.g. uploading multiple files to the same directory)
+  const encodedFull = encodePath(normalized, encoding);
+  try {
+    const stats = await statAsync(sftp, encodedFull);
+    if (stats.isDirectory()) {
+      return;
+    }
+  } catch (err) {
+    // If path doesn't exist or other error, proceed to recursive check
+  }
+
  const isAbsolute = normalized.startsWith("/");
  const parts = normalized.split("/").filter(Boolean);
  let current = isAbsolute ? "/" : "";
@@ -325,6 +338,9 @@ async function connectThroughChainForSftp(event, options, jumpHosts, targetHost,

      if (jump.password) connOpts.password = jump.password;

+      // Get default keys (either from options if pre-fetched, or fetch them now)
+      const defaultKeys = options._defaultKeys || await findAllDefaultPrivateKeysFromHelper();
+
      // Build auth handler using shared helper
      // Pass unlocked encrypted keys from options so jump hosts can use them for retry
      const authConfig = buildAuthHandler({
@@ -335,6 +351,7 @@ async function connectThroughChainForSftp(event, options, jumpHosts, targetHost,
        username: connOpts.username,
        logPrefix: `[SFTP Chain] Hop ${i + 1}`,
        unlockedEncryptedKeys: options._unlockedEncryptedKeys || [],
+        defaultKeys,
      });
      applyAuthToConnOpts(connOpts, authConfig);

@@ -654,6 +671,9 @@ async function openSftp(event, options) {
  const client = new SftpClient();
  const connId = options.sessionId || `${Date.now()}-sftp-${Math.random().toString(16).slice(2)}`;

+  // Get default keys early to use for both chain and target
+  const defaultKeys = await findAllDefaultPrivateKeysFromHelper();
+
  // Check if we need to connect through jump hosts
  const jumpHosts = options.jumpHosts || [];
  const hasJumpHosts = jumpHosts.length > 0;
@@ -665,6 +685,10 @@ async function openSftp(event, options) {
  // Handle chain/proxy connections
  if (hasJumpHosts) {
    console.log(`[SFTP] Opening connection through ${jumpHosts.length} jump host(s) to ${options.hostname}:${options.port || 22}`);
+
+    // Pass default keys to chain connection
+    options._defaultKeys = defaultKeys;
+
    const chainResult = await connectThroughChainForSftp(
      event,
      options,
@@ -731,6 +755,7 @@ async function openSftp(event, options) {
    agent: connectOpts.agent,
    username: connectOpts.username,
    logPrefix: "[SFTP]",
+    defaultKeys,
  });
  applyAuthToConnOpts(connectOpts, authConfig);

--- a/electron/bridges/sshAuthHelper.cjs
+++ b/electron/bridges/sshAuthHelper.cjs
@@ -68,22 +68,21 @@ const passphraseHandler = require("./passphraseHandler.cjs");
 /**
  * Find default SSH private key from user's ~/.ssh directory
  * Skips encrypted keys that require a passphrase
-  * @returns {{ privateKey: string, keyPath: string, keyName: string } | null}
+  * @returns {Promise<{ privateKey: string, keyPath: string, keyName: string } | null>}
  */
- function findDefaultPrivateKey() {
+ async function findDefaultPrivateKey() {
   const sshDir = path.join(os.homedir(), ".ssh");
   for (const name of DEFAULT_KEY_NAMES) {
     const keyPath = path.join(sshDir, name);
-     if (fs.existsSync(keyPath)) {
-       try {
-         const privateKey = fs.readFileSync(keyPath, "utf8");
-         if (isKeyEncrypted(privateKey)) {
-           continue;
-         }
-         return { privateKey, keyPath, keyName: name };
-       } catch {
+     try {
+       await fs.promises.access(keyPath, fs.constants.F_OK);
+       const privateKey = await fs.promises.readFile(keyPath, "utf8");
+       if (isKeyEncrypted(privateKey)) {
         continue;
       }
+       return { privateKey, keyPath, keyName: name };
+     } catch {
+       continue;
     }
   }
   return null;
@@ -93,33 +92,34 @@ const passphraseHandler = require("./passphraseHandler.cjs");
  * Find ALL default SSH private keys from user's ~/.ssh directory
 * @param {Object} [options]
 * @param {boolean} [options.includeEncrypted=false] - If true, include encrypted keys with isEncrypted flag
- * @returns {Array<{ privateKey: string, keyPath: string, keyName: string, isEncrypted?: boolean }>}
+ * @returns {Promise<Array<{ privateKey: string, keyPath: string, keyName: string, isEncrypted?: boolean }>>}
  */
-function findAllDefaultPrivateKeys(options = {}) {
+async function findAllDefaultPrivateKeys(options = {}) {
  const { includeEncrypted = false } = options;
   const sshDir = path.join(os.homedir(), ".ssh");
-   const keys = [];
-   for (const name of DEFAULT_KEY_NAMES) {
+
+   const promises = DEFAULT_KEY_NAMES.map(async (name) => {
     const keyPath = path.join(sshDir, name);
-     if (fs.existsSync(keyPath)) {
-       try {
-         const privateKey = fs.readFileSync(keyPath, "utf8");
-        const encrypted = isKeyEncrypted(privateKey);
-        if (encrypted && !includeEncrypted) {
-          continue; // Skip encrypted keys when not including them
-         }
-        keys.push({ 
-          privateKey, 
-          keyPath, 
-          keyName: name,
-          ...(includeEncrypted ? { isEncrypted: encrypted } : {})
-        });
-       } catch {
-         continue;
+     try {
+       await fs.promises.access(keyPath, fs.constants.F_OK);
+       const privateKey = await fs.promises.readFile(keyPath, "utf8");
+       const encrypted = isKeyEncrypted(privateKey);
+       if (encrypted && !includeEncrypted) {
+          return null;
       }
+       return {
+         privateKey,
+         keyPath,
+         keyName: name,
+         ...(includeEncrypted ? { isEncrypted: encrypted } : {})
+       };
+     } catch {
+       return null;
     }
-   }
-   return keys;
+   });
+
+   const results = await Promise.all(promises);
+   return results.filter(Boolean);
 }
 
 /**
@@ -146,7 +146,7 @@ function findAllDefaultPrivateKeys(options = {}) {
 * @param {Array} [options.unlockedEncryptedKeys] - Array of unlocked encrypted keys with passphrases
  */
 function buildAuthHandler(options) {
-  const { privateKey, password, passphrase, agent, username, logPrefix = "[SSH]", unlockedEncryptedKeys = [] } = options;
+  const { privateKey, password, passphrase, agent, username, logPrefix = "[SSH]", unlockedEncryptedKeys = [], defaultKeys = [] } = options;
   
  // Determine what type of explicit auth the user configured
  const hasExplicitKey = !!privateKey;
@@ -159,7 +159,6 @@ function findAllDefaultPrivateKeys(options = {}) {
  const isKeyOnly = hasExplicitKey && !hasExplicitAgent;
  
   const sshAgentSocket = getSshAgentSocket();
-   const defaultKeys = findAllDefaultPrivateKeys();
   
  // Only use system ssh-agent BEFORE user's auth when:
  // - User explicitly configured agent, OR
@@ -465,7 +464,7 @@ function findAllDefaultPrivateKeys(options = {}) {
 * @returns {Promise<{ keys: Array<{ privateKey: string, keyPath: string, keyName: string, passphrase: string }>, cancelled: boolean }>}
 */
 async function requestPassphrasesForEncryptedKeys(sender, hostname) {
-  const allKeys = findAllDefaultPrivateKeys({ includeEncrypted: true });
+  const allKeys = await findAllDefaultPrivateKeys({ includeEncrypted: true });
  const encryptedKeys = allKeys.filter(k => k.isEncrypted);
  
  if (encryptedKeys.length === 0) {
--- a/electron/bridges/sshBridge.cjs
+++ b/electron/bridges/sshBridge.cjs
@@ -76,31 +76,29 @@ function isKeyEncrypted(keyContent) {
 /**
 * Find default SSH private key from user's ~/.ssh directory
 * Skips encrypted keys that require a passphrase to allow password/keyboard-interactive auth
- * @returns {{ privateKey: string, keyPath: string, keyName: string } | null}
+ * @returns {Promise<{ privateKey: string, keyPath: string, keyName: string } | null>}
 */
-function findDefaultPrivateKey() {
+async function findDefaultPrivateKey() {
  const sshDir = path.join(os.homedir(), ".ssh");
  log("Searching for default SSH keys", { sshDir, keyNames: DEFAULT_KEY_NAMES });
  for (const name of DEFAULT_KEY_NAMES) {
    const keyPath = path.join(sshDir, name);
-    log("Checking key file", { keyPath, exists: fs.existsSync(keyPath) });
-    if (fs.existsSync(keyPath)) {
-      try {
-        const privateKey = fs.readFileSync(keyPath, "utf8");
-        // Skip encrypted keys - they require a passphrase and would abort
-        // authentication before password/keyboard-interactive can be tried
-        const encrypted = isKeyEncrypted(privateKey);
-        log("Key file read", { keyPath, keyName: name, encrypted, keyLength: privateKey.length });
-        if (encrypted) {
-          log("Skipping encrypted default key", { keyPath, keyName: name });
-          continue;
-        }
-        log("Found default key", { keyPath, keyName: name });
-        return { privateKey, keyPath, keyName: name };
-      } catch (e) {
-        log("Failed to read default key", { keyPath, error: e.message });
+    try {
+      await fs.promises.access(keyPath, fs.constants.F_OK);
+      const privateKey = await fs.promises.readFile(keyPath, "utf8");
+      // Skip encrypted keys - they require a passphrase and would abort
+      // authentication before password/keyboard-interactive can be tried
+      const encrypted = isKeyEncrypted(privateKey);
+      log("Key file read", { keyPath, keyName: name, encrypted, keyLength: privateKey.length });
+      if (encrypted) {
+        log("Skipping encrypted default key", { keyPath, keyName: name });
        continue;
      }
+      log("Found default key", { keyPath, keyName: name });
+      return { privateKey, keyPath, keyName: name };
+    } catch (e) {
+      log("Failed to read default key", { keyPath, error: e.message });
+      continue;
    }
  }
  log("No suitable default SSH key found");
@@ -110,29 +108,33 @@ function findDefaultPrivateKey() {
 /**
 * Find ALL default SSH private keys from user's ~/.ssh directory
 * Returns all non-encrypted keys for fallback authentication
- * @returns {Array<{ privateKey: string, keyPath: string, keyName: string }>}
+ * @returns {Promise<Array<{ privateKey: string, keyPath: string, keyName: string }>>}
 */
-function findAllDefaultPrivateKeys() {
+async function findAllDefaultPrivateKeys() {
  const sshDir = path.join(os.homedir(), ".ssh");
-  const keys = [];
  log("Searching for ALL default SSH keys", { sshDir, keyNames: DEFAULT_KEY_NAMES });
-  for (const name of DEFAULT_KEY_NAMES) {
+
+  const promises = DEFAULT_KEY_NAMES.map(async (name) => {
    const keyPath = path.join(sshDir, name);
-    if (fs.existsSync(keyPath)) {
-      try {
-        const privateKey = fs.readFileSync(keyPath, "utf8");
-        const encrypted = isKeyEncrypted(privateKey);
-        if (!encrypted) {
-          keys.push({ privateKey, keyPath, keyName: name });
-          log("Found default key for fallback", { keyPath, keyName: name });
-        } else {
-          log("Skipping encrypted key", { keyPath, keyName: name });
-        }
-      } catch (e) {
-        log("Failed to read key", { keyPath, error: e.message });
+    try {
+      await fs.promises.access(keyPath, fs.constants.F_OK);
+      const privateKey = await fs.promises.readFile(keyPath, "utf8");
+      const encrypted = isKeyEncrypted(privateKey);
+      if (!encrypted) {
+        log("Found default key for fallback", { keyPath, keyName: name });
+        return { privateKey, keyPath, keyName: name };
+      } else {
+        log("Skipping encrypted key", { keyPath, keyName: name });
+        return null;
      }
+    } catch (e) {
+      log("Failed to read key", { keyPath, error: e.message });
+      return null;
    }
-  }
+  });
+
+  const results = await Promise.all(promises);
+  const keys = results.filter(Boolean);
  log("Found default SSH keys", { count: keys.length, keyNames: keys.map(k => k.keyName) });
  return keys;
 }
@@ -308,6 +310,9 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target

      if (jump.password) connOpts.password = jump.password;

+      // Get default keys (either from options if pre-fetched, or fetch them now)
+      const defaultKeys = options._defaultKeys || await findAllDefaultPrivateKeys();
+
      // Build auth handler using shared helper
      // Pass unlocked encrypted keys from options so jump hosts can use them for retry
      const authConfig = buildAuthHandler({
@@ -318,6 +323,7 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
        username: connOpts.username,
        logPrefix: `[Chain] Hop ${i + 1}`,
        unlockedEncryptedKeys: options._unlockedEncryptedKeys || [],
+        defaultKeys,
      });
      applyAuthToConnOpts(connOpts, authConfig);

@@ -508,13 +514,13 @@ async function startSSHSession(event, options) {
    let defaultKeyInfo = null;
    let allDefaultKeys = [];
    let usedDefaultKeyAsPrimary = false;
-    const defaultKey = findDefaultPrivateKey();
+    const defaultKey = await findDefaultPrivateKey();
    if (defaultKey) {
      defaultKeyInfo = defaultKey;
      log("Found default SSH key for fallback", { keyPath: defaultKey.keyPath, keyName: defaultKey.keyName });
    }
    // Also find ALL default keys for comprehensive fallback
-    allDefaultKeys = findAllDefaultPrivateKeys();
+    allDefaultKeys = await findAllDefaultPrivateKeys();

    // Use unlocked encrypted keys if provided (from retry after auth failure)
    // These are passed via _unlockedEncryptedKeys from startSSHSessionWrapper
@@ -814,6 +820,9 @@ async function startSSHSession(event, options) {

    // Handle chain/proxy connections
    if (hasJumpHosts) {
+      // Pass fetched keys to chain connection to avoid re-reading files
+      options._defaultKeys = allDefaultKeys;
+
      const chainResult = await connectThroughChain(
        event,
        options,
@@ -1098,12 +1107,18 @@ async function startSSHSession(event, options) {
 * Execute a one-off command via SSH
 */
 async function execCommand(event, payload) {
+  const enableKeyboardInteractive = !!payload.enableKeyboardInteractive;
+  const baseTimeoutMs = payload.timeout || 10000;
+  const timeoutMs = enableKeyboardInteractive ? Math.max(baseTimeoutMs, 120000) : baseTimeoutMs;
+  const sender = event.sender;
+  const sessionId = payload.sessionId || `exec-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  const defaultKeys = enableKeyboardInteractive ? await findAllDefaultPrivateKeysFromHelper() : [];
+
  return new Promise((resolve, reject) => {
    const conn = new SSHClient();
    let stdout = "";
    let stderr = "";
    let settled = false;
-    const timeoutMs = payload.timeout || 10000;
    const timer = setTimeout(() => {
      if (settled) return;
      settled = true;
@@ -1159,7 +1174,7 @@ async function execCommand(event, payload) {
      host: payload.hostname,
      port: payload.port || 22,
      username: payload.username,
-      readyTimeout: timeoutMs,
+      readyTimeout: enableKeyboardInteractive ? Math.max(timeoutMs, 120000) : timeoutMs,
      keepaliveInterval: 0,
    };

@@ -1183,7 +1198,29 @@ async function execCommand(event, payload) {

    if (payload.password) connectOpts.password = payload.password;

-    if (authAgent) {
+    if (enableKeyboardInteractive) {
+      connectOpts.tryKeyboard = true;
+
+      const authConfig = buildAuthHandler({
+        privateKey: connectOpts.privateKey,
+        password: connectOpts.password,
+        passphrase: connectOpts.passphrase,
+        agent: connectOpts.agent,
+        username: connectOpts.username,
+        logPrefix: "[SSH Exec]",
+        defaultKeys,
+      });
+
+      applyAuthToConnOpts(connectOpts, authConfig);
+
+      conn.on("keyboard-interactive", createKeyboardInteractiveHandler({
+        sender,
+        sessionId,
+        hostname: payload.hostname,
+        password: payload.password,
+        logPrefix: "[SSH Exec]",
+      }));
+    } else if (authAgent) {
      const order = ["agent"];
      if (connectOpts.password) order.push("password");
      connectOpts.authHandler = order;
@@ -1257,7 +1294,7 @@ async function startSSHSessionWrapper(event, options) {
      // Check if there are encrypted default keys we haven't tried yet
      // Only offer retry if no unlocked keys were provided in this attempt
      if (!options._unlockedEncryptedKeys || options._unlockedEncryptedKeys.length === 0) {
-        const allKeysWithEncrypted = findAllDefaultPrivateKeysFromHelper({ includeEncrypted: true });
+        const allKeysWithEncrypted = await findAllDefaultPrivateKeysFromHelper({ includeEncrypted: true });
        const encryptedKeys = allKeysWithEncrypted.filter(k => k.isEncrypted);
        
        if (encryptedKeys.length > 0) {
@@ -1720,8 +1757,11 @@ function registerHandlers(ipcMain) {
    const keys = [];
    for (const name of DEFAULT_KEY_NAMES) {
      const keyPath = path.join(sshDir, name);
-      if (fs.existsSync(keyPath)) {
+      try {
+        await fs.promises.access(keyPath, fs.constants.F_OK);
        keys.push({ name, path: keyPath });
+      } catch {
+        // ignore missing keys
      }
    }
    return keys;
--- a/electron/bridges/windowManager.cjs
+++ b/electron/bridges/windowManager.cjs
@@ -87,9 +87,9 @@ function loadWindowState() {
 }

 /**
- * Save window state to disk
+ * Save window state to disk (synchronous)
 */
-function saveWindowState(state) {
+function saveWindowStateSync(state) {
  try {
    const statePath = getWindowStatePath();
    if (!statePath) return false;
@@ -101,6 +101,47 @@ function saveWindowState(state) {
  }
 }

+/**
+ * Save window state to disk (asynchronous)
+ */
+async function saveWindowState(state) {
+  try {
+    const statePath = getWindowStatePath();
+    if (!statePath) return false;
+    await fs.promises.writeFile(statePath, JSON.stringify(state, null, 2), { mode: 0o600 });
+    return true;
+  } catch (err) {
+    debugLog("Failed to save window state:", err?.message || err);
+    return false;
+  }
+}
+
+let pendingWindowStateWrite = null;
+let queuedWindowState = null;
+let windowStateCloseRequested = false;
+
+async function queueWindowStateSave(state) {
+  if (!state) return false;
+  if (windowStateCloseRequested) {
+    return pendingWindowStateWrite || false;
+  }
+  queuedWindowState = state;
+  if (pendingWindowStateWrite) {
+    return pendingWindowStateWrite;
+  }
+  pendingWindowStateWrite = (async () => {
+    let lastResult = true;
+    while (queuedWindowState) {
+      const nextState = queuedWindowState;
+      queuedWindowState = null;
+      lastResult = await saveWindowState(nextState);
+    }
+    pendingWindowStateWrite = null;
+    return lastResult;
+  })();
+  return pendingWindowStateWrite;
+}
+
 /**
 * Get the current window bounds state for saving
 * @param {BrowserWindow} win - The window to get bounds from
@@ -589,7 +630,7 @@ async function createWindow(electronModule, options) {
    if (saveStateTimer) clearTimeout(saveStateTimer);
    saveStateTimer = setTimeout(() => {
      const state = getWindowBoundsState(win, lastNormalBounds);
-      if (state) saveWindowState(state);
+      if (state) queueWindowStateSave(state);
    }, 500);
  };

@@ -611,11 +652,33 @@ async function createWindow(electronModule, options) {
  });

  // Save state when window is about to close
-  win.on("close", () => {
+  win.on("close", (event) => {
+    if (windowStateCloseRequested) {
+      return;
+    }
+    windowStateCloseRequested = true;
    if (saveStateTimer) clearTimeout(saveStateTimer);
    const state = getWindowBoundsState(win, lastNormalBounds);
-    if (state) saveWindowState(state);
-    // Close settings window when main window closes
+    if (pendingWindowStateWrite) {
+      event.preventDefault();
+      if (state) queuedWindowState = state;
+      pendingWindowStateWrite
+        .catch(() => {
+          // ignore async write errors before closing
+        })
+        .finally(() => {
+          const finalState = getWindowBoundsState(win, lastNormalBounds);
+          if (finalState) saveWindowStateSync(finalState);
+          closeSettingsWindow();
+          try {
+            win.close();
+          } catch {
+            // ignore
+          }
+        });
+      return;
+    }
+    if (state) saveWindowStateSync(state);
    closeSettingsWindow();
  });

--- a/electron/main.cjs
+++ b/electron/main.cjs
@@ -267,22 +267,22 @@ let cloudSyncSessionPassword = null;
 const CLOUD_SYNC_PASSWORD_FILE = "netcatty_cloud_sync_master_password_v1";

 // Key management helpers
-const ensureKeyDir = () => {
+const ensureKeyDir = async () => {
  try {
-    fs.mkdirSync(keyRoot, { recursive: true, mode: 0o700 });
+    await fs.promises.mkdir(keyRoot, { recursive: true, mode: 0o700 });
  } catch (err) {
    console.warn("Unable to ensure key cache dir", err);
  }
 };

-const writeKeyToDisk = (keyId, privateKey) => {
+const writeKeyToDisk = async (keyId, privateKey) => {
  if (!privateKey) return null;
-  ensureKeyDir();
+  await ensureKeyDir();
  const filename = `${keyId || "temp"}.pem`;
  const target = path.join(keyRoot, filename);
  const normalized = privateKey.endsWith("\n") ? privateKey : `${privateKey}\n`;
  try {
-    fs.writeFileSync(target, normalized, { mode: 0o600 });
+    await fs.promises.writeFile(target, normalized, { mode: 0o600 });
    return target;
  } catch (err) {
    console.error("Failed to persist private key", err);
--- a/global.d.ts
+++ b/global.d.ts
@@ -182,6 +182,8 @@ declare global {
      privateKey?: string;
      command: string;
      timeout?: number;
+      enableKeyboardInteractive?: boolean;
+      sessionId?: string;
    }): Promise<{ stdout: string; stderr: string; code: number | null }>;
    /** Get current working directory from an active SSH session */
    getSessionPwd?(sessionId: string): Promise<{ success: boolean; cwd?: string; error?: string }>;
--- a/infrastructure/services/CloudSyncManager.ts
+++ b/infrastructure/services/CloudSyncManager.ts
@@ -26,11 +26,13 @@ import {
  type SyncHistoryEntry,
  type WebDAVConfig,
  type S3Config,
+  type SyncedFile,
  SYNC_CONSTANTS,
  SYNC_STORAGE_KEYS,
  generateDeviceId,
  getDefaultDeviceName,
 } from '../../domain/sync';
+import packageJson from '../../package.json';
 import { EncryptionService } from './EncryptionService';
 import { createAdapter, type CloudAdapter } from './adapters';
 import type { GitHubAdapter } from './adapters/GitHubAdapter';
@@ -795,6 +797,105 @@ export class CloudSyncManager {
  // Sync Operations
  // ==========================================================================

+  /**
+   * Helper: Check for conflicts with a specific provider
+   */
+  private async checkProviderConflict(
+    provider: CloudProvider,
+    adapter: CloudAdapter
+  ): Promise<{
+    conflict: boolean;
+    error?: string;
+    remoteFile?: SyncedFile;
+  }> {
+    try {
+      const remoteFile = await adapter.download();
+
+      if (remoteFile) {
+        // Compare versions
+        if (remoteFile.meta.updatedAt > this.state.localUpdatedAt) {
+          return {
+            conflict: true,
+            remoteFile,
+          };
+        }
+      }
+      return { conflict: false };
+    } catch (error) {
+      return { conflict: false, error: String(error) };
+    }
+  }
+
+  /**
+   * Helper: Upload encrypted file to a provider
+   */
+  private async uploadToProvider(
+    provider: CloudProvider,
+    adapter: CloudAdapter,
+    syncedFile: SyncedFile
+  ): Promise<SyncResult> {
+    try {
+      await adapter.upload(syncedFile);
+
+      // Update local state (safe to do multiple times if values are same)
+      this.state.localVersion = syncedFile.meta.version;
+      this.state.localUpdatedAt = syncedFile.meta.updatedAt;
+      this.state.remoteVersion = syncedFile.meta.version;
+      this.state.remoteUpdatedAt = syncedFile.meta.updatedAt;
+      this.state.providers[provider].lastSync = Date.now();
+      this.state.providers[provider].lastSyncVersion = syncedFile.meta.version;
+
+      this.saveSyncConfig();
+      this.saveProviderConnection(provider, this.state.providers[provider]);
+      this.notifyStateChange();
+
+      // Add to sync history
+      this.addSyncHistoryEntry({
+        timestamp: Date.now(),
+        provider,
+        action: 'upload',
+        success: true,
+        localVersion: syncedFile.meta.version,
+        remoteVersion: syncedFile.meta.version,
+        deviceName: this.state.deviceName,
+      });
+
+      this.updateProviderStatus(provider, 'connected');
+
+      const result: SyncResult = {
+        success: true,
+        provider,
+        action: 'upload',
+        version: syncedFile.meta.version,
+      };
+
+      this.emit({ type: 'SYNC_COMPLETED', provider, result });
+      return result;
+    } catch (error) {
+      this.updateProviderStatus(provider, 'error', String(error));
+
+      // Add to sync history
+      this.addSyncHistoryEntry({
+        timestamp: Date.now(),
+        provider,
+        action: 'upload',
+        success: false,
+        localVersion: this.state.localVersion,
+        deviceName: this.state.deviceName,
+        error: String(error),
+      });
+
+      this.emit({ type: 'SYNC_ERROR', provider, error: String(error) });
+
+      return {
+        success: false,
+        provider,
+        action: 'none',
+        error: String(error),
+      };
+    }
+  }
+
  /**
   * Build sync payload from current app state
   */
@@ -855,81 +956,61 @@ export class CloudSyncManager {
    this.emit({ type: 'SYNC_STARTED', provider });

    try {
-      // Check for remote version first
-      const remoteFile = await adapter.download();
+      // 1. Check for conflict
+      const checkResult = await this.checkProviderConflict(provider, adapter);

-      if (remoteFile) {
-        // Compare versions
-        if (remoteFile.meta.updatedAt > this.state.localUpdatedAt) {
-          // Remote is newer - conflict
-          this.state.syncState = 'CONFLICT';
-          this.state.currentConflict = {
-            provider,
-            localVersion: this.state.localVersion,
-            localUpdatedAt: this.state.localUpdatedAt,
-            localDeviceName: this.state.deviceName,
-            remoteVersion: remoteFile.meta.version,
-            remoteUpdatedAt: remoteFile.meta.updatedAt,
-            remoteDeviceName: remoteFile.meta.deviceName,
-          };
-
-          this.emit({ type: 'CONFLICT_DETECTED', conflict: this.state.currentConflict });
-          
-          return {
-            success: false,
-            provider,
-            action: 'none',
-            conflictDetected: true,
-          };
-        }
+      if (checkResult.error) {
+        throw new Error(checkResult.error);
      }

-      // Encrypt and upload
+      if (checkResult.conflict && checkResult.remoteFile) {
+        const remoteFile = checkResult.remoteFile;
+        // Remote is newer - conflict
+        this.state.syncState = 'CONFLICT';
+        this.state.currentConflict = {
+          provider,
+          localVersion: this.state.localVersion,
+          localUpdatedAt: this.state.localUpdatedAt,
+          localDeviceName: this.state.deviceName,
+          remoteVersion: remoteFile.meta.version,
+          remoteUpdatedAt: remoteFile.meta.updatedAt,
+          remoteDeviceName: remoteFile.meta.deviceName,
+        };
+
+        this.emit({
+          type: 'CONFLICT_DETECTED',
+          conflict: this.state.currentConflict,
+        });
+
+        return {
+          success: false,
+          provider,
+          action: 'none',
+          conflictDetected: true,
+        };
+      }
+
+      // 2. Encrypt
      const syncedFile = await EncryptionService.encryptPayload(
        payload,
        this.masterPassword,
        this.state.deviceId,
        this.state.deviceName,
-        '1.0.0', // TODO: Get from package.json
+        packageJson.version,
        this.state.localVersion
      );

-      await adapter.upload(syncedFile);
+      // 3. Upload
+      const result = await this.uploadToProvider(provider, adapter, syncedFile);

-      // Update local state
-      this.state.localVersion = syncedFile.meta.version;
-      this.state.localUpdatedAt = syncedFile.meta.updatedAt;
-      this.state.remoteVersion = syncedFile.meta.version;
-      this.state.remoteUpdatedAt = syncedFile.meta.updatedAt;
-      this.state.providers[provider].lastSync = Date.now();
-      this.state.providers[provider].lastSyncVersion = syncedFile.meta.version;
-
-      this.saveSyncConfig();
-      this.saveProviderConnection(provider, this.state.providers[provider]);
-      this.notifyStateChange(); // Notify UI immediately after version update
-
-      // Add to sync history
-      this.addSyncHistoryEntry({
-        timestamp: Date.now(),
-        provider,
-        action: 'upload',
-        success: true,
-        localVersion: syncedFile.meta.version,
-        remoteVersion: syncedFile.meta.version,
-        deviceName: this.state.deviceName,
-      });
-
-      this.state.syncState = 'IDLE';
-      this.updateProviderStatus(provider, 'connected');
-
-      const result: SyncResult = {
-        success: true,
-        provider,
-        action: 'upload',
-        version: syncedFile.meta.version,
-      };
-
-      this.emit({ type: 'SYNC_COMPLETED', provider, result });
+      if (result.success) {
+        this.state.syncState = 'IDLE';
+      } else {
+        this.state.syncState = 'ERROR';
+        if (result.error) {
+          this.state.lastError = result.error;
+        }
+      }
      return result;

    } catch (error) {
@@ -1050,20 +1131,178 @@ export class CloudSyncManager {
      return results;
    }

+    if (this.state.securityState !== 'UNLOCKED') {
+      return results; // Or throw? Caller handles it.
+    }
+
+    if (!this.masterPassword) {
+      return results;
+    }
+
    const connectedProviders = Object.entries(this.state.providers)
      .filter(([_, conn]) => conn.status === 'connected')
      .map(([p]) => p as CloudProvider);

-    for (const provider of connectedProviders) {
-      const result = await this.syncToProvider(provider, payload);
-      results.set(provider, result);
-      
-      // Stop on conflict
-      if (result.conflictDetected) {
-        break;
-      }
+    if (connectedProviders.length === 0) {
+      return results;
    }

+    this.state.syncState = 'SYNCING';
+
+    // 1. Parallel Checks
+    const checkTasks = connectedProviders.map(async (provider) => {
+      try {
+        // We handle connection error here to prevent one provider blocking others
+        const adapter = await this.getConnectedAdapter(provider);
+        this.updateProviderStatus(provider, 'syncing');
+        this.emit({ type: 'SYNC_STARTED', provider });
+
+        const check = await this.checkProviderConflict(provider, adapter);
+        return { provider, adapter, check };
+      } catch (error) {
+        return { provider, error: String(error) };
+      }
+    });
+
+    const checkResults = await Promise.all(checkTasks);
+
+    // 2. Analyze Results & Handle Conflicts
+    const conflict = checkResults.find((r) => !r.error && r.check?.conflict);
+
+    if (conflict && conflict.check?.remoteFile) {
+      const { provider, check } = conflict;
+      const remoteFile = check.remoteFile!;
+
+      this.state.syncState = 'CONFLICT';
+      this.state.currentConflict = {
+        provider: provider as CloudProvider,
+        localVersion: this.state.localVersion,
+        localUpdatedAt: this.state.localUpdatedAt,
+        localDeviceName: this.state.deviceName,
+        remoteVersion: remoteFile.meta.version,
+        remoteUpdatedAt: remoteFile.meta.updatedAt,
+        remoteDeviceName: remoteFile.meta.deviceName,
+      };
+
+      this.emit({
+        type: 'CONFLICT_DETECTED',
+        conflict: this.state.currentConflict,
+      });
+
+      // Populate results
+      for (const r of checkResults) {
+        if (r.error) {
+          results.set(r.provider as CloudProvider, {
+            success: false,
+            provider: r.provider as CloudProvider,
+            action: 'none',
+            error: r.error,
+          });
+          this.updateProviderStatus(r.provider as CloudProvider, 'error', r.error);
+          this.emit({ type: 'SYNC_ERROR', provider: r.provider as CloudProvider, error: r.error });
+        } else if (r.provider === provider) {
+          results.set(provider as CloudProvider, {
+            success: false,
+            provider: provider as CloudProvider,
+            action: 'none',
+            conflictDetected: true,
+          });
+        } else {
+          // Others are reset to connected
+          this.updateProviderStatus(r.provider as CloudProvider, 'connected');
+          results.set(r.provider as CloudProvider, {
+            success: true, // Should we mark as success if skipped?
+            provider: r.provider as CloudProvider,
+            action: 'none',
+          });
+        }
+      }
+      return results;
+    }
+
+    // 3. Encrypt Once
+    const validUploads = checkResults.filter(
+      (r) => !r.error && !r.check?.conflict && r.adapter
+    ) as { provider: CloudProvider; adapter: CloudAdapter }[];
+
+    if (validUploads.length === 0) {
+      // Process errors if any
+      checkResults.forEach((r) => {
+        if (r.error) {
+          results.set(r.provider as CloudProvider, {
+            success: false,
+            provider: r.provider as CloudProvider,
+            action: 'none',
+            error: r.error,
+          });
+          this.updateProviderStatus(r.provider as CloudProvider, 'error', r.error);
+          this.emit({ type: 'SYNC_ERROR', provider: r.provider as CloudProvider, error: r.error });
+        }
+      });
+      this.state.syncState = 'ERROR';
+      return results;
+    }
+
+    let syncedFile: SyncedFile;
+    try {
+      syncedFile = await EncryptionService.encryptPayload(
+        payload,
+        this.masterPassword,
+        this.state.deviceId,
+        this.state.deviceName,
+        packageJson.version,
+        this.state.localVersion
+      );
+    } catch (error) {
+      const msg = String(error);
+      this.state.syncState = 'ERROR';
+      this.state.lastError = msg;
+
+      // Fail all
+      for (const r of validUploads) {
+        this.updateProviderStatus(r.provider, 'error', msg);
+        this.emit({ type: 'SYNC_ERROR', provider: r.provider, error: msg });
+        results.set(r.provider, {
+          success: false,
+          provider: r.provider,
+          action: 'none',
+          error: msg,
+        });
+      }
+      return results;
+    }
+
+    // 4. Parallel Uploads
+    const uploadTasks = validUploads.map(async ({ provider, adapter }) => {
+      const result = await this.uploadToProvider(provider, adapter, syncedFile);
+      results.set(provider, result);
+    });
+
+    await Promise.all(uploadTasks);
+
+    // 5. Final State Update
+    const hasSuccess = Array.from(results.values()).some((r) => r.success);
+    if (hasSuccess) {
+      this.state.syncState = 'IDLE';
+    } else {
+      this.state.syncState = 'ERROR';
+      // lastError is set by uploadToProvider
+    }
+
+    // Process errors from initial checks (if any)
+    checkResults.forEach((r) => {
+      if (r.error) {
+        results.set(r.provider as CloudProvider, {
+          success: false,
+          provider: r.provider as CloudProvider,
+          action: 'none',
+          error: r.error,
+        });
+        this.updateProviderStatus(r.provider as CloudProvider, 'error', r.error);
+        this.emit({ type: 'SYNC_ERROR', provider: r.provider as CloudProvider, error: r.error });
+      }
+    });
+
    return results;
  }

@@ -1071,6 +1310,12 @@ export class CloudSyncManager {
  // Auto-Sync
  // ==========================================================================

+  setDeviceName(name: string): void {
+    this.state.deviceName = name;
+    this.saveToStorage(SYNC_STORAGE_KEYS.DEVICE_NAME, name);
+    this.notifyStateChange();
+  }
+
  setAutoSync(enabled: boolean, intervalMinutes?: number): void {
    this.state.autoSyncEnabled = enabled;
    if (intervalMinutes) {
--- a/package-lock.json
+++ b/package-lock.json
@@ -1008,7 +1008,6 @@
      "integrity": "sha512-H3mcG6ZDLTlYfaSNi0iOKkigqMFvkTKlGUYlD8GW7nNOYRrevuA46iTypPyv+06V3fEmvvazfntkBU34L0azAw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@babel/code-frame": "^7.28.6",
        "@babel/generator": "^7.28.6",
@@ -1655,6 +1654,7 @@
      "dev": true,
      "license": "BSD-2-Clause",
      "optional": true,
+      "peer": true,
      "dependencies": {
        "cross-dirname": "^0.1.0",
        "debug": "^4.3.4",
@@ -1676,6 +1676,7 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
+      "peer": true,
      "dependencies": {
        "graceful-fs": "^4.2.0",
        "jsonfile": "^6.0.1",
@@ -1692,6 +1693,7 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
+      "peer": true,
      "dependencies": {
        "universalify": "^2.0.0"
      },
@@ -1706,6 +1708,7 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
+      "peer": true,
      "engines": {
        "node": ">= 10.0.0"
      }
@@ -5671,7 +5674,6 @@
      "integrity": "sha512-eEXsVvLPu8Z4PkFibtuFJLJOTAV/nPdgtSjkGoPpddpFk3/ym2oy97jynY6ic2m6+nc5M8SE1e9v/mHKsulcJg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@eslint-community/regexpp": "^4.12.2",
        "@typescript-eslint/scope-manager": "8.53.0",
@@ -5701,7 +5703,6 @@
      "integrity": "sha512-npiaib8XzbjtzS2N4HlqPvlpxpmZ14FjSJrteZpPxGUaYPlvhzlzUZ4mZyABo0EFrOWnvyd0Xxroq//hKhtAWg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@typescript-eslint/scope-manager": "8.53.0",
        "@typescript-eslint/types": "8.53.0",
@@ -5980,8 +5981,7 @@
      "version": "5.5.0",
      "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-5.5.0.tgz",
      "integrity": "sha512-hqJHYaQb5OptNunnyAnkHyM8aCjZ1MEIDTQu1iIbbTD/xops91NB5yq1ZK/dC2JDbVWtF23zUtl9JE2NqwT87A==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
    },
    "node_modules/@yarnpkg/lockfile": {
      "version": "1.1.0",
@@ -6013,7 +6013,6 @@
      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "bin": {
        "acorn": "bin/acorn"
      },
@@ -6046,7 +6045,6 @@
      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "fast-deep-equal": "^3.1.1",
        "fast-json-stable-stringify": "^2.0.0",
@@ -6454,7 +6452,6 @@
        }
      ],
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.9.0",
        "caniuse-lite": "^1.0.30001759",
@@ -7114,7 +7111,8 @@
      "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
      "dev": true,
      "license": "MIT",
-      "optional": true
+      "optional": true,
+      "peer": true
    },
    "node_modules/cross-env": {
      "version": "10.1.0",
@@ -7354,7 +7352,6 @@
      "integrity": "sha512-ce4Ogns4VMeisIuCSK0C62umG0lFy012jd8LMZ6w/veHUeX4fqfDrGe+HTWALAEwK6JwKP+dhPvizhArSOsFbg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "app-builder-lib": "26.4.0",
        "builder-util": "26.3.4",
@@ -7680,6 +7677,7 @@
      "dev": true,
      "hasInstallScript": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@electron/asar": "^3.2.1",
        "debug": "^4.1.1",
@@ -7700,6 +7698,7 @@
      "integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "graceful-fs": "^4.1.2",
        "jsonfile": "^4.0.0",
@@ -7924,7 +7923,6 @@
      "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.8.0",
        "@eslint-community/regexpp": "^4.12.1",
@@ -10207,7 +10205,6 @@
      "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.55.1.tgz",
      "integrity": "sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A==",
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "dompurify": "3.2.7",
        "marked": "14.0.0"
@@ -10833,7 +10830,6 @@
      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "engines": {
        "node": ">=12"
      },
@@ -10892,6 +10888,7 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
+      "peer": true,
      "dependencies": {
        "commander": "^9.4.0"
      },
@@ -10909,6 +10906,7 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
+      "peer": true,
      "engines": {
        "node": "^12.20.0 || >=14"
      }
@@ -11009,7 +11007,6 @@
      "resolved": "https://registry.npmjs.org/react/-/react-19.2.3.tgz",
      "integrity": "sha512-Ku/hhYbVjOQnXDZFv2+RibmLFGwFdeeKHFcOTlrt7xplBnya5OGn/hIRDsqDiSUcfORsDC7MPxwork8jBwsIWA==",
      "license": "MIT",
-      "peer": true,
      "engines": {
        "node": ">=0.10.0"
      }
@@ -11019,7 +11016,6 @@
      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.3.tgz",
      "integrity": "sha512-yELu4WmLPw5Mr/lmeEpox5rw3RETacE++JgHqQzd2dg+YbJuat3jH4ingc+WPZhxaoFzdv9y33G+F7Nl5O0GBg==",
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "scheduler": "^0.27.0"
      },
@@ -11948,6 +11944,7 @@
      "integrity": "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "mkdirp": "^0.5.1",
        "rimraf": "~2.6.2"
@@ -12011,6 +12008,7 @@
      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "minimist": "^1.2.6"
      },
@@ -12025,6 +12023,7 @@
      "deprecated": "Rimraf versions prior to v4 are no longer supported",
      "dev": true,
      "license": "ISC",
+      "peer": true,
      "dependencies": {
        "glob": "^7.1.3"
      },
@@ -12186,7 +12185,6 @@
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "dev": true,
      "license": "Apache-2.0",
-      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -12389,7 +12387,6 @@
      "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "esbuild": "^0.27.0",
        "fdir": "^6.5.0",
@@ -12744,7 +12741,6 @@
      "integrity": "sha512-k7Nwx6vuWx1IJ9Bjuf4Zt1PEllcwe7cls3VNzm4CQ1/hgtFUK2bRNG3rvnpPUhFjmqJKAKtjV576KnUkHocg/g==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "funding": {
        "url": "https://github.com/sponsors/colinhacks"
      }
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -10,6 +10,7 @@
      "DOM.Iterable"
    ],
    "skipLibCheck": true,
+    "resolveJsonModule": true,
    "types": [
      "node",
      "vite/client"