bump version to 0.4.7

feat: support keyboard-interactive auth and interactive passphrase prompts (resolves #33 )
feat: add context menu to collapsed sidebar session cards
2026-10-03 16:00:18 +00:00 · 2026-06-23 00:23:11 +08:00 · 2026-06-23 00:16:48 +08:00 · 2026-06-22 12:48:20 +08:00 · 2026-06-22 12:36:20 +08:00 · 2026-06-22 10:53:17 +08:00
31 changed files with 12193 additions and 5365 deletions
@@ -0,0 +1,58 @@
+name: CI
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+
+jobs:
+  build:
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            name: windows-x86_64
+          - os: ubuntu-22.04            # build on the oldest supported runner for broader glibc compatibility
+            target: x86_64-unknown-linux-gnu
+            name: linux-x86_64
+          - os: macos-14               # Apple Silicon
+            target: aarch64-apple-darwin
+            name: macos-aarch64
+          - os: macos-14               # Intel (cross-compiled from Apple Silicon to avoid queue delays)
+            target: x86_64-apple-darwin
+            name: macos-x86_64
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # GPUI needs these system libs on Linux to compile.
+      - name: Install Linux GUI dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential pkg-config cmake \
+            libfontconfig1-dev libfreetype6-dev \
+            libxcb1-dev libxcb-render0-dev libxcb-shape0-dev libxcb-xfixes0-dev \
+            libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev \
+            libgl1-mesa-dev libegl1-mesa-dev libgtk-3-dev \
+            libudev-dev
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Cache cargo build
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.target }}
+
+      - name: Build (release)
+        # We build in release mode so that the release workflow can reuse the exact artifacts
+        run: cargo build --release --target ${{ matrix.target }}
@@ -12,7 +12,7 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write   # needed to create / update the GitHub Release
+  contents: write # needed to create / update the GitHub Release

 jobs:
  build:
@@ -26,15 +26,15 @@ jobs:
            target: x86_64-pc-windows-msvc
            name: windows-x86_64
            bin: ashell.exe
-          - os: ubuntu-22.04            # build on the oldest supported runner for broader glibc compatibility
+          - os: ubuntu-22.04 # build on the oldest supported runner for broader glibc compatibility
            target: x86_64-unknown-linux-gnu
            name: linux-x86_64
            bin: ashell
-          - os: macos-14               # Apple Silicon
+          - os: macos-14 # Apple Silicon
            target: aarch64-apple-darwin
            name: macos-aarch64
            bin: ashell
-          - os: macos-14               # Intel (cross-compiled from Apple Silicon to avoid queue delays)
+          - os: macos-14 # Intel (cross-compiled from Apple Silicon to avoid queue delays)
            target: x86_64-apple-darwin
            name: macos-x86_64
            bin: ashell
@@ -80,7 +80,7 @@ jobs:
            # Note: We build the bundle manually here rather than running
            # scripts/package-macos-app.sh, because that script runs `cargo build`
            # without respecting the `--target` flag from the matrix.
-            
+
            APP="ashell.app"
            CONTENTS="$APP/Contents"
            mkdir -p "$CONTENTS/MacOS" "$CONTENTS/Resources"
@@ -168,3 +168,84 @@ jobs:
          files: dist/**/*
          generate_release_notes: true
          fail_on_unmatched_files: true
+
+  cask:
+    name: Update Homebrew Cask
+    needs: publish
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Homebrew Tap
+        uses: actions/checkout@v4
+        with:
+          repository: rust-kotlin/homebrew-taps
+          token: ${{ secrets.TAP_GITHUB_TOKEN }}
+          path: tap
+
+      - name: Download all macOS artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: macos-*
+          path: dist
+
+      - name: Update Cask
+        run: |
+          VERSION=${GITHUB_REF#refs/tags/v}
+          SHA_ARM=$(sha256sum dist/macos-aarch64/*.zip | cut -d' ' -f1)
+          SHA_INTEL=$(sha256sum dist/macos-x86_64/*.zip | cut -d' ' -f1)
+
+          mkdir -p tap/Casks
+          CASK_FILE="tap/Casks/ashell.rb"
+
+          cat > "$CASK_FILE" <<EOF
+          cask "ashell" do
+            version "${VERSION}"
+
+            on_arm do
+              sha256 "${SHA_ARM}"
+              url "https://github.com/rust-kotlin/ashell/releases/download/v#{version}/ashell-v#{version}-macos-aarch64.zip"
+            end
+            on_intel do
+              sha256 "${SHA_INTEL}"
+              url "https://github.com/rust-kotlin/ashell/releases/download/v#{version}/ashell-v#{version}-macos-x86_64.zip"
+            end
+
+            name "ashell"
+            desc "ashell is a modern, fast, GPUI Component-based desktop terminal client written in Rust."
+            homepage "https://github.com/rust-kotlin/ashell"
+
+            app "ashell.app"
+
+            postflight do
+              puts "Removing quarantine flag from ashell.app..."
+              system_command "/usr/bin/xattr",
+                             args: ["-rd", "com.apple.quarantine", "#{appdir}/ashell.app"],
+                             sudo: true
+            end
+
+            caveats <<~EOS
+              ashell uses ad-hoc signing. The installation includes a postflight script
+              that removes the 'com.apple.quarantine' attribute from the application
+              to allow it to run. This will require your administrator password.
+
+              ashell 采用本地签名。安装程序包含一个后置脚本，用于移除应用程序的
+              'com.apple.quarantine' 属性以允许其运行。这需要您的管理员密码。
+            EOS
+          end
+          EOF
+          # Remove the 10 leading spaces added for YAML formatting
+          sed -i 's/^          //' "$CASK_FILE"
+
+      - name: Commit and Push
+        run: |
+          VERSION=${GITHUB_REF#refs/tags/v}
+          cd tap
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          if [[ -n $(git status -s) ]]; then
+            git add Casks/ashell.rb
+            git commit -m "chore: bump ashell to v${VERSION}"
+            git push
+          else
+            echo "No changes to commit"
+          fi
@@ -142,6 +142,19 @@ dependencies = [
 "subtle",
 ]

+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "const-random",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -252,6 +265,18 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures",
+ "password-hash",
+]
+
 [[package]]
 name = "arrayref"
 version = "0.3.9"
@@ -264,6 +289,12 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"

+[[package]]
+name = "as-raw-xcb-connection"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b"
+
 [[package]]
 name = "as-slice"
 version = "0.2.1"
@@ -284,11 +315,14 @@ dependencies = [

 [[package]]
 name = "ashell"
-version = "0.1.0"
+version = "0.4.7"
 dependencies = [
 "alacritty_terminal",
 "anyhow",
+ "argon2",
 "async-trait",
+ "base64",
+ "chacha20poly1305",
 "chrono",
 "directories",
 "flate2",
@@ -297,11 +331,15 @@ dependencies = [
 "gpui-component",
 "gpui-component-assets",
 "gpui_platform",
+ "hex",
+ "hmac",
 "image",
 "menu",
 "notify 6.1.1",
 "open",
 "portable-pty",
+ "rand 0.8.6",
+ "reqwest",
 "rfd",
 "russh",
 "russh-keys",
@@ -309,13 +347,16 @@ dependencies = [
 "rust-i18n 3.1.5",
 "serde",
 "serde_json",
+ "sha2",
 "ssh-key",
 "sys-locale",
 "sysinfo 0.33.1",
 "tar",
 "thiserror 1.0.69",
+ "time",
 "tokio",
 "tracing",
+ "tracing-appender",
 "tracing-subscriber",
 "uuid",
 "walkdir",
@@ -352,9 +393,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "340e0f6bf7f9ee78549c61454f1460a3ed97c011902ee76b58301bbc6d502a32"
 dependencies = [
 "enumflags2",
+ "futures-channel",
 "futures-util",
 "getrandom 0.4.2",
 "serde",
+ "serde_repr",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
 "zbus",
 ]

@@ -816,6 +862,15 @@ dependencies = [
 "no_std_io2",
 ]

+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "block"
 version = "0.1.6"
@@ -973,6 +1028,18 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "calloop-wayland-source"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "138efcf0940a02ebf0cc8d1eff41a1682a46b431630f4c52450d6265876021fa"
+dependencies = [
+ "calloop",
+ "rustix 1.1.4",
+ "wayland-backend",
+ "wayland-client",
+]
+
 [[package]]
 name = "cbc"
 version = "0.1.2"
@@ -1053,6 +1120,19 @@ dependencies = [
 "cpufeatures",
 ]

+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -1163,9 +1243,8 @@ dependencies = [
 [[package]]
 name = "collections"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
- "gpui_util",
 "indexmap",
 "rustc-hash 2.1.2",
 ]
@@ -1230,6 +1309,26 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"

+[[package]]
+name = "const-random"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
+dependencies = [
+ "const-random-macro",
+]
+
+[[package]]
+name = "const-random-macro"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
+dependencies = [
+ "getrandom 0.2.17",
+ "once_cell",
+ "tiny-keccak",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.10.0"
@@ -1594,6 +1693,15 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
 [[package]]
 name = "derive_arbitrary"
 version = "1.4.2"
@@ -1631,7 +1739,7 @@ dependencies = [
 [[package]]
 name = "derive_refineable"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2406,6 +2514,16 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "gethostname"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
+dependencies = [
+ "rustix 1.1.4",
+ "windows-link 0.2.1",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -2605,7 +2723,7 @@ dependencies = [
 [[package]]
 name = "gpui"
 version = "0.2.2"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "accesskit",
 "anyhow",
@@ -2635,7 +2753,6 @@ dependencies = [
 "gpui_macros",
 "gpui_shared_string",
 "gpui_util",
- "heapless",
 "http_client",
 "image",
 "inventory",
@@ -2755,22 +2872,29 @@ dependencies = [
 [[package]]
 name = "gpui_linux"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "accesskit",
 "accesskit_unix",
 "anyhow",
+ "as-raw-xcb-connection",
+ "ashpd 0.13.11",
+ "bitflags 2.12.1",
 "bytemuck",
 "calloop",
+ "calloop-wayland-source",
 "collections",
+ "filedescriptor",
 "futures",
 "gpui",
+ "gpui_wgpu",
 "http_client",
 "image",
 "itertools 0.14.0",
 "libc",
 "log",
 "oo7",
+ "open",
 "parking_lot",
 "pathfinder_geometry",
 "pollster 0.4.0",
@@ -2783,12 +2907,23 @@ dependencies = [
 "url",
 "util",
 "uuid",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-plasma",
+ "wayland-protocols-wlr",
+ "x11-clipboard",
+ "x11rb",
+ "xkbcommon",
+ "zed-scap",
+ "zed-xim",
 ]

 [[package]]
 name = "gpui_macos"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "accesskit",
 "accesskit_macos",
@@ -2833,7 +2968,7 @@ dependencies = [
 [[package]]
 name = "gpui_macros"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "heck 0.5.0",
 "proc-macro2",
@@ -2844,7 +2979,7 @@ dependencies = [
 [[package]]
 name = "gpui_platform"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "console_error_panic_hook",
 "gpui",
@@ -2857,7 +2992,7 @@ dependencies = [
 [[package]]
 name = "gpui_shared_string"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "schemars",
 "serde",
@@ -2867,7 +3002,7 @@ dependencies = [
 [[package]]
 name = "gpui_util"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "anyhow",
 "log",
@@ -2876,7 +3011,7 @@ dependencies = [
 [[package]]
 name = "gpui_web"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "anyhow",
 "console_error_panic_hook",
@@ -2900,7 +3035,7 @@ dependencies = [
 [[package]]
 name = "gpui_wgpu"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "anyhow",
 "bytemuck",
@@ -2923,12 +3058,13 @@ dependencies = [
 "wasm-bindgen-futures",
 "web-sys",
 "wgpu",
+ "zed-font-kit",
 ]

 [[package]]
 name = "gpui_windows"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "accesskit",
 "accesskit_windows",
@@ -3177,7 +3313,7 @@ dependencies = [
 [[package]]
 name = "http_client"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "anyhow",
 "async-compression",
@@ -3240,6 +3376,7 @@ dependencies = [
 "tokio",
 "tokio-rustls",
 "tower-service",
+ "webpki-roots",
 ]

 [[package]]
@@ -3248,13 +3385,16 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
+ "base64",
 "bytes",
 "futures-channel",
 "futures-util",
 "http",
 "http-body",
 "hyper",
+ "ipnet",
 "libc",
+ "percent-encoding",
 "pin-project-lite",
 "socket2",
 "tokio",
@@ -4050,7 +4190,7 @@ checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"
 [[package]]
 name = "media"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "anyhow",
 "bindgen",
@@ -4098,7 +4238,7 @@ dependencies = [
 [[package]]
 name = "menu"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "gpui",
 ]
@@ -4455,6 +4595,12 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-derive"
 version = "0.4.2"
@@ -4517,6 +4663,15 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "num_threads"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "objc"
 version = "0.2.7"
@@ -4903,6 +5058,17 @@ dependencies = [
 "windows-link 0.2.1",
 ]

+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "paste"
 version = "1.0.15"
@@ -4968,7 +5134,7 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 [[package]]
 name = "perf"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "collections",
 "serde",
@@ -5286,6 +5452,12 @@ dependencies = [
 "zerovec",
 ]

+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -5744,7 +5916,7 @@ dependencies = [
 [[package]]
 name = "refineable"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "derive_refineable",
 ]
@@ -5784,6 +5956,44 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832"

+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots",
+]
+
 [[package]]
 name = "resvg"
 version = "0.45.1"
@@ -6360,7 +6570,7 @@ dependencies = [
 [[package]]
 name = "scheduler"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "async-task",
 "backtrace",
@@ -7099,7 +7309,7 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 [[package]]
 name = "sum_tree"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "heapless",
 "log",
@@ -7213,6 +7423,12 @@ dependencies = [
 "zeno",
 ]

+[[package]]
+name = "symlink"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
+
 [[package]]
 name = "syn"
 version = "2.0.117"
@@ -7448,6 +7664,48 @@ dependencies = [
 "zune-jpeg 0.5.15",
 ]

+[[package]]
+name = "time"
+version = "0.3.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9e442fc33d7fdb45aa9bfeb312c095964abdf596f7567261062b2a7107aaabd"
+dependencies = [
+ "deranged",
+ "itoa",
+ "libc",
+ "num-conv",
+ "num_threads",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b36ee98fd31ec7426d599183e8fe26932a8dc1fb76ddb6214d05493377d34ca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e552d1249bf61ac2a52db88179fd0673def1e1ad8243a00d9ec9ed71fee3dd"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
 [[package]]
 name = "tiny-skia"
 version = "0.11.4"
@@ -7689,6 +7947,24 @@ dependencies = [
 "tower-service",
 ]

+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.12.1",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
@@ -7713,6 +7989,19 @@ dependencies = [
 "tracing-core",
 ]

+[[package]]
+name = "tracing-appender"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
+dependencies = [
+ "crossbeam-channel",
+ "symlink",
+ "thiserror 2.0.18",
+ "time",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "tracing-attributes"
 version = "0.1.31"
@@ -7758,6 +8047,7 @@ dependencies = [
 "sharded-slab",
 "smallvec",
 "thread_local",
+ "time",
 "tracing",
 "tracing-core",
 "tracing-log",
@@ -8003,7 +8293,7 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 [[package]]
 name = "util"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "anyhow",
 "async-fs",
@@ -8042,7 +8332,7 @@ dependencies = [
 [[package]]
 name = "util_macros"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "perf",
 "quote",
@@ -8344,6 +8634,17 @@ dependencies = [
 "wayland-scanner",
 ]

+[[package]]
+name = "wayland-cursor"
+version = "0.31.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a52d18780be9b1314328a3de5f930b73d2200112e3849ca6cb11822793fb34d"
+dependencies = [
+ "rustix 1.1.4",
+ "wayland-client",
+ "xcursor",
+]
+
 [[package]]
 name = "wayland-protocols"
 version = "0.32.12"
@@ -8356,6 +8657,32 @@ dependencies = [
 "wayland-scanner",
 ]

+[[package]]
+name = "wayland-protocols-plasma"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b6d8cf1eb2c1c31ed1f5643c88a6e53538129d4af80030c8cabd1f9fa884d91"
+dependencies = [
+ "bitflags 2.12.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-wlr"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb04e52f7836d7c7976c78ca0250d61e33873c34156a2a1fc9474828ec268234"
+dependencies = [
+ "bitflags 2.12.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
 [[package]]
 name = "wayland-scanner"
 version = "0.31.10"
@@ -8399,6 +8726,15 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "webpki-roots"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -9376,6 +9712,36 @@ dependencies = [
 "pkg-config",
 ]

+[[package]]
+name = "x11-clipboard"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "662d74b3d77e396b8e5beb00b9cad6a9eccf40b2ef68cc858784b14c41d535a3"
+dependencies = [
+ "libc",
+ "x11rb",
+]
+
+[[package]]
+name = "x11rb"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9993aa5be5a26815fe2c3eacfc1fde061fc1a1f094bf1ad2a18bf9c495dd7414"
+dependencies = [
+ "as-raw-xcb-connection",
+ "gethostname",
+ "libc",
+ "rustix 1.1.4",
+ "x11rb-protocol",
+ "xcursor",
+]
+
+[[package]]
+name = "x11rb-protocol"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
+
 [[package]]
 name = "xattr"
 version = "0.2.3"
@@ -9407,6 +9773,46 @@ dependencies = [
 "x11",
 ]

+[[package]]
+name = "xcursor"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bec9e4a500ca8864c5b47b8b482a73d62e4237670e5b5f1d6b9e3cae50f28f2b"
+
+[[package]]
+name = "xim-ctext"
+version = "0.3.0"
+source = "git+https://github.com/zed-industries/xim-rs.git?rev=16f35a2c881b815a2b6cdfd6687988e84f8447d8#16f35a2c881b815a2b6cdfd6687988e84f8447d8"
+dependencies = [
+ "encoding_rs",
+]
+
+[[package]]
+name = "xim-parser"
+version = "0.2.1"
+source = "git+https://github.com/zed-industries/xim-rs.git?rev=16f35a2c881b815a2b6cdfd6687988e84f8447d8#16f35a2c881b815a2b6cdfd6687988e84f8447d8"
+dependencies = [
+ "bitflags 2.12.1",
+]
+
+[[package]]
+name = "xkbcommon"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d66ca9352cbd4eecbbc40871d8a11b4ac8107cfc528a6e14d7c19c69d0e1ac9"
+dependencies = [
+ "as-raw-xcb-connection",
+ "libc",
+ "memmap2",
+ "xkeysym",
+]
+
+[[package]]
+name = "xkeysym"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
+
 [[package]]
 name = "xml-rs"
 version = "0.8.28"
@@ -9679,6 +10085,19 @@ dependencies = [
 "workspace-hack",
 ]

+[[package]]
+name = "zed-xim"
+version = "0.4.0-zed"
+source = "git+https://github.com/zed-industries/xim-rs.git?rev=16f35a2c881b815a2b6cdfd6687988e84f8447d8#16f35a2c881b815a2b6cdfd6687988e84f8447d8"
+dependencies = [
+ "ahash",
+ "hashbrown 0.14.5",
+ "log",
+ "x11rb",
+ "xim-ctext",
+ "xim-parser",
+]
+
 [[package]]
 name = "zeno"
 version = "0.3.3"
@@ -9799,7 +10218,7 @@ dependencies = [
 [[package]]
 name = "zlog"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "anyhow",
 "chrono",
@@ -9828,7 +10247,7 @@ dependencies = [
 [[package]]
 name = "ztracing"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"
 dependencies = [
 "tracing",
 "tracing-subscriber",
@@ -9839,7 +10258,7 @@ dependencies = [
 [[package]]
 name = "ztracing_macro"
 version = "0.1.0"
-source = "git+https://github.com/zed-industries/zed#dde98fa822c59028475850f242a4827ba770e24a"
+source = "git+https://github.com/zed-industries/zed#969a67fcfbf799e68ab00854028228274be847e8"

 [[package]]
 name = "zune-core"
@@ -1,6 +1,6 @@
 [package]
 name = "ashell"
-version = "0.1.0"
+version = "0.4.7"
 edition = "2024"
 authors = ["ashell contributors"]
 description = "A GPUI Component based SSH and local terminal client"
@@ -15,7 +15,7 @@ chrono = { version = "0.4", features = ["serde"] }
 directories = "5"
 flate2 = "1"
 gpui = { git = "https://github.com/zed-industries/zed" }
-gpui_platform = { git = "https://github.com/zed-industries/zed", features = ["font-kit", "runtime_shaders"] }
+gpui_platform = { git = "https://github.com/zed-industries/zed", features = ["font-kit", "runtime_shaders", "wayland", "x11"] }
 gpui-component = { git = "https://github.com/longbridge/gpui-component", rev = "ca85b5588f5feea021f1ee86cb13703dc6f30ec4" }
 gpui-component-assets = { git = "https://github.com/longbridge/gpui-component", rev = "ca85b5588f5feea021f1ee86cb13703dc6f30ec4" }
 menu = { git = "https://github.com/zed-industries/zed" }
@@ -34,7 +34,7 @@ tar = "0.4"
 thiserror = "1"
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "io-util", "net", "time", "fs"] }
 tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+tracing-subscriber = { version = "0.3", features = ["env-filter", "local-time", "time"] }
 uuid = { version = "1", features = ["v4", "serde"] }
 walkdir = "2"
 zip = { version = "2", default-features = false, features = ["deflate"] }
@@ -42,6 +42,16 @@ image = { version = "0.25.9", default-features = false, features = ["png"] }
 futures = "0.3.32"
 notify = "6.1.1"
 open = "5.1"
+time = { version = "0.3.45", features = ["formatting", "local-offset"] }
+tracing-appender = "0.2.5"
+argon2 = "0.5"
+base64 = "0.22"
+chacha20poly1305 = "0.10"
+hmac = "0.12"
+hex = "0.4"
+rand = "0.8"
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls"] }
+sha2 = "0.10"

 [profile.release]
 opt-level = 3
@@ -8,15 +8,15 @@

 This project focuses on providing a high-performance and visually appealing shell workspace by combining local and remote environments with a rich set of built-in features. 

-## 🚀 v0.3 Massive Update!
+## 🚀 v0.4 Major Upgrades

-The brand-new v0.3 introduces comprehensive upgrades to both architecture and user experience:
- ✨ **Global Real-Time Font Settings** (Thanks to [@ancion](https://github.com/ancion) for [PR #6](https://github.com/rust-kotlin/ashell/pull/6)): Customize your global UI fonts and terminal rendering fonts independently. Adjust text size in real-time with automatic persistence.
- ✨ **Concurrent SFTP Transfers**: A dedicated Transfers dialog now supports highly optimized, concurrent file uploads and downloads with precise progress display.
- ✨ **Persistent Workspace State**: Your sidebar width adjustments, terminal themes, font settings, and file visibility preferences are completely restored upon your next launch!
- ✨ **Intelligent SSH Disconnect/Reconnect**: Greatly enhanced SSH connection resilience. Provides a beautiful and localized overlay for one-click re-connection on unexpected disconnections.
- ✨ **Hot-Swappable i18n System**: Deeply optimized internationalization. Switch instantly between English and Simplified Chinese without restarting the application.
- ✨ **Smart Right-Click Actions**: Added intelligent right-click copy and paste for the terminal, featuring a dedicated settings toggle and OS-native keyboard shortcut hints.
+v0.4 builds on the v0.3 foundation and focuses on more capable workspace operations and a smoother daily workflow:
+- ✨ **Keybinding Management**: View and edit common shortcuts from the settings UI with conflict hints.
+- ✨ **Settings Page Polish**: A more compact and clearer settings experience with improved layout and interaction flow.
+- ✨ **Multi-Pane Tabs with a tmux-like Workflow**: A single tab can now host multiple panes, with split, focus, and switching actions for a tmux-inspired experience.
+- ✨ **Transfer History Improvements**: The transfer history panel now presents richer task details, making upload and download activity easier to review.
+- ✨ **SSH Passphrase Support**: Private keys can now store a passphrase, and SSH connections will use it automatically.
+- ✨ **Terminal Rendering Enhancements**: Terminal rendering now handles Block Elements and similar custom glyphs more completely.

 ## Download

@@ -24,8 +24,28 @@ You can download the latest pre-compiled releases for macOS, Windows, and Linux

 ## Mac Installation Guide

-After downloading, please unzip the file and move `ashell.app` to your **Applications** folder. 
-Since the app uses ad-hoc signing, macOS may warn that the app is "damaged" upon first launch. If this happens, open Terminal and run the following command:
+### Method 1: Homebrew (Recommended)
+
+If you use [Homebrew](https://brew.sh/), you can install it quickly with:
+
+```bash
+brew install rust-kotlin/taps/ashell --cask
+```
+
+To update the app:
+
+```bash
+brew update
+brew upgrade ashell --cask
+```
+
+> **Note**: Since the app uses ad-hoc signing, the Homebrew installation or update includes a postflight script to automatically handle the quarantine flag. This will require you to enter your administrator password for authorization.
+
+### Method 2: Manual Download
+
+1. Download and unzip from the [Releases page](https://github.com/rust-kotlin/ashell/releases/latest).
+2. Move `ashell.app` to your **Applications** folder. 
+3. Since the app uses ad-hoc signing, macOS may warn that the app is "damaged" upon first launch. If this happens, open Terminal and run:

 ```bash
 sudo xattr -cr /Applications/ashell.app
@@ -43,6 +63,7 @@ The current version provides a fully-featured GPUI-native workspace:
 - **System Telemetry:** Real-time visualization of CPU, memory, swap, network, and disk metrics in the left cockpit sidebar.
 - **Theming System:** Switch between multiple GPUI Component themes directly from the top toolbar.
 - **Embedded Fonts:** Uses embedded Maple Mono NF CN fonts out-of-the-box for excellent CJK character and Nerd Font icon support.
+- **v0.3 Core Enhancements:** Global font and font-size controls, concurrent SFTP transfers, persistent layout state, disconnect awareness, hot-swappable i18n, and smart terminal right-click copy/paste.

 ## Run

@@ -8,15 +8,15 @@

 该项目旨在通过结合本地和远程环境，并内置丰富的核心功能，提供一个高性能且美观的 Shell 工作区。

-## 🚀 v0.3 版本重磅更新！
+## 🚀 v0.4 版本重要升级

-全新发布的 v0.3 迎来了架构和体验的全面升级：
- ✨ **全局实时字体设置与字号调节**（感谢 [@ancion](https://github.com/ancion) 提供的 [PR #6](https://github.com/rust-kotlin/ashell/pull/6)）：支持自定义全局 UI 字体和终端渲染字体，支持实时字号调节并自动记忆。
- ✨ **SFTP 多任务并发传输队列**：引入全新的独立传输对话框，支持多文件并发上传下载，提供精准的进度展示。
- ✨ **持久化工作区记忆**：您对侧边栏的尺寸拖拽、终端主题、字体、隐藏文件开关等一切设置都会在下次启动时原样恢复！
- ✨ **智能断线重连与状态感知**：全面增强的 SSH 网络异常处理机制，断线后直接提供美观的覆盖层用于一键重连或关闭。
- ✨ **多语言热切换增强**：深度优化的 i18n 系统，包含中文与英文在内的所有界面文案现在均支持热切换。
- ✨ **智能右键快捷操作**：新增终端右键智能复制与粘贴功能，提供专属设置项自由控制开关，并支持根据不同操作系统自适应显示原生快捷键提示。
+v0.4 在 v0.3 打下的基础上，重点带来了更完整的工作区操作能力和更顺手的日常体验：
+- ✨ **键位管理功能**：支持在设置中可视化查看和修改常用快捷键，并提供冲突提示。
+- ✨ **设置页优化**：设置页的布局和交互更加紧凑顺手，整体信息层级更清晰。
+- ✨ **Tab 内多 Pane 与类 tmux 体验**：一个 tab 内现在可以管理多个 pane，支持分屏、聚焦和切换，提供更接近 tmux 的工作流。
+- ✨ **传输历史增强**：传输历史面板展示更完整的任务信息，便于回溯上传和下载过程。
+- ✨ **SSH passphrase 支持**：现在可以为私钥填写 passphrase，并在连接时自动使用保存的口令。
+- ✨ **终端显示优化**：终端渲染进一步增强，支持 Block Elements 等自定义图形字符的更完整显示。

 ## 下载

@@ -24,8 +24,28 @@

 ## Mac 安装指南

-下载并解压后，请先将 `ashell.app` 拖入或移动到 **应用程序 (Applications)** 目录。
-由于应用采用本地签名，初次启动时如果系统提示“App 已损坏，无法打开”，请打开终端（Terminal）并执行以下命令：
+### 方法 1: Homebrew 安装 (推荐)
+
+如果您使用 [Homebrew](https://brew.sh/)，可以通过以下命令快速安装：
+
+```bash
+brew install rust-kotlin/taps/ashell --cask
+```
+
+更新应用：
+
+```bash
+brew update
+brew upgrade ashell --cask
+```
+
+> **注意**: 由于应用采用本地签名，Homebrew 在安装或更新过程中会执行一个后置脚本来自动处理隔离属性（quarantine flag），这需要您输入管理员密码以授权。
+
+### 方法 2: 手动下载
+
+1. 从 [Releases 页面](https://github.com/rust-kotlin/ashell/releases/latest) 下载并解压。
+2. 将 `ashell.app` 拖入或移动到 **应用程序 (Applications)** 目录。
+3. 由于应用采用本地签名，初次启动时如果系统提示“App 已损坏，无法打开”，请打开终端（Terminal）并执行以下命令：

 ```bash
 sudo xattr -cr /Applications/ashell.app
@@ -43,6 +63,7 @@ sudo xattr -cr /Applications/ashell.app
 - **系统遥测**：在左侧边栏实时可视化显示 CPU、内存、Swap、网络和磁盘的使用指标。
 - **主题系统**：支持直接从顶部工具栏切换多种 GPUI Component 颜色主题。
 - **内置字体**：开箱即用，内置 Maple Mono NF CN 字体，提供卓越的中日韩（CJK）字符与 Nerd Font 图标支持。
+- **v0.3 核心增强**：全局字体与字号可调，支持 SFTP 并发传输、布局记忆、断线感知、多语言热切换，以及终端右键复制粘贴等增强能力。

 ## 运行

@@ -67,7 +67,10 @@ terminal_font_size: "Terminal Font Size"
 system_default: "System Default"
 ui_font_family: "UI Font"
 terminal_font_family: "Terminal Font"
-theme_management_hint: "Theme mode and light/dark theme families are managed from the top-bar theme button."
+monitoring_position: "Monitoring Position"
+position_bottom: "Bottom"
+position_sidebar: "Sidebar"
+position_hidden: "Hidden"
 local_host: "local host"
 local_terminal_opened: "local terminal opened"
 connecting: "Connecting"
@@ -91,7 +94,7 @@ n_folders: "%{folders} folders"
 n_files_and_folders: "%{files} files and %{folders} folders"
 reset: "Reset"
 reset_layout: "Reset Default Layout"
-reset_layout_success: "Layout reset. Window size takes effect on restart."
+reset_layout_hint: "Reset panel layout proportion. Window size will take effect on next startup."

 transfers: "Transfers"
 no_transfers_yet: "No transfers yet"
@@ -100,12 +103,80 @@ paused: "Paused"
 completed: "Completed"
 failed: "Failed"
 cancelled: "Cancelled"
+interrupted: "Interrupted"
 session: "Session"
+zombie: "Zombie"
+zombie_reason: "This transfer was interrupted because the application exited. The transfer task no longer exists."

 software_builtin: "Built-in"
 retry: "Retry"
 right_click_copy_paste: "Right-click Copy/Paste"
-copy_paste_hint: "Tip: Regardless of this switch, you can always use %{key} + C/V to copy/paste."
+copy_paste_hint: "Regardless of this switch, you can always use %{key} + C/V to copy/paste."
 edit_file: "Edit File"
 edit_file_tooltip: "Download to temporary directory, open in default editor, and auto upload on save."
 auto_saved_and_uploaded: "Auto-saved & uploaded: %{base}"
+scroll: "Scroll ↓"
+clone: "Clone"
+settings_general: "General"
+settings_key_bindings: "Key Bindings"
+settings_help: "Help"
+settings_about: "About"
+settings_group_appearance: "Appearance"
+settings_group_font: "Font"
+settings_group_other: "Other"
+settings_group_keybind_general: "General"
+settings_group_keybind_zoom: "Zoom"
+settings_group_keybind_focus: "Focus"
+settings_group_keybind_panel: "Panel"
+theme: "Theme"
+theme_mode: "Theme Mode"
+clear_transfers: "Clear History"
+transfers_limit: " (Max 100 records)"
+
+press_new_key: "Press new key..."
+settings_open_settings: "Open Settings"
+settings_open_session: "Open Session"
+settings_open_transfers: "Open Transfer History"
+files_downloading: "%{count} files downloading"
+files_uploading: "%{count} files uploading"
+panel_minimize: "Minimize Panel"
+panel_expand: "Expand Panel"
+settings_new_ssh: "New SSH"
+settings_toggle_sidebar: "Toggle Sidebar"
+settings_toggle_sftp_zoom: "Toggle SFTP Zoom"
+settings_focus_pane_left: "Focus Pane Left"
+settings_focus_pane_right: "Focus Pane Right"
+settings_focus_pane_up: "Focus Pane Up"
+settings_focus_pane_down: "Focus Pane Down"
+settings_split_pane_left: "Split Pane Left"
+settings_split_pane_right: "Split Pane Right"
+settings_split_pane_up: "Split Pane Up"
+settings_split_pane_down: "Split Pane Down"
+settings_close_pane: "Close Pane"
+keybind_conflict: '"%{key}" is already used by "%{action}", please choose another key'
+title_bar_style: "Title Bar Style"
+title_bar_native: "Native"
+title_bar_integrated: "Integrated"
+restart_hint: " (Restart required)"
+settings_sync: "Configuration Sync"
+sync_endpoint: "WebDAV Endpoint"
+sync_username: "WebDAV Username"
+sync_webdav_password: "WebDAV Password"
+sync_encryption_password: "Encryption Password (8+ characters)"
+sync_security_hint: "Only connection parameters are stored locally. WebDAV passwords, S3 secrets, and encryption passwords remain in memory for this process. Uploaded data is end-to-end encrypted. Downloading replaces locally saved SSH sessions."
+sync_s3_endpoint: "S3 Endpoint (optional for AWS S3)"
+sync_s3_region: "S3 Region"
+sync_s3_bucket: "S3 Bucket"
+sync_s3_object_key: "Object Key"
+sync_s3_access_key: "Access Key ID"
+sync_s3_secret_key: "Secret Access Key"
+sync_s3_session_token: "Session Token (optional)"
+sync_download: "Download Remote"
+sync_upload: "Upload Remote"
+sync_not_run: "Not synchronized yet"
+sync_uploading: "Encrypting and uploading configuration..."
+sync_downloading: "Downloading and decrypting configuration..."
+sync_upload_complete: "Configuration uploaded"
+sync_download_complete: "Configuration downloaded"
+sync_failed: "Synchronization failed"
+keyboard_interactive: "Keyboard Interactive"
@@ -23,7 +23,6 @@ system_path_warning: "警告：您即将删除系统关键路径！这可能会
 delete_success: "成功删除 %{count} 个项"
 delete_failed: "删除失败: %{err}"
 deleting_paths: "正在删除 %{count} 个项..."
-cancel: "取消"
 confirm: "确认"
 local_terminal: "本地终端"
 open_local_shell_tab: "打开一个新的本地终端页面"
@@ -69,7 +68,10 @@ terminal_font_size: "终端字体大小"
 system_default: "系统默认"
 ui_font_family: "界面字体"
 terminal_font_family: "终端字体"
-theme_management_hint: "主题模式和亮/暗主题系列可通过顶栏的主题按钮管理。"
+monitoring_position: "系统监控显示位置"
+position_bottom: "底部"
+position_sidebar: "侧边栏"
+position_hidden: "不显示"
 local_host: "本地主机"
 local_terminal_opened: "已打开本地终端"
 connecting: "正在连接"
@@ -93,7 +95,7 @@ n_folders: "%{folders} 个文件夹"
 n_files_and_folders: "%{files} 个文件及 %{folders} 个文件夹"
 reset: "重置"
 reset_layout: "恢复默认布局"
-reset_layout_success: "布局占比已恢复默认。窗口大小将在下次启动时生效。"
+reset_layout_hint: "重置面板布局占比，窗口大小将在下次启动时生效"

 transfers: "传输记录"
 no_transfers_yet: "暂无传输记录"
@@ -102,12 +104,81 @@ paused: "已暂停"
 completed: "已完成"
 failed: "失败"
 cancelled: "已取消"
+interrupted: "已中断"
 session: "会话"
+zombie: "僵尸任务"
+zombie_reason: "此传输任务因程序退出而中断，传输进程已不存在。"

 software_builtin: "软件内置"
 retry: "重试"
 right_click_copy_paste: "右键复制/粘贴"
-copy_paste_hint: "提示：不管是否开启此开关，都可以使用 %{key} + C/V 快捷键进行复制和粘贴。"
+copy_paste_hint: "不管是否开启此开关，都可以使用 %{key} + C/V 快捷键进行复制和粘贴。"
 edit_file: "编辑文件"
 edit_file_tooltip: "下载到临时目录，使用默认编辑器打开，并在保存后自动上传。"
 auto_saved_and_uploaded: "已自动保存并上传: %{base}"
+scroll: "滑动查看 ↓"
+clone: "克隆"
+about_feedback_hint: "如果遇到问题或者有什么建议，请前往我们的 GitHub 项目中反馈。"
+settings_general: "常规"
+settings_key_bindings: "快捷键"
+settings_help: "帮助"
+settings_about: "关于"
+settings_group_appearance: "外观"
+settings_group_font: "字体"
+settings_group_other: "其它"
+settings_group_keybind_general: "常规"
+settings_group_keybind_zoom: "缩放"
+settings_group_keybind_focus: "焦点"
+settings_group_keybind_panel: "面板"
+theme: "主题"
+theme_mode: "主题模式"
+clear_transfers: "清空记录"
+transfers_limit: " (最多保留 100 条)"
+
+press_new_key: "请按下新的快捷键..."
+settings_open_settings: "打开设置"
+settings_open_session: "打开会话"
+settings_open_transfers: "打开传输历史"
+files_downloading: "%{count} 个文件正在下载"
+files_uploading: "%{count} 个文件正在上传"
+panel_minimize: "折叠面板"
+panel_expand: "展开面板"
+settings_new_ssh: "新建 SSH"
+settings_toggle_sidebar: "缩放侧边栏"
+settings_toggle_sftp_zoom: "缩放 SFTP 面板"
+settings_focus_pane_left: "向左切换焦点"
+settings_focus_pane_right: "向右切换焦点"
+settings_focus_pane_up: "向上切换焦点"
+settings_focus_pane_down: "向下切换焦点"
+settings_split_pane_left: "向左拆分面板"
+settings_split_pane_right: "向右拆分面板"
+settings_split_pane_up: "向上拆分面板"
+settings_split_pane_down: "向下拆分面板"
+settings_close_pane: "关闭当前面板"
+keybind_conflict: '"%{key}" 已被「%{action}」使用，请选择其他快捷键'
+title_bar_style: "标题栏样式"
+title_bar_native: "原生"
+title_bar_integrated: "融合"
+restart_hint: " (修改后重启生效)"
+settings_sync: "配置同步"
+sync_endpoint: "WebDAV 地址"
+sync_username: "WebDAV 用户名"
+sync_webdav_password: "WebDAV 密码"
+sync_encryption_password: "配置加密口令（至少 8 位）"
+sync_security_hint: "仅连接参数会保存到本机。WebDAV 密码、S3 密钥和加密口令只保留在当前进程内；上传内容使用端到端加密。下载会替换本机保存的 SSH 会话。"
+sync_s3_endpoint: "S3 Endpoint（AWS S3 可留空）"
+sync_s3_region: "S3 Region"
+sync_s3_bucket: "S3 Bucket"
+sync_s3_object_key: "对象路径"
+sync_s3_access_key: "Access Key ID"
+sync_s3_secret_key: "Secret Access Key"
+sync_s3_session_token: "Session Token（可选）"
+sync_download: "从远程下载"
+sync_upload: "上传到远程"
+sync_not_run: "尚未同步"
+sync_uploading: "正在加密并上传配置..."
+sync_downloading: "正在下载并解密配置..."
+sync_upload_complete: "配置上传完成"
+sync_download_complete: "配置下载完成"
+sync_failed: "同步失败"
+keyboard_interactive: "键盘交互"
@@ -0,0 +1,129 @@
+use gpui::{Context, Entity, SharedString};
+use gpui_component::input::InputState;
+use rust_i18n::t;
+
+use crate::{
+    Ashell,
+    sync::{self, SyncBackendCredentials, SyncCredentials, SyncPayload, SyncResult},
+    terminal::BackendEvent,
+};
+
+impl Ashell {
+    fn sync_input_value(input: &Entity<InputState>, cx: &Context<Self>) -> String {
+        input.read(cx).value().trim().to_string()
+    }
+
+    fn sync_credentials(&self, cx: &Context<Self>) -> SyncCredentials {
+        let backend = if self.config.sync_backend() == "s3" {
+            SyncBackendCredentials::S3 {
+                endpoint: Self::sync_input_value(&self.sync_s3_endpoint_input, cx),
+                region: Self::sync_input_value(&self.sync_s3_region_input, cx),
+                bucket: Self::sync_input_value(&self.sync_s3_bucket_input, cx),
+                object_key: Self::sync_input_value(&self.sync_s3_object_key_input, cx),
+                access_key: Self::sync_input_value(&self.sync_s3_access_key_input, cx),
+                secret_key: self.sync_s3_secret_key_input.read(cx).value().to_string(),
+                session_token: self
+                    .sync_s3_session_token_input
+                    .read(cx)
+                    .value()
+                    .to_string(),
+            }
+        } else {
+            SyncBackendCredentials::WebDav {
+                endpoint: Self::sync_input_value(&self.sync_endpoint_input, cx),
+                username: Self::sync_input_value(&self.sync_username_input, cx),
+                password: self.sync_webdav_password_input.read(cx).value().to_string(),
+            }
+        };
+        SyncCredentials {
+            backend,
+            encryption_password: self
+                .sync_encryption_password_input
+                .read(cx)
+                .value()
+                .to_string(),
+        }
+    }
+
+    fn begin_sync(
+        &mut self,
+        status: SharedString,
+        cx: &mut Context<Self>,
+    ) -> Option<SyncCredentials> {
+        if self.sync_in_progress {
+            return None;
+        }
+        let credentials = self.sync_credentials(cx);
+        match &credentials.backend {
+            SyncBackendCredentials::WebDav {
+                endpoint, username, ..
+            } => {
+                self.config
+                    .set_sync_connection(endpoint.clone(), username.clone());
+            }
+            SyncBackendCredentials::S3 {
+                endpoint,
+                region,
+                bucket,
+                object_key,
+                ..
+            } => {
+                self.config.set_sync_s3_connection(
+                    endpoint.clone(),
+                    region.clone(),
+                    bucket.clone(),
+                    object_key.clone(),
+                );
+            }
+        }
+        if let Err(err) = self.config.save() {
+            self.sync_status = format!("{}: {err:#}", t!("sync_failed")).into();
+            cx.notify();
+            return None;
+        }
+        self.sync_in_progress = true;
+        self.sync_status = status;
+        cx.notify();
+        Some(credentials)
+    }
+
+    pub(crate) fn set_sync_backend(&mut self, backend: &str, cx: &mut Context<Self>) {
+        self.config.set_sync_backend(backend);
+        let _ = self.config.save();
+        self.sync_status = t!("sync_not_run").into();
+        cx.notify();
+    }
+
+    pub(crate) fn upload_sync_config(&mut self, cx: &mut Context<Self>) {
+        let Some(credentials) = self.begin_sync(t!("sync_uploading").into(), cx) else {
+            return;
+        };
+        let payload = SyncPayload::new(
+            self.config.sync_device_id().to_string(),
+            self.config.sessions().to_vec(),
+        );
+        let expected_etag = self.config.sync_etag().map(str::to_string);
+        let events = self.events_tx.clone();
+        self.runtime.spawn(async move {
+            let result = match sync::upload(credentials, payload, expected_etag).await {
+                Ok(etag) => SyncResult::Uploaded { etag },
+                Err(err) => SyncResult::Failed(format!("{err:#}")),
+            };
+            let _ = events.send(BackendEvent::SyncFinished(result));
+        });
+    }
+
+    pub(crate) fn download_sync_config(&mut self, cx: &mut Context<Self>) {
+        let Some(credentials) = self.begin_sync(t!("sync_downloading").into(), cx) else {
+            return;
+        };
+        let events = self.events_tx.clone();
+        self.runtime.spawn(async move {
+            let result = match sync::download(credentials).await {
+                Ok((payload, etag)) => SyncResult::Downloaded { payload, etag },
+                Err(err) => SyncResult::Failed(format!("{err:#}")),
+            };
+            let _ = events.send(BackendEvent::SyncFinished(result));
+        });
+    }
+}
@@ -0,0 +1,8 @@
+pub(crate) const DEFAULT_COLS: u16 = 100;
+pub(crate) const DEFAULT_ROWS: u16 = 30;
+pub(crate) const SIDEBAR_WIDTH: f32 = 306.0;
+pub(crate) const COLLAPSED_SIDEBAR_WIDTH: f32 = 52.0;
+pub(crate) const TAB_BAR_HEIGHT: f32 = 52.0;
+pub(crate) const TERMINAL_PADDING_X: f32 = 32.0;
+pub(crate) const TERMINAL_PADDING_Y: f32 = 32.0;
+pub(crate) const TERMINAL_KEY_CONTEXT: &str = "AshellTerminal";
@@ -0,0 +1,391 @@
+use gpui::{
+    Action as _, App, Entity, IntoElement, KeyBinding, KeyDownEvent, Keystroke, Unbind, prelude::*,
+};
+use gpui_component::{
+    Sizable,
+    button::{Button, ButtonVariants},
+    kbd::Kbd,
+    setting::{SettingField, SettingGroup, SettingItem},
+};
+use rust_i18n::t;
+
+use crate::{Ashell, session::config::ConfigStore};
+
+gpui::actions!(
+    ashell_workspace,
+    [
+        OpenSettings,
+        OpenSession,
+        OpenTransfers,
+        NewSsh,
+        ToggleSidebar,
+        ToggleSftpZoom,
+        FocusPaneLeft,
+        FocusPaneRight,
+        FocusPaneUp,
+        FocusPaneDown,
+        SplitPaneLeft,
+        SplitPaneRight,
+        SplitPaneUp,
+        SplitPaneDown,
+        ClosePane
+    ]
+);
+
+pub struct KeybindingsPage;
+
+#[derive(Clone, Copy)]
+pub(crate) struct WorkspaceAction {
+    id: &'static str,
+    label_key: &'static str,
+    default_suffix: &'static str,
+}
+
+pub(crate) const WORKSPACE_ACTIONS: &[WorkspaceAction] = &[
+    WorkspaceAction {
+        id: "OpenSettings",
+        label_key: "settings_open_settings",
+        default_suffix: ",",
+    },
+    WorkspaceAction {
+        id: "OpenSession",
+        label_key: "settings_open_session",
+        default_suffix: "o",
+    },
+    WorkspaceAction {
+        id: "OpenTransfers",
+        label_key: "settings_open_transfers",
+        default_suffix: "t",
+    },
+    WorkspaceAction {
+        id: "NewSsh",
+        label_key: "settings_new_ssh",
+        default_suffix: "n",
+    },
+    WorkspaceAction {
+        id: "ToggleSidebar",
+        label_key: "settings_toggle_sidebar",
+        default_suffix: "s",
+    },
+    WorkspaceAction {
+        id: "ToggleSftpZoom",
+        label_key: "settings_toggle_sftp_zoom",
+        default_suffix: "m",
+    },
+    WorkspaceAction {
+        id: "FocusPaneLeft",
+        label_key: "settings_focus_pane_left",
+        default_suffix: "h",
+    },
+    WorkspaceAction {
+        id: "FocusPaneRight",
+        label_key: "settings_focus_pane_right",
+        default_suffix: "l",
+    },
+    WorkspaceAction {
+        id: "FocusPaneUp",
+        label_key: "settings_focus_pane_up",
+        default_suffix: "k",
+    },
+    WorkspaceAction {
+        id: "FocusPaneDown",
+        label_key: "settings_focus_pane_down",
+        default_suffix: "j",
+    },
+    WorkspaceAction {
+        id: "SplitPaneLeft",
+        label_key: "settings_split_pane_left",
+        default_suffix: "shift-h",
+    },
+    WorkspaceAction {
+        id: "SplitPaneRight",
+        label_key: "settings_split_pane_right",
+        default_suffix: "shift-l",
+    },
+    WorkspaceAction {
+        id: "SplitPaneUp",
+        label_key: "settings_split_pane_up",
+        default_suffix: "shift-k",
+    },
+    WorkspaceAction {
+        id: "SplitPaneDown",
+        label_key: "settings_split_pane_down",
+        default_suffix: "shift-j",
+    },
+    WorkspaceAction {
+        id: "ClosePane",
+        label_key: "settings_close_pane",
+        default_suffix: "w",
+    },
+];
+
+pub(crate) fn default_modifier() -> &'static str {
+    if cfg!(target_os = "macos") {
+        "cmd"
+    } else {
+        "ctrl"
+    }
+}
+
+pub(crate) fn default_keystroke(action_id: &str) -> Option<String> {
+    WORKSPACE_ACTIONS
+        .iter()
+        .find(|action| action.id == action_id)
+        .map(|action| format!("{}-{}", default_modifier(), action.default_suffix))
+}
+
+pub(crate) fn configured_keystroke(config: &ConfigStore, action_id: &str) -> Option<String> {
+    config
+        .key_bindings()
+        .get(action_id)
+        .cloned()
+        .or_else(|| default_keystroke(action_id))
+}
+
+pub(crate) fn normalize_recorded_keystroke(event: &KeyDownEvent) -> Option<String> {
+    let key = event.keystroke.key.trim();
+    if key.is_empty() {
+        return None;
+    }
+
+    let mut parts = Vec::new();
+    if event.keystroke.modifiers.control {
+        parts.push("ctrl".to_string());
+    }
+    if event.keystroke.modifiers.alt {
+        parts.push("alt".to_string());
+    }
+    if event.keystroke.modifiers.shift {
+        parts.push("shift".to_string());
+    }
+    if event.keystroke.modifiers.platform {
+        parts.push("cmd".to_string());
+    }
+    if event.keystroke.modifiers.function {
+        parts.push("fn".to_string());
+    }
+
+    parts.push(key.to_ascii_lowercase());
+    let keystroke = parts.join("-");
+    Keystroke::parse(&keystroke).ok().map(|_| keystroke)
+}
+
+pub(crate) fn format_keystroke(keystroke: &str) -> String {
+    Keystroke::parse(keystroke)
+        .map(|stroke| Kbd::format(&stroke))
+        .unwrap_or_else(|_| keystroke.to_string())
+}
+
+pub(crate) fn bind_workspace_keys_from_config(cx: &mut App, config: &ConfigStore) {
+    bind_workspace_actions(cx, config);
+}
+
+/// Unbind all workspace keybindings (used when entering keybinding settings to prevent interference).
+pub(crate) fn unbind_all_workspace_keys(cx: &mut App, config: &ConfigStore) {
+    let mut bindings = Vec::new();
+
+    macro_rules! unbind_action {
+        ($id:literal, $action:expr) => {
+            let default = default_keystroke($id).expect("workspace action has default key");
+            let configured = configured_keystroke(config, $id).unwrap_or_else(|| default.clone());
+            let action_name = $action.name();
+
+            // Unbind both the default and configured keystroke
+            bindings.push(KeyBinding::new(&default, Unbind(action_name.into()), None));
+            if configured != default {
+                bindings.push(KeyBinding::new(
+                    &configured,
+                    Unbind(action_name.into()),
+                    None,
+                ));
+            }
+        };
+    }
+
+    unbind_action!("OpenSettings", crate::OpenSettings);
+    unbind_action!("OpenSession", crate::OpenSession);
+    unbind_action!("OpenTransfers", crate::OpenTransfers);
+    unbind_action!("NewSsh", crate::NewSsh);
+    unbind_action!("ToggleSidebar", crate::ToggleSidebar);
+    unbind_action!("ToggleSftpZoom", crate::ToggleSftpZoom);
+    unbind_action!("FocusPaneLeft", crate::FocusPaneLeft);
+    unbind_action!("FocusPaneRight", crate::FocusPaneRight);
+    unbind_action!("FocusPaneUp", crate::FocusPaneUp);
+    unbind_action!("FocusPaneDown", crate::FocusPaneDown);
+    unbind_action!("SplitPaneLeft", crate::SplitPaneLeft);
+    unbind_action!("SplitPaneRight", crate::SplitPaneRight);
+    unbind_action!("SplitPaneUp", crate::SplitPaneUp);
+    unbind_action!("SplitPaneDown", crate::SplitPaneDown);
+    unbind_action!("ClosePane", crate::ClosePane);
+
+    cx.bind_keys(bindings);
+}
+
+/// Check if a keystroke conflicts with any other action's binding.
+/// Returns Some((conflicting_action_id, label)) if there is a conflict.
+pub(crate) fn find_conflict(
+    config: &ConfigStore,
+    current_action_id: &str,
+    new_keystroke: &str,
+) -> Option<(String, String)> {
+    for action in WORKSPACE_ACTIONS {
+        if action.id == current_action_id {
+            continue;
+        }
+        let existing = configured_keystroke(config, action.id).unwrap_or_default();
+        if !existing.is_empty() && existing == new_keystroke {
+            return Some((action.id.to_string(), t!(action.label_key).to_string()));
+        }
+    }
+    None
+}
+
+fn bind_workspace_actions(cx: &mut App, config: &ConfigStore) {
+    let mut bindings = Vec::new();
+
+    macro_rules! bind_action {
+        ($id:literal, $action:expr) => {
+            let default = default_keystroke($id).expect("workspace action has default key");
+            let configured = configured_keystroke(config, $id).unwrap_or_else(|| default.clone());
+            let action_name = $action.name();
+
+            if configured != default {
+                bindings.push(KeyBinding::new(&default, Unbind(action_name.into()), None));
+            }
+
+            bindings.push(KeyBinding::new(&configured, $action, None));
+        };
+    }
+
+    bind_action!("OpenSettings", crate::OpenSettings);
+    bind_action!("OpenSession", crate::OpenSession);
+    bind_action!("OpenTransfers", crate::OpenTransfers);
+    bind_action!("NewSsh", crate::NewSsh);
+    bind_action!("ToggleSidebar", crate::ToggleSidebar);
+    bind_action!("ToggleSftpZoom", crate::ToggleSftpZoom);
+    bind_action!("FocusPaneLeft", crate::FocusPaneLeft);
+    bind_action!("FocusPaneRight", crate::FocusPaneRight);
+    bind_action!("FocusPaneUp", crate::FocusPaneUp);
+    bind_action!("FocusPaneDown", crate::FocusPaneDown);
+    bind_action!("SplitPaneLeft", crate::SplitPaneLeft);
+    bind_action!("SplitPaneRight", crate::SplitPaneRight);
+    bind_action!("SplitPaneUp", crate::SplitPaneUp);
+    bind_action!("SplitPaneDown", crate::SplitPaneDown);
+    bind_action!("ClosePane", crate::ClosePane);
+
+    cx.bind_keys(bindings);
+}
+
+impl KeybindingsPage {
+    pub fn render_groups(view: &Entity<Ashell>, cx: &mut App) -> Vec<SettingGroup> {
+        let groups = [
+            (
+                "settings_group_keybind_general",
+                vec!["OpenSettings", "OpenSession", "OpenTransfers", "NewSsh"],
+            ),
+            (
+                "settings_group_keybind_zoom",
+                vec!["ToggleSidebar", "ToggleSftpZoom"],
+            ),
+            (
+                "settings_group_keybind_focus",
+                vec![
+                    "FocusPaneLeft",
+                    "FocusPaneRight",
+                    "FocusPaneUp",
+                    "FocusPaneDown",
+                ],
+            ),
+            (
+                "settings_group_keybind_panel",
+                vec![
+                    "SplitPaneLeft",
+                    "SplitPaneRight",
+                    "SplitPaneUp",
+                    "SplitPaneDown",
+                    "ClosePane",
+                ],
+            ),
+        ];
+
+        let mut result = Vec::new();
+
+        for (group_label, action_ids) in groups {
+            let mut group = SettingGroup::new().title(t!(group_label).to_string());
+
+            for action_id in action_ids {
+                let action = WORKSPACE_ACTIONS
+                    .iter()
+                    .find(|a| a.id == action_id)
+                    .expect("action exists");
+
+                let recording = view.read(cx).recording_action.as_deref() == Some(action.id);
+                let has_error = view
+                    .read(cx)
+                    .keybind_error
+                    .as_ref()
+                    .is_some_and(|(id, _)| id == action.id);
+                let error_msg = if has_error {
+                    view.read(cx)
+                        .keybind_error
+                        .as_ref()
+                        .map(|(_, msg)| msg.clone())
+                } else {
+                    None
+                };
+
+                let keystroke = {
+                    let config = &view.read(cx).config;
+                    configured_keystroke(config, action.id).unwrap_or_default()
+                };
+
+                let btn_label = if recording {
+                    t!("press_new_key").to_string()
+                } else if keystroke.is_empty() {
+                    t!("none").to_string()
+                } else {
+                    format_keystroke(&keystroke)
+                };
+
+                let mut item = SettingItem::new(
+                    t!(action.label_key).to_string(),
+                    SettingField::render({
+                        let view = view.clone();
+                        let action_id = action.id.to_string();
+                        move |_, _window, _cx| {
+                            Button::new(gpui::SharedString::from(format!("keybind-{action_id}")))
+                                .label(btn_label.clone())
+                                .small()
+                                .when(recording, |this| this.primary())
+                                .when(has_error, |this| this.danger())
+                                .on_click({
+                                    let view = view.clone();
+                                    let action_id = action_id.clone();
+                                    move |_event, window, cx| {
+                                        view.update(cx, |this, cx| {
+                                            // Clear any previous error when starting new recording
+                                            this.keybind_error = None;
+                                            this.recording_action = Some(action_id.clone());
+                                            this.focus_handle.focus(window, cx);
+                                            cx.notify();
+                                        });
+                                    }
+                                })
+                                .into_any_element()
+                        }
+                    }),
+                );
+
+                if let Some(msg) = error_msg {
+                    item = item.description(msg);
+                }
+
+                group = group.item(item);
+            }
+
+            result.push(group);
+        }
+
+        result
+    }
+}
@@ -0,0 +1,337 @@
+use gpui::{App, AppContext as _, Bounds, WindowOptions, point, px, size};
+use gpui_component::Root;
+
+use crate::Ashell;
+use crate::session::config::ConfigStore;
+
+pub(crate) fn bind_workspace_keys(cx: &mut gpui::App) {
+    let config = ConfigStore::load().unwrap_or_else(|_| ConfigStore::in_memory());
+    crate::app::keybinding_recorder::bind_workspace_keys_from_config(cx, &config);
+}
+
+struct LocalMinutelyRoller {
+    dir: std::path::PathBuf,
+    prefix: String,
+    current_minute: u32,
+    file: Option<std::fs::File>,
+}
+
+impl LocalMinutelyRoller {
+    fn new(dir: std::path::PathBuf, prefix: String) -> Self {
+        Self {
+            dir,
+            prefix,
+            current_minute: 60,
+            file: None,
+        }
+    }
+
+    fn rollover(&mut self, now: chrono::DateTime<chrono::Local>) -> std::io::Result<()> {
+        use chrono::Timelike;
+        let minute = now.minute();
+        if self.current_minute != minute || self.file.is_none() {
+            let filename = format!("{}-{}.log", self.prefix, now.format("%Y-%m-%d-%H-%M"));
+            let path = self.dir.join(filename);
+            let file = std::fs::OpenOptions::new()
+                .create(true)
+                .append(true)
+                .open(&path)?;
+            self.file = Some(file);
+            self.current_minute = minute;
+
+            // Cleanup old files keeping last 6
+            if let Ok(entries) = std::fs::read_dir(&self.dir) {
+                let mut files: Vec<_> = entries
+                    .filter_map(|e| e.ok())
+                    .filter(|e| e.file_name().to_string_lossy().starts_with(&self.prefix))
+                    .collect();
+                files.sort_by_key(|e| {
+                    e.metadata()
+                        .and_then(|m| m.modified())
+                        .unwrap_or(std::time::SystemTime::UNIX_EPOCH)
+                });
+                if files.len() > 6 {
+                    for file in files.iter().take(files.len() - 6) {
+                        let _ = std::fs::remove_file(file.path());
+                    }
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+impl std::io::Write for LocalMinutelyRoller {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        let now = chrono::Local::now();
+        let _ = self.rollover(now);
+        if let Some(f) = &mut self.file {
+            f.write(buf)
+        } else {
+            Ok(buf.len())
+        }
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        if let Some(f) = &mut self.file {
+            f.flush()
+        } else {
+            Ok(())
+        }
+    }
+}
+
+pub(crate) fn init_logging() {
+    use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
+
+    let log_dir = directories::BaseDirs::new()
+        .map(|dirs| dirs.home_dir().join(".config").join("ashell").join("log"))
+        .unwrap_or_else(|| std::path::PathBuf::from("."));
+
+    std::fs::create_dir_all(&log_dir).ok();
+
+    let roller = LocalMinutelyRoller::new(log_dir.clone(), "ashell".to_string());
+
+    let (non_blocking, _guard) = tracing_appender::non_blocking(roller);
+    // Leak the guard so it lives for the entire duration of the app since GPUI's run might not return
+    std::mem::forget(_guard);
+
+    let env_filter = tracing_subscriber::EnvFilter::try_from_default_env()
+        .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info"));
+
+    let stdout_layer = if cfg!(debug_assertions) {
+        Some(
+            tracing_subscriber::fmt::layer()
+                .with_timer(tracing_subscriber::fmt::time::LocalTime::rfc_3339())
+                .with_target(true),
+        )
+    } else {
+        None
+    };
+
+    let file_layer = tracing_subscriber::fmt::layer()
+        .with_timer(tracing_subscriber::fmt::time::LocalTime::rfc_3339())
+        .with_writer(non_blocking)
+        .with_ansi(false)
+        .with_target(true);
+
+    tracing_subscriber::registry()
+        .with(env_filter)
+        .with(stdout_layer)
+        .with(file_layer)
+        .init();
+}
+
+#[cfg(target_os = "macos")]
+pub(crate) fn sync_macos_launch_environment() {
+    let shell = std::env::var("SHELL").unwrap_or_else(|_| "/bin/zsh".to_string());
+    let Ok(output) = std::process::Command::new(&shell)
+        .args(["-l", "-c", "env -0"])
+        .output()
+    else {
+        return;
+    };
+    if !output.status.success() {
+        return;
+    }
+
+    for entry in output.stdout.split(|b| *b == 0) {
+        if entry.is_empty() {
+            continue;
+        }
+        let Some(eq) = entry.iter().position(|b| *b == b'=') else {
+            continue;
+        };
+        let Ok(key) = std::str::from_utf8(&entry[..eq]) else {
+            continue;
+        };
+        let Ok(value) = std::str::from_utf8(&entry[eq + 1..]) else {
+            continue;
+        };
+
+        let should_import = matches!(
+            key,
+            "PATH"
+                | "MANPATH"
+                | "INFOPATH"
+                | "LANG"
+                | "LC_ALL"
+                | "LC_CTYPE"
+                | "SHELL"
+                | "HOME"
+                | "HOMEBREW_PREFIX"
+                | "HOMEBREW_CELLAR"
+                | "HOMEBREW_REPOSITORY"
+        ) || key.starts_with("LC_");
+
+        if should_import {
+            unsafe {
+                std::env::set_var(key, value);
+            }
+        }
+    }
+}
+
+#[cfg(not(target_os = "macos"))]
+pub(crate) fn sync_macos_launch_environment() {}
+
+pub(crate) fn open_main_window(cx: &mut App) {
+    let config = ConfigStore::load().unwrap_or_else(|_| ConfigStore::in_memory());
+
+    let mut window_options = WindowOptions::default();
+
+    if config.title_bar_style() == crate::session::config::TitleBarStyle::Integrated {
+        window_options.titlebar = Some(gpui::TitlebarOptions {
+            title: None,
+            appears_transparent: true,
+            traffic_light_position: Some(gpui::point(px(9.0), px(9.0))),
+        });
+    }
+
+    #[cfg(not(target_os = "macos"))]
+    if let Ok(img) = image::load_from_memory(include_bytes!("../../assets/icons/ashell.png")) {
+        window_options.icon = Some(std::sync::Arc::new(img.into_rgba8()));
+    }
+
+    if let Some(bounds) = config.window_bounds() {
+        window_options.window_bounds = Some(match bounds {
+            crate::session::config::SavedWindowBounds::Fullscreen {
+                x,
+                y,
+                width,
+                height,
+            } => gpui::WindowBounds::Fullscreen(Bounds::new(
+                point(px(*x), px(*y)),
+                size(px(*width), px(*height)),
+            )),
+            crate::session::config::SavedWindowBounds::Maximized {
+                x,
+                y,
+                width,
+                height,
+            } => gpui::WindowBounds::Maximized(Bounds::new(
+                point(px(*x), px(*y)),
+                size(px(*width), px(*height)),
+            )),
+            crate::session::config::SavedWindowBounds::Windowed {
+                x,
+                y,
+                width,
+                height,
+            } => gpui::WindowBounds::Windowed(Bounds::new(
+                point(px(*x), px(*y)),
+                size(px(*width), px(*height)),
+            )),
+        });
+    } else if let Some(display) = cx.displays().first().cloned() {
+        let display_bounds = display.bounds();
+        let width = display_bounds.size.width * 0.8;
+        let height = display_bounds.size.height * 0.9;
+
+        let x = display_bounds.origin.x + (display_bounds.size.width - width) / 2.0;
+
+        #[cfg(target_os = "macos")]
+        let y = display_bounds.origin.y;
+        #[cfg(not(target_os = "macos"))]
+        let y = display_bounds.origin.y + (display_bounds.size.height - height) / 2.0;
+
+        window_options.window_bounds = Some(gpui::WindowBounds::Windowed(Bounds::new(
+            point(x, y),
+            size(width, height),
+        )));
+    }
+
+    cx.open_window(window_options, |window, cx| {
+        window.activate_window();
+        window.set_window_title("ashell");
+        gpui_component::Theme::sync_system_appearance(Some(window), cx);
+        let view = cx.new(|cx| Ashell::new(window, cx));
+
+        tracing::info!("[ui] main application window opened");
+        let focus_handle = view.read(cx).focus_handle.clone();
+        window.focus(&focus_handle, cx);
+
+
+
+        let workspace_panels_clone = view.read(cx).workspace_panels.clone();
+        let body_panels_clone = view.read(cx).body_panels.clone();
+        let view_clone = view.clone();
+        window.on_window_should_close(cx, move |window: &mut gpui::Window, cx: &mut gpui::App| {
+            if view_clone.read(cx).is_layout_reset {
+                tracing::info!("[ui] layout was reset, skipping save layout state.");
+                return true;
+            }
+            let current_bounds = window.window_bounds();
+            let bounds = match current_bounds {
+                gpui::WindowBounds::Fullscreen(b) => b,
+                gpui::WindowBounds::Maximized(b) => b,
+                gpui::WindowBounds::Windowed(b) => b,
+            };
+            let size = bounds.size;
+            if size.width.as_f32() > 400.0 && size.height.as_f32() > 300.0 {
+                tracing::info!("[ui] main application window closed, saving layout state...");
+                let mut config = ConfigStore::load().unwrap_or_else(|_| ConfigStore::in_memory());
+                let saved_bounds = match current_bounds {
+                    gpui::WindowBounds::Fullscreen(b) => {
+                        crate::session::config::SavedWindowBounds::Fullscreen {
+                            x: b.origin.x.into(),
+                            y: b.origin.y.into(),
+                            width: b.size.width.into(),
+                            height: b.size.height.into(),
+                        }
+                    }
+                    gpui::WindowBounds::Maximized(b) => {
+                        crate::session::config::SavedWindowBounds::Maximized {
+                            x: b.origin.x.into(),
+                            y: b.origin.y.into(),
+                            width: b.size.width.into(),
+                            height: b.size.height.into(),
+                        }
+                    }
+                    gpui::WindowBounds::Windowed(b) => {
+                        crate::session::config::SavedWindowBounds::Windowed {
+                            x: b.origin.x.into(),
+                            y: b.origin.y.into(),
+                            width: b.size.width.into(),
+                            height: b.size.height.into(),
+                        }
+                    }
+                };
+                let workspace_sizes: Vec<f32> = workspace_panels_clone
+                    .read(cx)
+                    .sizes()
+                    .iter()
+                    .map(|s| s.into())
+                    .collect();
+                let mut body_sizes: Vec<f32> = body_panels_clone
+                    .read(cx)
+                    .sizes()
+                    .iter()
+                    .map(|s| s.into())
+                    .collect();
+
+                if view_clone.read(cx).sftp_panel_minimized {
+                    if let Some(prev) = view_clone.read(cx).prev_monitoring_size {
+                        if body_sizes.len() > 1 {
+                            body_sizes[1] = prev.into();
+                        }
+                    }
+                }
+
+                config.set_layout_state(Some(saved_bounds), Some(workspace_sizes), Some(body_sizes));
+                config.set_sidebar_collapsed(view_clone.read(cx).sidebar_collapsed);
+                config.set_sftp_panel_minimized(view_clone.read(cx).sftp_panel_minimized);
+                let _ = config.save();
+            } else {
+                tracing::warn!(
+                    "[ui] window size is too small ({:?}), skipping save layout state to prevent corrupting saved bounds.",
+                    size
+                );
+            }
+            true
+        });
+
+        cx.new(|cx| Root::new(view, window, cx))
+    })
+    .expect("failed to open window");
+}
@@ -0,0 +1,162 @@
+use anyhow::{Context as _, Result};
+use gpui::{App, Context, SharedString, Window, px};
+use gpui_component::{ActiveTheme as _, Theme, ThemeMode, ThemeRegistry};
+
+use crate::Ashell;
+
+pub(crate) const EMBEDDED_THEME_JSONS: &[&str] = &[
+    include_str!("../../assets/themes/matrix.json"),
+    include_str!("../../assets/themes/tokyonight.json"),
+    include_str!("../../assets/themes/gruvbox.json"),
+    include_str!("../../assets/themes/solarized.json"),
+];
+
+pub(crate) fn load_fonts(cx: &mut App) -> Result<()> {
+    let regular = std::borrow::Cow::Borrowed(
+        include_bytes!("../../assets/fonts/MapleMono-NF-CN-Regular.ttf").as_slice(),
+    );
+    let bold = std::borrow::Cow::Borrowed(
+        include_bytes!("../../assets/fonts/MapleMono-NF-CN-Bold.ttf").as_slice(),
+    );
+    cx.text_system()
+        .add_fonts(vec![regular, bold])
+        .context("load Maple Mono NF CN fonts")?;
+    set_theme_font_names(cx.global_mut::<Theme>(), ".SystemUIFont");
+    Ok(())
+}
+
+pub(crate) fn load_embedded_themes(cx: &mut App) {
+    let registry = ThemeRegistry::global_mut(cx);
+    for theme_json in EMBEDDED_THEME_JSONS {
+        if let Err(err) = registry.load_themes_from_str(theme_json) {
+            tracing::warn!("failed to load embedded theme: {err:#}");
+        }
+    }
+}
+
+pub(crate) fn set_theme_font_names(theme: &mut Theme, ui_font_family: &str) {
+    theme.font_family = ui_font_family.into();
+    theme.mono_font_family = ui_font_family.into();
+}
+
+impl Ashell {
+    pub(crate) fn switch_theme_mode(
+        &mut self,
+        mode: ThemeMode,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.follow_system_theme = false;
+        self.theme_mode = mode;
+        self.apply_theme_preferences(window, cx);
+        self.status = format!("theme mode: {}", cx.theme().mode.name()).into();
+        self.persist_theme_preferences();
+        cx.notify();
+    }
+
+    pub(crate) fn apply_theme(
+        &mut self,
+        name: SharedString,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let Some(theme_config) = ThemeRegistry::global(cx).themes().get(&name).cloned() else {
+            self.status = format!("theme not found: {name}").into();
+            cx.notify();
+            return;
+        };
+
+        if theme_config.mode.is_dark() {
+            self.dark_theme_name = name.clone();
+        } else {
+            self.light_theme_name = name.clone();
+        }
+        self.apply_theme_preferences(window, cx);
+        self.status = format!("theme: {name}").into();
+        self.persist_theme_preferences();
+        window.refresh();
+        cx.notify();
+    }
+
+    pub(crate) fn set_follow_system_theme(
+        &mut self,
+        follow: bool,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.follow_system_theme = follow;
+        if follow {
+            self.status = "theme mode: system".into();
+        } else {
+            self.status = format!("theme mode: {}", cx.theme().mode.name()).into();
+        }
+        self.apply_theme_preferences(window, cx);
+        self.persist_theme_preferences();
+        cx.notify();
+    }
+
+    pub(crate) fn set_display_language(
+        &mut self,
+        locale: &str,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.config.set_locale(locale);
+        let mut active_locale = locale.to_string();
+        if active_locale == "system" {
+            active_locale = sys_locale::get_locale().unwrap_or_else(|| "en".to_string());
+            if active_locale.starts_with("zh") {
+                active_locale = "zh-CN".to_string();
+            } else {
+                active_locale = "en".to_string();
+            }
+        }
+        rust_i18n::set_locale(&active_locale);
+        gpui_component::set_locale(&active_locale);
+        if let Err(err) = self.config.save() {
+            tracing::warn!("failed to save language preferences: {err:#}");
+        }
+        window.refresh();
+        cx.notify();
+    }
+
+    pub(crate) fn apply_theme_preferences(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let light_theme = ThemeRegistry::global(cx)
+            .themes()
+            .get(&self.light_theme_name)
+            .cloned()
+            .unwrap_or_else(|| ThemeRegistry::global(cx).default_light_theme().clone());
+        let dark_theme = ThemeRegistry::global(cx)
+            .themes()
+            .get(&self.dark_theme_name)
+            .cloned()
+            .unwrap_or_else(|| ThemeRegistry::global(cx).default_dark_theme().clone());
+        let theme = Theme::global_mut(cx);
+        theme.light_theme = light_theme;
+        theme.dark_theme = dark_theme;
+        theme.font_size = px(self.ui_font_size);
+        set_theme_font_names(theme, &self.ui_font_family);
+
+        if self.follow_system_theme {
+            Theme::sync_system_appearance(Some(window), cx);
+        } else {
+            Theme::change(self.theme_mode, Some(window), cx);
+        }
+    }
+
+    pub(crate) fn persist_theme_preferences(&mut self) {
+        let theme_mode_str = match self.theme_mode {
+            ThemeMode::Light => "light",
+            ThemeMode::Dark => "dark",
+        };
+        self.config.set_theme_preferences(
+            self.follow_system_theme,
+            theme_mode_str,
+            self.light_theme_name.to_string(),
+            self.dark_theme_name.to_string(),
+        );
+        if let Err(err) = self.config.save() {
+            tracing::warn!("failed to save theme preferences: {err:#}");
+        }
+    }
+}
@@ -94,27 +94,41 @@ pub fn spawn_local_terminal(
    let write_tab = tab_id.clone();
    let write_events = events.clone();
    thread::spawn(move || {
-        while let Ok(command) = cmd_rx.recv() {
-            match command {
-                BackendCommand::Input(bytes) => {
-                    if let Err(err) = writer.write_all(&bytes) {
+        loop {
+            match cmd_rx.recv_timeout(std::time::Duration::from_millis(100)) {
+                Ok(command) => match command {
+                    BackendCommand::Input(bytes) => {
+                        if let Err(err) = writer.write_all(&bytes) {
+                            let _ = write_events.send(BackendEvent::Closed {
+                                tab_id: write_tab.clone(),
+                                reason: format!("local write error: {err}"),
+                            });
+                            break;
+                        }
+                        let _ = writer.flush();
+                    }
+                    BackendCommand::Resize { cols, rows } => {
+                        let _ = master.resize(PtySize {
+                            rows,
+                            cols,
+                            pixel_width: 0,
+                            pixel_height: 0,
+                        });
+                    }
+                    BackendCommand::Close => break,
+                    BackendCommand::SampleMetrics => {}
+                    BackendCommand::PromptResponse(_) => {}
+                },
+                Err(mpsc::RecvTimeoutError::Timeout) => {
+                    if let Ok(Some(status)) = child.try_wait() {
                        let _ = write_events.send(BackendEvent::Closed {
-                            tab_id: write_tab.clone(),
-                            reason: format!("local write error: {err}"),
+                            tab_id: write_tab,
+                            reason: format!("local shell exited: {status}"),
                        });
-                        break;
+                        return;
                    }
-                    let _ = writer.flush();
                }
-                BackendCommand::Resize { cols, rows } => {
-                    let _ = master.resize(PtySize {
-                        rows,
-                        cols,
-                        pixel_width: 0,
-                        pixel_height: 0,
-                    });
-                }
-                BackendCommand::Close => break,
+                Err(mpsc::RecvTimeoutError::Disconnected) => break,
            }
        }
        let _ = child.kill();
@@ -0,0 +1,2 @@
+pub mod local;
+pub mod ssh;
@@ -0,0 +1,713 @@
+use std::{
+    path::{Path, PathBuf},
+    sync::Arc,
+};
+
+use anyhow::{Context, Result, anyhow};
+use async_trait::async_trait;
+use directories::BaseDirs;
+use russh::{
+    ChannelMsg, Disconnect,
+    client::{self, Handler},
+    keys::{HashAlg, PrivateKey, decode_secret_key, key::PrivateKeyWithHashAlg, load_secret_key},
+};
+use tokio::sync::mpsc;
+
+use crate::{
+    session::config::{AuthMethod, Session},
+    system::{SystemSnapshot, remote_snapshot_from_kv},
+    terminal::{BackendCommand, BackendEvent, BackendTx, PromptType, PromptInfo},
+};
+use std::sync::OnceLock;
+use std::collections::HashMap;
+use tokio::sync::Mutex;
+
+#[allow(dead_code)]
+#[derive(Debug, Clone)]
+pub struct CachedCreds {
+    pub password: Option<String>,
+    pub passphrase: Option<String>,
+    pub kb_responses: Option<Vec<String>>,
+}
+
+pub static CREDENTIALS_CACHE: OnceLock<std::sync::Mutex<HashMap<String, CachedCreds>>> = OnceLock::new();
+
+pub static PROMPT_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+
+pub fn spawn_ssh_terminal(
+    runtime: &tokio::runtime::Handle,
+    tab_id: String,
+    session: Session,
+    cols: u16,
+    rows: u16,
+    events: std::sync::mpsc::Sender<BackendEvent>,
+) -> BackendTx {
+    let (cmd_tx, cmd_rx) = mpsc::unbounded_channel::<BackendCommand>();
+    let task_tab = tab_id.clone();
+    runtime.spawn(async move {
+        if let Err(err) = run_ssh(
+            task_tab.clone(),
+            session,
+            cols,
+            rows,
+            cmd_rx,
+            events.clone(),
+        )
+        .await
+        {
+            let _ = events.send(BackendEvent::Closed {
+                tab_id: task_tab,
+                reason: format!("{err:#}"),
+            });
+        }
+    });
+    BackendTx::Ssh(cmd_tx)
+}
+
+async fn sample_remote_system_with_handle(
+    handle: Arc<tokio::sync::Mutex<russh::client::Handle<ClientHandler>>>,
+) -> Result<SystemSnapshot> {
+    let mut channel = handle
+        .lock()
+        .await
+        .channel_open_session()
+        .await
+        .context("open metrics session")?;
+    channel
+        .exec(true, REMOTE_SYSTEM_PROBE)
+        .await
+        .context("exec remote metrics probe")?;
+
+    let mut stdout = Vec::new();
+    while let Some(msg) = channel.wait().await {
+        match msg {
+            ChannelMsg::Data { data } | ChannelMsg::ExtendedData { data, ext: _ } => {
+                stdout.extend_from_slice(&data);
+            }
+            ChannelMsg::Close => break,
+            _ => {}
+        }
+    }
+
+    let output = String::from_utf8_lossy(&stdout);
+    remote_snapshot_from_kv(&output)
+}
+
+async fn run_ssh(
+    tab_id: String,
+    session: Session,
+    cols: u16,
+    rows: u16,
+    mut commands: mpsc::UnboundedReceiver<BackendCommand>,
+    events: std::sync::mpsc::Sender<BackendEvent>,
+) -> Result<()> {
+    let _ = events.send(BackendEvent::Status {
+        tab_id: tab_id.clone(),
+        text: format!(
+            "connecting {}@{}:{}...",
+            session.user, session.host, session.port
+        ),
+    });
+
+    let handle = Arc::new(tokio::sync::Mutex::new(
+        connect_and_authenticate(&tab_id, &session, &events, &mut commands).await?,
+    ));
+
+    let mut channel = handle
+        .lock()
+        .await
+        .channel_open_session()
+        .await
+        .context("open session")?;
+    channel
+        .request_pty(true, "xterm-256color", cols.into(), rows.into(), 0, 0, &[])
+        .await
+        .context("request pty")?;
+    channel.request_shell(true).await.context("request shell")?;
+
+    let _ = events.send(BackendEvent::Status {
+        tab_id: tab_id.clone(),
+        text: format!("connected {}@{}", session.user, session.host),
+    });
+    let _ = events.send(BackendEvent::Connected {
+        tab_id: tab_id.clone(),
+    });
+
+    let exit_reason;
+    let mut is_graceful_close = false;
+
+    loop {
+        tokio::select! {
+            command = commands.recv() => {
+                match command {
+                    Some(BackendCommand::Input(bytes)) => {
+                        if let Err(err) = channel.data(bytes.as_slice()).await {
+                            tracing::error!("[ssh] write error on tab {}: {}", tab_id, err);
+                            exit_reason = format!("ssh write error: {err}");
+                            break;
+                        }
+                    }
+                    Some(BackendCommand::Resize { cols, rows }) => {
+                        let _ = channel.window_change(cols.into(), rows.into(), 0, 0).await;
+                    }
+                    Some(BackendCommand::SampleMetrics) => {
+                        let handle_clone = handle.clone();
+                        let tab_id_clone = tab_id.clone();
+                        let events_clone = events.clone();
+                        tokio::spawn(async move {
+                            match sample_remote_system_with_handle(handle_clone).await {
+                                Ok(snapshot) => {
+                                    let _ = events_clone.send(BackendEvent::RemoteSystem {
+                                        tab_id: tab_id_clone,
+                                        snapshot,
+                                    });
+                                }
+                                Err(err) => {
+                                    let _ = events_clone.send(BackendEvent::RemoteSystemUnavailable {
+                                        tab_id: tab_id_clone,
+                                        reason: format!("remote metrics unavailable: {err:#}"),
+                                    });
+                                }
+                            }
+                        });
+                    }
+                    Some(BackendCommand::PromptResponse(_)) => {
+                        tracing::warn!("[ssh] received unexpected prompt response after authentication");
+                    }
+                    Some(BackendCommand::Close) | None => {
+                        tracing::info!("[ssh] local client closed the session for tab {}", tab_id);
+                        let _ = channel.eof().await;
+                        exit_reason = "ssh session closed".to_string();
+                        break;
+                    }
+                }
+            }
+            msg = channel.wait() => {
+                match msg {
+                    Some(ChannelMsg::Data { data }) | Some(ChannelMsg::ExtendedData { data, ext: _ }) => {
+                        let _ = events.send(BackendEvent::Output {
+                            tab_id: tab_id.clone(),
+                            bytes: data.to_vec(),
+                        });
+                    }
+                    Some(ChannelMsg::ExitStatus { exit_status: _ }) | Some(ChannelMsg::Eof) => {
+                        is_graceful_close = true;
+                    }
+                    Some(ChannelMsg::Close) => {
+                        if is_graceful_close {
+                            tracing::info!("[ssh] session gracefully closed by server for tab {}", tab_id);
+                            exit_reason = "ssh session closed".to_string();
+                        } else {
+                            tracing::warn!("[ssh] connection abruptly closed by server for tab {}", tab_id);
+                            exit_reason = "ssh connection lost (abrupt close)".to_string();
+                        }
+                        break;
+                    }
+                    None => {
+                        if is_graceful_close {
+                            tracing::info!("[ssh] network stream ended gracefully for tab {}", tab_id);
+                            exit_reason = "ssh session closed".to_string();
+                        } else {
+                            tracing::warn!("[ssh] network drop detected for tab {}", tab_id);
+                            exit_reason = "ssh connection lost (network drop)".to_string();
+                        }
+                        break;
+                    }
+                    _ => {}
+                }
+            }
+        }
+    }
+
+    let _ = handle
+        .lock()
+        .await
+        .disconnect(Disconnect::ByApplication, "bye", "")
+        .await;
+    let _ = events.send(BackendEvent::Closed {
+        tab_id,
+        reason: exit_reason,
+    });
+    Ok(())
+}
+
+async fn load_session_private_key_with_cache(session: &Session) -> Result<PrivateKey> {
+    let cached_passphrase = {
+        let cache_lock = CREDENTIALS_CACHE.get_or_init(|| std::sync::Mutex::new(HashMap::new()));
+        let cache = cache_lock.lock().unwrap();
+        cache.get(&session.id).and_then(|c| c.passphrase.clone())
+    };
+    if let Some(p) = cached_passphrase {
+        let mut temp_session = session.clone();
+        temp_session.passphrase = p;
+        if let Ok(key) = load_session_private_key(&temp_session) {
+            return Ok(key);
+        }
+    }
+    load_session_private_key(session)
+}
+
+async fn connect_and_authenticate(
+    tab_id: &str,
+    session: &Session,
+    events: &std::sync::mpsc::Sender<BackendEvent>,
+    commands: &mut mpsc::UnboundedReceiver<BackendCommand>,
+) -> Result<russh::client::Handle<ClientHandler>> {
+    let config = Arc::new(client::Config {
+        inactivity_timeout: Some(std::time::Duration::from_secs(600)),
+        keepalive_interval: Some(std::time::Duration::from_secs(10)),
+        keepalive_max: 3,
+        ..Default::default()
+    });
+    let addr = format!("{}:{}", session.host, session.port);
+    tracing::info!(
+        "[ssh] initiating tcp connection to {} (user: {})",
+        addr,
+        session.user
+    );
+    let _ = events.send(BackendEvent::Status {
+        tab_id: tab_id.to_string(),
+        text: format!("opening tcp connection to {addr}"),
+    });
+    let mut handle = client::connect(config, addr.as_str(), ClientHandler)
+        .await
+        .with_context(|| format!("connect {addr} failed"))?;
+
+    tracing::debug!("[ssh] tcp connected to {}", addr);
+
+    let authed = match session.auth {
+        AuthMethod::Password => {
+            tracing::info!(
+                "[ssh] sending password authentication for {}@{}",
+                session.user,
+                addr
+            );
+            let _ = events.send(BackendEvent::Status {
+                tab_id: tab_id.to_string(),
+                text: format!(
+                    "connected to {addr}, sending password authentication for {}",
+                    session.user
+                ),
+            });
+            handle
+                .authenticate_password(&session.user, &session.password)
+                .await
+                .context("password authentication failed")?
+        }
+        AuthMethod::Key => {
+            let source = key_source_label(session);
+            tracing::info!(
+                "[ssh] sending key authentication for {}@{} (key source: {})",
+                session.user,
+                addr,
+                source
+            );
+            let _ = events.send(BackendEvent::Status {
+                tab_id: tab_id.to_string(),
+                text: format!("connected to {addr}, loading private key from {source}"),
+            });
+            let mut keypair = load_session_private_key_with_cache(session).await;
+            if let Err(e) = &keypair {
+                let err_str = e.to_string();
+                if err_str.contains("encrypted") || err_str.contains("passphrase") || err_str.contains("decrypt") {
+                    let prompt_lock = PROMPT_LOCK.get_or_init(|| Mutex::new(()));
+                    let _guard = prompt_lock.lock().await;
+                    let _ = events.send(BackendEvent::PromptRequest {
+                        tab_id: tab_id.to_string(),
+                        prompt_type: PromptType::Passphrase,
+                        instruction: format!("Enter passphrase for private key (source: {})", source),
+                        prompts: vec![PromptInfo {
+                            prompt: "Passphrase".to_string(),
+                            echo: false,
+                        }],
+                    });
+                    let mut passphrase_res = None;
+                    while let Some(cmd) = commands.recv().await {
+                        match cmd {
+                            BackendCommand::PromptResponse(responses) => {
+                                if let Some(p) = responses.first().cloned() {
+                                    passphrase_res = Some(p);
+                                }
+                                break;
+                            }
+                            BackendCommand::Close => {
+                                return Err(anyhow!("Authentication cancelled by user"));
+                            }
+                            _ => {}
+                        }
+                    }
+                    if let Some(p) = passphrase_res {
+                        {
+                            let cache_lock = CREDENTIALS_CACHE.get_or_init(|| std::sync::Mutex::new(HashMap::new()));
+                            let mut cache = cache_lock.lock().unwrap();
+                            cache.entry(session.id.clone()).or_insert_with(|| CachedCreds {
+                                password: None,
+                                passphrase: None,
+                                kb_responses: None,
+                            }).passphrase = Some(p.clone());
+                        }
+                        let mut temp_session = session.clone();
+                        temp_session.passphrase = p;
+                        keypair = load_session_private_key(&temp_session);
+                    } else {
+                        return Err(anyhow!("Passphrase prompt cancelled"));
+                    }
+                }
+            }
+            let keypair = keypair.context("failed to load private key")?;
+            let algorithm = format!("{:?}", keypair.algorithm());
+            let _ = events.send(BackendEvent::Status {
+                tab_id: tab_id.to_string(),
+                text: format!("private key loaded from {source}, algorithm {algorithm}, sending public key authentication for {}", session.user),
+            });
+            let keys = private_keys_with_algs(keypair).context("invalid private key")?;
+            let mut success = false;
+            for key in keys {
+                match handle.authenticate_publickey(&session.user, key).await {
+                    Ok(true) => {
+                        success = true;
+                        break;
+                    }
+                    Ok(false) => {
+                        tracing::debug!("[ssh] public key auth failed with algorithm, trying next");
+                        continue;
+                    }
+                    Err(e) => {
+                        tracing::debug!("[ssh] public key auth error: {:?}, trying next", e);
+                        continue;
+                    }
+                }
+            }
+            if !success {
+                return Err(anyhow::anyhow!(
+                    "public key authentication failed for {}@{}:{} using {} ({})",
+                    session.user,
+                    session.host,
+                    session.port,
+                    source,
+                    algorithm
+                ));
+            }
+            success
+        }
+        AuthMethod::KeyboardInteractive => {
+            let cached = {
+                let cache_lock = CREDENTIALS_CACHE.get_or_init(|| std::sync::Mutex::new(HashMap::new()));
+                let cache = cache_lock.lock().unwrap();
+                cache.get(&session.id).cloned()
+            };
+            let mut response = if cached.as_ref().and_then(|c| c.kb_responses.as_ref()).is_some() {
+                handle.authenticate_keyboard_interactive_start(&session.user, None).await?
+            } else {
+                let prompt_lock = PROMPT_LOCK.get_or_init(|| Mutex::new(()));
+                let _guard = prompt_lock.lock().await;
+                handle.authenticate_keyboard_interactive_start(&session.user, None).await?
+            };
+            loop {
+                match response {
+                    russh::client::KeyboardInteractiveAuthResponse::Success => {
+                        break true;
+                    }
+                    russh::client::KeyboardInteractiveAuthResponse::Failure => {
+                        break false;
+                    }
+                    russh::client::KeyboardInteractiveAuthResponse::InfoRequest { name, instructions, prompts } => {
+                        let mut responses = Vec::new();
+                        let mut cache_hit = false;
+                        if let Some(c) = cached.as_ref().and_then(|c| c.kb_responses.as_ref()) {
+                            if c.len() == prompts.len() {
+                                responses = c.clone();
+                                cache_hit = true;
+                            }
+                        }
+                        if !cache_hit {
+                            let prompt_lock = PROMPT_LOCK.get_or_init(|| Mutex::new(()));
+                            let _guard = prompt_lock.lock().await;
+                            let mut prompt_infos = Vec::new();
+                            for p in &prompts {
+                                prompt_infos.push(PromptInfo {
+                                    prompt: p.prompt.clone(),
+                                    echo: p.echo,
+                                });
+                            }
+                            let _ = events.send(BackendEvent::PromptRequest {
+                                tab_id: tab_id.to_string(),
+                                prompt_type: PromptType::KeyboardInteractive,
+                                instruction: format!("{}\n{}", name, instructions),
+                                prompts: prompt_infos,
+                            });
+                            let mut prompt_res = None;
+                            while let Some(cmd) = commands.recv().await {
+                                match cmd {
+                                    BackendCommand::PromptResponse(res) => {
+                                        prompt_res = Some(res);
+                                        break;
+                                    }
+                                    BackendCommand::Close => {
+                                        return Err(anyhow!("Authentication cancelled"));
+                                    }
+                                    _ => {}
+                                }
+                            }
+                            if let Some(res) = prompt_res {
+                                responses = res;
+                                let cache_lock = CREDENTIALS_CACHE.get_or_init(|| std::sync::Mutex::new(HashMap::new()));
+                                let mut cache = cache_lock.lock().unwrap();
+                                cache.entry(session.id.clone()).or_insert_with(|| CachedCreds {
+                                    password: None,
+                                    passphrase: None,
+                                    kb_responses: None,
+                                }).kb_responses = Some(responses.clone());
+                            } else {
+                                return Err(anyhow!("Keyboard-interactive cancelled"));
+                            }
+                        }
+                        response = handle.authenticate_keyboard_interactive_respond(responses).await?;
+                    }
+                }
+            }
+        }
+    };
+
+    if !authed {
+        tracing::warn!("[ssh] authentication failed for {}@{}", session.user, addr);
+        let _ = handle
+            .disconnect(Disconnect::ByApplication, "auth failed", "")
+            .await;
+        return Err(anyhow!(
+            "{}",
+            match session.auth {
+                AuthMethod::Password => format!(
+                    "authentication failed: server rejected password authentication for {}@{}:{}",
+                    session.user, session.host, session.port
+                ),
+                AuthMethod::Key => format!(
+                    "authentication failed: server rejected public key authentication for {}@{}:{} using {}",
+                    session.user,
+                    session.host,
+                    session.port,
+                    key_source_label(session)
+                ),
+                AuthMethod::KeyboardInteractive => format!(
+                    "authentication failed: server rejected keyboard-interactive authentication for {}@{}:{}",
+                    session.user, session.host, session.port
+                ),
+            }
+        ));
+    }
+
+    tracing::info!(
+        "[ssh] authentication successful for {}@{}",
+        session.user,
+        addr
+    );
+
+    let _ = events.send(BackendEvent::Status {
+        tab_id: tab_id.to_string(),
+        text: format!(
+            "authentication accepted, opening shell for {}@{}",
+            session.user, session.host
+        ),
+    });
+
+    Ok(handle)
+}
+
+fn load_session_private_key(session: &Session) -> Result<PrivateKey> {
+    let inline_key = normalize_inline_private_key(&session.private_key_inline);
+    let key_path = expand_key_path(session.private_key_path.trim());
+    let passphrase = session.passphrase.trim();
+    let passphrase = (!passphrase.is_empty()).then_some(passphrase);
+    let has_inline = !inline_key.is_empty();
+    let has_path = key_path.is_some();
+
+    if !has_inline && !has_path {
+        return Err(anyhow!("private key content or path is required"));
+    }
+
+    let mut errors = Vec::new();
+
+    if has_inline {
+        match decode_secret_key(&inline_key, passphrase) {
+            Ok(key) => return Ok(key),
+            Err(err) => errors.push(format!("decode private key content: {err}")),
+        }
+    }
+
+    if let Some(path) = key_path {
+        match load_secret_key(path.as_path(), passphrase) {
+            Ok(key) => return Ok(key),
+            Err(err) => errors.push(format!("load key {}: {err}", path.display())),
+        }
+    }
+
+    Err(anyhow!(errors.join("; ")))
+}
+
+fn private_keys_with_algs(keypair: PrivateKey) -> Result<Vec<PrivateKeyWithHashAlg>> {
+    let mut algs = Vec::new();
+    let key_arc = Arc::new(keypair);
+
+    if key_arc.algorithm().is_rsa() {
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha512)) {
+            algs.push(k);
+        }
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha256)) {
+            algs.push(k);
+        }
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
+            algs.push(k);
+        }
+    } else {
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
+            algs.push(k);
+        }
+    }
+
+    if algs.is_empty() {
+        return Err(anyhow!(
+            "Failed to construct PrivateKeyWithHashAlg for any supported hash algorithm"
+        ));
+    }
+
+    Ok(algs)
+}
+
+fn normalize_inline_private_key(value: &str) -> String {
+    let mut normalized = value
+        .trim()
+        .replace("\\r\\n", "\n")
+        .replace("\\n", "\n")
+        .replace("\r\n", "\n");
+    if !normalized.ends_with('\n') {
+        normalized.push('\n');
+    }
+    normalized
+}
+
+fn expand_key_path(value: &str) -> Option<PathBuf> {
+    if value.is_empty() {
+        return None;
+    }
+    if value == "~" {
+        return BaseDirs::new().map(|dirs| dirs.home_dir().to_path_buf());
+    }
+    if let Some(rest) = value.strip_prefix("~/") {
+        return BaseDirs::new().map(|dirs| dirs.home_dir().join(rest));
+    }
+    Some(Path::new(value).to_path_buf())
+}
+
+fn key_source_label(session: &Session) -> String {
+    let path = session.private_key_path.trim();
+    let has_inline = !session.private_key_inline.trim().is_empty();
+    match (!path.is_empty(), has_inline) {
+        (true, true) => format!("inline key or {}", path),
+        (true, false) => path.to_string(),
+        (false, true) => "inline key text".to_string(),
+        (false, false) => "unknown key source".to_string(),
+    }
+}
+
+const REMOTE_SYSTEM_PROBE: &str = r#"sh -lc '
+os=$(uname -s 2>/dev/null || echo unknown)
+
+if [ "$os" = "Linux" ] && [ -r /proc/stat ]; then
+  cpu_stat() { awk '"'"'/^cpu / { print ($2+$3+$4+$5+$6+$7+$8), $5 }'"'"' /proc/stat 2>/dev/null; }
+  net_stat() { awk -F"[: ]+" '"'"'/:/ && $1!="Inter" && $1!="face" { rx += $3; tx += $11 } END { print rx+0, tx+0 }'"'"' /proc/net/dev 2>/dev/null; }
+
+  read cpu_total_1 cpu_idle_1 <<EOF
+$(cpu_stat)
+EOF
+  read net_rx_1 net_tx_1 <<EOF
+$(net_stat)
+EOF
+  sleep 1
+  read cpu_total_2 cpu_idle_2 <<EOF
+$(cpu_stat)
+EOF
+  read net_rx_2 net_tx_2 <<EOF
+$(net_stat)
+EOF
+
+  cpu_delta=$((cpu_total_2 - cpu_total_1))
+  idle_delta=$((cpu_idle_2 - cpu_idle_1))
+  cpu_percent=$(awk -v total="$cpu_delta" -v idle="$idle_delta" '"'"'BEGIN { if (total <= 0) print "0.00"; else printf "%.2f", ((total-idle)/total)*100 }'"'"')
+  mem_total=$(awk '"'"'/^MemTotal:/ {print $2 * 1024}'"'"' /proc/meminfo 2>/dev/null)
+  mem_available=$(awk '"'"'/^MemAvailable:/ {print $2 * 1024}'"'"' /proc/meminfo 2>/dev/null)
+  swap_total=$(awk '"'"'/^SwapTotal:/ {print $2 * 1024}'"'"' /proc/meminfo 2>/dev/null)
+  swap_free=$(awk '"'"'/^SwapFree:/ {print $2 * 1024}'"'"' /proc/meminfo 2>/dev/null)
+
+  echo "CPU_PERCENT=${cpu_percent:-0.00}"
+  echo "MEM_TOTAL=${mem_total:-0}"
+  echo "MEM_USED=$(( ${mem_total:-0} - ${mem_available:-0} ))"
+  echo "SWAP_TOTAL=${swap_total:-0}"
+  echo "SWAP_USED=$(( ${swap_total:-0} - ${swap_free:-0} ))"
+  echo "NET_RX=$(( ${net_rx_2:-0} - ${net_rx_1:-0} ))"
+  echo "NET_TX=$(( ${net_tx_2:-0} - ${net_tx_1:-0} ))"
+  df -kP 2>/dev/null | awk "NR > 1 && \$1 !~ /^(tmpfs|devtmpfs|ramfs|overlay|aufs)\$/ { printf \"DISK=%s\t%s\t%s\n\", \$6, \$4 * 1024, \$2 * 1024 }" | head -n 6
+  exit 0
+fi
+
+if [ "$os" = "Darwin" ]; then
+  net_stat() { netstat -ibn 2>/dev/null | awk '"'"'NR > 1 && $7 ~ /^[0-9]+$/ && $10 ~ /^[0-9]+$/ { rx += $7; tx += $10 } END { print rx+0, tx+0 }'"'"'; }
+
+  read net_rx_1 net_tx_1 <<EOF
+$(net_stat)
+EOF
+  sleep 1
+  read net_rx_2 net_tx_2 <<EOF
+$(net_stat)
+EOF
+
+  cpu_percent=$(top -l 2 -n 0 -s 1 2>/dev/null | awk -F"[:,% ]+" '"'"'/CPU usage:/ { user=$3; sys=$5 } END { if (user == "" && sys == "") print "0.00"; else printf "%.2f", user + sys }'"'"')
+  mem_total=$(sysctl -n hw.memsize 2>/dev/null || echo 0)
+  pagesize=$(sysctl -n hw.pagesize 2>/dev/null || echo 4096)
+  vm_output=$(vm_stat 2>/dev/null)
+  pages_active=$(printf "%s\n" "$vm_output" | awk '"'"'/Pages active/ { gsub("\\.","",$3); print $3+0 }'"'"')
+  pages_wired=$(printf "%s\n" "$vm_output" | awk '"'"'/Pages wired down/ { gsub("\\.","",$4); print $4+0 }'"'"')
+  pages_compressed=$(printf "%s\n" "$vm_output" | awk '"'"'/Pages occupied by compressor/ { gsub("\\.","",$5); print $5+0 }'"'"')
+  pages_speculative=$(printf "%s\n" "$vm_output" | awk '"'"'/Pages speculative/ { gsub("\\.","",$3); print $3+0 }'"'"')
+  mem_used=$(( (${pages_active:-0} + ${pages_wired:-0} + ${pages_compressed:-0} + ${pages_speculative:-0}) * ${pagesize:-4096} ))
+  swap_line=$(sysctl vm.swapusage 2>/dev/null || true)
+  swap_used=$(printf "%s\n" "$swap_line" | awk -F"[= ,]+" '"'"'
+    function mult(unit) { return unit=="K"?1024:(unit=="M"?1048576:(unit=="G"?1073741824:(unit=="T"?1099511627776:1))) }
+    /used/ { value=$4; unit=substr(value, length(value), 1); sub(/[A-Za-z]+$/, "", value); printf "%.0f", value * mult(unit) }'"'"')
+  swap_total=$(printf "%s\n" "$swap_line" | awk -F"[= ,]+" '"'"'
+    function mult(unit) { return unit=="K"?1024:(unit=="M"?1048576:(unit=="G"?1073741824:(unit=="T"?1099511627776:1))) }
+    /used/ && /free/ { used=$4; free=$8; unit1=substr(used, length(used), 1); unit2=substr(free, length(free), 1); sub(/[A-Za-z]+$/, "", used); sub(/[A-Za-z]+$/, "", free); printf "%.0f", (used * mult(unit1)) + (free * mult(unit2)) }'"'"')
+
+  echo "CPU_PERCENT=${cpu_percent:-0.00}"
+  echo "MEM_TOTAL=${mem_total:-0}"
+  echo "MEM_USED=${mem_used:-0}"
+  echo "SWAP_TOTAL=${swap_total:-0}"
+  echo "SWAP_USED=${swap_used:-0}"
+  echo "NET_RX=$(( ${net_rx_2:-0} - ${net_rx_1:-0} ))"
+  echo "NET_TX=$(( ${net_tx_2:-0} - ${net_tx_1:-0} ))"
+  df -kP 2>/dev/null | awk "NR > 1 && \$1 !~ /^(devfs|tmpfs|devtmpfs|ramfs|overlay|aufs)\$/ { printf \"DISK=%s\t%s\t%s\n\", \$6, \$4 * 1024, \$2 * 1024 }" | head -n 6
+  exit 0
+fi
+
+echo "CPU_PERCENT=0.00"
+echo "MEM_TOTAL=0"
+echo "MEM_USED=0"
+echo "SWAP_TOTAL=0"
+echo "SWAP_USED=0"
+echo "NET_RX=0"
+echo "NET_TX=0"
+'"#;
+
+#[derive(Clone)]
+struct ClientHandler;
+
+#[async_trait]
+impl Handler for ClientHandler {
+    type Error = anyhow::Error;
+
+    async fn check_server_key(
+        &mut self,
+        _server_public_key: &russh::keys::ssh_key::PublicKey,
+    ) -> Result<bool, Self::Error> {
+        Ok(true)
+    }
+}
@@ -6,10 +6,11 @@ use serde::{Deserialize, Serialize};
 use uuid::Uuid;

 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "lowercase")]
+#[serde(rename_all = "kebab-case")]
 pub enum AuthMethod {
    Password,
    Key,
+    KeyboardInteractive,
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -27,6 +28,8 @@ pub struct Session {
    #[serde(default)]
    pub private_key_inline: String,
    #[serde(default)]
+    pub passphrase: String,
+    #[serde(default)]
    pub last_used: Option<String>,
 }

@@ -43,6 +46,7 @@ impl Session {
            password,
            private_key_path: String::new(),
            private_key_inline: String::new(),
+            passphrase: String::new(),
            last_used: None,
        }
    }
@@ -53,6 +57,7 @@ impl Session {
        user: String,
        private_key_path: String,
        private_key_inline: String,
+        passphrase: String,
    ) -> Self {
        let name = format!("{user}@{host}");
        Self {
@@ -65,6 +70,28 @@ impl Session {
            password: String::new(),
            private_key_path,
            private_key_inline,
+            passphrase,
+            last_used: None,
+        }
+    }
+
+    pub fn keyboard_interactive(
+        host: String,
+        port: u16,
+        user: String,
+    ) -> Self {
+        let name = format!("{user}@{host}");
+        Self {
+            id: Uuid::new_v4().to_string(),
+            name,
+            host,
+            port,
+            user,
+            auth: AuthMethod::KeyboardInteractive,
+            password: String::new(),
+            private_key_path: String::new(),
+            private_key_inline: String::new(),
+            passphrase: String::new(),
            last_used: None,
        }
    }
@@ -93,9 +120,17 @@ pub enum SavedWindowBounds {
    },
 }

+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum TitleBarStyle {
+    Native,
+    #[default]
+    Integrated,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct ConfigFile {
-    #[serde(default)]
+    #[serde(default = "default_follow_system_theme")]
    pub follow_system_theme: bool,
    #[serde(default)]
    pub theme_mode: String,
@@ -116,6 +151,8 @@ pub struct ConfigFile {
    #[serde(default = "default_terminal_font_family")]
    pub terminal_font_family: String,
    #[serde(default)]
+    pub title_bar_style: TitleBarStyle,
+    #[serde(default)]
    pub sessions: Vec<Session>,
    #[serde(default)]
    pub window_bounds: Option<SavedWindowBounds>,
@@ -127,6 +164,50 @@ pub struct ConfigFile {
    pub transfers: Vec<crate::terminal::Transfer>,
    #[serde(default)]
    pub show_hidden_files: bool,
+    #[serde(default = "default_monitoring_position")]
+    pub monitoring_position: String,
+    #[serde(default)]
+    pub sidebar_collapsed: bool,
+    #[serde(default)]
+    pub sftp_panel_minimized: bool,
+    #[serde(default)]
+    pub key_bindings: std::collections::HashMap<String, String>,
+    #[serde(default)]
+    pub sync_endpoint: String,
+    #[serde(default)]
+    pub sync_username: String,
+    #[serde(default)]
+    pub sync_etag: Option<String>,
+    #[serde(default)]
+    pub sync_device_id: String,
+    #[serde(default)]
+    pub sync_backend: String,
+    #[serde(default)]
+    pub sync_etag_backend: String,
+    #[serde(default)]
+    pub sync_s3_endpoint: String,
+    #[serde(default = "default_s3_region")]
+    pub sync_s3_region: String,
+    #[serde(default)]
+    pub sync_s3_bucket: String,
+    #[serde(default = "default_s3_object_key")]
+    pub sync_s3_object_key: String,
+}
+
+fn default_monitoring_position() -> String {
+    "Sidebar".to_string()
+}
+
+fn default_s3_region() -> String {
+    "us-east-1".to_string()
+}
+
+fn default_s3_object_key() -> String {
+    "ashell-sync.json".to_string()
+}
+
+fn default_follow_system_theme() -> bool {
+    true
 }

 fn default_locale() -> String {
@@ -134,11 +215,11 @@ fn default_locale() -> String {
 }

 fn default_terminal_font_size() -> f32 {
-    13.0
+    18.0
 }

 fn default_ui_font_size() -> f32 {
-    12.0
+    14.0
 }

 pub fn default_ui_font_family() -> String {
@@ -162,26 +243,62 @@ impl ConfigStore {
        if let Some(parent) = path.parent() {
            fs::create_dir_all(parent)
                .with_context(|| format!("failed to create config dir {}", parent.display()))?;
+
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt;
+                if let Ok(mut perms) = fs::metadata(parent).map(|m| m.permissions()) {
+                    perms.set_mode(0o700);
+                    let _ = fs::set_permissions(parent, perms);
+                }
+            }
+
            let tmp_dir = parent.join("tmp");
            let _ = fs::remove_dir_all(&tmp_dir);
            let _ = fs::create_dir_all(&tmp_dir);
        }

-        let cache = if path.exists() {
+        let mut cache = if path.exists() {
            let raw = fs::read_to_string(&path)
                .with_context(|| format!("failed to read {}", path.display()))?;
-            serde_json::from_str::<ConfigFile>(&raw).unwrap_or_default()
+            match serde_json::from_str::<ConfigFile>(&raw) {
+                Ok(cache) => cache,
+                Err(err) => {
+                    let backup_path = path.with_extension("json.bak");
+                    if let Err(backup_err) = fs::write(&backup_path, raw.as_bytes()) {
+                        tracing::warn!(
+                            "failed to parse config {}; backup to {} also failed: {backup_err:#}; parse error: {err:#}",
+                            path.display(),
+                            backup_path.display(),
+                        );
+                    } else {
+                        tracing::warn!(
+                            "failed to parse config {}; backed up the original to {} and loaded defaults: {err:#}",
+                            path.display(),
+                            backup_path.display(),
+                        );
+                    }
+                    ConfigFile::default()
+                }
+            }
        } else {
            ConfigFile::default()
        };

+        if cache.sync_device_id.is_empty() {
+            cache.sync_device_id = Uuid::new_v4().to_string();
+        }
        Ok(Self { path, cache })
    }

    pub fn in_memory() -> Self {
+        let cache = ConfigFile {
+            sync_device_id: Uuid::new_v4().to_string(),
+            ..ConfigFile::default()
+        };
        Self {
            path: PathBuf::new(),
-            cache: ConfigFile::default(),
+            cache,
        }
    }

@@ -198,6 +315,79 @@ impl ConfigStore {
        &self.cache.sessions
    }

+    pub fn replace_sessions(&mut self, sessions: Vec<Session>) {
+        self.cache.sessions = sessions;
+    }
+
+    pub fn sync_endpoint(&self) -> &str {
+        &self.cache.sync_endpoint
+    }
+
+    pub fn sync_username(&self) -> &str {
+        &self.cache.sync_username
+    }
+
+    pub fn sync_etag(&self) -> Option<&str> {
+        (self.cache.sync_etag_backend == self.sync_backend())
+            .then_some(self.cache.sync_etag.as_deref())
+            .flatten()
+    }
+
+    pub fn sync_device_id(&self) -> &str {
+        &self.cache.sync_device_id
+    }
+
+    pub fn sync_backend(&self) -> &str {
+        if self.cache.sync_backend == "s3" {
+            "s3"
+        } else {
+            "webdav"
+        }
+    }
+
+    pub fn set_sync_backend(&mut self, backend: &str) {
+        self.cache.sync_backend = if backend == "s3" { "s3" } else { "webdav" }.to_string();
+    }
+
+    pub fn sync_s3_endpoint(&self) -> &str {
+        &self.cache.sync_s3_endpoint
+    }
+
+    pub fn sync_s3_region(&self) -> &str {
+        if self.cache.sync_s3_region.is_empty() { "us-east-1" } else { &self.cache.sync_s3_region }
+    }
+
+    pub fn sync_s3_bucket(&self) -> &str {
+        &self.cache.sync_s3_bucket
+    }
+
+    pub fn sync_s3_object_key(&self) -> &str {
+        if self.cache.sync_s3_object_key.is_empty() { "ashell-sync.json" } else { &self.cache.sync_s3_object_key }
+    }
+
+    pub fn set_sync_connection(&mut self, endpoint: String, username: String) {
+        self.cache.sync_endpoint = endpoint;
+        self.cache.sync_username = username;
+    }
+
+    pub fn set_sync_s3_connection(
+        &mut self,
+        endpoint: String,
+        region: String,
+        bucket: String,
+        object_key: String,
+    ) {
+        self.cache.sync_s3_endpoint = endpoint;
+        self.cache.sync_s3_region = region;
+        self.cache.sync_s3_bucket = bucket;
+        self.cache.sync_s3_object_key = object_key;
+    }
+
+    pub fn set_sync_etag(&mut self, etag: Option<String>) {
+        self.cache.sync_etag = etag;
+        self.cache.sync_etag_backend = self.sync_backend().to_string();
+    }
+
    pub fn tmp_dir(&self) -> Option<PathBuf> {
        self.path.parent().map(|p| p.join("tmp"))
    }
@@ -230,6 +420,28 @@ impl ConfigStore {
        self.cache.locale = locale.to_string();
    }

+    pub fn key_bindings(&self) -> &std::collections::HashMap<String, String> {
+        &self.cache.key_bindings
+    }
+
+    pub fn set_key_binding(&mut self, action_name: &str, keystroke: &str) {
+        self.cache
+            .key_bindings
+            .insert(action_name.to_string(), keystroke.to_string());
+    }
+
+    pub fn monitoring_position(&self) -> &str {
+        if self.cache.monitoring_position.is_empty() {
+            "Sidebar"
+        } else {
+            &self.cache.monitoring_position
+        }
+    }
+
+    pub fn set_monitoring_position(&mut self, pos: &str) {
+        self.cache.monitoring_position = pos.to_string();
+    }
+
    pub fn terminal_font_size(&self) -> f32 {
        if self.cache.terminal_font_size <= 0.0 {
            default_terminal_font_size()
@@ -259,6 +471,7 @@ impl ConfigStore {
        self.cache.workspace_panels.as_ref()
    }

+    #[allow(dead_code)]
    pub fn body_panels(&self) -> Option<&Vec<f32>> {
        self.cache.body_panels.as_ref()
    }
@@ -333,6 +546,14 @@ impl ConfigStore {
        self.cache.terminal_font_family = family.to_string();
    }

+    pub fn title_bar_style(&self) -> TitleBarStyle {
+        self.cache.title_bar_style
+    }
+
+    pub fn set_title_bar_style(&mut self, style: TitleBarStyle) {
+        self.cache.title_bar_style = style;
+    }
+
    pub fn show_hidden_files(&self) -> bool {
        self.cache.show_hidden_files
    }
@@ -341,6 +562,22 @@ impl ConfigStore {
        self.cache.show_hidden_files = val;
    }

+    pub fn sidebar_collapsed(&self) -> bool {
+        self.cache.sidebar_collapsed
+    }
+
+    pub fn set_sidebar_collapsed(&mut self, val: bool) {
+        self.cache.sidebar_collapsed = val;
+    }
+
+    pub fn sftp_panel_minimized(&self) -> bool {
+        self.cache.sftp_panel_minimized
+    }
+
+    pub fn set_sftp_panel_minimized(&mut self, val: bool) {
+        self.cache.sftp_panel_minimized = val;
+    }
+
    pub fn get(&self, id: &str) -> Option<&Session> {
        self.cache.sessions.iter().find(|s| s.id == id)
    }
@@ -363,6 +600,17 @@ impl ConfigStore {
        }
        let raw = serde_json::to_string_pretty(&self.cache)?;
        fs::write(&self.path, raw)
-            .with_context(|| format!("failed to write {}", self.path.display()))
+            .with_context(|| format!("failed to write {}", self.path.display()))?;
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            if let Ok(mut perms) = fs::metadata(&self.path).map(|m| m.permissions()) {
+                perms.set_mode(0o600);
+                let _ = fs::set_permissions(&self.path, perms);
+            }
+        }
+
+        Ok(())
    }
 }
@@ -1,3 +1,5 @@
+pub mod ops;
+
 use std::{
    fs,
    path::{Path, PathBuf},
@@ -27,7 +29,7 @@ use zip::read::ZipArchive;
 use rust_i18n::t;

 use crate::{
-    config::{AuthMethod, Session},
+    session::config::{AuthMethod, Session},
    terminal::BackendEvent,
 };

@@ -256,7 +258,7 @@ async fn run_sftp(
        .canonicalize(".")
        .await
        .unwrap_or_else(|_| "/".to_string());
-    
+
    let _ = events.send(BackendEvent::SftpHome {
        tab_id: tab_id.clone(),
        home: home.clone(),
@@ -377,16 +379,28 @@ async fn run_sftp(
                        }
                        Err(err) => {
                            let err_msg = format!("{err:#}");
+                            let is_cancelled = err_msg.contains("transfer cancelled");
+                            let state = if is_cancelled {
+                                crate::terminal::TransferState::Interrupted(
+                                    "User cancelled".to_string(),
+                                )
+                            } else {
+                                crate::terminal::TransferState::Failed(err_msg.clone())
+                            };
                            let _ = events_clone.send(BackendEvent::SftpStatus {
                                tab_id: tab_id_clone.clone(),
-                                text: t!("download_failed", err = err_msg.clone()).to_string(),
+                                text: if is_cancelled {
+                                    "Transmission cancelled".to_string()
+                                } else {
+                                    t!("download_failed", err = err_msg.clone()).to_string()
+                                },
                            });
                            let _ = events_clone.send(BackendEvent::TransferProgress {
                                tab_id: tab_id_clone,
                                id: id.clone(),
                                transferred: 0,
                                total: None,
-                                state: crate::terminal::TransferState::Failed(err_msg),
+                                state,
                            });
                        }
                    }
@@ -478,16 +492,28 @@ async fn run_sftp(
                        }
                        Err(err) => {
                            let err_msg = format!("{err:#}");
+                            let is_cancelled = err_msg.contains("transfer cancelled");
+                            let state = if is_cancelled {
+                                crate::terminal::TransferState::Interrupted(
+                                    "User cancelled".to_string(),
+                                )
+                            } else {
+                                crate::terminal::TransferState::Failed(err_msg.clone())
+                            };
                            let _ = events_clone.send(BackendEvent::SftpStatus {
                                tab_id: tab_id_clone.clone(),
-                                text: t!("upload_failed", err = err_msg.clone()).to_string(),
+                                text: if is_cancelled {
+                                    "Transmission cancelled".to_string()
+                                } else {
+                                    t!("upload_failed", err = err_msg.clone()).to_string()
+                                },
                            });
                            let _ = events_clone.send(BackendEvent::TransferProgress {
                                tab_id: tab_id_clone,
                                id: id.clone(),
                                transferred: 0,
                                total: None,
-                                state: crate::terminal::TransferState::Failed(err_msg),
+                                state,
                            });
                        }
                    }
@@ -496,7 +522,7 @@ async fn run_sftp(
            }
            SftpCommand::EditFile { remote_path } => {
                let id = uuid::Uuid::new_v4().to_string();
-                let config = crate::config::ConfigStore::load().unwrap();
+                let config = crate::session::config::ConfigStore::load().unwrap();
                let tmp_dir = config.tmp_dir().unwrap_or_else(|| PathBuf::from("/tmp"));
                let base = base_name(&remote_path);
                let local_path = tmp_dir.join(format!("{}-{}", id, base));
@@ -573,10 +599,13 @@ async fn run_sftp(
                        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
                        while let Ok(_) = rx.try_recv() {} // drain pending

-                        if commands_tx_clone.send(SftpCommand::UploadEditedFile {
-                            local_path: local_path.to_string_lossy().to_string(),
-                            remote_path: remote_path.clone(),
-                        }).is_err() {
+                        if commands_tx_clone
+                            .send(SftpCommand::UploadEditedFile {
+                                local_path: local_path.to_string_lossy().to_string(),
+                                remote_path: remote_path.clone(),
+                            })
+                            .is_err()
+                        {
                            break;
                        }
                    }
@@ -620,7 +649,11 @@ async fn run_sftp(
                            let now = chrono::Local::now().format("%H:%M:%S");
                            let _ = events_clone.send(BackendEvent::SftpStatus {
                                tab_id: tab_id_clone.clone(),
-                                text: format!("{} ({})", t!("auto_saved_and_uploaded", base = base_name(&remote_path)), now),
+                                text: format!(
+                                    "{} ({})",
+                                    t!("auto_saved_and_uploaded", base = base_name(&remote_path)),
+                                    now
+                                ),
                            });
                        }
                        Err(err) => {
@@ -641,13 +674,16 @@ async fn run_sftp(
                    path.clone()
                };

+                tracing::info!("[sftp] creating directory: '{}'", actual_path);
+
                match sftp.create_dir(&actual_path).await {
                    Ok(_) => {
                        let _ = events.send(BackendEvent::SftpStatus {
                            tab_id: tab_id.clone(),
-                            text: t!("create_folder_success", name = base_name(&actual_path)).to_string(),
+                            text: t!("create_folder_success", name = base_name(&actual_path))
+                                .to_string(),
                        });
-                        
+
                        // Re-fetch the parent directory to show the newly created folder
                        if let Some(parent) = parent_dir(&actual_path) {
                            let _ = commands_tx.send(SftpCommand::ListDir(parent));
@@ -664,6 +700,7 @@ async fn run_sftp(
                }
            }
            SftpCommand::DeletePaths(paths) => {
+                tracing::info!("[sftp] batch deleting {} paths", paths.len());
                let _ = events.send(BackendEvent::SftpStatus {
                    tab_id: tab_id.clone(),
                    text: t!("deleting_paths", count = paths.len()).to_string(),
@@ -736,21 +773,27 @@ fn recursive_delete<'a>(
                        continue;
                    }
                    let child_path = crate::sftp::join_remote(&path, &name);
-                    
+
                    let meta = entry.metadata();
                    let permissions = meta.permissions.unwrap_or(0);
                    let is_dir = (permissions & 0o170_000) == 0o040_000;
-                    
+
                    if is_dir {
                        recursive_delete(sftp, child_path).await?;
                    } else {
-                        sftp.remove_file(&child_path).await.with_context(|| format!("Failed to delete file {child_path}"))?;
+                        sftp.remove_file(&child_path)
+                            .await
+                            .with_context(|| format!("Failed to delete file {child_path}"))?;
                    }
                }
-                sftp.remove_dir(&path).await.with_context(|| format!("Failed to delete dir {path}"))?;
+                sftp.remove_dir(&path)
+                    .await
+                    .with_context(|| format!("Failed to delete dir {path}"))?;
            }
            Err(_) => {
-                sftp.remove_file(&path).await.with_context(|| format!("Failed to delete {path}"))?;
+                sftp.remove_file(&path)
+                    .await
+                    .with_context(|| format!("Failed to delete {path}"))?;
            }
        }
        Ok(())
@@ -795,11 +838,63 @@ async fn connect_and_authenticate(
            .context("password authentication failed")?,
        AuthMethod::Key => {
            let keypair = load_session_private_key(session)?;
-            let key = private_key_with_alg(keypair).context("invalid private key")?;
-            handle
-                .authenticate_publickey(&session.user, key)
-                .await
-                .context("public key authentication failed")?
+            let keys = private_keys_with_algs(keypair).context("invalid private key")?;
+            let mut success = false;
+            for key in keys {
+                match handle.authenticate_publickey(&session.user, key).await {
+                    Ok(true) => {
+                        success = true;
+                        break;
+                    }
+                    Ok(false) => {
+                        tracing::debug!(
+                            "[sftp] public key auth failed with algorithm, trying next"
+                        );
+                        continue;
+                    }
+                    Err(e) => {
+                        tracing::debug!("[sftp] public key auth error: {:?}, trying next", e);
+                        continue;
+                    }
+                }
+            }
+            if !success {
+                return Err(anyhow!(
+                    "public key authentication failed for {}@{}:{}",
+                    session.user,
+                    session.host,
+                    session.port
+                ));
+            }
+            success
+        }
+        AuthMethod::KeyboardInteractive => {
+            let cached_kb_responses = {
+                let cache_lock = crate::backend::ssh::CREDENTIALS_CACHE.get_or_init(|| std::sync::Mutex::new(std::collections::HashMap::new()));
+                let cache = cache_lock.lock().unwrap();
+                cache.get(&session.id).and_then(|c| c.kb_responses.clone())
+            };
+            let responses = cached_kb_responses.unwrap_or_else(|| vec![session.password.clone()]);
+            let mut response = handle.authenticate_keyboard_interactive_start(&session.user, None).await?;
+            loop {
+                match response {
+                    russh::client::KeyboardInteractiveAuthResponse::Success => {
+                        break true;
+                    }
+                    russh::client::KeyboardInteractiveAuthResponse::Failure => {
+                        break false;
+                    }
+                    russh::client::KeyboardInteractiveAuthResponse::InfoRequest { prompts, .. } => {
+                        let mut resp = responses.clone();
+                        if resp.len() < prompts.len() {
+                            resp.resize(prompts.len(), String::new());
+                        } else if resp.len() > prompts.len() {
+                            resp.truncate(prompts.len());
+                        }
+                        response = handle.authenticate_keyboard_interactive_respond(resp).await?;
+                    }
+                }
+            }
        }
    };

@@ -812,6 +907,7 @@ async fn connect_and_authenticate(
            match session.auth {
                AuthMethod::Password => "password",
                AuthMethod::Key => "public key",
+                AuthMethod::KeyboardInteractive => "keyboard interactive",
            },
            session.user,
            session.host,
@@ -825,6 +921,17 @@ async fn connect_and_authenticate(
 fn load_session_private_key(session: &Session) -> Result<PrivateKey> {
    let inline_key = normalize_inline_private_key(&session.private_key_inline);
    let key_path = expand_key_path(session.private_key_path.trim());
+    let cached_passphrase = {
+        let cache_lock = crate::backend::ssh::CREDENTIALS_CACHE.get_or_init(|| std::sync::Mutex::new(std::collections::HashMap::new()));
+        let cache = cache_lock.lock().unwrap();
+        cache.get(&session.id).and_then(|c| c.passphrase.clone())
+    };
+    let passphrase = if let Some(ref p) = cached_passphrase {
+        Some(p.as_str())
+    } else {
+        let p = session.passphrase.trim();
+        (!p.is_empty()).then_some(p)
+    };
    let has_inline = !inline_key.is_empty();
    let has_path = key_path.is_some();

@@ -835,14 +942,14 @@ fn load_session_private_key(session: &Session) -> Result<PrivateKey> {
    let mut errors = Vec::new();

    if has_inline {
-        match decode_secret_key(&inline_key, None) {
+        match decode_secret_key(&inline_key, passphrase) {
            Ok(key) => return Ok(key),
            Err(err) => errors.push(format!("decode private key content: {err}")),
        }
    }

    if let Some(path) = key_path {
-        match load_secret_key(path.as_path(), None) {
+        match load_secret_key(path.as_path(), passphrase) {
            Ok(key) => return Ok(key),
            Err(err) => errors.push(format!("load key {}: {err}", path.display())),
        }
@@ -851,16 +958,33 @@ fn load_session_private_key(session: &Session) -> Result<PrivateKey> {
    Err(anyhow!(errors.join("; ")))
 }

-fn private_key_with_alg(keypair: PrivateKey) -> Result<PrivateKeyWithHashAlg> {
-    let hash_alg = if keypair.algorithm().is_rsa() {
-        Some(HashAlg::Sha512)
+fn private_keys_with_algs(keypair: PrivateKey) -> Result<Vec<PrivateKeyWithHashAlg>> {
+    let mut algs = Vec::new();
+    let key_arc = Arc::new(keypair);
+
+    if key_arc.algorithm().is_rsa() {
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha512)) {
+            algs.push(k);
+        }
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), Some(HashAlg::Sha256)) {
+            algs.push(k);
+        }
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
+            algs.push(k);
+        }
    } else {
-        None
-    };
-    Ok(
-        PrivateKeyWithHashAlg::new(Arc::new(keypair.clone()), hash_alg)
-            .or_else(|_| PrivateKeyWithHashAlg::new(Arc::new(keypair), Some(HashAlg::Sha256)))?,
-    )
+        if let Ok(k) = PrivateKeyWithHashAlg::new(key_arc.clone(), None) {
+            algs.push(k);
+        }
+    }
+
+    if algs.is_empty() {
+        return Err(anyhow!(
+            "Failed to construct PrivateKeyWithHashAlg for any supported hash algorithm"
+        ));
+    }
+
+    Ok(algs)
 }

 fn normalize_inline_private_key(value: &str) -> String {
@@ -1063,6 +1187,12 @@ async fn download_path_impl(
        .await
        .with_context(|| format!("create {}", local_dir.display()))?;

+    // Check for cancellation after initial setup
+    let state = flag.0.load(Ordering::SeqCst);
+    if state == 2 {
+        return Err(anyhow::anyhow!("transfer cancelled"));
+    }
+
    let metadata = sftp
        .metadata(remote)
        .await
@@ -1156,7 +1286,15 @@ async fn download_remote_directory_archive(
        base_name(remote_dir),
        Uuid::new_v4()
    );
+
+    // Check for cancellation before creating remote archive
+    let state = flag.0.load(Ordering::SeqCst);
+    if state == 2 {
+        return Err(anyhow::anyhow!("transfer cancelled"));
+    }
+
    create_remote_archive(handle, remote_dir, &remote_archive).await?;
+
    let local_extract_root = local_archive
        .parent()
        .unwrap_or_else(|| Path::new("."))
@@ -1262,6 +1400,12 @@ async fn upload_paths_impl(
    tab_id: &str,
    id: &str,
 ) -> Result<String> {
+    // Check for cancellation before starting
+    let state = flag.0.load(Ordering::SeqCst);
+    if state == 2 {
+        return Err(anyhow::anyhow!("transfer cancelled"));
+    }
+
    create_remote_dir_all(sftp, remote_dir).await?;
    let mut file_count = 0usize;
    let mut folder_count = 0usize;
@@ -1314,8 +1458,19 @@ async fn upload_paths_impl(
        }
    }

+    // Check for cancellation before creating directories
+    let state = flag.0.load(Ordering::SeqCst);
+    if state == 2 {
+        return Err(anyhow::anyhow!("transfer cancelled"));
+    }
+
    // Create directories sequentially first
    for dir in dirs_to_create {
+        // Check for cancellation between each directory creation
+        let state = flag.0.load(Ordering::SeqCst);
+        if state == 2 {
+            return Err(anyhow::anyhow!("transfer cancelled"));
+        }
        create_remote_dir_all(sftp, &dir).await?;
    }

@@ -1483,14 +1638,31 @@ async fn exec_remote_command(
    let mut stderr = Vec::new();
    let mut stdout = Vec::new();
    let mut exit_status = None;
-    while let Some(msg) = channel.wait().await {
-        match msg {
-            russh::ChannelMsg::Data { data } => stdout.extend_from_slice(&data),
-            russh::ChannelMsg::ExtendedData { data, .. } => stderr.extend_from_slice(&data),
-            russh::ChannelMsg::ExitStatus { exit_status: code } => exit_status = Some(code),
-            russh::ChannelMsg::Close => break,
-            _ => {}
+
+    // Add timeout to prevent indefinite blocking (300 seconds = 5 minutes)
+    let timeout = tokio::time::Duration::from_secs(300);
+    let result = tokio::time::timeout(timeout, async {
+        loop {
+            // Yield to allow cancellation
+            tokio::task::yield_now().await;
+
+            if let Some(msg) = channel.wait().await {
+                match msg {
+                    russh::ChannelMsg::Data { data } => stdout.extend_from_slice(&data),
+                    russh::ChannelMsg::ExtendedData { data, .. } => stderr.extend_from_slice(&data),
+                    russh::ChannelMsg::ExitStatus { exit_status: code } => exit_status = Some(code),
+                    russh::ChannelMsg::Close => break,
+                    _ => {}
+                }
+            } else {
+                break;
+            }
        }
+    })
+    .await;
+
+    if result.is_err() {
+        return Err(anyhow!("remote command timeout: {command}"));
    }

    match exit_status.unwrap_or(0) {
@@ -0,0 +1,395 @@
+use gpui::{Context, PathPromptOptions, Pixels, Point, Window};
+
+use crate::{
+    Ashell, SftpContextMenuState,
+    sftp::{RemoteEntry, SftpHandle},
+    terminal,
+};
+
+pub(crate) fn is_editable_text_file(filename: &str) -> bool {
+    let lower = filename.to_lowercase();
+    let ext = std::path::Path::new(&lower)
+        .extension()
+        .and_then(|s| s.to_str())
+        .unwrap_or("");
+    let known_exts = [
+        "txt", "conf", "json", "yaml", "yml", "xml", "ini", "sh", "py", "rs", "js", "ts", "html",
+        "css", "md", "toml", "csv", "log", "cfg",
+    ];
+    if known_exts.contains(&ext) {
+        return true;
+    }
+    let known_names = ["dockerfile", "makefile", ".gitignore", ".env"];
+    if known_names.contains(&lower.as_str()) {
+        return true;
+    }
+    false
+}
+
+impl Ashell {
+    pub(crate) fn active_sftp(&self) -> Option<&terminal::SftpUiState> {
+        self.active_group
+            .as_ref()
+            .and_then(|id| self.tab_groups.iter().find(|g| &g.id == id))
+            .and_then(|g| g.sftp.as_ref())
+    }
+
+    pub(crate) fn active_sftp_mut(&mut self) -> Option<&mut terminal::SftpUiState> {
+        let active_id = self.active_group.clone()?;
+        self.tab_groups
+            .iter_mut()
+            .find(|g| g.id == active_id)
+            .and_then(|g| g.sftp.as_mut())
+    }
+
+    pub(crate) fn active_sftp_handle(&self) -> Option<&SftpHandle> {
+        self.active_group
+            .as_ref()
+            .and_then(|id| self.sftp_handles.get(id))
+    }
+
+    pub(crate) fn navigate_sftp(&mut self, path: String, cx: &mut Context<Self>) {
+        if let Some(handle) = self.active_sftp_handle() {
+            tracing::info!("[sftp] navigating to directory: '{}'", path);
+            handle.list_dir(path.clone());
+            if let Some(sftp) = self.active_sftp_mut() {
+                sftp.current_path = path;
+                self.pending_sftp_path_sync = Some(sftp.current_path.clone());
+            }
+            cx.notify();
+        }
+    }
+
+    pub(crate) fn select_sftp_entry(&mut self, entry: RemoteEntry, cx: &mut Context<Self>) {
+        if entry.is_dir {
+            self.navigate_sftp(entry.full_path, cx);
+            return;
+        }
+        self.mark_sftp_entry_selected(&entry.full_path, cx);
+        if let Some(sftp) = self.active_sftp_mut() {
+            if !sftp.selected_entries.remove(&entry.full_path) {
+                sftp.selected_entries.insert(entry.full_path);
+            }
+        }
+    }
+
+    pub(crate) fn mark_sftp_entry_selected(&mut self, path: &str, cx: &mut Context<Self>) {
+        if let Some(sftp) = self.active_sftp_mut() {
+            sftp.selected_path = Some(path.to_string());
+        }
+        cx.notify();
+    }
+
+    pub(crate) fn sftp_parent_path(path: &str) -> String {
+        if path == "/" {
+            return "/".to_string();
+        }
+        path.trim_end_matches('/')
+            .rsplit_once('/')
+            .map(|(parent, _)| {
+                if parent.is_empty() {
+                    "/".to_string()
+                } else {
+                    parent.to_string()
+                }
+            })
+            .unwrap_or_else(|| "/".to_string())
+    }
+
+    pub(crate) fn refresh_sftp(&mut self, cx: &mut Context<Self>) {
+        if let Some(path) = self.active_sftp().map(|sftp| sftp.current_path.clone()) {
+            self.navigate_sftp(path, cx);
+        }
+    }
+
+    pub(crate) fn sync_sftp_path_input(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(path) = self.pending_sftp_path_sync.take() else {
+            return;
+        };
+        self.sftp_path_input.update(cx, |state, cx| {
+            state.set_value(path, window, cx);
+        });
+    }
+
+    pub(crate) fn open_sftp_context_menu(
+        &mut self,
+        remote_path: String,
+        is_dir: bool,
+        position: Point<Pixels>,
+        cx: &mut Context<Self>,
+    ) {
+        self.sftp_context_menu = Some(SftpContextMenuState {
+            remote_path,
+            is_dir,
+            position,
+        });
+        cx.notify();
+    }
+
+    pub(crate) fn dismiss_sftp_context_menu(&mut self, cx: &mut Context<Self>) {
+        if self.sftp_context_menu.take().is_some() {
+            cx.notify();
+        }
+    }
+
+    pub(crate) fn trigger_sftp_context_download(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let Some(menu) = self.sftp_context_menu.take() else {
+            return;
+        };
+        self.download_sftp_entry(menu.remote_path, window, cx);
+        cx.notify();
+    }
+
+    pub(crate) fn trigger_sftp_context_edit(&mut self, cx: &mut Context<Self>) {
+        let Some(menu) = self.sftp_context_menu.take() else {
+            return;
+        };
+        if let Some(handle) = self.active_sftp_handle() {
+            tracing::info!("[sftp] triggering edit for file: '{}'", menu.remote_path);
+            handle.edit_file(menu.remote_path);
+        }
+        cx.notify();
+    }
+
+    pub(crate) fn download_sftp_entry(
+        &mut self,
+        remote_path: String,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let Some(handle) = self.active_sftp_handle().cloned() else {
+            return;
+        };
+        let path_prompt = cx.prompt_for_paths(PathPromptOptions {
+            files: false,
+            directories: true,
+            multiple: false,
+            prompt: Some("Select Download Folder".into()),
+        });
+        cx.spawn_in(window, async move |this, cx| {
+            match path_prompt.await {
+                Ok(Ok(Some(mut paths))) => {
+                    if let Some(folder) = paths.pop() {
+                        let local_path = folder.to_string_lossy().to_string();
+                        tracing::info!(
+                            "[sftp] initiating download of '{}' to '{}'",
+                            remote_path,
+                            local_path
+                        );
+                        handle.download(remote_path, local_path);
+                        this.update(cx, |this, cx| {
+                            this.show_transfers_dialog = true;
+                            cx.notify();
+                        })?;
+                    }
+                }
+                Ok(Err(err)) => {
+                    this.update(cx, |this, cx| {
+                        this.status = format!("download picker failed: {err}").into();
+                        cx.notify();
+                    })?;
+                }
+                _ => {}
+            }
+            Ok::<(), anyhow::Error>(())
+        })
+        .detach();
+    }
+
+    pub(crate) fn upload_sftp_files(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(handle) = self.active_sftp_handle().cloned() else {
+            return;
+        };
+        let remote_dir = self
+            .active_sftp()
+            .map(|sftp| sftp.current_path.clone())
+            .unwrap_or_else(|| "/".into());
+        let path_prompt = cx.prompt_for_paths(PathPromptOptions {
+            files: true,
+            directories: false,
+            multiple: false,
+            prompt: Some("Select File to Upload".into()),
+        });
+        cx.spawn_in(window, async move |this, cx| {
+            match path_prompt.await {
+                Ok(Ok(Some(mut paths))) => {
+                    if let Some(file) = paths.pop() {
+                        let local_path = file.to_string_lossy().to_string();
+                        tracing::info!(
+                            "[sftp] initiating upload of file '{}' to '{}'",
+                            local_path,
+                            remote_dir
+                        );
+                        handle.upload_paths(vec![local_path], remote_dir);
+                        this.update(cx, |this, cx| {
+                            this.show_transfers_dialog = true;
+                            cx.notify();
+                        })?;
+                    }
+                }
+                Ok(Err(err)) => {
+                    this.update(cx, |this, cx| {
+                        this.status = format!("upload picker failed: {err}").into();
+                        cx.notify();
+                    })?;
+                }
+                _ => {}
+            }
+            Ok::<(), anyhow::Error>(())
+        })
+        .detach();
+    }
+
+    pub(crate) fn upload_sftp_folder(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(handle) = self.active_sftp_handle().cloned() else {
+            return;
+        };
+        let remote_dir = self
+            .active_sftp()
+            .map(|sftp| sftp.current_path.clone())
+            .unwrap_or_else(|| "/".into());
+        let path_prompt = cx.prompt_for_paths(PathPromptOptions {
+            files: false,
+            directories: true,
+            multiple: false,
+            prompt: Some("Select Folder to Upload".into()),
+        });
+        cx.spawn_in(window, async move |this, cx| {
+            match path_prompt.await {
+                Ok(Ok(Some(mut paths))) => {
+                    if let Some(folder) = paths.pop() {
+                        let local_path = folder.to_string_lossy().to_string();
+                        tracing::info!(
+                            "[sftp] initiating upload of folder '{}' to '{}'",
+                            local_path,
+                            remote_dir
+                        );
+                        handle.upload_paths(vec![local_path], remote_dir);
+                        this.update(cx, |this, cx| {
+                            this.show_transfers_dialog = true;
+                            cx.notify();
+                        })?;
+                    }
+                }
+                Ok(Err(err)) => {
+                    this.update(cx, |this, cx| {
+                        this.status = format!("upload picker failed: {err}").into();
+                        cx.notify();
+                    })?;
+                }
+                _ => {}
+            }
+            Ok::<(), anyhow::Error>(())
+        })
+        .detach();
+    }
+
+    pub(crate) fn toggle_sftp_entry(
+        &mut self,
+        path: String,
+        checked: bool,
+        cx: &mut Context<Self>,
+    ) {
+        if let Some(sftp) = self.active_sftp_mut() {
+            if checked {
+                sftp.selected_entries.insert(path);
+            } else {
+                sftp.selected_entries.remove(&path);
+            }
+            cx.notify();
+        }
+    }
+
+    pub(crate) fn toggle_all_sftp_entries(&mut self, checked: bool, cx: &mut Context<Self>) {
+        if let Some(sftp) = self.active_sftp_mut() {
+            if checked {
+                let paths: Vec<String> = sftp.entries.iter().map(|e| e.full_path.clone()).collect();
+                for path in paths {
+                    sftp.selected_entries.insert(path);
+                }
+            } else {
+                sftp.selected_entries.clear();
+            }
+            cx.notify();
+        }
+    }
+
+    pub(crate) fn download_selected_sftp_entries(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let Some(sftp) = self.active_sftp() else {
+            return;
+        };
+        let selected: Vec<String> = sftp.selected_entries.iter().cloned().collect();
+        if selected.is_empty() {
+            return;
+        }
+
+        let Some(handle) = self.active_sftp_handle().cloned() else {
+            return;
+        };
+
+        let path_prompt = cx.prompt_for_paths(PathPromptOptions {
+            files: false,
+            directories: true,
+            multiple: false,
+            prompt: Some("Select Download Folder".into()),
+        });
+
+        cx.spawn_in(window, async move |this, cx| {
+            if let Ok(Ok(Some(mut paths))) = path_prompt.await {
+                if let Some(folder) = paths.pop() {
+                    let local_dir = folder.to_string_lossy().to_string();
+                    tracing::info!(
+                        "[sftp] initiating batch download of {} entries to '{}'",
+                        selected.len(),
+                        local_dir
+                    );
+                    for remote in selected {
+                        let _ = handle.commands.send(crate::sftp::SftpCommand::Download {
+                            remote,
+                            local_dir: local_dir.clone(),
+                        });
+                    }
+
+                    let _ = this.update(cx, |this, cx| {
+                        if let Some(sftp_mut) = this.active_sftp_mut() {
+                            sftp_mut.selected_entries.clear();
+                        }
+                        this.show_transfers_dialog = true;
+                        cx.notify();
+                    });
+                }
+            }
+            Ok::<(), anyhow::Error>(())
+        })
+        .detach();
+    }
+
+    pub(crate) fn upload_sftp_files_batch(&mut self, paths: Vec<String>, cx: &mut Context<Self>) {
+        if paths.is_empty() {
+            return;
+        }
+        if let Some(sftp) = self.active_sftp() {
+            if let Some(handle) = self.active_sftp_handle() {
+                tracing::info!(
+                    "[sftp] initiating batch upload of {} files to '{}'",
+                    paths.len(),
+                    sftp.current_path
+                );
+                let _ = handle.commands.send(crate::sftp::SftpCommand::UploadPaths {
+                    locals: paths,
+                    remote_dir: sftp.current_path.clone(),
+                });
+                self.show_transfers_dialog = true;
+                cx.notify();
+            }
+        }
+    }
+}
@@ -1,432 +0,0 @@
-use std::{
-    path::{Path, PathBuf},
-    sync::Arc,
-};
-
-use anyhow::{Context, Result, anyhow};
-use async_trait::async_trait;
-use directories::BaseDirs;
-use russh::{
-    ChannelMsg, Disconnect,
-    client::{self, Handler},
-    keys::{HashAlg, PrivateKey, decode_secret_key, key::PrivateKeyWithHashAlg, load_secret_key},
-};
-use tokio::sync::mpsc;
-
-use crate::{
-    config::{AuthMethod, Session},
-    system::{SystemSnapshot, remote_snapshot_from_kv},
-    terminal::{BackendCommand, BackendEvent, BackendTx},
-};
-
-pub fn spawn_ssh_terminal(
-    runtime: &tokio::runtime::Handle,
-    tab_id: String,
-    session: Session,
-    cols: u16,
-    rows: u16,
-    events: std::sync::mpsc::Sender<BackendEvent>,
-) -> BackendTx {
-    let (cmd_tx, cmd_rx) = mpsc::unbounded_channel::<BackendCommand>();
-    let task_tab = tab_id.clone();
-    runtime.spawn(async move {
-        if let Err(err) = run_ssh(
-            task_tab.clone(),
-            session,
-            cols,
-            rows,
-            cmd_rx,
-            events.clone(),
-        )
-        .await
-        {
-            let _ = events.send(BackendEvent::Closed {
-                tab_id: task_tab,
-                reason: format!("{err:#}"),
-            });
-        }
-    });
-    BackendTx::Ssh(cmd_tx)
-}
-
-pub async fn sample_remote_system(session: Session) -> Result<SystemSnapshot> {
-    let (events_tx, _events_rx) = std::sync::mpsc::channel();
-    let handle = connect_and_authenticate("remote-metrics", &session, &events_tx).await?;
-    let mut channel = handle
-        .channel_open_session()
-        .await
-        .context("open metrics session")?;
-    channel
-        .exec(true, REMOTE_SYSTEM_PROBE)
-        .await
-        .context("exec remote metrics probe")?;
-
-    let mut stdout = Vec::new();
-    while let Some(msg) = channel.wait().await {
-        match msg {
-            ChannelMsg::Data { data } | ChannelMsg::ExtendedData { data, ext: _ } => {
-                stdout.extend_from_slice(&data);
-            }
-            ChannelMsg::Close => break,
-            _ => {}
-        }
-    }
-
-    let _ = handle
-        .disconnect(Disconnect::ByApplication, "metrics done", "")
-        .await;
-    let output = String::from_utf8_lossy(&stdout);
-    remote_snapshot_from_kv(&output)
-}
-
-async fn run_ssh(
-    tab_id: String,
-    session: Session,
-    cols: u16,
-    rows: u16,
-    mut commands: mpsc::UnboundedReceiver<BackendCommand>,
-    events: std::sync::mpsc::Sender<BackendEvent>,
-) -> Result<()> {
-    let _ = events.send(BackendEvent::Status {
-        tab_id: tab_id.clone(),
-        text: format!(
-            "connecting {}@{}:{}...",
-            session.user, session.host, session.port
-        ),
-    });
-
-    let handle = connect_and_authenticate(&tab_id, &session, &events).await?;
-
-    let mut channel = handle
-        .channel_open_session()
-        .await
-        .context("open session")?;
-    channel
-        .request_pty(true, "xterm-256color", cols.into(), rows.into(), 0, 0, &[])
-        .await
-        .context("request pty")?;
-    channel.request_shell(true).await.context("request shell")?;
-
-    let _ = events.send(BackendEvent::Status {
-        tab_id: tab_id.clone(),
-        text: format!("connected {}@{}", session.user, session.host),
-    });
-    let _ = events.send(BackendEvent::Connected {
-        tab_id: tab_id.clone(),
-    });
-
-    loop {
-        tokio::select! {
-            command = commands.recv() => {
-                match command {
-                    Some(BackendCommand::Input(bytes)) => {
-                        if let Err(err) = channel.data(bytes.as_slice()).await {
-                            let _ = events.send(BackendEvent::Closed {
-                                tab_id: tab_id.clone(),
-                                reason: format!("ssh write error: {err}"),
-                            });
-                            break;
-                        }
-                    }
-                    Some(BackendCommand::Resize { cols, rows }) => {
-                        let _ = channel.window_change(cols.into(), rows.into(), 0, 0).await;
-                    }
-                    Some(BackendCommand::Close) | None => {
-                        let _ = channel.eof().await;
-                        break;
-                    }
-                }
-            }
-            msg = channel.wait() => {
-                match msg {
-                    Some(ChannelMsg::Data { data }) | Some(ChannelMsg::ExtendedData { data, ext: _ }) => {
-                        let _ = events.send(BackendEvent::Output {
-                            tab_id: tab_id.clone(),
-                            bytes: data.to_vec(),
-                        });
-                    }
-                    Some(ChannelMsg::Close) | None => break,
-                    _ => {}
-                }
-            }
-        }
-    }
-
-    let _ = handle
-        .disconnect(Disconnect::ByApplication, "bye", "")
-        .await;
-    let _ = events.send(BackendEvent::Closed {
-        tab_id,
-        reason: "ssh session closed".into(),
-    });
-    Ok(())
-}
-
-async fn connect_and_authenticate(
-    tab_id: &str,
-    session: &Session,
-    events: &std::sync::mpsc::Sender<BackendEvent>,
-) -> Result<russh::client::Handle<ClientHandler>> {
-    let config = Arc::new(client::Config {
-        inactivity_timeout: Some(std::time::Duration::from_secs(600)),
-        ..Default::default()
-    });
-    let addr = format!("{}:{}", session.host, session.port);
-    let _ = events.send(BackendEvent::Status {
-        tab_id: tab_id.to_string(),
-        text: format!("opening tcp connection to {addr}"),
-    });
-    let mut handle = client::connect(config, addr.as_str(), ClientHandler)
-        .await
-        .with_context(|| format!("connect {addr} failed"))?;
-
-    let authed = match session.auth {
-        AuthMethod::Password => {
-            let _ = events.send(BackendEvent::Status {
-                tab_id: tab_id.to_string(),
-                text: format!(
-                    "connected to {addr}, sending password authentication for {}",
-                    session.user
-                ),
-            });
-            handle
-                .authenticate_password(&session.user, &session.password)
-                .await
-                .context("password authentication failed")?
-        }
-        AuthMethod::Key => {
-            let source = key_source_label(session);
-            let _ = events.send(BackendEvent::Status {
-                tab_id: tab_id.to_string(),
-                text: format!("connected to {addr}, loading private key from {source}"),
-            });
-            let keypair = load_session_private_key(session)?;
-            let algorithm = format!("{:?}", keypair.algorithm());
-            let _ = events.send(BackendEvent::Status {
-                tab_id: tab_id.to_string(),
-                text: format!("private key loaded from {source}, algorithm {algorithm}, sending public key authentication for {}", session.user),
-            });
-            let key = private_key_with_alg(keypair).context("invalid private key")?;
-            handle
-                .authenticate_publickey(&session.user, key)
-                .await
-                .with_context(|| {
-                    format!(
-                        "public key authentication failed for {}@{}:{} using {} ({})",
-                        session.user, session.host, session.port, source, algorithm
-                    )
-                })?
-        }
-    };
-
-    if !authed {
-        let _ = handle
-            .disconnect(Disconnect::ByApplication, "auth failed", "")
-            .await;
-        return Err(anyhow!(
-            "{}",
-            match session.auth {
-                AuthMethod::Password => format!(
-                    "authentication failed: server rejected password authentication for {}@{}:{}",
-                    session.user, session.host, session.port
-                ),
-                AuthMethod::Key => format!(
-                    "authentication failed: server rejected public key authentication for {}@{}:{} using {}",
-                    session.user,
-                    session.host,
-                    session.port,
-                    key_source_label(session)
-                ),
-            }
-        ));
-    }
-
-    let _ = events.send(BackendEvent::Status {
-        tab_id: tab_id.to_string(),
-        text: format!(
-            "authentication accepted, opening shell for {}@{}",
-            session.user, session.host
-        ),
-    });
-
-    Ok(handle)
-}
-
-fn load_session_private_key(session: &Session) -> Result<PrivateKey> {
-    let inline_key = normalize_inline_private_key(&session.private_key_inline);
-    let key_path = expand_key_path(session.private_key_path.trim());
-    let has_inline = !inline_key.is_empty();
-    let has_path = key_path.is_some();
-
-    if !has_inline && !has_path {
-        return Err(anyhow!("private key content or path is required"));
-    }
-
-    let mut errors = Vec::new();
-
-    if has_inline {
-        match decode_secret_key(&inline_key, None) {
-            Ok(key) => return Ok(key),
-            Err(err) => errors.push(format!("decode private key content: {err}")),
-        }
-    }
-
-    if let Some(path) = key_path {
-        match load_secret_key(path.as_path(), None) {
-            Ok(key) => return Ok(key),
-            Err(err) => errors.push(format!("load key {}: {err}", path.display())),
-        }
-    }
-
-    Err(anyhow!(errors.join("; ")))
-}
-
-fn private_key_with_alg(keypair: PrivateKey) -> Result<PrivateKeyWithHashAlg> {
-    let hash_alg = if keypair.algorithm().is_rsa() {
-        Some(HashAlg::Sha512)
-    } else {
-        None
-    };
-    Ok(
-        PrivateKeyWithHashAlg::new(Arc::new(keypair.clone()), hash_alg)
-            .or_else(|_| PrivateKeyWithHashAlg::new(Arc::new(keypair), Some(HashAlg::Sha256)))?,
-    )
-}
-
-fn normalize_inline_private_key(value: &str) -> String {
-    let mut normalized = value
-        .trim()
-        .replace("\\r\\n", "\n")
-        .replace("\\n", "\n")
-        .replace("\r\n", "\n");
-    if !normalized.ends_with('\n') {
-        normalized.push('\n');
-    }
-    normalized
-}
-
-fn expand_key_path(value: &str) -> Option<PathBuf> {
-    if value.is_empty() {
-        return None;
-    }
-    if value == "~" {
-        return BaseDirs::new().map(|dirs| dirs.home_dir().to_path_buf());
-    }
-    if let Some(rest) = value.strip_prefix("~/") {
-        return BaseDirs::new().map(|dirs| dirs.home_dir().join(rest));
-    }
-    Some(Path::new(value).to_path_buf())
-}
-
-fn key_source_label(session: &Session) -> String {
-    let path = session.private_key_path.trim();
-    let has_inline = !session.private_key_inline.trim().is_empty();
-    match (!path.is_empty(), has_inline) {
-        (true, true) => format!("inline key or {}", path),
-        (true, false) => path.to_string(),
-        (false, true) => "inline key text".to_string(),
-        (false, false) => "unknown key source".to_string(),
-    }
-}
-
-const REMOTE_SYSTEM_PROBE: &str = r#"sh -lc '
-os=$(uname -s 2>/dev/null || echo unknown)
-
-if [ "$os" = "Linux" ] && [ -r /proc/stat ]; then
-  cpu_stat() { awk '"'"'/^cpu / { print ($2+$3+$4+$5+$6+$7+$8), $5 }'"'"' /proc/stat 2>/dev/null; }
-  net_stat() { awk -F"[: ]+" '"'"'/:/ && $1!="Inter" && $1!="face" { rx += $3; tx += $11 } END { print rx+0, tx+0 }'"'"' /proc/net/dev 2>/dev/null; }
-
-  read cpu_total_1 cpu_idle_1 <<EOF
-$(cpu_stat)
-EOF
-  read net_rx_1 net_tx_1 <<EOF
-$(net_stat)
-EOF
-  sleep 1
-  read cpu_total_2 cpu_idle_2 <<EOF
-$(cpu_stat)
-EOF
-  read net_rx_2 net_tx_2 <<EOF
-$(net_stat)
-EOF
-
-  cpu_delta=$((cpu_total_2 - cpu_total_1))
-  idle_delta=$((cpu_idle_2 - cpu_idle_1))
-  cpu_percent=$(awk -v total="$cpu_delta" -v idle="$idle_delta" '"'"'BEGIN { if (total <= 0) print "0.00"; else printf "%.2f", ((total-idle)/total)*100 }'"'"')
-  mem_total=$(awk '"'"'/^MemTotal:/ {print $2 * 1024}'"'"' /proc/meminfo 2>/dev/null)
-  mem_available=$(awk '"'"'/^MemAvailable:/ {print $2 * 1024}'"'"' /proc/meminfo 2>/dev/null)
-  swap_total=$(awk '"'"'/^SwapTotal:/ {print $2 * 1024}'"'"' /proc/meminfo 2>/dev/null)
-  swap_free=$(awk '"'"'/^SwapFree:/ {print $2 * 1024}'"'"' /proc/meminfo 2>/dev/null)
-
-  echo "CPU_PERCENT=${cpu_percent:-0.00}"
-  echo "MEM_TOTAL=${mem_total:-0}"
-  echo "MEM_USED=$(( ${mem_total:-0} - ${mem_available:-0} ))"
-  echo "SWAP_TOTAL=${swap_total:-0}"
-  echo "SWAP_USED=$(( ${swap_total:-0} - ${swap_free:-0} ))"
-  echo "NET_RX=$(( ${net_rx_2:-0} - ${net_rx_1:-0} ))"
-  echo "NET_TX=$(( ${net_tx_2:-0} - ${net_tx_1:-0} ))"
-  df -kP 2>/dev/null | awk "NR > 1 { printf \"DISK=%s\t%s\t%s\n\", \$6, \$4 * 1024, \$2 * 1024 }" | head -n 4
-  exit 0
-fi
-
-if [ "$os" = "Darwin" ]; then
-  net_stat() { netstat -ibn 2>/dev/null | awk '"'"'NR > 1 && $7 ~ /^[0-9]+$/ && $10 ~ /^[0-9]+$/ { rx += $7; tx += $10 } END { print rx+0, tx+0 }'"'"'; }
-
-  read net_rx_1 net_tx_1 <<EOF
-$(net_stat)
-EOF
-  sleep 1
-  read net_rx_2 net_tx_2 <<EOF
-$(net_stat)
-EOF
-
-  cpu_percent=$(top -l 2 -n 0 -s 1 2>/dev/null | awk -F"[:,% ]+" '"'"'/CPU usage:/ { user=$3; sys=$5 } END { if (user == "" && sys == "") print "0.00"; else printf "%.2f", user + sys }'"'"')
-  mem_total=$(sysctl -n hw.memsize 2>/dev/null || echo 0)
-  pagesize=$(sysctl -n hw.pagesize 2>/dev/null || echo 4096)
-  vm_output=$(vm_stat 2>/dev/null)
-  pages_active=$(printf "%s\n" "$vm_output" | awk '"'"'/Pages active/ { gsub("\\.","",$3); print $3+0 }'"'"')
-  pages_wired=$(printf "%s\n" "$vm_output" | awk '"'"'/Pages wired down/ { gsub("\\.","",$4); print $4+0 }'"'"')
-  pages_compressed=$(printf "%s\n" "$vm_output" | awk '"'"'/Pages occupied by compressor/ { gsub("\\.","",$5); print $5+0 }'"'"')
-  pages_speculative=$(printf "%s\n" "$vm_output" | awk '"'"'/Pages speculative/ { gsub("\\.","",$3); print $3+0 }'"'"')
-  mem_used=$(( (${pages_active:-0} + ${pages_wired:-0} + ${pages_compressed:-0} + ${pages_speculative:-0}) * ${pagesize:-4096} ))
-  swap_line=$(sysctl vm.swapusage 2>/dev/null || true)
-  swap_used=$(printf "%s\n" "$swap_line" | awk -F"[= ,]+" '"'"'
-    function mult(unit) { return unit=="K"?1024:(unit=="M"?1048576:(unit=="G"?1073741824:(unit=="T"?1099511627776:1))) }
-    /used/ { value=$4; unit=substr(value, length(value), 1); sub(/[A-Za-z]+$/, "", value); printf "%.0f", value * mult(unit) }'"'"')
-  swap_total=$(printf "%s\n" "$swap_line" | awk -F"[= ,]+" '"'"'
-    function mult(unit) { return unit=="K"?1024:(unit=="M"?1048576:(unit=="G"?1073741824:(unit=="T"?1099511627776:1))) }
-    /used/ && /free/ { used=$4; free=$8; unit1=substr(used, length(used), 1); unit2=substr(free, length(free), 1); sub(/[A-Za-z]+$/, "", used); sub(/[A-Za-z]+$/, "", free); printf "%.0f", (used * mult(unit1)) + (free * mult(unit2)) }'"'"')
-
-  echo "CPU_PERCENT=${cpu_percent:-0.00}"
-  echo "MEM_TOTAL=${mem_total:-0}"
-  echo "MEM_USED=${mem_used:-0}"
-  echo "SWAP_TOTAL=${swap_total:-0}"
-  echo "SWAP_USED=${swap_used:-0}"
-  echo "NET_RX=$(( ${net_rx_2:-0} - ${net_rx_1:-0} ))"
-  echo "NET_TX=$(( ${net_tx_2:-0} - ${net_tx_1:-0} ))"
-  df -kP 2>/dev/null | awk "NR > 1 { printf \"DISK=%s\t%s\t%s\n\", \$6, \$4 * 1024, \$2 * 1024 }" | head -n 4
-  exit 0
-fi
-
-echo "CPU_PERCENT=0.00"
-echo "MEM_TOTAL=0"
-echo "MEM_USED=0"
-echo "SWAP_TOTAL=0"
-echo "SWAP_USED=0"
-echo "NET_RX=0"
-echo "NET_TX=0"
-'"#;
-
-struct ClientHandler;
-
-#[async_trait]
-impl Handler for ClientHandler {
-    type Error = anyhow::Error;
-
-    async fn check_server_key(
-        &mut self,
-        _server_public_key: &russh::keys::ssh_key::PublicKey,
-    ) -> Result<bool, Self::Error> {
-        Ok(true)
-    }
-}
@@ -0,0 +1,577 @@
+use anyhow::{Context, Result, anyhow};
+use argon2::Argon2;
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use chacha20poly1305::{
+    XChaCha20Poly1305, XNonce,
+    aead::{Aead, KeyInit},
+};
+use hmac::{Hmac, Mac};
+use rand::{RngCore, rngs::OsRng};
+use reqwest::{Client, StatusCode, header};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+
+use crate::session::config::Session;
+
+const SYNC_FILE_NAME: &str = "ashell-sync.json";
+const FORMAT_VERSION: u32 = 1;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SyncPayload {
+    pub schema_version: u32,
+    pub revision: String,
+    pub updated_at: String,
+    pub device_id: String,
+    pub sessions: Vec<Session>,
+}
+
+impl SyncPayload {
+    pub fn new(device_id: String, sessions: Vec<Session>) -> Self {
+        Self {
+            schema_version: FORMAT_VERSION,
+            revision: Uuid::new_v4().to_string(),
+            updated_at: chrono::Utc::now().to_rfc3339(),
+            device_id,
+            sessions,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct EncryptedEnvelope {
+    format_version: u32,
+    kdf: String,
+    cipher: String,
+    salt: String,
+    nonce: String,
+    payload: String,
+}
+
+#[derive(Clone)]
+pub struct SyncCredentials {
+    pub backend: SyncBackendCredentials,
+    pub encryption_password: String,
+}
+
+#[derive(Clone)]
+pub enum SyncBackendCredentials {
+    WebDav {
+        endpoint: String,
+        username: String,
+        password: String,
+    },
+    S3 {
+        endpoint: String,
+        region: String,
+        bucket: String,
+        object_key: String,
+        access_key: String,
+        secret_key: String,
+        session_token: String,
+    },
+}
+
+#[derive(Debug, Clone)]
+pub enum SyncResult {
+    Uploaded {
+        etag: Option<String>,
+    },
+    Downloaded {
+        payload: SyncPayload,
+        etag: Option<String>,
+    },
+    Failed(String),
+}
+
+pub async fn upload(
+    credentials: SyncCredentials,
+    payload: SyncPayload,
+    expected_etag: Option<String>,
+) -> Result<Option<String>> {
+    validate_credentials(&credentials)?;
+    let body = encrypt_payload(&payload, &credentials.encryption_password)?;
+    match credentials.backend {
+        SyncBackendCredentials::WebDav {
+            endpoint,
+            username,
+            password,
+        } => upload_webdav(&endpoint, &username, &password, body, expected_etag).await,
+        SyncBackendCredentials::S3 {
+            endpoint,
+            region,
+            bucket,
+            object_key,
+            access_key,
+            secret_key,
+            session_token,
+        } => {
+            let config = S3Config {
+                endpoint,
+                region,
+                bucket,
+                object_key,
+                access_key,
+                secret_key,
+                session_token,
+            };
+            upload_s3(&config, body, expected_etag).await
+        }
+    }
+}
+
+async fn upload_webdav(
+    endpoint: &str,
+    username: &str,
+    password: &str,
+    body: Vec<u8>,
+    expected_etag: Option<String>,
+) -> Result<Option<String>> {
+    let client = Client::new();
+    let mut request = client
+        .put(sync_url(endpoint))
+        .basic_auth(username, Some(password))
+        .header(header::CONTENT_TYPE, "application/json")
+        .body(body);
+    request = if let Some(etag) = expected_etag {
+        request.header(header::IF_MATCH, etag)
+    } else {
+        // An uninitialized client may only create a new remote file. This keeps
+        // it from silently replacing configuration uploaded by another device.
+        request.header(header::IF_NONE_MATCH, "*")
+    };
+    let response = request.send().await.context("send WebDAV upload")?;
+    if response.status() == StatusCode::PRECONDITION_FAILED
+        || response.status() == StatusCode::CONFLICT
+    {
+        return Err(anyhow!(
+            "remote configuration changed; download it before uploading"
+        ));
+    }
+    if !response.status().is_success() {
+        return Err(anyhow!("WebDAV upload failed: HTTP {}", response.status()));
+    }
+    Ok(response
+        .headers()
+        .get(header::ETAG)
+        .and_then(|value| value.to_str().ok())
+        .map(str::to_string))
+}
+
+pub async fn download(credentials: SyncCredentials) -> Result<(SyncPayload, Option<String>)> {
+    validate_credentials(&credentials)?;
+    let encryption_password = credentials.encryption_password;
+    let (body, etag) = match credentials.backend {
+        SyncBackendCredentials::WebDav {
+            endpoint,
+            username,
+            password,
+        } => download_webdav(&endpoint, &username, &password).await?,
+        SyncBackendCredentials::S3 {
+            endpoint,
+            region,
+            bucket,
+            object_key,
+            access_key,
+            secret_key,
+            session_token,
+        } => {
+            let config = S3Config {
+                endpoint,
+                region,
+                bucket,
+                object_key,
+                access_key,
+                secret_key,
+                session_token,
+            };
+            download_s3(&config).await?
+        }
+    };
+    let payload = decrypt_payload(&body, &encryption_password)?;
+    Ok((payload, etag))
+}
+
+async fn download_webdav(
+    endpoint: &str,
+    username: &str,
+    password: &str,
+) -> Result<(Vec<u8>, Option<String>)> {
+    let response = Client::new()
+        .get(sync_url(endpoint))
+        .basic_auth(username, Some(password))
+        .send()
+        .await
+        .context("send WebDAV download")?;
+    if response.status() == StatusCode::NOT_FOUND {
+        return Err(anyhow!("no remote configuration exists yet"));
+    }
+    if !response.status().is_success() {
+        return Err(anyhow!(
+            "WebDAV download failed: HTTP {}",
+            response.status()
+        ));
+    }
+    let etag = response
+        .headers()
+        .get(header::ETAG)
+        .and_then(|value| value.to_str().ok())
+        .map(str::to_string);
+    let body = response
+        .bytes()
+        .await
+        .context("read WebDAV response")?
+        .to_vec();
+    Ok((body, etag))
+}
+
+fn validate_credentials(credentials: &SyncCredentials) -> Result<()> {
+    if credentials.encryption_password.len() < 8 {
+        return Err(anyhow!(
+            "encryption password must contain at least 8 characters"
+        ));
+    }
+    match &credentials.backend {
+        SyncBackendCredentials::WebDav { endpoint, .. } if endpoint.trim().is_empty() => {
+            Err(anyhow!("WebDAV endpoint is required"))
+        }
+        SyncBackendCredentials::S3 {
+            region,
+            bucket,
+            access_key,
+            secret_key,
+            ..
+        } if region.trim().is_empty()
+            || bucket.trim().is_empty()
+            || access_key.trim().is_empty()
+            || secret_key.is_empty() =>
+        {
+            Err(anyhow!(
+                "S3 region, bucket, access key and secret key are required"
+            ))
+        }
+        _ => Ok(()),
+    }
+}
+
+struct S3Config {
+    endpoint: String,
+    region: String,
+    bucket: String,
+    object_key: String,
+    access_key: String,
+    secret_key: String,
+    session_token: String,
+}
+
+async fn upload_s3(
+    config: &S3Config,
+    body: Vec<u8>,
+    expected_etag: Option<String>,
+) -> Result<Option<String>> {
+    let url = s3_url(config)?;
+    let mut headers = signed_s3_headers("PUT", &url, &body, config)?;
+    headers.insert(
+        header::CONTENT_TYPE,
+        header::HeaderValue::from_static("application/json"),
+    );
+    if let Some(etag) = expected_etag {
+        headers.insert(header::IF_MATCH, header_value(&etag, "S3 ETag")?);
+    } else {
+        headers.insert(header::IF_NONE_MATCH, header::HeaderValue::from_static("*"));
+    }
+    let response = Client::new()
+        .put(url)
+        .headers(headers)
+        .body(body)
+        .send()
+        .await
+        .context("send S3 upload")?;
+    if response.status() == StatusCode::PRECONDITION_FAILED
+        || response.status() == StatusCode::CONFLICT
+    {
+        return Err(anyhow!(
+            "remote configuration changed; download it before uploading"
+        ));
+    }
+    if !response.status().is_success() {
+        let status = response.status();
+        let detail = response.text().await.unwrap_or_default();
+        return Err(anyhow!("S3 upload failed: HTTP {status}: {detail}"));
+    }
+    Ok(response
+        .headers()
+        .get(header::ETAG)
+        .and_then(|value| value.to_str().ok())
+        .map(str::to_string))
+}
+
+async fn download_s3(config: &S3Config) -> Result<(Vec<u8>, Option<String>)> {
+    let url = s3_url(config)?;
+    let headers = signed_s3_headers("GET", &url, &[], config)?;
+    let response = Client::new()
+        .get(url)
+        .headers(headers)
+        .send()
+        .await
+        .context("send S3 download")?;
+    if response.status() == StatusCode::NOT_FOUND {
+        return Err(anyhow!("no remote configuration exists yet"));
+    }
+    if !response.status().is_success() {
+        let status = response.status();
+        let detail = response.text().await.unwrap_or_default();
+        return Err(anyhow!("S3 download failed: HTTP {status}: {detail}"));
+    }
+    let etag = response
+        .headers()
+        .get(header::ETAG)
+        .and_then(|value| value.to_str().ok())
+        .map(str::to_string);
+    let body = response.bytes().await.context("read S3 response")?.to_vec();
+    Ok((body, etag))
+}
+
+fn s3_url(config: &S3Config) -> Result<reqwest::Url> {
+    let endpoint = if config.endpoint.trim().is_empty() {
+        format!("https://s3.{}.amazonaws.com", config.region.trim())
+    } else {
+        config.endpoint.trim().trim_end_matches('/').to_string()
+    };
+    let key = if config.object_key.trim().is_empty() {
+        SYNC_FILE_NAME
+    } else {
+        config.object_key.trim().trim_start_matches('/')
+    };
+    let url = format!(
+        "{}/{}/{}",
+        endpoint,
+        aws_uri_encode(config.bucket.trim(), true),
+        aws_uri_encode(key, false)
+    );
+    reqwest::Url::parse(&url).context("parse S3 object URL")
+}
+
+fn signed_s3_headers(
+    method: &str,
+    url: &reqwest::Url,
+    body: &[u8],
+    config: &S3Config,
+) -> Result<header::HeaderMap> {
+    let now = chrono::Utc::now();
+    let amz_date = now.format("%Y%m%dT%H%M%SZ").to_string();
+    let date = now.format("%Y%m%d").to_string();
+    let host = url
+        .host_str()
+        .ok_or_else(|| anyhow!("S3 endpoint has no host"))?;
+    let host = match url.port() {
+        Some(port) => format!("{host}:{port}"),
+        None => host.to_string(),
+    };
+    let payload_hash = hex_sha256(body);
+    let mut canonical_headers =
+        format!("host:{host}\nx-amz-content-sha256:{payload_hash}\nx-amz-date:{amz_date}\n");
+    let mut signed_headers = "host;x-amz-content-sha256;x-amz-date".to_string();
+    if !config.session_token.is_empty() {
+        canonical_headers.push_str(&format!(
+            "x-amz-security-token:{}\n",
+            config.session_token.trim()
+        ));
+        signed_headers.push_str(";x-amz-security-token");
+    }
+    let canonical_request = format!(
+        "{method}\n{}\n\n{canonical_headers}\n{signed_headers}\n{payload_hash}",
+        url.path()
+    );
+    let scope = format!("{date}/{}/s3/aws4_request", config.region.trim());
+    let string_to_sign = format!(
+        "AWS4-HMAC-SHA256\n{amz_date}\n{scope}\n{}",
+        hex_sha256(canonical_request.as_bytes())
+    );
+    let date_key = hmac_sha256(
+        format!("AWS4{}", config.secret_key).as_bytes(),
+        date.as_bytes(),
+    )?;
+    let region_key = hmac_sha256(&date_key, config.region.trim().as_bytes())?;
+    let service_key = hmac_sha256(&region_key, b"s3")?;
+    let signing_key = hmac_sha256(&service_key, b"aws4_request")?;
+    let signature = hex::encode(hmac_sha256(&signing_key, string_to_sign.as_bytes())?);
+    let authorization = format!(
+        "AWS4-HMAC-SHA256 Credential={}/{scope}, SignedHeaders={signed_headers}, Signature={signature}",
+        config.access_key.trim()
+    );
+    let mut headers = header::HeaderMap::new();
+    headers.insert("x-amz-date", header_value(&amz_date, "S3 date")?);
+    headers.insert(
+        "x-amz-content-sha256",
+        header_value(&payload_hash, "S3 payload hash")?,
+    );
+    headers.insert(
+        header::AUTHORIZATION,
+        header_value(&authorization, "S3 authorization")?,
+    );
+    if !config.session_token.is_empty() {
+        headers.insert(
+            "x-amz-security-token",
+            header_value(config.session_token.trim(), "S3 session token")?,
+        );
+    }
+    Ok(headers)
+}
+
+fn header_value(value: &str, name: &str) -> Result<header::HeaderValue> {
+    header::HeaderValue::from_str(value).with_context(|| format!("invalid {name}"))
+}
+
+fn hmac_sha256(key: &[u8], value: &[u8]) -> Result<Vec<u8>> {
+    let mut mac =
+        <Hmac<Sha256> as Mac>::new_from_slice(key).map_err(|_| anyhow!("initialize S3 signer"))?;
+    mac.update(value);
+    Ok(mac.finalize().into_bytes().to_vec())
+}
+
+fn hex_sha256(value: &[u8]) -> String {
+    hex::encode(Sha256::digest(value))
+}
+
+fn aws_uri_encode(value: &str, encode_slash: bool) -> String {
+    let mut encoded = String::new();
+    for byte in value.bytes() {
+        if byte.is_ascii_alphanumeric()
+            || matches!(byte, b'-' | b'_' | b'.' | b'~')
+            || (!encode_slash && byte == b'/')
+        {
+            encoded.push(byte as char);
+        } else {
+            encoded.push_str(&format!("%{byte:02X}"));
+        }
+    }
+    encoded
+}
+
+fn sync_url(endpoint: &str) -> String {
+    let endpoint = endpoint.trim();
+    if endpoint.ends_with('/') {
+        format!("{endpoint}{SYNC_FILE_NAME}")
+    } else if endpoint.ends_with(".json") {
+        endpoint.to_string()
+    } else {
+        format!("{endpoint}/{SYNC_FILE_NAME}")
+    }
+}
+
+fn encrypt_payload(payload: &SyncPayload, password: &str) -> Result<Vec<u8>> {
+    let mut salt = [0u8; 16];
+    let mut nonce = [0u8; 24];
+    OsRng.fill_bytes(&mut salt);
+    OsRng.fill_bytes(&mut nonce);
+    let key = derive_key(password, &salt)?;
+    let plaintext = serde_json::to_vec(payload).context("serialize sync payload")?;
+    let ciphertext = XChaCha20Poly1305::new((&key).into())
+        .encrypt(XNonce::from_slice(&nonce), plaintext.as_ref())
+        .map_err(|_| anyhow!("encrypt sync payload"))?;
+    serde_json::to_vec_pretty(&EncryptedEnvelope {
+        format_version: FORMAT_VERSION,
+        kdf: "argon2id".to_string(),
+        cipher: "xchacha20poly1305".to_string(),
+        salt: STANDARD.encode(salt),
+        nonce: STANDARD.encode(nonce),
+        payload: STANDARD.encode(ciphertext),
+    })
+    .context("serialize encrypted sync envelope")
+}
+
+fn decrypt_payload(raw: &[u8], password: &str) -> Result<SyncPayload> {
+    let envelope: EncryptedEnvelope =
+        serde_json::from_slice(raw).context("parse encrypted sync envelope")?;
+    if envelope.format_version != FORMAT_VERSION
+        || envelope.kdf != "argon2id"
+        || envelope.cipher != "xchacha20poly1305"
+    {
+        return Err(anyhow!("unsupported remote sync format"));
+    }
+    let salt = STANDARD.decode(envelope.salt).context("decode sync salt")?;
+    let nonce = STANDARD
+        .decode(envelope.nonce)
+        .context("decode sync nonce")?;
+    if nonce.len() != 24 {
+        return Err(anyhow!("invalid sync nonce"));
+    }
+    let ciphertext = STANDARD
+        .decode(envelope.payload)
+        .context("decode encrypted sync payload")?;
+    let key = derive_key(password, &salt)?;
+    let plaintext = XChaCha20Poly1305::new((&key).into())
+        .decrypt(XNonce::from_slice(&nonce), ciphertext.as_ref())
+        .map_err(|_| anyhow!("cannot decrypt remote configuration; check the password"))?;
+    let payload: SyncPayload =
+        serde_json::from_slice(&plaintext).context("parse decrypted sync payload")?;
+    if payload.schema_version != FORMAT_VERSION {
+        return Err(anyhow!("unsupported synchronized configuration version"));
+    }
+    Ok(payload)
+}
+
+fn derive_key(password: &str, salt: &[u8]) -> Result<[u8; 32]> {
+    let mut key = [0u8; 32];
+    Argon2::default()
+        .hash_password_into(password.as_bytes(), salt, &mut key)
+        .map_err(|err| anyhow!("derive encryption key: {err}"))?;
+    Ok(key)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn encrypted_payload_round_trip() {
+        let payload = SyncPayload::new("test-device".into(), Vec::new());
+        let encrypted = encrypt_payload(&payload, "correct horse battery staple").unwrap();
+        assert!(!String::from_utf8_lossy(&encrypted).contains("test-device"));
+        let decrypted = decrypt_payload(&encrypted, "correct horse battery staple").unwrap();
+        assert_eq!(decrypted.revision, payload.revision);
+    }
+
+    #[test]
+    fn wrong_password_is_rejected() {
+        let payload = SyncPayload::new("test-device".into(), Vec::new());
+        let encrypted = encrypt_payload(&payload, "correct horse battery staple").unwrap();
+        assert!(decrypt_payload(&encrypted, "incorrect password").is_err());
+    }
+
+    #[test]
+    fn endpoint_can_be_a_collection_or_file() {
+        assert_eq!(
+            sync_url("https://example.test/dav/"),
+            "https://example.test/dav/ashell-sync.json"
+        );
+        assert_eq!(
+            sync_url("https://example.test/config.json"),
+            "https://example.test/config.json"
+        );
+    }
+
+    #[test]
+    fn s3_url_uses_path_style_and_encodes_object_key() {
+        let config = S3Config {
+            endpoint: "https://s3.example.test".into(),
+            region: "us-east-1".into(),
+            bucket: "my-bucket".into(),
+            object_key: "configs/my file.json".into(),
+            access_key: "access".into(),
+            secret_key: "secret".into(),
+            session_token: String::new(),
+        };
+        assert_eq!(
+            s3_url(&config).unwrap().as_str(),
+            "https://s3.example.test/my-bucket/configs/my%20file.json"
+        );
+    }
+
+    #[test]
+    fn aws_uri_encoding_preserves_only_object_key_slashes() {
+        assert_eq!(aws_uri_encode("a b/c", false), "a%20b/c");
+        assert_eq!(aws_uri_encode("a/b", true), "a%2Fb");
+    }
+}
@@ -1,11 +1,20 @@
 use std::{
    collections::BTreeMap,
+    ffi::OsStr,
    time::{Duration, Instant},
 };

 use anyhow::{Result, anyhow};
 use sysinfo::{Disks, Networks, System};

+/// Known virtual/ram filesystems to exclude from disk monitoring.
+fn is_real_filesystem(fs: &OsStr) -> bool {
+    !matches!(
+        fs.to_str(),
+        Some("tmpfs" | "devtmpfs" | "ramfs" | "overlay" | "aufs")
+    )
+}
+
 #[derive(Debug, Clone, Default)]
 pub struct DiskSample {
    pub mount: String,
@@ -22,7 +31,10 @@ pub struct SystemSnapshot {
    pub swap_detail: String,
    pub net_rx: String,
    pub net_tx: String,
+    pub net_rx_rate: u64,
+    pub net_tx_rate: u64,
    pub disks: Vec<DiskSample>,
+    pub total_swap: u64,
 }

 pub struct SystemSampler {
@@ -82,17 +94,25 @@ impl SystemSampler {
        self.last_tx_total = tx_total;
        self.last_instant = now;

-        let disks = self
+        let mut disks: Vec<DiskSample> = self
            .disks
            .iter()
-            .filter(|disk| disk.total_space() > 0)
-            .take(4)
+            .filter(|disk| disk.total_space() > 0 && is_real_filesystem(disk.file_system()))
            .map(|disk| DiskSample {
                mount: disk.mount_point().to_string_lossy().to_string(),
                available_bytes: disk.available_space(),
                total_bytes: disk.total_space(),
            })
            .collect();
+        disks.sort_by(|a, b| {
+            if a.mount == "/" {
+                return std::cmp::Ordering::Less;
+            }
+            if b.mount == "/" {
+                return std::cmp::Ordering::Greater;
+            }
+            a.mount.cmp(&b.mount)
+        });

        SystemSnapshot {
            cpu_percent,
@@ -102,7 +122,10 @@ impl SystemSampler {
            swap_detail: format!("{}/{}", format_bytes(swap_used), format_bytes(swap_total)),
            net_rx: format!("{}/s", format_bytes(rx_rate)),
            net_tx: format!("{}/s", format_bytes(tx_rate)),
+            net_rx_rate: rx_rate,
+            net_tx_rate: tx_rate,
            disks,
+            total_swap: swap_total,
        }
    }
 }
@@ -176,6 +199,20 @@ pub fn remote_snapshot_from_kv(raw: &str) -> Result<SystemSnapshot> {
    let rx_rate = parse_u64(&kv, "NET_RX");
    let tx_rate = parse_u64(&kv, "NET_TX");

+    // Safety filter: exclude entries with zero/negligible total size
+    // (catches any virtual fs lines that slipped past the script filter)
+    disks.retain(|d| d.total_bytes >= 1024 * 1024);
+
+    disks.sort_by(|a, b| {
+        if a.mount == "/" {
+            return std::cmp::Ordering::Less;
+        }
+        if b.mount == "/" {
+            return std::cmp::Ordering::Greater;
+        }
+        a.mount.cmp(&b.mount)
+    });
+
    Ok(SystemSnapshot {
        cpu_percent: cpu_percent.clamp(0.0, 1.0),
        mem_percent: ratio(mem_used, mem_total),
@@ -184,7 +221,10 @@ pub fn remote_snapshot_from_kv(raw: &str) -> Result<SystemSnapshot> {
        swap_detail: format!("{}/{}", format_bytes(swap_used), format_bytes(swap_total)),
        net_rx: format!("{}/s", format_bytes(rx_rate)),
        net_tx: format!("{}/s", format_bytes(tx_rate)),
+        net_rx_rate: rx_rate,
+        net_tx_rate: tx_rate,
        disks,
+        total_swap: swap_total,
    })
 }

@@ -0,0 +1,337 @@
+use gpui::{Bounds, Hsla, Path, Pixels, Window, fill, point, px, size};
+
+pub fn is_custom_block_supported(c: char) -> bool {
+    match c as u32 {
+        0x2580..=0x258F | 0x2590 | 0x2594..=0x259F => true, // Block Elements
+        0x2500 | 0x2502 | 0x250C | 0x2510 | 0x2514 | 0x2518 | 0x251C | 0x2524 | 0x252C | 0x2534
+        | 0x253C => true, // Light lines
+        0x2501 | 0x2503 | 0x250F | 0x2513 | 0x2517 | 0x251B | 0x2523 | 0x252B | 0x2533 | 0x253B
+        | 0x254B => true, // Heavy lines
+        0xE0B0..=0xE0B6 => true,                            // Powerline
+        _ => false,
+    }
+}
+
+pub fn paint_custom_block(
+    window: &mut Window,
+    c: char,
+    raw_x: f32,
+    raw_y: f32,
+    raw_w: f32,
+    raw_h: f32,
+    color: Hsla,
+) -> bool {
+    let scale = window.scale_factor();
+
+    let x = px((raw_x * scale).round() / scale);
+    let y = px((raw_y * scale).round() / scale);
+    let w = px(((raw_x + raw_w) * scale).round() / scale) - x;
+    let h = px(((raw_y + raw_h) * scale).round() / scale) - y;
+
+    let mut painted = false;
+
+    // Helper to paint a quad snapping its true physical boundaries to integer physical pixels
+    let mut paint_quad = |qx: Pixels, qy: Pixels, qw: Pixels, qh: Pixels| {
+        let l = px((qx.as_f32() * scale).round() / scale);
+        let t = px((qy.as_f32() * scale).round() / scale);
+        let r = px(((qx + qw).as_f32() * scale).round() / scale);
+        let b = px(((qy + qh).as_f32() * scale).round() / scale);
+        window.paint_quad(fill(Bounds::new(point(l, t), size(r - l, b - t)), color));
+        painted = true;
+    };
+
+    let px_1 = px(1.0);
+    let px_2 = px(2.0);
+
+    // Box drawing thickness
+    let light = (w * 0.1).max(px_1);
+    let heavy = (w * 0.2).max(px_2);
+    let cx = x + w / 2.0;
+    let cy = y + h / 2.0;
+
+    match c as u32 {
+        // --- Block Elements (U+2580..=U+259F) ---
+        0x2580 => paint_quad(x, y, w, h / 2.0),
+        0x2581 => paint_quad(x, y + h * 7.0 / 8.0, w, h / 8.0),
+        0x2582 => paint_quad(x, y + h * 3.0 / 4.0, w, h / 4.0),
+        0x2583 => paint_quad(x, y + h * 5.0 / 8.0, w, h * 3.0 / 8.0),
+        0x2584 => paint_quad(x, y + h / 2.0, w, h / 2.0),
+        0x2585 => paint_quad(x, y + h * 3.0 / 8.0, w, h * 5.0 / 8.0),
+        0x2586 => paint_quad(x, y + h / 4.0, w, h * 3.0 / 4.0),
+        0x2587 => paint_quad(x, y + h / 8.0, w, h * 7.0 / 8.0),
+        0x2588 => paint_quad(x, y, w, h),
+        0x2589 => paint_quad(x, y, w * 7.0 / 8.0, h),
+        0x258A => paint_quad(x, y, w * 3.0 / 4.0, h),
+        0x258B => paint_quad(x, y, w * 5.0 / 8.0, h),
+        0x258C => paint_quad(x, y, w / 2.0, h),
+        0x258D => paint_quad(x, y, w * 3.0 / 8.0, h),
+        0x258E => paint_quad(x, y, w / 4.0, h),
+        0x258F => paint_quad(x, y, w / 8.0, h),
+        0x2590 => paint_quad(x + w / 2.0, y, w / 2.0, h),
+        0x2594 => paint_quad(x, y, w, h / 8.0),
+        0x2595 => paint_quad(x + w * 7.0 / 8.0, y, w / 8.0, h),
+        0x2596 => paint_quad(x, y + h / 2.0, w / 2.0, h / 2.0),
+        0x2597 => paint_quad(x + w / 2.0, y + h / 2.0, w / 2.0, h / 2.0),
+        0x2598 => paint_quad(x, y, w / 2.0, h / 2.0),
+        0x2599 => {
+            paint_quad(x, y, w / 2.0, h);
+            paint_quad(x + w / 2.0, y + h / 2.0, w / 2.0, h / 2.0);
+        }
+        0x259A => {
+            paint_quad(x, y, w / 2.0, h / 2.0);
+            paint_quad(x + w / 2.0, y + h / 2.0, w / 2.0, h / 2.0);
+        }
+        0x259B => {
+            paint_quad(x, y, w, h / 2.0);
+            paint_quad(x, y + h / 2.0, w / 2.0, h / 2.0);
+        }
+        0x259C => {
+            paint_quad(x, y, w, h / 2.0);
+            paint_quad(x + w / 2.0, y + h / 2.0, w / 2.0, h / 2.0);
+        }
+        0x259D => paint_quad(x + w / 2.0, y, w / 2.0, h / 2.0),
+        0x259E => {
+            paint_quad(x + w / 2.0, y, w / 2.0, h / 2.0);
+            paint_quad(x, y + h / 2.0, w / 2.0, h / 2.0);
+        }
+        0x259F => {
+            paint_quad(x + w / 2.0, y, w / 2.0, h);
+            paint_quad(x, y + h / 2.0, w / 2.0, h / 2.0);
+        }
+
+        // --- Basic Box Drawing (U+2500..=U+257F) ---
+        // Light lines
+        0x2500 => paint_quad(x, cy - light / 2.0, w, light), // Horizontal
+        0x2502 => paint_quad(cx - light / 2.0, y, light, h), // Vertical
+        0x250C => {
+            // Down + Right
+            paint_quad(
+                cx - light / 2.0,
+                cy - light / 2.0,
+                light,
+                h / 2.0 + light / 2.0,
+            );
+            paint_quad(
+                cx - light / 2.0,
+                cy - light / 2.0,
+                w / 2.0 + light / 2.0,
+                light,
+            );
+        }
+        0x2510 => {
+            // Down + Left
+            paint_quad(
+                cx - light / 2.0,
+                cy - light / 2.0,
+                light,
+                h / 2.0 + light / 2.0,
+            );
+            paint_quad(x, cy - light / 2.0, w / 2.0 + light / 2.0, light);
+        }
+        0x2514 => {
+            // Up + Right
+            paint_quad(cx - light / 2.0, y, light, h / 2.0 + light / 2.0);
+            paint_quad(
+                cx - light / 2.0,
+                cy - light / 2.0,
+                w / 2.0 + light / 2.0,
+                light,
+            );
+        }
+        0x2518 => {
+            // Up + Left
+            paint_quad(cx - light / 2.0, y, light, h / 2.0 + light / 2.0);
+            paint_quad(x, cy - light / 2.0, w / 2.0 + light / 2.0, light);
+        }
+        0x251C => {
+            // Vertical + Right
+            paint_quad(cx - light / 2.0, y, light, h);
+            paint_quad(
+                cx - light / 2.0,
+                cy - light / 2.0,
+                w / 2.0 + light / 2.0,
+                light,
+            );
+        }
+        0x2524 => {
+            // Vertical + Left
+            paint_quad(cx - light / 2.0, y, light, h);
+            paint_quad(x, cy - light / 2.0, w / 2.0 + light / 2.0, light);
+        }
+        0x252C => {
+            // Horizontal + Down
+            paint_quad(x, cy - light / 2.0, w, light);
+            paint_quad(
+                cx - light / 2.0,
+                cy - light / 2.0,
+                light,
+                h / 2.0 + light / 2.0,
+            );
+        }
+        0x2534 => {
+            // Horizontal + Up
+            paint_quad(x, cy - light / 2.0, w, light);
+            paint_quad(cx - light / 2.0, y, light, h / 2.0 + light / 2.0);
+        }
+        0x253C => {
+            // Vertical + Horizontal (Cross)
+            paint_quad(x, cy - light / 2.0, w, light);
+            paint_quad(cx - light / 2.0, y, light, h);
+        }
+
+        // Heavy lines
+        0x2501 => paint_quad(x, cy - heavy / 2.0, w, heavy), // Heavy Horizontal
+        0x2503 => paint_quad(cx - heavy / 2.0, y, heavy, h), // Heavy Vertical
+        0x250F => {
+            // Heavy Down + Right
+            paint_quad(
+                cx - heavy / 2.0,
+                cy - heavy / 2.0,
+                heavy,
+                h / 2.0 + heavy / 2.0,
+            );
+            paint_quad(
+                cx - heavy / 2.0,
+                cy - heavy / 2.0,
+                w / 2.0 + heavy / 2.0,
+                heavy,
+            );
+        }
+        0x2513 => {
+            // Heavy Down + Left
+            paint_quad(
+                cx - heavy / 2.0,
+                cy - heavy / 2.0,
+                heavy,
+                h / 2.0 + heavy / 2.0,
+            );
+            paint_quad(x, cy - heavy / 2.0, w / 2.0 + heavy / 2.0, heavy);
+        }
+        0x2517 => {
+            // Heavy Up + Right
+            paint_quad(cx - heavy / 2.0, y, heavy, h / 2.0 + heavy / 2.0);
+            paint_quad(
+                cx - heavy / 2.0,
+                cy - heavy / 2.0,
+                w / 2.0 + heavy / 2.0,
+                heavy,
+            );
+        }
+        0x251B => {
+            // Heavy Up + Left
+            paint_quad(cx - heavy / 2.0, y, heavy, h / 2.0 + heavy / 2.0);
+            paint_quad(x, cy - heavy / 2.0, w / 2.0 + heavy / 2.0, heavy);
+        }
+        0x2523 => {
+            // Heavy Vertical + Right
+            paint_quad(cx - heavy / 2.0, y, heavy, h);
+            paint_quad(
+                cx - heavy / 2.0,
+                cy - heavy / 2.0,
+                w / 2.0 + heavy / 2.0,
+                heavy,
+            );
+        }
+        0x252B => {
+            // Heavy Vertical + Left
+            paint_quad(cx - heavy / 2.0, y, heavy, h);
+            paint_quad(x, cy - heavy / 2.0, w / 2.0 + heavy / 2.0, heavy);
+        }
+        0x2533 => {
+            // Heavy Horizontal + Down
+            paint_quad(x, cy - heavy / 2.0, w, heavy);
+            paint_quad(
+                cx - heavy / 2.0,
+                cy - heavy / 2.0,
+                heavy,
+                h / 2.0 + heavy / 2.0,
+            );
+        }
+        0x253B => {
+            // Heavy Horizontal + Up
+            paint_quad(x, cy - heavy / 2.0, w, heavy);
+            paint_quad(cx - heavy / 2.0, y, heavy, h / 2.0 + heavy / 2.0);
+        }
+        0x254B => {
+            // Heavy Vertical + Horizontal (Cross)
+            paint_quad(x, cy - heavy / 2.0, w, heavy);
+            paint_quad(cx - heavy / 2.0, y, heavy, h);
+        }
+
+        // --- Powerline ---
+        0xE0B0 => {
+            // Rightward Solid Arrow
+            let mut path = Path::new(point(x, y));
+            path.line_to(point(x + w, y + h / 2.0));
+            path.line_to(point(x, y + h));
+            path.line_to(point(x, y));
+            window.paint_path(path, color);
+            painted = true;
+        }
+        0xE0B2 => {
+            // Leftward Solid Arrow
+            let mut path = Path::new(point(x + w, y));
+            path.line_to(point(x, y + h / 2.0));
+            path.line_to(point(x + w, y + h));
+            path.line_to(point(x + w, y));
+            window.paint_path(path, color);
+            painted = true;
+        }
+        0xE0B1 => {
+            // Rightward Line Arrow
+            let t = px(1.0);
+            let mut p = Path::new(point(x, y));
+            p.line_to(point(x + w, y + h / 2.0));
+            p.line_to(point(x + w - t, y + h / 2.0));
+            p.line_to(point(x, y + t));
+            p.line_to(point(x, y));
+            window.paint_path(p, color);
+            let mut p2 = Path::new(point(x, y + h));
+            p2.line_to(point(x + w, y + h / 2.0));
+            p2.line_to(point(x + w - t, y + h / 2.0));
+            p2.line_to(point(x, y + h - t));
+            p2.line_to(point(x, y + h));
+            window.paint_path(p2, color);
+            painted = true;
+        }
+        0xE0B3 => {
+            // Leftward Line Arrow
+            let t = px(1.0);
+            let mut p = Path::new(point(x + w, y));
+            p.line_to(point(x, y + h / 2.0));
+            p.line_to(point(x + t, y + h / 2.0));
+            p.line_to(point(x + w, y + t));
+            p.line_to(point(x + w, y));
+            window.paint_path(p, color);
+            let mut p2 = Path::new(point(x + w, y + h));
+            p2.line_to(point(x, y + h / 2.0));
+            p2.line_to(point(x + t, y + h / 2.0));
+            p2.line_to(point(x + w, y + h - t));
+            p2.line_to(point(x + w, y + h));
+            window.paint_path(p2, color);
+            painted = true;
+        }
+
+        // Half arches (Powerline rounded)
+        0xE0B4 => {
+            // Rightward Solid Semicircle
+            let mut path = Path::new(point(x, y));
+            path.curve_to(point(x, y + h), point(x + w * 2.0, y + h / 2.0));
+            path.line_to(point(x, y));
+            window.paint_path(path, color);
+            painted = true;
+        }
+        0xE0B6 => {
+            // Leftward Solid Semicircle
+            let mut path = Path::new(point(x + w, y));
+            path.curve_to(point(x + w, y + h), point(x - w, y + h / 2.0));
+            path.line_to(point(x + w, y));
+            window.paint_path(path, color);
+            painted = true;
+        }
+
+        _ => {}
+    }
+
+    painted
+}
@@ -11,6 +11,7 @@ use gpui::{
 use gpui_component::ActiveTheme as _;

 use crate::Ashell;
+use crate::terminal::custom_blocks::{is_custom_block_supported, paint_custom_block};
 use crate::terminal::{RenderSnapshot, ViewportSelection};

 #[derive(Clone, Copy)]
@@ -138,9 +139,19 @@ pub struct PrepaintState {
    metrics: TerminalMetrics,
    rects: Vec<LayoutRect>,
    runs: Vec<BatchedTextRun>,
+    custom_blocks: Vec<LayoutCustomBlock>,
    cursor: Option<CursorLayout>,
 }

+#[derive(Clone)]
+struct LayoutCustomBlock {
+    c: char,
+    row: i32,
+    col: i32,
+    cells: usize,
+    color: Hsla,
+}
+
 struct TerminalInputHandler {
    view: Entity<Ashell>,
    element_bounds: Bounds<Pixels>,
@@ -219,9 +230,12 @@ impl InputHandler for TerminalInputHandler {
        _window: &mut Window,
        cx: &mut App,
    ) -> Option<Bounds<Pixels>> {
-        self.view
-            .read(cx)
-            .terminal_ime_bounds_for_range(range_utf16, self.element_bounds, self.cell_width, self.line_height)
+        self.view.read(cx).terminal_ime_bounds_for_range(
+            range_utf16,
+            self.element_bounds,
+            self.cell_width,
+            self.line_height,
+        )
    }

    fn character_index_for_point(
@@ -331,9 +345,13 @@ impl TerminalElement {
        }
    }

-    fn layout_grid(&self, cx: &App) -> (Vec<LayoutRect>, Vec<BatchedTextRun>) {
+    fn layout_grid(
+        &self,
+        cx: &App,
+    ) -> (Vec<LayoutRect>, Vec<BatchedTextRun>, Vec<LayoutCustomBlock>) {
        let mut rects = Vec::new();
        let mut runs = Vec::new();
+        let mut custom_blocks = Vec::new();
        let mut current_run: Option<BatchedTextRun> = None;

        for render_cell in &self.snapshot.cells {
@@ -352,7 +370,11 @@ impl TerminalElement {
                rects.push(LayoutRect {
                    row: render_cell.row,
                    col: render_cell.col,
-                    cells: 1,
+                    cells: if cell.flags.contains(Flags::WIDE_CHAR) {
+                        2
+                    } else {
+                        1
+                    },
                    color: if selected {
                        cx.theme().selection
                    } else if cell.flags.contains(Flags::INVERSE) {
@@ -371,6 +393,28 @@ impl TerminalElement {
            }

            let style = self.cell_run_style(cell, cx);
+
+            // Box Drawing & Block Elements interception
+            let is_custom_block = is_custom_block_supported(cell.c);
+
+            if is_custom_block {
+                if let Some(run) = current_run.take() {
+                    runs.push(run);
+                }
+                custom_blocks.push(LayoutCustomBlock {
+                    c: cell.c,
+                    row: render_cell.row,
+                    col: render_cell.col,
+                    cells: if cell.flags.contains(Flags::WIDE_CHAR) {
+                        2
+                    } else {
+                        1
+                    },
+                    color: style.color,
+                });
+                continue;
+            }
+
            if let Some(run) = current_run.as_mut() {
                if run.can_append(&style, render_cell.row, render_cell.col) {
                    run.append(cell.c, cell.zerowidth());
@@ -402,7 +446,7 @@ impl TerminalElement {
            runs.push(run);
        }

-        (merge_rects(rects), runs)
+        (merge_rects(rects), runs, custom_blocks)
    }

    fn cursor_layout(&self, cx: &App) -> Option<CursorLayout> {
@@ -458,7 +502,7 @@ impl Element for TerminalElement {
        cx: &mut App,
    ) -> Self::PrepaintState {
        let _ = self.base_text_style(cx);
-        let (rects, runs) = self.layout_grid(cx);
+        let (rects, runs, custom_blocks) = self.layout_grid(cx);
        PrepaintState {
            bounds,
            metrics: TerminalMetrics {
@@ -467,6 +511,7 @@ impl Element for TerminalElement {
            },
            rects,
            runs,
+            custom_blocks,
            cursor: self.cursor_layout(cx),
        }
    }
@@ -489,6 +534,22 @@ impl Element for TerminalElement {
            run.paint(prepaint.bounds.origin, prepaint.metrics, window, cx);
        }

+        for block in &prepaint.custom_blocks {
+            let x = prepaint.bounds.origin.x.as_f32()
+                + block.col as f32 * prepaint.metrics.cell_width.as_f32();
+            let y = prepaint.bounds.origin.y.as_f32()
+                + block.row as f32 * prepaint.metrics.line_height.as_f32();
+            paint_custom_block(
+                window,
+                block.c,
+                x,
+                y,
+                prepaint.metrics.cell_width.as_f32() * block.cells as f32,
+                prepaint.metrics.line_height.as_f32(),
+                block.color,
+            );
+        }
+
        window.handle_input(
            &self.focus_handle,
            TerminalInputHandler {
@@ -0,0 +1,487 @@
+use std::ops::Range;
+
+use alacritty_terminal::index::Side;
+use alacritty_terminal::selection::SelectionType;
+use gpui::{
+    ClipboardItem, Context, KeyDownEvent, MouseButton, MouseDownEvent, MouseMoveEvent,
+    MouseUpEvent, Pixels, Point, ScrollDelta, ScrollWheelEvent, Window, px,
+};
+
+use crate::{
+    Ashell, TerminalBacktabKey, TerminalTabKey,
+    terminal::{BackendCommand, encode_key},
+};
+
+impl Ashell {
+    pub(crate) fn on_terminal_key_down(
+        &mut self,
+        event: &KeyDownEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        // Pane navigation: Alt + h/j/k/l
+        if event.keystroke.modifiers.alt
+            && !event.keystroke.modifiers.shift
+            && !event.keystroke.modifiers.control
+            && !event.keystroke.modifiers.platform
+        {
+            match event.keystroke.key.to_ascii_lowercase().as_str() {
+                "h" => self.focus_adjacent_pane("left"),
+                "j" => self.focus_adjacent_pane("down"),
+                "k" => self.focus_adjacent_pane("up"),
+                "l" => self.focus_adjacent_pane("right"),
+                "q" => {
+                    if let Some(active_id) = self.active_tab.clone() {
+                        self.close_tab(active_id, cx);
+                    }
+                }
+                _ => return,
+            }
+            window.prevent_default();
+            cx.stop_propagation();
+            cx.notify();
+            return;
+        }
+
+        // Pane split: Shift+Alt + h/j/k/l
+        if event.keystroke.modifiers.shift
+            && event.keystroke.modifiers.alt
+            && !event.keystroke.modifiers.control
+            && !event.keystroke.modifiers.platform
+        {
+            let direction = match event.keystroke.key.to_ascii_lowercase().as_str() {
+                "h" => Some("left"),
+                "j" => Some("down"),
+                "k" => Some("up"),
+                "l" => Some("right"),
+                _ => None,
+            };
+            if let Some(dir) = direction {
+                self.split_current_pane(dir, cx);
+                window.prevent_default();
+                cx.stop_propagation();
+                cx.notify();
+                return;
+            }
+        }
+
+        if event.keystroke.modifiers.secondary() && event.keystroke.key == "," {
+            self.show_settings_dialog(window, cx);
+            window.prevent_default();
+            cx.stop_propagation();
+            return;
+        }
+        if event.keystroke.modifiers.shift
+            && event.keystroke.modifiers.secondary()
+            && event.keystroke.key == "o"
+        {
+            self.show_selector_dialog(window, cx);
+            window.prevent_default();
+            cx.stop_propagation();
+            return;
+        }
+        if event.keystroke.modifiers.secondary() && event.keystroke.key.eq_ignore_ascii_case("c") {
+            if let Some(text) = self.active_terminal_selection_text() {
+                cx.write_to_clipboard(ClipboardItem::new_string(text));
+                window.prevent_default();
+                cx.stop_propagation();
+                return;
+            }
+        }
+        if event.keystroke.modifiers.secondary() && event.keystroke.key.eq_ignore_ascii_case("v") {
+            if let Some(clipboard) = cx.read_from_clipboard() {
+                if let Some(text) = clipboard.text() {
+                    self.paste_into_terminal(&text, window, cx);
+                    return;
+                }
+            }
+        }
+
+        if event.prefer_character_input {
+            if let Some(text) = event.keystroke.key_char.as_deref() {
+                if !text.is_empty()
+                    && !event.keystroke.modifiers.control
+                    && !event.keystroke.modifiers.function
+                    && !event.keystroke.modifiers.platform
+                {
+                    self.send_terminal_input(text.as_bytes().to_vec(), window, cx);
+                }
+            }
+            return;
+        }
+
+        let Some(active_id) = self.active_tab.clone() else {
+            return;
+        };
+        let Some(tab) = self.tabs.iter_mut().find(|t| t.id == active_id) else {
+            return;
+        };
+
+        if tab.render_snapshot().display_offset > 0 {
+            tab.scroll_to_bottom();
+        }
+        tab.clear_selection();
+
+        if let Some(bytes) = encode_key(&event.keystroke, tab.app_cursor_mode(), false) {
+            tab.backend.send(BackendCommand::Input(bytes));
+            window.prevent_default();
+            cx.stop_propagation();
+            cx.notify();
+        }
+    }
+
+    pub(crate) fn on_terminal_tab_action(
+        &mut self,
+        _: &TerminalTabKey,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.send_terminal_input(vec![b'\t'], window, cx);
+    }
+
+    pub(crate) fn on_terminal_backtab_action(
+        &mut self,
+        _: &TerminalBacktabKey,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.send_terminal_input(b"\x1b[Z".to_vec(), window, cx);
+    }
+
+    fn send_terminal_input(&mut self, bytes: Vec<u8>, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(active_id) = self.active_tab.clone() else {
+            return;
+        };
+        let Some(tab) = self.tabs.iter_mut().find(|t| t.id == active_id) else {
+            return;
+        };
+
+        if tab.render_snapshot().display_offset > 0 {
+            tab.scroll_to_bottom();
+        }
+
+        tab.clear_selection();
+        tab.backend.send(BackendCommand::Input(bytes));
+        window.prevent_default();
+        cx.stop_propagation();
+        cx.notify();
+    }
+
+    fn active_terminal_selection_text(&self) -> Option<String> {
+        let active_id = self.active_tab.as_ref()?;
+        self.tabs
+            .iter()
+            .find(|tab| &tab.id == active_id)
+            .and_then(|tab| tab.selection_text())
+    }
+
+    fn paste_into_terminal(&mut self, text: &str, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(active_id) = self.active_tab.clone() else {
+            return;
+        };
+        let Some(tab) = self.tabs.iter_mut().find(|tab| tab.id == active_id) else {
+            return;
+        };
+
+        if tab.render_snapshot().display_offset > 0 {
+            tab.scroll_to_bottom();
+        }
+        tab.clear_selection();
+        tab.paste_text(text);
+        window.prevent_default();
+        cx.stop_propagation();
+        cx.notify();
+    }
+
+    pub(crate) fn terminal_accepts_text_input(&self) -> bool {
+        self.active_tab.is_some()
+    }
+
+    pub(crate) fn terminal_marked_text_range(&self) -> Option<Range<usize>> {
+        self.terminal_marked_text
+            .as_ref()
+            .map(|text| 0..text.encode_utf16().count())
+    }
+
+    pub(crate) fn set_terminal_marked_text(
+        &mut self,
+        text: String,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.terminal_marked_text = if text.is_empty() { None } else { Some(text) };
+        window.invalidate_character_coordinates();
+        cx.notify();
+    }
+
+    pub(crate) fn clear_terminal_marked_text(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        if self.terminal_marked_text.take().is_some() {
+            window.invalidate_character_coordinates();
+            cx.notify();
+        }
+    }
+
+    pub(crate) fn commit_terminal_ime_text(
+        &mut self,
+        text: &str,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let Some(active_id) = self.active_tab.clone() else {
+            return;
+        };
+        let Some(tab) = self.tabs.iter_mut().find(|tab| tab.id == active_id) else {
+            return;
+        };
+
+        if tab.render_snapshot().display_offset > 0 {
+            tab.scroll_to_bottom();
+        }
+        tab.clear_selection();
+        self.terminal_marked_text = None;
+        tab.backend
+            .send(BackendCommand::Input(text.as_bytes().to_vec()));
+        window.invalidate_character_coordinates();
+        cx.notify();
+    }
+
+    pub(crate) fn on_terminal_right_click(
+        &mut self,
+        _event: &MouseDownEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        if !self.config.right_click_copy_paste() {
+            return;
+        }
+
+        let mut handled = false;
+        if let Some(text) = self.active_terminal_selection_text() {
+            if !text.is_empty() {
+                cx.write_to_clipboard(gpui::ClipboardItem::new_string(text));
+
+                let active_id = self.active_tab.clone();
+                if let Some(active_id) = active_id {
+                    if let Some(tab) = self.tabs.iter_mut().find(|tab| tab.id == active_id) {
+                        tab.clear_selection();
+                    }
+                }
+                cx.notify();
+                handled = true;
+            }
+        }
+
+        if !handled {
+            if let Some(clipboard_item) = cx.read_from_clipboard() {
+                if let Some(text) = clipboard_item.text() {
+                    if !text.is_empty() {
+                        self.paste_into_terminal(&text, window, cx);
+                    }
+                }
+            }
+        }
+    }
+
+    pub(crate) fn begin_terminal_selection(
+        &mut self,
+        event: &MouseDownEvent,
+        cx: &mut Context<Self>,
+    ) {
+        let click_count = event.click_count.max(1);
+        let selection_type = match click_count {
+            1 => SelectionType::Simple,
+            2 => SelectionType::Semantic,
+            3 => SelectionType::Lines,
+            _ => SelectionType::Simple,
+        };
+        let Some((row, col, side)) = self.terminal_grid_point_and_side(event.position) else {
+            return;
+        };
+        let Some(active_id) = self.active_tab.clone() else {
+            return;
+        };
+        if let Some(tab) = self.tabs.iter_mut().find(|tab| tab.id == active_id) {
+            tab.begin_selection(row, col, side, selection_type);
+            self.terminal_selecting = true;
+            cx.notify();
+        }
+    }
+
+    pub(crate) fn on_terminal_mouse_move(
+        &mut self,
+        event: &MouseMoveEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        // Handle split drag
+        if self.dragging_splitter.is_some() {
+            if event.pressed_button == Some(MouseButton::Left) {
+                self.on_split_drag_move(event, window, cx);
+                cx.notify();
+            } else {
+                self.end_drag_split();
+                cx.notify();
+            }
+            return;
+        }
+        if !self.terminal_selecting || event.pressed_button != Some(MouseButton::Left) {
+            return;
+        }
+        let Some((row, col, side)) = self.terminal_grid_point_and_side(event.position) else {
+            return;
+        };
+        let Some(active_id) = self.active_tab.clone() else {
+            return;
+        };
+        if let Some(tab) = self.tabs.iter_mut().find(|tab| tab.id == active_id) {
+            tab.update_selection(row, col, side);
+            cx.notify();
+        }
+    }
+
+    pub(crate) fn on_terminal_mouse_up(
+        &mut self,
+        _event: &MouseUpEvent,
+        _window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        if self.dragging_splitter.is_some() {
+            self.end_drag_split();
+        }
+        self.terminal_selecting = false;
+        cx.notify();
+    }
+
+    fn terminal_grid_point_and_side(
+        &self,
+        position: Point<Pixels>,
+    ) -> Option<(usize, usize, Side)> {
+        let active_id = self.active_tab.as_ref()?;
+        let bounds = self.terminal_bounds.get(active_id)?;
+        if !bounds.contains(&position) {
+            // Try other pane bounds
+            for (_, b) in &self.terminal_bounds {
+                if b.contains(&position) {
+                    // Found a different pane - focus it
+                    // (this path is for click-to-focus; handled via focus_terminal)
+                    return None;
+                }
+            }
+            return None;
+        }
+        let local_x = (position.x - bounds.origin.x).max(px(0.));
+        let local_y = (position.y - bounds.origin.y).max(px(0.));
+        let cell_width = px(self.terminal_cell_width());
+        let line_height = px(self.terminal_line_height());
+        let snapshot = self.active_snapshot()?;
+        let max_col = snapshot.cols.saturating_sub(1);
+        let max_row = snapshot.rows.saturating_sub(1);
+        let col = ((local_x / cell_width).floor() as usize).min(max_col);
+        let row = ((local_y / line_height).floor() as usize).min(max_row);
+        let cell_offset_x = px(local_x.as_f32() % cell_width.as_f32());
+        let side = if cell_offset_x >= (cell_width / 2.) {
+            Side::Right
+        } else {
+            Side::Left
+        };
+        Some((row, col, side))
+    }
+
+    pub(crate) fn on_terminal_scroll(
+        &mut self,
+        event: &ScrollWheelEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let Some(active_id) = self.active_tab.clone() else {
+            return;
+        };
+
+        // Get coordinates before mutably borrowing tabs
+        let grid_point = self.terminal_grid_point_and_side(event.position);
+
+        let line_height = self.terminal_line_height();
+
+        if let Some(tab) = self.tabs.iter_mut().find(|tab| tab.id == active_id) {
+            let delta_lines = match event.delta {
+                ScrollDelta::Lines(point) => point.y.round() as i32,
+                ScrollDelta::Pixels(point) => {
+                    tab.scroll_pixel_y += point.y.as_f32();
+                    let lines = (tab.scroll_pixel_y / line_height).trunc() as i32;
+                    tab.scroll_pixel_y -= (lines as f32) * line_height;
+                    lines
+                }
+            };
+
+            if delta_lines == 0 {
+                return;
+            }
+
+            let mode = tab.term.mode();
+
+            let is_mouse_tracking = mode.intersects(
+                alacritty_terminal::term::TermMode::MOUSE_REPORT_CLICK
+                    | alacritty_terminal::term::TermMode::MOUSE_MOTION
+                    | alacritty_terminal::term::TermMode::MOUSE_DRAG,
+            );
+
+            let is_alternate_scroll = mode.contains(
+                alacritty_terminal::term::TermMode::ALT_SCREEN
+                    | alacritty_terminal::term::TermMode::ALTERNATE_SCROLL,
+            );
+
+            if is_mouse_tracking {
+                if let Some((row, col, _)) = grid_point {
+                    let sgr = mode.contains(alacritty_terminal::term::TermMode::SGR_MOUSE);
+                    let button = if delta_lines > 0 { 64 } else { 65 };
+                    let times = delta_lines.abs();
+                    let mut bytes = Vec::new();
+                    for _ in 0..times {
+                        if sgr {
+                            bytes.extend_from_slice(
+                                format!("\x1b[<{};{};{}M", button, col + 1, row + 1).as_bytes(),
+                            );
+                        } else {
+                            if col < 223 && row < 223 {
+                                bytes.extend_from_slice(b"\x1b[M");
+                                bytes.push(button as u8 + 32);
+                                bytes.push(col as u8 + 33);
+                                bytes.push(row as u8 + 33);
+                            }
+                        }
+                    }
+                    if !bytes.is_empty() {
+                        tab.backend
+                            .send(crate::terminal::BackendCommand::Input(bytes));
+                    }
+                }
+                window.prevent_default();
+                cx.stop_propagation();
+                return;
+            } else if is_alternate_scroll {
+                let times = delta_lines.abs();
+                let code = if delta_lines > 0 { b'A' } else { b'B' };
+                let mut bytes = Vec::with_capacity((times * 3) as usize);
+                for _ in 0..times {
+                    bytes.extend_from_slice(&[b'\x1b', b'O', code]);
+                }
+                if !bytes.is_empty() {
+                    tab.backend
+                        .send(crate::terminal::BackendCommand::Input(bytes));
+                }
+                window.prevent_default();
+                cx.stop_propagation();
+                return;
+            }
+
+            tab.scroll_history(delta_lines);
+            window.prevent_default();
+            cx.stop_propagation();
+            cx.notify();
+        }
+    }
+}
@@ -1,3 +1,7 @@
+pub mod custom_blocks;
+pub mod element;
+pub mod input;
+
 use std::sync::mpsc::Sender;

 use alacritty_terminal::{
@@ -10,7 +14,7 @@ use alacritty_terminal::{
 };
 use gpui::Keystroke;

-use crate::config::Session;
+use crate::session::config::Session;
 use crate::sftp::{PreviewData, RemoteEntry};
 use crate::system::SystemSnapshot;

@@ -20,15 +24,35 @@ pub enum TabKind {
    Ssh,
 }

+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PromptType {
+    KeyboardInteractive,
+    Passphrase,
+}
+
+#[derive(Debug, Clone)]
+pub struct PromptInfo {
+    pub prompt: String,
+    pub echo: bool,
+}
+
 #[derive(Debug)]
 pub enum BackendCommand {
    Input(Vec<u8>),
    Resize { cols: u16, rows: u16 },
+    SampleMetrics,
    Close,
+    PromptResponse(Vec<String>),
 }

 #[derive(Debug, Clone)]
 pub enum BackendEvent {
+    PromptRequest {
+        tab_id: String,
+        prompt_type: PromptType,
+        instruction: String,
+        prompts: Vec<PromptInfo>,
+    },
    Output {
        tab_id: String,
        bytes: Vec<u8>,
@@ -85,6 +109,7 @@ pub enum BackendEvent {
        tab_id: String,
        title: String,
    },
+    SyncFinished(crate::sync::SyncResult),
 }

 #[derive(Clone)]
@@ -113,12 +138,12 @@ pub struct TerminalTab {
    pub status: String,
    pub connected: bool,
    pub session: Option<Session>,
-    pub sftp: Option<SftpUiState>,
    processor: Processor,
    term: Term<TerminalListener>,
    cols: u16,
    rows: u16,
    pub backend: BackendTx,
+    pub scroll_pixel_y: f32,
 }

 #[derive(Clone, Copy)]
@@ -202,15 +227,6 @@ impl TerminalTab {
        );
        tab.session = Some(session.clone());
        tab.connected = false;
-        tab.sftp = Some(SftpUiState {
-            current_path: "/".into(),
-            status: t!("sftp_connecting").to_string(),
-            entries: Vec::new(),
-            selected_path: None,
-            preview: None,
-            selected_entries: std::collections::HashSet::new(),
-            home_dir: "/".into(),
-        });
        tab
    }

@@ -229,12 +245,12 @@ impl TerminalTab {
            status,
            connected: matches!(kind, TabKind::Local),
            session: None,
-            sftp: None,
            processor: Processor::new(),
            term: new_term(100, 30, backend.clone(), id, events),
            cols: 100,
            rows: 30,
            backend,
+            scroll_pixel_y: 0.0,
        }
    }

@@ -243,10 +259,19 @@ impl TerminalTab {
    }

    pub fn resize(&mut self, cols: u16, rows: u16) {
-        self.cols = cols.max(1);
-        self.rows = rows.max(1);
-        self.term.resize(TerminalSize::new(self.cols, self.rows));
-        self.backend.send(BackendCommand::Resize { cols, rows });
+        let new_cols = cols.max(1);
+        let new_rows = rows.max(1);
+        if self.cols != new_cols || self.rows != new_rows {
+            self.cols = new_cols;
+            self.rows = new_rows;
+            tracing::info!(
+                "[ui] terminal resized to {}x{} (cols x rows)",
+                self.cols,
+                self.rows
+            );
+            self.term.resize(TerminalSize::new(self.cols, self.rows));
+            self.backend.send(BackendCommand::Resize { cols, rows });
+        }
    }

    pub fn cursor_state(&self) -> Option<CursorState> {
@@ -443,7 +468,6 @@ impl EventListener for TerminalListener {
    }
 }

-use rust_i18n::t;
 fn new_term(
    cols: u16,
    rows: u16,
@@ -674,15 +698,52 @@ pub enum TransferType {
    Download,
 }

-#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
 pub enum TransferState {
    Running,
    Paused,
    Completed,
    Failed(String),
+    Interrupted(String), // 中断传输：包含原因（例如 "User cancelled", "Network timeout"）
+    Zombie(String),      // 程序重启后残留的 Running/Paused 任务
+                         // 兼容 v0.3.11 -> v0.4.x：旧配置里曾保存过 `Cancelled`，
+                         // 新版本改成了带原因的状态，因此要手动接住旧枚举值。
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, serde::Deserialize)]
+enum TransferStateCompat {
+    Running,
+    Paused,
+    Completed,
+    Failed(String),
+    Interrupted(String),
+    Zombie(String),
    Cancelled,
 }

+impl From<TransferStateCompat> for TransferState {
+    fn from(value: TransferStateCompat) -> Self {
+        match value {
+            TransferStateCompat::Running => Self::Running,
+            TransferStateCompat::Paused => Self::Paused,
+            TransferStateCompat::Completed => Self::Completed,
+            TransferStateCompat::Failed(reason) => Self::Failed(reason),
+            TransferStateCompat::Interrupted(reason) => Self::Interrupted(reason),
+            TransferStateCompat::Zombie(reason) => Self::Zombie(reason),
+            TransferStateCompat::Cancelled => Self::Interrupted("Cancelled".to_string()),
+        }
+    }
+}
+
+impl<'de> serde::Deserialize<'de> for TransferState {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        TransferStateCompat::deserialize(deserializer).map(Into::into)
+    }
+}
+
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
 pub struct TransferInfo {
    pub id: String,
Author	SHA1	Message	Date
TomZz	5ae44c9e44	bump version to 0.4.7	2026-06-23 00:23:11 +08:00
TomZz	73938aef8a	feat: support keyboard-interactive auth and interactive passphrase prompts (resolves #33 )	2026-06-23 00:16:48 +08:00
TomZz	59df2b5a9a	feat: add context menu to collapsed sidebar session cards	2026-06-22 12:48:20 +08:00
TomZz	b225b0e56f	fix: persist sidebar and sftp panel state on window close and remove startup flashing	2026-06-22 12:36:20 +08:00
TomZz	2cdd6d3ded	Merge branch 'pr-47'	2026-06-22 10:53:17 +08:00
TomZz	42c408f63f	style: change sync backend selection to segmented buttons	2026-06-22 10:53:14 +08:00
TomZz	f4005bf2bb	Merge pull request #46 from WutangNailao/main fix: pin Zed GPUI dependencies to stable-compatible revision	2026-06-22 10:35:07 +08:00
nailao	d5fab2e9ca	feat: add encrypted config sync via WebDAV and S3 - encrypt SSH configuration with Argon2id and XChaCha20-Poly1305 - support WebDAV and S3-compatible storage backends - add ETag-based conflict protection - add sync settings and localized UI - keep remote credentials in memory only	2026-06-20 09:47:26 +08:00
nailao	1b7f625aea	fix: pin Zed GPUI dependencies to stable-compatible revision cause the newer version of GPUI use unstable feature `std::hint::cold_path`, it made we can not build success, so pin it to a specific commit.	2026-06-20 09:07:45 +08:00
TomZz	b6b4d3c35e	feat: set integrated as default title bar style	2026-06-18 14:30:53 +08:00
TomZz	ae763eae1c	fix: title bar buttons unresponsive on windows in integrated mode	2026-06-18 14:28:58 +08:00
TomZz	a89d15d255	feat: add title bar style option (native vs integrated) Introduced a new configuration setting allowing users to choose between: 1. Native: Standard OS title bar with the tab bar rendered below it. 2. Integrated: Custom title bar with Mac-style controls and embedded tabs. Updated: - ConfigFile/Store to include title_bar_style (defaulting to Native). - localization files for English and Chinese with 'Restart required' hints. - Settings dialog with a new dropdown in the Appearance group. - Startup and UI logic to handle conditional title bar and tab bar rendering. - UI now uses the title bar style detected at startup to ensure consistency until the application is restarted. - Restored Windows app icon loading in startup.rs. - Fixed Native mode layout to match previous standard behavior.	2026-06-18 13:31:51 +08:00
TomZz	b5a068541d	feat: implement fully custom title bar with mac-style controls Replaced gpui-component's TitleBar with a self-drawn one that provides: 1. Mac-style traffic light window controls on the left. 2. App session and split pane buttons on the right. 3. Tab bar in the middle with robust flex-shrink and overflow-hidden logic to prevent it from squeezing the side buttons when many tabs are open.	2026-06-18 13:10:27 +08:00
TomZz	7be0c420e1	chore: release v0.4.6	2026-06-18 08:20:33 +08:00
TomZz	62028c7921	feat: replace native title bar with custom TitleBar and integrate tab bar This commit removes the native OS title bar and introduces a cross-platform custom title bar using gpui-component's TitleBar. To optimize vertical screen space, the tab bar has been relocated into the newly created custom title bar. Fixes #37	2026-06-18 08:18:00 +08:00
TomZz	56a6ef98b7	feat: add tooltips for sidebar and tab bar buttons	2026-06-18 07:58:50 +08:00
TomZz	caa8a58561	fix: correctly reset active_dialog in session selector and ssh dialog	2026-06-18 00:41:53 +08:00
TomZz	6150bd410b	fix: correctly reset active_dialog when manually closing transfers dialog	2026-06-17 07:05:09 +08:00
TomZz	f55c3a8470	chore: bump version to v0.4.5 and update documentation	2026-06-17 06:23:07 +08:00
TomZz	7ae44ab9a7	ci: automate homebrew cask release for macos	2026-06-17 05:59:05 +08:00
TomZz	9c43b2dde7	chore: release v0.4.4	2026-06-17 05:00:51 +08:00
TomZz	e6134bc0d1	fix: sftp panel status bar layout bug, update localized strings and add Open Transfer History shortcut	2026-06-17 04:58:27 +08:00
TomZz	96cd85a8d3	feat: persist sidebar and sftp panel visibility states	2026-06-17 03:00:44 +08:00
TomZz	f45c2ed60f	chore: release	2026-06-17 02:46:36 +08:00
TomZz	8a8f280401	feat: group keybindings and set keybindings page as default in settings	2026-06-17 02:43:10 +08:00
TomZz	dc006f7144	fix: explicitly set mac quit mode to LastWindowClosed	2026-06-17 02:16:05 +08:00
TomZz	daaebe4c2b	feat: add sidebar collapsible feature	2026-06-17 00:43:39 +08:00
TomZz	2a37f45ba2	Merge pull request #35 from ancion/main fix splitter resize bug and sftp status bar show file transfer progress	2026-06-16 22:54:07 +08:00
ancion	ee8c18844c	fix: sftp status not show sometimes and file transfer progress bar	2026-06-16 18:49:48 +08:00
ancion	c5b09628b3	fix: panel splitter can drag to resize	2026-06-16 18:49:48 +08:00
TomZz	b45364331d	fix: restore full terminal width in split panes Use the outer terminal panel bounds for PTY resizing while keeping per-pane bounds for focus and input handling. This prevents split panes from being resized a second time to half width.	2026-06-16 04:38:01 +08:00
TomZz	2d92f0ceee	chore(release): v0.4.2 Bump the project version to v0.4.2 and include the updated README release notes in both Chinese and English.	2026-06-16 04:27:50 +08:00
TomZz	162a245a8f	feat: improve theme defaults, config compatibility, and SSH key passphrase support - default follow_system_theme to true and remove empty theme-name fallback override\n- add backward compatibility for v0.3.11 transfer state values during config load\n- preserve old config files by backing up parse failures instead of silently overwriting them\n- add optional SSH key passphrase input to the new SSH form and persist it in sessions\n- use stored passphrases when loading private keys for SSH and SFTP connections\n- make terminal size sync prefer measured bounds to reduce unused space at the bottom	2026-06-16 04:16:13 +08:00
TomZz	68bf152792	chore(release): v0.4.1	2026-06-16 01:54:35 +08:00
TomZz	13b9433c90	fix: fix settings layout collapse caused by keybind wrapper	2026-06-16 01:53:55 +08:00
TomZz	445e474fe8	chore: bump version to v0.4.0	2026-06-16 01:06:43 +08:00
TomZz	4c7c06f391	fix: fix interrupted message position, handle zombie transfers on restart, fix upload status text	2026-06-16 01:06:43 +08:00
TomZz	e4fbd65a31	fix: show tab title in transfer history	2026-06-15 20:50:12 +08:00
TomZz	bd376935f4	feat: add keybinding management 解决了 #18。验证： - cargo fmt - cargo check - git diff --check	2026-06-15 20:32:05 +08:00
TomZz	16761c1bf5	ci: add CI workflow to pre-populate rust cache on main branch	2026-06-15 01:29:03 +08:00
TomZz	c3201e7c30	chore: bump version to v0.3.11	2026-06-15 01:14:48 +08:00
TomZz	2d5062ed75	feat: implement pixel-perfect custom rendering for block elements, powerline and box drawing - Render block elements (U+2580-U+259F), box drawing lines, and powerline characters using precise GPUI vector paths instead of fonts. - Snap logical coordinates to exact physical pixels using window.scale_factor() to perfectly eliminate SDF anti-aliasing gaps and bleeding. - Fixes visual seams in terminal UI layouts.	2026-06-15 01:14:42 +08:00
TomZz	d7d6faeeb1	feat: optimize transfer history dialog UI and logic - Add an independent scrollbar track to prevent it from overlapping with the content list - Add a "Clear History" button with text label, placed seamlessly next to the close button in the custom header - Implement a 100-record limit for transfer history and display this limit in the header - Persist the cleared transfer history into the session config immediately after clearing - Disable default dialog close button and reconstruct header to avoid state update collision and panic Resolves #25	2026-06-14 23:58:46 +08:00
TomZz	19a4274473	feat: enhance UI for active tabs and settings dialog - Active Tab: Now uses `FontWeight::BOLD`, `text_base()` font size, and the primary theme color. This makes it far more distinct from inactive tabs, especially in themes where background differences are subtle. - Settings Dialog: Overrode the default sidebar style to use the main dialog background (`cx.theme().background`), seamlessly blending the sidebar with the content pane. - Refactor: Renamed unused `_cx` parameter to `cx` in the settings dialog render closure since it is now being utilized to access the theme.	2026-06-14 23:34:01 +08:00
TomZz	4bb3bee6c8	fix: ensure selection background fully covers wide characters (#24 ) Rationale: Previously, the terminal renderer generated background highlight rectangles (`LayoutRect`) with a hardcoded width of 1 cell (`cells: 1`) for every character. For full-width CJK characters (which carry the `Flags::WIDE_CHAR` flag and visually span 2 columns), this caused the selection and custom background colors to render across only half of the character's visual width. This fix correctly interprets the terminal cell flags during layout generation: if a cell possesses `Flags::WIDE_CHAR`, it generates a background rectangle spanning 2 cells (`cells: 2`). As a result, the highlight now matches the exact bounds that the text occupies in the terminal grid, cleanly fixing the partial highlighting of Chinese text.	2026-06-14 23:19:33 +08:00
TomZz	8ab4b43825	style: update settings button icon and size	2026-06-14 19:41:55 +08:00
TomZz	bbf843dde6	feat: settings dialog using Settings component #19	2026-06-14 19:34:06 +08:00
TomZz	bc6af2e213	fix: close local terminal tab reliably when process exits on Windows	2026-06-14 16:31:30 +08:00
TomZz	d224506fd5	fix: align sftp list item checkbox with header checkbox	2026-06-14 16:09:31 +08:00
TomZz	d175135529	Merge branch 'fix-tmux'	2026-06-14 16:00:29 +08:00
TomZz	c769b982b4	fix: resolve tmux mouse scroll mode recognition and alternate scroll fallback	2026-06-14 15:56:22 +08:00
TomZz	ee68835972	fix: default monitoring area position when sessions.json is absent	2026-06-14 15:45:08 +08:00
TomZz	8a535fad5a	fix: fallback to ssh-rsa signature for legacy OpenWrt dropbear Resolves issue #20 where RSA 4096-bit keys failed to authenticate on OpenWrt Dropbear servers. The previous logic exclusively tried rsa-sha2-512 and rsa-sha2-256, which caused authentication aborts on servers only supporting legacy ssh-rsa (SHA-1) signatures. - Modified `private_key_with_alg` to `private_keys_with_algs` to return a list of supported algorithms including SHA-1 fallback for RSA keys. - Implemented an iterative algorithm fallback loop in both SSH and SFTP connection authentication phases.	2026-06-14 14:22:24 +08:00
TomZz	90c07e16e1	Fix: change log timestamps and rolling filename suffix from UTC to local time	2026-06-14 14:06:57 +08:00
TomZz	33a3d624b7	Refactor: integrate comprehensive tracing logs and SSH multiplexing This commit introduces a robust logging system and optimizes remote metric collection over SSH: - Logging Infrastructure: - Replaced ad-hoc `eprintln!` and `println!` with the `tracing` crate. - Implemented a rolling file appender in `~/.config/ashell/log/` keeping the last 6 minutes of logs. - Restricted stdout logging to debug builds only, keeping release builds clean. - SSH Multiplexing & Performance: - Shared `russh::client::Handle` across tasks using `Arc<Mutex<>>`. - Replaced the 5-second polling of new SSH connections with `SampleMetrics` over the existing channel. - Eliminated authentication log spam and vastly improved polling latency. - Optimized terminal `resize` events to only trigger when dimensions actually change, further reducing UI layout spam and backend load. - Application & Network Auditing: - Log window lifecycles (open, close). - Log UI actions such as session connects and tab closures. - Detailed connection logs distinguishing between graceful EOFs, network drops, and abrupt closures. - Granular SFTP tracking including directory navigation, creation, batch uploads/downloads, and online file editing.	2026-06-14 13:57:50 +08:00
TomZz	78f8626217	feat: add native file picker and clear button for SSH key path	2026-06-14 11:26:23 +08:00
TomZz	743a5f9fe7	feat: add clone session context menu item and localize edit/delete items	2026-06-14 11:10:28 +08:00
TomZz	99a954b0b5	fix: add wayland and x11 features to gpui_platform for Linux support	2026-06-14 00:30:24 +08:00
TomZz	0bd04a98f0	fix: restrict config directory and file permissions to prevent credential leakage	2026-06-14 00:26:54 +08:00
TomZz	df44d17ade	fix: only show IME marked text in the focused terminal tab	2026-06-14 00:21:43 +08:00
TomZz	0e4c4cdc69	fix: correctly handle PTY exit as graceful and add SSH keepalives for fast disconnect detection	2026-06-14 00:16:56 +08:00
TomZz	227966319c	fix: retry connection in existing tab and perfectly detect graceful ssh exit	2026-06-13 23:38:55 +08:00
TomZz	205ceba20c	fix: correctly track ssh network drop and emit proper closed reason	2026-06-13 23:31:50 +08:00
TomZz	0ccbf9573b	feat: enhance split pane focus UI and fix graceful exit tab cleanup - Implement 4-sided inner absolute border for active pane focus - Fix 'exit' gracefully closing tabs not removing empty tab groups - Sync system monitoring automatically on active group switches	2026-06-13 23:25:54 +08:00
TomZz	8193223dc2	Fix: synchronize system monitoring with active tab group	2026-06-13 22:59:32 +08:00
TomZz	805cec5000	UI: make connection progress scrollable with auto-scroll to bottom	2026-06-13 22:51:09 +08:00
TomZz	3151757c4f	Refactor SFTP to be scoped to TabGroup instead of TerminalTab and fix tab close behavior	2026-06-13 22:38:03 +08:00
TomZz	57c55e358c	feat: improve sidebar disk monitoring panel with scroll support	2026-06-13 22:08:29 +08:00
ancion	81b160285d	refactor: restructure project	2026-06-13 19:21:33 +08:00
ancion	77206bd126	feature: add split window feature	2026-06-13 18:08:40 +08:00
TomZz	bb22718d3d	style: tweak sidebar layout and monitor metrics - Adjust monitor panel height logic when hidden to prevent layout dead space - Change network upload/download text alignment to match v0.3.5 exact layout - Move '+ SSH' button below the sidebar monitor panel	2026-06-13 03:39:34 +08:00
TomZz	4ba3000538	feat: add customizable system monitoring position - Add settings to position the system monitoring panel at the Bottom, Sidebar, or Hidden. - Support dynamically reallocating UI space when the monitor panel is moved. - Implement a simplified, compact card-style system monitoring view for the sidebar (similar to v0.3.5 design). - Add full localization for monitoring setting and sidebar metrics.	2026-06-13 03:34:29 +08:00
TomZz	e7e2c67393	fix: restore body_panels layout sizes on app startup - Ensure the size of the monitoring panel (the second child of body_panels) is explicitly loaded from configuration rather than falling back to the hardcoded default of 328px.	2026-06-13 03:01:40 +08:00
TomZz	47b03510b2	feat: optimize monitoring card layout for memory and disks - Hide swap memory progress bar entirely if total swap is 0. - Add temporary overlay scrollbar for the disk list using ScrollbarShow::Scrolling, allowing users to scroll through long disk lists without displaying a persistent scrollbar UI. - Fix unused variable and dead code cargo warnings.	2026-06-13 02:56:11 +08:00
TomZz	54c50c871a	feat: fix SFTP monitoring panel minimize behavior and layout - Isolated the monitoring panel from ResizableState when minimized to prevent the GPUI flex layout and proportional resize engine from forcing it out of the window bounds. - Wrapped the terminal's resizable container with flex_1 to constrain it to available space, preventing the fixed-height 114px panel from overflowing the bottom of the screen. - Saved the user's dragged panel size (prev_monitoring_size) immediately before minimizing. Double-Frame Delay Update Reason: When expanding the panel from 1 child back to 2 children, ResizableState needs one full render frame to recognize the child count change, append the new panel, and initialize its zero-size defaults. If we update the sizes synchronously on the first frame, ResizableState would overwrite our manual sizes during its layout initialization. Waiting for a double-frame delay guarantees that ResizableState has fully populated the second panel in its internal state, allowing us to accurately restore the user's previously dragged height without being overridden by the layout engine.	2026-06-13 02:42:04 +08:00
TomZz	6f887712e6	style: Simplify terminal title bar and remove redundant path display	2026-06-12 21:26:18 +08:00
TomZz	99071997d5	Merge PR 9, refactor codebase and manually resolve conflicts while retaining all recent main branch features	2026-06-12 20:38:11 +08:00
TomZz	e35a2458bb	Merge branch 'pr-9' into resolve-pr-9	2026-06-12 20:34:34 +08:00
ancion	1847736d66	merge fix	2026-06-12 19:59:50 +08:00
ancion	e163d05683	refactor: avoid main to big, split to different module and fix layout	2026-06-12 19:54:24 +08:00
ancion	c3b1707014	refactor: change ui layout, make space for ai feture	2026-06-12 19:52:42 +08:00
TomZz	8a82288c5e	feat: persist window bounds and layout sizes across restarts	2026-06-12 19:50:32 +08:00