refactor(ssh): move the ssh-connection and ssh-target cluster into ssh/connection/ and ssh/targets/ (#30479)

* refactor(ssh): move the ssh-connection and ssh-target cluster into ssh/connection/ and ssh/targets/ Pure git mv plus import and path-literal rewrites. ssh-connection-utils stays put; the next PR splits it. Co-Authored-By: Claude <noreply@anthropic.com> * test(e2e): keep the release-checkout import at the v1.4.218 path Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
2026-10-30 16:47:34 +00:00 · 2026-10-18 19:23:21 -07:00
parent bf866505e8
commit 139bac88b6
236 changed files with 650 additions and 601 deletions
@@ -27,7 +27,8 @@ on:
      - 'config/scripts/verify-packaged-orcad-template.cjs'
      - 'config/patches/node-pty*'
      # The deploy runs over this SSH transport.
-      - 'src/main/ssh/ssh-connection*'
+      - 'src/main/ssh/connection/**'
+      - 'src/main/ssh/ssh-connection-utils.ts'
      - '!src/**/*.test.ts'
      - 'src/main/ssh/hostile-host-test-support/ssh-hostile-hosts.docker.test.ts'
      - '.github/workflows/ssh-hostile-hosts.yml'
@@ -43,7 +43,8 @@ on:
      - 'src/shared/windows-breakaway-launch*.ts'
      - 'src/main/ipc/ssh/ssh-host-server-*.ts'
      # The deploy runs over this SSH transport.
-      - 'src/main/ssh/ssh-connection*'
+      - 'src/main/ssh/connection/**'
+      - 'src/main/ssh/ssh-connection-utils.ts'
      - '!src/**/*.test.ts'
      - 'src/main/managed-server/host-state/orcad-windows-host-lane.test.ts'
      - 'tests/e2e/ssh-orcad-auto-convert.spec.ts'
@@ -20,7 +20,7 @@ src/main/ssh/orcad-migration-terminal-gate.ts
 src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts
 src/main/ssh/ssh-host-server-on-connect.test.ts
 src/main/ssh/ssh-host-server-on-connect.ts
-src/main/ssh/ssh-target-orcad-preflight.ts
+src/main/ssh/targets/ssh-target-orcad-preflight.ts
 src/preload/api-types.ts
 src/preload/api/legacy-relay-bridge-api.ts
 src/renderer/src/components/terminal-pane/legacy-relay-bridge-panes.ts
@@ -71,5 +71,5 @@
 4 src/main/runtime/workspace-session-worktree-id.ts
 1 src/main/runtime/workspaces/session-hosts/get-runtime-id.ts
 2 src/main/runtime/workspaces/workspace-file-session-targets.ts
-1 src/main/ssh/ssh-target-id-migration.ts
+1 src/main/ssh/targets/ssh-target-id-migration.ts
 2 src/main/terminal-scrollback-snapshots.ts
@@ -4,5 +4,5 @@
 # Regenerate/prune: pnpm check:max-lines-ratchet --prune   (removes stale entries only)
 inline src/main/ipc/worktree-remote.ts
 inline src/main/ssh/ssh-channel-multiplexer.ts
-inline src/main/ssh/ssh-connection.ts
+inline src/main/ssh/connection/ssh-connection.ts
 inline src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
@@ -100,7 +100,7 @@ src/main/rate-limits/gemini-cli-oauth-extractor.ts
 src/main/runtime/windows-default-route-interfaces.ts
 src/main/runtime/windows-mobile-firewall.ts
 src/main/skills/skill-update-run.ts
-src/main/ssh/ssh-connection.ts
+src/main/ssh/connection/ssh-connection.ts
 src/main/ssh/ssh-proxy-command.ts
 src/main/ssh/system-transport/system-ssh-command.ts
 src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts
@@ -3781,13 +3781,13 @@
      "invariant": "A first-install relay transfer must complete in an attempt-owned fixed staging slot before acquiring the shared version install lock. Reservation, promotion, confirmed cleanup, and stale recovery must reject path replacement, persisted-identity mismatch, POSIX symlinks, and Windows reparse points. A newly acquired install lock atomically records the execution host's boot identity; only a verified identity change or the existing stale-age proof may replace it, while legacy, missing, malformed, and unreadable identity state must retain the conservative stale fallback. Recovery examines only eight fixed slot/claim/delete names and removes at most one stale valid stage per call; eight unclaimable states fail with an explicit manual-recovery message. Split-SFTP hosts must prove the stage identity on the exact transfer session, only payload contents may be promoted under the shared lock, and cancellation must boundedly join SFTP, stream, local file-handle, and transfer settlement.",
      "oracle": "Pause a real ssh2 SFTP relay.js write after one remotely acknowledged chunk, prove the remote file is partial, abort the live transfer, and require no shared .install-lock, leaked local descriptor, or foreign-process termination. Separately inject two unconfirmed cancellations, require an independent deployment to install, launch, answer relay RPC, and read a real repository HEAD. Keep a fresh install lock on the current POSIX or Windows boot and require takeover to fail; replace its bounded identity with a prior-boot value and race concurrent recoverers, requiring exactly one atomic winner, a current successor identity, and no tombstone residue; omit the marker and require the legacy lock to remain fenced. Replace one retained fixed slot with an old-mtime same-owner directory while preserving the original, add a fixed-slot POSIX symlink, and require installed-path recovery to skip both while reclaiming a valid stale slot behind them. Add 15,197 unrelated relay-shaped names and run the real version GC, requiring bounded stdout and no removal. Unit and wire contracts cover exact POSIX and native PowerShell 0/1/7/8/9+ quota behavior, no-follow identity fencing, payload symlink/reparse rejection, one-item repeated draining, zero lock acquisition before upload settlement, joined transfer/channel teardown including never-settling failures, SFTP redirection, package.json namespace ownership, promotion only after the lock, cross-version isolation, and system-SSH behavior.",
      "commands": [
-        "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts"
+        "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/connection/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts"
      ],
      "testFiles": [
        "src/main/ssh/sftp-upload.test.ts",
        "src/main/ssh/ssh-file-transfer-abort.test.ts",
        "src/main/ssh/sftp-namespace-resolution.test.ts",
-        "src/main/ssh/ssh-connection-sftp-wire.test.ts",
+        "src/main/ssh/connection/ssh-connection-sftp-wire.test.ts",
        "src/main/ssh/ssh-remote-commands.test.ts"
      ],
      "assertionRefs": [
@@ -3817,7 +3817,7 @@
          "date": "2026-07-31",
          "runner": "local",
          "platform": "macos",
-          "command": "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts",
+          "command": "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/connection/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts",
          "result": "passed",
          "durationSeconds": 57.9,
          "summary": "Eleven focused files passed 152 tests with 3 platform skips using exact POSIX sh, native ARM macOS PowerShell 7.6.4, real ssh2 split-SFTP wire sessions, fixed-slot identity races, bounded recovery, joined cancellation teardown, and cross-version isolation."
@@ -4465,7 +4465,7 @@
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/watched-worktree-catalog-notification.test.ts src/main/runtime/external-worktree-paired-client-discovery.integration.test.ts src/main/window/attach-main-window-services.test.ts",
        "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-external-worktree-discovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/connection/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts --reporter=dot"
      ],
      "testFiles": [
@@ -4481,7 +4481,7 @@
        "src/main/window/attach-main-window-services.test.ts",
        "tests/e2e/paired-external-worktree-discovery.spec.ts",
        "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
-        "src/main/ssh/ssh-connection-generation.test.ts",
+        "src/main/ssh/connection/ssh-connection-generation.test.ts",
        "src/main/ssh/ssh-provider-authority.test.ts"
      ],
      "assertionRefs": [
@@ -4581,7 +4581,7 @@
          ]
        },
        {
-          "file": "src/main/ssh/ssh-connection-generation.test.ts",
+          "file": "src/main/ssh/connection/ssh-connection-generation.test.ts",
          "assertions": [
            "one exhausted target rolls the process generation scope and invalidates every sibling target token",
            "old-scope mutation expectations fail while the new-scope authority continues rotating"
@@ -4609,7 +4609,7 @@
          "date": "2026-07-27",
          "runner": "local",
          "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/connection/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
          "result": "passed",
          "durationSeconds": 1.61,
          "summary": "Three main-process catalog and authority files passed with 118 tests, including contradictory catalog provenance rejection and all-target generation-scope revocation. The third file, src/main/ipc/repos-remote.test.ts, was later deleted with the SSH repo IPC handlers."
@@ -13108,7 +13108,7 @@
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/hooks/direct-ssh-state-routing.test.ts src/renderer/src/components/terminal-pane/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot",
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ipc/worktrees-lineage-hydration.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/ssh-connection-manager.test.ts src/main/ssh/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ipc/worktrees-lineage-hydration.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot",
        "pnpm exec electron-vite build --mode e2e",
        "pnpm run build:web-from-renderer",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
@@ -13155,8 +13155,8 @@
        "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts",
        "src/main/ipc/worktrees-lineage-hydration.test.ts",
        "src/main/runtime/public-ssh-state.test.ts",
-        "src/main/ssh/ssh-connection-manager.test.ts",
-        "src/main/ssh/ssh-connection.test.ts",
+        "src/main/ssh/connection/ssh-connection-manager.test.ts",
+        "src/main/ssh/connection/ssh-connection.test.ts",
        "src/main/ssh/ssh-provider-authority.test.ts",
        "src/preload/ssh-authority-forwarding.test.ts",
        "src/renderer/src/runtime/runtime-client-events.test.ts",
@@ -13318,13 +13318,13 @@
          ]
        },
        {
-          "file": "src/main/ssh/ssh-connection-manager.test.ts",
+          "file": "src/main/ssh/connection/ssh-connection-manager.test.ts",
          "assertions": [
            "disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement"
          ]
        },
        {
-          "file": "src/main/ssh/ssh-connection.test.ts",
+          "file": "src/main/ssh/connection/ssh-connection.test.ts",
          "assertions": [
            "late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state"
          ]
@@ -5692,7 +5692,7 @@
      "src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts": 2252,
      "src/main/managed-server/install/remote-node-runtime-store-windows.test.ts": 7184,
      "src/main/managed-server/install/remote-versioned-install.test.ts": 283,
-      "src/main/ssh/removed-ssh-target-tombstone-retention.test.ts": 72,
+      "src/main/ssh/targets/removed-ssh-target-tombstone-retention.test.ts": 72,
      "src/main/ssh/runtime-ssh-access-verification.test.ts": 290,
      "src/main/ssh/runtime-ssh-access.test.ts": 621,
      "src/main/ssh/sftp-namespace-resolution.test.ts": 66,
@@ -5712,30 +5712,30 @@
      "src/main/ssh/config/ssh-config-parser.test.ts": 331,
      "src/main/ssh/config/ssh-config-resolver.test.ts": 40,
      "src/main/ssh/ssh-connect-attempt-cancellation.test.ts": 85,
-      "src/main/ssh/ssh-connection-attribution.test.ts": 34,
-      "src/main/ssh/ssh-connection-auth-fallback.test.ts": 269,
-      "src/main/ssh/ssh-connection-channel-error.test.ts": 142,
-      "src/main/ssh/ssh-connection-channel-lifetime.test.ts": 58,
-      "src/main/ssh/ssh-connection-channel-open.test.ts": 930,
-      "src/main/ssh/ssh-connection-direct-startup.test.ts": 128,
-      "src/main/ssh/ssh-connection-file-transfer.test.ts": 142,
-      "src/main/ssh/ssh-connection-generation.test.ts": 41,
-      "src/main/ssh/ssh-connection-github-probe.test.ts": 174,
-      "src/main/ssh/ssh-connection-gssapi-fallback.test.ts": 237,
-      "src/main/ssh/ssh-connection-host-key-store-wiring.test.ts": 524,
-      "src/main/ssh/ssh-connection-host-key-verification.test.ts": 216,
-      "src/main/ssh/ssh-connection-manager-registry.test.ts": 402,
-      "src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts": 522,
-      "src/main/ssh/ssh-connection-manager.test.ts": 274,
-      "src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts": 254,
-      "src/main/ssh/ssh-connection-reconnect-ladder.test.ts": 354,
-      "src/main/ssh/ssh-connection-sftp-namespace.test.ts": 1227,
-      "src/main/ssh/ssh-connection-sftp-wire.test.ts": 254,
-      "src/main/ssh/ssh-connection-store-orcad-ownership.test.ts": 293,
-      "src/main/ssh/ssh-connection-store.test.ts": 337,
-      "src/main/ssh/ssh-connection-system-transport.test.ts": 206,
+      "src/main/ssh/connection/ssh-connection-attribution.test.ts": 34,
+      "src/main/ssh/connection/ssh-connection-auth-fallback.test.ts": 269,
+      "src/main/ssh/connection/ssh-connection-channel-error.test.ts": 142,
+      "src/main/ssh/connection/ssh-connection-channel-lifetime.test.ts": 58,
+      "src/main/ssh/connection/ssh-connection-channel-open.test.ts": 930,
+      "src/main/ssh/connection/ssh-connection-direct-startup.test.ts": 128,
+      "src/main/ssh/connection/ssh-connection-file-transfer.test.ts": 142,
+      "src/main/ssh/connection/ssh-connection-generation.test.ts": 41,
+      "src/main/ssh/connection/ssh-connection-github-probe.test.ts": 174,
+      "src/main/ssh/connection/ssh-connection-gssapi-fallback.test.ts": 237,
+      "src/main/ssh/connection/ssh-connection-host-key-store-wiring.test.ts": 524,
+      "src/main/ssh/connection/ssh-connection-host-key-verification.test.ts": 216,
+      "src/main/ssh/connection/ssh-connection-manager-registry.test.ts": 402,
+      "src/main/ssh/connection/ssh-connection-manager-sign-in-reuse.test.ts": 522,
+      "src/main/ssh/connection/ssh-connection-manager.test.ts": 274,
+      "src/main/ssh/connection/ssh-connection-reconnect-handshake-loss.test.ts": 254,
+      "src/main/ssh/connection/ssh-connection-reconnect-ladder.test.ts": 354,
+      "src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts": 1227,
+      "src/main/ssh/connection/ssh-connection-sftp-wire.test.ts": 254,
+      "src/main/ssh/connection/ssh-connection-store-orcad-ownership.test.ts": 293,
+      "src/main/ssh/connection/ssh-connection-store.test.ts": 337,
+      "src/main/ssh/connection/ssh-connection-system-transport.test.ts": 206,
      "src/main/ssh/ssh-connection-utils.test.ts": 244,
-      "src/main/ssh/ssh-connection.test.ts": 1226,
+      "src/main/ssh/connection/ssh-connection.test.ts": 1226,
      "src/main/ssh/ssh-control-socket.test.ts": 50,
      "src/main/ssh/ssh-credential-decline.test.ts": 252,
      "src/main/ssh/ssh-exec-rc-stdout-noise.test.ts": 260,
@@ -5804,11 +5804,11 @@
      "src/main/ssh/ssh-session-limit-error.test.ts": 27,
      "src/main/ssh/system-transport/system-ssh-operations.test.ts": 275,
      "src/main/ssh/ssh-system-transport.integration.test.ts": 277,
-      "src/main/ssh/ssh-target-id-migration.test.ts": 46,
-      "src/main/ssh/ssh-target-orcad-claims.test.ts": 306,
-      "src/main/ssh/ssh-target-orcad-dependents.test.ts": 269,
-      "src/main/ssh/ssh-target-orcad-preflight.test.ts": 1582,
-      "src/main/ssh/ssh-target-readoption.test.ts": 52,
+      "src/main/ssh/targets/ssh-target-id-migration.test.ts": 46,
+      "src/main/ssh/targets/ssh-target-orcad-claims.test.ts": 306,
+      "src/main/ssh/targets/ssh-target-orcad-dependents.test.ts": 269,
+      "src/main/ssh/targets/ssh-target-orcad-preflight.test.ts": 1582,
+      "src/main/ssh/targets/ssh-target-readoption.test.ts": 52,
      "src/main/ssh/ssh-tcp-forwarding-probe.test.ts": 810,
      "src/main/ssh/ssh-windows-host-cells.test.ts": 39,
      "src/main/ssh/port-forwarding/ssh2-port-forward-listen.test.ts": 30,
@@ -161,8 +161,14 @@ it('re-includes the real WSL distro root after excluding unit tests', () => {

 // Each remote host lane executes these sources, so a change to one must start the lane.
 describe.each([
-  ['hostileHosts', ['src/main/ssh/ssh-connection.ts', 'src/main/ssh/ssh-connection-utils.ts']],
-  ['windowsHosts', ['src/main/ssh/ssh-connection.ts', 'src/main/ssh/ssh-connection-utils.ts']],
+  [
+    'hostileHosts',
+    ['src/main/ssh/connection/ssh-connection.ts', 'src/main/ssh/ssh-connection-utils.ts']
+  ],
+  [
+    'windowsHosts',
+    ['src/main/ssh/connection/ssh-connection.ts', 'src/main/ssh/ssh-connection-utils.ts']
+  ],
  ['wsl', ['src/main/orcad/orcad-wsl-host-login-environment.ts']]
 ])('%s remote transport routing', (lane, sources) => {
  const paths = workflows[lane].on.pull_request.paths
@@ -468,7 +468,7 @@ describe('orcad-e2e-routing', () => {
          'src/main/ipc/ssh/ssh-connection-handlers.ts',
          'src/main/ipc/runtime-environments/runtime-environment-connectivity-handlers.ts',
          'src/main/ipc/runtime-environments/runtime-environment-manual-disconnect.ts',
-          'src/main/ssh/ssh-connection-manager.ts',
+          'src/main/ssh/connection/ssh-connection-manager.ts',
          'src/main/ssh/ssh-user-disconnect.ts',
          'src/renderer/src/runtime/web-session-close-intent.ts',
          'src/renderer/src/runtime/web-session-close-replay.ts'
@@ -503,7 +503,7 @@ describe('managed-SSH remote sources routing', () => {
      'src/main/ipc/ssh/ssh.ts',
      'src/cli/runtime/serve-orcad-launch.ts',
      'src/main/orcad/orcad-entry.ts',
-      'src/main/ssh/ssh-connection.ts',
+      'src/main/ssh/connection/ssh-connection.ts',
      'src/main/ipc/runtime-environments/runtime-environment-status-probe.ts',
      'src/main/ipc/runtime-environments/orcad-runtime-lifecycle-handlers.ts',
      'src/shared/protocol-version.ts',
@@ -520,7 +520,7 @@ describe('managed-SSH remote sources routing', () => {

  it('leaves unit tests and local-only sources alone', () => {
    for (const file of [
-      'src/main/ssh/ssh-connection.test.ts',
+      'src/main/ssh/connection/ssh-connection.test.ts',
      'src/main/ipc/ssh/ssh.test.ts',
      'src/main/daemon/daemon-server.ts',
      'src/main/runtime/rpc/methods/accounts.ts',
@@ -248,7 +248,7 @@ export const PR_E2E_SOURCE_ROUTES = [
        file
      ) ||
      (isProductSource(file) &&
-        /^src\/(?:main\/(?:ssh|managed-server\/[a-z-]+)\/orcad-managed-|main\/ipc\/(?:ssh\/)?ssh-port-forward|main\/(?:ipc\/(?:(?:ssh\/)?ssh-(?:connect-flow|connection-handlers|host-user-disconnect|session-teardown)|(?:runtime-environments\/)?runtime-environment-(?:connectivity-handlers|manual-disconnect))|ssh\/ssh-(?:connection-manager|user-disconnect))\.ts$|renderer\/src\/startup\/(?:ssh-startup-reconnect|startup-ssh-connection-restore)\.ts$|renderer\/src\/runtime\/(?:web-runtime-session|web-session-close-|runtime-terminal-artifact-read\.ts$)|renderer\/src\/components\/terminal-pane\/(?:remote-runtime-|terminal-host-(?:workspace-file|file-link-existence)\.ts$))/.test(
+        /^src\/(?:main\/(?:ssh|managed-server\/[a-z-]+)\/orcad-managed-|main\/ipc\/(?:ssh\/)?ssh-port-forward|main\/(?:ipc\/(?:(?:ssh\/)?ssh-(?:connect-flow|connection-handlers|host-user-disconnect|session-teardown)|(?:runtime-environments\/)?runtime-environment-(?:connectivity-handlers|manual-disconnect))|ssh\/(?:connection\/ssh-connection-manager|ssh-user-disconnect))\.ts$|renderer\/src\/startup\/(?:ssh-startup-reconnect|startup-ssh-connection-restore)\.ts$|renderer\/src\/runtime\/(?:web-runtime-session|web-session-close-|runtime-terminal-artifact-read\.ts$)|renderer\/src\/components\/terminal-pane\/(?:remote-runtime-|terminal-host-(?:workspace-file|file-link-existence)\.ts$))/.test(
          file
        ))
  },
@@ -5,7 +5,7 @@ const defaultFiles = [
  'src/main/ssh/ssh-file-transfer-abort.test.ts',
  'src/main/ssh/ssh-relay-install-namespace.test.ts',
  'src/main/ssh/sftp-namespace-resolution.test.ts',
-  'src/main/ssh/ssh-connection-sftp-wire.test.ts',
+  'src/main/ssh/connection/ssh-connection-sftp-wire.test.ts',
  'src/main/ssh/ssh-remote-commands.test.ts'
 ]

@@ -298,7 +298,7 @@ export const SQLITE_RUNTIME_INCLUDE = [
  'src/main/ssh/orcad-migration-stuck-host-profiles.test.ts',
  'src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts',
  'src/main/ssh/orcad-unreachable-setup-release.test.ts',
-  'src/main/ssh/ssh-target-orcad-preflight.test.ts',
+  'src/main/ssh/targets/ssh-target-orcad-preflight.test.ts',
  'src/main/worktree-identity-persistence.test.ts',
  'src/main/worktree-removal-close-records.test.ts',
  'src/main/worktree-removal-session-partition-fencing.test.ts',
@@ -23,7 +23,10 @@ import type {
  ExternalAutomationTarget
 } from '../../shared/automations-types'
 import type { SshTarget } from '../../shared/ssh-types'
-import { isManagedOrcadSshTarget, isRuntimeOwnedSshTarget } from '../ssh/ssh-connection-store'
+import {
+  isManagedOrcadSshTarget,
+  isRuntimeOwnedSshTarget
+} from '../ssh/connection/ssh-connection-store'

 /** Current SSH registrations, hidden ones included so the guard can reject them itself. */
 export type DesktopSshTargetRegistry = {
@@ -12,7 +12,7 @@ const sshManagerState = vi.hoisted(() => ({
  }
 }))

-vi.mock('../ssh/ssh-target-registry', () => ({
+vi.mock('../ssh/targets/ssh-target-registry', () => ({
  getSshConnectionManager: () => sshManagerState.manager
 }))

@@ -2,7 +2,7 @@ import { spawn, type ChildProcess } from 'node:child_process'
 import type { ClientChannel } from 'ssh2'
 import type { AutomationPrecheck, AutomationPrecheckResult } from '../../shared/automations-types'
 import { MAX_AUTOMATION_PRECHECK_OUTPUT_CHARS } from '../../shared/automation-precheck'
-import { getSshConnectionManager } from '../ssh/ssh-target-registry'
+import { getSshConnectionManager } from '../ssh/targets/ssh-target-registry'
 import { shellEscape } from '../ssh/ssh-connection-utils'
 import { admitSelfInitiatedTreeKill } from '../own-chromium-tree-kill-guard'
 import { errorMessage } from '../../shared/error-message'
@@ -22,7 +22,7 @@ export const resolveBrowserNetworkExecutionRoute: BrowserNetworkExecutionRouteRe
    return wslRoute.resolveWslBrowserNetworkExecutionRoute(context)
  }
  const [{ getSshConnectionManager }, authority, sshRoute] = await Promise.all([
-    import('../ssh/ssh-target-registry'),
+    import('../ssh/targets/ssh-target-registry'),
    import('../ssh/ssh-provider-authority'),
    import('./ssh-browser-network-execution-route')
  ])
@@ -3,7 +3,7 @@ import type { ChildProcess } from 'node:child_process'
 import { createServer, type AddressInfo } from 'node:net'
 import { PassThrough } from 'node:stream'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../ssh/ssh-connection'
+import type { SshConnection } from '../ssh/connection/ssh-connection'
 import type { SshProviderEpoch } from '../../shared/ssh-types'
 import { resolveSshBrowserNetworkExecutionRoute } from './ssh-browser-network-execution-route'

@@ -1,6 +1,6 @@
 import type { DirectSshAuthority, SshProviderEpoch } from '../../shared/ssh-types'
-import type { SshConnection } from '../ssh/ssh-connection'
-import type { SshConnectionManager } from '../ssh/ssh-connection-manager'
+import type { SshConnection } from '../ssh/connection/ssh-connection'
+import type { SshConnectionManager } from '../ssh/connection/ssh-connection-manager'
 import type { Client as SshClient } from 'ssh2'
 import {
  startSystemSshDynamicForwardProcess,
@@ -5,7 +5,7 @@ const mocks = vi.hoisted(() => ({
  remove: vi.fn(async () => {})
 }))

-vi.mock('./ssh/ssh-target-registry', () => ({
+vi.mock('./ssh/targets/ssh-target-registry', () => ({
  connectRegisteredSshTarget: mocks.connect
 }))
 vi.mock('./ipc/ssh/ssh', () => ({
@@ -1,5 +1,5 @@
 import { getSshConnectionStore } from './ipc/ssh/ssh'
-import { connectRegisteredSshTarget } from './ssh/ssh-target-registry'
+import { connectRegisteredSshTarget } from './ssh/targets/ssh-target-registry'
 import {
  disconnectRegisteredSshTarget,
  removeRegisteredSshTarget
@@ -13,7 +13,7 @@ vi.mock('./ssh/ssh-ipc-context', () => ({ persistedStore: null }))
 vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
  ensureOrcadManagedTunnel: vi.fn()
 }))
-vi.mock('../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../ssh/targets/ssh-target-registry', async (importOriginal) => ({
  ...(await importOriginal<Record<string, unknown>>()),
  getSshTargetRegistryStore: () => ({ listTargets: () => targets })
 }))
@@ -31,8 +31,8 @@ import type { OrcaRuntimeService } from '../runtime/orca-runtime'
 import { RpcDispatcher } from '../runtime/rpc/dispatcher'
 import { ALL_RPC_METHODS } from '../runtime/rpc/methods'
 import { ensureOrcadManagedTunnel } from '../managed-server/lifecycle/orcad-managed-tunnel'
-import { getSshTargetRegistryStore } from '../ssh/ssh-target-registry'
-import type { SshConnectionManager } from '../ssh/ssh-connection-manager'
+import { getSshTargetRegistryStore } from '../ssh/targets/ssh-target-registry'
+import type { SshConnectionManager } from '../ssh/connection/ssh-connection-manager'
 import { getRuntimeEnvironmentStatus } from './runtime-environments/runtime-environment-status-probe'
 import { isRuntimeEnvironmentManuallyDisconnected } from './runtime-environments/runtime-environment-connectivity-handlers'
 import { setDesktopBrowserBridgeControl } from './desktop-browser-bridge-reconcile'
@@ -32,7 +32,7 @@ import { registerFilesystemMutationHandlers } from './filesystem-mutations'
 import {
  resetSshConnectionGenerations,
  setSshConnectionGeneration
-} from '../ssh/ssh-connection-generation'
+} from '../ssh/connection/ssh-connection-generation'

 // Why: paths are resolved via path.resolve() in production code, so test
 // data must use resolved paths to avoid Unix-vs-Windows mismatches.
@@ -12,7 +12,7 @@ import type { LocalFileAccess } from '../../shared/local-file-access'
 import { SshHostNotServedError } from '../providers/ssh-host-not-served-error'
 import { resolveLocalDroppedPathsForAgent } from './dropped-path-resolution'
 import type { SshMutationExpectation } from '../../shared/ssh-types'
-import { assertSshMutationExpectation } from '../ssh/ssh-connection-generation'
+import { assertSshMutationExpectation } from '../ssh/connection/ssh-connection-generation'
 import { renameLocalPathSerializedByDestination } from '../destination-serialized-local-rename'
 import { assertNotExists, rethrowWithUserMessage } from './filesystem-create-path-guards'
 import type {
@@ -1,7 +1,7 @@
 import { ipcMain, shell } from 'electron'
 import { lstat, writeFile } from 'node:fs/promises'
 import type { SshMutationExpectation } from '../../../shared/ssh-types'
-import { assertSshMutationExpectation } from '../../ssh/ssh-connection-generation'
+import { assertSshMutationExpectation } from '../../ssh/connection/ssh-connection-generation'
 import { SshHostNotServedError } from '../../providers/ssh-host-not-served-error'
 import { tryDeleteWslUncPath } from '../../wsl-unc-delete'
 import type { LocalFileAccess } from '../../../shared/local-file-access'
@@ -9,7 +9,7 @@ vi.mock('./ssh/ssh-ipc-context', () => ({
  persistedStore: null,
  portForwardManager: null
 }))
-vi.mock('../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../ssh/targets/ssh-target-registry', async (importOriginal) => ({
  ...(await importOriginal<Record<string, unknown>>()),
  getSshTargetRegistryStore: () => null
 }))
@@ -1,6 +1,6 @@
 /** IPC for "Move anyway": the user confirms that saved state a move can't carry stays on this desktop. */
 import { ipcMain } from 'electron'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { requiredString } from './orcad-runtime-lifecycle-handlers'

 export function registerOrcadLeaveBehindHandlers(): void {
@@ -36,7 +36,7 @@ vi.mock('./runtime-environment-status-probe', () => ({
  getRuntimeEnvironmentStatus: vi.fn(async () => ({ ok: true }))
 }))
 vi.mock('../ssh/ssh-session-teardown', () => ({ disconnectRegisteredSshTarget: hoisted.teardown }))
-vi.mock('../../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../../ssh/targets/ssh-target-registry', async (importOriginal) => ({
  ...(await importOriginal<object>()),
  connectRegisteredSshTarget: hoisted.connectHost
 }))
@@ -50,7 +50,7 @@ vi.mock('../../managed-server/lifecycle/orcad-managed-update-on-restore', () =>
  redeployStoppedManagedOrcad: mocks.redeploy
 }))
 vi.mock('../../ssh/ssh-host-server-status', () => ({ setSshHostServerStatus: vi.fn() }))
-vi.mock('../../ssh/ssh-target-registry', () => ({ getSshTargetRegistryStore: () => null }))
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({ getSshTargetRegistryStore: () => null }))
 vi.mock('../ssh/ssh-ipc-context', () => ({
  connectionManager: null,
  getCurrentMainWindow: () => null
@@ -25,7 +25,7 @@ import {
  updateManagedOrcadOnRestore
 } from '../../managed-server/lifecycle/orcad-managed-update-on-restore'
 import { getSshHostServerStatus, setSshHostServerStatus } from '../../ssh/ssh-host-server-status'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { connectionManager, getCurrentMainWindow } from '../ssh/ssh-ipc-context'
 import { getWslHostService } from '../../wsl/wsl-host-service-instance'
 import { assertWslHostReachable } from '../../wsl/wsl-host-gate'
@@ -21,7 +21,7 @@ vi.mock('../../../shared/runtime-environments', async (importOriginal) => ({
 vi.mock('./runtime-environment-managed-tunnel', () => ({
  resolveManagedRuntimeEnvironment: mocks.resolveManaged
 }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  listRegisteredSshTargets: () => mocks.sshTargets,
  getRegisteredSshState: (targetId: string) => mocks.sshStates.get(targetId)
 }))
@@ -16,7 +16,10 @@ import type {
 } from '../../runtime/mobile-desktop-relay/mobile-desktop-relay-hosts'
 import { resolveManagedRuntimeEnvironment } from './runtime-environment-managed-tunnel'
 import type { SshConnectionState } from '../../../shared/ssh-types'
-import { getRegisteredSshState, listRegisteredSshTargets } from '../../ssh/ssh-target-registry'
+import {
+  getRegisteredSshState,
+  listRegisteredSshTargets
+} from '../../ssh/targets/ssh-target-registry'
 import { getRuntimeEnvironmentStatusSnapshots } from './runtime-environment-request-connections'
 import {
  callRuntimeEnvironment,
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -1,5 +1,5 @@
 import { ipcMain } from 'electron'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import { browseSshDirectory, type RemoteBrowseResult } from '../../ssh/ssh-remote-directory-browse'

 export function registerSshBrowseHandler(
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -20,8 +20,8 @@ vi.mock(import('../../ssh/legacy-relay/legacy-relay-bridge-registry'), async (im
 }))

 import type { SshTarget } from '../../../shared/ssh-types'
-import type { SshConnection } from '../../ssh/ssh-connection'
-import { recordSshConnectionOpened } from '../../ssh/ssh-connection-attribution'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
+import { recordSshConnectionOpened } from '../../ssh/connection/ssh-connection-attribution'
 import {
  decideHostServer,
  publishBridgedUnservedHostServer,
@@ -6,8 +6,11 @@ import {
  isCurrentSshProviderAuthority,
  rotateSshProviderAuthority
 } from '../../ssh/ssh-provider-authority'
-import { adoptSshConnection, runAttributedToSshOwner } from '../../ssh/ssh-connection-attribution'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import {
+  adoptSshConnection,
+  runAttributedToSshOwner
+} from '../../ssh/connection/ssh-connection-attribution'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import {
  decideHostServer,
  recheckWhenManagedFenceClears,
@@ -2,7 +2,7 @@ import { ipcMain } from 'electron'
 import {
  setSshTargetRegistryHandlers,
  getSshTargetRegistryStore
-} from '../../ssh/ssh-target-registry'
+} from '../../ssh/targets/ssh-target-registry'
 import {
  assertSshConnectsNotFenced,
  connectInFlight,
@@ -1,6 +1,6 @@
 import type { SshConnectionCallbacks } from '../../ssh/ssh-connection-utils'
 import type { SshConnectionState } from '../../../shared/ssh-types'
-import { isSshHostCensusInFlight } from '../../ssh/ssh-connection-attribution'
+import { isSshHostCensusInFlight } from '../../ssh/connection/ssh-connection-attribution'
 import {
  clearSshCredentialDeclined,
  isSshCredentialDeclined
@@ -11,7 +11,7 @@ import {
  testingTargets
 } from './ssh-connect-attempt-registry'
 import { connectionManager, getCurrentMainWindow } from './ssh-ipc-context'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { recordSshSignInRequirement } from './ssh-sign-in-requirement'
 import { restoreManagedHostPortForwards } from './ssh-managed-port-forward-restore'
 import { requestCredential } from './ssh-passphrase'
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -8,7 +8,7 @@ const mocks = vi.hoisted(() => ({
 vi.mock('../../../shared/app-environment', () => ({
  getAppEnvironment: () => ({ getPath: () => '/tmp/user-data', getVersion: () => '1.5.0' })
 }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  getSshTargetRegistryStore: () => ({ getTarget: mocks.getTarget })
 }))
 vi.mock('../../ssh/ssh-host-server-on-connect', () => ({
@@ -6,7 +6,7 @@ import type { SshTarget } from '../../../shared/ssh-types'
 import { closeTestStores, createSqliteTestStore } from '../../persistence-test-harness'
 import { Store } from '../../persistence/loading-store/store'
 import { OrcadHostUnsupportedError } from '../../orcad/orcad-host-unavailable'
-import { allowsDirectSshRelay, SshConnectionStore } from '../../ssh/ssh-connection-store'
+import { allowsDirectSshRelay, SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 import { resolveHostServerOnConnect } from '../../ssh/ssh-host-server-on-connect'

 const mocks = vi.hoisted(() => {
@@ -22,7 +22,7 @@ const mocks = vi.hoisted(() => {
 vi.mock('../../../shared/app-environment', () => ({
  getAppEnvironment: () => ({ getVersion: () => '1.5.0', getPath: () => '/tmp/unused' })
 }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  getSshTargetRegistryStore: () => mocks.registry.current
 }))
 vi.mock('../../managed-server/lifecycle/orcad-runtime-deployment', () => ({
@@ -30,7 +30,7 @@ import { setSshHostServerStatus } from '../../ssh/ssh-host-server-status'
 import { trackSshHostServerEvent } from '../../ssh/ssh-host-server-telemetry'
 import { knownSshHostPlatform } from '../../ssh/ssh-host-platform-memo'
 import { knownOrcadTunnelTransport } from '../../ssh/orcad-tunnel-transport-memo'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { releaseUnreachableOrcadSetup } from '../../ssh/orcad-unreachable-setup-release'
 import { getCurrentMainWindow } from './ssh-ipc-context'
 import { broadcastSshState } from './ssh-renderer-broadcast'
@@ -10,7 +10,7 @@ vi.mock('electron', async () => {
 vi.mock('../../managed-server/lifecycle/orcad-managed-tunnel', () => ({
  recoverOrcadManagedTunnelsAfterHostResume: recoverManagedTunnels
 }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  getSshConnectionManager: () => ({ retryStalledReconnects })
 }))

@@ -1,6 +1,6 @@
 import { powerMonitor } from 'electron'
 import { recoverOrcadManagedTunnelsAfterHostResume } from '../../managed-server/lifecycle/orcad-managed-tunnel'
-import { getSshConnectionManager } from '../../ssh/ssh-target-registry'
+import { getSshConnectionManager } from '../../ssh/targets/ssh-target-registry'
 import { errorMessage } from '../../../shared/error-message'

 let powerMonitorUnsubscribe: (() => void) | null = null
@@ -11,9 +11,9 @@ const runtime = vi.hoisted(() => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -11,7 +11,7 @@ import {
  isSshUserDisconnected,
  recordSshUserDisconnected
 } from '../../ssh/ssh-user-disconnect'
-import { connectRegisteredSshTarget } from '../../ssh/ssh-target-registry'
+import { connectRegisteredSshTarget } from '../../ssh/targets/ssh-target-registry'
 import {
  clearRuntimeEnvironmentManualDisconnect,
  isRuntimeEnvironmentManuallyDisconnected,
@@ -1,6 +1,6 @@
 import type { BrowserWindow } from 'electron'
 import type { Store } from '../../persistence'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'

@@ -15,7 +15,7 @@ vi.mock('./ssh-ipc-context', () => ({
  persistedStore: null,
  portForwardManager: { removeAllForwards: h.removeAllForwards }
 }))
-vi.mock('../../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../../ssh/targets/ssh-target-registry', async (importOriginal) => ({
  ...(await importOriginal<Record<string, unknown>>()),
  getSshTargetRegistryStore: () => null
 }))
@@ -13,7 +13,7 @@ vi.mock('./ssh-ipc-context', () => ({
  persistedStore: null,
  portForwardManager: null
 }))
-vi.mock('../../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../../ssh/targets/ssh-target-registry', async (importOriginal) => ({
  ...(await importOriginal<Record<string, unknown>>()),
  getSshTargetRegistryStore: () => null
 }))
@@ -1,6 +1,6 @@
 import type { BrowserWindow } from 'electron'
 import type { SavedPortForward } from '../../../shared/ssh-types'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { connectionManager, portForwardManager } from './ssh-ipc-context'
 import { broadcastPortForwards } from './ssh-renderer-broadcast'

@@ -53,7 +53,9 @@ const h = vi.hoisted(() => {
  }
 })

-vi.mock('../../ssh/ssh-target-registry', () => ({ getSshTargetRegistryStore: () => h.store }))
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
+  getSshTargetRegistryStore: () => h.store
+}))
 vi.mock('./ssh-ipc-context', () => ({
  connectionManager: h.connectionManager,
  portForwardManager: h.portForwardManager,
@@ -11,10 +11,10 @@ import {
  enrichSshForwardEntries,
  getWorktreeIdsForConnection
 } from '../../ports/ssh-advertised-url-enrichment'
-import { isRuntimeOwnedSshTarget } from '../../ssh/ssh-connection-store'
+import { isRuntimeOwnedSshTarget } from '../../ssh/connection/ssh-connection-store'
 import { getSshProviderAuthority } from '../../ssh/ssh-provider-authority'
 import { clearSshHostServerStatus, getSshHostServerStatus } from '../../ssh/ssh-host-server-status'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import {
  connectionManager,
  currentRuntime,
@@ -1,7 +1,7 @@
 import type { DirectSshAuthority } from '../../../shared/ssh-types'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { clearSshHostServerStatus } from '../../ssh/ssh-host-server-status'
-import { isSshConnectionSolelyOwnedBy } from '../../ssh/ssh-connection-attribution'
+import { isSshConnectionSolelyOwnedBy } from '../../ssh/connection/ssh-connection-attribution'
 import {
  connectInFlight,
  invalidateConnectAttempt,
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -1,6 +1,6 @@
 import { recordSshSignInAwaited } from '../../ssh/ssh-credential-decline'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
-import type { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
+import type { SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 import { credentialRequestedForTarget } from './ssh-connect-attempt-registry'

 /**
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -16,7 +16,7 @@ const mocks = vi.hoisted(() => {
 })

 vi.mock('electron', () => ({ ipcMain: { handle: mocks.handle } }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  getSshTargetRegistryStore: () => ({
    getTarget: () => mocks.state.target,
    addTarget: mocks.addTarget,
@@ -14,12 +14,15 @@ import {
 import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
 import { closeOrcadManagedTunnel } from '../../managed-server/lifecycle/orcad-managed-tunnel'
 import { rotateSshProviderAuthority } from '../../ssh/ssh-provider-authority'
-import { getSshTargetRegistryStore, setSshTargetMutations } from '../../ssh/ssh-target-registry'
+import {
+  getSshTargetRegistryStore,
+  setSshTargetMutations
+} from '../../ssh/targets/ssh-target-registry'
 import {
  allowsDirectSshRelay,
  isManagedOrcadSshTarget,
  isRuntimeOwnedSshTarget
-} from '../../ssh/ssh-connection-store'
+} from '../../ssh/connection/ssh-connection-store'
 import { connectionManager, getCurrentMainWindow } from './ssh-ipc-context'
 import { runTargetLifecycle } from './ssh-target-lifecycle-queue'
 import { fingerprintRuntimeSshTarget } from '../../ssh/runtime-ssh-access'
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {

 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -21,8 +21,11 @@ import {
  publishManagedServerConnect,
  publishUnservedHostServer
 } from './ssh-host-server-connect'
-import { beginSshHostCensus, recordSshConnectionOpened } from '../../ssh/ssh-connection-attribution'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import {
+  beginSshHostCensus,
+  recordSshConnectionOpened
+} from '../../ssh/connection/ssh-connection-attribution'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'

 const { mockSshStore, mockConnectionManager } = mocks

@@ -1,8 +1,8 @@
 import { ipcMain, type BrowserWindow } from 'electron'
 import type { Store } from '../../persistence'
-import { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import { SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 import { awaitSignInForCredentialHosts } from './ssh-sign-in-requirement'
-import { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import { quitTeardownStartGate } from '../../quit-teardown-start-gate'
 import {
@@ -11,7 +11,7 @@ import {
  setSshTargetMutations,
  setSshTargetRegistryHandlers,
  setSshTargetRegistryStore
-} from '../../ssh/ssh-target-registry'
+} from '../../ssh/targets/ssh-target-registry'

 import { registerSshBrowseHandler } from './ssh-browse'
 import { registerCredentialHandler } from './ssh-passphrase'
@@ -19,7 +19,7 @@ import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import {
  initializeSshConnectionGenerationSession,
  resetSshConnectionGenerations
-} from '../../ssh/ssh-connection-generation'
+} from '../../ssh/connection/ssh-connection-generation'
 import { resetSshProviderAuthorities } from '../../ssh/ssh-provider-authority'
 import { installManagedOrcadStartStatus } from '../runtime-environments/runtime-environment-managed-tunnel'
 import {
@@ -12,7 +12,7 @@ import { afterAll, beforeAll, describe, expect, it, vi, type MockInstance } from

 vi.mock('electron', () => ({ app: { getAppPath: () => process.cwd() } }))

-import { SshConnection } from '../../ssh/ssh-connection'
+import { SshConnection } from '../../ssh/connection/ssh-connection'
 import {
  connectHostileHost,
  installHostileHostAppEnvironment
@@ -6,7 +6,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
  execCommand: vi.fn()
 }))

-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import {
  isRelayGcClaimOwned,
@@ -5,7 +5,7 @@ import { join } from 'node:path'
 import { PassThrough } from 'node:stream'
 import type { ClientChannel } from 'ssh2'
 import { runProcess, spawnProcess } from '@orca/process-host'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'

@@ -6,7 +6,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
  execCommand: vi.fn()
 }))

-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { gcOldRemoteInstallVersions } from './remote-install-gc'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
@@ -6,7 +6,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
  execCommand: vi.fn()
 }))

-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock, isRelayInstallLockStale } from './remote-install-lock'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
@@ -1,6 +1,6 @@
 import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'

 vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
  ...(await importOriginal<typeof ExecCommandModule>()),
@@ -5,7 +5,7 @@ import { Client, Server as Ssh2Server, utils, type Connection } from 'ssh2'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshTarget } from '../../../shared/ssh-types'
 import { spawnProcess } from '@orca/process-host'
-import { SshConnection } from '../../ssh/ssh-connection'
+import { SshConnection } from '../../ssh/connection/ssh-connection'
 import { uploadRelayDirectory, writeRelayFile } from './remote-install-transfers'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'

@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { createSshOperationAbortError } from '../../ssh/ssh-connection-utils'
 import {
  uploadDirectoryViaExecStdin,
@@ -1,5 +1,5 @@
 import type { Duplex, Readable, Writable } from 'node:stream'
-import type { SshRemoteFileOptions } from '../../ssh/ssh-connection-file-transfers'
+import type { SshRemoteFileOptions } from '../../ssh/connection/ssh-connection-file-transfers'
 import type { SshExecOptions } from '../../ssh/ssh-connection-utils'

 type RemoteFileWriteOptions = SshRemoteFileOptions & { signal?: AbortSignal }
@@ -20,7 +20,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
  execCommand: vi.fn()
 }))

-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import {
  gcRemoteNodeRuntimeStore,
  parseSweptRuntimeStages,
@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { runProcess, spawnProcess } from '@orca/process-host'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import {
  RUNTIME_STORE_LOCK_NAME,
  RUNTIME_STORE_LOCK_OWNER_FILENAME,
@@ -10,7 +10,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
  execCommand: vi.fn()
 }))

-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { gcRemoteNodeRuntimeStore, parseSweptRuntimeStages } from './remote-node-runtime-store-gc'
 import { RUNTIME_STORE_LOCK_NAME } from './remote-node-runtime-store-lock'
 import { parseRuntimeStoreInventory } from './remote-node-runtime-store-inventory'
@@ -6,7 +6,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
  execCommand: vi.fn()
 }))

-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { REMOTE_INSTALL_MODELS } from './remote-install-model'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import {
@@ -37,7 +37,7 @@ import {
  waitForRelayGcClaimRelease
 } from './remote-install-gc-claim'
 import { getRemoteHostPlatform, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'

 const conn = {} as SshConnection
 const mockExec = vi.mocked(execCommand)
@@ -6,8 +6,8 @@ import { addManagedOrcadEnvironment } from '../../../shared/runtime-environment-
 import type { SshTarget } from '../../../shared/ssh-types'
 import type { ServeReadiness } from '../../server/serve-readiness'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
-import { SshTargetOrcadClaims } from '../../ssh/ssh-target-orcad-claims'
-import { emptyDependentStateStore } from '../../ssh/ssh-target-orcad-dependents-fixture'
+import { SshTargetOrcadClaims } from '../../ssh/targets/ssh-target-orcad-claims'
+import { emptyDependentStateStore } from '../../ssh/targets/ssh-target-orcad-dependents-fixture'

 export const MANAGED_VERSION = '0.2.0+abc'
 export const MANAGED_PREVIOUS_VERSION = '0.1.0+def'
@@ -16,7 +16,10 @@ import { probeActiveOrcadReadiness } from '../../ssh/orcad-active-readiness'
 import { resolveOrcadRemoteContext, type OrcadRemoteContext } from '../install/orcad-remote-context'
 import { ORCAD_INSTALL_MODEL } from '../install/remote-install-model'
 import { computeRemoteInstallDir } from '../install/remote-versioned-install'
-import { getSshConnectionManager, getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import {
+  getSshConnectionManager,
+  getSshTargetRegistryStore
+} from '../../ssh/targets/ssh-target-registry'

 export const ORCAD_BIND_HOST = '127.0.0.1'

@@ -6,8 +6,8 @@ import {
  type RuntimeSshTunnelLink
 } from '../../../shared/runtime-environments'
 import type { SshTarget } from '../../../shared/ssh-types'
-import type { SshConnection } from '../../ssh/ssh-connection'
-import { adoptSshConnection } from '../../ssh/ssh-connection-attribution'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
+import { adoptSshConnection } from '../../ssh/connection/ssh-connection-attribution'
 import type {
  PortForwardEntry,
  SshPortForwardManager
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type { PortForwardStartOptions } from '../../ssh/port-forwarding/ssh-port-forward-provider'
 import type * as ForwardProcess from '../../ssh/system-transport/system-ssh-forward-process'

@@ -8,9 +8,9 @@ import {
 } from '../../../shared/runtime-environments'
 import type { SshTarget } from '../../../shared/ssh-types'
 import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { isAuthError } from '../../ssh/ssh-connection-utils'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import { OrcadManagedTunnelTransportProvider } from './orcad-managed-tunnel-transport'
 import {
@@ -28,7 +28,7 @@ import {
  type ActiveOrcadTunnel
 } from './orcad-managed-tunnel-active'
 import { checkManagedTunnelServing, type OrcadTunnelServing } from './orcad-managed-tunnel-serving'
-import type { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import type { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import {
  environmentForwardChecks,
  forwardToVerifiedOrcad,
@@ -4,12 +4,12 @@ import {
  type KnownRuntimeEnvironment,
  type RuntimeSshTunnelLink
 } from '../../../shared/runtime-environments'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type { SshTarget } from '../../../shared/ssh-types'
 import type { OrcadManagedServing } from './orcad-managed-serving'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
-import type { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import type { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import {
  dropActiveOrcadTunnel,
  managedTunnelAccess,
@@ -2,7 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshTarget } from '../../../shared/ssh-types'
 import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import {
  OrcadManagedIdentityError,
@@ -15,7 +15,7 @@ import {
 import { managedOrcadSlot } from './orcad-managed-runtime-context'
 import { wakeStoppedManagedOrcad } from './orcad-managed-wake'
 import { resolveOrcadRemoteContext } from '../install/orcad-remote-context'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type {
  PortForwardEntry,
  SshPortForwardManager
@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { OrcadManagedTunnelTransportProvider } from './orcad-managed-tunnel-transport'
 import { knownOrcadTunnelTransport } from '../../ssh/orcad-tunnel-transport-memo'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type {
  PortForwardStartOptions,
  SshPortForwardProvider,
@@ -4,7 +4,7 @@
 */
 import { OrcadStdioBridgePortForwardProvider } from './orcad-stdio-bridge-provider'
 import { rememberOrcadTunnelTransport } from '../../ssh/orcad-tunnel-transport-memo'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type {
  PortForwardStartOptions,
  SshPortForwardProvider,
@@ -5,9 +5,9 @@ import {
 } from '../../../shared/runtime-environments'
 import { PAIRING_OFFER_VERSION } from '../../../shared/pairing'
 import type { SshTarget } from '../../../shared/ssh-types'
-import type { SshConnection } from '../../ssh/ssh-connection'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
-import type { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
+import type { SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import { OrcadManagedTunnelManager } from './orcad-managed-tunnel-manager'
 import type { OrcadManagedTunnelTargeting } from './orcad-managed-tunnel-target'
@@ -1,12 +1,15 @@
 import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
 import { resolveEnvironment } from '../../../shared/runtime-environment-store'
 import type { SshTarget } from '../../../shared/ssh-types'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { probeManagedOrcadTunnel } from './orcad-managed-tunnel-resume'
 import { ensureManagedOrcadServing } from './orcad-managed-serving'
 import { OrcadManagedTunnelManager } from './orcad-managed-tunnel-manager'
 import { getRemoteRuntimeSharedControlAnsweredAt } from '../../ipc/runtime-environments/runtime-environment-shared-control-answers'
-import { getSshConnectionManager, getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import {
+  getSshConnectionManager,
+  getSshTargetRegistryStore
+} from '../../ssh/targets/ssh-target-registry'
 import {
  MANAGED_ORCAD_TUNNEL_TARGETING,
  type OrcadTunnelStartChecks
@@ -16,13 +16,13 @@ import { listOrcadMigrationSourceCutovers } from '../../ssh/orcad-migration-cuto
 import type { OrcadManagedConversionArgs } from './orcad-runtime-conversion'
 import { fakeOrcadMigrationDestination } from '../../ssh/orcad-migration-destination-fake'
 import { reconcileManagedOrcadSshTargets, visibleRepos } from '../../ssh/orcad-retained-source'
-import { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import { SshConnectionStore } from '../../ssh/connection/ssh-connection-store'

 const mocks = vi.hoisted(() => {
  const state: { targetStore: unknown } = { targetStore: null }
  return { state, deploy: vi.fn(), ensureTunnel: vi.fn() }
 })
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  getSshConnectionManager: () => ({}),
  getSshTargetRegistryStore: () => mocks.state.targetStore
 }))
@@ -36,7 +36,7 @@ import { createSshRelayMigrationSource } from '../../ssh/orcad-migration-ssh-rel
 import {
  leaveBehindClearsOrcadMigrationBlockers,
  onlyLeavableOrcadMigrationBlockers
-} from '../../ssh/ssh-target-orcad-preflight'
+} from '../../ssh/targets/ssh-target-orcad-preflight'
 import { ORCAD_MIGRATION_LEAVE_BEHIND_TERMINALS_REASON } from '../../ssh/orcad-migration-source-fence'
 import { retainOrcadMigrationSource } from '../../ssh/orcad-migration-source-retention'
 import {
@@ -29,7 +29,7 @@ const mocks = vi.hoisted(() => {
  }
 })

-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  getSshConnectionManager: () => ({ connect: async () => ({}) }),
  getSshTargetRegistryStore: () => mocks.state.store
 }))
@@ -10,8 +10,8 @@ import { orcadMigrationCutoverFixture } from '../../ssh/orcad-migration-cutover-
 import { listEnvironments } from '../../../shared/runtime-environment-store'
 import type { SshTarget } from '../../../shared/ssh-types'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
-import { SshTargetOrcadClaims } from '../../ssh/ssh-target-orcad-claims'
-import { emptyDependentStateStore } from '../../ssh/ssh-target-orcad-dependents-fixture'
+import { SshTargetOrcadClaims } from '../../ssh/targets/ssh-target-orcad-claims'
+import { emptyDependentStateStore } from '../../ssh/targets/ssh-target-orcad-dependents-fixture'
 import {
  withDeactivatedVersion,
  withDeactivatedVersionCommitted,
@@ -41,7 +41,7 @@ const mocks = vi.hoisted(() => {
  }
 })

-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  getSshConnectionManager: () => ({ connect: mocks.connect }),
  getSshTargetRegistryStore: () => mocks.state.store
 }))
@@ -8,7 +8,7 @@ import {
 } from '../../ssh/orcad-migration-cutover-journal'
 import { orcadMigrationCutoverFixture } from '../../ssh/orcad-migration-cutover-fixture'
 import { createManagedLifecycleHarness } from './orcad-managed-lifecycle-test-fixture'
-import { isManagedOrcadSshTarget } from '../../ssh/ssh-connection-store'
+import { isManagedOrcadSshTarget } from '../../ssh/connection/ssh-connection-store'

 const mocks = vi.hoisted(() => {
  const state: { store: unknown } = { store: null }
@@ -21,7 +21,7 @@ const mocks = vi.hoisted(() => {
  }
 })

-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
  getSshConnectionManager: () => ({ connect: mocks.connect }),
  getSshTargetRegistryStore: () => mocks.state.store
 }))
@@ -1,8 +1,8 @@
 import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { resolveOrcadRuntimeTarget } from './orcad-runtime-target'
-import { SshConnection } from '../../ssh/ssh-connection'
-import { createCallbacks, createTarget } from '../../ssh/ssh-connection-test-fixtures'
+import { SshConnection } from '../../ssh/connection/ssh-connection'
+import { createCallbacks, createTarget } from '../../ssh/connection/ssh-connection-test-fixtures'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'

@@ -10,7 +10,7 @@ import { ORCAD_STDIO_BRIDGE_MAX_CHANNELS } from './orcad-stdio-bridge-listener'
 import { OrcadStdioBridgePortForwardProvider } from './orcad-stdio-bridge-provider'
 import { spawnLocalBridgeChannel, startEchoServer } from './orcad-stdio-bridge-test-channel'
 import { ORCAD_WINDOWS_HOST_SCRIPT } from '../host-state/orcad-windows-host-script'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type { StartedPortForward } from '../../ssh/port-forwarding/ssh-port-forward-provider'
 import type { RemoteCommandChannel } from '../install/remote-install-transport'

@@ -17,7 +17,7 @@ import {
 import { listenOrcadStdioBridge } from './orcad-stdio-bridge-listener'
 import { sshOrcadHostTransport } from '../../ssh/orcad-ssh-host-transport'
 import type { RemoteCommandChannel } from '../install/remote-install-transport'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type {
  PortForwardStartOptions,
  SshPortForwardProvider,
@@ -40,7 +40,7 @@ import {
  getOrcaProfileIndexPath,
  getOrcaProfileStateDatabaseFile
 } from '../orca-profiles/profile-storage-paths'
-import type { SshConnection } from '../ssh/ssh-connection'
+import type { SshConnection } from '../ssh/connection/ssh-connection'
 import {
  emptyOrcadActivationRecord,
  orcadGcPinnedDirNames
@@ -22,8 +22,8 @@ import {
  advanceSshConnectionGeneration,
  assertSshMutationExpectation,
  resetSshConnectionGenerations
-} from './ssh/ssh-connection-generation'
-import { getRuntimeOwnedSshTargetId } from './ssh/ssh-connection-store'
+} from './ssh/connection/ssh-connection-generation'
+import { getRuntimeOwnedSshTargetId } from './ssh/connection/ssh-connection-store'
 import {
  _getLocalWorktreeScanGenerationCacheSize,
  getLocalWorktreeScanGeneration,
--- a/Show More
+++ b/Show More