diff --git a/.github/workflows/ssh-hostile-hosts.yml b/.github/workflows/ssh-hostile-hosts.yml
index 8b1f7f7688c..9a531bf45bf 100644
--- a/.github/workflows/ssh-hostile-hosts.yml
+++ b/.github/workflows/ssh-hostile-hosts.yml
@@ -27,7 +27,8 @@ on:
       - 'config/scripts/verify-packaged-orcad-template.cjs'
       - 'config/patches/node-pty*'
       # The deploy runs over this SSH transport.
-      - 'src/main/ssh/ssh-connection*'
+      - 'src/main/ssh/connection/**'
+      - 'src/main/ssh/ssh-connection-utils.ts'
       - '!src/**/*.test.ts'
       - 'src/main/ssh/hostile-host-test-support/ssh-hostile-hosts.docker.test.ts'
       - '.github/workflows/ssh-hostile-hosts.yml'
diff --git a/.github/workflows/ssh-windows-hosts.yml b/.github/workflows/ssh-windows-hosts.yml
index 87c9f837803..0bd5172460c 100644
--- a/.github/workflows/ssh-windows-hosts.yml
+++ b/.github/workflows/ssh-windows-hosts.yml
@@ -43,7 +43,8 @@ on:
       - 'src/shared/windows-breakaway-launch*.ts'
       - 'src/main/ipc/ssh/ssh-host-server-*.ts'
       # The deploy runs over this SSH transport.
-      - 'src/main/ssh/ssh-connection*'
+      - 'src/main/ssh/connection/**'
+      - 'src/main/ssh/ssh-connection-utils.ts'
       - '!src/**/*.test.ts'
       - 'src/main/managed-server/host-state/orcad-windows-host-lane.test.ts'
       - 'tests/e2e/ssh-orcad-auto-convert.spec.ts'
diff --git a/config/legacy-relay-compat-tags-baseline.txt b/config/legacy-relay-compat-tags-baseline.txt
index 31905b92641..16a3bfc3fee 100644
--- a/config/legacy-relay-compat-tags-baseline.txt
+++ b/config/legacy-relay-compat-tags-baseline.txt
@@ -20,7 +20,7 @@ src/main/ssh/orcad-migration-terminal-gate.ts
 src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts
 src/main/ssh/ssh-host-server-on-connect.test.ts
 src/main/ssh/ssh-host-server-on-connect.ts
-src/main/ssh/ssh-target-orcad-preflight.ts
+src/main/ssh/targets/ssh-target-orcad-preflight.ts
 src/preload/api-types.ts
 src/preload/api/legacy-relay-bridge-api.ts
 src/renderer/src/components/terminal-pane/legacy-relay-bridge-panes.ts
diff --git a/config/main-layout-writer-baseline.txt b/config/main-layout-writer-baseline.txt
index c7b9453dfca..a2558f48639 100644
--- a/config/main-layout-writer-baseline.txt
+++ b/config/main-layout-writer-baseline.txt
@@ -71,5 +71,5 @@
 4 src/main/runtime/workspace-session-worktree-id.ts
 1 src/main/runtime/workspaces/session-hosts/get-runtime-id.ts
 2 src/main/runtime/workspaces/workspace-file-session-targets.ts
-1 src/main/ssh/ssh-target-id-migration.ts
+1 src/main/ssh/targets/ssh-target-id-migration.ts
 2 src/main/terminal-scrollback-snapshots.ts
diff --git a/config/max-lines-baseline.txt b/config/max-lines-baseline.txt
index 5e8ac38c890..10cb9ef3659 100644
--- a/config/max-lines-baseline.txt
+++ b/config/max-lines-baseline.txt
@@ -4,5 +4,5 @@
 # Regenerate/prune: pnpm check:max-lines-ratchet --prune   (removes stale entries only)
 inline src/main/ipc/worktree-remote.ts
 inline src/main/ssh/ssh-channel-multiplexer.ts
-inline src/main/ssh/ssh-connection.ts
+inline src/main/ssh/connection/ssh-connection.ts
 inline src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
diff --git a/config/process-host-direct-import-baseline.txt b/config/process-host-direct-import-baseline.txt
index 80709a6a6d5..7cb50f9826a 100644
--- a/config/process-host-direct-import-baseline.txt
+++ b/config/process-host-direct-import-baseline.txt
@@ -100,7 +100,7 @@ src/main/rate-limits/gemini-cli-oauth-extractor.ts
 src/main/runtime/windows-default-route-interfaces.ts
 src/main/runtime/windows-mobile-firewall.ts
 src/main/skills/skill-update-run.ts
-src/main/ssh/ssh-connection.ts
+src/main/ssh/connection/ssh-connection.ts
 src/main/ssh/ssh-proxy-command.ts
 src/main/ssh/system-transport/system-ssh-command.ts
 src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index d3246ec8fe2..fd1f9bb8a4b 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -3781,13 +3781,13 @@
       "invariant": "A first-install relay transfer must complete in an attempt-owned fixed staging slot before acquiring the shared version install lock. Reservation, promotion, confirmed cleanup, and stale recovery must reject path replacement, persisted-identity mismatch, POSIX symlinks, and Windows reparse points. A newly acquired install lock atomically records the execution host's boot identity; only a verified identity change or the existing stale-age proof may replace it, while legacy, missing, malformed, and unreadable identity state must retain the conservative stale fallback. Recovery examines only eight fixed slot/claim/delete names and removes at most one stale valid stage per call; eight unclaimable states fail with an explicit manual-recovery message. Split-SFTP hosts must prove the stage identity on the exact transfer session, only payload contents may be promoted under the shared lock, and cancellation must boundedly join SFTP, stream, local file-handle, and transfer settlement.",
       "oracle": "Pause a real ssh2 SFTP relay.js write after one remotely acknowledged chunk, prove the remote file is partial, abort the live transfer, and require no shared .install-lock, leaked local descriptor, or foreign-process termination. Separately inject two unconfirmed cancellations, require an independent deployment to install, launch, answer relay RPC, and read a real repository HEAD. Keep a fresh install lock on the current POSIX or Windows boot and require takeover to fail; replace its bounded identity with a prior-boot value and race concurrent recoverers, requiring exactly one atomic winner, a current successor identity, and no tombstone residue; omit the marker and require the legacy lock to remain fenced. Replace one retained fixed slot with an old-mtime same-owner directory while preserving the original, add a fixed-slot POSIX symlink, and require installed-path recovery to skip both while reclaiming a valid stale slot behind them. Add 15,197 unrelated relay-shaped names and run the real version GC, requiring bounded stdout and no removal. Unit and wire contracts cover exact POSIX and native PowerShell 0/1/7/8/9+ quota behavior, no-follow identity fencing, payload symlink/reparse rejection, one-item repeated draining, zero lock acquisition before upload settlement, joined transfer/channel teardown including never-settling failures, SFTP redirection, package.json namespace ownership, promotion only after the lock, cross-version isolation, and system-SSH behavior.",
       "commands": [
-        "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts"
+        "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/connection/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts"
       ],
       "testFiles": [
         "src/main/ssh/sftp-upload.test.ts",
         "src/main/ssh/ssh-file-transfer-abort.test.ts",
         "src/main/ssh/sftp-namespace-resolution.test.ts",
-        "src/main/ssh/ssh-connection-sftp-wire.test.ts",
+        "src/main/ssh/connection/ssh-connection-sftp-wire.test.ts",
         "src/main/ssh/ssh-remote-commands.test.ts"
       ],
       "assertionRefs": [
@@ -3817,7 +3817,7 @@
           "date": "2026-07-31",
           "runner": "local",
           "platform": "macos",
-          "command": "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts",
+          "command": "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/connection/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts",
           "result": "passed",
           "durationSeconds": 57.9,
           "summary": "Eleven focused files passed 152 tests with 3 platform skips using exact POSIX sh, native ARM macOS PowerShell 7.6.4, real ssh2 split-SFTP wire sessions, fixed-slot identity races, bounded recovery, joined cancellation teardown, and cross-version isolation."
@@ -4465,7 +4465,7 @@
         "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/watched-worktree-catalog-notification.test.ts src/main/runtime/external-worktree-paired-client-discovery.integration.test.ts src/main/window/attach-main-window-services.test.ts",
         "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-external-worktree-discovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/connection/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts --reporter=dot"
       ],
       "testFiles": [
@@ -4481,7 +4481,7 @@
         "src/main/window/attach-main-window-services.test.ts",
         "tests/e2e/paired-external-worktree-discovery.spec.ts",
         "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
-        "src/main/ssh/ssh-connection-generation.test.ts",
+        "src/main/ssh/connection/ssh-connection-generation.test.ts",
         "src/main/ssh/ssh-provider-authority.test.ts"
       ],
       "assertionRefs": [
@@ -4581,7 +4581,7 @@
           ]
         },
         {
-          "file": "src/main/ssh/ssh-connection-generation.test.ts",
+          "file": "src/main/ssh/connection/ssh-connection-generation.test.ts",
           "assertions": [
             "one exhausted target rolls the process generation scope and invalidates every sibling target token",
             "old-scope mutation expectations fail while the new-scope authority continues rotating"
@@ -4609,7 +4609,7 @@
           "date": "2026-07-27",
           "runner": "local",
           "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/connection/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
           "result": "passed",
           "durationSeconds": 1.61,
           "summary": "Three main-process catalog and authority files passed with 118 tests, including contradictory catalog provenance rejection and all-target generation-scope revocation. The third file, src/main/ipc/repos-remote.test.ts, was later deleted with the SSH repo IPC handlers."
@@ -13108,7 +13108,7 @@
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/hooks/direct-ssh-state-routing.test.ts src/renderer/src/components/terminal-pane/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot",
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ipc/worktrees-lineage-hydration.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/ssh-connection-manager.test.ts src/main/ssh/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ipc/worktrees-lineage-hydration.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot",
         "pnpm exec electron-vite build --mode e2e",
         "pnpm run build:web-from-renderer",
         "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
@@ -13155,8 +13155,8 @@
         "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts",
         "src/main/ipc/worktrees-lineage-hydration.test.ts",
         "src/main/runtime/public-ssh-state.test.ts",
-        "src/main/ssh/ssh-connection-manager.test.ts",
-        "src/main/ssh/ssh-connection.test.ts",
+        "src/main/ssh/connection/ssh-connection-manager.test.ts",
+        "src/main/ssh/connection/ssh-connection.test.ts",
         "src/main/ssh/ssh-provider-authority.test.ts",
         "src/preload/ssh-authority-forwarding.test.ts",
         "src/renderer/src/runtime/runtime-client-events.test.ts",
@@ -13318,13 +13318,13 @@
           ]
         },
         {
-          "file": "src/main/ssh/ssh-connection-manager.test.ts",
+          "file": "src/main/ssh/connection/ssh-connection-manager.test.ts",
           "assertions": [
             "disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement"
           ]
         },
         {
-          "file": "src/main/ssh/ssh-connection.test.ts",
+          "file": "src/main/ssh/connection/ssh-connection.test.ts",
           "assertions": [
             "late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state"
           ]
diff --git a/config/scripts/ci-shard-timings.json b/config/scripts/ci-shard-timings.json
index 381b6d63a91..eea6662952b 100644
--- a/config/scripts/ci-shard-timings.json
+++ b/config/scripts/ci-shard-timings.json
@@ -5692,7 +5692,7 @@
       "src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts": 2252,
       "src/main/managed-server/install/remote-node-runtime-store-windows.test.ts": 7184,
       "src/main/managed-server/install/remote-versioned-install.test.ts": 283,
-      "src/main/ssh/removed-ssh-target-tombstone-retention.test.ts": 72,
+      "src/main/ssh/targets/removed-ssh-target-tombstone-retention.test.ts": 72,
       "src/main/ssh/runtime-ssh-access-verification.test.ts": 290,
       "src/main/ssh/runtime-ssh-access.test.ts": 621,
       "src/main/ssh/sftp-namespace-resolution.test.ts": 66,
@@ -5712,30 +5712,30 @@
       "src/main/ssh/config/ssh-config-parser.test.ts": 331,
       "src/main/ssh/config/ssh-config-resolver.test.ts": 40,
       "src/main/ssh/ssh-connect-attempt-cancellation.test.ts": 85,
-      "src/main/ssh/ssh-connection-attribution.test.ts": 34,
-      "src/main/ssh/ssh-connection-auth-fallback.test.ts": 269,
-      "src/main/ssh/ssh-connection-channel-error.test.ts": 142,
-      "src/main/ssh/ssh-connection-channel-lifetime.test.ts": 58,
-      "src/main/ssh/ssh-connection-channel-open.test.ts": 930,
-      "src/main/ssh/ssh-connection-direct-startup.test.ts": 128,
-      "src/main/ssh/ssh-connection-file-transfer.test.ts": 142,
-      "src/main/ssh/ssh-connection-generation.test.ts": 41,
-      "src/main/ssh/ssh-connection-github-probe.test.ts": 174,
-      "src/main/ssh/ssh-connection-gssapi-fallback.test.ts": 237,
-      "src/main/ssh/ssh-connection-host-key-store-wiring.test.ts": 524,
-      "src/main/ssh/ssh-connection-host-key-verification.test.ts": 216,
-      "src/main/ssh/ssh-connection-manager-registry.test.ts": 402,
-      "src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts": 522,
-      "src/main/ssh/ssh-connection-manager.test.ts": 274,
-      "src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts": 254,
-      "src/main/ssh/ssh-connection-reconnect-ladder.test.ts": 354,
-      "src/main/ssh/ssh-connection-sftp-namespace.test.ts": 1227,
-      "src/main/ssh/ssh-connection-sftp-wire.test.ts": 254,
-      "src/main/ssh/ssh-connection-store-orcad-ownership.test.ts": 293,
-      "src/main/ssh/ssh-connection-store.test.ts": 337,
-      "src/main/ssh/ssh-connection-system-transport.test.ts": 206,
+      "src/main/ssh/connection/ssh-connection-attribution.test.ts": 34,
+      "src/main/ssh/connection/ssh-connection-auth-fallback.test.ts": 269,
+      "src/main/ssh/connection/ssh-connection-channel-error.test.ts": 142,
+      "src/main/ssh/connection/ssh-connection-channel-lifetime.test.ts": 58,
+      "src/main/ssh/connection/ssh-connection-channel-open.test.ts": 930,
+      "src/main/ssh/connection/ssh-connection-direct-startup.test.ts": 128,
+      "src/main/ssh/connection/ssh-connection-file-transfer.test.ts": 142,
+      "src/main/ssh/connection/ssh-connection-generation.test.ts": 41,
+      "src/main/ssh/connection/ssh-connection-github-probe.test.ts": 174,
+      "src/main/ssh/connection/ssh-connection-gssapi-fallback.test.ts": 237,
+      "src/main/ssh/connection/ssh-connection-host-key-store-wiring.test.ts": 524,
+      "src/main/ssh/connection/ssh-connection-host-key-verification.test.ts": 216,
+      "src/main/ssh/connection/ssh-connection-manager-registry.test.ts": 402,
+      "src/main/ssh/connection/ssh-connection-manager-sign-in-reuse.test.ts": 522,
+      "src/main/ssh/connection/ssh-connection-manager.test.ts": 274,
+      "src/main/ssh/connection/ssh-connection-reconnect-handshake-loss.test.ts": 254,
+      "src/main/ssh/connection/ssh-connection-reconnect-ladder.test.ts": 354,
+      "src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts": 1227,
+      "src/main/ssh/connection/ssh-connection-sftp-wire.test.ts": 254,
+      "src/main/ssh/connection/ssh-connection-store-orcad-ownership.test.ts": 293,
+      "src/main/ssh/connection/ssh-connection-store.test.ts": 337,
+      "src/main/ssh/connection/ssh-connection-system-transport.test.ts": 206,
       "src/main/ssh/ssh-connection-utils.test.ts": 244,
-      "src/main/ssh/ssh-connection.test.ts": 1226,
+      "src/main/ssh/connection/ssh-connection.test.ts": 1226,
       "src/main/ssh/ssh-control-socket.test.ts": 50,
       "src/main/ssh/ssh-credential-decline.test.ts": 252,
       "src/main/ssh/ssh-exec-rc-stdout-noise.test.ts": 260,
@@ -5804,11 +5804,11 @@
       "src/main/ssh/ssh-session-limit-error.test.ts": 27,
       "src/main/ssh/system-transport/system-ssh-operations.test.ts": 275,
       "src/main/ssh/ssh-system-transport.integration.test.ts": 277,
-      "src/main/ssh/ssh-target-id-migration.test.ts": 46,
-      "src/main/ssh/ssh-target-orcad-claims.test.ts": 306,
-      "src/main/ssh/ssh-target-orcad-dependents.test.ts": 269,
-      "src/main/ssh/ssh-target-orcad-preflight.test.ts": 1582,
-      "src/main/ssh/ssh-target-readoption.test.ts": 52,
+      "src/main/ssh/targets/ssh-target-id-migration.test.ts": 46,
+      "src/main/ssh/targets/ssh-target-orcad-claims.test.ts": 306,
+      "src/main/ssh/targets/ssh-target-orcad-dependents.test.ts": 269,
+      "src/main/ssh/targets/ssh-target-orcad-preflight.test.ts": 1582,
+      "src/main/ssh/targets/ssh-target-readoption.test.ts": 52,
       "src/main/ssh/ssh-tcp-forwarding-probe.test.ts": 810,
       "src/main/ssh/ssh-windows-host-cells.test.ts": 39,
       "src/main/ssh/port-forwarding/ssh2-port-forward-listen.test.ts": 30,
diff --git a/config/scripts/orcad-e2e-change-scope.test.mjs b/config/scripts/orcad-e2e-change-scope.test.mjs
index e1f90ff537e..c2f1849ff2f 100644
--- a/config/scripts/orcad-e2e-change-scope.test.mjs
+++ b/config/scripts/orcad-e2e-change-scope.test.mjs
@@ -161,8 +161,14 @@ it('re-includes the real WSL distro root after excluding unit tests', () => {
 
 // Each remote host lane executes these sources, so a change to one must start the lane.
 describe.each([
-  ['hostileHosts', ['src/main/ssh/ssh-connection.ts', 'src/main/ssh/ssh-connection-utils.ts']],
-  ['windowsHosts', ['src/main/ssh/ssh-connection.ts', 'src/main/ssh/ssh-connection-utils.ts']],
+  [
+    'hostileHosts',
+    ['src/main/ssh/connection/ssh-connection.ts', 'src/main/ssh/ssh-connection-utils.ts']
+  ],
+  [
+    'windowsHosts',
+    ['src/main/ssh/connection/ssh-connection.ts', 'src/main/ssh/ssh-connection-utils.ts']
+  ],
   ['wsl', ['src/main/orcad/orcad-wsl-host-login-environment.ts']]
 ])('%s remote transport routing', (lane, sources) => {
   const paths = workflows[lane].on.pull_request.paths
diff --git a/config/scripts/pr-e2e-route-contracts.test.mjs b/config/scripts/pr-e2e-route-contracts.test.mjs
index d4841f1de49..57599eb255f 100644
--- a/config/scripts/pr-e2e-route-contracts.test.mjs
+++ b/config/scripts/pr-e2e-route-contracts.test.mjs
@@ -468,7 +468,7 @@ describe('orcad-e2e-routing', () => {
           'src/main/ipc/ssh/ssh-connection-handlers.ts',
           'src/main/ipc/runtime-environments/runtime-environment-connectivity-handlers.ts',
           'src/main/ipc/runtime-environments/runtime-environment-manual-disconnect.ts',
-          'src/main/ssh/ssh-connection-manager.ts',
+          'src/main/ssh/connection/ssh-connection-manager.ts',
           'src/main/ssh/ssh-user-disconnect.ts',
           'src/renderer/src/runtime/web-session-close-intent.ts',
           'src/renderer/src/runtime/web-session-close-replay.ts'
@@ -503,7 +503,7 @@ describe('managed-SSH remote sources routing', () => {
       'src/main/ipc/ssh/ssh.ts',
       'src/cli/runtime/serve-orcad-launch.ts',
       'src/main/orcad/orcad-entry.ts',
-      'src/main/ssh/ssh-connection.ts',
+      'src/main/ssh/connection/ssh-connection.ts',
       'src/main/ipc/runtime-environments/runtime-environment-status-probe.ts',
       'src/main/ipc/runtime-environments/orcad-runtime-lifecycle-handlers.ts',
       'src/shared/protocol-version.ts',
@@ -520,7 +520,7 @@ describe('managed-SSH remote sources routing', () => {
 
   it('leaves unit tests and local-only sources alone', () => {
     for (const file of [
-      'src/main/ssh/ssh-connection.test.ts',
+      'src/main/ssh/connection/ssh-connection.test.ts',
       'src/main/ipc/ssh/ssh.test.ts',
       'src/main/daemon/daemon-server.ts',
       'src/main/runtime/rpc/methods/accounts.ts',
diff --git a/config/scripts/pr-e2e-source-routing.mjs b/config/scripts/pr-e2e-source-routing.mjs
index 59797779c16..321e5543067 100644
--- a/config/scripts/pr-e2e-source-routing.mjs
+++ b/config/scripts/pr-e2e-source-routing.mjs
@@ -248,7 +248,7 @@ export const PR_E2E_SOURCE_ROUTES = [
         file
       ) ||
       (isProductSource(file) &&
-        /^src\/(?:main\/(?:ssh|managed-server\/[a-z-]+)\/orcad-managed-|main\/ipc\/(?:ssh\/)?ssh-port-forward|main\/(?:ipc\/(?:(?:ssh\/)?ssh-(?:connect-flow|connection-handlers|host-user-disconnect|session-teardown)|(?:runtime-environments\/)?runtime-environment-(?:connectivity-handlers|manual-disconnect))|ssh\/ssh-(?:connection-manager|user-disconnect))\.ts$|renderer\/src\/startup\/(?:ssh-startup-reconnect|startup-ssh-connection-restore)\.ts$|renderer\/src\/runtime\/(?:web-runtime-session|web-session-close-|runtime-terminal-artifact-read\.ts$)|renderer\/src\/components\/terminal-pane\/(?:remote-runtime-|terminal-host-(?:workspace-file|file-link-existence)\.ts$))/.test(
+        /^src\/(?:main\/(?:ssh|managed-server\/[a-z-]+)\/orcad-managed-|main\/ipc\/(?:ssh\/)?ssh-port-forward|main\/(?:ipc\/(?:(?:ssh\/)?ssh-(?:connect-flow|connection-handlers|host-user-disconnect|session-teardown)|(?:runtime-environments\/)?runtime-environment-(?:connectivity-handlers|manual-disconnect))|ssh\/(?:connection\/ssh-connection-manager|ssh-user-disconnect))\.ts$|renderer\/src\/startup\/(?:ssh-startup-reconnect|startup-ssh-connection-restore)\.ts$|renderer\/src\/runtime\/(?:web-runtime-session|web-session-close-|runtime-terminal-artifact-read\.ts$)|renderer\/src\/components\/terminal-pane\/(?:remote-runtime-|terminal-host-(?:workspace-file|file-link-existence)\.ts$))/.test(
           file
         ))
   },
diff --git a/config/scripts/run-ssh-staged-upload-reliability.mjs b/config/scripts/run-ssh-staged-upload-reliability.mjs
index ca17b774bdb..9262571d698 100644
--- a/config/scripts/run-ssh-staged-upload-reliability.mjs
+++ b/config/scripts/run-ssh-staged-upload-reliability.mjs
@@ -5,7 +5,7 @@ const defaultFiles = [
   'src/main/ssh/ssh-file-transfer-abort.test.ts',
   'src/main/ssh/ssh-relay-install-namespace.test.ts',
   'src/main/ssh/sftp-namespace-resolution.test.ts',
-  'src/main/ssh/ssh-connection-sftp-wire.test.ts',
+  'src/main/ssh/connection/ssh-connection-sftp-wire.test.ts',
   'src/main/ssh/ssh-remote-commands.test.ts'
 ]
 
diff --git a/config/scripts/vitest-sqlite-runtime-files.mjs b/config/scripts/vitest-sqlite-runtime-files.mjs
index 9770c655956..3a5999de9de 100644
--- a/config/scripts/vitest-sqlite-runtime-files.mjs
+++ b/config/scripts/vitest-sqlite-runtime-files.mjs
@@ -298,7 +298,7 @@ export const SQLITE_RUNTIME_INCLUDE = [
   'src/main/ssh/orcad-migration-stuck-host-profiles.test.ts',
   'src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts',
   'src/main/ssh/orcad-unreachable-setup-release.test.ts',
-  'src/main/ssh/ssh-target-orcad-preflight.test.ts',
+  'src/main/ssh/targets/ssh-target-orcad-preflight.test.ts',
   'src/main/worktree-identity-persistence.test.ts',
   'src/main/worktree-removal-close-records.test.ts',
   'src/main/worktree-removal-session-partition-fencing.test.ts',
diff --git a/src/main/automations/external-automation-owner-guard.ts b/src/main/automations/external-automation-owner-guard.ts
index c8b28f90c85..5fe98e3c426 100644
--- a/src/main/automations/external-automation-owner-guard.ts
+++ b/src/main/automations/external-automation-owner-guard.ts
@@ -23,7 +23,10 @@ import type {
   ExternalAutomationTarget
 } from '../../shared/automations-types'
 import type { SshTarget } from '../../shared/ssh-types'
-import { isManagedOrcadSshTarget, isRuntimeOwnedSshTarget } from '../ssh/ssh-connection-store'
+import {
+  isManagedOrcadSshTarget,
+  isRuntimeOwnedSshTarget
+} from '../ssh/connection/ssh-connection-store'
 
 /** Current SSH registrations, hidden ones included so the guard can reject them itself. */
 export type DesktopSshTargetRegistry = {
diff --git a/src/main/automations/precheck-runner.test.ts b/src/main/automations/precheck-runner.test.ts
index 3c6405761d9..3a0b6243ae1 100644
--- a/src/main/automations/precheck-runner.test.ts
+++ b/src/main/automations/precheck-runner.test.ts
@@ -12,7 +12,7 @@ const sshManagerState = vi.hoisted(() => ({
   }
 }))
 
-vi.mock('../ssh/ssh-target-registry', () => ({
+vi.mock('../ssh/targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => sshManagerState.manager
 }))
 
diff --git a/src/main/automations/precheck-runner.ts b/src/main/automations/precheck-runner.ts
index bf777d02af1..5437f9fa5e4 100644
--- a/src/main/automations/precheck-runner.ts
+++ b/src/main/automations/precheck-runner.ts
@@ -2,7 +2,7 @@ import { spawn, type ChildProcess } from 'node:child_process'
 import type { ClientChannel } from 'ssh2'
 import type { AutomationPrecheck, AutomationPrecheckResult } from '../../shared/automations-types'
 import { MAX_AUTOMATION_PRECHECK_OUTPUT_CHARS } from '../../shared/automation-precheck'
-import { getSshConnectionManager } from '../ssh/ssh-target-registry'
+import { getSshConnectionManager } from '../ssh/targets/ssh-target-registry'
 import { shellEscape } from '../ssh/ssh-connection-utils'
 import { admitSelfInitiatedTreeKill } from '../own-chromium-tree-kill-guard'
 import { errorMessage } from '../../shared/error-message'
diff --git a/src/main/browser/browser-network-execution-route-dispatch.ts b/src/main/browser/browser-network-execution-route-dispatch.ts
index dd8902261c5..5f52a1e0577 100644
--- a/src/main/browser/browser-network-execution-route-dispatch.ts
+++ b/src/main/browser/browser-network-execution-route-dispatch.ts
@@ -22,7 +22,7 @@ export const resolveBrowserNetworkExecutionRoute: BrowserNetworkExecutionRouteRe
     return wslRoute.resolveWslBrowserNetworkExecutionRoute(context)
   }
   const [{ getSshConnectionManager }, authority, sshRoute] = await Promise.all([
-    import('../ssh/ssh-target-registry'),
+    import('../ssh/targets/ssh-target-registry'),
     import('../ssh/ssh-provider-authority'),
     import('./ssh-browser-network-execution-route')
   ])
diff --git a/src/main/browser/ssh-browser-network-execution-route.test.ts b/src/main/browser/ssh-browser-network-execution-route.test.ts
index f8cf0d1a5ea..6be328e131f 100644
--- a/src/main/browser/ssh-browser-network-execution-route.test.ts
+++ b/src/main/browser/ssh-browser-network-execution-route.test.ts
@@ -3,7 +3,7 @@ import type { ChildProcess } from 'node:child_process'
 import { createServer, type AddressInfo } from 'node:net'
 import { PassThrough } from 'node:stream'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../ssh/ssh-connection'
+import type { SshConnection } from '../ssh/connection/ssh-connection'
 import type { SshProviderEpoch } from '../../shared/ssh-types'
 import { resolveSshBrowserNetworkExecutionRoute } from './ssh-browser-network-execution-route'
 
diff --git a/src/main/browser/ssh-browser-network-execution-route.ts b/src/main/browser/ssh-browser-network-execution-route.ts
index 96abc6952bd..0f78f152493 100644
--- a/src/main/browser/ssh-browser-network-execution-route.ts
+++ b/src/main/browser/ssh-browser-network-execution-route.ts
@@ -1,6 +1,6 @@
 import type { DirectSshAuthority, SshProviderEpoch } from '../../shared/ssh-types'
-import type { SshConnection } from '../ssh/ssh-connection'
-import type { SshConnectionManager } from '../ssh/ssh-connection-manager'
+import type { SshConnection } from '../ssh/connection/ssh-connection'
+import type { SshConnectionManager } from '../ssh/connection/ssh-connection-manager'
 import type { Client as SshClient } from 'ssh2'
 import {
   startSystemSshDynamicForwardProcess,
diff --git a/src/main/ephemeral-vm-runtime-ssh.test.ts b/src/main/ephemeral-vm-runtime-ssh.test.ts
index 822ffc7a3c3..6e576d2bac3 100644
--- a/src/main/ephemeral-vm-runtime-ssh.test.ts
+++ b/src/main/ephemeral-vm-runtime-ssh.test.ts
@@ -5,7 +5,7 @@ const mocks = vi.hoisted(() => ({
   remove: vi.fn(async () => {})
 }))
 
-vi.mock('./ssh/ssh-target-registry', () => ({
+vi.mock('./ssh/targets/ssh-target-registry', () => ({
   connectRegisteredSshTarget: mocks.connect
 }))
 vi.mock('./ipc/ssh/ssh', () => ({
diff --git a/src/main/ephemeral-vm-runtime-ssh.ts b/src/main/ephemeral-vm-runtime-ssh.ts
index 7acaacc9a98..99cd4103abc 100644
--- a/src/main/ephemeral-vm-runtime-ssh.ts
+++ b/src/main/ephemeral-vm-runtime-ssh.ts
@@ -1,5 +1,5 @@
 import { getSshConnectionStore } from './ipc/ssh/ssh'
-import { connectRegisteredSshTarget } from './ssh/ssh-target-registry'
+import { connectRegisteredSshTarget } from './ssh/targets/ssh-target-registry'
 import {
   disconnectRegisteredSshTarget,
   removeRegisteredSshTarget
diff --git a/src/main/ipc/desktop-browser-bridge-wiring.test.ts b/src/main/ipc/desktop-browser-bridge-wiring.test.ts
index f3105eb3139..5f5dfd0d43e 100644
--- a/src/main/ipc/desktop-browser-bridge-wiring.test.ts
+++ b/src/main/ipc/desktop-browser-bridge-wiring.test.ts
@@ -13,7 +13,7 @@ vi.mock('./ssh/ssh-ipc-context', () => ({ persistedStore: null }))
 vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
   ensureOrcadManagedTunnel: vi.fn()
 }))
-vi.mock('../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../ssh/targets/ssh-target-registry', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   getSshTargetRegistryStore: () => ({ listTargets: () => targets })
 }))
diff --git a/src/main/ipc/desktop-browser-bridge-wiring.ts b/src/main/ipc/desktop-browser-bridge-wiring.ts
index 90019e546a3..d7537233422 100644
--- a/src/main/ipc/desktop-browser-bridge-wiring.ts
+++ b/src/main/ipc/desktop-browser-bridge-wiring.ts
@@ -31,8 +31,8 @@ import type { OrcaRuntimeService } from '../runtime/orca-runtime'
 import { RpcDispatcher } from '../runtime/rpc/dispatcher'
 import { ALL_RPC_METHODS } from '../runtime/rpc/methods'
 import { ensureOrcadManagedTunnel } from '../managed-server/lifecycle/orcad-managed-tunnel'
-import { getSshTargetRegistryStore } from '../ssh/ssh-target-registry'
-import type { SshConnectionManager } from '../ssh/ssh-connection-manager'
+import { getSshTargetRegistryStore } from '../ssh/targets/ssh-target-registry'
+import type { SshConnectionManager } from '../ssh/connection/ssh-connection-manager'
 import { getRuntimeEnvironmentStatus } from './runtime-environments/runtime-environment-status-probe'
 import { isRuntimeEnvironmentManuallyDisconnected } from './runtime-environments/runtime-environment-connectivity-handlers'
 import { setDesktopBrowserBridgeControl } from './desktop-browser-bridge-reconcile'
diff --git a/src/main/ipc/filesystem-mutations.test.ts b/src/main/ipc/filesystem-mutations.test.ts
index 199e029e178..4aaf23bc9ab 100644
--- a/src/main/ipc/filesystem-mutations.test.ts
+++ b/src/main/ipc/filesystem-mutations.test.ts
@@ -32,7 +32,7 @@ import { registerFilesystemMutationHandlers } from './filesystem-mutations'
 import {
   resetSshConnectionGenerations,
   setSshConnectionGeneration
-} from '../ssh/ssh-connection-generation'
+} from '../ssh/connection/ssh-connection-generation'
 
 // Why: paths are resolved via path.resolve() in production code, so test
 // data must use resolved paths to avoid Unix-vs-Windows mismatches.
diff --git a/src/main/ipc/filesystem-mutations.ts b/src/main/ipc/filesystem-mutations.ts
index e3c38b704c8..9c1d0951a38 100644
--- a/src/main/ipc/filesystem-mutations.ts
+++ b/src/main/ipc/filesystem-mutations.ts
@@ -12,7 +12,7 @@ import type { LocalFileAccess } from '../../shared/local-file-access'
 import { SshHostNotServedError } from '../providers/ssh-host-not-served-error'
 import { resolveLocalDroppedPathsForAgent } from './dropped-path-resolution'
 import type { SshMutationExpectation } from '../../shared/ssh-types'
-import { assertSshMutationExpectation } from '../ssh/ssh-connection-generation'
+import { assertSshMutationExpectation } from '../ssh/connection/ssh-connection-generation'
 import { renameLocalPathSerializedByDestination } from '../destination-serialized-local-rename'
 import { assertNotExists, rethrowWithUserMessage } from './filesystem-create-path-guards'
 import type {
diff --git a/src/main/ipc/filesystem/filesystem-write-handlers.ts b/src/main/ipc/filesystem/filesystem-write-handlers.ts
index 6bf20868f28..138b9b89b2d 100644
--- a/src/main/ipc/filesystem/filesystem-write-handlers.ts
+++ b/src/main/ipc/filesystem/filesystem-write-handlers.ts
@@ -1,7 +1,7 @@
 import { ipcMain, shell } from 'electron'
 import { lstat, writeFile } from 'node:fs/promises'
 import type { SshMutationExpectation } from '../../../shared/ssh-types'
-import { assertSshMutationExpectation } from '../../ssh/ssh-connection-generation'
+import { assertSshMutationExpectation } from '../../ssh/connection/ssh-connection-generation'
 import { SshHostNotServedError } from '../../providers/ssh-host-not-served-error'
 import { tryDeleteWslUncPath } from '../../wsl-unc-delete'
 import type { LocalFileAccess } from '../../../shared/local-file-access'
diff --git a/src/main/ipc/managed-host-status-publication.test.ts b/src/main/ipc/managed-host-status-publication.test.ts
index e885368d705..d779e99c77b 100644
--- a/src/main/ipc/managed-host-status-publication.test.ts
+++ b/src/main/ipc/managed-host-status-publication.test.ts
@@ -9,7 +9,7 @@ vi.mock('./ssh/ssh-ipc-context', () => ({
   persistedStore: null,
   portForwardManager: null
 }))
-vi.mock('../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../ssh/targets/ssh-target-registry', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   getSshTargetRegistryStore: () => null
 }))
diff --git a/src/main/ipc/runtime-environments/orcad-leave-behind-handlers.ts b/src/main/ipc/runtime-environments/orcad-leave-behind-handlers.ts
index 50ed345090c..780cdade1b3 100644
--- a/src/main/ipc/runtime-environments/orcad-leave-behind-handlers.ts
+++ b/src/main/ipc/runtime-environments/orcad-leave-behind-handlers.ts
@@ -1,6 +1,6 @@
 /** IPC for "Move anyway": the user confirms that saved state a move can't carry stays on this desktop. */
 import { ipcMain } from 'electron'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { requiredString } from './orcad-runtime-lifecycle-handlers'
 
 export function registerOrcadLeaveBehindHandlers(): void {
diff --git a/src/main/ipc/runtime-environments/runtime-environment-managed-host-disconnect.test.ts b/src/main/ipc/runtime-environments/runtime-environment-managed-host-disconnect.test.ts
index 98425963956..ddbf6062f5a 100644
--- a/src/main/ipc/runtime-environments/runtime-environment-managed-host-disconnect.test.ts
+++ b/src/main/ipc/runtime-environments/runtime-environment-managed-host-disconnect.test.ts
@@ -36,7 +36,7 @@ vi.mock('./runtime-environment-status-probe', () => ({
   getRuntimeEnvironmentStatus: vi.fn(async () => ({ ok: true }))
 }))
 vi.mock('../ssh/ssh-session-teardown', () => ({ disconnectRegisteredSshTarget: hoisted.teardown }))
-vi.mock('../../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../../ssh/targets/ssh-target-registry', async (importOriginal) => ({
   ...(await importOriginal<object>()),
   connectRegisteredSshTarget: hoisted.connectHost
 }))
diff --git a/src/main/ipc/runtime-environments/runtime-environment-managed-tunnel.test.ts b/src/main/ipc/runtime-environments/runtime-environment-managed-tunnel.test.ts
index 69f5213fa43..b09fc72b392 100644
--- a/src/main/ipc/runtime-environments/runtime-environment-managed-tunnel.test.ts
+++ b/src/main/ipc/runtime-environments/runtime-environment-managed-tunnel.test.ts
@@ -50,7 +50,7 @@ vi.mock('../../managed-server/lifecycle/orcad-managed-update-on-restore', () =>
   redeployStoppedManagedOrcad: mocks.redeploy
 }))
 vi.mock('../../ssh/ssh-host-server-status', () => ({ setSshHostServerStatus: vi.fn() }))
-vi.mock('../../ssh/ssh-target-registry', () => ({ getSshTargetRegistryStore: () => null }))
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({ getSshTargetRegistryStore: () => null }))
 vi.mock('../ssh/ssh-ipc-context', () => ({
   connectionManager: null,
   getCurrentMainWindow: () => null
diff --git a/src/main/ipc/runtime-environments/runtime-environment-managed-tunnel.ts b/src/main/ipc/runtime-environments/runtime-environment-managed-tunnel.ts
index 50387f53f17..8324a40a49c 100644
--- a/src/main/ipc/runtime-environments/runtime-environment-managed-tunnel.ts
+++ b/src/main/ipc/runtime-environments/runtime-environment-managed-tunnel.ts
@@ -25,7 +25,7 @@ import {
   updateManagedOrcadOnRestore
 } from '../../managed-server/lifecycle/orcad-managed-update-on-restore'
 import { getSshHostServerStatus, setSshHostServerStatus } from '../../ssh/ssh-host-server-status'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { connectionManager, getCurrentMainWindow } from '../ssh/ssh-ipc-context'
 import { getWslHostService } from '../../wsl/wsl-host-service-instance'
 import { assertWslHostReachable } from '../../wsl/wsl-host-gate'
diff --git a/src/main/ipc/runtime-environments/runtime-environment-mobile-relay-hosts.test.ts b/src/main/ipc/runtime-environments/runtime-environment-mobile-relay-hosts.test.ts
index 241d29f6776..e67cda2b83d 100644
--- a/src/main/ipc/runtime-environments/runtime-environment-mobile-relay-hosts.test.ts
+++ b/src/main/ipc/runtime-environments/runtime-environment-mobile-relay-hosts.test.ts
@@ -21,7 +21,7 @@ vi.mock('../../../shared/runtime-environments', async (importOriginal) => ({
 vi.mock('./runtime-environment-managed-tunnel', () => ({
   resolveManagedRuntimeEnvironment: mocks.resolveManaged
 }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   listRegisteredSshTargets: () => mocks.sshTargets,
   getRegisteredSshState: (targetId: string) => mocks.sshStates.get(targetId)
 }))
diff --git a/src/main/ipc/runtime-environments/runtime-environment-mobile-relay-hosts.ts b/src/main/ipc/runtime-environments/runtime-environment-mobile-relay-hosts.ts
index ac3887cab7c..ab4672e3810 100644
--- a/src/main/ipc/runtime-environments/runtime-environment-mobile-relay-hosts.ts
+++ b/src/main/ipc/runtime-environments/runtime-environment-mobile-relay-hosts.ts
@@ -16,7 +16,10 @@ import type {
 } from '../../runtime/mobile-desktop-relay/mobile-desktop-relay-hosts'
 import { resolveManagedRuntimeEnvironment } from './runtime-environment-managed-tunnel'
 import type { SshConnectionState } from '../../../shared/ssh-types'
-import { getRegisteredSshState, listRegisteredSshTargets } from '../../ssh/ssh-target-registry'
+import {
+  getRegisteredSshState,
+  listRegisteredSshTargets
+} from '../../ssh/targets/ssh-target-registry'
 import { getRuntimeEnvironmentStatusSnapshots } from './runtime-environment-request-connections'
 import {
   callRuntimeEnvironment,
diff --git a/src/main/ipc/ssh/ssh-app-shutdown.test.ts b/src/main/ipc/ssh/ssh-app-shutdown.test.ts
index 798e4920d0b..76e85909cfb 100644
--- a/src/main/ipc/ssh/ssh-app-shutdown.test.ts
+++ b/src/main/ipc/ssh/ssh-app-shutdown.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
diff --git a/src/main/ipc/ssh/ssh-browse.ts b/src/main/ipc/ssh/ssh-browse.ts
index 886305158d8..808bce33151 100644
--- a/src/main/ipc/ssh/ssh-browse.ts
+++ b/src/main/ipc/ssh/ssh-browse.ts
@@ -1,5 +1,5 @@
 import { ipcMain } from 'electron'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import { browseSshDirectory, type RemoteBrowseResult } from '../../ssh/ssh-remote-directory-browse'
 
 export function registerSshBrowseHandler(
diff --git a/src/main/ipc/ssh/ssh-connect-decision-cancellation.test.ts b/src/main/ipc/ssh/ssh-connect-decision-cancellation.test.ts
index 13c3e201cfe..caf9e11e1e0 100644
--- a/src/main/ipc/ssh/ssh-connect-decision-cancellation.test.ts
+++ b/src/main/ipc/ssh/ssh-connect-decision-cancellation.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -20,8 +20,8 @@ vi.mock(import('../../ssh/legacy-relay/legacy-relay-bridge-registry'), async (im
 }))
 
 import type { SshTarget } from '../../../shared/ssh-types'
-import type { SshConnection } from '../../ssh/ssh-connection'
-import { recordSshConnectionOpened } from '../../ssh/ssh-connection-attribution'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
+import { recordSshConnectionOpened } from '../../ssh/connection/ssh-connection-attribution'
 import {
   decideHostServer,
   publishBridgedUnservedHostServer,
diff --git a/src/main/ipc/ssh/ssh-connect-flow.ts b/src/main/ipc/ssh/ssh-connect-flow.ts
index 793bfced7d7..095e1f201f8 100644
--- a/src/main/ipc/ssh/ssh-connect-flow.ts
+++ b/src/main/ipc/ssh/ssh-connect-flow.ts
@@ -6,8 +6,11 @@ import {
   isCurrentSshProviderAuthority,
   rotateSshProviderAuthority
 } from '../../ssh/ssh-provider-authority'
-import { adoptSshConnection, runAttributedToSshOwner } from '../../ssh/ssh-connection-attribution'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import {
+  adoptSshConnection,
+  runAttributedToSshOwner
+} from '../../ssh/connection/ssh-connection-attribution'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import {
   decideHostServer,
   recheckWhenManagedFenceClears,
diff --git a/src/main/ipc/ssh/ssh-connection-handlers.ts b/src/main/ipc/ssh/ssh-connection-handlers.ts
index 855571ae5fc..1623b052feb 100644
--- a/src/main/ipc/ssh/ssh-connection-handlers.ts
+++ b/src/main/ipc/ssh/ssh-connection-handlers.ts
@@ -2,7 +2,7 @@ import { ipcMain } from 'electron'
 import {
   setSshTargetRegistryHandlers,
   getSshTargetRegistryStore
-} from '../../ssh/ssh-target-registry'
+} from '../../ssh/targets/ssh-target-registry'
 import {
   assertSshConnectsNotFenced,
   connectInFlight,
diff --git a/src/main/ipc/ssh/ssh-connection-state-callbacks.ts b/src/main/ipc/ssh/ssh-connection-state-callbacks.ts
index f0f32838303..487a9d25c3e 100644
--- a/src/main/ipc/ssh/ssh-connection-state-callbacks.ts
+++ b/src/main/ipc/ssh/ssh-connection-state-callbacks.ts
@@ -1,6 +1,6 @@
 import type { SshConnectionCallbacks } from '../../ssh/ssh-connection-utils'
 import type { SshConnectionState } from '../../../shared/ssh-types'
-import { isSshHostCensusInFlight } from '../../ssh/ssh-connection-attribution'
+import { isSshHostCensusInFlight } from '../../ssh/connection/ssh-connection-attribution'
 import {
   clearSshCredentialDeclined,
   isSshCredentialDeclined
@@ -11,7 +11,7 @@ import {
   testingTargets
 } from './ssh-connect-attempt-registry'
 import { connectionManager, getCurrentMainWindow } from './ssh-ipc-context'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { recordSshSignInRequirement } from './ssh-sign-in-requirement'
 import { restoreManagedHostPortForwards } from './ssh-managed-port-forward-restore'
 import { requestCredential } from './ssh-passphrase'
diff --git a/src/main/ipc/ssh/ssh-credential-cancel.test.ts b/src/main/ipc/ssh/ssh-credential-cancel.test.ts
index 7483581988a..4b08d744374 100644
--- a/src/main/ipc/ssh/ssh-credential-cancel.test.ts
+++ b/src/main/ipc/ssh/ssh-credential-cancel.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
diff --git a/src/main/ipc/ssh/ssh-disconnect-cancellation.test.ts b/src/main/ipc/ssh/ssh-disconnect-cancellation.test.ts
index 502464e9480..825bb4ef979 100644
--- a/src/main/ipc/ssh/ssh-disconnect-cancellation.test.ts
+++ b/src/main/ipc/ssh/ssh-disconnect-cancellation.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
diff --git a/src/main/ipc/ssh/ssh-handler-reregistration.test.ts b/src/main/ipc/ssh/ssh-handler-reregistration.test.ts
index 7ec3d28ba73..11c8c9b89d4 100644
--- a/src/main/ipc/ssh/ssh-handler-reregistration.test.ts
+++ b/src/main/ipc/ssh/ssh-handler-reregistration.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
diff --git a/src/main/ipc/ssh/ssh-host-server-decision-failure.test.ts b/src/main/ipc/ssh/ssh-host-server-decision-failure.test.ts
index 1138c40d23c..61ff873feb7 100644
--- a/src/main/ipc/ssh/ssh-host-server-decision-failure.test.ts
+++ b/src/main/ipc/ssh/ssh-host-server-decision-failure.test.ts
@@ -8,7 +8,7 @@ const mocks = vi.hoisted(() => ({
 vi.mock('../../../shared/app-environment', () => ({
   getAppEnvironment: () => ({ getPath: () => '/tmp/user-data', getVersion: () => '1.5.0' })
 }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getSshTargetRegistryStore: () => ({ getTarget: mocks.getTarget })
 }))
 vi.mock('../../ssh/ssh-host-server-on-connect', () => ({
diff --git a/src/main/ipc/ssh/ssh-host-server-on-connect-wiring.test.ts b/src/main/ipc/ssh/ssh-host-server-on-connect-wiring.test.ts
index cdd5de61822..a879409d786 100644
--- a/src/main/ipc/ssh/ssh-host-server-on-connect-wiring.test.ts
+++ b/src/main/ipc/ssh/ssh-host-server-on-connect-wiring.test.ts
@@ -6,7 +6,7 @@ import type { SshTarget } from '../../../shared/ssh-types'
 import { closeTestStores, createSqliteTestStore } from '../../persistence-test-harness'
 import { Store } from '../../persistence/loading-store/store'
 import { OrcadHostUnsupportedError } from '../../orcad/orcad-host-unavailable'
-import { allowsDirectSshRelay, SshConnectionStore } from '../../ssh/ssh-connection-store'
+import { allowsDirectSshRelay, SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 import { resolveHostServerOnConnect } from '../../ssh/ssh-host-server-on-connect'
 
 const mocks = vi.hoisted(() => {
@@ -22,7 +22,7 @@ const mocks = vi.hoisted(() => {
 vi.mock('../../../shared/app-environment', () => ({
   getAppEnvironment: () => ({ getVersion: () => '1.5.0', getPath: () => '/tmp/unused' })
 }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getSshTargetRegistryStore: () => mocks.registry.current
 }))
 vi.mock('../../managed-server/lifecycle/orcad-runtime-deployment', () => ({
diff --git a/src/main/ipc/ssh/ssh-host-server-on-connect-wiring.ts b/src/main/ipc/ssh/ssh-host-server-on-connect-wiring.ts
index 2963694ea4d..60429b37b1e 100644
--- a/src/main/ipc/ssh/ssh-host-server-on-connect-wiring.ts
+++ b/src/main/ipc/ssh/ssh-host-server-on-connect-wiring.ts
@@ -30,7 +30,7 @@ import { setSshHostServerStatus } from '../../ssh/ssh-host-server-status'
 import { trackSshHostServerEvent } from '../../ssh/ssh-host-server-telemetry'
 import { knownSshHostPlatform } from '../../ssh/ssh-host-platform-memo'
 import { knownOrcadTunnelTransport } from '../../ssh/orcad-tunnel-transport-memo'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { releaseUnreachableOrcadSetup } from '../../ssh/orcad-unreachable-setup-release'
 import { getCurrentMainWindow } from './ssh-ipc-context'
 import { broadcastSshState } from './ssh-renderer-broadcast'
diff --git a/src/main/ipc/ssh/ssh-host-sleep-reconnect.test.ts b/src/main/ipc/ssh/ssh-host-sleep-reconnect.test.ts
index 082183075e2..24a54bd40ad 100644
--- a/src/main/ipc/ssh/ssh-host-sleep-reconnect.test.ts
+++ b/src/main/ipc/ssh/ssh-host-sleep-reconnect.test.ts
@@ -10,7 +10,7 @@ vi.mock('electron', async () => {
 vi.mock('../../managed-server/lifecycle/orcad-managed-tunnel', () => ({
   recoverOrcadManagedTunnelsAfterHostResume: recoverManagedTunnels
 }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({ retryStalledReconnects })
 }))
 
diff --git a/src/main/ipc/ssh/ssh-host-sleep-reconnect.ts b/src/main/ipc/ssh/ssh-host-sleep-reconnect.ts
index f81a6a10591..e4e8a4e4146 100644
--- a/src/main/ipc/ssh/ssh-host-sleep-reconnect.ts
+++ b/src/main/ipc/ssh/ssh-host-sleep-reconnect.ts
@@ -1,6 +1,6 @@
 import { powerMonitor } from 'electron'
 import { recoverOrcadManagedTunnelsAfterHostResume } from '../../managed-server/lifecycle/orcad-managed-tunnel'
-import { getSshConnectionManager } from '../../ssh/ssh-target-registry'
+import { getSshConnectionManager } from '../../ssh/targets/ssh-target-registry'
 import { errorMessage } from '../../../shared/error-message'
 
 let powerMonitorUnsubscribe: (() => void) | null = null
diff --git a/src/main/ipc/ssh/ssh-host-user-disconnect.test.ts b/src/main/ipc/ssh/ssh-host-user-disconnect.test.ts
index 1d36ae2bf77..f9540a6305b 100644
--- a/src/main/ipc/ssh/ssh-host-user-disconnect.test.ts
+++ b/src/main/ipc/ssh/ssh-host-user-disconnect.test.ts
@@ -11,9 +11,9 @@ const runtime = vi.hoisted(() => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
diff --git a/src/main/ipc/ssh/ssh-host-user-disconnect.ts b/src/main/ipc/ssh/ssh-host-user-disconnect.ts
index f3b4f20895f..607af4440d6 100644
--- a/src/main/ipc/ssh/ssh-host-user-disconnect.ts
+++ b/src/main/ipc/ssh/ssh-host-user-disconnect.ts
@@ -11,7 +11,7 @@ import {
   isSshUserDisconnected,
   recordSshUserDisconnected
 } from '../../ssh/ssh-user-disconnect'
-import { connectRegisteredSshTarget } from '../../ssh/ssh-target-registry'
+import { connectRegisteredSshTarget } from '../../ssh/targets/ssh-target-registry'
 import {
   clearRuntimeEnvironmentManualDisconnect,
   isRuntimeEnvironmentManuallyDisconnected,
diff --git a/src/main/ipc/ssh/ssh-ipc-context.ts b/src/main/ipc/ssh/ssh-ipc-context.ts
index 2c677336f5b..808ffd275dd 100644
--- a/src/main/ipc/ssh/ssh-ipc-context.ts
+++ b/src/main/ipc/ssh/ssh-ipc-context.ts
@@ -1,6 +1,6 @@
 import type { BrowserWindow } from 'electron'
 import type { Store } from '../../persistence'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 
diff --git a/src/main/ipc/ssh/ssh-managed-host-port-forward-lifecycle.test.ts b/src/main/ipc/ssh/ssh-managed-host-port-forward-lifecycle.test.ts
index 4fe64b979db..e90316e21d5 100644
--- a/src/main/ipc/ssh/ssh-managed-host-port-forward-lifecycle.test.ts
+++ b/src/main/ipc/ssh/ssh-managed-host-port-forward-lifecycle.test.ts
@@ -15,7 +15,7 @@ vi.mock('./ssh-ipc-context', () => ({
   persistedStore: null,
   portForwardManager: { removeAllForwards: h.removeAllForwards }
 }))
-vi.mock('../../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../../ssh/targets/ssh-target-registry', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   getSshTargetRegistryStore: () => null
 }))
diff --git a/src/main/ipc/ssh/ssh-managed-server-unlink-broadcast.test.ts b/src/main/ipc/ssh/ssh-managed-server-unlink-broadcast.test.ts
index b6595a738ed..347bf60d5c5 100644
--- a/src/main/ipc/ssh/ssh-managed-server-unlink-broadcast.test.ts
+++ b/src/main/ipc/ssh/ssh-managed-server-unlink-broadcast.test.ts
@@ -13,7 +13,7 @@ vi.mock('./ssh-ipc-context', () => ({
   persistedStore: null,
   portForwardManager: null
 }))
-vi.mock('../../ssh/ssh-target-registry', async (importOriginal) => ({
+vi.mock('../../ssh/targets/ssh-target-registry', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   getSshTargetRegistryStore: () => null
 }))
diff --git a/src/main/ipc/ssh/ssh-port-forward-persistence.ts b/src/main/ipc/ssh/ssh-port-forward-persistence.ts
index 6e3b4614ae0..b1b8229e143 100644
--- a/src/main/ipc/ssh/ssh-port-forward-persistence.ts
+++ b/src/main/ipc/ssh/ssh-port-forward-persistence.ts
@@ -1,6 +1,6 @@
 import type { BrowserWindow } from 'electron'
 import type { SavedPortForward } from '../../../shared/ssh-types'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { connectionManager, portForwardManager } from './ssh-ipc-context'
 import { broadcastPortForwards } from './ssh-renderer-broadcast'
 
diff --git a/src/main/ipc/ssh/ssh-port-forward-restore.test.ts b/src/main/ipc/ssh/ssh-port-forward-restore.test.ts
index f040bbb0817..82ae7323c03 100644
--- a/src/main/ipc/ssh/ssh-port-forward-restore.test.ts
+++ b/src/main/ipc/ssh/ssh-port-forward-restore.test.ts
@@ -53,7 +53,9 @@ const h = vi.hoisted(() => {
   }
 })
 
-vi.mock('../../ssh/ssh-target-registry', () => ({ getSshTargetRegistryStore: () => h.store }))
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
+  getSshTargetRegistryStore: () => h.store
+}))
 vi.mock('./ssh-ipc-context', () => ({
   connectionManager: h.connectionManager,
   portForwardManager: h.portForwardManager,
diff --git a/src/main/ipc/ssh/ssh-renderer-broadcast.ts b/src/main/ipc/ssh/ssh-renderer-broadcast.ts
index 62e4270c477..c25733dba74 100644
--- a/src/main/ipc/ssh/ssh-renderer-broadcast.ts
+++ b/src/main/ipc/ssh/ssh-renderer-broadcast.ts
@@ -11,10 +11,10 @@ import {
   enrichSshForwardEntries,
   getWorktreeIdsForConnection
 } from '../../ports/ssh-advertised-url-enrichment'
-import { isRuntimeOwnedSshTarget } from '../../ssh/ssh-connection-store'
+import { isRuntimeOwnedSshTarget } from '../../ssh/connection/ssh-connection-store'
 import { getSshProviderAuthority } from '../../ssh/ssh-provider-authority'
 import { clearSshHostServerStatus, getSshHostServerStatus } from '../../ssh/ssh-host-server-status'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import {
   connectionManager,
   currentRuntime,
diff --git a/src/main/ipc/ssh/ssh-session-teardown.ts b/src/main/ipc/ssh/ssh-session-teardown.ts
index fdd9884761d..091be92d4a0 100644
--- a/src/main/ipc/ssh/ssh-session-teardown.ts
+++ b/src/main/ipc/ssh/ssh-session-teardown.ts
@@ -1,7 +1,7 @@
 import type { DirectSshAuthority } from '../../../shared/ssh-types'
-import { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import { clearSshHostServerStatus } from '../../ssh/ssh-host-server-status'
-import { isSshConnectionSolelyOwnedBy } from '../../ssh/ssh-connection-attribution'
+import { isSshConnectionSolelyOwnedBy } from '../../ssh/connection/ssh-connection-attribution'
 import {
   connectInFlight,
   invalidateConnectAttempt,
diff --git a/src/main/ipc/ssh/ssh-sign-in-requirement.test.ts b/src/main/ipc/ssh/ssh-sign-in-requirement.test.ts
index 70e72595674..da28874ea57 100644
--- a/src/main/ipc/ssh/ssh-sign-in-requirement.test.ts
+++ b/src/main/ipc/ssh/ssh-sign-in-requirement.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
diff --git a/src/main/ipc/ssh/ssh-sign-in-requirement.ts b/src/main/ipc/ssh/ssh-sign-in-requirement.ts
index fd5ae87020e..c914150f001 100644
--- a/src/main/ipc/ssh/ssh-sign-in-requirement.ts
+++ b/src/main/ipc/ssh/ssh-sign-in-requirement.ts
@@ -1,6 +1,6 @@
 import { recordSshSignInAwaited } from '../../ssh/ssh-credential-decline'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
-import type { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
+import type { SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 import { credentialRequestedForTarget } from './ssh-connect-attempt-registry'
 
 /**
diff --git a/src/main/ipc/ssh/ssh-state-broadcast-fanout.test.ts b/src/main/ipc/ssh/ssh-state-broadcast-fanout.test.ts
index bf5304ac1f8..a2d2ef4f17e 100644
--- a/src/main/ipc/ssh/ssh-state-broadcast-fanout.test.ts
+++ b/src/main/ipc/ssh/ssh-state-broadcast-fanout.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
diff --git a/src/main/ipc/ssh/ssh-target-crud-handlers-ownership.test.ts b/src/main/ipc/ssh/ssh-target-crud-handlers-ownership.test.ts
index 10c94d14e3f..ad5d184f36d 100644
--- a/src/main/ipc/ssh/ssh-target-crud-handlers-ownership.test.ts
+++ b/src/main/ipc/ssh/ssh-target-crud-handlers-ownership.test.ts
@@ -16,7 +16,7 @@ const mocks = vi.hoisted(() => {
 })
 
 vi.mock('electron', () => ({ ipcMain: { handle: mocks.handle } }))
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getSshTargetRegistryStore: () => ({
     getTarget: () => mocks.state.target,
     addTarget: mocks.addTarget,
diff --git a/src/main/ipc/ssh/ssh-target-crud-handlers.ts b/src/main/ipc/ssh/ssh-target-crud-handlers.ts
index a8afaa773c3..93296fd77b9 100644
--- a/src/main/ipc/ssh/ssh-target-crud-handlers.ts
+++ b/src/main/ipc/ssh/ssh-target-crud-handlers.ts
@@ -14,12 +14,15 @@ import {
 import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
 import { closeOrcadManagedTunnel } from '../../managed-server/lifecycle/orcad-managed-tunnel'
 import { rotateSshProviderAuthority } from '../../ssh/ssh-provider-authority'
-import { getSshTargetRegistryStore, setSshTargetMutations } from '../../ssh/ssh-target-registry'
+import {
+  getSshTargetRegistryStore,
+  setSshTargetMutations
+} from '../../ssh/targets/ssh-target-registry'
 import {
   allowsDirectSshRelay,
   isManagedOrcadSshTarget,
   isRuntimeOwnedSshTarget
-} from '../../ssh/ssh-connection-store'
+} from '../../ssh/connection/ssh-connection-store'
 import { connectionManager, getCurrentMainWindow } from './ssh-ipc-context'
 import { runTargetLifecycle } from './ssh-target-lifecycle-queue'
 import { fingerprintRuntimeSshTarget } from '../../ssh/runtime-ssh-access'
diff --git a/src/main/ipc/ssh/ssh-target-registry.test.ts b/src/main/ipc/ssh/ssh-target-registry.test.ts
index bf13d2ebedd..2f2bf746aa3 100644
--- a/src/main/ipc/ssh/ssh-target-registry.test.ts
+++ b/src/main/ipc/ssh/ssh-target-registry.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
diff --git a/src/main/ipc/ssh/ssh.test.ts b/src/main/ipc/ssh/ssh.test.ts
index 5ab78da5fe7..d516935e220 100644
--- a/src/main/ipc/ssh/ssh.test.ts
+++ b/src/main/ipc/ssh/ssh.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -21,8 +21,11 @@ import {
   publishManagedServerConnect,
   publishUnservedHostServer
 } from './ssh-host-server-connect'
-import { beginSshHostCensus, recordSshConnectionOpened } from '../../ssh/ssh-connection-attribution'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import {
+  beginSshHostCensus,
+  recordSshConnectionOpened
+} from '../../ssh/connection/ssh-connection-attribution'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 
 const { mockSshStore, mockConnectionManager } = mocks
 
diff --git a/src/main/ipc/ssh/ssh.ts b/src/main/ipc/ssh/ssh.ts
index 00c6661512b..53f581cbddb 100644
--- a/src/main/ipc/ssh/ssh.ts
+++ b/src/main/ipc/ssh/ssh.ts
@@ -1,8 +1,8 @@
 import { ipcMain, type BrowserWindow } from 'electron'
 import type { Store } from '../../persistence'
-import { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import { SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 import { awaitSignInForCredentialHosts } from './ssh-sign-in-requirement'
-import { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import { quitTeardownStartGate } from '../../quit-teardown-start-gate'
 import {
@@ -11,7 +11,7 @@ import {
   setSshTargetMutations,
   setSshTargetRegistryHandlers,
   setSshTargetRegistryStore
-} from '../../ssh/ssh-target-registry'
+} from '../../ssh/targets/ssh-target-registry'
 
 import { registerSshBrowseHandler } from './ssh-browse'
 import { registerCredentialHandler } from './ssh-passphrase'
@@ -19,7 +19,7 @@ import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import {
   initializeSshConnectionGenerationSession,
   resetSshConnectionGenerations
-} from '../../ssh/ssh-connection-generation'
+} from '../../ssh/connection/ssh-connection-generation'
 import { resetSshProviderAuthorities } from '../../ssh/ssh-provider-authority'
 import { installManagedOrcadStartStatus } from '../runtime-environments/runtime-environment-managed-tunnel'
 import {
diff --git a/src/main/managed-server/host-state/orcad-windows-host-lane.test.ts b/src/main/managed-server/host-state/orcad-windows-host-lane.test.ts
index 60fcbea13a9..86de76f573b 100644
--- a/src/main/managed-server/host-state/orcad-windows-host-lane.test.ts
+++ b/src/main/managed-server/host-state/orcad-windows-host-lane.test.ts
@@ -12,7 +12,7 @@ import { afterAll, beforeAll, describe, expect, it, vi, type MockInstance } from
 
 vi.mock('electron', () => ({ app: { getAppPath: () => process.cwd() } }))
 
-import { SshConnection } from '../../ssh/ssh-connection'
+import { SshConnection } from '../../ssh/connection/ssh-connection'
 import {
   connectHostileHost,
   installHostileHostAppEnvironment
diff --git a/src/main/managed-server/install/remote-install-gc-claim-termination.test.ts b/src/main/managed-server/install/remote-install-gc-claim-termination.test.ts
index 360c3cae0a0..0770f89b7cf 100644
--- a/src/main/managed-server/install/remote-install-gc-claim-termination.test.ts
+++ b/src/main/managed-server/install/remote-install-gc-claim-termination.test.ts
@@ -6,7 +6,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
   execCommand: vi.fn()
 }))
 
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import {
   isRelayGcClaimOwned,
diff --git a/src/main/managed-server/install/remote-install-gc-listing.test-fixture.ts b/src/main/managed-server/install/remote-install-gc-listing.test-fixture.ts
index e5b4c070463..41cd2109c42 100644
--- a/src/main/managed-server/install/remote-install-gc-listing.test-fixture.ts
+++ b/src/main/managed-server/install/remote-install-gc-listing.test-fixture.ts
@@ -5,7 +5,7 @@ import { join } from 'node:path'
 import { PassThrough } from 'node:stream'
 import type { ClientChannel } from 'ssh2'
 import { runProcess, spawnProcess } from '@orca/process-host'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 
diff --git a/src/main/managed-server/install/remote-install-gc-termination.test.ts b/src/main/managed-server/install/remote-install-gc-termination.test.ts
index d4e8fca9eca..985cf59ef49 100644
--- a/src/main/managed-server/install/remote-install-gc-termination.test.ts
+++ b/src/main/managed-server/install/remote-install-gc-termination.test.ts
@@ -6,7 +6,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
   execCommand: vi.fn()
 }))
 
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { gcOldRemoteInstallVersions } from './remote-install-gc'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
diff --git a/src/main/managed-server/install/remote-install-lock-termination.test.ts b/src/main/managed-server/install/remote-install-lock-termination.test.ts
index 5b090d53c83..3ba84bbe515 100644
--- a/src/main/managed-server/install/remote-install-lock-termination.test.ts
+++ b/src/main/managed-server/install/remote-install-lock-termination.test.ts
@@ -6,7 +6,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
   execCommand: vi.fn()
 }))
 
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock, isRelayInstallLockStale } from './remote-install-lock'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
diff --git a/src/main/managed-server/install/remote-install-lock.test.ts b/src/main/managed-server/install/remote-install-lock.test.ts
index 69bad2258e4..4fd0abf3b51 100644
--- a/src/main/managed-server/install/remote-install-lock.test.ts
+++ b/src/main/managed-server/install/remote-install-lock.test.ts
@@ -1,6 +1,6 @@
 import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 
 vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
diff --git a/src/main/managed-server/install/remote-install-noisy-sftp-wire.test.ts b/src/main/managed-server/install/remote-install-noisy-sftp-wire.test.ts
index 41e5b7bf4fa..b2d24d16304 100644
--- a/src/main/managed-server/install/remote-install-noisy-sftp-wire.test.ts
+++ b/src/main/managed-server/install/remote-install-noisy-sftp-wire.test.ts
@@ -5,7 +5,7 @@ import { Client, Server as Ssh2Server, utils, type Connection } from 'ssh2'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshTarget } from '../../../shared/ssh-types'
 import { spawnProcess } from '@orca/process-host'
-import { SshConnection } from '../../ssh/ssh-connection'
+import { SshConnection } from '../../ssh/connection/ssh-connection'
 import { uploadRelayDirectory, writeRelayFile } from './remote-install-transfers'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
diff --git a/src/main/managed-server/install/remote-install-transfers-exec-fallback.test.ts b/src/main/managed-server/install/remote-install-transfers-exec-fallback.test.ts
index 6aa7b2679f8..e032bcc6d7f 100644
--- a/src/main/managed-server/install/remote-install-transfers-exec-fallback.test.ts
+++ b/src/main/managed-server/install/remote-install-transfers-exec-fallback.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { createSshOperationAbortError } from '../../ssh/ssh-connection-utils'
 import {
   uploadDirectoryViaExecStdin,
diff --git a/src/main/managed-server/install/remote-install-transport.ts b/src/main/managed-server/install/remote-install-transport.ts
index c4beacf3915..7269b36f99a 100644
--- a/src/main/managed-server/install/remote-install-transport.ts
+++ b/src/main/managed-server/install/remote-install-transport.ts
@@ -1,5 +1,5 @@
 import type { Duplex, Readable, Writable } from 'node:stream'
-import type { SshRemoteFileOptions } from '../../ssh/ssh-connection-file-transfers'
+import type { SshRemoteFileOptions } from '../../ssh/connection/ssh-connection-file-transfers'
 import type { SshExecOptions } from '../../ssh/ssh-connection-utils'
 
 type RemoteFileWriteOptions = SshRemoteFileOptions & { signal?: AbortSignal }
diff --git a/src/main/managed-server/install/remote-node-runtime-store-gc.test.ts b/src/main/managed-server/install/remote-node-runtime-store-gc.test.ts
index 75151b5e56c..4b5cd5673c7 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-gc.test.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-gc.test.ts
@@ -20,7 +20,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
   execCommand: vi.fn()
 }))
 
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import {
   gcRemoteNodeRuntimeStore,
   parseSweptRuntimeStages,
diff --git a/src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts b/src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts
index db6b24c1154..d7b6c0572c9 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts
@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { runProcess, spawnProcess } from '@orca/process-host'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import {
   RUNTIME_STORE_LOCK_NAME,
   RUNTIME_STORE_LOCK_OWNER_FILENAME,
diff --git a/src/main/managed-server/install/remote-node-runtime-store-windows.test.ts b/src/main/managed-server/install/remote-node-runtime-store-windows.test.ts
index a289137657b..253dea07610 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-windows.test.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-windows.test.ts
@@ -10,7 +10,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
   execCommand: vi.fn()
 }))
 
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { gcRemoteNodeRuntimeStore, parseSweptRuntimeStages } from './remote-node-runtime-store-gc'
 import { RUNTIME_STORE_LOCK_NAME } from './remote-node-runtime-store-lock'
 import { parseRuntimeStoreInventory } from './remote-node-runtime-store-inventory'
diff --git a/src/main/managed-server/install/remote-versioned-install-termination.test.ts b/src/main/managed-server/install/remote-versioned-install-termination.test.ts
index 9b22a3fb098..48e4bcf276f 100644
--- a/src/main/managed-server/install/remote-versioned-install-termination.test.ts
+++ b/src/main/managed-server/install/remote-versioned-install-termination.test.ts
@@ -6,7 +6,7 @@ vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => (
   execCommand: vi.fn()
 }))
 
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { REMOTE_INSTALL_MODELS } from './remote-install-model'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import {
diff --git a/src/main/managed-server/install/remote-versioned-install.test.ts b/src/main/managed-server/install/remote-versioned-install.test.ts
index 0fff3cda234..3f09fc05cb7 100644
--- a/src/main/managed-server/install/remote-versioned-install.test.ts
+++ b/src/main/managed-server/install/remote-versioned-install.test.ts
@@ -37,7 +37,7 @@ import {
   waitForRelayGcClaimRelease
 } from './remote-install-gc-claim'
 import { getRemoteHostPlatform, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 
 const conn = {} as SshConnection
 const mockExec = vi.mocked(execCommand)
diff --git a/src/main/managed-server/lifecycle/orcad-managed-lifecycle-test-fixture.ts b/src/main/managed-server/lifecycle/orcad-managed-lifecycle-test-fixture.ts
index 3d029ee0682..8e61bd902a5 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-lifecycle-test-fixture.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-lifecycle-test-fixture.ts
@@ -6,8 +6,8 @@ import { addManagedOrcadEnvironment } from '../../../shared/runtime-environment-
 import type { SshTarget } from '../../../shared/ssh-types'
 import type { ServeReadiness } from '../../server/serve-readiness'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
-import { SshTargetOrcadClaims } from '../../ssh/ssh-target-orcad-claims'
-import { emptyDependentStateStore } from '../../ssh/ssh-target-orcad-dependents-fixture'
+import { SshTargetOrcadClaims } from '../../ssh/targets/ssh-target-orcad-claims'
+import { emptyDependentStateStore } from '../../ssh/targets/ssh-target-orcad-dependents-fixture'
 
 export const MANAGED_VERSION = '0.2.0+abc'
 export const MANAGED_PREVIOUS_VERSION = '0.1.0+def'
diff --git a/src/main/managed-server/lifecycle/orcad-managed-runtime-context.ts b/src/main/managed-server/lifecycle/orcad-managed-runtime-context.ts
index 5f2defd47e1..0befe1f8967 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-runtime-context.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-runtime-context.ts
@@ -16,7 +16,10 @@ import { probeActiveOrcadReadiness } from '../../ssh/orcad-active-readiness'
 import { resolveOrcadRemoteContext, type OrcadRemoteContext } from '../install/orcad-remote-context'
 import { ORCAD_INSTALL_MODEL } from '../install/remote-install-model'
 import { computeRemoteInstallDir } from '../install/remote-versioned-install'
-import { getSshConnectionManager, getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import {
+  getSshConnectionManager,
+  getSshTargetRegistryStore
+} from '../../ssh/targets/ssh-target-registry'
 
 export const ORCAD_BIND_HOST = '127.0.0.1'
 
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-active.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-active.ts
index 2c0a73fd2f3..e37fcb3d172 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-active.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-active.ts
@@ -6,8 +6,8 @@ import {
   type RuntimeSshTunnelLink
 } from '../../../shared/runtime-environments'
 import type { SshTarget } from '../../../shared/ssh-types'
-import type { SshConnection } from '../../ssh/ssh-connection'
-import { adoptSshConnection } from '../../ssh/ssh-connection-attribution'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
+import { adoptSshConnection } from '../../ssh/connection/ssh-connection-attribution'
 import type {
   PortForwardEntry,
   SshPortForwardManager
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts
index 50135d4a903..e37d33fcf5d 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type { PortForwardStartOptions } from '../../ssh/port-forwarding/ssh-port-forward-provider'
 import type * as ForwardProcess from '../../ssh/system-transport/system-ssh-forward-process'
 
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-manager.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-manager.ts
index 76227d71e1e..38705e7817c 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-manager.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-manager.ts
@@ -8,9 +8,9 @@ import {
 } from '../../../shared/runtime-environments'
 import type { SshTarget } from '../../../shared/ssh-types'
 import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { isAuthError } from '../../ssh/ssh-connection-utils'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import { OrcadManagedTunnelTransportProvider } from './orcad-managed-tunnel-transport'
 import {
@@ -28,7 +28,7 @@ import {
   type ActiveOrcadTunnel
 } from './orcad-managed-tunnel-active'
 import { checkManagedTunnelServing, type OrcadTunnelServing } from './orcad-managed-tunnel-serving'
-import type { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import type { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import {
   environmentForwardChecks,
   forwardToVerifiedOrcad,
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-resume.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-resume.ts
index eccc4853ddd..835a665b7c6 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-resume.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-resume.ts
@@ -4,12 +4,12 @@ import {
   type KnownRuntimeEnvironment,
   type RuntimeSshTunnelLink
 } from '../../../shared/runtime-environments'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type { SshTarget } from '../../../shared/ssh-types'
 import type { OrcadManagedServing } from './orcad-managed-serving'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
 import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
-import type { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import type { getSshTargetRegistryStore } from '../../ssh/targets/ssh-target-registry'
 import {
   dropActiveOrcadTunnel,
   managedTunnelAccess,
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-target.test.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-target.test.ts
index 40395f4c8dc..6713e63d9c8 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-target.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-target.test.ts
@@ -2,7 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshTarget } from '../../../shared/ssh-types'
 import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import {
   OrcadManagedIdentityError,
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-target.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-target.ts
index 4a9e5b7349f..81eaa399368 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-target.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-target.ts
@@ -15,7 +15,7 @@ import {
 import { managedOrcadSlot } from './orcad-managed-runtime-context'
 import { wakeStoppedManagedOrcad } from './orcad-managed-wake'
 import { resolveOrcadRemoteContext } from '../install/orcad-remote-context'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type {
   PortForwardEntry,
   SshPortForwardManager
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.test.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.test.ts
index a8a00092955..fec3ecb28e1 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.test.ts
@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { OrcadManagedTunnelTransportProvider } from './orcad-managed-tunnel-transport'
 import { knownOrcadTunnelTransport } from '../../ssh/orcad-tunnel-transport-memo'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type {
   PortForwardStartOptions,
   SshPortForwardProvider,
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts
index fa7d15d2f2d..7ec2a26649c 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts
@@ -4,7 +4,7 @@
  */
 import { OrcadStdioBridgePortForwardProvider } from './orcad-stdio-bridge-provider'
 import { rememberOrcadTunnelTransport } from '../../ssh/orcad-tunnel-transport-memo'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type {
   PortForwardStartOptions,
   SshPortForwardProvider,
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel.test.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel.test.ts
index fca8ecbf4b3..9b6c5238df8 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel.test.ts
@@ -5,9 +5,9 @@ import {
 } from '../../../shared/runtime-environments'
 import { PAIRING_OFFER_VERSION } from '../../../shared/pairing'
 import type { SshTarget } from '../../../shared/ssh-types'
-import type { SshConnection } from '../../ssh/ssh-connection'
-import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
-import type { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
+import type { SshConnectionManager } from '../../ssh/connection/ssh-connection-manager'
+import type { SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import { OrcadManagedTunnelManager } from './orcad-managed-tunnel-manager'
 import type { OrcadManagedTunnelTargeting } from './orcad-managed-tunnel-target'
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel.ts
index 8bb5993e206..9c7d2f1f340 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel.ts
@@ -1,12 +1,15 @@
 import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
 import { resolveEnvironment } from '../../../shared/runtime-environment-store'
 import type { SshTarget } from '../../../shared/ssh-types'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import { probeManagedOrcadTunnel } from './orcad-managed-tunnel-resume'
 import { ensureManagedOrcadServing } from './orcad-managed-serving'
 import { OrcadManagedTunnelManager } from './orcad-managed-tunnel-manager'
 import { getRemoteRuntimeSharedControlAnsweredAt } from '../../ipc/runtime-environments/runtime-environment-shared-control-answers'
-import { getSshConnectionManager, getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
+import {
+  getSshConnectionManager,
+  getSshTargetRegistryStore
+} from '../../ssh/targets/ssh-target-registry'
 import {
   MANAGED_ORCAD_TUNNEL_TARGETING,
   type OrcadTunnelStartChecks
diff --git a/src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts b/src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts
index 08f03f8c05b..cc8ea55398e 100644
--- a/src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts
@@ -16,13 +16,13 @@ import { listOrcadMigrationSourceCutovers } from '../../ssh/orcad-migration-cuto
 import type { OrcadManagedConversionArgs } from './orcad-runtime-conversion'
 import { fakeOrcadMigrationDestination } from '../../ssh/orcad-migration-destination-fake'
 import { reconcileManagedOrcadSshTargets, visibleRepos } from '../../ssh/orcad-retained-source'
-import { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import { SshConnectionStore } from '../../ssh/connection/ssh-connection-store'
 
 const mocks = vi.hoisted(() => {
   const state: { targetStore: unknown } = { targetStore: null }
   return { state, deploy: vi.fn(), ensureTunnel: vi.fn() }
 })
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({}),
   getSshTargetRegistryStore: () => mocks.state.targetStore
 }))
diff --git a/src/main/managed-server/lifecycle/orcad-runtime-conversion.ts b/src/main/managed-server/lifecycle/orcad-runtime-conversion.ts
index 05f17750bf4..809743a2b54 100644
--- a/src/main/managed-server/lifecycle/orcad-runtime-conversion.ts
+++ b/src/main/managed-server/lifecycle/orcad-runtime-conversion.ts
@@ -36,7 +36,7 @@ import { createSshRelayMigrationSource } from '../../ssh/orcad-migration-ssh-rel
 import {
   leaveBehindClearsOrcadMigrationBlockers,
   onlyLeavableOrcadMigrationBlockers
-} from '../../ssh/ssh-target-orcad-preflight'
+} from '../../ssh/targets/ssh-target-orcad-preflight'
 import { ORCAD_MIGRATION_LEAVE_BEHIND_TERMINALS_REASON } from '../../ssh/orcad-migration-source-fence'
 import { retainOrcadMigrationSource } from '../../ssh/orcad-migration-source-retention'
 import {
diff --git a/src/main/managed-server/lifecycle/orcad-runtime-decommission.test.ts b/src/main/managed-server/lifecycle/orcad-runtime-decommission.test.ts
index aac63f6958e..56f31223671 100644
--- a/src/main/managed-server/lifecycle/orcad-runtime-decommission.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-runtime-decommission.test.ts
@@ -29,7 +29,7 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({ connect: async () => ({}) }),
   getSshTargetRegistryStore: () => mocks.state.store
 }))
diff --git a/src/main/managed-server/lifecycle/orcad-runtime-deployment.test.ts b/src/main/managed-server/lifecycle/orcad-runtime-deployment.test.ts
index 3d5f6aee6b9..bdaa09398ae 100644
--- a/src/main/managed-server/lifecycle/orcad-runtime-deployment.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-runtime-deployment.test.ts
@@ -10,8 +10,8 @@ import { orcadMigrationCutoverFixture } from '../../ssh/orcad-migration-cutover-
 import { listEnvironments } from '../../../shared/runtime-environment-store'
 import type { SshTarget } from '../../../shared/ssh-types'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
-import { SshTargetOrcadClaims } from '../../ssh/ssh-target-orcad-claims'
-import { emptyDependentStateStore } from '../../ssh/ssh-target-orcad-dependents-fixture'
+import { SshTargetOrcadClaims } from '../../ssh/targets/ssh-target-orcad-claims'
+import { emptyDependentStateStore } from '../../ssh/targets/ssh-target-orcad-dependents-fixture'
 import {
   withDeactivatedVersion,
   withDeactivatedVersionCommitted,
@@ -41,7 +41,7 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({ connect: mocks.connect }),
   getSshTargetRegistryStore: () => mocks.state.store
 }))
diff --git a/src/main/managed-server/lifecycle/orcad-runtime-forget.test.ts b/src/main/managed-server/lifecycle/orcad-runtime-forget.test.ts
index 09cddd448d0..3cc105beae7 100644
--- a/src/main/managed-server/lifecycle/orcad-runtime-forget.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-runtime-forget.test.ts
@@ -8,7 +8,7 @@ import {
 } from '../../ssh/orcad-migration-cutover-journal'
 import { orcadMigrationCutoverFixture } from '../../ssh/orcad-migration-cutover-fixture'
 import { createManagedLifecycleHarness } from './orcad-managed-lifecycle-test-fixture'
-import { isManagedOrcadSshTarget } from '../../ssh/ssh-connection-store'
+import { isManagedOrcadSshTarget } from '../../ssh/connection/ssh-connection-store'
 
 const mocks = vi.hoisted(() => {
   const state: { store: unknown } = { store: null }
@@ -21,7 +21,7 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({ connect: mocks.connect }),
   getSshTargetRegistryStore: () => mocks.state.store
 }))
diff --git a/src/main/managed-server/lifecycle/orcad-runtime-target.test.ts b/src/main/managed-server/lifecycle/orcad-runtime-target.test.ts
index 780e936f4ae..1bdb911eeaa 100644
--- a/src/main/managed-server/lifecycle/orcad-runtime-target.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-runtime-target.test.ts
@@ -1,8 +1,8 @@
 import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { resolveOrcadRuntimeTarget } from './orcad-runtime-target'
-import { SshConnection } from '../../ssh/ssh-connection'
-import { createCallbacks, createTarget } from '../../ssh/ssh-connection-test-fixtures'
+import { SshConnection } from '../../ssh/connection/ssh-connection'
+import { createCallbacks, createTarget } from '../../ssh/connection/ssh-connection-test-fixtures'
 import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
diff --git a/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts b/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts
index d59f5ae483a..49b33637649 100644
--- a/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts
@@ -10,7 +10,7 @@ import { ORCAD_STDIO_BRIDGE_MAX_CHANNELS } from './orcad-stdio-bridge-listener'
 import { OrcadStdioBridgePortForwardProvider } from './orcad-stdio-bridge-provider'
 import { spawnLocalBridgeChannel, startEchoServer } from './orcad-stdio-bridge-test-channel'
 import { ORCAD_WINDOWS_HOST_SCRIPT } from '../host-state/orcad-windows-host-script'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type { StartedPortForward } from '../../ssh/port-forwarding/ssh-port-forward-provider'
 import type { RemoteCommandChannel } from '../install/remote-install-transport'
 
diff --git a/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.ts b/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.ts
index 080823307a8..f0c78c7ce92 100644
--- a/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.ts
+++ b/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.ts
@@ -17,7 +17,7 @@ import {
 import { listenOrcadStdioBridge } from './orcad-stdio-bridge-listener'
 import { sshOrcadHostTransport } from '../../ssh/orcad-ssh-host-transport'
 import type { RemoteCommandChannel } from '../install/remote-install-transport'
-import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnection } from '../../ssh/connection/ssh-connection'
 import type {
   PortForwardStartOptions,
   SshPortForwardProvider,
diff --git a/src/main/orcad/orcad-cross-runtime-daemon-adoption.integration.test.ts b/src/main/orcad/orcad-cross-runtime-daemon-adoption.integration.test.ts
index afdb5efc29c..81d332e32e3 100644
--- a/src/main/orcad/orcad-cross-runtime-daemon-adoption.integration.test.ts
+++ b/src/main/orcad/orcad-cross-runtime-daemon-adoption.integration.test.ts
@@ -40,7 +40,7 @@ import {
   getOrcaProfileIndexPath,
   getOrcaProfileStateDatabaseFile
 } from '../orca-profiles/profile-storage-paths'
-import type { SshConnection } from '../ssh/ssh-connection'
+import type { SshConnection } from '../ssh/connection/ssh-connection'
 import {
   emptyOrcadActivationRecord,
   orcadGcPinnedDirNames
diff --git a/src/main/persistence-repo-lifecycle.test.ts b/src/main/persistence-repo-lifecycle.test.ts
index 4187db59eec..78b6ebee23d 100644
--- a/src/main/persistence-repo-lifecycle.test.ts
+++ b/src/main/persistence-repo-lifecycle.test.ts
@@ -22,8 +22,8 @@ import {
   advanceSshConnectionGeneration,
   assertSshMutationExpectation,
   resetSshConnectionGenerations
-} from './ssh/ssh-connection-generation'
-import { getRuntimeOwnedSshTargetId } from './ssh/ssh-connection-store'
+} from './ssh/connection/ssh-connection-generation'
+import { getRuntimeOwnedSshTargetId } from './ssh/connection/ssh-connection-store'
 import {
   _getLocalWorktreeScanGenerationCacheSize,
   getLocalWorktreeScanGeneration,
diff --git a/src/main/persistence-ssh-readoption-automation-migration.test.ts b/src/main/persistence-ssh-readoption-automation-migration.test.ts
index e7820b41b80..acefbd40176 100644
--- a/src/main/persistence-ssh-readoption-automation-migration.test.ts
+++ b/src/main/persistence-ssh-readoption-automation-migration.test.ts
@@ -21,7 +21,7 @@ import type { FolderWorkspace } from '../shared/folder-workspace-types'
 import type { ProjectGroup } from '../shared/project-group-types'
 import type { Repo } from '../shared/repo-types'
 import type { RemovedSshTargetTombstone } from '../shared/ssh-types'
-import type { SshConnectionStore } from './ssh/ssh-connection-store'
+import type { SshConnectionStore } from './ssh/connection/ssh-connection-store'
 import { getDefaultPersistedState } from '../shared/constants'
 import { toSshExecutionHostId } from '../shared/execution-host'
 import { hostStableKey } from '../shared/automation-owner-key'
@@ -170,7 +170,7 @@ async function reloadStore() {
 
 async function createSshStore(state: Record<string, unknown>) {
   const store = await createStoreFromState(state)
-  const { SshConnectionStore } = await import('./ssh/ssh-connection-store')
+  const { SshConnectionStore } = await import('./ssh/connection/ssh-connection-store')
   return { store, ssh: new SshConnectionStore(store) }
 }
 
@@ -359,7 +359,8 @@ describe('SSH re-adoption tombstone retention', () => {
 
   it('retains the tombstone when a same-id re-registration leaves the automation on the old incarnation', async () => {
     const { store } = await createSshStore(removedHostState())
-    const { readoptOrphanedWorkspacesForTarget } = await import('./ssh/ssh-target-readoption')
+    const { readoptOrphanedWorkspacesForTarget } =
+      await import('./ssh/targets/ssh-target-readoption')
     // Same id back with a new registration: nothing is re-pointed, so the automation
     // still depends on the tombstone as the only evidence its host was replaced.
     const target = { id: OLD_ID, label: 'Dev box', ...IDENTITY, generation: 9 }
diff --git a/src/main/persistence-ssh-remote-cli-control-migration.test.ts b/src/main/persistence-ssh-remote-cli-control-migration.test.ts
index fa9f75a443d..7016d5b5351 100644
--- a/src/main/persistence-ssh-remote-cli-control-migration.test.ts
+++ b/src/main/persistence-ssh-remote-cli-control-migration.test.ts
@@ -11,7 +11,7 @@ import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { SshTarget } from '../shared/ssh-types'
 import { isRemoteCliControlAllowed } from '../shared/ssh-remote-cli-control'
-import { SshConnectionStore } from './ssh/ssh-connection-store'
+import { SshConnectionStore } from './ssh/connection/ssh-connection-store'
 
 vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
diff --git a/src/main/persistence-ssh-targets-and-pane-keys.test.ts b/src/main/persistence-ssh-targets-and-pane-keys.test.ts
index 9b9d30bdff1..cb71b50a25a 100644
--- a/src/main/persistence-ssh-targets-and-pane-keys.test.ts
+++ b/src/main/persistence-ssh-targets-and-pane-keys.test.ts
@@ -12,7 +12,7 @@ import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
-import { SshConnectionStore } from './ssh/ssh-connection-store'
+import { SshConnectionStore } from './ssh/connection/ssh-connection-store'
 import { LEGACY_DEFAULT_SSH_RELAY_GRACE_PERIOD_SECONDS } from '../shared/ssh-types'
 
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
diff --git a/src/main/persistence-worktree-name-retirement.test.ts b/src/main/persistence-worktree-name-retirement.test.ts
index 6e976d1e5b5..1602b540f5b 100644
--- a/src/main/persistence-worktree-name-retirement.test.ts
+++ b/src/main/persistence-worktree-name-retirement.test.ts
@@ -14,7 +14,7 @@ import { MARINE_CREATURES } from '../shared/marine-creatures'
 import { createRetiredNameLookup } from '../shared/worktree/retired-name-registry'
 import type { SshTarget } from '../shared/ssh-types'
 import { MAX_RETIREMENT_NAMESPACES } from './worktree-retirement-namespace'
-import { getRuntimeOwnedSshTargetId } from './ssh/ssh-connection-store'
+import { getRuntimeOwnedSshTargetId } from './ssh/connection/ssh-connection-store'
 import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
 import { resetRetirementCollisionKeyCacheForTests } from './worktree-name-retirement'
 
diff --git a/src/main/persistence/leasing-ssh-ptys/ssh-target-reassignment.ts b/src/main/persistence/leasing-ssh-ptys/ssh-target-reassignment.ts
index 8099496fabf..7374242d65c 100644
--- a/src/main/persistence/leasing-ssh-ptys/ssh-target-reassignment.ts
+++ b/src/main/persistence/leasing-ssh-ptys/ssh-target-reassignment.ts
@@ -5,7 +5,7 @@ import {
   migrateFolderWorkspaceHostSshTargetId,
   migrateUiHostScopeSshTargetId,
   migrateWorkspaceSessionSshTargetId
-} from '../../ssh/ssh-target-id-migration'
+} from '../../ssh/targets/ssh-target-id-migration'
 import type { ProtectedSecretPersistence } from '../../protected-secret-persistence'
 import { sshPtyOwnerLeaseSecretSlot } from '../../protected-secret-persistence'
 import {
diff --git a/src/main/persistence/leasing-ssh-ptys/ssh-target-state.ts b/src/main/persistence/leasing-ssh-ptys/ssh-target-state.ts
index 7f72f2117ab..904efc6dbea 100644
--- a/src/main/persistence/leasing-ssh-ptys/ssh-target-state.ts
+++ b/src/main/persistence/leasing-ssh-ptys/ssh-target-state.ts
@@ -6,7 +6,7 @@ import {
   MAX_REMOVED_SSH_TARGET_TOMBSTONES,
   capRemovedSshTargetTombstones,
   collectSshTargetRemovalEvidenceDependencies
-} from '../../ssh/removed-ssh-target-tombstone-retention'
+} from '../../ssh/targets/removed-ssh-target-tombstone-retention'
 import { normalizeSshTarget } from './ssh-normalization'
 import { isRuntimeOwnedSshTargetId } from '../../../shared/execution-host'
 import {
diff --git a/src/main/persistence/loading-store/ssh-profile-operations.ts b/src/main/persistence/loading-store/ssh-profile-operations.ts
index 5cfffc41a72..c9f179217c7 100644
--- a/src/main/persistence/loading-store/ssh-profile-operations.ts
+++ b/src/main/persistence/loading-store/ssh-profile-operations.ts
@@ -26,7 +26,7 @@ import type { WriteSchedulingOperations } from './write-scheduling'
 import type { RepoLifecycleOperations } from './repo-lifecycle-operations'
 import { syncProjectHostSetupCompatibilityState } from './repo-lifecycle-operations'
 import { scheduleSave } from './write-scheduling'
-import { forgetSshConnectionGeneration } from '../../ssh/ssh-connection-generation'
+import { forgetSshConnectionGeneration } from '../../ssh/connection/ssh-connection-generation'
 
 type SshProfileOperationsRuntime = Pick<StoreRuntimeState, 'protectedSecrets' | 'state'>
 
diff --git a/src/main/persistence/migrating-orcad-catalog/orcad-source-stale-state-move.test.ts b/src/main/persistence/migrating-orcad-catalog/orcad-source-stale-state-move.test.ts
index a688eb372ed..e5acb9bc791 100644
--- a/src/main/persistence/migrating-orcad-catalog/orcad-source-stale-state-move.test.ts
+++ b/src/main/persistence/migrating-orcad-catalog/orcad-source-stale-state-move.test.ts
@@ -11,7 +11,7 @@ import type { TerminalTab } from '../../../shared/terminal-tab-types'
 import type { PersistedOpenFile } from '../../../shared/workspace-session-state-types'
 import { createOrcadMigrationManifest } from '../../ssh/orcad-migration-manifest-export'
 import { orcadMigrationRefusalReason } from '../../ssh/orcad-migration-refusal-reason'
-import { collectUntransferredDependentBlockers } from '../../ssh/ssh-target-orcad-dependents'
+import { collectUntransferredDependentBlockers } from '../../ssh/targets/ssh-target-orcad-dependents'
 import { collectOrcadMigrationUntransferredDependencyCensus } from './orcad-source-dependency-census'
 import { collectOrcadMigrationSourceDormantState } from './orcad-source-dormant-state'
 
diff --git a/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts b/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
index 9625be02eaf..d28cfb896a6 100644
--- a/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
+++ b/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
@@ -4,7 +4,7 @@ import {
   getAgentPromptSubmitDelayMs,
   getTerminalPasteIngestMs
 } from '../../shared/agent-prompt-injection'
-import { setSshTargetRegistryHandlers } from '../ssh/ssh-target-registry'
+import { setSshTargetRegistryHandlers } from '../ssh/targets/ssh-target-registry'
 import { OrcaRuntimeService } from './orca-runtime'
 import { makeStore } from './runtime-rpc-worktree-store-fixtures'
 
diff --git a/src/main/runtime/files/file-mutation-expectation.ts b/src/main/runtime/files/file-mutation-expectation.ts
index bf692a96c2b..788c9bffae3 100644
--- a/src/main/runtime/files/file-mutation-expectation.ts
+++ b/src/main/runtime/files/file-mutation-expectation.ts
@@ -2,7 +2,7 @@ import {
   getSshTargetIdForExecutionHost,
   type ExecutionHostId
 } from '../../../shared/execution-host'
-import { assertSshMutationExpectation } from '../../ssh/ssh-connection-generation'
+import { assertSshMutationExpectation } from '../../ssh/connection/ssh-connection-generation'
 
 export const RUNTIME_FILE_MUTATION_UPDATE_REQUIRED =
   'Remote file changes require a newer Orca client. Update the paired client and try again.'
diff --git a/src/main/runtime/orca-runtime-files-rename-authority.test.ts b/src/main/runtime/orca-runtime-files-rename-authority.test.ts
index fcbd8206052..651668173ac 100644
--- a/src/main/runtime/orca-runtime-files-rename-authority.test.ts
+++ b/src/main/runtime/orca-runtime-files-rename-authority.test.ts
@@ -10,7 +10,7 @@ import {
   useRuntimeFileCommandsLifecycle
 } from './orca-runtime-files-test-harness'
 import { SshHostNotServedError } from '../providers/ssh-host-not-served-error'
-import { setSshConnectionGeneration } from '../ssh/ssh-connection-generation'
+import { setSshConnectionGeneration } from '../ssh/connection/ssh-connection-generation'
 
 vi.mock('fs', async () => (await import('./orca-runtime-files-mock-registry')).fsModuleMock())
 vi.mock('fs/promises', async () =>
diff --git a/src/main/runtime/orca-runtime-files-test-harness.ts b/src/main/runtime/orca-runtime-files-test-harness.ts
index 8bae5c1b2b2..27f0580e358 100644
--- a/src/main/runtime/orca-runtime-files-test-harness.ts
+++ b/src/main/runtime/orca-runtime-files-test-harness.ts
@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, vi } from 'vitest'
 import { awaitRuntimeFileWatcherUnsubscribes } from './files/watch/file-watcher-leases'
 import { RuntimeFileCommands } from './orca-runtime-files'
-import { resetSshConnectionGenerations } from '../ssh/ssh-connection-generation'
+import { resetSshConnectionGenerations } from '../ssh/connection/ssh-connection-generation'
 import { resetRuntimeFileMocks } from './orca-runtime-files-mock-registry'
 import {
   getConnectionExecutionHostId,
diff --git a/src/main/runtime/orca-runtime-test-mocks/setup.spec.ts b/src/main/runtime/orca-runtime-test-mocks/setup.spec.ts
index 0fe8b00bde7..641666d0809 100644
--- a/src/main/runtime/orca-runtime-test-mocks/setup.spec.ts
+++ b/src/main/runtime/orca-runtime-test-mocks/setup.spec.ts
@@ -293,7 +293,7 @@ vi.mock('../../terminal-history-deletion', () => ({
   deleteWorktreeHistoryDir: deleteWorktreeHistoryDirMock
 }))
 
-vi.mock('../../ssh/ssh-target-registry', () => ({
+vi.mock('../../ssh/targets/ssh-target-registry', () => ({
   getRegisteredSshState: () => ({ remotePlatform: 'linux' })
 }))
 
diff --git a/src/main/runtime/rpc/methods/client-events.ts b/src/main/runtime/rpc/methods/client-events.ts
index 68c80f20ee0..8d125f6a009 100644
--- a/src/main/runtime/rpc/methods/client-events.ts
+++ b/src/main/runtime/rpc/methods/client-events.ts
@@ -1,4 +1,7 @@
-import { getRegisteredSshState, listRegisteredSshTargets } from '../../../ssh/ssh-target-registry'
+import {
+  getRegisteredSshState,
+  listRegisteredSshTargets
+} from '../../../ssh/targets/ssh-target-registry'
 import { getPublicSshState } from '../../public-ssh-state'
 import { defineMethod, defineStreamingMethod } from '../core'
 import { ClientEventsUnsubscribeParams } from '../../../../shared/rpc-contract/client-events-params'
diff --git a/src/main/runtime/rpc/methods/ssh-target-management-unserved.test.ts b/src/main/runtime/rpc/methods/ssh-target-management-unserved.test.ts
index 462e705d99c..61b1b89d0ef 100644
--- a/src/main/runtime/rpc/methods/ssh-target-management-unserved.test.ts
+++ b/src/main/runtime/rpc/methods/ssh-target-management-unserved.test.ts
@@ -2,7 +2,7 @@ import '../unused-default-rpc-methods.test-fixture'
 import { describe, expect, it } from 'vitest'
 import { RpcDispatcher } from '../dispatcher'
 import { OrcaRuntimeService } from '../../orca-runtime'
-import { SSH_TARGET_MANAGEMENT_UNSERVED_MESSAGE } from '../../../ssh/ssh-target-registry'
+import { SSH_TARGET_MANAGEMENT_UNSERVED_MESSAGE } from '../../../ssh/targets/ssh-target-registry'
 import { SSH_METHODS } from './ssh'
 
 const target = { label: 'Build', host: 'build.internal', port: 22, username: 'ci' }
diff --git a/src/main/runtime/rpc/methods/ssh-target-management.test.ts b/src/main/runtime/rpc/methods/ssh-target-management.test.ts
index 633b613d242..55c88054912 100644
--- a/src/main/runtime/rpc/methods/ssh-target-management.test.ts
+++ b/src/main/runtime/rpc/methods/ssh-target-management.test.ts
@@ -15,7 +15,7 @@ const mocks = vi.hoisted(() => ({
   browseSshDirectory: vi.fn()
 }))
 
-vi.mock('../../../ssh/ssh-target-registry', () => ({
+vi.mock('../../../ssh/targets/ssh-target-registry', () => ({
   connectRegisteredSshTarget: vi.fn(),
   getRegisteredSshState: mocks.getRegisteredSshState,
   getRegisteredSshTargetMutations: () => mocks.mutations,
diff --git a/src/main/runtime/rpc/methods/ssh.test.ts b/src/main/runtime/rpc/methods/ssh.test.ts
index 3c6e6723084..f05d88317d7 100644
--- a/src/main/runtime/rpc/methods/ssh.test.ts
+++ b/src/main/runtime/rpc/methods/ssh.test.ts
@@ -17,7 +17,7 @@ const {
   listRegisteredRemovedSshTargetLabelsMock: vi.fn()
 }))
 
-vi.mock('../../../ssh/ssh-target-registry', () => ({
+vi.mock('../../../ssh/targets/ssh-target-registry', () => ({
   connectRegisteredSshTarget: connectRegisteredSshTargetMock,
   getRegisteredSshState: getRegisteredSshStateMock,
   listRegisteredSshTargets: listRegisteredSshTargetsMock,
diff --git a/src/main/runtime/rpc/methods/ssh.ts b/src/main/runtime/rpc/methods/ssh.ts
index 172e1beaec0..dae6850dced 100644
--- a/src/main/runtime/rpc/methods/ssh.ts
+++ b/src/main/runtime/rpc/methods/ssh.ts
@@ -6,8 +6,8 @@ import {
   listRegisteredRemovedSshTargetLabels,
   listRegisteredSshTargets,
   SshTargetManagementUnservedError
-} from '../../../ssh/ssh-target-registry'
-import { isManagedOrcadSshTarget } from '../../../ssh/ssh-connection-store'
+} from '../../../ssh/targets/ssh-target-registry'
+import { isManagedOrcadSshTarget } from '../../../ssh/connection/ssh-connection-store'
 import { browseSshDirectory } from '../../../ssh/ssh-remote-directory-browse'
 import { defineMethod } from '../core'
 import { getPublicSshError, getPublicSshState } from '../../public-ssh-state'
diff --git a/src/main/runtime/sidebar-inputs/sidebar-inputs-feed-domains.ts b/src/main/runtime/sidebar-inputs/sidebar-inputs-feed-domains.ts
index fb93ac6297e..c2831e70ab6 100644
--- a/src/main/runtime/sidebar-inputs/sidebar-inputs-feed-domains.ts
+++ b/src/main/runtime/sidebar-inputs/sidebar-inputs-feed-domains.ts
@@ -1,4 +1,7 @@
-import { getRegisteredSshState, listRegisteredSshTargets } from '../../ssh/ssh-target-registry'
+import {
+  getRegisteredSshState,
+  listRegisteredSshTargets
+} from '../../ssh/targets/ssh-target-registry'
 import { getWslHostService } from '../../wsl/wsl-host-service-instance'
 import type { RuntimeClientEvent } from '../../../shared/runtime-client-events'
 import type { DesktopSidebarFacts } from '../../../shared/sidebar-list/desktop-sidebar-facts'
diff --git a/src/main/runtime/terminal/launch/terminal-create-deduplication.ts b/src/main/runtime/terminal/launch/terminal-create-deduplication.ts
index bdaacf24c80..7298e71a792 100644
--- a/src/main/runtime/terminal/launch/terminal-create-deduplication.ts
+++ b/src/main/runtime/terminal/launch/terminal-create-deduplication.ts
@@ -5,7 +5,7 @@ import { deriveRemoteRuntimeTerminalCreateHandle } from '../../remote-runtime-te
 import { withTimeoutResult } from '../../runtime-async-boundaries'
 import { PTY_CONTROLLER_LIST_TIMEOUT_MS } from '../../orca-runtime-postlude'
 import { inferWorktreeIdFromPtyId } from '../../runtime-worktree-path-identity'
-import { getRegisteredSshState } from '../../../ssh/ssh-target-registry'
+import { getRegisteredSshState } from '../../../ssh/targets/ssh-target-registry'
 import {
   getConnectionExecutionHostId,
   LOCAL_EXECUTION_HOST_ID,
diff --git a/src/main/runtime/terminal/launch/terminal-workspace-scope.ts b/src/main/runtime/terminal/launch/terminal-workspace-scope.ts
index 6e58de9edc3..1dcd139f15e 100644
--- a/src/main/runtime/terminal/launch/terminal-workspace-scope.ts
+++ b/src/main/runtime/terminal/launch/terminal-workspace-scope.ts
@@ -14,7 +14,7 @@ import {
 } from '../../../../shared/execution-host'
 import { resolveRuntimeBrowserNetworkExecutionHost } from '../../runtime-browser-network-execution-host'
 import { resolveLocalProjectRuntimeForWorktreeId } from '../../../local-project-runtime-resolution'
-import { getRegisteredSshState } from '../../../ssh/ssh-target-registry'
+import { getRegisteredSshState } from '../../../ssh/targets/ssh-target-registry'
 import {
   resolveWorktreeHostRouting,
   resolveWorktreeLaunchHost
diff --git a/src/main/runtime/terminal/wait/terminal-wait-permission.ts b/src/main/runtime/terminal/wait/terminal-wait-permission.ts
index 636f47b8f93..411630180c2 100644
--- a/src/main/runtime/terminal/wait/terminal-wait-permission.ts
+++ b/src/main/runtime/terminal/wait/terminal-wait-permission.ts
@@ -16,7 +16,7 @@ import { renewRuntimeMobileAgentStatusFromPtyTitle } from '../../runtime-mobile-
 import { getDisplayPromptLifecycle } from '../../runtime-worktree-status-projection'
 import type { RuntimeTerminalWriteOptions } from '../../runtime-terminal-writer'
 import type { WriteSettlement } from '../../../../shared/pty-write-settlement'
-import { getRegisteredSshState } from '../../../ssh/ssh-target-registry'
+import { getRegisteredSshState } from '../../../ssh/targets/ssh-target-registry'
 import { splitWorktreeIdForFilesystem } from '../../../../shared/worktree/id'
 import { isWindowsAbsolutePathLike } from '../../../../shared/cross-platform-path'
 import type { TuiAgent } from '../../../../shared/tui-agent'
diff --git a/src/main/ssh/ssh-connection-attribution.test.ts b/src/main/ssh/connection/ssh-connection-attribution.test.ts
similarity index 100%
rename from src/main/ssh/ssh-connection-attribution.test.ts
rename to src/main/ssh/connection/ssh-connection-attribution.test.ts
diff --git a/src/main/ssh/ssh-connection-attribution.ts b/src/main/ssh/connection/ssh-connection-attribution.ts
similarity index 100%
rename from src/main/ssh/ssh-connection-attribution.ts
rename to src/main/ssh/connection/ssh-connection-attribution.ts
diff --git a/src/main/ssh/ssh-connection-auth-fallback.test.ts b/src/main/ssh/connection/ssh-connection-auth-fallback.test.ts
similarity index 96%
rename from src/main/ssh/ssh-connection-auth-fallback.test.ts
rename to src/main/ssh/connection/ssh-connection-auth-fallback.test.ts
index 7575dcf1cc9..6bb33f50c11 100644
--- a/src/main/ssh/ssh-connection-auth-fallback.test.ts
+++ b/src/main/ssh/connection/ssh-connection-auth-fallback.test.ts
@@ -3,7 +3,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { utils } from 'ssh2'
-import { clientInstances, emitSshEvent, ssh2Mock } from './__tests__/ssh-connection-test-client'
+import { clientInstances, emitSshEvent, ssh2Mock } from '../__tests__/ssh-connection-test-client'
 import { nextSshClientCreation, resetSshConnectionMocks } from './ssh-connection-test-harness'
 import {
   createCallbacks,
@@ -11,37 +11,37 @@ import {
   walkInitialAuthLadder
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import { resolveWithSshG } from '../config/ssh-g-config-resolution'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-channel-error.test.ts b/src/main/ssh/connection/ssh-connection-channel-error.test.ts
similarity index 72%
rename from src/main/ssh/ssh-connection-channel-error.test.ts
rename to src/main/ssh/connection/ssh-connection-channel-error.test.ts
index cad64969e57..951f20a2d21 100644
--- a/src/main/ssh/ssh-connection-channel-error.test.ts
+++ b/src/main/ssh/connection/ssh-connection-channel-error.test.ts
@@ -3,38 +3,38 @@ import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import { SshConnection } from './ssh-connection'
 import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { resetSshConnectionMocks } from './ssh-connection-test-harness'
-import { ssh2Mock } from './__tests__/ssh-connection-test-client'
-import * as sshClientMock from './__tests__/ssh-connection-test-client'
+import { ssh2Mock } from '../__tests__/ssh-connection-test-client'
+import * as sshClientMock from '../__tests__/ssh-connection-test-client'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-channel-lifetime.test.ts b/src/main/ssh/connection/ssh-connection-channel-lifetime.test.ts
similarity index 100%
rename from src/main/ssh/ssh-connection-channel-lifetime.test.ts
rename to src/main/ssh/connection/ssh-connection-channel-lifetime.test.ts
diff --git a/src/main/ssh/ssh-connection-channel-lifetime.ts b/src/main/ssh/connection/ssh-connection-channel-lifetime.ts
similarity index 100%
rename from src/main/ssh/ssh-connection-channel-lifetime.ts
rename to src/main/ssh/connection/ssh-connection-channel-lifetime.ts
diff --git a/src/main/ssh/ssh-connection-channel-open.test.ts b/src/main/ssh/connection/ssh-connection-channel-open.test.ts
similarity index 95%
rename from src/main/ssh/ssh-connection-channel-open.test.ts
rename to src/main/ssh/connection/ssh-connection-channel-open.test.ts
index 510d07b71bb..cd39264c8ee 100644
--- a/src/main/ssh/ssh-connection-channel-open.test.ts
+++ b/src/main/ssh/connection/ssh-connection-channel-open.test.ts
@@ -5,40 +5,40 @@ import {
   pendingExecCallback,
   pendingSftpCallback,
   ssh2Mock
-} from './__tests__/ssh-connection-test-client'
+} from '../__tests__/ssh-connection-test-client'
 import { resetSshConnectionMocks } from './ssh-connection-test-harness'
 import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-direct-startup.test.ts b/src/main/ssh/connection/ssh-connection-direct-startup.test.ts
similarity index 79%
rename from src/main/ssh/ssh-connection-direct-startup.test.ts
rename to src/main/ssh/connection/ssh-connection-direct-startup.test.ts
index 8421e7b98d1..8e0fb2b1ac6 100644
--- a/src/main/ssh/ssh-connection-direct-startup.test.ts
+++ b/src/main/ssh/connection/ssh-connection-direct-startup.test.ts
@@ -4,37 +4,37 @@ import { resetSshConnectionMocks, spawnSystemSshCommandMock } from './ssh-connec
 import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
 import type { createSystemCommandChannel } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import { resolveWithSshG } from '../config/ssh-g-config-resolution'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-file-transfer.test.ts b/src/main/ssh/connection/ssh-connection-file-transfer.test.ts
similarity index 89%
rename from src/main/ssh/ssh-connection-file-transfer.test.ts
rename to src/main/ssh/connection/ssh-connection-file-transfer.test.ts
index 14168ca8c90..e2e0d67502a 100644
--- a/src/main/ssh/ssh-connection-file-transfer.test.ts
+++ b/src/main/ssh/connection/ssh-connection-file-transfer.test.ts
@@ -2,47 +2,47 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 import { resetSshConnectionMocks } from './ssh-connection-test-harness'
 import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import { resolveWithSshG } from '../config/ssh-g-config-resolution'
 import {
   downloadFileViaSystemSsh,
   uploadFileViaSystemSsh,
   writeBufferViaSystemSsh
-} from './system-transport/system-ssh-file-binary-transfer'
+} from '../system-transport/system-ssh-file-binary-transfer'
 import {
   uploadDirectoryViaSystemSsh,
   writeFileViaSystemSsh
-} from './system-transport/system-ssh-file-transfer'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+} from '../system-transport/system-ssh-file-transfer'
+import { getRemoteHostPlatform } from '../ssh-remote-platform'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-file-transfers.ts b/src/main/ssh/connection/ssh-connection-file-transfers.ts
similarity index 88%
rename from src/main/ssh/ssh-connection-file-transfers.ts
rename to src/main/ssh/connection/ssh-connection-file-transfers.ts
index 930d7303dfa..b995e330d8f 100644
--- a/src/main/ssh/ssh-connection-file-transfers.ts
+++ b/src/main/ssh/connection/ssh-connection-file-transfers.ts
@@ -1,25 +1,25 @@
 import type { SFTPWrapper } from 'ssh2'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { FileUploadSession } from '../providers/filesystem-provider-contract'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { FileUploadSession } from '../../providers/filesystem-provider-contract'
 import {
   resolveSftpTransferPathIfMapped,
   type SftpNamespacePathMapping
-} from './sftp-namespace-resolution'
+} from '../sftp-namespace-resolution'
 import {
   createLinkedSshFileTransferSignal,
   raceSftpFileTransferWithAbort
-} from './ssh-file-transfer-abort'
-import type { RemoteHostPlatform } from './ssh-remote-platform'
+} from '../ssh-file-transfer-abort'
+import type { RemoteHostPlatform } from '../ssh-remote-platform'
 import {
   downloadFileViaSystemSsh,
   uploadFileViaSystemSsh,
   writeBufferViaSystemSsh
-} from './system-transport/system-ssh-file-binary-transfer'
+} from '../system-transport/system-ssh-file-binary-transfer'
 import {
   uploadDirectoryViaSystemSsh,
   writeFileViaSystemSsh
-} from './system-transport/system-ssh-file-transfer'
-import type { SystemSshBuildArgsOptions } from './system-transport/system-ssh-args'
+} from '../system-transport/system-ssh-file-transfer'
+import type { SystemSshBuildArgsOptions } from '../system-transport/system-ssh-args'
 
 export type SshRemoteFileOptions = {
   hostPlatform?: RemoteHostPlatform
@@ -44,7 +44,7 @@ export async function uploadSshDirectory(
 ): Promise<void> {
   await withLinkedSftpTransfer(host, remoteDir, options, {
     sftp: async (sftp, targetDir, signal) => {
-      const { uploadDirectory } = await import('./sftp-upload')
+      const { uploadDirectory } = await import('../sftp-upload')
       await uploadDirectory(sftp, localDir, targetDir, localDir, { signal })
     },
     system: (signal) =>
@@ -65,7 +65,7 @@ export async function downloadSshFile(
   if (!host.usesSystemSshTransport()) {
     const sftp = await host.sftp()
     try {
-      const { fastGetViaSftp } = await import('../providers/ssh-filesystem-provider-sftp')
+      const { fastGetViaSftp } = await import('../../providers/ssh-filesystem-provider-sftp')
       await fastGetViaSftp(sftp, remotePath, localPath)
     } finally {
       sftp.end()
@@ -85,7 +85,7 @@ export async function createSshFileUploadSession(
 ): Promise<FileUploadSession> {
   if (!host.usesSystemSshTransport()) {
     const sftp = await host.sftp()
-    const { uploadFile } = await import('./sftp-upload')
+    const { uploadFile } = await import('../sftp-upload')
     return {
       uploadFile: (localPath, remotePath, uploadOptions) =>
         uploadFile(sftp, localPath, remotePath, uploadOptions),
@@ -115,7 +115,7 @@ export async function writeSshFile(
 ): Promise<void> {
   await withLinkedSftpTransfer(host, remotePath, options, {
     sftp: async (sftp, targetPath) => {
-      const { writeStringViaSftp } = await import('./sftp-upload')
+      const { writeStringViaSftp } = await import('../sftp-upload')
       await writeStringViaSftp(sftp, targetPath, contents)
     },
     system: (signal) =>
@@ -190,7 +190,7 @@ export async function writeSshBuffer(
   if (!host.usesSystemSshTransport()) {
     const sftp = await host.sftp()
     try {
-      const { uploadBuffer } = await import('./sftp-upload')
+      const { uploadBuffer } = await import('../sftp-upload')
       await uploadBuffer(sftp, contents, remotePath, options)
     } finally {
       sftp.end()
diff --git a/src/main/ssh/ssh-connection-generation.test.ts b/src/main/ssh/connection/ssh-connection-generation.test.ts
similarity index 100%
rename from src/main/ssh/ssh-connection-generation.test.ts
rename to src/main/ssh/connection/ssh-connection-generation.test.ts
diff --git a/src/main/ssh/ssh-connection-generation.ts b/src/main/ssh/connection/ssh-connection-generation.ts
similarity index 98%
rename from src/main/ssh/ssh-connection-generation.ts
rename to src/main/ssh/connection/ssh-connection-generation.ts
index 610d35713a4..4e766008dc7 100644
--- a/src/main/ssh/ssh-connection-generation.ts
+++ b/src/main/ssh/connection/ssh-connection-generation.ts
@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto'
-import { getConnectionExecutionHostId } from '../../shared/execution-host'
+import { getConnectionExecutionHostId } from '../../../shared/execution-host'
 
 const SESSION_COUNTER_BITS = 13
 const SESSION_COUNTER_STRIDE = 2 ** SESSION_COUNTER_BITS
diff --git a/src/main/ssh/ssh-connection-github-probe.test.ts b/src/main/ssh/connection/ssh-connection-github-probe.test.ts
similarity index 93%
rename from src/main/ssh/ssh-connection-github-probe.test.ts
rename to src/main/ssh/connection/ssh-connection-github-probe.test.ts
index 06054e0c86e..046c69f194c 100644
--- a/src/main/ssh/ssh-connection-github-probe.test.ts
+++ b/src/main/ssh/connection/ssh-connection-github-probe.test.ts
@@ -7,37 +7,37 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import { resolveWithSshG } from '../config/ssh-g-config-resolution'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-gssapi-fallback.test.ts b/src/main/ssh/connection/ssh-connection-gssapi-fallback.test.ts
similarity index 94%
rename from src/main/ssh/ssh-connection-gssapi-fallback.test.ts
rename to src/main/ssh/connection/ssh-connection-gssapi-fallback.test.ts
index 0efe8924f7c..0e93680724d 100644
--- a/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
+++ b/src/main/ssh/connection/ssh-connection-gssapi-fallback.test.ts
@@ -3,7 +3,7 @@ import { EventEmitter } from 'node:events'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { clientInstances, ssh2Mock } from './__tests__/ssh-connection-test-client'
+import { clientInstances, ssh2Mock } from '../__tests__/ssh-connection-test-client'
 import { resetSshConnectionMocks, spawnSystemSshCommandMock } from './ssh-connection-test-harness'
 import {
   createCallbacks,
@@ -13,37 +13,37 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import { resolveWithSshG } from '../config/ssh-g-config-resolution'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-host-key-store-wiring.test.ts b/src/main/ssh/connection/ssh-connection-host-key-store-wiring.test.ts
similarity index 96%
rename from src/main/ssh/ssh-connection-host-key-store-wiring.test.ts
rename to src/main/ssh/connection/ssh-connection-host-key-store-wiring.test.ts
index 456aefa212c..e8062ded7c2 100644
--- a/src/main/ssh/ssh-connection-host-key-store-wiring.test.ts
+++ b/src/main/ssh/connection/ssh-connection-host-key-store-wiring.test.ts
@@ -15,7 +15,7 @@ import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:f
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 // Type-only, so it is erased before vi.mock's hoisted factory runs.
-import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
+import type * as SshGConfigResolution from '../config/ssh-g-config-resolution'
 import type * as Ssh2 from 'ssh2'
 
 const VALID_ED25519_HOST_KEY = Buffer.from(
@@ -76,14 +76,14 @@ vi.mock('ssh2', async (importOriginal) => {
   }
 })
 
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) => ({
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) => ({
   ...(await importOriginal<typeof SshGConfigResolution>()),
   resolveWithSshG: vi.fn(async () => null)
 }))
 
 import { SshConnection } from './ssh-connection'
-import { initSshHostKeyStoreFile, isTrusted, loadTrustedHostKeys } from './ssh-host-key-store'
-import type { SshTarget } from '../../shared/ssh-types'
+import { initSshHostKeyStoreFile, isTrusted, loadTrustedHostKeys } from '../ssh-host-key-store'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 const target = (overrides?: Partial<SshTarget>): SshTarget => ({
   id: 'target-1',
diff --git a/src/main/ssh/ssh-connection-host-key-verification.test.ts b/src/main/ssh/connection/ssh-connection-host-key-verification.test.ts
similarity index 89%
rename from src/main/ssh/ssh-connection-host-key-verification.test.ts
rename to src/main/ssh/connection/ssh-connection-host-key-verification.test.ts
index 242b40bf868..ac28eb7b376 100644
--- a/src/main/ssh/ssh-connection-host-key-verification.test.ts
+++ b/src/main/ssh/connection/ssh-connection-host-key-verification.test.ts
@@ -2,40 +2,40 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { connectAttempts, ssh2Mock } from './__tests__/ssh-connection-test-client'
+import { connectAttempts, ssh2Mock } from '../__tests__/ssh-connection-test-client'
 import { resetSshConnectionMocks } from './ssh-connection-test-harness'
 import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-manager-registry.test.ts b/src/main/ssh/connection/ssh-connection-manager-registry.test.ts
similarity index 85%
rename from src/main/ssh/ssh-connection-manager-registry.test.ts
rename to src/main/ssh/connection/ssh-connection-manager-registry.test.ts
index c43cd52859e..70fb9cece28 100644
--- a/src/main/ssh/ssh-connection-manager-registry.test.ts
+++ b/src/main/ssh/connection/ssh-connection-manager-registry.test.ts
@@ -1,37 +1,37 @@
 import { describe, expect, it, vi, beforeEach } from 'vitest'
-import { resetSsh2ClientState } from './__tests__/ssh-connection-test-client'
+import { resetSsh2ClientState } from '../__tests__/ssh-connection-test-client'
 import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnectionManager } from './ssh-connection-manager'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts b/src/main/ssh/connection/ssh-connection-manager-sign-in-reuse.test.ts
similarity index 91%
rename from src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts
rename to src/main/ssh/connection/ssh-connection-manager-sign-in-reuse.test.ts
index ea3d5453a7d..7057b5015a3 100644
--- a/src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts
+++ b/src/main/ssh/connection/ssh-connection-manager-sign-in-reuse.test.ts
@@ -4,44 +4,44 @@ import {
   emitSshEvent,
   eventHandlers,
   ssh2Mock
-} from './__tests__/ssh-connection-test-client'
+} from '../__tests__/ssh-connection-test-client'
 import { resetSshConnectionMocks } from './ssh-connection-test-harness'
 import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnectionManager } from './ssh-connection-manager'
 import {
   recordSshCredentialDeclined,
   resetSshCredentialDeclinesForTests
-} from './ssh-credential-decline'
+} from '../ssh-credential-decline'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-manager.test.ts b/src/main/ssh/connection/ssh-connection-manager.test.ts
similarity index 98%
rename from src/main/ssh/ssh-connection-manager.test.ts
rename to src/main/ssh/connection/ssh-connection-manager.test.ts
index 4418fb2a674..536ddfc9fb7 100644
--- a/src/main/ssh/ssh-connection-manager.test.ts
+++ b/src/main/ssh/connection/ssh-connection-manager.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 type MockConnectionRecord = {
   connect: ReturnType<typeof vi.fn>
@@ -53,9 +53,9 @@ import {
   recordSshCredentialDeclined,
   recordSshSignInAwaited,
   resetSshCredentialDeclinesForTests
-} from './ssh-credential-decline'
-import { isAuthError } from './ssh-connection-utils'
-import { recordSshUserDisconnected, resetSshUserDisconnectsForTests } from './ssh-user-disconnect'
+} from '../ssh-credential-decline'
+import { isAuthError } from '../ssh-connection-utils'
+import { recordSshUserDisconnected, resetSshUserDisconnectsForTests } from '../ssh-user-disconnect'
 
 const target = {
   id: 'target-1',
diff --git a/src/main/ssh/ssh-connection-manager.ts b/src/main/ssh/connection/ssh-connection-manager.ts
similarity index 96%
rename from src/main/ssh/ssh-connection-manager.ts
rename to src/main/ssh/connection/ssh-connection-manager.ts
index 0b54330aae8..bc0b35d9fe5 100644
--- a/src/main/ssh/ssh-connection-manager.ts
+++ b/src/main/ssh/connection/ssh-connection-manager.ts
@@ -1,9 +1,12 @@
-import type { SshTarget, SshConnectionState } from '../../shared/ssh-types'
+import type { SshTarget, SshConnectionState } from '../../../shared/ssh-types'
 import { SshConnection, type SshCachedCredentials } from './ssh-connection'
-import type { SshConnectionCallbacks } from './ssh-connection-utils'
+import type { SshConnectionCallbacks } from '../ssh-connection-utils'
 import { recordSshConnectionOpened, recordSshConnectionReused } from './ssh-connection-attribution'
-import { createSshCredentialDeclinedError, isSshCredentialDeclined } from './ssh-credential-decline'
-import { createSshUserDisconnectedError, isSshUserDisconnected } from './ssh-user-disconnect'
+import {
+  createSshCredentialDeclinedError,
+  isSshCredentialDeclined
+} from '../ssh-credential-decline'
+import { createSshUserDisconnectedError, isSshUserDisconnected } from '../ssh-user-disconnect'
 
 /** A remembered sign-in only applies to the endpoint it was given for; an edited host must ask. */
 function signInEndpoint(target: SshTarget): string {
diff --git a/src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts b/src/main/ssh/connection/ssh-connection-reconnect-handshake-loss.test.ts
similarity index 85%
rename from src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts
rename to src/main/ssh/connection/ssh-connection-reconnect-handshake-loss.test.ts
index 86feb5d2139..5d9bdcf331a 100644
--- a/src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts
+++ b/src/main/ssh/connection/ssh-connection-reconnect-handshake-loss.test.ts
@@ -4,40 +4,40 @@ import {
   connectWithFakeTimers,
   resetSshConnectionMocks
 } from './ssh-connection-test-harness'
-import { clientInstances, emitSshEvent, ssh2Mock } from './__tests__/ssh-connection-test-client'
+import { clientInstances, emitSshEvent, ssh2Mock } from '../__tests__/ssh-connection-test-client'
 import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { CONNECT_TIMEOUT_MS, RECONNECT_BACKOFF_MS } from './ssh-connection-utils'
+import { CONNECT_TIMEOUT_MS, RECONNECT_BACKOFF_MS } from '../ssh-connection-utils'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-reconnect-ladder.test.ts b/src/main/ssh/connection/ssh-connection-reconnect-ladder.test.ts
similarity index 93%
rename from src/main/ssh/ssh-connection-reconnect-ladder.test.ts
rename to src/main/ssh/connection/ssh-connection-reconnect-ladder.test.ts
index d5360b91d8a..38efab06f1a 100644
--- a/src/main/ssh/ssh-connection-reconnect-ladder.test.ts
+++ b/src/main/ssh/connection/ssh-connection-reconnect-ladder.test.ts
@@ -11,7 +11,7 @@ import {
   connectAttempts,
   emitSshEvent,
   ssh2Mock
-} from './__tests__/ssh-connection-test-client'
+} from '../__tests__/ssh-connection-test-client'
 import {
   createCallbacks,
   createHangingSystemCommandChannel,
@@ -19,39 +19,39 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './config/ssh-g-config-resolution'
-import { CONNECT_TIMEOUT_MS, RECONNECT_BACKOFF_MS } from './ssh-connection-utils'
-import { MIN_SSH_RELAY_GRACE_PERIOD_SECONDS } from '../../shared/ssh-types'
+import { resolveWithSshG } from '../config/ssh-g-config-resolution'
+import { CONNECT_TIMEOUT_MS, RECONNECT_BACKOFF_MS } from '../ssh-connection-utils'
+import { MIN_SSH_RELAY_GRACE_PERIOD_SECONDS } from '../../../shared/ssh-types'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-sftp-namespace.test.ts b/src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts
similarity index 93%
rename from src/main/ssh/ssh-connection-sftp-namespace.test.ts
rename to src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts
index ea2fa10dace..dec67dfb8a5 100644
--- a/src/main/ssh/ssh-connection-sftp-namespace.test.ts
+++ b/src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts
@@ -7,10 +7,10 @@ import { mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as SystemSshArgs from './system-transport/system-ssh-args'
-import type * as SystemSshFileBinaryTransfer from './system-transport/system-ssh-file-binary-transfer'
-import type * as SystemSshFileTransfer from './system-transport/system-ssh-file-transfer'
-import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
+import type * as SystemSshArgs from '../system-transport/system-ssh-args'
+import type * as SystemSshFileBinaryTransfer from '../system-transport/system-ssh-file-binary-transfer'
+import type * as SystemSshFileTransfer from '../system-transport/system-ssh-file-transfer'
+import type * as SshGConfigResolution from '../config/ssh-g-config-resolution'
 
 vi.mock('ssh2', () => ({
   BaseAgent: class {},
@@ -19,41 +19,41 @@ vi.mock('ssh2', () => ({
   utils: { parseKey: vi.fn() }
 }))
 
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) => ({
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) => ({
   ...(await importOriginal<typeof SystemSshArgs>()),
   getOrcaControlSocketPath: vi.fn().mockReturnValue(null)
 }))
-vi.mock('./system-transport/system-ssh-command', () => ({
+vi.mock('../system-transport/system-ssh-command', () => ({
   spawnSystemSsh: vi.fn(),
   spawnSystemSshCommand: vi.fn()
 }))
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) => ({
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) => ({
   ...(await importOriginal<typeof SystemSshFileBinaryTransfer>()),
   downloadFileViaSystemSsh: vi.fn().mockResolvedValue(undefined),
   uploadFileViaSystemSsh: vi.fn().mockResolvedValue(undefined),
   writeBufferViaSystemSsh: vi.fn().mockResolvedValue(undefined)
 }))
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) => ({
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) => ({
   ...(await importOriginal<typeof SystemSshFileTransfer>()),
   uploadDirectoryViaSystemSsh: vi.fn().mockResolvedValue(undefined),
   writeFileViaSystemSsh: vi.fn().mockResolvedValue(undefined)
 }))
 
-vi.mock('./ssh-control-socket', () => ({ removeControlSocketPath: vi.fn() }))
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) => ({
+vi.mock('../ssh-control-socket', () => ({ removeControlSocketPath: vi.fn() }))
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) => ({
   ...(await importOriginal<typeof SshGConfigResolution>()),
   resolveWithSshG: vi.fn().mockResolvedValue(null)
 }))
 
 import { SshConnection } from './ssh-connection'
-import type { SftpNamespacePathMapping } from './sftp-namespace-resolution'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import { isSshSessionLimitError } from './ssh-session-limit-error'
+import type { SftpNamespacePathMapping } from '../sftp-namespace-resolution'
+import { getRemoteHostPlatform } from '../ssh-remote-platform'
+import { isSshSessionLimitError } from '../ssh-session-limit-error'
 import {
   uploadDirectoryViaSystemSsh,
   writeFileViaSystemSsh
-} from './system-transport/system-ssh-file-transfer'
-import type { SshTarget } from '../../shared/ssh-types'
+} from '../system-transport/system-ssh-file-transfer'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 const SHELL_HOME = '/var/services/homes/alice'
 const SFTP_HOME = '/homes/alice'
diff --git a/src/main/ssh/ssh-connection-sftp-wire.test.ts b/src/main/ssh/connection/ssh-connection-sftp-wire.test.ts
similarity index 98%
rename from src/main/ssh/ssh-connection-sftp-wire.test.ts
rename to src/main/ssh/connection/ssh-connection-sftp-wire.test.ts
index 3b609c735aa..72188cdc1b1 100644
--- a/src/main/ssh/ssh-connection-sftp-wire.test.ts
+++ b/src/main/ssh/connection/ssh-connection-sftp-wire.test.ts
@@ -3,10 +3,10 @@ import { tmpdir } from 'node:os'
 import { join, posix } from 'node:path'
 import { Client, Server as Ssh2Server, utils, type Connection, type SFTPWrapper } from 'ssh2'
 import { expect, it, vi } from 'vitest'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { SshConnection } from './ssh-connection'
-import type { SftpNamespacePathMapping } from './sftp-namespace-resolution'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import type { SftpNamespacePathMapping } from '../sftp-namespace-resolution'
+import { getRemoteHostPlatform } from '../ssh-remote-platform'
 
 const SHELL_HOME = '/var/services/homes/alice'
 const SFTP_HOME = '/homes/alice'
diff --git a/src/main/ssh/ssh-connection-store-orcad-ownership.test.ts b/src/main/ssh/connection/ssh-connection-store-orcad-ownership.test.ts
similarity index 95%
rename from src/main/ssh/ssh-connection-store-orcad-ownership.test.ts
rename to src/main/ssh/connection/ssh-connection-store-orcad-ownership.test.ts
index 9d306eb8e30..269d9a47a17 100644
--- a/src/main/ssh/ssh-connection-store-orcad-ownership.test.ts
+++ b/src/main/ssh/connection/ssh-connection-store-orcad-ownership.test.ts
@@ -5,14 +5,14 @@ import {
   SshConnectionStore
 } from './ssh-connection-store'
 import { createMockStore } from './ssh-connection-store-test-fixture'
-import { emptyDependentStateStore } from './ssh-target-orcad-dependents-fixture'
+import { emptyDependentStateStore } from '../targets/ssh-target-orcad-dependents-fixture'
 
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
   loadUserSshConfigMock: vi.fn(),
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./config/ssh-config-parser', () => ({
+vi.mock('../config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/ssh/ssh-connection-store-test-fixture.ts b/src/main/ssh/connection/ssh-connection-store-test-fixture.ts
similarity index 95%
rename from src/main/ssh/ssh-connection-store-test-fixture.ts
rename to src/main/ssh/connection/ssh-connection-store-test-fixture.ts
index 53b776ffd3f..3ef483f6407 100644
--- a/src/main/ssh/ssh-connection-store-test-fixture.ts
+++ b/src/main/ssh/connection/ssh-connection-store-test-fixture.ts
@@ -1,7 +1,7 @@
 import { vi } from 'vitest'
-import type { FolderWorkspace } from '../../shared/folder-workspace-types'
-import type { Repo } from '../../shared/repo-types'
-import type { RemovedSshTargetTombstone, SshTarget } from '../../shared/ssh-types'
+import type { FolderWorkspace } from '../../../shared/folder-workspace-types'
+import type { Repo } from '../../../shared/repo-types'
+import type { RemovedSshTargetTombstone, SshTarget } from '../../../shared/ssh-types'
 
 export function createMockStore() {
   const targets: SshTarget[] = []
diff --git a/src/main/ssh/ssh-connection-store.test.ts b/src/main/ssh/connection/ssh-connection-store.test.ts
similarity index 99%
rename from src/main/ssh/ssh-connection-store.test.ts
rename to src/main/ssh/connection/ssh-connection-store.test.ts
index 9507e993e30..9c38e021aff 100644
--- a/src/main/ssh/ssh-connection-store.test.ts
+++ b/src/main/ssh/connection/ssh-connection-store.test.ts
@@ -1,14 +1,14 @@
 import { describe, expect, it, vi, beforeEach } from 'vitest'
 import { SshConnectionStore } from './ssh-connection-store'
 import { createMockStore } from './ssh-connection-store-test-fixture'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
   loadUserSshConfigMock: vi.fn(),
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./config/ssh-config-parser', () => ({
+vi.mock('../config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/ssh/ssh-connection-store.ts b/src/main/ssh/connection/ssh-connection-store.ts
similarity index 96%
rename from src/main/ssh/ssh-connection-store.ts
rename to src/main/ssh/connection/ssh-connection-store.ts
index e032d1928a5..fa5bd340041 100644
--- a/src/main/ssh/ssh-connection-store.ts
+++ b/src/main/ssh/connection/ssh-connection-store.ts
@@ -1,13 +1,13 @@
-import type { Store } from '../persistence'
-import type { SshRepoReadoption, SshTarget } from '../../shared/ssh-types'
-import { RUNTIME_OWNED_SSH_TARGET_ID_PREFIX } from '../../shared/execution-host'
-import { normalizeSshConfigAlias } from '../../shared/ssh-config-alias'
-import { loadUserSshConfig, sshConfigHostsToTargets } from './config/ssh-config-parser'
-import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import type { Store } from '../../persistence'
+import type { SshRepoReadoption, SshTarget } from '../../../shared/ssh-types'
+import { RUNTIME_OWNED_SSH_TARGET_ID_PREFIX } from '../../../shared/execution-host'
+import { normalizeSshConfigAlias } from '../../../shared/ssh-config-alias'
+import { loadUserSshConfig, sshConfigHostsToTargets } from '../config/ssh-config-parser'
+import { SshTargetOrcadClaims } from '../targets/ssh-target-orcad-claims'
 import {
   buildRemovedSshTargetTombstone,
   readoptOrphanedWorkspacesForTarget
-} from './ssh-target-readoption'
+} from '../targets/ssh-target-readoption'
 
 export class SshConnectionStore {
   constructor(private store: Store) {}
diff --git a/src/main/ssh/ssh-connection-system-transport.test.ts b/src/main/ssh/connection/ssh-connection-system-transport.test.ts
similarity index 92%
rename from src/main/ssh/ssh-connection-system-transport.test.ts
rename to src/main/ssh/connection/ssh-connection-system-transport.test.ts
index 12513928f8f..bb4f841957b 100644
--- a/src/main/ssh/ssh-connection-system-transport.test.ts
+++ b/src/main/ssh/connection/ssh-connection-system-transport.test.ts
@@ -2,7 +2,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { clientInstances, ssh2Mock } from './__tests__/ssh-connection-test-client'
+import { clientInstances, ssh2Mock } from '../__tests__/ssh-connection-test-client'
 import {
   findSystemSshMock,
   getOrcaControlSocketPathMock,
@@ -19,45 +19,45 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { shouldUseSystemSshTransport } from './ssh-transport-selection'
-import { resolveWithSshG } from './config/ssh-g-config-resolution'
-import { writeFileViaSystemSsh } from './system-transport/system-ssh-file-transfer'
-import { CONNECT_TIMEOUT_MS } from './ssh-connection-utils'
-import type { SshTarget } from '../../shared/ssh-types'
+import { shouldUseSystemSshTransport } from '../ssh-transport-selection'
+import { resolveWithSshG } from '../config/ssh-g-config-resolution'
+import { writeFileViaSystemSsh } from '../system-transport/system-ssh-file-transfer'
+import { CONNECT_TIMEOUT_MS } from '../ssh-connection-utils'
+import type { SshTarget } from '../../../shared/ssh-types'
 import {
   createOpenSshPrivateKeyFixture,
   createOpenSshPublicKeyFixture
-} from './ssh-security-key-identity.test-fixture'
+} from '../ssh-security-key-identity.test-fixture'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-test-fixtures.ts b/src/main/ssh/connection/ssh-connection-test-fixtures.ts
similarity index 95%
rename from src/main/ssh/ssh-connection-test-fixtures.ts
rename to src/main/ssh/connection/ssh-connection-test-fixtures.ts
index 5c8b9c568c6..3eb40fc0318 100644
--- a/src/main/ssh/ssh-connection-test-fixtures.ts
+++ b/src/main/ssh/connection/ssh-connection-test-fixtures.ts
@@ -2,9 +2,9 @@ import { EventEmitter } from 'node:events'
 import { vi } from 'vitest'
 import type { Mock } from 'vitest'
 import type { AnyAuthMethod, AuthenticationType } from 'ssh2'
-import type { SshConnectionCallbacks } from './ssh-connection-utils'
-import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshConnectionCallbacks } from '../ssh-connection-utils'
+import type { SshResolvedConfig } from '../config/ssh-g-config-resolution'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 export function createTarget(overrides?: Partial<SshTarget>): SshTarget {
   return {
diff --git a/src/main/ssh/ssh-connection-test-harness.ts b/src/main/ssh/connection/ssh-connection-test-harness.ts
similarity index 87%
rename from src/main/ssh/ssh-connection-test-harness.ts
rename to src/main/ssh/connection/ssh-connection-test-harness.ts
index 617c6ea2fd0..e749c053d0a 100644
--- a/src/main/ssh/ssh-connection-test-harness.ts
+++ b/src/main/ssh/connection/ssh-connection-test-harness.ts
@@ -2,15 +2,15 @@ import { vi } from 'vitest'
 import { createSystemCommandChannel, createSystemSshProcess } from './ssh-connection-test-fixtures'
 import type { SshConnection } from './ssh-connection'
 import type { MockSystemCommandChannel, MockSystemSshProcess } from './ssh-connection-test-fixtures'
-import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
-import type { SystemSshBuildArgsOptions } from './system-transport/system-ssh-args'
-import type { SshTarget } from '../../shared/ssh-types'
-import type * as SystemSshArgs from './system-transport/system-ssh-args'
-import type * as SystemSshCommand from './system-transport/system-ssh-command'
-import type * as SystemSshFileBinaryTransfer from './system-transport/system-ssh-file-binary-transfer'
-import type * as SystemSshFileTransfer from './system-transport/system-ssh-file-transfer'
-import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
-import { resetSsh2ClientState, ssh2Mock } from './__tests__/ssh-connection-test-client'
+import type { SshResolvedConfig } from '../config/ssh-g-config-resolution'
+import type { SystemSshBuildArgsOptions } from '../system-transport/system-ssh-args'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type * as SystemSshArgs from '../system-transport/system-ssh-args'
+import type * as SystemSshCommand from '../system-transport/system-ssh-command'
+import type * as SystemSshFileBinaryTransfer from '../system-transport/system-ssh-file-binary-transfer'
+import type * as SystemSshFileTransfer from '../system-transport/system-ssh-file-transfer'
+import type * as SshGConfigResolution from '../config/ssh-g-config-resolution'
+import { resetSsh2ClientState, ssh2Mock } from '../__tests__/ssh-connection-test-client'
 
 export type SystemSshBinaryModuleMock = { findSystemSsh: typeof findSystemSshMock }
 
diff --git a/src/main/ssh/ssh-connection-wake-retry.test.ts b/src/main/ssh/connection/ssh-connection-wake-retry.test.ts
similarity index 90%
rename from src/main/ssh/ssh-connection-wake-retry.test.ts
rename to src/main/ssh/connection/ssh-connection-wake-retry.test.ts
index 2acb23cd6df..ded760113a4 100644
--- a/src/main/ssh/ssh-connection-wake-retry.test.ts
+++ b/src/main/ssh/connection/ssh-connection-wake-retry.test.ts
@@ -6,7 +6,7 @@ import {
   resetSshConnectionMocks,
   spawnSystemSshCommandMock
 } from './ssh-connection-test-harness'
-import { clientInstances, emitSshEvent, ssh2Mock } from './__tests__/ssh-connection-test-client'
+import { clientInstances, emitSshEvent, ssh2Mock } from '../__tests__/ssh-connection-test-client'
 import {
   createCallbacks,
   createHangingSystemCommandChannel,
@@ -14,40 +14,40 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import { resolveWithSshG } from '../config/ssh-g-config-resolution'
 import { SshConnectionManager } from './ssh-connection-manager'
-import { RECONNECT_BACKOFF_MS } from './ssh-connection-utils'
-import { recordSshUserDisconnected, resetSshUserDisconnectsForTests } from './ssh-user-disconnect'
+import { RECONNECT_BACKOFF_MS } from '../ssh-connection-utils'
+import { recordSshUserDisconnected, resetSshUserDisconnectsForTests } from '../ssh-user-disconnect'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection.test.ts b/src/main/ssh/connection/ssh-connection.test.ts
similarity index 97%
rename from src/main/ssh/ssh-connection.test.ts
rename to src/main/ssh/connection/ssh-connection.test.ts
index 0a89f4efc21..1b06b5831e7 100644
--- a/src/main/ssh/ssh-connection.test.ts
+++ b/src/main/ssh/connection/ssh-connection.test.ts
@@ -6,40 +6,40 @@ import {
   eventHandlers,
   VALID_ED25519_HOST_KEY,
   ssh2Mock
-} from './__tests__/ssh-connection-test-client'
+} from '../__tests__/ssh-connection-test-client'
 import { resetSshConnectionMocks } from './ssh-connection-test-harness'
 import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
 
 vi.mock('ssh2', async () =>
-  (await import('./__tests__/ssh-connection-test-client')).createSsh2Module()
+  (await import('../__tests__/ssh-connection-test-client')).createSsh2Module()
 )
-vi.mock('./system-transport/system-ssh-binary', async () =>
+vi.mock('../system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('../system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./ssh-control-socket', async () =>
+vi.mock('../ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./config/ssh-config-parser', async () =>
+vi.mock('../config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('../config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection.ts b/src/main/ssh/connection/ssh-connection.ts
similarity index 97%
rename from src/main/ssh/ssh-connection.ts
rename to src/main/ssh/connection/ssh-connection.ts
index 1d638dcfdef..87072c1b74c 100644
--- a/src/main/ssh/ssh-connection.ts
+++ b/src/main/ssh/connection/ssh-connection.ts
@@ -20,14 +20,14 @@ import type {
   SFTPWrapper,
   ShellOptions
 } from 'ssh2'
-import type { SshTarget, SshConnectionState, SshConnectionStatus } from '../../shared/ssh-types'
+import type { SshTarget, SshConnectionState, SshConnectionStatus } from '../../../shared/ssh-types'
 import {
   getOrcaControlSocketPath,
   isOpenSshConfigBackedTarget,
   type SystemSshBuildArgsOptions
-} from './system-transport/system-ssh-args'
-import { spawnSystemSshCommand } from './system-transport/system-ssh-command'
-import { removeControlSocketPath } from './ssh-control-socket'
+} from '../system-transport/system-ssh-args'
+import { spawnSystemSshCommand } from '../system-transport/system-ssh-command'
+import { removeControlSocketPath } from '../ssh-control-socket'
 import {
   INITIAL_RETRY_ATTEMPTS,
   INITIAL_RETRY_DELAY_MS,
@@ -47,58 +47,58 @@ import {
   type SshExecOptions,
   type SshConnectionCallbacks,
   type SshCredentialKind
-} from './ssh-connection-utils'
-import { collectKeyboardInteractiveResponses } from './ssh-keyboard-interactive'
-import { resolveEffectiveProxy, spawnProxyCommand } from './ssh-proxy-command'
+} from '../ssh-connection-utils'
+import { collectKeyboardInteractiveResponses } from '../ssh-keyboard-interactive'
+import { resolveEffectiveProxy, spawnProxyCommand } from '../ssh-proxy-command'
 import {
   createHostKeyVerifier,
   DEFAULT_SERVER_HOST_KEY_ALGORITHMS,
   orderServerHostKeyAlgorithms
-} from './ssh-host-key-verifier'
-import { HostKeyVerificationError, isHostKeyVerificationError } from './ssh-host-key-decision'
+} from '../ssh-host-key-verifier'
+import { HostKeyVerificationError, isHostKeyVerificationError } from '../ssh-host-key-decision'
 import {
   resolveWithSshG,
   siteConfigMayRestrictHostKeys,
   sshGArgsForHost,
   type SshResolvedConfig
-} from './config/ssh-g-config-resolution'
+} from '../config/ssh-g-config-resolution'
 import {
   boundSshHostKeyStoreFile,
   loadTrustedHostKeys,
   matchTrustedHostKeys,
   storedKeyTypesForEndpoint,
   trustHostKey
-} from './ssh-host-key-store'
+} from '../ssh-host-key-store'
 import {
   loadKnownHostsEvidence,
   resolveKnownHostsFiles,
   resolveKnownHostsLookupHost
-} from './config/ssh-known-hosts-source'
+} from '../config/ssh-known-hosts-source'
 import {
   createCancelledConnectAttemptError,
   isCancelledConnectAttemptError
-} from './ssh-connect-attempt-cancellation'
+} from '../ssh-connect-attempt-cancellation'
 import {
   isDefiniteSystemSshHostFailure,
   isTransientReconnectError
-} from './ssh-reconnect-error-classification'
-import { SshReconnectLadder } from './ssh-reconnect-ladder'
-import { mayUserSshConfigClaimAlias } from './config/ssh-config-alias-claim'
+} from '../ssh-reconnect-error-classification'
+import { SshReconnectLadder } from '../ssh-reconnect-ladder'
+import { mayUserSshConfigClaimAlias } from '../config/ssh-config-alias-claim'
 import {
   didDeferKeyboardInteractive,
   didOfferKeyboardInteractive,
   getPassphrasePrivateKeyPath
-} from './ssh-private-key-authentication'
+} from '../ssh-private-key-authentication'
 import {
   requiresSystemSshForSecurityKey,
   shouldUseSystemSshTransport
-} from './ssh-transport-selection'
-import type { FileUploadSession } from '../providers/filesystem-provider-contract'
-import { openSshSessionChannelWithRetry, waitForSshChannelOpen } from './ssh-channel-open'
-import { tagSftpHandshakeCorruption } from './sftp-handshake-corruption'
-import { withTimeout } from '../../shared/promise-timeout-fallback'
-import { isEphemeralRuntimeSshOwner } from '../../shared/managed-orcad-ssh-owner'
-import { isSshUserDisconnected } from './ssh-user-disconnect'
+} from '../ssh-transport-selection'
+import type { FileUploadSession } from '../../providers/filesystem-provider-contract'
+import { openSshSessionChannelWithRetry, waitForSshChannelOpen } from '../ssh-channel-open'
+import { tagSftpHandshakeCorruption } from '../sftp-handshake-corruption'
+import { withTimeout } from '../../../shared/promise-timeout-fallback'
+import { isEphemeralRuntimeSshOwner } from '../../../shared/managed-orcad-ssh-owner'
+import { isSshUserDisconnected } from '../ssh-user-disconnect'
 
 /** The sign-in a connection holds in memory, handed to the connection that replaces it. */
 export type SshCachedCredentials = { password: string | null; passphrase: string | null }
diff --git a/src/main/ssh/hostile-host-test-support/ssh-hostile-host-test-harness.ts b/src/main/ssh/hostile-host-test-support/ssh-hostile-host-test-harness.ts
index 316c3be785e..23811f7c0e9 100644
--- a/src/main/ssh/hostile-host-test-support/ssh-hostile-host-test-harness.ts
+++ b/src/main/ssh/hostile-host-test-support/ssh-hostile-host-test-harness.ts
@@ -8,7 +8,7 @@ import { join } from 'node:path'
 import { setAppEnvironment } from '../../../shared/app-environment'
 import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
 import type { SshTarget } from '../../../shared/ssh-types'
-import { SshConnection } from '../ssh-connection'
+import { SshConnection } from '../connection/ssh-connection'
 
 export function installHostileHostAppEnvironment(): () => void {
   const userData = mkdtempSync(join(tmpdir(), 'orca-hostile-hosts-userdata-'))
diff --git a/src/main/ssh/legacy-relay/legacy-relay-bridge-ipc.ts b/src/main/ssh/legacy-relay/legacy-relay-bridge-ipc.ts
index dd7a736d551..6093e52b62d 100644
--- a/src/main/ssh/legacy-relay/legacy-relay-bridge-ipc.ts
+++ b/src/main/ssh/legacy-relay/legacy-relay-bridge-ipc.ts
@@ -9,7 +9,7 @@ import { isRemoteCliControlAllowed } from '../../../shared/ssh-remote-cli-contro
 import type { Store } from '../../persistence'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import { track } from '../../telemetry/client'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { knownSshHostPlatform } from '../ssh-host-platform-memo'
 import { hostProps } from '../ssh-host-server-telemetry'
 import {
diff --git a/src/main/ssh/legacy-relay/legacy-relay-bridge-registry.ts b/src/main/ssh/legacy-relay/legacy-relay-bridge-registry.ts
index 67a213f886c..355cfc37197 100644
--- a/src/main/ssh/legacy-relay/legacy-relay-bridge-registry.ts
+++ b/src/main/ssh/legacy-relay/legacy-relay-bridge-registry.ts
@@ -10,7 +10,7 @@ import type {
 } from '../../../shared/legacy-relay-bridge-contract'
 import { parseAppSshPtyId } from '../../../shared/ssh-pty-id'
 import type { SshRemotePtyLease } from '../../../shared/ssh-types'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { waitForSentinel } from './ssh-relay-sentinel'
 import { probeRelayEndpointIncumbent } from './ssh-relay-endpoint-incumbent'
 import { isWindowsRemoteHost } from '../ssh-remote-platform'
diff --git a/src/main/ssh/legacy-relay/legacy-relay-bridge-teardown.test.ts b/src/main/ssh/legacy-relay/legacy-relay-bridge-teardown.test.ts
index 7ca50c7d5e5..f4d6b5291a9 100644
--- a/src/main/ssh/legacy-relay/legacy-relay-bridge-teardown.test.ts
+++ b/src/main/ssh/legacy-relay/legacy-relay-bridge-teardown.test.ts
@@ -2,7 +2,7 @@ import { beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 import type { LegacyRelayBridgedPane } from '../../../shared/legacy-relay-bridge-contract'
 import { toAppSshPtyId } from '../../../shared/ssh-pty-id'
 import type { SshRemotePtyLease } from '../../../shared/ssh-types'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import type { LegacyRelayTargetBridgeDeps } from './legacy-relay-target-bridge'
 import type { LegacyRelayBridgeHost } from './legacy-relay-bridge-registry'
 
diff --git a/src/main/ssh/legacy-relay/legacy-relay-endpoints.test.ts b/src/main/ssh/legacy-relay/legacy-relay-endpoints.test.ts
index da27f56ae56..460ee08e5c4 100644
--- a/src/main/ssh/legacy-relay/legacy-relay-endpoints.test.ts
+++ b/src/main/ssh/legacy-relay/legacy-relay-endpoints.test.ts
@@ -1,6 +1,6 @@
 import type * as ExecCommandModule from '../remote-exec/remote-exec-command'
 import { describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { relaySocketNameForInstanceId } from './ssh-relay-instance-id'
 import { windowsRelayPipePathsForSocketName } from './ssh-relay-endpoints'
 import { getRemoteHostPlatform, joinRemotePath } from '../ssh-remote-platform'
diff --git a/src/main/ssh/legacy-relay/legacy-relay-endpoints.ts b/src/main/ssh/legacy-relay/legacy-relay-endpoints.ts
index a254b5397ac..1d9c10978ff 100644
--- a/src/main/ssh/legacy-relay/legacy-relay-endpoints.ts
+++ b/src/main/ssh/legacy-relay/legacy-relay-endpoints.ts
@@ -5,7 +5,7 @@
  * Read-only: lists sockets or pipes and reads each daemon's argv; never starts, stops or removes
  * anything. Another desktop's relay hashes another target id, so it is never listed here.
  */
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { shellEscape } from '../ssh-connection-utils'
 import { RELAY_REMOTE_DIR } from '../remote-exec/remote-frame-protocol'
 import { SHORT_RELAY_SOCKET_DIR_PREFIX } from '../relay-socket-path-limit'
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-census-for-target.test.ts b/src/main/ssh/legacy-relay/ssh-host-relay-census-for-target.test.ts
index c870871dba6..d65b8d272ec 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-census-for-target.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-census-for-target.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import type { SshTarget } from '../../../shared/ssh-types'
 
 const mocks = vi.hoisted(() => ({
@@ -23,7 +23,7 @@ vi.mock('./ssh-host-relay-terminals-on-connect', () => ({
 }))
 
 const { censusHostRelayTerminalsFor } = await import('./ssh-host-relay-census-for-target')
-const attribution = await import('../ssh-connection-attribution')
+const attribution = await import('../connection/ssh-connection-attribution')
 
 const target: SshTarget = { id: 'ssh-1', label: 'Box', host: 'box', port: 22, username: 'me' }
 // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: attribution keys on identity only.
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-census-for-target.ts b/src/main/ssh/legacy-relay/ssh-host-relay-census-for-target.ts
index 3abea9e9025..dd3eb956993 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-census-for-target.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-census-for-target.ts
@@ -6,7 +6,7 @@ import {
   currentSshOwner,
   isSshConnectionSolelyOwnedBy,
   runAttributedToSshOwner
-} from '../ssh-connection-attribution'
+} from '../connection/ssh-connection-attribution'
 import {
   censusSshHostRelaysBeforeSession,
   hostTerminalProofFromCensus
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.test.ts b/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.test.ts
index b9a1092b0ab..252a81cb696 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.test.ts
@@ -1,6 +1,6 @@
 import type * as ExecCommandModule from '../remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import {
   parseRelayEndpointIncumbentProbe,
   type RelayEndpointIncumbent
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.ts b/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.ts
index 9ffc15310f7..8ffd098c12b 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.ts
@@ -6,7 +6,7 @@
  * Loss of contact is never evidence of exit (docs/reference/ssh-execution-boundary.md): a listing
  * that failed, ran out of room, or an endpoint the probe could not classify is `unverifiable`.
  */
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { shellEscape } from '../ssh-connection-utils'
 import { RELAY_REMOTE_DIR } from '../remote-exec/remote-frame-protocol'
 import { SHORT_RELAY_SOCKET_DIR_PREFIX } from '../relay-socket-path-limit'
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-terminals-on-connect.ts b/src/main/ssh/legacy-relay/ssh-host-relay-terminals-on-connect.ts
index cc0bc9a476c..5c59d12b485 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-terminals-on-connect.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-terminals-on-connect.ts
@@ -8,7 +8,7 @@ import {
   censusHostRelayEndpoints,
   type HostRelayEndpointCensus
 } from './ssh-host-relay-endpoint-census'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { censusWindowsHostRelays, windowsCensusNodePath } from './ssh-host-relay-windows-census'
 import { execCommand } from '../remote-exec/remote-exec-command'
 import { readRemoteHomeCommand } from '../ssh-remote-commands'
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.test.ts b/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.test.ts
index fe1070a75a4..63fb1bf54ca 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.test.ts
@@ -1,6 +1,6 @@
 import type * as ExecCommandModule from '../remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { relaySocketNameForInstanceId } from './ssh-relay-instance-id'
 import { windowsRelayPipePathsForSocketName } from './ssh-relay-endpoints'
 import { getRemoteHostPlatform, joinRemotePath } from '../ssh-remote-platform'
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.ts b/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.ts
index 62a19f6b8a0..c70c2e7183d 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.ts
@@ -8,7 +8,7 @@
  * failed or a live pipe that cannot be asked: a shell no lease here knows must never let the host
  * convert under it.
  */
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { RELAY_REMOTE_DIR } from '../remote-exec/remote-frame-protocol'
 import { RELAY_INSTALL_MODEL } from '../../managed-server/install/remote-install-model'
 import type { HostRelayEndpointCensus } from './ssh-host-relay-endpoint-census'
diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts
index 28bc400f21d..85d4267ec58 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts
@@ -16,7 +16,7 @@ import {
   probeRelayEndpointIncumbent,
   relayEndpointIncumbentProbeCommand
 } from './ssh-relay-endpoint-incumbent'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { getRemoteHostPlatform } from '../ssh-remote-platform'
 
 // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never dereferences the connection; the Windows path returns before using it.
diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.ts
index e28d0f492b0..eb920301af5 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.ts
@@ -21,7 +21,7 @@
  *   kernel may hold it, and this machine's connect and `lsof` cannot see that machine.
  */
 import { RELAY_LSOF_PROBE_JS } from '@orca/process-host/posix-lsof-probe'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { shellEscape } from '../ssh-connection-utils'
 import {
   RELAY_CHILD_COUNT_VAR,
diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.test.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.test.ts
index 9d48babd73b..15d60299e06 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 
 const { waitForSentinel, request, dispose } = vi.hoisted(() => ({
   waitForSentinel: vi.fn(),
diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.ts
index 374a89d61e8..26f148b7991 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.ts
@@ -6,7 +6,7 @@
  * itself knows: its own `relay.js --connect` presents its own build hash, so any client reaches it,
  * and `pty.listProcesses` needs no PTY owner role, so asking never takes over another desktop's.
  */
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { SshChannelMultiplexer } from '../ssh-channel-multiplexer'
 import { shellEscape } from '../ssh-connection-utils'
 import { SHORT_RELAY_SOCKET_DIR_PREFIX } from '../relay-socket-path-limit'
diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.ts
index 844c97724ca..52cb398dd6a 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.ts
@@ -6,7 +6,7 @@
  * relay resolved. Asking that relay, or probing its socket, with the same runtime is what keeps a
  * host with no PATH Node from reading every relay as unverifiable.
  */
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { execCommand } from '../remote-exec/remote-exec-command'
 
 const RELAY_DAEMON_MARKER = ' relay.js --detached '
diff --git a/src/main/ssh/orcad-deployment-target.test.ts b/src/main/ssh/orcad-deployment-target.test.ts
index 0f3cad13d73..51661654624 100644
--- a/src/main/ssh/orcad-deployment-target.test.ts
+++ b/src/main/ssh/orcad-deployment-target.test.ts
@@ -5,8 +5,8 @@ import {
   parseOrcadLinuxLibc,
   resolveOrcadDeploymentTargetFacts
 } from './orcad-deployment-target'
-import { SshConnection } from './ssh-connection'
-import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
+import { SshConnection } from './connection/ssh-connection'
+import { createCallbacks, createTarget } from './connection/ssh-connection-test-fixtures'
 import { execCommand } from './remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 
diff --git a/src/main/ssh/orcad-migration-cutover-coordinator.test.ts b/src/main/ssh/orcad-migration-cutover-coordinator.test.ts
index 197fcf94f42..cca170c90fd 100644
--- a/src/main/ssh/orcad-migration-cutover-coordinator.test.ts
+++ b/src/main/ssh/orcad-migration-cutover-coordinator.test.ts
@@ -15,7 +15,7 @@ import {
 import { ORCAD_MIGRATION_DESTINATION_UNSUPPORTED } from './orcad-migration-catalog-client'
 import { listOrcadMigrationSourceCutovers } from './orcad-migration-cutover-journal'
 import { fenceOrcadMigrationSource } from './orcad-migration-source-fence'
-import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 import { fakeOrcadMigrationDestination as fakeDestination } from './orcad-migration-destination-fake'
 
 const TARGET: SshTarget = {
diff --git a/src/main/ssh/orcad-migration-cutover-coordinator.ts b/src/main/ssh/orcad-migration-cutover-coordinator.ts
index c82fd00afe6..62ee0e5ed2d 100644
--- a/src/main/ssh/orcad-migration-cutover-coordinator.ts
+++ b/src/main/ssh/orcad-migration-cutover-coordinator.ts
@@ -31,9 +31,9 @@ import {
   transferOrcadMigrationSnapshots,
   type OrcadMigrationSnapshotSource
 } from './orcad-migration-snapshot-coordinator'
-import type { OrcadMigrationPreflightStore } from './ssh-target-orcad-preflight'
+import type { OrcadMigrationPreflightStore } from './targets/ssh-target-orcad-preflight'
 import { sshRelayMigrationCutoverPort } from './orcad-migration-ssh-relay-source'
-import type { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import type { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 
 /** The destination's catalog operations, served by the T6-9 orcad.migration.* client. */
 export type OrcadMigrationDestinationCatalog = {
diff --git a/src/main/ssh/orcad-migration-delta-move.test.ts b/src/main/ssh/orcad-migration-delta-move.test.ts
index 6173fdb68d0..ef7c71f0dad 100644
--- a/src/main/ssh/orcad-migration-delta-move.test.ts
+++ b/src/main/ssh/orcad-migration-delta-move.test.ts
@@ -25,7 +25,7 @@ import { planOrcadDeltaMove } from './orcad-migration-delta-plan'
 import { latestOrcadMigrationInto } from './orcad-migration-rollback-mark'
 import { retainOrcadMigrationSource } from './orcad-migration-source-retention'
 import { reconcileManagedOrcadSshTargets, visibleRepos } from './orcad-retained-source'
-import { SshConnectionStore } from './ssh-connection-store'
+import { SshConnectionStore } from './connection/ssh-connection-store'
 import { resolveHostServerOnConnect } from './ssh-host-server-on-connect'
 import { hostServerDepsStub } from './ssh-host-server-on-connect-test-deps'
 import { runTargetLifecycle } from '../ipc/ssh/ssh-target-lifecycle-queue'
@@ -34,7 +34,7 @@ const mocks = vi.hoisted(() => {
   const state: { targetStore: unknown } = { targetStore: null }
   return { state, deploy: vi.fn(), ensureTunnel: vi.fn() }
 })
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('./targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({}),
   getSshTargetRegistryStore: () => mocks.state.targetStore
 }))
diff --git a/src/main/ssh/orcad-migration-delta-move.ts b/src/main/ssh/orcad-migration-delta-move.ts
index e502342655d..9767c1b6413 100644
--- a/src/main/ssh/orcad-migration-delta-move.ts
+++ b/src/main/ssh/orcad-migration-delta-move.ts
@@ -43,7 +43,7 @@ import {
   type CensusHostRelayTerminals
 } from './orcad-migration-terminal-gate'
 import { currentOrcadSourceFingerprint } from './orcad-retained-source'
-import type { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import type { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 import { orcadMigrationRefusalReason } from './orcad-migration-refusal-reason'
 import { errorMessage } from '../../shared/error-message'
 
diff --git a/src/main/ssh/orcad-migration-delta-plan.ts b/src/main/ssh/orcad-migration-delta-plan.ts
index fd586813a0e..55952da8a5c 100644
--- a/src/main/ssh/orcad-migration-delta-plan.ts
+++ b/src/main/ssh/orcad-migration-delta-plan.ts
@@ -23,8 +23,8 @@ import {
   type OrcadMigrationCatalogIds
 } from './orcad-migration-manifest-export'
 import type { OrcadMigrationSnapshotSource } from './orcad-migration-snapshot-coordinator'
-import { collectUntransferredDependentBlockers } from './ssh-target-orcad-dependents'
-import type { OrcadMigrationPreflightStore } from './ssh-target-orcad-preflight'
+import { collectUntransferredDependentBlockers } from './targets/ssh-target-orcad-dependents'
+import type { OrcadMigrationPreflightStore } from './targets/ssh-target-orcad-preflight'
 
 export type OrcadDeltaSourceStore = OrcadMigrationPreflightStore & OrcadMigrationSnapshotSource
 
diff --git a/src/main/ssh/orcad-migration-delta-snapshot.test.ts b/src/main/ssh/orcad-migration-delta-snapshot.test.ts
index 0810c431ae3..40a53bad058 100644
--- a/src/main/ssh/orcad-migration-delta-snapshot.test.ts
+++ b/src/main/ssh/orcad-migration-delta-snapshot.test.ts
@@ -15,14 +15,14 @@ import { listOrcadMigrationSourceCutovers } from './orcad-migration-cutover-jour
 import { fakeOrcadMigrationDestination } from './orcad-migration-destination-fake'
 import { runOrcadDeltaMove } from './orcad-migration-delta-move'
 import { reconcileManagedOrcadSshTargets } from './orcad-retained-source'
-import { SshConnectionStore } from './ssh-connection-store'
+import { SshConnectionStore } from './connection/ssh-connection-store'
 import { runTargetLifecycle } from '../ipc/ssh/ssh-target-lifecycle-queue'
 
 const mocks = vi.hoisted(() => {
   const state: { targetStore: unknown } = { targetStore: null }
   return { state, deploy: vi.fn(), ensureTunnel: vi.fn() }
 })
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('./targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({}),
   getSshTargetRegistryStore: () => mocks.state.targetStore
 }))
diff --git a/src/main/ssh/orcad-migration-repository-link.test.ts b/src/main/ssh/orcad-migration-repository-link.test.ts
index f741b66496b..0db316682ad 100644
--- a/src/main/ssh/orcad-migration-repository-link.test.ts
+++ b/src/main/ssh/orcad-migration-repository-link.test.ts
@@ -30,13 +30,13 @@ import {
   type OrcadServerFolderCatalog
 } from './orcad-server-folder-workspaces'
 import { reconcileManagedOrcadSshTargets, visibleRepos } from './orcad-retained-source'
-import { SshConnectionStore } from './ssh-connection-store'
+import { SshConnectionStore } from './connection/ssh-connection-store'
 
 const mocks = vi.hoisted(() => {
   const state: { targetStore: unknown } = { targetStore: null }
   return { state, deploy: vi.fn(), ensureTunnel: vi.fn() }
 })
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('./targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({}),
   getSshTargetRegistryStore: () => mocks.state.targetStore
 }))
diff --git a/src/main/ssh/orcad-migration-repository-link.ts b/src/main/ssh/orcad-migration-repository-link.ts
index 67bc579193c..458ab1a0b49 100644
--- a/src/main/ssh/orcad-migration-repository-link.ts
+++ b/src/main/ssh/orcad-migration-repository-link.ts
@@ -32,7 +32,7 @@ import {
   folderWorkspacesHeldByServer,
   type OrcadServerFolderCatalog
 } from './orcad-server-folder-workspaces'
-import type { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import type { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 
 export type OrcadServerRepository = Pick<Repo, 'id' | 'path'> & {
   connectionId?: string | null
diff --git a/src/main/ssh/orcad-migration-source-assertions.ts b/src/main/ssh/orcad-migration-source-assertions.ts
index b0c0fb4dcf9..ff14f9bcc78 100644
--- a/src/main/ssh/orcad-migration-source-assertions.ts
+++ b/src/main/ssh/orcad-migration-source-assertions.ts
@@ -8,8 +8,8 @@ import type { OrcadMigrationSourceCutover } from '../../shared/orcad-migration-s
 import { createOrcadMigrationManifest } from './orcad-migration-manifest-export'
 import { resolveOrcadMigrationFence } from './orcad-migration-source-fence'
 import { confirmOrcadMigrationTerminalsUnderFence } from './orcad-migration-terminal-gate'
-import { collectUntransferredDependentBlockers } from './ssh-target-orcad-dependents'
-import type { OrcadMigrationPreflightStore } from './ssh-target-orcad-preflight'
+import { collectUntransferredDependentBlockers } from './targets/ssh-target-orcad-dependents'
+import type { OrcadMigrationPreflightStore } from './targets/ssh-target-orcad-preflight'
 
 export function assertOrcadMigrationSourceUnchanged(
   context: { userDataPath: string; store: OrcadMigrationPreflightStore },
diff --git a/src/main/ssh/orcad-migration-source-fence.test.ts b/src/main/ssh/orcad-migration-source-fence.test.ts
index bf7b1019f65..29c4867269b 100644
--- a/src/main/ssh/orcad-migration-source-fence.test.ts
+++ b/src/main/ssh/orcad-migration-source-fence.test.ts
@@ -15,7 +15,7 @@ import {
   resolveOrcadMigrationFence
 } from './orcad-migration-source-fence'
 import type { OrcadMigrationTerminalVerdict } from './orcad-migration-terminal-gate'
-import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 
 const TARGET: SshTarget = {
   id: 'ssh-prod',
diff --git a/src/main/ssh/orcad-migration-source-fence.ts b/src/main/ssh/orcad-migration-source-fence.ts
index efceaf0fb9d..7aeaf3b079a 100644
--- a/src/main/ssh/orcad-migration-source-fence.ts
+++ b/src/main/ssh/orcad-migration-source-fence.ts
@@ -24,12 +24,12 @@ import {
   confirmOrcadMigrationTerminalsUnderFence,
   type OrcadMigrationTerminalVerdict
 } from './orcad-migration-terminal-gate'
-import type { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import type { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 import {
   isBlockingOrcadMigrationBlocker,
   preflightOrcadMigrationExport,
   type OrcadMigrationPreflightStore
-} from './ssh-target-orcad-preflight'
+} from './targets/ssh-target-orcad-preflight'
 import { orcadMigrationRefusalReason } from './orcad-migration-refusal-reason'
 
 export const ORCAD_MIGRATION_LEAVE_BEHIND_TERMINALS = 'orcad_migration_leave_behind_terminals'
diff --git a/src/main/ssh/orcad-migration-ssh-relay-source.test.ts b/src/main/ssh/orcad-migration-ssh-relay-source.test.ts
index 3a650935f52..a9afd666f24 100644
--- a/src/main/ssh/orcad-migration-ssh-relay-source.test.ts
+++ b/src/main/ssh/orcad-migration-ssh-relay-source.test.ts
@@ -8,7 +8,7 @@ import { Store } from '../persistence/loading-store/store'
 import { listOrcadMigrationSourceCutovers } from './orcad-migration-cutover-journal'
 import { createOrcadMigrationManifest } from './orcad-migration-manifest-export'
 import { createSshRelayMigrationSource } from './orcad-migration-ssh-relay-source'
-import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 
 const TARGET: SshTarget = {
   id: 'ssh-prod',
diff --git a/src/main/ssh/orcad-migration-ssh-relay-source.ts b/src/main/ssh/orcad-migration-ssh-relay-source.ts
index e64d9b0e730..4243ad6ca4c 100644
--- a/src/main/ssh/orcad-migration-ssh-relay-source.ts
+++ b/src/main/ssh/orcad-migration-ssh-relay-source.ts
@@ -21,8 +21,8 @@ import {
   retireProvenExitedLeases,
   type CensusHostRelayTerminals
 } from './orcad-migration-terminal-gate'
-import type { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
-import type { OrcadMigrationPreflightStore } from './ssh-target-orcad-preflight'
+import type { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
+import type { OrcadMigrationPreflightStore } from './targets/ssh-target-orcad-preflight'
 
 type SshRelayCutoverDeps = {
   userDataPath: string
diff --git a/src/main/ssh/orcad-migration-stuck-host-profiles.test.ts b/src/main/ssh/orcad-migration-stuck-host-profiles.test.ts
index c599730908a..140631b211c 100644
--- a/src/main/ssh/orcad-migration-stuck-host-profiles.test.ts
+++ b/src/main/ssh/orcad-migration-stuck-host-profiles.test.ts
@@ -18,15 +18,15 @@ import {
   retireProvenExitedLeases,
   type HostRelayTerminalProof
 } from './orcad-migration-terminal-gate'
-import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
 import { listOrcadMigrationSourceCutovers } from './orcad-migration-cutover-journal'
 import {
   leaveBehindClearsOrcadMigrationBlockers,
   onlyLeavableOrcadMigrationBlockers
-} from './ssh-target-orcad-preflight'
+} from './targets/ssh-target-orcad-preflight'
 import { ownedEditorFileId } from '../../shared/workspace-session-pane-ownership'
-import { allowsDirectSshRelay } from './ssh-connection-store'
+import { allowsDirectSshRelay } from './connection/ssh-connection-store'
 
 // Relay-era profiles as the reporters' builds left them, loaded by the real Store and taken through
 // the conversion's source steps: terminal proof, lease retirement, then the fence and its preflight.
diff --git a/src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts b/src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts
index ea7dd74d814..569763b9f54 100644
--- a/src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts
+++ b/src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts
@@ -3,7 +3,7 @@
 // and leaves B's relay alone, so the census reads `bridged` with nothing of A's to serve.
 import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import { relaySocketNameForInstanceId } from './legacy-relay/ssh-relay-instance-id'
 import { windowsRelayPipePathsForSocketName } from './legacy-relay/ssh-relay-endpoints'
 import { getRemoteHostPlatform, joinRemotePath } from './ssh-remote-platform'
diff --git a/src/main/ssh/orcad-runtime-maintenance.test.ts b/src/main/ssh/orcad-runtime-maintenance.test.ts
index a0cba5e8fb0..b2ed7300648 100644
--- a/src/main/ssh/orcad-runtime-maintenance.test.ts
+++ b/src/main/ssh/orcad-runtime-maintenance.test.ts
@@ -29,7 +29,7 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('./targets/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({ connect: async () => ({}) }),
   getSshTargetRegistryStore: () => mocks.state.store
 }))
diff --git a/src/main/ssh/orcad-ssh-host-transport.ts b/src/main/ssh/orcad-ssh-host-transport.ts
index 5bba94f2c1c..bc48b88b641 100644
--- a/src/main/ssh/orcad-ssh-host-transport.ts
+++ b/src/main/ssh/orcad-ssh-host-transport.ts
@@ -1,5 +1,5 @@
 import type { OrcadHostTransport } from './orcad-host-transport'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 
 /**
  * An SSH host's orcad transport is its connection itself, not a wrapper: tunnel ownership, serving
diff --git a/src/main/ssh/orcad-unreachable-setup-release.test.ts b/src/main/ssh/orcad-unreachable-setup-release.test.ts
index ec284b68cf9..23a28947b9e 100644
--- a/src/main/ssh/orcad-unreachable-setup-release.test.ts
+++ b/src/main/ssh/orcad-unreachable-setup-release.test.ts
@@ -14,7 +14,7 @@ import { listOrcadMigrationSourceCutovers } from './orcad-migration-cutover-jour
 import { fakeOrcadMigrationDestination } from './orcad-migration-destination-fake'
 import { fenceOrcadMigrationSource } from './orcad-migration-source-fence'
 import { releaseUnreachableOrcadSetup } from './orcad-unreachable-setup-release'
-import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 
 const TARGET: SshTarget = {
   id: 'ssh-locked',
diff --git a/src/main/ssh/orcad-unreachable-setup-release.ts b/src/main/ssh/orcad-unreachable-setup-release.ts
index b4d3b9b452c..e0bddde8d30 100644
--- a/src/main/ssh/orcad-unreachable-setup-release.ts
+++ b/src/main/ssh/orcad-unreachable-setup-release.ts
@@ -10,7 +10,7 @@ import { removeManagedOrcadEnvironment } from '../../shared/runtime-environment-
 import { findOrcadMigrationSourceCutoverForTarget } from './orcad-migration-cutover-journal'
 import { releaseUndeployedMigrationFence } from './orcad-migration-source-fence'
 import { closeOrcadManagedTunnel } from '../managed-server/lifecycle/orcad-managed-tunnel'
-import type { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
+import type { SshTargetOrcadClaims } from './targets/ssh-target-orcad-claims'
 import { withOrcadActivationLock } from '../managed-server/activation/orcad-activation-lock'
 import { withDeactivatedVersionCommitted } from '../managed-server/activation/orcad-activation-record'
 import {
@@ -22,7 +22,7 @@ import { resolveOrcadRemoteContext } from '../managed-server/install/orcad-remot
 import { orcadStopFreedTheHost } from '../managed-server/install/orcad-remote-process-control'
 import { orcadSlotDir, stopOrcadSlot } from './orcad-recovery-slot'
 import { sshOrcadHostTransport } from './orcad-ssh-host-transport'
-import { getSshConnectionManager, getSshTargetRegistryStore } from './ssh-target-registry'
+import { getSshConnectionManager, getSshTargetRegistryStore } from './targets/ssh-target-registry'
 import { errorMessage } from '../../shared/error-message'
 
 export async function releaseUnreachableOrcadSetup(args: {
diff --git a/src/main/ssh/orcad-unreachable-setup-stop.test.ts b/src/main/ssh/orcad-unreachable-setup-stop.test.ts
index ffbe8db0fff..90aeb1bda00 100644
--- a/src/main/ssh/orcad-unreachable-setup-stop.test.ts
+++ b/src/main/ssh/orcad-unreachable-setup-stop.test.ts
@@ -21,7 +21,7 @@ vi.mock('./orcad-migration-source-fence', () => ({
 vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
   closeOrcadManagedTunnel: async () => undefined
 }))
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('./targets/ssh-target-registry', () => ({
   getSshTargetRegistryStore: () => ({ getTarget: () => ({ id: 'ssh-1' }) }),
   getSshConnectionManager: () => ({ connect: async () => ({}) })
 }))
diff --git a/src/main/ssh/orcad-windows-stdio-bridge-test-cell.ts b/src/main/ssh/orcad-windows-stdio-bridge-test-cell.ts
index 2bdab5283db..d111fea92eb 100644
--- a/src/main/ssh/orcad-windows-stdio-bridge-test-cell.ts
+++ b/src/main/ssh/orcad-windows-stdio-bridge-test-cell.ts
@@ -9,7 +9,7 @@ import {
   readOrcadReadinessNowCommand
 } from '../managed-server/install/orcad-remote-readiness-wait'
 import { execOrcadRemote } from '../managed-server/install/orcad-remote-runtime-control'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import type { RemoteHostPlatform } from './ssh-remote-platform'
 import { probeTcpForwarding } from './ssh-tcp-forwarding-probe'
 
diff --git a/src/main/ssh/port-forwarding/ssh-port-forward-provider.ts b/src/main/ssh/port-forwarding/ssh-port-forward-provider.ts
index 65b9faad83f..c95196ac578 100644
--- a/src/main/ssh/port-forwarding/ssh-port-forward-provider.ts
+++ b/src/main/ssh/port-forwarding/ssh-port-forward-provider.ts
@@ -1,5 +1,5 @@
 import type { PortForwardEntry } from '../../../shared/ssh-types'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 
 export type PortForwardCloseReason =
   | { kind: 'removed' }
diff --git a/src/main/ssh/port-forwarding/ssh-port-forward.ts b/src/main/ssh/port-forwarding/ssh-port-forward.ts
index dcc9f8ec049..c22d23875d2 100644
--- a/src/main/ssh/port-forwarding/ssh-port-forward.ts
+++ b/src/main/ssh/port-forwarding/ssh-port-forward.ts
@@ -1,4 +1,4 @@
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import { Ssh2PortForwardProvider } from './ssh2-port-forward-provider'
 import { SystemSshPortForwardProvider } from './system-ssh-port-forward-provider'
 import type { PortForwardEntry } from '../../../shared/ssh-types'
diff --git a/src/main/ssh/port-forwarding/ssh2-port-forward-provider.ts b/src/main/ssh/port-forwarding/ssh2-port-forward-provider.ts
index 1adc7598d0c..abe9b939066 100644
--- a/src/main/ssh/port-forwarding/ssh2-port-forward-provider.ts
+++ b/src/main/ssh/port-forwarding/ssh2-port-forward-provider.ts
@@ -1,6 +1,6 @@
 import { createServer, type Server, type Socket } from 'node:net'
 import type { ClientChannel } from 'ssh2'
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import type {
   PortForwardStartOptions,
   SshPortForwardProvider,
diff --git a/src/main/ssh/port-forwarding/system-ssh-port-forward-provider.ts b/src/main/ssh/port-forwarding/system-ssh-port-forward-provider.ts
index 16ef43052fa..4cf5612ef07 100644
--- a/src/main/ssh/port-forwarding/system-ssh-port-forward-provider.ts
+++ b/src/main/ssh/port-forwarding/system-ssh-port-forward-provider.ts
@@ -1,4 +1,4 @@
-import type { SshConnection } from '../ssh-connection'
+import type { SshConnection } from '../connection/ssh-connection'
 import type { SystemSshBuildArgsOptions } from '../system-transport/system-ssh-args'
 import {
   startSystemSshPortForwardProcess,
diff --git a/src/main/ssh/sftp-stream-late-error.test.ts b/src/main/ssh/sftp-stream-late-error.test.ts
index 8336029c637..267b933ccfb 100644
--- a/src/main/ssh/sftp-stream-late-error.test.ts
+++ b/src/main/ssh/sftp-stream-late-error.test.ts
@@ -7,7 +7,7 @@ import type { SFTPWrapper } from 'ssh2'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { uploadBuffer, uploadFile, writeStringViaSftp } from './sftp-upload'
 import { writeRelayFile } from '../managed-server/install/remote-install-transfers'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 
 /** The exact error ssh2 builds from a STATUS reply of SSH_FX_NO_SUCH_FILE. */
diff --git a/src/main/ssh/ssh-channel-open.ts b/src/main/ssh/ssh-channel-open.ts
index d6d0436f1de..4ee86522277 100644
--- a/src/main/ssh/ssh-channel-open.ts
+++ b/src/main/ssh/ssh-channel-open.ts
@@ -1,4 +1,4 @@
-import { trackSshConnectionChannelLifetime } from './ssh-connection-channel-lifetime'
+import { trackSshConnectionChannelLifetime } from './connection/ssh-connection-channel-lifetime'
 import { CONNECT_TIMEOUT_MS, createSshOperationAbortError } from './ssh-connection-utils'
 import { isSshSessionLimitError } from './ssh-session-limit-error'
 
diff --git a/src/main/ssh/ssh-connection-utils.test.ts b/src/main/ssh/ssh-connection-utils.test.ts
index 9edbb5331a1..760eccdfba7 100644
--- a/src/main/ssh/ssh-connection-utils.test.ts
+++ b/src/main/ssh/ssh-connection-utils.test.ts
@@ -30,7 +30,7 @@ import {
 } from './ssh-connection-utils'
 import { findDefaultKeyFile, resolveAgentSocket } from './ssh-auth-resolution'
 import { resolveEffectiveProxy } from './ssh-proxy-command'
-import { walkInitialAuthLadder } from './ssh-connection-test-fixtures'
+import { walkInitialAuthLadder } from './connection/ssh-connection-test-fixtures'
 import type { SshTarget } from '../../shared/ssh-types'
 import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 
diff --git a/src/main/ssh/ssh-credential-prompt-login-grace-wire.test.ts b/src/main/ssh/ssh-credential-prompt-login-grace-wire.test.ts
index 0bcc8c197ce..511eb01e90f 100644
--- a/src/main/ssh/ssh-credential-prompt-login-grace-wire.test.ts
+++ b/src/main/ssh/ssh-credential-prompt-login-grace-wire.test.ts
@@ -3,9 +3,13 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { Server, utils, type Connection } from 'ssh2'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { SshConnection } from './ssh-connection'
+import { SshConnection } from './connection/ssh-connection'
 import { INITIAL_RETRY_DELAY_MS } from './ssh-connection-utils'
-import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
+import {
+  createCallbacks,
+  createResolvedConfig,
+  createTarget
+} from './connection/ssh-connection-test-fixtures'
 import { initSshHostKeyStoreFile } from './ssh-host-key-store'
 import { resolveWithSshG } from './config/ssh-g-config-resolution'
 import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
diff --git a/src/main/ssh/ssh-exec-rc-stdout-noise.test.ts b/src/main/ssh/ssh-exec-rc-stdout-noise.test.ts
index f7e00bf66c4..12cea22fc19 100644
--- a/src/main/ssh/ssh-exec-rc-stdout-noise.test.ts
+++ b/src/main/ssh/ssh-exec-rc-stdout-noise.test.ts
@@ -9,7 +9,7 @@ import { runProcess } from '@orca/process-host'
 import { wrapRemoteCommandForPosixShell, type SshExecOptions } from './ssh-connection-utils'
 import { execCommand, isSshCommandExitError } from './remote-exec/remote-exec-command'
 import { readRemoteHomeCommand } from './ssh-remote-commands'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import { tryResolveViaLoginShell } from './ssh-remote-node-resolution'
 import {
   normalizeRemoteHome,
diff --git a/src/main/ssh/ssh-exec-stdin-file-transfer.test.ts b/src/main/ssh/ssh-exec-stdin-file-transfer.test.ts
index 1720c386aa8..8a24ea97f45 100644
--- a/src/main/ssh/ssh-exec-stdin-file-transfer.test.ts
+++ b/src/main/ssh/ssh-exec-stdin-file-transfer.test.ts
@@ -15,7 +15,7 @@ import { join } from 'node:path'
 import { Duplex } from 'node:stream'
 import { afterEach, describe, expect, it } from 'vitest'
 import { spawnProcess } from '@orca/process-host'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import {
   EXEC_STDIN_WRITE_DONE,
   makeExecStdinWriteFileCommand,
diff --git a/src/main/ssh/ssh-keyboard-interactive-wire.test.ts b/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
index 494503ec137..0fff6b62327 100644
--- a/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
+++ b/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
@@ -3,8 +3,12 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { Server, utils, type Connection } from 'ssh2'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { SshConnection } from './ssh-connection'
-import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
+import { SshConnection } from './connection/ssh-connection'
+import {
+  createCallbacks,
+  createResolvedConfig,
+  createTarget
+} from './connection/ssh-connection-test-fixtures'
 import { initSshHostKeyStoreFile } from './ssh-host-key-store'
 import { resolveWithSshG } from './config/ssh-g-config-resolution'
 import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
diff --git a/src/main/ssh/ssh-multi-key-authentication.test.ts b/src/main/ssh/ssh-multi-key-authentication.test.ts
index afa3e2b07c1..ce04b6aa844 100644
--- a/src/main/ssh/ssh-multi-key-authentication.test.ts
+++ b/src/main/ssh/ssh-multi-key-authentication.test.ts
@@ -25,7 +25,7 @@ vi.mock('fs', () => ({
 import { buildConnectConfig } from './ssh-connection-utils'
 import { getPassphrasePrivateKeyPath } from './ssh-private-key-authentication'
 import { buildSshArgs } from './system-transport/system-ssh-args'
-import { walkInitialAuthLadder } from './ssh-connection-test-fixtures'
+import { walkInitialAuthLadder } from './connection/ssh-connection-test-fixtures'
 import type { SshTarget } from '../../shared/ssh-types'
 import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 
diff --git a/src/main/ssh/ssh-provider-authority.test.ts b/src/main/ssh/ssh-provider-authority.test.ts
index 519c401a900..82ec0d4e37b 100644
--- a/src/main/ssh/ssh-provider-authority.test.ts
+++ b/src/main/ssh/ssh-provider-authority.test.ts
@@ -4,7 +4,7 @@ import {
   forgetSshConnectionGeneration,
   resetSshConnectionGenerations,
   setSshConnectionGeneration
-} from './ssh-connection-generation'
+} from './connection/ssh-connection-generation'
 import {
   getSshProviderAuthority,
   isCurrentSshProviderAuthority,
diff --git a/src/main/ssh/ssh-provider-authority.ts b/src/main/ssh/ssh-provider-authority.ts
index ce7e5942aba..bdf6300b946 100644
--- a/src/main/ssh/ssh-provider-authority.ts
+++ b/src/main/ssh/ssh-provider-authority.ts
@@ -4,7 +4,7 @@ import {
   advanceSshConnectionGeneration,
   isSshConnectionGenerationInCurrentSession,
   getSshConnectionGeneration
-} from './ssh-connection-generation'
+} from './connection/ssh-connection-generation'
 
 const authorityByTarget = new Map<string, DirectSshAuthority>()
 type ProviderRequestAbortRegistration = {
diff --git a/src/main/ssh/ssh-quit-abort-upload.test.ts b/src/main/ssh/ssh-quit-abort-upload.test.ts
index fd71c70ea72..efe825f23e7 100644
--- a/src/main/ssh/ssh-quit-abort-upload.test.ts
+++ b/src/main/ssh/ssh-quit-abort-upload.test.ts
@@ -6,7 +6,7 @@ import { Writable } from 'node:stream'
 import { describe, expect, it, vi } from 'vitest'
 import type { SFTPWrapper } from 'ssh2'
 import type { SshTarget } from '../../shared/ssh-types'
-import { uploadSshDirectory } from './ssh-connection-file-transfers'
+import { uploadSshDirectory } from './connection/ssh-connection-file-transfers'
 
 const target: SshTarget = { id: 'ssh-1', label: 'Box', host: 'box', port: 22, username: 'me' }
 
diff --git a/src/main/ssh/ssh-remote-directory-browse.ts b/src/main/ssh/ssh-remote-directory-browse.ts
index 66461c60b46..dd1171f1d8d 100644
--- a/src/main/ssh/ssh-remote-directory-browse.ts
+++ b/src/main/ssh/ssh-remote-directory-browse.ts
@@ -1,4 +1,4 @@
-import type { SshConnectionManager } from './ssh-connection-manager'
+import type { SshConnectionManager } from './connection/ssh-connection-manager'
 import type { SshExecOptions } from './ssh-connection-utils'
 import { powerShellCommand } from './ssh-remote-powershell'
 import { quotePowerShellLiteral as powerShellLiteral } from '../../shared/powershell-native-argument'
diff --git a/src/main/ssh/ssh-remote-node-install-guidance.ts b/src/main/ssh/ssh-remote-node-install-guidance.ts
index 5e08bdc1842..c8e0632ee7b 100644
--- a/src/main/ssh/ssh-remote-node-install-guidance.ts
+++ b/src/main/ssh/ssh-remote-node-install-guidance.ts
@@ -1,4 +1,4 @@
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import { createSshOperationAbortError } from './ssh-connection-utils'
 import { execCommand } from './remote-exec/remote-exec-command'
 import { isSshSessionLimitError } from './ssh-session-limit-error'
diff --git a/src/main/ssh/ssh-remote-node-resolution.test.ts b/src/main/ssh/ssh-remote-node-resolution.test.ts
index 7375c772299..66696bb08b9 100644
--- a/src/main/ssh/ssh-remote-node-resolution.test.ts
+++ b/src/main/ssh/ssh-remote-node-resolution.test.ts
@@ -4,7 +4,7 @@ import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:f
 import os from 'node:os'
 import path from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 
 const execCommandMock = vi.hoisted(() => vi.fn())
diff --git a/src/main/ssh/ssh-remote-node-resolution.ts b/src/main/ssh/ssh-remote-node-resolution.ts
index 05ff680e6f3..575ca81a3e5 100644
--- a/src/main/ssh/ssh-remote-node-resolution.ts
+++ b/src/main/ssh/ssh-remote-node-resolution.ts
@@ -1,4 +1,4 @@
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import { createSshOperationAbortError } from './ssh-connection-utils'
 import type { RemoteHostPlatform } from './ssh-remote-platform'
 import { isWindowsRemoteHost, normalizeWindowsRemotePath } from './ssh-remote-platform'
diff --git a/src/main/ssh/ssh-remote-platform-detection.test.ts b/src/main/ssh/ssh-remote-platform-detection.test.ts
index 07e91aa58b6..ca164dcca7c 100644
--- a/src/main/ssh/ssh-remote-platform-detection.test.ts
+++ b/src/main/ssh/ssh-remote-platform-detection.test.ts
@@ -1,6 +1,6 @@
 import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import { SSH_EXEC_TIMEOUT_CODE } from './remote-exec/remote-exec-command'
 
 const execCommandMock = vi.hoisted(() => vi.fn())
diff --git a/src/main/ssh/ssh-system-transport.integration.test.ts b/src/main/ssh/ssh-system-transport.integration.test.ts
index 2df57ba5094..35f6dcabb0f 100644
--- a/src/main/ssh/ssh-system-transport.integration.test.ts
+++ b/src/main/ssh/ssh-system-transport.integration.test.ts
@@ -6,7 +6,7 @@ vi.mock('electron', () => ({
   app: { getAppPath: () => '/mock/app' }
 }))
 
-import { SshConnection } from './ssh-connection'
+import { SshConnection } from './connection/ssh-connection'
 import { uploadDirectoryViaSystemSsh } from './system-transport/system-ssh-file-transfer'
 import type { SshTarget } from '../../shared/ssh-types'
 import { relayArtifactFilenames } from './relay-install-artifacts'
diff --git a/src/main/ssh/ssh-tcp-forwarding-probe.ts b/src/main/ssh/ssh-tcp-forwarding-probe.ts
index 48b3201f5d2..ab3da8b68b2 100644
--- a/src/main/ssh/ssh-tcp-forwarding-probe.ts
+++ b/src/main/ssh/ssh-tcp-forwarding-probe.ts
@@ -5,7 +5,7 @@
  */
 import { connect, type Socket } from 'node:net'
 import type { ClientChannel } from 'ssh2'
-import type { SshConnection } from './ssh-connection'
+import type { SshConnection } from './connection/ssh-connection'
 import type { StartedPortForward } from './port-forwarding/ssh-port-forward-provider'
 
 export type TcpForwardingVerdict = 'allowed' | 'refused' | 'unverifiable'
diff --git a/src/main/ssh/removed-ssh-target-tombstone-retention.test.ts b/src/main/ssh/targets/removed-ssh-target-tombstone-retention.test.ts
similarity index 94%
rename from src/main/ssh/removed-ssh-target-tombstone-retention.test.ts
rename to src/main/ssh/targets/removed-ssh-target-tombstone-retention.test.ts
index 73976525c36..1b079ea68fd 100644
--- a/src/main/ssh/removed-ssh-target-tombstone-retention.test.ts
+++ b/src/main/ssh/targets/removed-ssh-target-tombstone-retention.test.ts
@@ -4,8 +4,8 @@ import {
   collectAutomationReferencedSshTargetIds,
   collectSshTargetRemovalEvidenceDependencies
 } from './removed-ssh-target-tombstone-retention'
-import type { RemovedSshTargetTombstone } from '../../shared/ssh-types'
-import type { FolderWorkspaceHostState } from '../../shared/folder-workspace-execution-host'
+import type { RemovedSshTargetTombstone } from '../../../shared/ssh-types'
+import type { FolderWorkspaceHostState } from '../../../shared/folder-workspace-execution-host'
 
 function tombstones(count: number): RemovedSshTargetTombstone[] {
   return Array.from({ length: count }, (_, index) => ({
diff --git a/src/main/ssh/removed-ssh-target-tombstone-retention.ts b/src/main/ssh/targets/removed-ssh-target-tombstone-retention.ts
similarity index 88%
rename from src/main/ssh/removed-ssh-target-tombstone-retention.ts
rename to src/main/ssh/targets/removed-ssh-target-tombstone-retention.ts
index b3238c97f11..5eb99724d68 100644
--- a/src/main/ssh/removed-ssh-target-tombstone-retention.ts
+++ b/src/main/ssh/targets/removed-ssh-target-tombstone-retention.ts
@@ -1,8 +1,8 @@
-import type { RemovedSshTargetTombstone } from '../../shared/ssh-types'
-import type { PersistedAutomationHostFilter } from '../../shared/automation-host-filter'
-import { parseHostStableKey } from '../../shared/automation-owner-key'
-import { resolveAutomationWorkspaceSshTargetId } from '../../shared/automation-workspace-pin'
-import type { FolderWorkspaceHostState } from '../../shared/folder-workspace-execution-host'
+import type { RemovedSshTargetTombstone } from '../../../shared/ssh-types'
+import type { PersistedAutomationHostFilter } from '../../../shared/automation-host-filter'
+import { parseHostStableKey } from '../../../shared/automation-owner-key'
+import { resolveAutomationWorkspaceSshTargetId } from '../../../shared/automation-workspace-pin'
+import type { FolderWorkspaceHostState } from '../../../shared/folder-workspace-execution-host'
 
 // Why: bound removed-SSH-target history so remove/re-add churn can't grow the file unbounded.
 export const MAX_REMOVED_SSH_TARGET_TOMBSTONES = 50
diff --git a/src/main/ssh/ssh-target-id-migration.test.ts b/src/main/ssh/targets/ssh-target-id-migration.test.ts
similarity index 95%
rename from src/main/ssh/ssh-target-id-migration.test.ts
rename to src/main/ssh/targets/ssh-target-id-migration.test.ts
index 59ba19d4dc9..1c1aee50647 100644
--- a/src/main/ssh/ssh-target-id-migration.test.ts
+++ b/src/main/ssh/targets/ssh-target-id-migration.test.ts
@@ -1,7 +1,7 @@
 import { describe, it, expect } from 'vitest'
-import type { PersistedUIState } from '../../shared/persisted-ui-state-types'
-import type { TerminalTab } from '../../shared/terminal-tab-types'
-import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import type { PersistedUIState } from '../../../shared/persisted-ui-state-types'
+import type { TerminalTab } from '../../../shared/terminal-tab-types'
+import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
 import {
   migrateUiHostScopeSshTargetId,
   migrateWorkspaceSessionSshTargetId
diff --git a/src/main/ssh/ssh-target-id-migration.ts b/src/main/ssh/targets/ssh-target-id-migration.ts
similarity index 89%
rename from src/main/ssh/ssh-target-id-migration.ts
rename to src/main/ssh/targets/ssh-target-id-migration.ts
index 403688d2b31..39c3a1eb7cb 100644
--- a/src/main/ssh/ssh-target-id-migration.ts
+++ b/src/main/ssh/targets/ssh-target-id-migration.ts
@@ -1,10 +1,10 @@
-import type { FolderWorkspace } from '../../shared/folder-workspace-types'
-import type { PersistedUIState } from '../../shared/persisted-ui-state-types'
-import type { ProjectGroup } from '../../shared/project-group-types'
-import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
-import { parseAppSshPtyId, toAppSshPtyId } from '../../shared/ssh-pty-id'
-import { toSshExecutionHostId } from '../../shared/execution-host'
-import { normalizeManualRepoOrder } from '../../shared/manual-repo-order'
+import type { FolderWorkspace } from '../../../shared/folder-workspace-types'
+import type { PersistedUIState } from '../../../shared/persisted-ui-state-types'
+import type { ProjectGroup } from '../../../shared/project-group-types'
+import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
+import { parseAppSshPtyId, toAppSshPtyId } from '../../../shared/ssh-pty-id'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+import { normalizeManualRepoOrder } from '../../../shared/manual-repo-order'
 
 /**
  * Carrier sweep for SSH target re-adoption (see ssh-target-readoption.ts).
diff --git a/src/main/ssh/ssh-target-identity.ts b/src/main/ssh/targets/ssh-target-identity.ts
similarity index 95%
rename from src/main/ssh/ssh-target-identity.ts
rename to src/main/ssh/targets/ssh-target-identity.ts
index f786ac8b44c..44539c08ee5 100644
--- a/src/main/ssh/ssh-target-identity.ts
+++ b/src/main/ssh/targets/ssh-target-identity.ts
@@ -1,4 +1,4 @@
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 /**
  * Identity of the endpoint an SSH target reaches, independent of the target row.
diff --git a/src/main/ssh/ssh-target-orcad-claims.test.ts b/src/main/ssh/targets/ssh-target-orcad-claims.test.ts
similarity index 97%
rename from src/main/ssh/ssh-target-orcad-claims.test.ts
rename to src/main/ssh/targets/ssh-target-orcad-claims.test.ts
index 6be6d4ee209..70ac625515e 100644
--- a/src/main/ssh/ssh-target-orcad-claims.test.ts
+++ b/src/main/ssh/targets/ssh-target-orcad-claims.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import type { SshRemotePtyLease, SshTarget } from '../../shared/ssh-types'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
+import type { SshRemotePtyLease, SshTarget } from '../../../shared/ssh-types'
 import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
 import { emptyDependentStateStore } from './ssh-target-orcad-dependents-fixture'
 
diff --git a/src/main/ssh/ssh-target-orcad-claims.ts b/src/main/ssh/targets/ssh-target-orcad-claims.ts
similarity index 98%
rename from src/main/ssh/ssh-target-orcad-claims.ts
rename to src/main/ssh/targets/ssh-target-orcad-claims.ts
index af73895bbad..7560841790d 100644
--- a/src/main/ssh/ssh-target-orcad-claims.ts
+++ b/src/main/ssh/targets/ssh-target-orcad-claims.ts
@@ -4,16 +4,16 @@
  * targets are claimable, with no saved sessions, automations, worktree metadata or terminal
  * leases: moving a direct SSH host's state into a managed server is the catalog migration.
  */
-import type { Store } from '../persistence'
+import type { Store } from '../../persistence'
 import {
   getManagedOrcadFenceEnvironmentId,
   isEphemeralRuntimeSshOwner
-} from '../../shared/managed-orcad-ssh-owner'
+} from '../../../shared/managed-orcad-ssh-owner'
 import type {
   OrcadMigrationBlocker,
   OrcadMigrationPreflight
-} from '../../shared/orcad-migration-preflight'
-import type { SshTarget } from '../../shared/ssh-types'
+} from '../../../shared/orcad-migration-preflight'
+import type { SshTarget } from '../../../shared/ssh-types'
 import {
   collectDependentStateBlockers,
   dependentStateMessage,
diff --git a/src/main/ssh/ssh-target-orcad-dependents-fixture.ts b/src/main/ssh/targets/ssh-target-orcad-dependents-fixture.ts
similarity index 87%
rename from src/main/ssh/ssh-target-orcad-dependents-fixture.ts
rename to src/main/ssh/targets/ssh-target-orcad-dependents-fixture.ts
index 34239d6e54f..2fd62577b58 100644
--- a/src/main/ssh/ssh-target-orcad-dependents-fixture.ts
+++ b/src/main/ssh/targets/ssh-target-orcad-dependents-fixture.ts
@@ -1,4 +1,4 @@
-import { getDefaultWorkspaceSession } from '../../shared/constants'
+import { getDefaultWorkspaceSession } from '../../../shared/constants'
 import type { DependentStateStore } from './ssh-target-orcad-dependents'
 
 /** A store with no client state referencing any SSH target. */
diff --git a/src/main/ssh/ssh-target-orcad-dependents.test.ts b/src/main/ssh/targets/ssh-target-orcad-dependents.test.ts
similarity index 97%
rename from src/main/ssh/ssh-target-orcad-dependents.test.ts
rename to src/main/ssh/targets/ssh-target-orcad-dependents.test.ts
index 5c37a6a41d1..c6e77b4322b 100644
--- a/src/main/ssh/ssh-target-orcad-dependents.test.ts
+++ b/src/main/ssh/targets/ssh-target-orcad-dependents.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
-import { getDefaultWorkspaceSession } from '../../shared/constants'
-import type { ExecutionHostId } from '../../shared/execution-host'
+import { getDefaultWorkspaceSession } from '../../../shared/constants'
+import type { ExecutionHostId } from '../../../shared/execution-host'
 import { collectDependentStateBlockers } from './ssh-target-orcad-dependents'
 import { emptyDependentStateStore } from './ssh-target-orcad-dependents-fixture'
 import { orcadTargetBlockerMessage } from './ssh-target-orcad-claims'
diff --git a/src/main/ssh/ssh-target-orcad-dependents.ts b/src/main/ssh/targets/ssh-target-orcad-dependents.ts
similarity index 92%
rename from src/main/ssh/ssh-target-orcad-dependents.ts
rename to src/main/ssh/targets/ssh-target-orcad-dependents.ts
index ef76aea5caf..21bb9cc7559 100644
--- a/src/main/ssh/ssh-target-orcad-dependents.ts
+++ b/src/main/ssh/targets/ssh-target-orcad-dependents.ts
@@ -2,17 +2,17 @@
  * Client state that still references an SSH target. An empty-host claim refuses any of it, since
  * hiding the target would strand it; a migration blocks only on what its manifest can't carry.
  */
-import type { Store } from '../persistence'
-import { getDefaultWorkspaceSession } from '../../shared/constants'
-import { toSshExecutionHostId } from '../../shared/execution-host'
-import { GLOBAL_WORKSPACE_SESSION_FIELDS } from '../../shared/workspace-session-host-field-ownership'
+import type { Store } from '../../persistence'
+import { getDefaultWorkspaceSession } from '../../../shared/constants'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+import { GLOBAL_WORKSPACE_SESSION_FIELDS } from '../../../shared/workspace-session-host-field-ownership'
 import {
   ORCAD_MIGRATION_DEPENDENCY_KINDS,
   type OrcadMigrationBlocker,
   type OrcadMigrationDependency,
   type OrcadMigrationDependencyKind
-} from '../../shared/orcad-migration-preflight'
-import type { OrcadMigrationManifest } from '../../shared/orcad-migration-manifest'
+} from '../../../shared/orcad-migration-preflight'
+import type { OrcadMigrationManifest } from '../../../shared/orcad-migration-manifest'
 
 export type DependentStateStore = Pick<
   Store,
diff --git a/src/main/ssh/ssh-target-orcad-preflight.test.ts b/src/main/ssh/targets/ssh-target-orcad-preflight.test.ts
similarity index 96%
rename from src/main/ssh/ssh-target-orcad-preflight.test.ts
rename to src/main/ssh/targets/ssh-target-orcad-preflight.test.ts
index c4f4896dc06..32bf9037653 100644
--- a/src/main/ssh/ssh-target-orcad-preflight.test.ts
+++ b/src/main/ssh/targets/ssh-target-orcad-preflight.test.ts
@@ -2,9 +2,9 @@ import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
-import type { SshRemotePtyLease, SshTarget } from '../../shared/ssh-types'
-import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
-import { Store } from '../persistence/loading-store/store'
+import type { SshRemotePtyLease, SshTarget } from '../../../shared/ssh-types'
+import { closeTestStores, createSqliteTestStore } from '../../persistence-test-harness'
+import { Store } from '../../persistence/loading-store/store'
 import {
   preflightOrcadMigrationExport,
   type OrcadMigrationPreflightStore
diff --git a/src/main/ssh/ssh-target-orcad-preflight.ts b/src/main/ssh/targets/ssh-target-orcad-preflight.ts
similarity index 94%
rename from src/main/ssh/ssh-target-orcad-preflight.ts
rename to src/main/ssh/targets/ssh-target-orcad-preflight.ts
index 85fcd5107d4..3b787f4c94a 100644
--- a/src/main/ssh/ssh-target-orcad-preflight.ts
+++ b/src/main/ssh/targets/ssh-target-orcad-preflight.ts
@@ -6,16 +6,16 @@
  * What blocks is what cannot move: another owner, live terminal leases, and dependent state the
  * manifest cannot carry. Read-only: building the manifest here exports nothing.
  */
-import { isLiveSshPtyLease } from '../../shared/ssh-types'
-import type { Store } from '../persistence'
+import { isLiveSshPtyLease } from '../../../shared/ssh-types'
+import type { Store } from '../../persistence'
 import type {
   OrcadMigrationBlocker,
   OrcadMigrationPreflight
-} from '../../shared/orcad-migration-preflight'
+} from '../../../shared/orcad-migration-preflight'
 import {
   createOrcadMigrationManifest,
   type OrcadMigrationExportStore
-} from './orcad-migration-manifest-export'
+} from '../orcad-migration-manifest-export'
 import {
   collectTargetCatalogBlockers,
   resolveOrcadPreflightTarget
diff --git a/src/main/ssh/ssh-target-readoption.test.ts b/src/main/ssh/targets/ssh-target-readoption.test.ts
similarity index 98%
rename from src/main/ssh/ssh-target-readoption.test.ts
rename to src/main/ssh/targets/ssh-target-readoption.test.ts
index 231a17397ce..3674a4cf86b 100644
--- a/src/main/ssh/ssh-target-readoption.test.ts
+++ b/src/main/ssh/targets/ssh-target-readoption.test.ts
@@ -3,8 +3,8 @@ import {
   buildRemovedSshTargetTombstone,
   readoptOrphanedWorkspacesForTarget
 } from './ssh-target-readoption'
-import type { Store } from '../persistence'
-import type { RemovedSshTargetTombstone, SshTarget } from '../../shared/ssh-types'
+import type { Store } from '../../persistence'
+import type { RemovedSshTargetTombstone, SshTarget } from '../../../shared/ssh-types'
 
 function makeTarget(overrides: Partial<SshTarget> = {}): SshTarget {
   return {
diff --git a/src/main/ssh/ssh-target-readoption.ts b/src/main/ssh/targets/ssh-target-readoption.ts
similarity index 98%
rename from src/main/ssh/ssh-target-readoption.ts
rename to src/main/ssh/targets/ssh-target-readoption.ts
index fd80d91a4ae..216ce17f570 100644
--- a/src/main/ssh/ssh-target-readoption.ts
+++ b/src/main/ssh/targets/ssh-target-readoption.ts
@@ -1,9 +1,9 @@
-import type { Store } from '../persistence'
+import type { Store } from '../../persistence'
 import type {
   RemovedSshTargetTombstone,
   SshRepoReadoption,
   SshTarget
-} from '../../shared/ssh-types'
+} from '../../../shared/ssh-types'
 import { meaningfulSshAlias, sshEndpointKey, type SshIdentityFields } from './ssh-target-identity'
 
 /**
diff --git a/src/main/ssh/ssh-target-registry.ts b/src/main/ssh/targets/ssh-target-registry.ts
similarity index 96%
rename from src/main/ssh/ssh-target-registry.ts
rename to src/main/ssh/targets/ssh-target-registry.ts
index f088beb3a7f..a19f58acde3 100644
--- a/src/main/ssh/ssh-target-registry.ts
+++ b/src/main/ssh/targets/ssh-target-registry.ts
@@ -1,12 +1,12 @@
-import type { SshConnectionStore } from './ssh-connection-store'
-import type { SshConnectionManager } from './ssh-connection-manager'
+import type { SshConnectionStore } from '../connection/ssh-connection-store'
+import type { SshConnectionManager } from '../connection/ssh-connection-manager'
 import type {
   SshConnectionState,
   SshTarget,
   SshTargetAddResult,
   SshTargetCreateInput,
   SshTargetUpdateInput
-} from '../../shared/ssh-types'
+} from '../../../shared/ssh-types'
 
 /**
  * The SSH target/state registry, split out of `ipc/ssh.ts`.
diff --git a/src/main/startup/headless-serve-ssh-registration.test.ts b/src/main/startup/headless-serve-ssh-registration.test.ts
index 909621f2e3a..d3fc2a50ea8 100644
--- a/src/main/startup/headless-serve-ssh-registration.test.ts
+++ b/src/main/startup/headless-serve-ssh-registration.test.ts
@@ -7,9 +7,9 @@ const mocks = await vi.hoisted(async () => {
 
 vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
-vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
+vi.mock('../ssh/connection/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('../ipc/ssh/ssh-host-server-connect', () => mocks.hostServerConnect)
-vi.mock('../ssh/ssh-connection-manager', () => mocks.sshConnectionManager)
+vi.mock('../ssh/connection/ssh-connection-manager', () => mocks.sshConnectionManager)
 vi.mock('../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
@@ -19,7 +19,7 @@ import {
   connectRegisteredSshTarget,
   listRegisteredSshTargets,
   SSH_TARGET_MANAGEMENT_UNSERVED_MESSAGE
-} from '../ssh/ssh-target-registry'
+} from '../ssh/targets/ssh-target-registry'
 import { createSshIpcHarness } from '../ipc/ssh/ssh-ipc-test-harness'
 import type { SshTarget } from '../../shared/ssh-types'
 import { mainProcessState } from './main-process-state'
diff --git a/src/main/worktree-retirement-namespace.ts b/src/main/worktree-retirement-namespace.ts
index 08b011e9339..701a27ff266 100644
--- a/src/main/worktree-retirement-namespace.ts
+++ b/src/main/worktree-retirement-namespace.ts
@@ -5,7 +5,7 @@ import {
 } from '../shared/worktree/retired-name-registry'
 import type { Repo } from '../shared/repo-types'
 import { worktreePathComparisonKey } from './worktree-path-comparison-key'
-import { sshEndpointKey, type SshIdentityFields } from './ssh/ssh-target-identity'
+import { sshEndpointKey, type SshIdentityFields } from './ssh/targets/ssh-target-identity'
 
 /**
  * Keys for `retiredWorktreeNamesByNamespace`, the copy of the retirement registry that survives a
diff --git a/tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts b/tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts
index a2099fee423..a8c3b76032b 100644
--- a/tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts
+++ b/tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts
@@ -3,7 +3,7 @@ import { readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { Client } from 'ssh2'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from '../../src/main/ssh/ssh-connection'
+import type { SshConnection } from '../../src/main/ssh/connection/ssh-connection'
 import type { SshProviderEpoch } from '../../src/shared/ssh-types'
 import { ensureDockerSshHostImage } from './helpers/docker-ssh-host-image'
 import {