diff --git a/src/main/ai-vault/runtime-owned-ssh-session-list.test.ts b/src/main/ai-vault/runtime-owned-ssh-session-list.test.ts
index 7c12537fb1f..d92da936e0f 100644
--- a/src/main/ai-vault/runtime-owned-ssh-session-list.test.ts
+++ b/src/main/ai-vault/runtime-owned-ssh-session-list.test.ts
@@ -63,7 +63,7 @@ describe('runtime-owned SSH AI Vault inventory', () => {
   it('skips malformed target rows from a paired runtime', async () => {
     mocks.callRuntimeEnvironment.mockResolvedValueOnce({
       ok: true,
-      result: { targets: [null, 42, { id: 'hub-owned-host', connected: true }] }
+      result: { targets: [null, 42, { id: '\ud800' }, { id: 'hub-owned-host', connected: true }] }
     })
 
     await expect(listRuntimeOwnedSshAiVaultTargets('/user-data', 'hub-runtime')).resolves.toEqual([
diff --git a/src/main/ai-vault/runtime-owned-ssh-session-list.ts b/src/main/ai-vault/runtime-owned-ssh-session-list.ts
index fefcab98e3c..ad61e638ed2 100644
--- a/src/main/ai-vault/runtime-owned-ssh-session-list.ts
+++ b/src/main/ai-vault/runtime-owned-ssh-session-list.ts
@@ -87,11 +87,17 @@ async function loadRuntimeOwnedSshAiVaultTargets(
     if (isRuntimeOwnedSshTargetId(target.id)) {
       return []
     }
+    let executionHostId: `ssh:${string}`
+    try {
+      executionHostId = toSshExecutionHostId(target.id)
+    } catch {
+      return []
+    }
     return [
       {
         environmentId,
         targetId: target.id,
-        executionHostId: toSshExecutionHostId(target.id),
+        executionHostId,
         ...('connected' in target && typeof target.connected === 'boolean'
           ? { connected: target.connected }
           : {})
diff --git a/src/renderer/src/web/web-preload-api.test.ts b/src/renderer/src/web/web-preload-api.test.ts
index 8f4fe422b41..51dee75614f 100644
--- a/src/renderer/src/web/web-preload-api.test.ts
+++ b/src/renderer/src/web/web-preload-api.test.ts
@@ -1941,14 +1941,14 @@ describe('web AI Vault preload API', () => {
     await expect(
       globals.window.api.aiVault.listSessions({
         executionHostScope: 'ssh:hub-owned-host',
-        limit: 25
+        unlimited: true
       })
     ).resolves.toEqual(scanResult)
     expect(runtimeCalls).toEqual([
       {
         method: 'aiVault.listSessions',
         params: {
-          limit: 25,
+          unlimited: true,
           executionHostId: 'ssh:hub-owned-host'
         }
       }
@@ -1985,6 +1985,7 @@ describe('web AI Vault preload API', () => {
       issues: [
         expect.objectContaining({
           executionHostId: 'ssh:hub-owned-host',
+          kind: 'host',
           message: expect.stringContaining('cannot scan Agent Session History on its SSH hosts')
         })
       ],
diff --git a/src/renderer/src/web/web-preload-api.ts b/src/renderer/src/web/web-preload-api.ts
index 3f96a0c3dfd..34a4bc205c4 100644
--- a/src/renderer/src/web/web-preload-api.ts
+++ b/src/renderer/src/web/web-preload-api.ts
@@ -1608,6 +1608,7 @@ function createAiVaultApi(): NonNullable<Partial<PreloadApi>['aiVault']> {
       if (parsedScope?.kind === 'ssh') {
         return callRuntimeResult<AiVaultListResult>('aiVault.listSessions', {
           limit: args?.limit,
+          unlimited: args?.unlimited,
           force: args?.force,
           scopePaths: args?.scopePaths,
           executionHostId: parsedScope.id
@@ -1700,6 +1701,7 @@ function webAiVaultUnsupportedSshHostResult(executionHostId: ExecutionHostId): A
       {
         executionHostId,
         agent: 'codex',
+        kind: 'host',
         path: executionHostId,
         message: translate(
           'auto.web.webPreloadApi.aiVaultUnsupportedSshHost',