diff --git a/config/process-host-direct-import-baseline.txt b/config/process-host-direct-import-baseline.txt
index e76e1eb7b15..80709a6a6d5 100644
--- a/config/process-host-direct-import-baseline.txt
+++ b/config/process-host-direct-import-baseline.txt
@@ -102,11 +102,11 @@ src/main/runtime/windows-mobile-firewall.ts
 src/main/skills/skill-update-run.ts
 src/main/ssh/ssh-connection.ts
 src/main/ssh/ssh-proxy-command.ts
-src/main/ssh/system-ssh-command.ts
-src/main/ssh/system-ssh-dynamic-forward-process.ts
-src/main/ssh/system-ssh-file-transfer.ts
-src/main/ssh/system-ssh-forward-process.ts
-src/main/ssh/system-ssh-operation-lifecycle.ts
+src/main/ssh/system-transport/system-ssh-command.ts
+src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts
+src/main/ssh/system-transport/system-ssh-file-transfer.ts
+src/main/ssh/system-transport/system-ssh-forward-process.ts
+src/main/ssh/system-transport/system-ssh-operation-lifecycle.ts
 src/main/startup/ensure-virtual-display.ts
 src/main/windows-process-tree-kill.ts
 src/main/zsh-startup-hook-pty-harness.ts
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index 0575434081e..f343f7292f5 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -6349,7 +6349,7 @@
         "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/browser-host-command-ledger.test.ts src/main/runtime/browser-host/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/browser-host-lease-placement-retirement.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host-registry.test.ts src/main/browser/paired-runtime-browser-client-host-runtime.test.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-session-startup.test.ts src/main/ipc/runtime-environments-subscription-teardown.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/browser-host-command-ledger.test.ts src/main/runtime/browser-host/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/browser/browser-network-deferred-socket.test.ts src/main/browser/browser-network-execution-route.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/ssh-browser-network-execution-route.test.ts src/main/browser/system-ssh-socks-client-socket.test.ts src/main/ssh/system-ssh-dynamic-forward-process.test.ts src/shared/browser-client-host-protocol.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ssh/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/browser/browser-network-deferred-socket.test.ts src/main/browser/browser-network-execution-route.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/ssh-browser-network-execution-route.test.ts src/main/browser/system-ssh-socks-client-socket.test.ts src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts src/shared/browser-client-host-protocol.test.ts src/main/ssh/system-transport/system-ssh-forward-process.test.ts src/main/ssh/system-transport/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
         "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
         "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
       ],
@@ -6405,7 +6405,7 @@
         "src/main/browser/paired-runtime-browser-network-route.test.ts",
         "src/main/browser/ssh-browser-network-execution-route.test.ts",
         "src/main/browser/system-ssh-socks-client-socket.test.ts",
-        "src/main/ssh/system-ssh-dynamic-forward-process.test.ts",
+        "src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts",
         "src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
         "src/main/browser/remote-browser-socks-server.test.ts",
         "src/main/runtime/runtime-binary-message-router.test.ts",
@@ -6889,7 +6889,7 @@
           ]
         },
         {
-          "file": "src/main/ssh/system-ssh-dynamic-forward-process.test.ts",
+          "file": "src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts",
           "assertions": [
             "system SSH uses BatchMode=yes, disables ControlMaster, and positions one dynamic forward before the destination",
             "authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately"
@@ -18736,13 +18736,13 @@
       "invariant": "For one connected SSH authority, a renderer snapshot may update Forwarded or Detected state only if no newer push for that target and stream arrived after the snapshot began. Active tunnels and persisted intent remain authoritative through scan refresh and reconnect until explicit removal or a real connection-lifecycle transition.",
       "oracle": "Hold empty initial Forwarded and Detected snapshot promises, publish live events, release the snapshots, and require each target and stream to preserve only its own newer push while applying unaffected snapshots. Reject one target's Detected snapshot and require its Forwarded snapshot plus later targets to hydrate independently. Begin another target with partial connected authority and require its snapshots to hydrate after same-watermark authority reconciliation. In headed Electron, hold an authoritative empty Forwarded snapshot across renderer reload, add a forward through the Ports panel, release and confirm the wrapped main handler resumed, then complete a later renderer-to-main listPortForwards round trip as the ordered hydration-continuation barrier. Before checking the Forwarded row, require main inventory, persisted intent, HTTP, remote process identity, and close warnings to prove the tunnel remained authoritative. Then forward two real Docker listeners, refresh detection, force an in-place relay-channel reconnect, perform a full transport reconnect, reject a bound local-port collision, remove one row, and require all signals to agree.",
       "commands": [
-        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-transport/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts --reporter=dot",
         "pnpm exec electron-vite build --mode e2e"
       ],
       "testFiles": [
         "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
         "src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
-        "src/main/ssh/system-ssh-forward-process.test.ts",
+        "src/main/ssh/system-transport/system-ssh-forward-process.test.ts",
         "src/main/ipc/ssh.test.ts"
       ],
       "assertionRefs": [
@@ -18755,7 +18755,7 @@
           "assertions": ["lists forwards filtered by connectionId", "removes a forward by id"]
         },
         {
-          "file": "src/main/ssh/system-ssh-forward-process.test.ts",
+          "file": "src/main/ssh/system-transport/system-ssh-forward-process.test.ts",
           "assertions": [
             "does not spawn ssh when the requested local forward port is already in use",
             "sends SIGTERM then SIGKILL when the process does not exit",
@@ -18775,7 +18775,7 @@
           "date": "2026-07-30",
           "runner": "local",
           "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts --reporter=dot",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-transport/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts --reporter=dot",
           "result": "passed",
           "durationSeconds": 6.77,
           "summary": "Six renderer, main-process, and barrier lifecycle files passed with 215 tests, including deterministic stale-snapshot, rejected-stream, partial-authority, and single-capture isolation plus existing collision, delayed-exit, reconnect, persistence, re-registration, and unrelated-forward contracts."
diff --git a/config/scripts/ci-shard-timings.json b/config/scripts/ci-shard-timings.json
index 64ecfee2c1e..dee8bb06ee3 100644
--- a/config/scripts/ci-shard-timings.json
+++ b/config/scripts/ci-shard-timings.json
@@ -5685,7 +5685,7 @@
       "src/main/ssh/pinned-runtime-host-target.test.ts": 51,
       "src/main/ssh/relay-bundle-paths.test.ts": 32,
       "src/main/ssh/relay-install-artifacts.test.ts": 37,
-      "src/main/ssh/remote-frame-protocol.test.ts": 113,
+      "src/main/ssh/remote-exec/remote-frame-protocol.test.ts": 113,
       "src/main/managed-server/install/remote-install-gc-termination.test.ts": 187,
       "src/main/managed-server/install/remote-install-model.test.ts": 184,
       "src/main/managed-server/install/remote-node-runtime-store-gc.test.ts": 1625,
@@ -5704,13 +5704,13 @@
       "src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts": 61,
       "src/main/ssh/ssh-channel-multiplexer-settlement.test.ts": 37,
       "src/main/ssh/ssh-channel-multiplexer.test.ts": 120,
-      "src/main/ssh/ssh-config-alias-claim.test.ts": 58,
-      "src/main/ssh/ssh-config-host-picker.test.ts": 223,
-      "src/main/ssh/ssh-config-loader-regression.test.ts": 132,
-      "src/main/ssh/ssh-config-loader.test.ts": 114,
-      "src/main/ssh/ssh-config-parser-host-patterns.test.ts": 49,
-      "src/main/ssh/ssh-config-parser.test.ts": 331,
-      "src/main/ssh/ssh-config-resolver.test.ts": 40,
+      "src/main/ssh/config/ssh-config-alias-claim.test.ts": 58,
+      "src/main/ssh/config/ssh-config-host-picker.test.ts": 223,
+      "src/main/ssh/config/ssh-config-loader-regression.test.ts": 132,
+      "src/main/ssh/config/ssh-config-loader.test.ts": 114,
+      "src/main/ssh/config/ssh-config-parser-host-patterns.test.ts": 49,
+      "src/main/ssh/config/ssh-config-parser.test.ts": 331,
+      "src/main/ssh/config/ssh-config-resolver.test.ts": 40,
       "src/main/ssh/ssh-connect-attempt-cancellation.test.ts": 85,
       "src/main/ssh/ssh-connection-attribution.test.ts": 34,
       "src/main/ssh/ssh-connection-auth-fallback.test.ts": 269,
@@ -5741,7 +5741,7 @@
       "src/main/ssh/ssh-exec-rc-stdout-noise.test.ts": 260,
       "src/main/ssh/ssh-exec-stdin-file-transfer.test.ts": 334,
       "src/main/ssh/ssh-file-transfer-abort.test.ts": 77,
-      "src/main/ssh/ssh-g-config-resolution.test.ts": 128,
+      "src/main/ssh/config/ssh-g-config-resolution.test.ts": 128,
       "src/main/ssh/ssh-host-key-decision.test.ts": 67,
       "src/main/ssh/ssh-host-key-store.test.ts": 207,
       "src/main/ssh/ssh-host-key-verifier.test.ts": 77,
@@ -5760,8 +5760,8 @@
       "src/main/ssh/hostile-host-test-support/ssh-hostile-hosts.docker.test.ts": 574,
       "src/main/ssh/ssh-keyboard-interactive-wire.test.ts": 261,
       "src/main/ssh/ssh-keyboard-interactive.test.ts": 41,
-      "src/main/ssh/ssh-known-hosts-source.test.ts": 106,
-      "src/main/ssh/ssh-known-hosts.test.ts": 89,
+      "src/main/ssh/config/ssh-known-hosts-source.test.ts": 106,
+      "src/main/ssh/config/ssh-known-hosts.test.ts": 89,
       "src/main/ssh/ssh-multi-factor-authentication.test.ts": 109,
       "src/main/ssh/ssh-multi-key-authentication.test.ts": 87,
       "src/main/ssh/ssh-multiplexer-transport-writer.test.ts": 75,
@@ -5773,16 +5773,16 @@
       "src/main/ssh/ssh-quit-abort-upload.test.ts": 252,
       "src/main/ssh/ssh-reconnect-error-classification.test.ts": 98,
       "src/main/ssh/ssh-reconnect-ladder.test.ts": 75,
-      "src/main/ssh/remote-host-answered-failure-producers.test.ts": 321,
+      "src/main/ssh/remote-exec/remote-host-answered-failure-producers.test.ts": 321,
       "src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent-shell.integration.test.ts": 1326,
       "src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts": 100,
       "src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.test.ts": 90,
       "src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.test.ts": 69,
-      "src/main/ssh/remote-exec-closed-stdin.test.ts": 89,
-      "src/main/ssh/remote-exec-command.test.ts": 130,
-      "src/main/ssh/remote-exec-input.test.ts": 92,
+      "src/main/ssh/remote-exec/remote-exec-closed-stdin.test.ts": 89,
+      "src/main/ssh/remote-exec/remote-exec-command.test.ts": 130,
+      "src/main/ssh/remote-exec/remote-exec-input.test.ts": 92,
       "src/main/managed-server/install/remote-install-gc-claim-termination.test.ts": 249,
-      "src/main/ssh/remote-host-answered-failure.test.ts": 101,
+      "src/main/ssh/remote-exec/remote-host-answered-failure.test.ts": 101,
       "src/main/ssh/legacy-relay/ssh-relay-incumbent-process.test.ts": 5329,
       "src/main/managed-server/install/remote-install-lock-exited-owner.test.ts": 380,
       "src/main/managed-server/install/remote-install-lock-termination.test.ts": 276,
@@ -5802,7 +5802,7 @@
       "src/main/ssh/ssh-request-outcome-verdict.test.ts": 37,
       "src/main/ssh/ssh-security-key-identity.test.ts": 147,
       "src/main/ssh/ssh-session-limit-error.test.ts": 27,
-      "src/main/ssh/system-ssh-operations.test.ts": 275,
+      "src/main/ssh/system-transport/system-ssh-operations.test.ts": 275,
       "src/main/ssh/ssh-system-transport.integration.test.ts": 277,
       "src/main/ssh/ssh-target-id-migration.test.ts": 46,
       "src/main/ssh/ssh-target-orcad-claims.test.ts": 306,
@@ -5812,16 +5812,16 @@
       "src/main/ssh/ssh-tcp-forwarding-probe.test.ts": 810,
       "src/main/ssh/ssh-windows-host-cells.test.ts": 39,
       "src/main/ssh/port-forwarding/ssh2-port-forward-listen.test.ts": 30,
-      "src/main/ssh/system-ssh-binary.test.ts": 35,
-      "src/main/ssh/system-ssh-dynamic-forward-process.test.ts": 240,
-      "src/main/ssh/system-ssh-forward-process.test.ts": 251,
-      "src/main/ssh/system-ssh-orphaned-forward.test.ts": 86,
-      "src/main/ssh/system-ssh-sftp-args.test.ts": 44,
-      "src/main/ssh/system-ssh-sftp-path.test.ts": 38,
-      "src/main/ssh/system-ssh-upload-plan-budget.test.ts": 336,
-      "src/main/ssh/system-ssh-windows-upload.test.ts": 343,
-      "src/main/ssh/system-ssh-windows-write-capabilities.test.ts": 35,
-      "src/main/ssh/vscode-ssh-authority.test.ts": 48,
+      "src/main/ssh/system-transport/system-ssh-binary.test.ts": 35,
+      "src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts": 240,
+      "src/main/ssh/system-transport/system-ssh-forward-process.test.ts": 251,
+      "src/main/ssh/system-transport/system-ssh-orphaned-forward.test.ts": 86,
+      "src/main/ssh/system-transport/system-ssh-sftp-args.test.ts": 44,
+      "src/main/ssh/system-transport/system-ssh-sftp-path.test.ts": 38,
+      "src/main/ssh/system-transport/system-ssh-upload-plan-budget.test.ts": 336,
+      "src/main/ssh/system-transport/system-ssh-windows-upload.test.ts": 343,
+      "src/main/ssh/system-transport/system-ssh-windows-write-capabilities.test.ts": 35,
+      "src/main/ssh/config/vscode-ssh-authority.test.ts": 48,
       "src/main/star-nag/service-direct-star.test.ts": 323,
       "src/main/star-nag/service-force-show-races.test.ts": 322,
       "src/main/star-nag/service-outcome-telemetry.test.ts": 354,
diff --git a/config/scripts/pr-e2e-route-contracts.test.mjs b/config/scripts/pr-e2e-route-contracts.test.mjs
index 5bfed39aca8..af525da7c2e 100644
--- a/config/scripts/pr-e2e-route-contracts.test.mjs
+++ b/config/scripts/pr-e2e-route-contracts.test.mjs
@@ -288,7 +288,7 @@ describe('ssh-browser-e2e-routing', () => {
       'src/main/browser/browser-network-deferred-socket.ts',
       'src/main/browser/browser-network-execution-route.ts',
       'src/main/browser/system-ssh-socks-client-socket.ts',
-      'src/main/ssh/system-ssh-dynamic-forward-process.ts',
+      'src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts',
       'tests/e2e/helpers/docker-ssh-host-target.ts',
       'tests/e2e/helpers/docker-ssh-host-image.ts'
     ]) {
diff --git a/config/scripts/pr-e2e-source-routing.mjs b/config/scripts/pr-e2e-source-routing.mjs
index 46f6f0265ae..44105317e0f 100644
--- a/config/scripts/pr-e2e-source-routing.mjs
+++ b/config/scripts/pr-e2e-source-routing.mjs
@@ -276,7 +276,7 @@ export const PR_E2E_SOURCE_ROUTES = [
       file === 'tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts' ||
       /^tests\/e2e\/helpers\/docker-ssh-host-(?:image|target)\.ts$/.test(file) ||
       (isProductSource(file) &&
-        /^src\/main\/(?:browser\/(?:ssh-browser-network-execution-route|browser-network-deferred-socket|browser-network-execution-route|system-ssh-socks-client-socket)|ssh\/system-ssh-dynamic-forward-process)\.ts$/.test(
+        /^src\/main\/(?:browser\/(?:ssh-browser-network-execution-route|browser-network-deferred-socket|browser-network-execution-route|system-ssh-socks-client-socket)|ssh\/system-transport\/system-ssh-dynamic-forward-process)\.ts$/.test(
           file
         ))
   },
diff --git a/src/main/active-view-persistence-boundary.test.ts b/src/main/active-view-persistence-boundary.test.ts
index 54112b2b08f..a951cb36100 100644
--- a/src/main/active-view-persistence-boundary.test.ts
+++ b/src/main/active-view-persistence-boundary.test.ts
@@ -22,7 +22,7 @@ vi.mock('electron', () => ({
 
 vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn() }))
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts b/src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts
index 613352b29e7..5503704b86b 100644
--- a/src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts
@@ -5,7 +5,7 @@ import { EventEmitter } from 'node:events'
 import type { ChildProcessWithoutNullStreams } from 'node:child_process'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
-import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../ssh/remote-frame-protocol'
+import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../ssh/remote-exec/remote-frame-protocol'
 import {
   MAX_STARTUP_BUFFER_BYTES,
   waitForWslRelaySentinel,
diff --git a/src/main/agent-hooks/wsl-hook-relay-sentinel.ts b/src/main/agent-hooks/wsl-hook-relay-sentinel.ts
index 47b50eaacfd..eb392f1b524 100644
--- a/src/main/agent-hooks/wsl-hook-relay-sentinel.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-sentinel.ts
@@ -4,7 +4,7 @@
 // ChildProcess instead of a ClientChannel.
 import type { ChildProcessWithoutNullStreams } from 'node:child_process'
 
-import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../ssh/remote-frame-protocol'
+import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../ssh/remote-exec/remote-frame-protocol'
 import type { MultiplexerTransport } from '../ssh/ssh-channel-multiplexer'
 
 export const MAX_STARTUP_BUFFER_BYTES = 64 * 1024
diff --git a/src/main/automations/automation-worker-durability.test.ts b/src/main/automations/automation-worker-durability.test.ts
index 22d13899e3b..1cd77cd8518 100644
--- a/src/main/automations/automation-worker-durability.test.ts
+++ b/src/main/automations/automation-worker-durability.test.ts
@@ -10,7 +10,7 @@ vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/browser/ssh-browser-network-execution-route.ts b/src/main/browser/ssh-browser-network-execution-route.ts
index cadf3597c44..96abc6952bd 100644
--- a/src/main/browser/ssh-browser-network-execution-route.ts
+++ b/src/main/browser/ssh-browser-network-execution-route.ts
@@ -5,7 +5,7 @@ import type { Client as SshClient } from 'ssh2'
 import {
   startSystemSshDynamicForwardProcess,
   type SystemSshDynamicForwardProcess
-} from '../ssh/system-ssh-dynamic-forward-process'
+} from '../ssh/system-transport/system-ssh-dynamic-forward-process'
 import { BrowserNetworkDeferredSocket } from './browser-network-deferred-socket'
 import {
   browserNetworkExecutionHostKey,
diff --git a/src/main/github/github-enterprise-repository.test.ts b/src/main/github/github-enterprise-repository.test.ts
index d6db52e01b9..1d0be831340 100644
--- a/src/main/github/github-enterprise-repository.test.ts
+++ b/src/main/github/github-enterprise-repository.test.ts
@@ -16,7 +16,7 @@ vi.mock('../git/runner', () => ({
   gitExecFileAsync: gitExecFileAsyncMock
 }))
 
-vi.mock('../ssh/ssh-g-config-resolution', () => ({
+vi.mock('../ssh/config/ssh-g-config-resolution', () => ({
   resolveWithSshG: resolveWithSshGMock
 }))
 
diff --git a/src/main/github/github-repository-identity.ssh-host-alias.test.ts b/src/main/github/github-repository-identity.ssh-host-alias.test.ts
index 5b718e397ab..cbc8cb99523 100644
--- a/src/main/github/github-repository-identity.ssh-host-alias.test.ts
+++ b/src/main/github/github-repository-identity.ssh-host-alias.test.ts
@@ -23,7 +23,7 @@ vi.mock('./local-git-config-signature', () => ({
   readLocalGitConfigSignature: readLocalGitConfigSignatureMock
 }))
 
-vi.mock('../ssh/ssh-g-config-resolution', () => ({
+vi.mock('../ssh/config/ssh-g-config-resolution', () => ({
   resolveWithSshG: resolveWithSshGMock
 }))
 
diff --git a/src/main/github/github-ssh-host-alias-resolution.ts b/src/main/github/github-ssh-host-alias-resolution.ts
index 8decd2ec8d0..8aa033a6b4d 100644
--- a/src/main/github/github-ssh-host-alias-resolution.ts
+++ b/src/main/github/github-ssh-host-alias-resolution.ts
@@ -1,7 +1,7 @@
 import type { GitHubOwnerRepo } from '../../shared/github/pull-request-types'
 import { commandExecFileAsync } from '../git/runner'
 import { parseWslPath } from '../wsl'
-import { resolveWithSshG } from '../ssh/ssh-g-config-resolution'
+import { resolveWithSshG } from '../ssh/config/ssh-g-config-resolution'
 import {
   gitHubSshConfigHostAlias,
   parseGitHubOwnerRepo,
diff --git a/src/main/ipc/orca-profiles-switch-persistence.test.ts b/src/main/ipc/orca-profiles-switch-persistence.test.ts
index 6365291fd21..2ec29383d0b 100644
--- a/src/main/ipc/orca-profiles-switch-persistence.test.ts
+++ b/src/main/ipc/orca-profiles-switch-persistence.test.ts
@@ -30,7 +30,7 @@ vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/ipc/pty/pane/pane-owner-replacement.test.ts b/src/main/ipc/pty/pane/pane-owner-replacement.test.ts
index 07ba7d410e3..714f0c095ec 100644
--- a/src/main/ipc/pty/pane/pane-owner-replacement.test.ts
+++ b/src/main/ipc/pty/pane/pane-owner-replacement.test.ts
@@ -7,7 +7,7 @@ vi.mock('../../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../../ssh/ssh-config-parser', () => ({
+vi.mock('../../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/ipc/renderer-shutdown-checkpoint-sleep-records.test.ts b/src/main/ipc/renderer-shutdown-checkpoint-sleep-records.test.ts
index d5121cc5f83..eb9370efcd5 100644
--- a/src/main/ipc/renderer-shutdown-checkpoint-sleep-records.test.ts
+++ b/src/main/ipc/renderer-shutdown-checkpoint-sleep-records.test.ts
@@ -37,7 +37,7 @@ vi.mock('electron', () => ({
 }))
 vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn().mockReturnValue({}) }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/ipc/session-window-view-save.test.ts b/src/main/ipc/session-window-view-save.test.ts
index 8508d7d5ba5..3d5e2784c1e 100644
--- a/src/main/ipc/session-window-view-save.test.ts
+++ b/src/main/ipc/session-window-view-save.test.ts
@@ -30,7 +30,7 @@ vi.mock('electron', () => ({
 }))
 vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn().mockReturnValue({}) }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/ipc/settings-delayed-response.test.ts b/src/main/ipc/settings-delayed-response.test.ts
index 3b0d5b2ecd5..ff162527dad 100644
--- a/src/main/ipc/settings-delayed-response.test.ts
+++ b/src/main/ipc/settings-delayed-response.test.ts
@@ -28,7 +28,7 @@ vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/ipc/shell.ts b/src/main/ipc/shell.ts
index 409ff648857..2591055ae18 100644
--- a/src/main/ipc/shell.ts
+++ b/src/main/ipc/shell.ts
@@ -16,7 +16,7 @@ import {
   resolveExternalEditorLaunchSpec,
   resolveVsCodeRemoteSshLaunchSpec
 } from '../external-editor-launch'
-import { resolveVsCodeSshAuthority } from '../ssh/vscode-ssh-authority'
+import { resolveVsCodeSshAuthority } from '../ssh/config/vscode-ssh-authority'
 import { toSshExecutionHostId } from '../../shared/execution-host'
 import {
   isLocallyOwned,
diff --git a/src/main/ipc/ssh-app-shutdown.test.ts b/src/main/ipc/ssh-app-shutdown.test.ts
index a299063c4b3..cb887bbac1c 100644
--- a/src/main/ipc/ssh-app-shutdown.test.ts
+++ b/src/main/ipc/ssh-app-shutdown.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh-connect-decision-cancellation.test.ts b/src/main/ipc/ssh-connect-decision-cancellation.test.ts
index 2685189af84..fb406cec1c0 100644
--- a/src/main/ipc/ssh-connect-decision-cancellation.test.ts
+++ b/src/main/ipc/ssh-connect-decision-cancellation.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh-credential-cancel.test.ts b/src/main/ipc/ssh-credential-cancel.test.ts
index 5a7766956bd..f318ba954e2 100644
--- a/src/main/ipc/ssh-credential-cancel.test.ts
+++ b/src/main/ipc/ssh-credential-cancel.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh-disconnect-cancellation.test.ts b/src/main/ipc/ssh-disconnect-cancellation.test.ts
index 13587401ebb..403a55b2834 100644
--- a/src/main/ipc/ssh-disconnect-cancellation.test.ts
+++ b/src/main/ipc/ssh-disconnect-cancellation.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh-handler-reregistration.test.ts b/src/main/ipc/ssh-handler-reregistration.test.ts
index fc9a83dbb82..fb8f5c27aea 100644
--- a/src/main/ipc/ssh-handler-reregistration.test.ts
+++ b/src/main/ipc/ssh-handler-reregistration.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh-host-user-disconnect.test.ts b/src/main/ipc/ssh-host-user-disconnect.test.ts
index 0b98be00fb4..fe055533d03 100644
--- a/src/main/ipc/ssh-host-user-disconnect.test.ts
+++ b/src/main/ipc/ssh-host-user-disconnect.test.ts
@@ -9,7 +9,7 @@ const runtime = vi.hoisted(() => {
   return { environments, activate: vi.fn(), getStatusOwner: vi.fn(), invalidate: vi.fn() }
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh-sign-in-requirement.test.ts b/src/main/ipc/ssh-sign-in-requirement.test.ts
index a8d0c6ae65a..6b7a672c3a7 100644
--- a/src/main/ipc/ssh-sign-in-requirement.test.ts
+++ b/src/main/ipc/ssh-sign-in-requirement.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh-state-broadcast-fanout.test.ts b/src/main/ipc/ssh-state-broadcast-fanout.test.ts
index 8e1fa64bb1f..8859f63230c 100644
--- a/src/main/ipc/ssh-state-broadcast-fanout.test.ts
+++ b/src/main/ipc/ssh-state-broadcast-fanout.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh-target-crud-handlers.ts b/src/main/ipc/ssh-target-crud-handlers.ts
index ab5ea2d2cdb..abd803fe872 100644
--- a/src/main/ipc/ssh-target-crud-handlers.ts
+++ b/src/main/ipc/ssh-target-crud-handlers.ts
@@ -10,7 +10,7 @@ import type {
 import {
   listUserSshConfigHostSummaries,
   resolveUserSshConfigHost
-} from '../ssh/ssh-config-host-picker'
+} from '../ssh/config/ssh-config-host-picker'
 import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
 import { closeOrcadManagedTunnel } from '../managed-server/lifecycle/orcad-managed-tunnel'
 import { rotateSshProviderAuthority } from '../ssh/ssh-provider-authority'
diff --git a/src/main/ipc/ssh-target-registry.test.ts b/src/main/ipc/ssh-target-registry.test.ts
index e4444a3dcc0..d56d6807bd9 100644
--- a/src/main/ipc/ssh-target-registry.test.ts
+++ b/src/main/ipc/ssh-target-registry.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/ipc/ssh.test.ts b/src/main/ipc/ssh.test.ts
index 96ab716211d..b261a928355 100644
--- a/src/main/ipc/ssh.test.ts
+++ b/src/main/ipc/ssh.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('./ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/managed-server/activation/orcad-activation-crash-recovery.test.ts b/src/main/managed-server/activation/orcad-activation-crash-recovery.test.ts
index f3fa0e0d6b5..4edbef24b43 100644
--- a/src/main/managed-server/activation/orcad-activation-crash-recovery.test.ts
+++ b/src/main/managed-server/activation/orcad-activation-crash-recovery.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import type * as RecordFile from '../install/orcad-remote-record-file'
 import type * as InstallLock from '../install/remote-install-lock'
 import type * as VersionedInstall from '../install/remote-versioned-install'
@@ -11,7 +11,7 @@ vi.mock('node:crypto', async (importOriginal) => {
   return { ...actual, randomUUID: () => uuid.fixed ?? actual.randomUUID() }
 })
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -38,7 +38,7 @@ vi.mock('../../ssh/orcad-local-build-hash', () => ({
   computeLocalOrcadBuildHash: () => 'abc123def4567890'
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock } from '../install/remote-install-lock'
 import { writeAtomicOrcadRemoteRecord } from '../install/orcad-remote-record-file'
 import { deployOrcad } from '../../ssh/orcad-remote-deploy'
diff --git a/src/main/managed-server/activation/orcad-activation-fence-generation.test.ts b/src/main/managed-server/activation/orcad-activation-fence-generation.test.ts
index 4517d8c43a5..66664d53f74 100644
--- a/src/main/managed-server/activation/orcad-activation-fence-generation.test.ts
+++ b/src/main/managed-server/activation/orcad-activation-fence-generation.test.ts
@@ -11,18 +11,18 @@ import {
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 
 // Every remote command runs in a real local shell, so the host-side checks are the real ones.
 const shell = vi.hoisted((): { env: NodeJS.ProcessEnv | undefined } => ({ env: undefined }))
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => {
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => {
   const { runProcess } = await import('@orca/process-host')
   return {
     ...(await importOriginal<typeof ExecCommandModule>()),
     execCommand: async (_conn: unknown, command: string) => {
       const result = await runProcess({ program: '/bin/sh', args: ['-c', command], env: shell.env })
       if (result.code !== 0) {
-        const { sshCommandExitError } = await import('../../ssh/remote-exec-command')
+        const { sshCommandExitError } = await import('../../ssh/remote-exec/remote-exec-command')
         throw sshCommandExitError(command, result.code ?? 1, result.stdout)
       }
       return result.stdout
diff --git a/src/main/managed-server/activation/orcad-activation-fence-scope.ts b/src/main/managed-server/activation/orcad-activation-fence-scope.ts
index 13504db0834..910b4c6adbd 100644
--- a/src/main/managed-server/activation/orcad-activation-fence-scope.ts
+++ b/src/main/managed-server/activation/orcad-activation-fence-scope.ts
@@ -9,7 +9,7 @@
  */
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { isSshCommandExitError } from '../../ssh/remote-exec-command'
+import { isSshCommandExitError } from '../../ssh/remote-exec/remote-exec-command'
 
 export const ORCAD_FENCE_OWNER_FILENAME = '.orca-fence-owner'
 export const ORCAD_FENCE_LOST_MARKER = '__ORCAD_FENCE_LOST__'
diff --git a/src/main/managed-server/activation/orcad-activation-host-test-harness.ts b/src/main/managed-server/activation/orcad-activation-host-test-harness.ts
index 08aa143edee..0373e798c55 100644
--- a/src/main/managed-server/activation/orcad-activation-host-test-harness.ts
+++ b/src/main/managed-server/activation/orcad-activation-host-test-harness.ts
@@ -10,7 +10,7 @@ import {
   type OrcadActivationRecord
 } from './orcad-activation-record'
 import { isSnapshotCaptureCommand } from '../../ssh/orcad-snapshot-capture-command'
-import { sshCommandExitError } from '../../ssh/remote-exec-command'
+import { sshCommandExitError } from '../../ssh/remote-exec/remote-exec-command'
 
 export const OLD = '0.1.0+aa01'
 export const NEW = '0.2.0+bb01'
diff --git a/src/main/managed-server/activation/orcad-activation-lock.ts b/src/main/managed-server/activation/orcad-activation-lock.ts
index 7300e3f9299..7be50609818 100644
--- a/src/main/managed-server/activation/orcad-activation-lock.ts
+++ b/src/main/managed-server/activation/orcad-activation-lock.ts
@@ -12,7 +12,7 @@ import {
   withoutAbortSignal,
   type OrcadRemoteExecTarget
 } from '../install/orcad-remote-runtime-control'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock, RemoteInstallLockBusyError } from '../install/remote-install-lock'
 import {
   orphanInstallLockCommand,
diff --git a/src/main/managed-server/activation/orcad-activation-record-store.ts b/src/main/managed-server/activation/orcad-activation-record-store.ts
index 693820b9f4e..9879b89c3ef 100644
--- a/src/main/managed-server/activation/orcad-activation-record-store.ts
+++ b/src/main/managed-server/activation/orcad-activation-record-store.ts
@@ -6,7 +6,7 @@
  * activated" would deploy over a live install and lose its rollback target.
  */
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import {
   ORCAD_ACTIVATION_FILENAME,
   emptyOrcadActivationRecord,
diff --git a/src/main/managed-server/activation/orcad-activation-transaction.test.ts b/src/main/managed-server/activation/orcad-activation-transaction.test.ts
index b51e187acae..e75b55103ef 100644
--- a/src/main/managed-server/activation/orcad-activation-transaction.test.ts
+++ b/src/main/managed-server/activation/orcad-activation-transaction.test.ts
@@ -1,8 +1,8 @@
 import { describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import type * as InstallLock from '../install/remote-install-lock'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn().mockResolvedValue('')
 }))
@@ -11,7 +11,7 @@ vi.mock('../install/remote-install-lock', async (importOriginal) => ({
   acquireInstallLock: vi.fn().mockResolvedValue(undefined)
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock, RemoteInstallLockBusyError } from '../install/remote-install-lock'
 import {
   parseOrcadActivationTransaction,
diff --git a/src/main/managed-server/activation/orcad-activation-transaction.ts b/src/main/managed-server/activation/orcad-activation-transaction.ts
index 2de8fd077b3..0e7ba2f36cf 100644
--- a/src/main/managed-server/activation/orcad-activation-transaction.ts
+++ b/src/main/managed-server/activation/orcad-activation-transaction.ts
@@ -25,7 +25,7 @@ import {
 } from '../lifecycle/orcad-decommission-transaction'
 import { errorMessage } from '../../../shared/error-message'
 import { RELAY_INSTALL_LOCK_NAME } from '../../../shared/relay-install-lock-name'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import { joinRemotePath, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 export const ORCAD_ACTIVATION_TRANSACTION_FILENAME = 'transaction.json'
diff --git a/src/main/managed-server/host-state/orcad-machine-claim-command.ts b/src/main/managed-server/host-state/orcad-machine-claim-command.ts
index ad8c6e60dc9..6c6058f4a5b 100644
--- a/src/main/managed-server/host-state/orcad-machine-claim-command.ts
+++ b/src/main/managed-server/host-state/orcad-machine-claim-command.ts
@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import {
   ORCAD_MACHINE_CLAIM_FILENAME,
   ORCAD_MACHINE_CLAIM_SCHEMA_VERSION
diff --git a/src/main/managed-server/host-state/orcad-machine-home.test.ts b/src/main/managed-server/host-state/orcad-machine-home.test.ts
index e728ffb6505..1d55ce1ae95 100644
--- a/src/main/managed-server/host-state/orcad-machine-home.test.ts
+++ b/src/main/managed-server/host-state/orcad-machine-home.test.ts
@@ -12,7 +12,7 @@ import {
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import type { OrcadMachineHomeProbe } from './orcad-machine-home'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 import type { RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
@@ -21,7 +21,7 @@ import type { RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 const shell = vi.hoisted((): { env: NodeJS.ProcessEnv | undefined } => ({
   env: undefined
 }))
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => {
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => {
   const { runProcess } = await import('@orca/process-host')
   return {
     ...(await importOriginal<typeof ExecCommandModule>()),
@@ -32,7 +32,7 @@ vi.mock('../../ssh/remote-exec-command', async (importOriginal) => {
         env: conn.env ?? shell.env
       })
       if (result.code !== 0) {
-        const { sshCommandExitError } = await import('../../ssh/remote-exec-command')
+        const { sshCommandExitError } = await import('../../ssh/remote-exec/remote-exec-command')
         throw sshCommandExitError(command, result.code ?? 1, result.stdout)
       }
       return result.stdout
diff --git a/src/main/managed-server/host-state/orcad-machine-home.ts b/src/main/managed-server/host-state/orcad-machine-home.ts
index 7ca9beb3562..1404fd54221 100644
--- a/src/main/managed-server/host-state/orcad-machine-home.ts
+++ b/src/main/managed-server/host-state/orcad-machine-home.ts
@@ -12,7 +12,7 @@
  */
 import { createHash } from 'node:crypto'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import { ORCAD_ACTIVATION_FILENAME } from '../activation/orcad-activation-record'
 import { parseDarwinPlatformUuid } from '../../persistence/profile-state/profile-state-access-identity'
 import {
diff --git a/src/main/managed-server/host-state/orcad-state-mutation-exec.test.ts b/src/main/managed-server/host-state/orcad-state-mutation-exec.test.ts
index fde1f054db0..6865d6d08a7 100644
--- a/src/main/managed-server/host-state/orcad-state-mutation-exec.test.ts
+++ b/src/main/managed-server/host-state/orcad-state-mutation-exec.test.ts
@@ -7,7 +7,7 @@ import {
   execOrcadStateMutationOr
 } from './orcad-state-mutation-exec'
 import { execOrcadRemoteOr } from '../install/orcad-remote-runtime-control'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 
diff --git a/src/main/managed-server/host-state/orcad-state-mutation-exec.ts b/src/main/managed-server/host-state/orcad-state-mutation-exec.ts
index 69dc25e495d..86cd33909f3 100644
--- a/src/main/managed-server/host-state/orcad-state-mutation-exec.ts
+++ b/src/main/managed-server/host-state/orcad-state-mutation-exec.ts
@@ -12,7 +12,10 @@ import {
   ORCAD_STATE_MUTATION_DEADLINE
 } from './orcad-state-snapshot-members'
 import type { OrcadRemoteExecTarget } from '../install/orcad-remote-runtime-control'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import {
+  execCommand,
+  isUnconfirmedSshCommandTermination
+} from '../../ssh/remote-exec/remote-exec-command'
 import { isOrcadFenceLost, OrcadFenceLostError } from '../activation/orcad-activation-fence-scope'
 
 // Longer than the host's own deadline, so the host kills the work before the client gives up.
diff --git a/src/main/managed-server/host-state/orcad-state-mutation-timeout.test.ts b/src/main/managed-server/host-state/orcad-state-mutation-timeout.test.ts
index 8e883245041..9af2a828766 100644
--- a/src/main/managed-server/host-state/orcad-state-mutation-timeout.test.ts
+++ b/src/main/managed-server/host-state/orcad-state-mutation-timeout.test.ts
@@ -5,12 +5,12 @@
  * command shape) runs beside it, as the two restores did on a real host.
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import type * as RecordFile from '../install/orcad-remote-record-file'
 import type * as InstallLock from '../install/remote-install-lock'
 import type * as VersionedInstall from '../install/remote-versioned-install'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -39,7 +39,7 @@ import {
   execCommand,
   SSH_EXEC_TIMEOUT_CODE,
   isUnconfirmedSshCommandTermination
-} from '../../ssh/remote-exec-command'
+} from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock } from '../install/remote-install-lock'
 import { writeAtomicOrcadRemoteRecord } from '../install/orcad-remote-record-file'
 import { deployOrcad } from '../../ssh/orcad-remote-deploy'
diff --git a/src/main/managed-server/install/orcad-remote-context.ts b/src/main/managed-server/install/orcad-remote-context.ts
index 07401dba139..9d5b318de48 100644
--- a/src/main/managed-server/install/orcad-remote-context.ts
+++ b/src/main/managed-server/install/orcad-remote-context.ts
@@ -23,7 +23,7 @@ import { orcadMachineClaimCommand } from '../host-state/orcad-machine-claim-comm
 import { execOrcadRemote, type OrcadRemoteExecTarget } from './orcad-remote-runtime-control'
 import { readRemoteHomeCommand } from '../../ssh/ssh-remote-commands'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import {
   isWindowsRemoteHost,
   joinRemotePath,
diff --git a/src/main/managed-server/install/orcad-remote-decommission.test.ts b/src/main/managed-server/install/orcad-remote-decommission.test.ts
index a6419c4bdd8..873b24cd9f7 100644
--- a/src/main/managed-server/install/orcad-remote-decommission.test.ts
+++ b/src/main/managed-server/install/orcad-remote-decommission.test.ts
@@ -1,9 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import type * as RecordFile from './orcad-remote-record-file'
 import type * as InstallLock from './remote-install-lock'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -17,7 +17,7 @@ vi.mock('./orcad-remote-record-file', async (importOriginal) => ({
   writeAtomicOrcadRemoteRecord: vi.fn()
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock } from './remote-install-lock'
 import { writeAtomicOrcadRemoteRecord } from './orcad-remote-record-file'
 import { decommissionRemoteOrcad } from './orcad-remote-decommission'
diff --git a/src/main/managed-server/install/orcad-remote-gc.test.ts b/src/main/managed-server/install/orcad-remote-gc.test.ts
index 372b548a328..4be62080738 100644
--- a/src/main/managed-server/install/orcad-remote-gc.test.ts
+++ b/src/main/managed-server/install/orcad-remote-gc.test.ts
@@ -1,7 +1,7 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -21,7 +21,7 @@ vi.mock('./remote-install-lock', () => ({
   isRelayInstallLockStale: vi.fn().mockResolvedValue(false)
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { gcOldOrcadVersions } from './orcad-remote-gc'
 import { emptyOrcadActivationRecord } from '../activation/orcad-activation-record'
 import { serializeOrcadActivationTransaction } from '../activation/orcad-activation-transaction'
diff --git a/src/main/managed-server/install/orcad-remote-gc.ts b/src/main/managed-server/install/orcad-remote-gc.ts
index e9a66f8f404..7bf3eafcec5 100644
--- a/src/main/managed-server/install/orcad-remote-gc.ts
+++ b/src/main/managed-server/install/orcad-remote-gc.ts
@@ -14,7 +14,10 @@
  * pinned too, and an unreadable journal skips the pass entirely.
  */
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import {
+  execCommand,
+  isUnconfirmedSshCommandTermination
+} from '../../ssh/remote-exec/remote-exec-command'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
 import { gcOldRemoteInstallVersions } from './remote-install-gc'
 import {
@@ -33,7 +36,7 @@ import {
   joinRemotePath,
   type RemoteHostPlatform
 } from '../../ssh/ssh-remote-platform'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import { orcadWindowsHomeOpCommand } from './orcad-remote-windows-node'
 import { ORCAD_WINDOWS_LIVENESS_MANY_MARKER } from '../host-state/orcad-windows-host-script'
 
diff --git a/src/main/managed-server/install/orcad-remote-install-termination.test.ts b/src/main/managed-server/install/orcad-remote-install-termination.test.ts
index 127a0298ee4..99ad8ccd9ff 100644
--- a/src/main/managed-server/install/orcad-remote-install-termination.test.ts
+++ b/src/main/managed-server/install/orcad-remote-install-termination.test.ts
@@ -1,7 +1,7 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -18,7 +18,7 @@ vi.mock('./orcad-remote-node-runtime', () => ({
 }))
 
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { uploadRelayDirectory, writeRelayFile } from './remote-install-transfers'
 import { installOrcadBundle } from './orcad-remote-install'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
diff --git a/src/main/managed-server/install/orcad-remote-install.ts b/src/main/managed-server/install/orcad-remote-install.ts
index 59372409cab..260e2c45ad4 100644
--- a/src/main/managed-server/install/orcad-remote-install.ts
+++ b/src/main/managed-server/install/orcad-remote-install.ts
@@ -4,7 +4,10 @@ import { orcadAgentBrowserNativeName } from '../../../shared/orcad-agent-browser
 import type { NodeRuntimeTarget } from '../../../shared/node-runtime-pin'
 import { ensureRemoteOrcadNodeRuntime } from './orcad-remote-node-runtime'
 import { recordedRemoteNodeRuntimeProbeCommand } from './orcad-remote-node-runtime-recorded-probe'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import {
+  execCommand,
+  isUnconfirmedSshCommandTermination
+} from '../../ssh/remote-exec/remote-exec-command'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 import { joinRemotePath, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
diff --git a/src/main/managed-server/install/orcad-remote-launch.ts b/src/main/managed-server/install/orcad-remote-launch.ts
index 38726eb8077..e20ffdbdfef 100644
--- a/src/main/managed-server/install/orcad-remote-launch.ts
+++ b/src/main/managed-server/install/orcad-remote-launch.ts
@@ -25,7 +25,7 @@ import {
   remoteDirname,
   type RemoteHostPlatform
 } from '../../ssh/ssh-remote-platform'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import { ORCAD_WSL_HOST_ENV } from '../../ipc/wsl-guest-windows-drive-path'
 import {
   assertPosixOrcadHost as assertPosixHost,
diff --git a/src/main/managed-server/install/orcad-remote-lifecycle-windows.test.ts b/src/main/managed-server/install/orcad-remote-lifecycle-windows.test.ts
index bb7a72827c8..ce516ffbde5 100644
--- a/src/main/managed-server/install/orcad-remote-lifecycle-windows.test.ts
+++ b/src/main/managed-server/install/orcad-remote-lifecycle-windows.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import type * as TerminalBarrier from '../lifecycle/orcad-rollback-terminal-barrier'
 /**
  * The deploy and rollback drivers end to end against a Windows host whose every host op is answered by a
@@ -7,7 +7,7 @@ import type * as TerminalBarrier from '../lifecycle/orcad-rollback-terminal-barr
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RecordFile from './orcad-remote-record-file'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -50,7 +50,7 @@ vi.mock('./remote-versioned-install', async (importOriginal) => ({
   abandonInstall: vi.fn().mockResolvedValue(undefined)
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { deployOrcad, type OrcadDeployOptions } from '../../ssh/orcad-remote-deploy'
 import { rollbackOrcad } from './orcad-remote-rollback'
 import { emptyOrcadActivationRecord } from '../activation/orcad-activation-record'
diff --git a/src/main/managed-server/install/orcad-remote-log-tail.test.ts b/src/main/managed-server/install/orcad-remote-log-tail.test.ts
index 04aaa640691..7827d56999b 100644
--- a/src/main/managed-server/install/orcad-remote-log-tail.test.ts
+++ b/src/main/managed-server/install/orcad-remote-log-tail.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -15,7 +15,7 @@ import { ORCAD_WINDOWS_HOST_SCRIPT } from '../host-state/orcad-windows-host-scri
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 const execCommand = vi.hoisted(() => vi.fn())
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand
 }))
diff --git a/src/main/managed-server/install/orcad-remote-log-tail.ts b/src/main/managed-server/install/orcad-remote-log-tail.ts
index b06882659ad..e4b4d336af8 100644
--- a/src/main/managed-server/install/orcad-remote-log-tail.ts
+++ b/src/main/managed-server/install/orcad-remote-log-tail.ts
@@ -6,7 +6,7 @@
 import { redactString } from '../../observability/redactor'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
 import { ORCAD_LOG_FILENAME } from './orcad-remote-host-support'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import {
   isWindowsRemoteHost,
   joinRemotePath,
diff --git a/src/main/managed-server/install/orcad-remote-node-runtime-promotion-lock.test.ts b/src/main/managed-server/install/orcad-remote-node-runtime-promotion-lock.test.ts
index 014bbfc9713..dccfcdffdc5 100644
--- a/src/main/managed-server/install/orcad-remote-node-runtime-promotion-lock.test.ts
+++ b/src/main/managed-server/install/orcad-remote-node-runtime-promotion-lock.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -13,10 +13,10 @@ import {
   REMOTE_NODE_RUNTIME_READY
 } from '../../ssh/orcad-remote-node-runtime-report'
 import { RUNTIME_STORE_LOCK_NAME } from './remote-node-runtime-store-lock'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
diff --git a/src/main/managed-server/install/orcad-remote-node-runtime-recorded-probe.test.ts b/src/main/managed-server/install/orcad-remote-node-runtime-recorded-probe.test.ts
index be196c52d08..8462ec5fd6c 100644
--- a/src/main/managed-server/install/orcad-remote-node-runtime-recorded-probe.test.ts
+++ b/src/main/managed-server/install/orcad-remote-node-runtime-recorded-probe.test.ts
@@ -28,11 +28,11 @@ import {
   recordedRemoteNodeRuntimeProbeCommand,
   REMOTE_NODE_RUNTIME_HASHED_STAT_FILENAME
 } from './orcad-remote-node-runtime-recorded-probe'
-import { execCommand } from '../../ssh/remote-exec-command'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
diff --git a/src/main/managed-server/install/orcad-remote-node-runtime-slow-hash.test.ts b/src/main/managed-server/install/orcad-remote-node-runtime-slow-hash.test.ts
index 19a97fcda20..132de1faee2 100644
--- a/src/main/managed-server/install/orcad-remote-node-runtime-slow-hash.test.ts
+++ b/src/main/managed-server/install/orcad-remote-node-runtime-slow-hash.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -16,11 +16,11 @@ import {
   REMOTE_NODE_RUNTIME_VERIFIED_MARKER
 } from '../../ssh/orcad-remote-node-runtime-report'
 import { RUNTIME_STORE_LOCK_NAME, withRuntimeStoreLock } from './remote-node-runtime-store-lock'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { uploadRelayDirectory } from './remote-install-transfers'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
diff --git a/src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts b/src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts
index 2ececda46fc..afa80f46cfb 100644
--- a/src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts
+++ b/src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts
@@ -1,9 +1,9 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import path from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { NODE_RUNTIME_ASSETS, NODE_RUNTIME_PIN } from '../../../shared/node-runtime-pin'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { uploadRelayDirectory } from './remote-install-transfers'
 import {
   ensureRemoteOrcadNodeRuntime,
@@ -25,7 +25,7 @@ import {
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import { decodeRemotePowerShellScript } from '../../ssh/ssh-remote-powershell'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
diff --git a/src/main/managed-server/install/orcad-remote-node-runtime.ts b/src/main/managed-server/install/orcad-remote-node-runtime.ts
index 62cebf3276d..b06cbf5a818 100644
--- a/src/main/managed-server/install/orcad-remote-node-runtime.ts
+++ b/src/main/managed-server/install/orcad-remote-node-runtime.ts
@@ -24,7 +24,10 @@ import {
 } from '../../../shared/orcad-artifacts'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import {
+  execCommand,
+  isUnconfirmedSshCommandTermination
+} from '../../ssh/remote-exec/remote-exec-command'
 import { uploadRelayDirectory } from './remote-install-transfers'
 import {
   isWindowsRemoteHost,
diff --git a/src/main/managed-server/install/orcad-remote-preflight.ts b/src/main/managed-server/install/orcad-remote-preflight.ts
index 9be9ffa4d48..2386779569c 100644
--- a/src/main/managed-server/install/orcad-remote-preflight.ts
+++ b/src/main/managed-server/install/orcad-remote-preflight.ts
@@ -15,7 +15,7 @@ import {
 import { readWindowsOrcadSlotEntry } from './orcad-remote-launch-windows'
 import { ORCAD_WINDOWS_RUNTIME_MARKER } from '../host-state/orcad-windows-host-script'
 import { orcadNodeSlotRuntimeCommand, selectOrcadSlotEntryCommand } from './orcad-remote-runtime'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
 import {
   isWindowsRemoteHost,
diff --git a/src/main/managed-server/install/orcad-remote-primitives.test.ts b/src/main/managed-server/install/orcad-remote-primitives.test.ts
index 4ff84ffd914..071534b41f3 100644
--- a/src/main/managed-server/install/orcad-remote-primitives.test.ts
+++ b/src/main/managed-server/install/orcad-remote-primitives.test.ts
@@ -1,7 +1,7 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn(),
   isUnconfirmedSshCommandTermination: (error: unknown) =>
@@ -13,7 +13,7 @@ vi.mock('../host-state/orcad-windows-host-preparation', () => ({
   prepareWindowsOrcadHost: vi.fn()
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { detectRemoteHostPlatform } from '../../ssh/ssh-remote-platform-detection'
 import { prepareWindowsOrcadHost } from '../host-state/orcad-windows-host-preparation'
 import { resolveOrcadRemoteContext } from './orcad-remote-context'
diff --git a/src/main/managed-server/install/orcad-remote-record-file.ts b/src/main/managed-server/install/orcad-remote-record-file.ts
index fca3bdd6626..35c61db4924 100644
--- a/src/main/managed-server/install/orcad-remote-record-file.ts
+++ b/src/main/managed-server/install/orcad-remote-record-file.ts
@@ -8,7 +8,7 @@ import { randomUUID } from 'node:crypto'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
 import { removeRemoteFileCommand } from '../../ssh/ssh-remote-commands'
 import { execOrcadRemote, type OrcadRemoteExecTarget } from './orcad-remote-runtime-control'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import { isWindowsRemoteHost } from '../../ssh/ssh-remote-platform'
 import {
   orcadRemoteBaseDir,
diff --git a/src/main/managed-server/install/orcad-remote-rollback.test.ts b/src/main/managed-server/install/orcad-remote-rollback.test.ts
index 071de4d2cef..19a5fbd4a1d 100644
--- a/src/main/managed-server/install/orcad-remote-rollback.test.ts
+++ b/src/main/managed-server/install/orcad-remote-rollback.test.ts
@@ -1,10 +1,10 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RecordFile from './orcad-remote-record-file'
 import type * as InstallLock from './remote-install-lock'
 import type * as TerminalBarrier from '../lifecycle/orcad-rollback-terminal-barrier'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -52,7 +52,7 @@ vi.mock('../lifecycle/orcad-rollback-terminal-barrier', async (importOriginal) =
   }
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { writeAtomicOrcadRemoteRecord } from './orcad-remote-record-file'
 import { rollbackOrcad, type OrcadRollbackOptions } from './orcad-remote-rollback'
 import {
diff --git a/src/main/managed-server/install/orcad-remote-runtime-control.test.ts b/src/main/managed-server/install/orcad-remote-runtime-control.test.ts
index e288f917e54..69623e1d6e3 100644
--- a/src/main/managed-server/install/orcad-remote-runtime-control.test.ts
+++ b/src/main/managed-server/install/orcad-remote-runtime-control.test.ts
@@ -1,14 +1,14 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn(),
   isUnconfirmedSshCommandTermination: (error: unknown) =>
     error instanceof Error && error.message === 'unconfirmed'
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { launchOrcadAndAwaitReadiness } from './orcad-remote-runtime-control'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import type { OrcadLaunchSpec } from './orcad-remote-launch'
diff --git a/src/main/managed-server/install/orcad-remote-runtime-control.ts b/src/main/managed-server/install/orcad-remote-runtime-control.ts
index 14a0ad1250d..3435312090d 100644
--- a/src/main/managed-server/install/orcad-remote-runtime-control.ts
+++ b/src/main/managed-server/install/orcad-remote-runtime-control.ts
@@ -20,7 +20,10 @@ import {
 } from './orcad-remote-readiness-wait'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 import { errorMessage } from '../../../shared/error-message'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import {
+  execCommand,
+  isUnconfirmedSshCommandTermination
+} from '../../ssh/remote-exec/remote-exec-command'
 import {
   currentOrcadFence,
   isOrcadFenceLost,
diff --git a/src/main/managed-server/install/orcad-remote-windows-commands.test.ts b/src/main/managed-server/install/orcad-remote-windows-commands.test.ts
index 6b2508303ce..fe705520f0d 100644
--- a/src/main/managed-server/install/orcad-remote-windows-commands.test.ts
+++ b/src/main/managed-server/install/orcad-remote-windows-commands.test.ts
@@ -1,12 +1,12 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import { orcadLivenessProbeCommand, type OrcadLaunchSpec } from './orcad-remote-launch'
diff --git a/src/main/managed-server/install/orcad-remote-windows-decommission.test.ts b/src/main/managed-server/install/orcad-remote-windows-decommission.test.ts
index 75ed326fd34..de2ec5635b3 100644
--- a/src/main/managed-server/install/orcad-remote-windows-decommission.test.ts
+++ b/src/main/managed-server/install/orcad-remote-windows-decommission.test.ts
@@ -3,12 +3,12 @@
  * a staged managed request run by the slot's node.exe, and GC screens every candidate in one
  * node.exe instead of one per version dir.
  */
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RecordFile from './orcad-remote-record-file'
 import type * as InstallLock from './remote-install-lock'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -25,7 +25,7 @@ vi.mock('./remote-install-gc', async (importOriginal) => ({
   gcOldRemoteInstallVersions: vi.fn().mockResolvedValue(undefined)
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { writeAtomicOrcadRemoteRecord } from './orcad-remote-record-file'
 import { gcOldRemoteInstallVersions } from './remote-install-gc'
 import { decommissionRemoteOrcad } from './orcad-remote-decommission'
diff --git a/src/main/managed-server/install/orcad-remote-windows-node.ts b/src/main/managed-server/install/orcad-remote-windows-node.ts
index 5451b82be6f..fc6c8d837b6 100644
--- a/src/main/managed-server/install/orcad-remote-windows-node.ts
+++ b/src/main/managed-server/install/orcad-remote-windows-node.ts
@@ -19,8 +19,11 @@ import {
 import { pinnedNodeRuntimeAsset, type NodeRuntimeTarget } from '../../../shared/node-runtime-pin'
 import { randomUUID } from 'node:crypto'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import {
+  execCommand,
+  isUnconfirmedSshCommandTermination
+} from '../../ssh/remote-exec/remote-exec-command'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import {
   joinRemotePath,
   remoteDirname,
diff --git a/src/main/managed-server/install/remote-install-gc-claim-termination.test.ts b/src/main/managed-server/install/remote-install-gc-claim-termination.test.ts
index 0aed0bccfff..360c3cae0a0 100644
--- a/src/main/managed-server/install/remote-install-gc-claim-termination.test.ts
+++ b/src/main/managed-server/install/remote-install-gc-claim-termination.test.ts
@@ -1,13 +1,13 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
 
 import type { SshConnection } from '../../ssh/ssh-connection'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import {
   isRelayGcClaimOwned,
   releaseRelayGcClaim,
diff --git a/src/main/managed-server/install/remote-install-gc-claim.ts b/src/main/managed-server/install/remote-install-gc-claim.ts
index 1199022abb4..d51bcd71a5e 100644
--- a/src/main/managed-server/install/remote-install-gc-claim.ts
+++ b/src/main/managed-server/install/remote-install-gc-claim.ts
@@ -1,8 +1,8 @@
 import { randomUUID } from 'node:crypto'
 import type { RemoteInstallTransport } from './remote-install-transport'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { execHostCommand } from '../../ssh/remote-host-exec'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { execHostCommand } from '../../ssh/remote-exec/remote-host-exec'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import {
   probeInstallLockExistsCommand,
   tryCreateInstallLockCommand,
diff --git a/src/main/managed-server/install/remote-install-gc-listing.test-fixture.ts b/src/main/managed-server/install/remote-install-gc-listing.test-fixture.ts
index 3be335b0219..e5b4c070463 100644
--- a/src/main/managed-server/install/remote-install-gc-listing.test-fixture.ts
+++ b/src/main/managed-server/install/remote-install-gc-listing.test-fixture.ts
@@ -7,7 +7,7 @@ import type { ClientChannel } from 'ssh2'
 import { runProcess, spawnProcess } from '@orca/process-host'
 import type { SshConnection } from '../../ssh/ssh-connection'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 
 export const SSH_EXEC_OUTPUT_CAP_CHARS = 1024 * 1024
 
diff --git a/src/main/managed-server/install/remote-install-gc-termination.test.ts b/src/main/managed-server/install/remote-install-gc-termination.test.ts
index 2f7d762b7ac..d4e8fca9eca 100644
--- a/src/main/managed-server/install/remote-install-gc-termination.test.ts
+++ b/src/main/managed-server/install/remote-install-gc-termination.test.ts
@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -9,7 +9,7 @@ vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
 import type { SshConnection } from '../../ssh/ssh-connection'
 import { gcOldRemoteInstallVersions } from './remote-install-gc'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: all connection access is replaced by execCommand's mock.
diff --git a/src/main/managed-server/install/remote-install-gc-tombstone.ts b/src/main/managed-server/install/remote-install-gc-tombstone.ts
index ee85cadc04a..0723209099c 100644
--- a/src/main/managed-server/install/remote-install-gc-tombstone.ts
+++ b/src/main/managed-server/install/remote-install-gc-tombstone.ts
@@ -1,5 +1,8 @@
 import type { RemoteInstallTransport } from './remote-install-transport'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import {
+  execCommand,
+  isUnconfirmedSshCommandTermination
+} from '../../ssh/remote-exec/remote-exec-command'
 import { remoteInstallGcTombstoneRegex, type RemoteInstallModel } from './remote-install-model'
 import { removeRemoteTreeCommand } from '../../ssh/ssh-remote-commands'
 import {
diff --git a/src/main/managed-server/install/remote-install-gc.ts b/src/main/managed-server/install/remote-install-gc.ts
index e82b276ba5a..68e7bef5bba 100644
--- a/src/main/managed-server/install/remote-install-gc.ts
+++ b/src/main/managed-server/install/remote-install-gc.ts
@@ -6,8 +6,8 @@
  * until the relay-era upgrade window closes.
  */
 import type { RemoteInstallTransport } from './remote-install-transport'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
-import { execHostCommand } from '../../ssh/remote-host-exec'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
+import { execHostCommand } from '../../ssh/remote-exec/remote-host-exec'
 import { probeInstallLockExistsCommand } from './remote-install-lock-commands'
 import { isRelayInstallLockStale, RELAY_INSTALL_LOCK_NAME } from './remote-install-lock'
 import {
@@ -34,7 +34,7 @@ import {
   remoteBasename,
   type RemoteHostPlatform
 } from '../../ssh/ssh-remote-platform'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 
 const DEFAULT_REMOTE_HOST = getRemoteHostPlatform('linux-x64')
 
diff --git a/src/main/managed-server/install/remote-install-lock-termination.test.ts b/src/main/managed-server/install/remote-install-lock-termination.test.ts
index 9c36a5a67db..5b090d53c83 100644
--- a/src/main/managed-server/install/remote-install-lock-termination.test.ts
+++ b/src/main/managed-server/install/remote-install-lock-termination.test.ts
@@ -1,13 +1,13 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
 
 import type { SshConnection } from '../../ssh/ssh-connection'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock, isRelayInstallLockStale } from './remote-install-lock'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
diff --git a/src/main/managed-server/install/remote-install-lock.test.ts b/src/main/managed-server/install/remote-install-lock.test.ts
index f0e977714b0..69bad2258e4 100644
--- a/src/main/managed-server/install/remote-install-lock.test.ts
+++ b/src/main/managed-server/install/remote-install-lock.test.ts
@@ -1,8 +1,8 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { SshConnection } from '../../ssh/ssh-connection'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn(),
   isUnconfirmedSshCommandTermination: (error: unknown) =>
@@ -15,7 +15,7 @@ vi.mock('./remote-install-gc-claim', () => ({
   waitForRelayGcClaimRelease: vi.fn().mockResolvedValue(undefined)
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock, RemoteInstallLockBusyError } from './remote-install-lock'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
diff --git a/src/main/managed-server/install/remote-install-lock.ts b/src/main/managed-server/install/remote-install-lock.ts
index 99919c6b521..f70258d2b78 100644
--- a/src/main/managed-server/install/remote-install-lock.ts
+++ b/src/main/managed-server/install/remote-install-lock.ts
@@ -1,7 +1,7 @@
 import type { RemoteInstallTransport } from './remote-install-transport'
-import { execHostCommand } from '../../ssh/remote-host-exec'
+import { execHostCommand } from '../../ssh/remote-exec/remote-host-exec'
 import { RELAY_DEPLOY_TIMEOUT_MS } from './remote-deploy-timing'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import { isRelayGcClaimed, waitForRelayGcClaimRelease } from './remote-install-gc-claim'
 import {
   acquireInstallLockParentCommand,
diff --git a/src/main/managed-server/install/remote-install-transfers.ts b/src/main/managed-server/install/remote-install-transfers.ts
index 4c1db614321..b03a1b691bb 100644
--- a/src/main/managed-server/install/remote-install-transfers.ts
+++ b/src/main/managed-server/install/remote-install-transfers.ts
@@ -8,7 +8,7 @@ import {
   uploadDirectoryViaExecStdin,
   writeStringViaExecStdin
 } from '../../ssh/ssh-exec-stdin-file-transfer'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import {
   describeSandboxedSftpFailure,
   isSandboxedSftpNamespaceError
diff --git a/src/main/managed-server/install/remote-node-runtime-store-gc.test.ts b/src/main/managed-server/install/remote-node-runtime-store-gc.test.ts
index 15836a505f5..75151b5e56c 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-gc.test.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-gc.test.ts
@@ -13,9 +13,9 @@ import { once } from 'node:events'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -34,7 +34,7 @@ import {
   runtimeStoreInventoryCommand,
   type RuntimeStoreInventory
 } from './remote-node-runtime-store-inventory'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: all connection access is replaced by execCommand's mock.
diff --git a/src/main/managed-server/install/remote-node-runtime-store-gc.ts b/src/main/managed-server/install/remote-node-runtime-store-gc.ts
index 5dea21421d9..f1725ffb30a 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-gc.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-gc.ts
@@ -28,7 +28,10 @@ import {
   tryWithRuntimeStoreLock
 } from './remote-node-runtime-store-lock'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import {
+  execCommand,
+  isUnconfirmedSshCommandTermination
+} from '../../ssh/remote-exec/remote-exec-command'
 import { INSTALL_LOCK_STALE_MS } from './remote-install-lock'
 import {
   moveRemoteTreeCommand,
diff --git a/src/main/managed-server/install/remote-node-runtime-store-inventory.ts b/src/main/managed-server/install/remote-node-runtime-store-inventory.ts
index c98d21acdf0..c3c0ad47688 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-inventory.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-inventory.ts
@@ -8,7 +8,7 @@ import {
   ORCAD_RUNTIMES_DIRNAME
 } from '../../../shared/orcad-artifacts'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import { joinRemotePath, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 /** A version dir names a runtime it needs with an empty file of this prefix + sha (design D5). */
diff --git a/src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts b/src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts
index 724f1444003..db6b24c1154 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-lock-host-release.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -10,11 +10,11 @@ import {
   RUNTIME_STORE_LOCK_OWNER_FILENAME,
   withRuntimeStoreLock
 } from './remote-node-runtime-store-lock'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { tryCreateInstallLockCommand } from './remote-install-lock-commands'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
diff --git a/src/main/managed-server/install/remote-node-runtime-store-lock.ts b/src/main/managed-server/install/remote-node-runtime-store-lock.ts
index f51ae6359ae..81beda6dc43 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-lock.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-lock.ts
@@ -7,15 +7,15 @@ import { randomUUID } from 'node:crypto'
 import { ORCAD_RUNTIMES_DIRNAME } from '../../../shared/orcad-artifacts'
 import type { RemoteInstallTransport } from './remote-install-transport'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { execHostCommand } from '../../ssh/remote-host-exec'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { execHostCommand } from '../../ssh/remote-exec/remote-host-exec'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock, INSTALL_LOCK_STALE_SECONDS } from './remote-install-lock'
 import {
   tryCreateInstallLockCommand,
   tryStealInstallLockCommand,
   type InstallLockOwnerFile
 } from './remote-install-lock-commands'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import { removeRemoteTreeCommand } from '../../ssh/ssh-remote-commands'
 import {
   isWindowsRemoteHost,
diff --git a/src/main/managed-server/install/remote-node-runtime-store-windows.test.ts b/src/main/managed-server/install/remote-node-runtime-store-windows.test.ts
index 91c8a8b992d..a289137657b 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-windows.test.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-windows.test.ts
@@ -3,9 +3,9 @@ import { copyFileSync, mkdirSync, mkdtempSync, utimesSync, writeFileSync } from
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -18,7 +18,7 @@ import {
   windowsRuntimeStoreInventoryCommand,
   windowsSweepStaleRuntimeStagesCommand
 } from './remote-node-runtime-store-windows'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import { decodeRemotePowerShellScript } from '../../ssh/ssh-remote-powershell'
 import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
diff --git a/src/main/managed-server/install/remote-node-runtime-store-windows.ts b/src/main/managed-server/install/remote-node-runtime-store-windows.ts
index 42428f5342f..3dbd48cd898 100644
--- a/src/main/managed-server/install/remote-node-runtime-store-windows.ts
+++ b/src/main/managed-server/install/remote-node-runtime-store-windows.ts
@@ -22,7 +22,7 @@ import {
   RUNTIME_STORE_TOMBSTONE_PREFIX,
   runtimeStoreInventoryCommand
 } from './remote-node-runtime-store-inventory'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import {
   isWindowsRemoteHost,
   joinRemotePath,
diff --git a/src/main/managed-server/install/remote-versioned-install-termination.test.ts b/src/main/managed-server/install/remote-versioned-install-termination.test.ts
index e602a752e42..9b22a3fb098 100644
--- a/src/main/managed-server/install/remote-versioned-install-termination.test.ts
+++ b/src/main/managed-server/install/remote-versioned-install-termination.test.ts
@@ -1,14 +1,14 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
 
 import type { SshConnection } from '../../ssh/ssh-connection'
 import { REMOTE_INSTALL_MODELS } from './remote-install-model'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import {
   abandonInstall,
   finalizeInstall,
diff --git a/src/main/managed-server/install/remote-versioned-install.test.ts b/src/main/managed-server/install/remote-versioned-install.test.ts
index eb977dfa72a..0fff3cda234 100644
--- a/src/main/managed-server/install/remote-versioned-install.test.ts
+++ b/src/main/managed-server/install/remote-versioned-install.test.ts
@@ -1,12 +1,12 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 
 vi.mock('fs', () => ({
   existsSync: vi.fn(),
   readFileSync: vi.fn()
 }))
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -24,7 +24,10 @@ import {
 } from './remote-versioned-install'
 import { gcOldRemoteInstallVersions } from './remote-install-gc'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
-import { isUnconfirmedSshCommandTermination, execCommand } from '../../ssh/remote-exec-command'
+import {
+  isUnconfirmedSshCommandTermination,
+  execCommand
+} from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock } from './remote-install-lock'
 import {
   isRelayGcClaimed,
diff --git a/src/main/managed-server/install/remote-versioned-install.ts b/src/main/managed-server/install/remote-versioned-install.ts
index 7a69c6f22cb..b4a8dd594fb 100644
--- a/src/main/managed-server/install/remote-versioned-install.ts
+++ b/src/main/managed-server/install/remote-versioned-install.ts
@@ -5,10 +5,10 @@
 import { join } from 'node:path'
 import { existsSync, readFileSync } from 'node:fs'
 import type { RemoteInstallTransport } from './remote-install-transport'
-import { execHostCommand } from '../../ssh/remote-host-exec'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { execHostCommand } from '../../ssh/remote-exec/remote-host-exec'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import { RELAY_INSTALL_LOCK_NAME } from './remote-install-lock'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import { remoteInstallDirName, type RemoteInstallModel } from './remote-install-model'
 import {
   probeRemoteInstallCompleteCommand,
diff --git a/src/main/managed-server/lifecycle/orcad-decommission-stop.ts b/src/main/managed-server/lifecycle/orcad-decommission-stop.ts
index 2d482f6c87f..644fb6124e8 100644
--- a/src/main/managed-server/lifecycle/orcad-decommission-stop.ts
+++ b/src/main/managed-server/lifecycle/orcad-decommission-stop.ts
@@ -5,7 +5,7 @@
  * lost answer is `unverifiable`, never exit; cancelling is how a stop that did not finish is
  * withdrawn, and only an orcad-confirmed cancellation lets the fence go.
  */
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import {
   cancelRemoteOrcadManagedStop,
   completeRemoteOrcadManagedStop
diff --git a/src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts b/src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts
index f85f406f746..70d58af0952 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts
@@ -16,7 +16,7 @@ import { execOrcadRemote } from '../install/orcad-remote-runtime-control'
 import { readBoundedOrcadRemoteRecord } from '../install/orcad-remote-record-file'
 import { orcadSlotDir, type OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
 import { isWindowsRemoteHost, joinRemotePath } from '../../ssh/ssh-remote-platform'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import {
   orcadWindowsNodeCommandLine,
   orcadWindowsSlotOpCommand,
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts
index d00c8d4a298..50135d4a903 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts
@@ -1,12 +1,12 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshConnection } from '../../ssh/ssh-connection'
 import type { PortForwardStartOptions } from '../../ssh/port-forwarding/ssh-port-forward-provider'
-import type * as ForwardProcess from '../../ssh/system-ssh-forward-process'
+import type * as ForwardProcess from '../../ssh/system-transport/system-ssh-forward-process'
 
 const { reserveLocalForwardPort } = vi.hoisted(() => ({
   reserveLocalForwardPort: vi.fn(async (port: number, _orphanArgs?: readonly string[]) => port)
 }))
-vi.mock('../../ssh/system-ssh-forward-process', async (importOriginal) => ({
+vi.mock('../../ssh/system-transport/system-ssh-forward-process', async (importOriginal) => ({
   ...(await importOriginal<typeof ForwardProcess>()),
   reserveLocalForwardPort
 }))
diff --git a/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts b/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts
index 833f5204bda..fa7d15d2f2d 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts
@@ -23,7 +23,7 @@ import {
 import {
   buildSystemSshPortForwardArgs,
   reserveLocalForwardPort
-} from '../../ssh/system-ssh-forward-process'
+} from '../../ssh/system-transport/system-ssh-forward-process'
 
 type OrcadManagedTunnelTransportDependencies = {
   forwards: SshPortForwardProvider[]
diff --git a/src/main/managed-server/lifecycle/orcad-managed-wake.test.ts b/src/main/managed-server/lifecycle/orcad-managed-wake.test.ts
index 43035d1c8bc..6854a5dfea5 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-wake.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-wake.test.ts
@@ -1,8 +1,8 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import type * as InstallLock from '../install/remote-install-lock'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -12,7 +12,7 @@ vi.mock('../install/remote-install-lock', async (importOriginal) => ({
   acquireInstallLock: vi.fn()
 }))
 
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { acquireInstallLock, RemoteInstallLockBusyError } from '../install/remote-install-lock'
 import { wakeStoppedManagedOrcad } from './orcad-managed-wake'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
diff --git a/src/main/managed-server/lifecycle/orcad-rollback-transition.ts b/src/main/managed-server/lifecycle/orcad-rollback-transition.ts
index e0961fd9cce..0a33e31152b 100644
--- a/src/main/managed-server/lifecycle/orcad-rollback-transition.ts
+++ b/src/main/managed-server/lifecycle/orcad-rollback-transition.ts
@@ -2,7 +2,7 @@
 import { orcadRemoteBaseDir } from '../install/orcad-remote-windows-node'
 import { randomUUID } from 'node:crypto'
 import type { OrcadRollbackOptions, OrcadRollbackResult } from '../install/orcad-remote-rollback'
-import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec/remote-exec-command'
 import { withRolledBackVersion } from '../activation/orcad-activation-record'
 import { writeOrcadActivationRecord } from '../activation/orcad-activation-record-store'
 import { launchAndJudgeOrcadSlot } from '../../ssh/orcad-candidate-launch-verdict'
diff --git a/src/main/managed-server/lifecycle/orcad-runtime-target.test.ts b/src/main/managed-server/lifecycle/orcad-runtime-target.test.ts
index e95579e78e8..780e936f4ae 100644
--- a/src/main/managed-server/lifecycle/orcad-runtime-target.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-runtime-target.test.ts
@@ -1,12 +1,12 @@
-import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { resolveOrcadRuntimeTarget } from './orcad-runtime-target'
 import { SshConnection } from '../../ssh/ssh-connection'
 import { createCallbacks, createTarget } from '../../ssh/ssh-connection-test-fixtures'
-import { execCommand } from '../../ssh/remote-exec-command'
+import { execCommand } from '../../ssh/remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
-vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
diff --git a/src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts b/src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts
index 9c8ceb28a80..5e6baa259a3 100644
--- a/src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts
+++ b/src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts
@@ -14,7 +14,7 @@ import {
   ORCAD_RUNTIMES_DIRNAME
 } from '../../../shared/orcad-artifacts'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-exec/remote-frame-protocol'
 import { ORCAD_MACHINE_HOMES_DIRNAME } from '../host-state/orcad-machine-home'
 
 export type OrcadStdioBridgeMode = 'raw' | 'base64'
diff --git a/src/main/orca-profiles/profile-active-transfer-worker.test.ts b/src/main/orca-profiles/profile-active-transfer-worker.test.ts
index 2e19eaf73f0..fef3884a54c 100644
--- a/src/main/orca-profiles/profile-active-transfer-worker.test.ts
+++ b/src/main/orca-profiles/profile-active-transfer-worker.test.ts
@@ -18,7 +18,7 @@ vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/orca-profiles/profile-active-transfer.test.ts b/src/main/orca-profiles/profile-active-transfer.test.ts
index 0cfd80d7eef..c1b1328a3ff 100644
--- a/src/main/orca-profiles/profile-active-transfer.test.ts
+++ b/src/main/orca-profiles/profile-active-transfer.test.ts
@@ -30,7 +30,7 @@ vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
 }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
   sshConfigHostsToTargets: vi.fn(() => [])
 }))
diff --git a/src/main/orcad/orcad-cross-runtime-daemon-adoption.integration.test.ts b/src/main/orcad/orcad-cross-runtime-daemon-adoption.integration.test.ts
index 8ff8858a1cf..afdb5efc29c 100644
--- a/src/main/orcad/orcad-cross-runtime-daemon-adoption.integration.test.ts
+++ b/src/main/orcad/orcad-cross-runtime-daemon-adoption.integration.test.ts
@@ -4,7 +4,7 @@
  * are installed side by side as `~/.orca-remote/orcad-<version>/`, launched and stopped with
  * the client's own deploy commands, and share one data root.
  */
-import type * as ExecCommandModule from '../ssh/remote-exec-command'
+import type * as ExecCommandModule from '../ssh/remote-exec/remote-exec-command'
 import { build } from 'esbuild'
 import {
   copyFileSync,
@@ -58,7 +58,7 @@ import {
   parseOrcadStopOutcome,
   stopOrcadCommand
 } from '../managed-server/install/orcad-remote-process-control'
-import { RELAY_REMOTE_DIR } from '../ssh/remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../ssh/remote-exec/remote-frame-protocol'
 import { getRemoteHostPlatform } from '../ssh/ssh-remote-platform'
 import {
   skipForMissingInputs,
@@ -68,7 +68,7 @@ import {
 
 // GC runs its real commands, against this machine instead of an SSH host.
 const { execMock } = vi.hoisted(() => ({ execMock: vi.fn() }))
-vi.mock('../ssh/remote-exec-command', async (importOriginal) => ({
+vi.mock('../ssh/remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: execMock
 }))
diff --git a/src/main/persistence-async-write-syscalls.test.ts b/src/main/persistence-async-write-syscalls.test.ts
index e70218edb7f..eea5515762f 100644
--- a/src/main/persistence-async-write-syscalls.test.ts
+++ b/src/main/persistence-async-write-syscalls.test.ts
@@ -64,7 +64,7 @@ vi.mock('node:fs/promises', async (importOriginal) => {
 })
 vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: () => ({ nth_repo_added: 2 }) }))
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence-automation-extra-agent-args.test.ts b/src/main/persistence-automation-extra-agent-args.test.ts
index c64fc3ec9b0..19b37453161 100644
--- a/src/main/persistence-automation-extra-agent-args.test.ts
+++ b/src/main/persistence-automation-extra-agent-args.test.ts
@@ -10,7 +10,7 @@ import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-automations.test.ts b/src/main/persistence-automations.test.ts
index fcd61b77ec3..7b9b985159a 100644
--- a/src/main/persistence-automations.test.ts
+++ b/src/main/persistence-automations.test.ts
@@ -19,7 +19,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-clipboard-selection-migration.test.ts b/src/main/persistence-clipboard-selection-migration.test.ts
index 552aa10b6f7..8bdd5d190e0 100644
--- a/src/main/persistence-clipboard-selection-migration.test.ts
+++ b/src/main/persistence-clipboard-selection-migration.test.ts
@@ -17,7 +17,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-cohort-and-identity-migration.test.ts b/src/main/persistence-cohort-and-identity-migration.test.ts
index 02afa7e3da5..ca40d13e34f 100644
--- a/src/main/persistence-cohort-and-identity-migration.test.ts
+++ b/src/main/persistence-cohort-and-identity-migration.test.ts
@@ -24,7 +24,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-deregistered-repo-residue.test.ts b/src/main/persistence-deregistered-repo-residue.test.ts
index b519b04cad8..e2d74ffa42d 100644
--- a/src/main/persistence-deregistered-repo-residue.test.ts
+++ b/src/main/persistence-deregistered-repo-residue.test.ts
@@ -18,7 +18,7 @@ import { composeWorktreeHostIdentity } from '../shared/worktree/host-qualified-i
 import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 import type { PersistedState } from '../shared/persisted-state-types'
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-floating-terminal-trust.test.ts b/src/main/persistence-floating-terminal-trust.test.ts
index 49ea6457e6d..b4fefc2b392 100644
--- a/src/main/persistence-floating-terminal-trust.test.ts
+++ b/src/main/persistence-floating-terminal-trust.test.ts
@@ -18,7 +18,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-flush-and-save-scheduling.test.ts b/src/main/persistence-flush-and-save-scheduling.test.ts
index dbe4ce8262f..782459df025 100644
--- a/src/main/persistence-flush-and-save-scheduling.test.ts
+++ b/src/main/persistence-flush-and-save-scheduling.test.ts
@@ -29,7 +29,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-folder-scan-project-groups.test.ts b/src/main/persistence-folder-scan-project-groups.test.ts
index d217c39529a..55cc9b088e9 100644
--- a/src/main/persistence-folder-scan-project-groups.test.ts
+++ b/src/main/persistence-folder-scan-project-groups.test.ts
@@ -29,7 +29,7 @@ vi.mock('electron', () => ({
   }
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
   sshConfigHostsToTargets: vi.fn(() => [])
 }))
diff --git a/src/main/persistence-folder-workspace-notes.test.ts b/src/main/persistence-folder-workspace-notes.test.ts
index 43abe5b7412..0031a6a571c 100644
--- a/src/main/persistence-folder-workspace-notes.test.ts
+++ b/src/main/persistence-folder-workspace-notes.test.ts
@@ -19,7 +19,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-host-partitioned-sessions.test.ts b/src/main/persistence-host-partitioned-sessions.test.ts
index 1314d8e2ff5..887a20a2a37 100644
--- a/src/main/persistence-host-partitioned-sessions.test.ts
+++ b/src/main/persistence-host-partitioned-sessions.test.ts
@@ -26,7 +26,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-initial-load.test.ts b/src/main/persistence-initial-load.test.ts
index a539d5efa19..ee663d302a2 100644
--- a/src/main/persistence-initial-load.test.ts
+++ b/src/main/persistence-initial-load.test.ts
@@ -32,7 +32,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-invalid-workspace-layout-purge.test.ts b/src/main/persistence-invalid-workspace-layout-purge.test.ts
index 9912753499a..84403e35113 100644
--- a/src/main/persistence-invalid-workspace-layout-purge.test.ts
+++ b/src/main/persistence-invalid-workspace-layout-purge.test.ts
@@ -24,7 +24,7 @@ import { WorkspaceLayoutStream } from './runtime/workspace-layout-stream'
 import { windowViewSaveForMain } from './persistence/window-save-view'
 
 vi.mock('../shared/layout-owner-switch', () => ({ ORCA_LAYOUT_OWNER_IS_MAIN: true }))
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-layout-binding-recovery.test.ts b/src/main/persistence-layout-binding-recovery.test.ts
index ef903b820bd..261da79955b 100644
--- a/src/main/persistence-layout-binding-recovery.test.ts
+++ b/src/main/persistence-layout-binding-recovery.test.ts
@@ -24,7 +24,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-load-repair-durability.test.ts b/src/main/persistence-load-repair-durability.test.ts
index 5cb2bbe8f4f..5b8ad603337 100644
--- a/src/main/persistence-load-repair-durability.test.ts
+++ b/src/main/persistence-load-repair-durability.test.ts
@@ -23,7 +23,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-loading-store-extraction.test.ts b/src/main/persistence-loading-store-extraction.test.ts
index 3acec0d56a4..8a07ccf6084 100644
--- a/src/main/persistence-loading-store-extraction.test.ts
+++ b/src/main/persistence-loading-store-extraction.test.ts
@@ -48,7 +48,7 @@ vi.mock('electron', () => ({
 
 vi.mock('./telemetry/client', () => ({ track: trackMock }))
 vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: getCohortAtEmitMock }))
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
   sshConfigHostsToTargets: vi.fn(() => [])
 }))
diff --git a/src/main/persistence-loading-store-write-risks.test.ts b/src/main/persistence-loading-store-write-risks.test.ts
index 11b463c631d..4ad78d87c5b 100644
--- a/src/main/persistence-loading-store-write-risks.test.ts
+++ b/src/main/persistence-loading-store-write-risks.test.ts
@@ -4,7 +4,7 @@ import {
   maintenanceBarrier
 } from './persistence/loading-store/profile-state-maintenance-fixture'
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-native-chat-tab-view-mode.test.ts b/src/main/persistence-native-chat-tab-view-mode.test.ts
index 96de2f21f67..04b5774fb58 100644
--- a/src/main/persistence-native-chat-tab-view-mode.test.ts
+++ b/src/main/persistence-native-chat-tab-view-mode.test.ts
@@ -16,7 +16,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-pane-identity-migration.test.ts b/src/main/persistence-pane-identity-migration.test.ts
index c39a93636a3..882cd8fa2e8 100644
--- a/src/main/persistence-pane-identity-migration.test.ts
+++ b/src/main/persistence-pane-identity-migration.test.ts
@@ -25,7 +25,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-protected-secret-fail-closed.test.ts b/src/main/persistence-protected-secret-fail-closed.test.ts
index 2fd8404a3af..01117d76348 100644
--- a/src/main/persistence-protected-secret-fail-closed.test.ts
+++ b/src/main/persistence-protected-secret-fail-closed.test.ts
@@ -19,7 +19,7 @@ const cipherState = {
   decryptionThrows: false
 }
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-protected-secret-write-race.test.ts b/src/main/persistence-protected-secret-write-race.test.ts
index 8388a3ba1de..d352ad11114 100644
--- a/src/main/persistence-protected-secret-write-race.test.ts
+++ b/src/main/persistence-protected-secret-write-race.test.ts
@@ -6,7 +6,7 @@ import {
 } from './persistence/loading-store/profile-state-maintenance-fixture'
 import { Store } from './persistence/loading-store/store'
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-proxy-secret-recovery.test.ts b/src/main/persistence-proxy-secret-recovery.test.ts
index 842aa015bac..2d9e949b209 100644
--- a/src/main/persistence-proxy-secret-recovery.test.ts
+++ b/src/main/persistence-proxy-secret-recovery.test.ts
@@ -19,7 +19,7 @@ import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-port
 
 const testState = { dir: '' }
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-pty-binding-reconciliation.test.ts b/src/main/persistence-pty-binding-reconciliation.test.ts
index c4fbf61f07b..364960a1c5a 100644
--- a/src/main/persistence-pty-binding-reconciliation.test.ts
+++ b/src/main/persistence-pty-binding-reconciliation.test.ts
@@ -19,7 +19,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-remote-session-startup.test.ts b/src/main/persistence-remote-session-startup.test.ts
index 0a27afc8d05..91328732cd3 100644
--- a/src/main/persistence-remote-session-startup.test.ts
+++ b/src/main/persistence-remote-session-startup.test.ts
@@ -6,7 +6,7 @@ import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
 import type { BrowserPage, BrowserWorkspace } from '../shared/browser-workspace-types'
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-repo-lifecycle.test.ts b/src/main/persistence-repo-lifecycle.test.ts
index e954cd05c20..4187db59eec 100644
--- a/src/main/persistence-repo-lifecycle.test.ts
+++ b/src/main/persistence-repo-lifecycle.test.ts
@@ -36,7 +36,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-settings-ui-defaults.test.ts b/src/main/persistence-settings-ui-defaults.test.ts
index 3e75cc7d021..ac4ab6ed104 100644
--- a/src/main/persistence-settings-ui-defaults.test.ts
+++ b/src/main/persistence-settings-ui-defaults.test.ts
@@ -21,7 +21,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-settings-update.test.ts b/src/main/persistence-settings-update.test.ts
index aced61e0ac4..b1978ed4ead 100644
--- a/src/main/persistence-settings-update.test.ts
+++ b/src/main/persistence-settings-update.test.ts
@@ -27,7 +27,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-single-serialize.test.ts b/src/main/persistence-single-serialize.test.ts
index 72967bc50ca..d5c36011c24 100644
--- a/src/main/persistence-single-serialize.test.ts
+++ b/src/main/persistence-single-serialize.test.ts
@@ -17,7 +17,7 @@ import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-port
 
 const testState = { dir: '' }
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-source-control-ai-migration.test.ts b/src/main/persistence-source-control-ai-migration.test.ts
index f3969da6ef0..f478c136ebf 100644
--- a/src/main/persistence-source-control-ai-migration.test.ts
+++ b/src/main/persistence-source-control-ai-migration.test.ts
@@ -21,7 +21,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-split-pane-incarnation.test.ts b/src/main/persistence-split-pane-incarnation.test.ts
index b628c28384b..9be1133cb66 100644
--- a/src/main/persistence-split-pane-incarnation.test.ts
+++ b/src/main/persistence-split-pane-incarnation.test.ts
@@ -21,7 +21,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-ssh-remote-cli-control-migration.test.ts b/src/main/persistence-ssh-remote-cli-control-migration.test.ts
index 02d6fbbabaf..fa9f75a443d 100644
--- a/src/main/persistence-ssh-remote-cli-control-migration.test.ts
+++ b/src/main/persistence-ssh-remote-cli-control-migration.test.ts
@@ -13,7 +13,7 @@ import type { SshTarget } from '../shared/ssh-types'
 import { isRemoteCliControlAllowed } from '../shared/ssh-remote-cli-control'
 import { SshConnectionStore } from './ssh/ssh-connection-store'
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/persistence-ssh-remote-pty-binding-replay.test.ts b/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
index 83608e1c9d2..0f94df1b178 100644
--- a/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
+++ b/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
@@ -18,7 +18,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-ssh-remote-pty-leases.test.ts b/src/main/persistence-ssh-remote-pty-leases.test.ts
index 32f419359a5..d74f55ca3e4 100644
--- a/src/main/persistence-ssh-remote-pty-leases.test.ts
+++ b/src/main/persistence-ssh-remote-pty-leases.test.ts
@@ -20,7 +20,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-ssh-targets-and-pane-keys.test.ts b/src/main/persistence-ssh-targets-and-pane-keys.test.ts
index 6cfb5332a8e..9b9d30bdff1 100644
--- a/src/main/persistence-ssh-targets-and-pane-keys.test.ts
+++ b/src/main/persistence-ssh-targets-and-pane-keys.test.ts
@@ -23,7 +23,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-terminal-option-key-migration.test.ts b/src/main/persistence-terminal-option-key-migration.test.ts
index 9d171178322..152808fb467 100644
--- a/src/main/persistence-terminal-option-key-migration.test.ts
+++ b/src/main/persistence-terminal-option-key-migration.test.ts
@@ -18,7 +18,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-ui-state.test.ts b/src/main/persistence-ui-state.test.ts
index 8320854cb24..436d5f42497 100644
--- a/src/main/persistence-ui-state.test.ts
+++ b/src/main/persistence-ui-state.test.ts
@@ -24,7 +24,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-update-repo.test.ts b/src/main/persistence-update-repo.test.ts
index cebcf5f6b14..fe8096bcb91 100644
--- a/src/main/persistence-update-repo.test.ts
+++ b/src/main/persistence-update-repo.test.ts
@@ -30,7 +30,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-workspace-session-scrollback.test.ts b/src/main/persistence-workspace-session-scrollback.test.ts
index 8afd69d70b0..873e82615bb 100644
--- a/src/main/persistence-workspace-session-scrollback.test.ts
+++ b/src/main/persistence-workspace-session-scrollback.test.ts
@@ -32,7 +32,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-workspace-status-workflow.test.ts b/src/main/persistence-workspace-status-workflow.test.ts
index 1804d04dc41..f4a328b6f8c 100644
--- a/src/main/persistence-workspace-status-workflow.test.ts
+++ b/src/main/persistence-workspace-status-workflow.test.ts
@@ -24,7 +24,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-worktree-card-properties.test.ts b/src/main/persistence-worktree-card-properties.test.ts
index 555ae14caf7..5fb262aea84 100644
--- a/src/main/persistence-worktree-card-properties.test.ts
+++ b/src/main/persistence-worktree-card-properties.test.ts
@@ -10,7 +10,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-worktree-deletion-fencing.test.ts b/src/main/persistence-worktree-deletion-fencing.test.ts
index 10cb684027b..496ba1af89c 100644
--- a/src/main/persistence-worktree-deletion-fencing.test.ts
+++ b/src/main/persistence-worktree-deletion-fencing.test.ts
@@ -18,7 +18,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-worktree-lineage-and-backups.test.ts b/src/main/persistence-worktree-lineage-and-backups.test.ts
index a9890f66164..270c700d449 100644
--- a/src/main/persistence-worktree-lineage-and-backups.test.ts
+++ b/src/main/persistence-worktree-lineage-and-backups.test.ts
@@ -27,7 +27,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts b/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
index 632e4ebf25a..d7f17f6ecb0 100644
--- a/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
+++ b/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
@@ -21,7 +21,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence-worktree-visibility.test.ts b/src/main/persistence-worktree-visibility.test.ts
index ab593396b72..600a76effb2 100644
--- a/src/main/persistence-worktree-visibility.test.ts
+++ b/src/main/persistence-worktree-visibility.test.ts
@@ -19,7 +19,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/persistence/loading-store/profile-state-checkpoints.test.ts b/src/main/persistence/loading-store/profile-state-checkpoints.test.ts
index 6ee7e7c7c8d..6900ca93934 100644
--- a/src/main/persistence/loading-store/profile-state-checkpoints.test.ts
+++ b/src/main/persistence/loading-store/profile-state-checkpoints.test.ts
@@ -15,7 +15,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-direct-flush.test.ts b/src/main/persistence/loading-store/profile-state-direct-flush.test.ts
index 7b8b77259f4..a000e04dfac 100644
--- a/src/main/persistence/loading-store/profile-state-direct-flush.test.ts
+++ b/src/main/persistence/loading-store/profile-state-direct-flush.test.ts
@@ -29,7 +29,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-durable-writes.test.ts b/src/main/persistence/loading-store/profile-state-durable-writes.test.ts
index 829d2eb403a..b70c92dd79e 100644
--- a/src/main/persistence/loading-store/profile-state-durable-writes.test.ts
+++ b/src/main/persistence/loading-store/profile-state-durable-writes.test.ts
@@ -13,7 +13,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts b/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts
index dd201c81cd3..7cc2376d4c1 100644
--- a/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts
+++ b/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts
@@ -18,7 +18,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts b/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts
index c56e1a23eaf..42e6b6150ae 100644
--- a/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts
+++ b/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts
@@ -7,7 +7,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-contracts.test.ts b/src/main/persistence/loading-store/profile-state-maintenance-contracts.test.ts
index d3b4ad1b58a..23a329b99ab 100644
--- a/src/main/persistence/loading-store/profile-state-maintenance-contracts.test.ts
+++ b/src/main/persistence/loading-store/profile-state-maintenance-contracts.test.ts
@@ -10,7 +10,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-settings-writes.test.ts b/src/main/persistence/loading-store/profile-state-settings-writes.test.ts
index 7ab1bf07188..3feaeea9160 100644
--- a/src/main/persistence/loading-store/profile-state-settings-writes.test.ts
+++ b/src/main/persistence/loading-store/profile-state-settings-writes.test.ts
@@ -15,7 +15,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts b/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts
index b693bb640ac..829337efe4c 100644
--- a/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts
+++ b/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts
@@ -48,7 +48,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
   sshConfigHostsToTargets: vi.fn(() => [])
 }))
diff --git a/src/main/persistence/loading-store/profile-state-store-backups.test.ts b/src/main/persistence/loading-store/profile-state-store-backups.test.ts
index d91a813099f..6da24ee8744 100644
--- a/src/main/persistence/loading-store/profile-state-store-backups.test.ts
+++ b/src/main/persistence/loading-store/profile-state-store-backups.test.ts
@@ -32,7 +32,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts b/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts
index 2cbdd1c59ff..006d64efa39 100644
--- a/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts
+++ b/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts
@@ -15,7 +15,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/profile-state-update-quit.test.ts b/src/main/persistence/loading-store/profile-state-update-quit.test.ts
index 088d10eeee4..1563ddb7828 100644
--- a/src/main/persistence/loading-store/profile-state-update-quit.test.ts
+++ b/src/main/persistence/loading-store/profile-state-update-quit.test.ts
@@ -7,7 +7,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/pty-binding-placement-inertness.test.ts b/src/main/persistence/loading-store/pty-binding-placement-inertness.test.ts
index 95007aaa380..1ca2e60f7c9 100644
--- a/src/main/persistence/loading-store/pty-binding-placement-inertness.test.ts
+++ b/src/main/persistence/loading-store/pty-binding-placement-inertness.test.ts
@@ -26,7 +26,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts b/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts
index 244f0a6336d..dfe3217a1dc 100644
--- a/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts
+++ b/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts
@@ -13,7 +13,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts b/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts
index 34b6e742804..e646672e71d 100644
--- a/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts
+++ b/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts
@@ -7,7 +7,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts
index 427152b3d1e..afaf6023ad2 100644
--- a/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts
+++ b/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts
@@ -23,7 +23,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts b/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts
index e8cad7828ee..1ae7cdadd78 100644
--- a/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts
+++ b/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts
@@ -11,7 +11,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts
index 75f154074e2..ae5ee3a66c5 100644
--- a/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts
+++ b/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts
@@ -16,7 +16,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts
index 032dc60bce5..b3b7c0df756 100644
--- a/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts
+++ b/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts
@@ -12,7 +12,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/loading-store/terminal-close-async-durability.test.ts b/src/main/persistence/loading-store/terminal-close-async-durability.test.ts
index 090d2340932..7cd83816a6f 100644
--- a/src/main/persistence/loading-store/terminal-close-async-durability.test.ts
+++ b/src/main/persistence/loading-store/terminal-close-async-durability.test.ts
@@ -7,7 +7,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state-cutover-fixture.test.ts b/src/main/persistence/profile-state-cutover-fixture.test.ts
index 311c15ae450..7bb24fe99e1 100644
--- a/src/main/persistence/profile-state-cutover-fixture.test.ts
+++ b/src/main/persistence/profile-state-cutover-fixture.test.ts
@@ -40,7 +40,7 @@ vi.mock('electron', () => ({
 
 vi.mock('../telemetry/client', () => ({ track: trackMock }))
 vi.mock('../telemetry/cohort-classifier', () => ({ getCohortAtEmit: getCohortAtEmitMock }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
   sshConfigHostsToTargets: vi.fn(() => [])
 }))
diff --git a/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts b/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts
index 21c13c3808f..d83fa5981c0 100644
--- a/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts
+++ b/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts
@@ -45,7 +45,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
   sshConfigHostsToTargets: vi.fn(() => [])
 }))
diff --git a/src/main/persistence/profile-state/profile-state-authority-marker.test.ts b/src/main/persistence/profile-state/profile-state-authority-marker.test.ts
index 93650a198fc..33a84c71c25 100644
--- a/src/main/persistence/profile-state/profile-state-authority-marker.test.ts
+++ b/src/main/persistence/profile-state/profile-state-authority-marker.test.ts
@@ -23,7 +23,7 @@ vi.mock('../../telemetry/client', () => ({ track: () => {} }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts b/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts
index b93b05b1b31..ece6f9b707e 100644
--- a/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts
+++ b/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts
@@ -14,7 +14,7 @@ vi.mock('../../telemetry/client', () => ({ track: () => {} }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts b/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts
index d5a2faaed72..8ca6e7ebf42 100644
--- a/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts
+++ b/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts
@@ -35,7 +35,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts b/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts
index 1fcb85eb108..3702b4acc1f 100644
--- a/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts
+++ b/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts
@@ -18,7 +18,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts b/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts
index 5bd76ab842b..915a1015320 100644
--- a/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts
+++ b/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts
@@ -28,7 +28,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts b/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts
index e7be8ee4185..99ab80890a4 100644
--- a/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts
+++ b/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts
@@ -17,7 +17,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts b/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts
index 65fd09bcbb5..ef731b13109 100644
--- a/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts
+++ b/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts
@@ -54,7 +54,7 @@ vi.mock('../../telemetry/client', () => ({ track: () => {} }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-startup-authority.test.ts b/src/main/persistence/profile-state/profile-state-startup-authority.test.ts
index 04f955c066e..615c15b40e5 100644
--- a/src/main/persistence/profile-state/profile-state-startup-authority.test.ts
+++ b/src/main/persistence/profile-state/profile-state-startup-authority.test.ts
@@ -65,7 +65,7 @@ vi.mock('../../telemetry/client', () => ({ track: () => {} }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts b/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts
index f37cb982036..f3ab2832cd9 100644
--- a/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts
+++ b/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts
@@ -30,7 +30,7 @@ vi.mock('../../telemetry/client', () => ({ track: () => {} }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts b/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts
index e53c425465d..84401b47d28 100644
--- a/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts
+++ b/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts
@@ -33,7 +33,7 @@ vi.mock('../../telemetry/client', () => ({ track: () => {} }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-store-factory.test.ts b/src/main/persistence/profile-state/profile-state-store-factory.test.ts
index d22fe0496c1..234005c0002 100644
--- a/src/main/persistence/profile-state/profile-state-store-factory.test.ts
+++ b/src/main/persistence/profile-state/profile-state-store-factory.test.ts
@@ -45,7 +45,7 @@ vi.mock('../../telemetry/client', () => ({ track: () => {} }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/profile-state/profile-state-worker-authority.test.ts b/src/main/persistence/profile-state/profile-state-worker-authority.test.ts
index cc42f350581..60f3b09c580 100644
--- a/src/main/persistence/profile-state/profile-state-worker-authority.test.ts
+++ b/src/main/persistence/profile-state/profile-state-worker-authority.test.ts
@@ -11,7 +11,7 @@ vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/duplicate-pty-pane-repair.test.ts b/src/main/persistence/terminal-topology/duplicate-pty-pane-repair.test.ts
index 4ede4b1e57b..c7eef2733ab 100644
--- a/src/main/persistence/terminal-topology/duplicate-pty-pane-repair.test.ts
+++ b/src/main/persistence/terminal-topology/duplicate-pty-pane-repair.test.ts
@@ -19,7 +19,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/editor-tab-layout-apply.test.ts b/src/main/persistence/terminal-topology/editor-tab-layout-apply.test.ts
index 8252c343d18..b61ef3b725f 100644
--- a/src/main/persistence/terminal-topology/editor-tab-layout-apply.test.ts
+++ b/src/main/persistence/terminal-topology/editor-tab-layout-apply.test.ts
@@ -16,7 +16,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/open-in-new-group-layout-apply.test.ts b/src/main/persistence/terminal-topology/open-in-new-group-layout-apply.test.ts
index 67f8d634653..c4b8ec07eda 100644
--- a/src/main/persistence/terminal-topology/open-in-new-group-layout-apply.test.ts
+++ b/src/main/persistence/terminal-topology/open-in-new-group-layout-apply.test.ts
@@ -14,7 +14,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-late-bind-layout-rules.test.ts b/src/main/persistence/terminal-topology/terminal-late-bind-layout-rules.test.ts
index 54af1c9101a..67372b9c161 100644
--- a/src/main/persistence/terminal-topology/terminal-late-bind-layout-rules.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-late-bind-layout-rules.test.ts
@@ -15,7 +15,7 @@ import { WindowSession, withoutLeaf } from './terminal-topology-window-session-f
 import { checkWorkspaceLayoutRules } from '../../../shared/workspace-layout/workspace-layout-rules'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-layout-apply.test.ts b/src/main/persistence/terminal-topology/terminal-layout-apply.test.ts
index 5c3f9906fdd..96570d2fa43 100644
--- a/src/main/persistence/terminal-topology/terminal-layout-apply.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-layout-apply.test.ts
@@ -14,7 +14,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-layout-create.test.ts b/src/main/persistence/terminal-topology/terminal-layout-create.test.ts
index f96d38e11cd..fc20ba6de03 100644
--- a/src/main/persistence/terminal-topology/terminal-layout-create.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-layout-create.test.ts
@@ -15,7 +15,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-layout-default-tabs-applied.test.ts b/src/main/persistence/terminal-topology/terminal-layout-default-tabs-applied.test.ts
index 22a0b04071d..7fa2708af82 100644
--- a/src/main/persistence/terminal-topology/terminal-layout-default-tabs-applied.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-layout-default-tabs-applied.test.ts
@@ -11,7 +11,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-layout-pane-ops.test.ts b/src/main/persistence/terminal-topology/terminal-layout-pane-ops.test.ts
index acc556a0a45..f1015fbae72 100644
--- a/src/main/persistence/terminal-topology/terminal-layout-pane-ops.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-layout-pane-ops.test.ts
@@ -19,7 +19,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-layout-sleep-wake.test.ts b/src/main/persistence/terminal-topology/terminal-layout-sleep-wake.test.ts
index 6d91d7b078a..a13dd0f93e9 100644
--- a/src/main/persistence/terminal-topology/terminal-layout-sleep-wake.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-layout-sleep-wake.test.ts
@@ -14,7 +14,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-owner-report-only.test.ts b/src/main/persistence/terminal-topology/terminal-owner-report-only.test.ts
index 9a304756392..06dba1ac189 100644
--- a/src/main/persistence/terminal-topology/terminal-owner-report-only.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-owner-report-only.test.ts
@@ -14,7 +14,7 @@ import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqli
 import type * as OwnerInvariants from '../../../shared/workspace-layout/terminal-owner-invariants'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-pane-admission-layout-owner.test.ts b/src/main/persistence/terminal-topology/terminal-pane-admission-layout-owner.test.ts
index cfaec407e8a..4f435be8102 100644
--- a/src/main/persistence/terminal-topology/terminal-pane-admission-layout-owner.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-pane-admission-layout-owner.test.ts
@@ -13,7 +13,7 @@ import {
 
 vi.mock('../../../shared/layout-owner-switch', () => ({ ORCA_LAYOUT_OWNER_IS_MAIN: true }))
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-sleep-quit-resume.test.ts b/src/main/persistence/terminal-topology/terminal-sleep-quit-resume.test.ts
index ba1b9dc6332..b83a7af5928 100644
--- a/src/main/persistence/terminal-topology/terminal-sleep-quit-resume.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-sleep-quit-resume.test.ts
@@ -14,7 +14,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-stale-pane-tree-client.test.ts b/src/main/persistence/terminal-topology/terminal-stale-pane-tree-client.test.ts
index e3e7f9b6db2..55eac763f0b 100644
--- a/src/main/persistence/terminal-topology/terminal-stale-pane-tree-client.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-stale-pane-tree-client.test.ts
@@ -19,7 +19,7 @@ import { leafIds, WindowSession } from './terminal-topology-window-session-fixtu
 import { checkWorkspaceLayoutRules } from '../../../shared/workspace-layout/workspace-layout-rules'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/persistence/terminal-topology/terminal-topology-model.test.ts b/src/main/persistence/terminal-topology/terminal-topology-model.test.ts
index f68b7595dbb..9437c582aa7 100644
--- a/src/main/persistence/terminal-topology/terminal-topology-model.test.ts
+++ b/src/main/persistence/terminal-topology/terminal-topology-model.test.ts
@@ -29,7 +29,7 @@ import {
 } from './terminal-topology-profile-fixture'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/quit-path-durable-write-blocking.test.ts b/src/main/quit-path-durable-write-blocking.test.ts
index 11bea685c7e..95eef503734 100644
--- a/src/main/quit-path-durable-write-blocking.test.ts
+++ b/src/main/quit-path-durable-write-blocking.test.ts
@@ -89,7 +89,7 @@ vi.mock('node:fs/promises', async (importOriginal) => {
   return { ...patched, default: patched }
 })
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/remote-layout-snapshot/remote-layout-snapshot-persistence.test.ts b/src/main/remote-layout-snapshot/remote-layout-snapshot-persistence.test.ts
index 06d9d0536da..9b80228c4c3 100644
--- a/src/main/remote-layout-snapshot/remote-layout-snapshot-persistence.test.ts
+++ b/src/main/remote-layout-snapshot/remote-layout-snapshot-persistence.test.ts
@@ -22,7 +22,7 @@ vi.mock('electron', () => ({
   BrowserWindow: { getAllWindows: () => [] }
 }))
 vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/runtime/runtime-client-agent-launch-settings-durability.test.ts b/src/main/runtime/runtime-client-agent-launch-settings-durability.test.ts
index f14c23cc8b3..46c1c4e45aa 100644
--- a/src/main/runtime/runtime-client-agent-launch-settings-durability.test.ts
+++ b/src/main/runtime/runtime-client-agent-launch-settings-durability.test.ts
@@ -10,7 +10,7 @@ vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/runtime/session-tabs/headless-browser-group-persistence.test.ts b/src/main/runtime/session-tabs/headless-browser-group-persistence.test.ts
index 9c29dd4e8f5..f2f4af77de4 100644
--- a/src/main/runtime/session-tabs/headless-browser-group-persistence.test.ts
+++ b/src/main/runtime/session-tabs/headless-browser-group-persistence.test.ts
@@ -13,7 +13,7 @@ import { OrcaRuntimeService } from '../orca-runtime'
 import { getRuntimeBrowserPageRegistry } from '../runtime-browser-page-registry'
 
 vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
-vi.mock('../../ssh/ssh-config-parser', () => ({
+vi.mock('../../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))
diff --git a/src/main/ssh/ssh-config-alias-claim.test.ts b/src/main/ssh/config/ssh-config-alias-claim.test.ts
similarity index 100%
rename from src/main/ssh/ssh-config-alias-claim.test.ts
rename to src/main/ssh/config/ssh-config-alias-claim.test.ts
diff --git a/src/main/ssh/ssh-config-alias-claim.ts b/src/main/ssh/config/ssh-config-alias-claim.ts
similarity index 98%
rename from src/main/ssh/ssh-config-alias-claim.ts
rename to src/main/ssh/config/ssh-config-alias-claim.ts
index 11da6543e45..cc95edbbb3f 100644
--- a/src/main/ssh/ssh-config-alias-claim.ts
+++ b/src/main/ssh/config/ssh-config-alias-claim.ts
@@ -1,7 +1,7 @@
 import { existsSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
-import { normalizeSshConfigAlias } from '../../shared/ssh-config-alias'
+import { normalizeSshConfigAlias } from '../../../shared/ssh-config-alias'
 import { expandSshConfigIncludes } from './ssh-config-include-expander'
 import { parseSshConfigAliasClaims, type SshConfigAliasClaims } from './ssh-config-parser'
 
diff --git a/src/main/ssh/ssh-config-host-picker.test.ts b/src/main/ssh/config/ssh-config-host-picker.test.ts
similarity index 98%
rename from src/main/ssh/ssh-config-host-picker.test.ts
rename to src/main/ssh/config/ssh-config-host-picker.test.ts
index 783eef679ca..e2307be2cd8 100644
--- a/src/main/ssh/ssh-config-host-picker.test.ts
+++ b/src/main/ssh/config/ssh-config-host-picker.test.ts
@@ -8,7 +8,7 @@ vi.mock('./ssh-config-parser', async (importOriginal) => ({
   loadUserSshConfig: loadUserSshConfigMock
 }))
 
-import { SSH_CONFIG_HOST_RESULT_LIMIT } from '../../shared/ssh-types'
+import { SSH_CONFIG_HOST_RESULT_LIMIT } from '../../../shared/ssh-types'
 import {
   invalidateUserSshConfigHostCache,
   listUserSshConfigHostSummaries,
diff --git a/src/main/ssh/ssh-config-host-picker.ts b/src/main/ssh/config/ssh-config-host-picker.ts
similarity index 97%
rename from src/main/ssh/ssh-config-host-picker.ts
rename to src/main/ssh/config/ssh-config-host-picker.ts
index d1870ad1b69..bbd0370da93 100644
--- a/src/main/ssh/ssh-config-host-picker.ts
+++ b/src/main/ssh/config/ssh-config-host-picker.ts
@@ -3,9 +3,9 @@ import type {
   SshConfigHostResolution,
   SshConfigHostSummary,
   SshTarget
-} from '../../shared/ssh-types'
-import { SSH_CONFIG_HOST_RESULT_LIMIT } from '../../shared/ssh-types'
-import { normalizeSshConfigAlias } from '../../shared/ssh-config-alias'
+} from '../../../shared/ssh-types'
+import { SSH_CONFIG_HOST_RESULT_LIMIT } from '../../../shared/ssh-types'
+import { normalizeSshConfigAlias } from '../../../shared/ssh-config-alias'
 import { loadUserSshConfig, type SshConfigHost } from './ssh-config-parser'
 import { resolveWithSshG, type SshResolvedConfig } from './ssh-g-config-resolution'
 
diff --git a/src/main/ssh/ssh-config-include-expander.ts b/src/main/ssh/config/ssh-config-include-expander.ts
similarity index 100%
rename from src/main/ssh/ssh-config-include-expander.ts
rename to src/main/ssh/config/ssh-config-include-expander.ts
diff --git a/src/main/ssh/ssh-config-loader-regression.test.ts b/src/main/ssh/config/ssh-config-loader-regression.test.ts
similarity index 100%
rename from src/main/ssh/ssh-config-loader-regression.test.ts
rename to src/main/ssh/config/ssh-config-loader-regression.test.ts
diff --git a/src/main/ssh/ssh-config-loader.test.ts b/src/main/ssh/config/ssh-config-loader.test.ts
similarity index 100%
rename from src/main/ssh/ssh-config-loader.test.ts
rename to src/main/ssh/config/ssh-config-loader.test.ts
diff --git a/src/main/ssh/ssh-config-parser-host-patterns.test.ts b/src/main/ssh/config/ssh-config-parser-host-patterns.test.ts
similarity index 100%
rename from src/main/ssh/ssh-config-parser-host-patterns.test.ts
rename to src/main/ssh/config/ssh-config-parser-host-patterns.test.ts
diff --git a/src/main/ssh/ssh-config-parser.test.ts b/src/main/ssh/config/ssh-config-parser.test.ts
similarity index 100%
rename from src/main/ssh/ssh-config-parser.test.ts
rename to src/main/ssh/config/ssh-config-parser.test.ts
diff --git a/src/main/ssh/ssh-config-parser.ts b/src/main/ssh/config/ssh-config-parser.ts
similarity index 99%
rename from src/main/ssh/ssh-config-parser.ts
rename to src/main/ssh/config/ssh-config-parser.ts
index 53575749255..e009e1083c3 100644
--- a/src/main/ssh/ssh-config-parser.ts
+++ b/src/main/ssh/config/ssh-config-parser.ts
@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { expandSshConfigIncludes } from './ssh-config-include-expander'
 import { resolveSshConfigHomePath } from './ssh-config-path-expansion'
 
diff --git a/src/main/ssh/ssh-config-path-expansion.ts b/src/main/ssh/config/ssh-config-path-expansion.ts
similarity index 100%
rename from src/main/ssh/ssh-config-path-expansion.ts
rename to src/main/ssh/config/ssh-config-path-expansion.ts
diff --git a/src/main/ssh/ssh-config-resolver.test.ts b/src/main/ssh/config/ssh-config-resolver.test.ts
similarity index 100%
rename from src/main/ssh/ssh-config-resolver.test.ts
rename to src/main/ssh/config/ssh-config-resolver.test.ts
diff --git a/src/main/ssh/ssh-g-config-resolution.test.ts b/src/main/ssh/config/ssh-g-config-resolution.test.ts
similarity index 100%
rename from src/main/ssh/ssh-g-config-resolution.test.ts
rename to src/main/ssh/config/ssh-g-config-resolution.test.ts
diff --git a/src/main/ssh/ssh-g-config-resolution.ts b/src/main/ssh/config/ssh-g-config-resolution.ts
similarity index 100%
rename from src/main/ssh/ssh-g-config-resolution.ts
rename to src/main/ssh/config/ssh-g-config-resolution.ts
diff --git a/src/main/ssh/ssh-known-hosts-source.test.ts b/src/main/ssh/config/ssh-known-hosts-source.test.ts
similarity index 100%
rename from src/main/ssh/ssh-known-hosts-source.test.ts
rename to src/main/ssh/config/ssh-known-hosts-source.test.ts
diff --git a/src/main/ssh/ssh-known-hosts-source.ts b/src/main/ssh/config/ssh-known-hosts-source.ts
similarity index 100%
rename from src/main/ssh/ssh-known-hosts-source.ts
rename to src/main/ssh/config/ssh-known-hosts-source.ts
diff --git a/src/main/ssh/ssh-known-hosts.test.ts b/src/main/ssh/config/ssh-known-hosts.test.ts
similarity index 100%
rename from src/main/ssh/ssh-known-hosts.test.ts
rename to src/main/ssh/config/ssh-known-hosts.test.ts
diff --git a/src/main/ssh/ssh-known-hosts.ts b/src/main/ssh/config/ssh-known-hosts.ts
similarity index 100%
rename from src/main/ssh/ssh-known-hosts.ts
rename to src/main/ssh/config/ssh-known-hosts.ts
diff --git a/src/main/ssh/vscode-ssh-authority.test.ts b/src/main/ssh/config/vscode-ssh-authority.test.ts
similarity index 97%
rename from src/main/ssh/vscode-ssh-authority.test.ts
rename to src/main/ssh/config/vscode-ssh-authority.test.ts
index 2816c1bc4bf..fb8558935b2 100644
--- a/src/main/ssh/vscode-ssh-authority.test.ts
+++ b/src/main/ssh/config/vscode-ssh-authority.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { resolveVsCodeSshAuthority } from './vscode-ssh-authority'
 
 function createTarget(overrides: Partial<SshTarget> = {}): SshTarget {
diff --git a/src/main/ssh/vscode-ssh-authority.ts b/src/main/ssh/config/vscode-ssh-authority.ts
similarity index 90%
rename from src/main/ssh/vscode-ssh-authority.ts
rename to src/main/ssh/config/vscode-ssh-authority.ts
index 055baac65d4..7ab79de5d5a 100644
--- a/src/main/ssh/vscode-ssh-authority.ts
+++ b/src/main/ssh/config/vscode-ssh-authority.ts
@@ -1,5 +1,5 @@
-import type { SshTarget } from '../../shared/ssh-types'
-import { isOpenSshConfigBackedTarget } from './system-ssh-args'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { isOpenSshConfigBackedTarget } from '../system-transport/system-ssh-args'
 
 export type VsCodeSshAuthorityResult =
   | { ok: true; authority: string }
diff --git a/src/main/ssh/legacy-relay/legacy-relay-endpoints.test.ts b/src/main/ssh/legacy-relay/legacy-relay-endpoints.test.ts
index cde6602e4a5..da27f56ae56 100644
--- a/src/main/ssh/legacy-relay/legacy-relay-endpoints.test.ts
+++ b/src/main/ssh/legacy-relay/legacy-relay-endpoints.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from '../remote-exec-command'
+import type * as ExecCommandModule from '../remote-exec/remote-exec-command'
 import { describe, expect, it, vi } from 'vitest'
 import type { SshConnection } from '../ssh-connection'
 import { relaySocketNameForInstanceId } from './ssh-relay-instance-id'
@@ -6,7 +6,7 @@ import { windowsRelayPipePathsForSocketName } from './ssh-relay-endpoints'
 import { getRemoteHostPlatform, joinRemotePath } from '../ssh-remote-platform'
 
 const { execCommand } = vi.hoisted(() => ({ execCommand: vi.fn() }))
-vi.mock('../remote-exec-command', async (importOriginal) => ({
+vi.mock('../remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand
 }))
diff --git a/src/main/ssh/legacy-relay/legacy-relay-endpoints.ts b/src/main/ssh/legacy-relay/legacy-relay-endpoints.ts
index 0b4cca1e707..a254b5397ac 100644
--- a/src/main/ssh/legacy-relay/legacy-relay-endpoints.ts
+++ b/src/main/ssh/legacy-relay/legacy-relay-endpoints.ts
@@ -7,9 +7,9 @@
  */
 import type { SshConnection } from '../ssh-connection'
 import { shellEscape } from '../ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from '../remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../remote-exec/remote-frame-protocol'
 import { SHORT_RELAY_SOCKET_DIR_PREFIX } from '../relay-socket-path-limit'
-import { execCommand } from '../remote-exec-command'
+import { execCommand } from '../remote-exec/remote-exec-command'
 import { readRelayDaemonRuntimes } from './ssh-relay-endpoint-runtime'
 import { relaySocketNameForInstanceId } from './ssh-relay-instance-id'
 import { readRemoteHomeCommand } from '../ssh-remote-commands'
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.test.ts b/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.test.ts
index 8bbe785e4a2..b9a1092b0ab 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from '../remote-exec-command'
+import type * as ExecCommandModule from '../remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshConnection } from '../ssh-connection'
 import {
@@ -13,7 +13,7 @@ const { execCommand, probeRelayEndpointIncumbent, countRelayEndpointPtys } = vi.
   countRelayEndpointPtys: vi.fn()
 }))
 
-vi.mock('../remote-exec-command', async (importOriginal) => ({
+vi.mock('../remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand
 }))
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.ts b/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.ts
index 956bdae8726..9ffc15310f7 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-endpoint-census.ts
@@ -8,9 +8,9 @@
  */
 import type { SshConnection } from '../ssh-connection'
 import { shellEscape } from '../ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from '../remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../remote-exec/remote-frame-protocol'
 import { SHORT_RELAY_SOCKET_DIR_PREFIX } from '../relay-socket-path-limit'
-import { execCommand } from '../remote-exec-command'
+import { execCommand } from '../remote-exec/remote-exec-command'
 import {
   isReapableRelayHusk,
   probeRelayEndpointIncumbent,
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-terminals-on-connect.ts b/src/main/ssh/legacy-relay/ssh-host-relay-terminals-on-connect.ts
index 3a7018aa157..cc0bc9a476c 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-terminals-on-connect.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-terminals-on-connect.ts
@@ -10,7 +10,7 @@ import {
 } from './ssh-host-relay-endpoint-census'
 import type { SshConnection } from '../ssh-connection'
 import { censusWindowsHostRelays, windowsCensusNodePath } from './ssh-host-relay-windows-census'
-import { execCommand } from '../remote-exec-command'
+import { execCommand } from '../remote-exec/remote-exec-command'
 import { readRemoteHomeCommand } from '../ssh-remote-commands'
 import { resolveRemoteNodePath } from '../ssh-remote-node-resolution'
 import { detectRemoteHostPlatform } from '../ssh-remote-platform-detection'
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.test.ts b/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.test.ts
index f27958da304..fe1070a75a4 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from '../remote-exec-command'
+import type * as ExecCommandModule from '../remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshConnection } from '../ssh-connection'
 import { relaySocketNameForInstanceId } from './ssh-relay-instance-id'
@@ -10,7 +10,7 @@ const { execCommand, countRelayPtysOverBridge } = vi.hoisted(() => ({
   countRelayPtysOverBridge: vi.fn()
 }))
 
-vi.mock('../remote-exec-command', async (importOriginal) => ({
+vi.mock('../remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand
 }))
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.ts b/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.ts
index e040936255f..62a19f6b8a0 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-windows-census.ts
@@ -9,7 +9,7 @@
  * convert under it.
  */
 import type { SshConnection } from '../ssh-connection'
-import { RELAY_REMOTE_DIR } from '../remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../remote-exec/remote-frame-protocol'
 import { RELAY_INSTALL_MODEL } from '../../managed-server/install/remote-install-model'
 import type { HostRelayEndpointCensus } from './ssh-host-relay-endpoint-census'
 import {
@@ -19,7 +19,7 @@ import {
   windowsRelayInventoryCommand
 } from './ssh-host-relay-windows-inventory'
 import { countRelayPtysOverBridge } from './ssh-relay-endpoint-pty-count'
-import { execCommand } from '../remote-exec-command'
+import { execCommand } from '../remote-exec/remote-exec-command'
 import { relaySocketNameForInstanceId } from './ssh-relay-instance-id'
 import { windowsRelayConnectCommand } from './ssh-relay-windows-launch-command'
 import { listRemoteInstallBaseDirsCommand } from '../ssh-remote-commands'
diff --git a/src/main/ssh/legacy-relay/ssh-host-relay-windows-inventory.ts b/src/main/ssh/legacy-relay/ssh-host-relay-windows-inventory.ts
index fc349aa2112..96783de6e34 100644
--- a/src/main/ssh/legacy-relay/ssh-host-relay-windows-inventory.ts
+++ b/src/main/ssh/legacy-relay/ssh-host-relay-windows-inventory.ts
@@ -7,7 +7,7 @@
  * names every relay pipe on the machine, and each instance leaves a credential file (and its pipe
  * marker) in its version directory, which maps a listed pipe back to the instance that serves it.
  */
-import { RELAY_REMOTE_DIR } from '../remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from '../remote-exec/remote-frame-protocol'
 import { commandWithNodePath } from '../ssh-remote-commands'
 import {
   quotePowerShellLiteral as powerShellLiteral,
diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts
index 57b6390d88e..28bc400f21d 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts
@@ -1,9 +1,9 @@
-import type * as ExecCommandModule from '../remote-exec-command'
+import type * as ExecCommandModule from '../remote-exec/remote-exec-command'
 import { describe, expect, it, vi } from 'vitest'
 import { RELAY_LSOF_PROBE_JS } from '@orca/process-host/posix-lsof-probe'
 
 const execCommand = vi.fn()
-vi.mock('../remote-exec-command', async (importOriginal) => ({
+vi.mock('../remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: (...args: unknown[]) => execCommand(...args),
   isUnconfirmedSshCommandTermination: (error: unknown) =>
diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.ts
index da960c4d976..e28d0f492b0 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.ts
@@ -28,7 +28,7 @@ import {
   RELAY_UNRECOGNIZED_CHILD_COUNT_VAR,
   relayDaemonChildCensusShell
 } from '../relay-daemon-service-children'
-import { execCommand, isUnconfirmedSshCommandTermination } from '../remote-exec-command'
+import { execCommand, isUnconfirmedSshCommandTermination } from '../remote-exec/remote-exec-command'
 import { isWindowsRemoteHost, type RemoteHostPlatform } from '../ssh-remote-platform'
 import { filesystemTypeIsLocalDisk } from '../../orcad/orcad-data-root-locality'
 
diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.ts
index e0ed047265f..844c97724ca 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.ts
@@ -7,7 +7,7 @@
  * host with no PATH Node from reading every relay as unverifiable.
  */
 import type { SshConnection } from '../ssh-connection'
-import { execCommand } from '../remote-exec-command'
+import { execCommand } from '../remote-exec/remote-exec-command'
 
 const RELAY_DAEMON_MARKER = ' relay.js --detached '
 
diff --git a/src/main/ssh/legacy-relay/ssh-relay-incumbent-process.test.ts b/src/main/ssh/legacy-relay/ssh-relay-incumbent-process.test.ts
index 5626c4d6dee..d5f3370f30d 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-incumbent-process.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-incumbent-process.test.ts
@@ -1,11 +1,11 @@
-import type * as ExecCommandModule from '../remote-exec-command'
+import type * as ExecCommandModule from '../remote-exec/remote-exec-command'
 import { mkdtempSync, writeFileSync, rmSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { createServer } from 'node:net'
 import { describe, expect, it, vi } from 'vitest'
 import { runProcess } from '@orca/process-host'
-vi.mock('../remote-exec-command', async (importOriginal) => ({
+vi.mock('../remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
diff --git a/src/main/ssh/legacy-relay/ssh-relay-sentinel-copy-budget.test.ts b/src/main/ssh/legacy-relay/ssh-relay-sentinel-copy-budget.test.ts
index 23348b6e13d..0723b17c76b 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-sentinel-copy-budget.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-sentinel-copy-budget.test.ts
@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events'
 import type { ClientChannel } from 'ssh2'
 import { expect, it, vi } from 'vitest'
-import { RELAY_SENTINEL } from '../remote-frame-protocol'
+import { RELAY_SENTINEL } from '../remote-exec/remote-frame-protocol'
 import { waitForSentinel } from './ssh-relay-sentinel'
 
 it.each([1, 256])('copies each startup prefix once across %i chunks', async (chunks) => {
diff --git a/src/main/ssh/legacy-relay/ssh-relay-sentinel.test.ts b/src/main/ssh/legacy-relay/ssh-relay-sentinel.test.ts
index fffdbe49d85..f724401c229 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-sentinel.test.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-sentinel.test.ts
@@ -2,7 +2,7 @@ import { EventEmitter } from 'node:events'
 import { describe, expect, it, vi } from 'vitest'
 import type { ClientChannel } from 'ssh2'
 import { waitForSentinel } from './ssh-relay-sentinel'
-import { RELAY_SENTINEL } from '../remote-frame-protocol'
+import { RELAY_SENTINEL } from '../remote-exec/remote-frame-protocol'
 import {
   RelayVersionMismatchError,
   RELAY_EXIT_CODE_VERSION_MISMATCH
diff --git a/src/main/ssh/legacy-relay/ssh-relay-sentinel.ts b/src/main/ssh/legacy-relay/ssh-relay-sentinel.ts
index 7a63d862f47..8d5ef3969c2 100644
--- a/src/main/ssh/legacy-relay/ssh-relay-sentinel.ts
+++ b/src/main/ssh/legacy-relay/ssh-relay-sentinel.ts
@@ -1,6 +1,6 @@
 import type { ClientChannel } from 'ssh2'
 import { createSshOperationAbortError } from '../ssh-connection-utils'
-import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../remote-frame-protocol'
+import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../remote-exec/remote-frame-protocol'
 import type { MultiplexerTransport } from '../ssh-channel-multiplexer'
 import { buildRelayHandshakeRefusalError } from './ssh-relay-handshake-mismatch'
 
diff --git a/src/main/ssh/orcad-candidate-launch-verdict.ts b/src/main/ssh/orcad-candidate-launch-verdict.ts
index d0ee5b2d32f..831f1a685aa 100644
--- a/src/main/ssh/orcad-candidate-launch-verdict.ts
+++ b/src/main/ssh/orcad-candidate-launch-verdict.ts
@@ -8,7 +8,7 @@ import {
   launchOrcadAndAwaitReadiness,
   type OrcadRemoteExecTarget
 } from '../managed-server/install/orcad-remote-runtime-control'
-import { isUnconfirmedSshCommandTermination } from './remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from './remote-exec/remote-exec-command'
 
 type CandidateLaunchTarget = Parameters<typeof launchOrcadAndAwaitReadiness>[0] &
   OrcadRemoteExecTarget & {
diff --git a/src/main/ssh/orcad-deployment-target.test.ts b/src/main/ssh/orcad-deployment-target.test.ts
index 9fbc6a94b61..0f3cad13d73 100644
--- a/src/main/ssh/orcad-deployment-target.test.ts
+++ b/src/main/ssh/orcad-deployment-target.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   parseGlibcVersion,
@@ -7,10 +7,10 @@ import {
 } from './orcad-deployment-target'
 import { SshConnection } from './ssh-connection'
 import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
-import { execCommand } from './remote-exec-command'
+import { execCommand } from './remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
diff --git a/src/main/ssh/orcad-deployment-target.ts b/src/main/ssh/orcad-deployment-target.ts
index 66349e65ba6..c516a6511bd 100644
--- a/src/main/ssh/orcad-deployment-target.ts
+++ b/src/main/ssh/orcad-deployment-target.ts
@@ -7,7 +7,7 @@ import {
 } from '../../shared/node-runtime-pin'
 import { ORCAD_SERVER_TARGET_FILENAME } from '../../shared/orcad-artifacts'
 import type { RemoteInstallTransport } from '../managed-server/install/remote-install-transport'
-import { execCommand } from './remote-exec-command'
+import { execCommand } from './remote-exec/remote-exec-command'
 import type { RemoteHostPlatform } from './ssh-remote-platform'
 
 /** The host answered the libc probe, but with nothing this client recognises. */
diff --git a/src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts b/src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts
index a726bea6e02..dbc2a47acde 100644
--- a/src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts
+++ b/src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts
@@ -11,10 +11,10 @@ import { hostname, tmpdir, uptime } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { runProcess, spawnProcess } from '@orca/process-host'
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 
 // The proof's remote commands run in a real local shell.
-vi.mock('./remote-exec-command', async (importOriginal) => {
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => {
   const { runProcess: run } = await import('@orca/process-host')
   return {
     ...(await importOriginal<typeof ExecCommandModule>()),
diff --git a/src/main/ssh/orcad-exited-own-fence.test.ts b/src/main/ssh/orcad-exited-own-fence.test.ts
index 084db7fe9f6..a5425af61e0 100644
--- a/src/main/ssh/orcad-exited-own-fence.test.ts
+++ b/src/main/ssh/orcad-exited-own-fence.test.ts
@@ -11,13 +11,13 @@ import {
 import { hostname, tmpdir, uptime } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 
 // Every remote command runs in a real local shell, so the host-side checks are the real ones.
 const shell = vi.hoisted((): { env: NodeJS.ProcessEnv | undefined } => ({ env: undefined }))
-vi.mock('./remote-exec-command', async (importOriginal) => {
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => {
   const { runProcess } = await import('@orca/process-host')
-  const { sshCommandExitError } = await import('./remote-exec-command')
+  const { sshCommandExitError } = await import('./remote-exec/remote-exec-command')
   return {
     ...(await importOriginal<typeof ExecCommandModule>()),
     execCommand: async (_conn: unknown, command: string) => {
diff --git a/src/main/ssh/orcad-exited-own-install-lock.test.ts b/src/main/ssh/orcad-exited-own-install-lock.test.ts
index 4adf3070a88..4da144676c9 100644
--- a/src/main/ssh/orcad-exited-own-install-lock.test.ts
+++ b/src/main/ssh/orcad-exited-own-install-lock.test.ts
@@ -11,12 +11,12 @@ import {
 import { hostname, tmpdir, uptime } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 
 // Every remote command runs in a real local shell, so the host-side checks are the real ones.
-vi.mock('./remote-exec-command', async (importOriginal) => {
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => {
   const { runProcess } = await import('@orca/process-host')
-  const { sshCommandExitError } = await import('./remote-exec-command')
+  const { sshCommandExitError } = await import('./remote-exec/remote-exec-command')
   return {
     ...(await importOriginal<typeof ExecCommandModule>()),
     execCommand: async (_conn: unknown, command: string) => {
diff --git a/src/main/ssh/orcad-exited-own-lock-windows.test.ts b/src/main/ssh/orcad-exited-own-lock-windows.test.ts
index ecf397a066a..0aa79ce53fb 100644
--- a/src/main/ssh/orcad-exited-own-lock-windows.test.ts
+++ b/src/main/ssh/orcad-exited-own-lock-windows.test.ts
@@ -2,14 +2,14 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { hostname, tmpdir, uptime } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 
 // The host script's own checks are covered against the real script; here only the client's part.
 const remote = vi.hoisted((): { commands: string[]; reply: string } => ({
   commands: [],
   reply: ''
 }))
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: async (_conn: unknown, command: string) => {
     remote.commands.push(command)
diff --git a/src/main/ssh/orcad-fence-lost-classification.test.ts b/src/main/ssh/orcad-fence-lost-classification.test.ts
index 9566e9c2ed1..73b8207ef96 100644
--- a/src/main/ssh/orcad-fence-lost-classification.test.ts
+++ b/src/main/ssh/orcad-fence-lost-classification.test.ts
@@ -13,7 +13,10 @@ import {
   posixOrcadFenceGuard,
   runWithOrcadFence
 } from '../managed-server/activation/orcad-activation-fence-scope'
-import { isUnconfirmedSshCommandTermination, sshCommandExitError } from './remote-exec-command'
+import {
+  isUnconfirmedSshCommandTermination,
+  sshCommandExitError
+} from './remote-exec/remote-exec-command'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 import type { OrcadHostTransport } from './orcad-host-transport'
 
diff --git a/src/main/ssh/orcad-gc-transaction-pins.ts b/src/main/ssh/orcad-gc-transaction-pins.ts
index 590d77711bc..d9a1a669e83 100644
--- a/src/main/ssh/orcad-gc-transaction-pins.ts
+++ b/src/main/ssh/orcad-gc-transaction-pins.ts
@@ -9,7 +9,7 @@ import { orcadInstallDirNames } from '../managed-server/activation/orcad-activat
 import type { OrcadActivationTransaction } from '../managed-server/activation/orcad-activation-transaction'
 import { readOrcadActivationTransaction } from '../managed-server/activation/orcad-activation-transaction-store'
 import { orcadActivationFenceExists } from '../managed-server/activation/orcad-activation-lock'
-import { isUnconfirmedSshCommandTermination } from './remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from './remote-exec/remote-exec-command'
 import type { OrcadRemoteExecTarget } from '../managed-server/install/orcad-remote-runtime-control'
 
 export type OrcadGcTransactionPins = { state: 'pinned'; dirNames: string[] } | { state: 'keep-all' }
diff --git a/src/main/ssh/orcad-incumbent-recovery.ts b/src/main/ssh/orcad-incumbent-recovery.ts
index fee46eb917c..7f3abc80c53 100644
--- a/src/main/ssh/orcad-incumbent-recovery.ts
+++ b/src/main/ssh/orcad-incumbent-recovery.ts
@@ -9,7 +9,7 @@
 import { execOrcadStateMutation } from '../managed-server/host-state/orcad-state-mutation-exec'
 import { orcadRemoteBaseDir } from '../managed-server/install/orcad-remote-windows-node'
 import type { ServeReadiness } from '../server/serve-readiness'
-import { RELAY_REMOTE_DIR } from './remote-frame-protocol'
+import { RELAY_REMOTE_DIR } from './remote-exec/remote-frame-protocol'
 import { ORCAD_STATE_SNAPSHOT_DIR } from '../managed-server/activation/orcad-activation-record'
 import type { OrcadSnapshotVerdict } from '../managed-server/activation/orcad-activation-transaction'
 import {
diff --git a/src/main/ssh/orcad-installed-activation.ts b/src/main/ssh/orcad-installed-activation.ts
index 50030c363b7..ea1ad29cd53 100644
--- a/src/main/ssh/orcad-installed-activation.ts
+++ b/src/main/ssh/orcad-installed-activation.ts
@@ -8,7 +8,7 @@
 import { orcadRemoteBaseDir } from '../managed-server/install/orcad-remote-windows-node'
 import { randomUUID } from 'node:crypto'
 import type { OrcadDeployOptions, OrcadDeployResult } from './orcad-remote-deploy'
-import { isUnconfirmedSshCommandTermination } from './remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from './remote-exec/remote-exec-command'
 import {
   withActivatedVersion,
   type OrcadActivationRecord,
diff --git a/src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts b/src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts
index 9a48749ec59..ea7dd74d814 100644
--- a/src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts
+++ b/src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts
@@ -1,7 +1,7 @@
 // Astra pass 4 §2: desktop A leases nothing, but desktop B's live shell, under another target id on
 // the same account, must never read as exited. COMPAT(legacy-relay-bridge): the host converts anyway
 // and leaves B's relay alone, so the census reads `bridged` with nothing of A's to serve.
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshConnection } from './ssh-connection'
 import { relaySocketNameForInstanceId } from './legacy-relay/ssh-relay-instance-id'
@@ -20,7 +20,7 @@ const {
   countRelayPtysOverBridge: vi.fn()
 }))
 
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand
 }))
diff --git a/src/main/ssh/orcad-remote-deploy.test.ts b/src/main/ssh/orcad-remote-deploy.test.ts
index 0d53cf98aa1..b9531315686 100644
--- a/src/main/ssh/orcad-remote-deploy.test.ts
+++ b/src/main/ssh/orcad-remote-deploy.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import type * as RecordFile from '../managed-server/install/orcad-remote-record-file'
 import { tmpdir } from 'node:os'
@@ -6,7 +6,7 @@ import { dirname, join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { runProcess } from '@orca/process-host'
 
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
@@ -32,7 +32,7 @@ vi.mock('./orcad-local-build-hash', () => ({
   computeLocalOrcadBuildHash: () => 'abc123def4567890'
 }))
 
-import { execCommand } from './remote-exec-command'
+import { execCommand } from './remote-exec/remote-exec-command'
 import {
   acquireInstallLock,
   isRelayInstallLockStale
diff --git a/src/main/ssh/orcad-remote-node-runtime-report.ts b/src/main/ssh/orcad-remote-node-runtime-report.ts
index 0fd882db0dd..50179a750dd 100644
--- a/src/main/ssh/orcad-remote-node-runtime-report.ts
+++ b/src/main/ssh/orcad-remote-node-runtime-report.ts
@@ -1,5 +1,5 @@
 /** What the host-side runtime-store scripts print, shared by the POSIX and Windows installers. */
-import { RelayHostAnsweredError } from './remote-host-answered-failure'
+import { RelayHostAnsweredError } from './remote-exec/remote-host-answered-failure'
 
 export const REMOTE_NODE_RUNTIME_READY = 'ORCA_NODE_RUNTIME_READY'
 export const REMOTE_NODE_RUNTIME_MISSING = 'ORCA_NODE_RUNTIME_MISSING'
diff --git a/src/main/ssh/port-forwarding/ssh-port-forward.test.ts b/src/main/ssh/port-forwarding/ssh-port-forward.test.ts
index 4489ff04903..fa4c5651f23 100644
--- a/src/main/ssh/port-forwarding/ssh-port-forward.test.ts
+++ b/src/main/ssh/port-forwarding/ssh-port-forward.test.ts
@@ -7,7 +7,7 @@ const { startSystemSshPortForwardProcessMock } = vi.hoisted(() => ({
   startSystemSshPortForwardProcessMock: vi.fn()
 }))
 
-vi.mock('../system-ssh-forward-process', async (importOriginal) => {
+vi.mock('../system-transport/system-ssh-forward-process', async (importOriginal) => {
   const actual = (await importOriginal()) as Record<string, unknown>
   return {
     ...actual,
diff --git a/src/main/ssh/port-forwarding/system-ssh-port-forward-provider.ts b/src/main/ssh/port-forwarding/system-ssh-port-forward-provider.ts
index 03df12434c0..16ef43052fa 100644
--- a/src/main/ssh/port-forwarding/system-ssh-port-forward-provider.ts
+++ b/src/main/ssh/port-forwarding/system-ssh-port-forward-provider.ts
@@ -1,9 +1,9 @@
 import type { SshConnection } from '../ssh-connection'
-import type { SystemSshBuildArgsOptions } from '../system-ssh-args'
+import type { SystemSshBuildArgsOptions } from '../system-transport/system-ssh-args'
 import {
   startSystemSshPortForwardProcess,
   systemSshForwardError
-} from '../system-ssh-forward-process'
+} from '../system-transport/system-ssh-forward-process'
 import type {
   ForwardChannelOpenFailure,
   PortForwardStartOptions,
diff --git a/src/main/ssh/relay-bundle-paths.ts b/src/main/ssh/relay-bundle-paths.ts
index c43ef6541bb..ac97aa34410 100644
--- a/src/main/ssh/relay-bundle-paths.ts
+++ b/src/main/ssh/relay-bundle-paths.ts
@@ -1,6 +1,6 @@
 import { join } from 'node:path'
 import { getAppEnvironment } from '../../shared/app-environment'
-import type { RelayPlatform } from './remote-frame-protocol'
+import type { RelayPlatform } from './remote-exec/remote-frame-protocol'
 
 function currentAppPath(): string | undefined {
   try {
diff --git a/src/main/ssh/remote-exec-closed-stdin.test.ts b/src/main/ssh/remote-exec/remote-exec-closed-stdin.test.ts
similarity index 95%
rename from src/main/ssh/remote-exec-closed-stdin.test.ts
rename to src/main/ssh/remote-exec/remote-exec-closed-stdin.test.ts
index 7e3883633ed..596bd0420a3 100644
--- a/src/main/ssh/remote-exec-closed-stdin.test.ts
+++ b/src/main/ssh/remote-exec/remote-exec-closed-stdin.test.ts
@@ -1,6 +1,6 @@
 import { Duplex, PassThrough, Readable } from 'node:stream'
 import { describe, expect, it, vi } from 'vitest'
-import type { RemoteCommandChannel } from '../managed-server/install/remote-install-transport'
+import type { RemoteCommandChannel } from '../../managed-server/install/remote-install-transport'
 import { execCommand } from './remote-exec-command'
 
 function answering(output: string): RemoteCommandChannel {
diff --git a/src/main/ssh/remote-exec-command.test.ts b/src/main/ssh/remote-exec/remote-exec-command.test.ts
similarity index 100%
rename from src/main/ssh/remote-exec-command.test.ts
rename to src/main/ssh/remote-exec/remote-exec-command.test.ts
diff --git a/src/main/ssh/remote-exec-command.ts b/src/main/ssh/remote-exec/remote-exec-command.ts
similarity index 96%
rename from src/main/ssh/remote-exec-command.ts
rename to src/main/ssh/remote-exec/remote-exec-command.ts
index 691885ac6ca..5b5b51d3723 100644
--- a/src/main/ssh/remote-exec-command.ts
+++ b/src/main/ssh/remote-exec/remote-exec-command.ts
@@ -2,14 +2,14 @@ import type { Readable } from 'node:stream'
 import type {
   RemoteCommandChannel,
   RemoteInstallTransport
-} from '../managed-server/install/remote-install-transport'
-import { createSshOperationAbortError, type SshExecOptions } from './ssh-connection-utils'
+} from '../../managed-server/install/remote-install-transport'
+import { createSshOperationAbortError, type SshExecOptions } from '../ssh-connection-utils'
 import {
   redactRelayInstallMarkerError,
   redactRelayInstallMarkerTokens
-} from '../managed-server/install/remote-install-marker'
-import type { SystemSshCommandChannel } from './system-ssh-command'
-import { buildPosixStdoutFence } from '../../shared/posix-stdout-fence'
+} from '../../managed-server/install/remote-install-marker'
+import type { SystemSshCommandChannel } from '../system-transport/system-ssh-command'
+import { buildPosixStdoutFence } from '../../../shared/posix-stdout-fence'
 
 const EXEC_TIMEOUT_MS = 30_000
 const COMMAND_CLOSE_GRACE_MS = 5_000
diff --git a/src/main/ssh/remote-exec-input.test.ts b/src/main/ssh/remote-exec/remote-exec-input.test.ts
similarity index 91%
rename from src/main/ssh/remote-exec-input.test.ts
rename to src/main/ssh/remote-exec/remote-exec-input.test.ts
index b6fbe50f0da..03618e5e01c 100644
--- a/src/main/ssh/remote-exec-input.test.ts
+++ b/src/main/ssh/remote-exec/remote-exec-input.test.ts
@@ -5,8 +5,8 @@ import { execCommand } from './remote-exec-command'
 
 const { spawnMock } = vi.hoisted(() => ({ spawnMock: vi.fn() }))
 vi.mock('node:child_process', () => ({ spawn: spawnMock }))
-vi.mock('./system-ssh-binary', () => ({ findSystemSsh: () => '/usr/bin/ssh' }))
-import { spawnSystemSshCommand } from './system-ssh-command'
+vi.mock('../system-transport/system-ssh-binary', () => ({ findSystemSsh: () => '/usr/bin/ssh' }))
+import { spawnSystemSshCommand } from '../system-transport/system-ssh-command'
 
 function fakeSshProcess() {
   const proc = Object.assign(new EventEmitter(), {
diff --git a/src/main/ssh/remote-frame-protocol.test.ts b/src/main/ssh/remote-exec/remote-frame-protocol.test.ts
similarity index 99%
rename from src/main/ssh/remote-frame-protocol.test.ts
rename to src/main/ssh/remote-exec/remote-frame-protocol.test.ts
index 52a4e1ff5dc..268931d9655 100644
--- a/src/main/ssh/remote-frame-protocol.test.ts
+++ b/src/main/ssh/remote-exec/remote-frame-protocol.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
-import { HEADER_LENGTH, FrameDecoder, type DecodedFrame } from '../../shared/relay-frame-decoder'
+import { HEADER_LENGTH, FrameDecoder, type DecodedFrame } from '../../../shared/relay-frame-decoder'
 import {
   MessageType,
   encodeFrame,
diff --git a/src/main/ssh/remote-frame-protocol.ts b/src/main/ssh/remote-exec/remote-frame-protocol.ts
similarity index 98%
rename from src/main/ssh/remote-frame-protocol.ts
rename to src/main/ssh/remote-exec/remote-frame-protocol.ts
index e27348db7b0..235ba06b7b2 100644
--- a/src/main/ssh/remote-frame-protocol.ts
+++ b/src/main/ssh/remote-exec/remote-frame-protocol.ts
@@ -2,7 +2,7 @@
 // 13-byte framing header matching VS Code's PersistentProtocol wire format.
 // See design-ssh-support.md § JSON-RPC Protocol Specification.
 
-import { HEADER_LENGTH, MAX_MESSAGE_SIZE } from '../../shared/relay-frame-decoder'
+import { HEADER_LENGTH, MAX_MESSAGE_SIZE } from '../../../shared/relay-frame-decoder'
 export const RELAY_VERSION = '0.1.0'
 export const RELAY_SENTINEL = `ORCA-RELAY v${RELAY_VERSION} READY\n`
 export const RELAY_SENTINEL_TIMEOUT_MS = 10_000
diff --git a/src/main/ssh/remote-host-answered-failure-producers.test.ts b/src/main/ssh/remote-exec/remote-host-answered-failure-producers.test.ts
similarity index 90%
rename from src/main/ssh/remote-host-answered-failure-producers.test.ts
rename to src/main/ssh/remote-exec/remote-host-answered-failure-producers.test.ts
index 09b1f8edacb..d1845fbaf31 100644
--- a/src/main/ssh/remote-host-answered-failure-producers.test.ts
+++ b/src/main/ssh/remote-exec/remote-host-answered-failure-producers.test.ts
@@ -7,28 +7,30 @@ import { chmod, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { NODE_RUNTIME_PIN } from '../../shared/node-runtime-pin'
-import type { SshTarget } from '../../shared/ssh-types'
+import { NODE_RUNTIME_PIN } from '../../../shared/node-runtime-pin'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { runProcess, runProcessSync } from '@orca/process-host'
 import {
   REMOTE_NODE_RUNTIME_READY,
   REMOTE_NODE_RUNTIME_VERIFIED_MARKER,
   RemoteNodeRuntimeSelfTestError,
   assertRemoteNodeRuntimePromoted
-} from './orcad-remote-node-runtime-report'
-import { remoteNodeRuntimePresentCommand } from '../managed-server/install/orcad-remote-node-runtime'
+} from '../orcad-remote-node-runtime-report'
+import { remoteNodeRuntimePresentCommand } from '../../managed-server/install/orcad-remote-node-runtime'
 import { isAnsweredHostFailure } from './remote-host-answered-failure'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import { findSystemSsh } from './system-ssh-binary'
-import { uploadDirectoryViaSystemSsh } from './system-ssh-file-transfer'
-import { runSftpBatch } from './system-ssh-sftp-transfer'
+import { getRemoteHostPlatform } from '../ssh-remote-platform'
+import { findSystemSsh } from '../system-transport/system-ssh-binary'
+import { uploadDirectoryViaSystemSsh } from '../system-transport/system-ssh-file-transfer'
+import { runSftpBatch } from '../system-transport/system-ssh-sftp-transfer'
 
 vi.mock('@orca/process-host', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   runProcess: vi.fn()
 }))
-vi.mock('./system-ssh-args', () => ({ buildSshArgs: () => ['--', 'host'] }))
-vi.mock('./system-ssh-binary', () => ({ findSystemSsh: vi.fn(() => '/usr/bin/ssh') }))
+vi.mock('../system-transport/system-ssh-args', () => ({ buildSshArgs: () => ['--', 'host'] }))
+vi.mock('../system-transport/system-ssh-binary', () => ({
+  findSystemSsh: vi.fn(() => '/usr/bin/ssh')
+}))
 
 const posix = process.platform !== 'win32'
 // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: ssh args are mocked, so the target is never read.
diff --git a/src/main/ssh/remote-host-answered-failure.test.ts b/src/main/ssh/remote-exec/remote-host-answered-failure.test.ts
similarity index 94%
rename from src/main/ssh/remote-host-answered-failure.test.ts
rename to src/main/ssh/remote-exec/remote-host-answered-failure.test.ts
index 12530328524..84ea9a57700 100644
--- a/src/main/ssh/remote-host-answered-failure.test.ts
+++ b/src/main/ssh/remote-exec/remote-host-answered-failure.test.ts
@@ -2,10 +2,10 @@ import { describe, expect, it } from 'vitest'
 import {
   RemoteNodeRuntimeSecurityModifiedError,
   RemoteNodeRuntimeSelfTestError
-} from './orcad-remote-node-runtime-report'
+} from '../orcad-remote-node-runtime-report'
 import { isAnsweredHostFailure, RelayHostAnsweredError } from './remote-host-answered-failure'
 import { SSH_EXEC_TIMEOUT_CODE } from './remote-exec-command'
-import { SystemSshCommandExitError } from './system-ssh-operation-lifecycle'
+import { SystemSshCommandExitError } from '../system-transport/system-ssh-operation-lifecycle'
 
 const exitError = (code: number, message: string): Error =>
   Object.assign(new Error(message), { exitCode: code, stdout: '' })
diff --git a/src/main/ssh/remote-host-answered-failure.ts b/src/main/ssh/remote-exec/remote-host-answered-failure.ts
similarity index 92%
rename from src/main/ssh/remote-host-answered-failure.ts
rename to src/main/ssh/remote-exec/remote-host-answered-failure.ts
index 119820c7363..1177fc6035d 100644
--- a/src/main/ssh/remote-host-answered-failure.ts
+++ b/src/main/ssh/remote-exec/remote-host-answered-failure.ts
@@ -4,11 +4,11 @@
  * so the connect fails retryably and never launches a second relay beside one that may be running.
  */
 import { isSshCommandExitError } from './remote-exec-command'
-import { isSshSessionLimitError } from './ssh-session-limit-error'
+import { isSshSessionLimitError } from '../ssh-session-limit-error'
 import {
   isHostAnsweredSystemSshExit,
   SystemSshCommandExitError
-} from './system-ssh-operation-lifecycle'
+} from '../system-transport/system-ssh-operation-lifecycle'
 
 /** SFTP statuses the server sent about the request itself; NO_CONNECTION/CONNECTION_LOST are transport. */
 const ANSWERED_SFTP_STATUSES: ReadonlySet<number> = new Set([1, 2, 3, 4, 5, 8])
diff --git a/src/main/ssh/remote-host-exec.ts b/src/main/ssh/remote-exec/remote-host-exec.ts
similarity index 74%
rename from src/main/ssh/remote-host-exec.ts
rename to src/main/ssh/remote-exec/remote-host-exec.ts
index f480111fc5f..83dfa23326a 100644
--- a/src/main/ssh/remote-host-exec.ts
+++ b/src/main/ssh/remote-exec/remote-host-exec.ts
@@ -1,6 +1,6 @@
-import type { RemoteInstallTransport } from '../managed-server/install/remote-install-transport'
+import type { RemoteInstallTransport } from '../../managed-server/install/remote-install-transport'
 import { execCommand } from './remote-exec-command'
-import type { RemoteHostPlatform } from './ssh-remote-platform'
+import type { RemoteHostPlatform } from '../ssh-remote-platform'
 
 export function execHostCommand(
   conn: RemoteInstallTransport,
diff --git a/src/main/ssh/ssh-agent-identity-filter.ts b/src/main/ssh/ssh-agent-identity-filter.ts
index 35a3c0a7721..e2fb48a6595 100644
--- a/src/main/ssh/ssh-agent-identity-filter.ts
+++ b/src/main/ssh/ssh-agent-identity-filter.ts
@@ -9,7 +9,7 @@ import {
   type SignCallback,
   type SigningRequestOptions
 } from 'ssh2'
-import { resolveSshConfigHomePath } from './ssh-config-path-expansion'
+import { resolveSshConfigHomePath } from './config/ssh-config-path-expansion'
 
 type AgentPublicKey = ParsedKey | Buffer | string | PublicKeyEntry
 
diff --git a/src/main/ssh/ssh-auth-resolution.ts b/src/main/ssh/ssh-auth-resolution.ts
index 86b4bb3dc44..d1ab583803f 100644
--- a/src/main/ssh/ssh-auth-resolution.ts
+++ b/src/main/ssh/ssh-auth-resolution.ts
@@ -1,10 +1,10 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { utils, type BaseAgent, type ParsedKey } from 'ssh2'
 import type { SshTarget } from '../../shared/ssh-types'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 import { createIdentityFilteredAgent } from './ssh-agent-identity-filter'
-import { resolveSshConfigHomePath } from './ssh-config-path-expansion'
-import { isOpenSshConfigBackedTarget } from './system-ssh-args'
+import { resolveSshConfigHomePath } from './config/ssh-config-path-expansion'
+import { isOpenSshConfigBackedTarget } from './system-transport/system-ssh-args'
 
 // Why: ssh2 only tries keys that are explicitly provided. Users with keys in
 // standard locations (e.g. ~/.ssh/id_ed25519) but no SSH agent running would
diff --git a/src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts b/src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts
index 1ff817c43f8..e893fa079d9 100644
--- a/src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts
+++ b/src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { SshChannelMultiplexer, type MultiplexerTransport } from './ssh-channel-multiplexer'
-import { encodeFrame, encodeKeepAliveFrame, MessageType } from './remote-frame-protocol'
+import { encodeFrame, encodeKeepAliveFrame, MessageType } from './remote-exec/remote-frame-protocol'
 import { HEADER_LENGTH } from '../../shared/relay-frame-decoder'
 
 type MockTransport = MultiplexerTransport & {
diff --git a/src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts b/src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts
index 2c92c28d91e..be31ddfbc63 100644
--- a/src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts
+++ b/src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts
@@ -1,5 +1,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { encodeKeepAliveFrame, KEEPALIVE_SEND_MS, TIMEOUT_MS } from './remote-frame-protocol'
+import {
+  encodeKeepAliveFrame,
+  KEEPALIVE_SEND_MS,
+  TIMEOUT_MS
+} from './remote-exec/remote-frame-protocol'
 import { SshChannelMultiplexer, type MultiplexerTransport } from './ssh-channel-multiplexer'
 
 type WedgedTransport = MultiplexerTransport & { writes: Buffer[]; feed: (chunk: Buffer) => void }
diff --git a/src/main/ssh/ssh-channel-multiplexer.test.ts b/src/main/ssh/ssh-channel-multiplexer.test.ts
index 3f4e058791d..5a2d82ef8d6 100644
--- a/src/main/ssh/ssh-channel-multiplexer.test.ts
+++ b/src/main/ssh/ssh-channel-multiplexer.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
 import { SshChannelMultiplexer, type MultiplexerTransport } from './ssh-channel-multiplexer'
-import { encodeFrame, MessageType, encodeKeepAliveFrame } from './remote-frame-protocol'
+import { encodeFrame, MessageType, encodeKeepAliveFrame } from './remote-exec/remote-frame-protocol'
 import { HEADER_LENGTH } from '../../shared/relay-frame-decoder'
 
 function createMockTransport(): MultiplexerTransport & {
diff --git a/src/main/ssh/ssh-channel-multiplexer.ts b/src/main/ssh/ssh-channel-multiplexer.ts
index 12bf62c2781..e9b2f93d5b1 100644
--- a/src/main/ssh/ssh-channel-multiplexer.ts
+++ b/src/main/ssh/ssh-channel-multiplexer.ts
@@ -12,7 +12,7 @@ import {
   type JsonRpcRequest,
   type JsonRpcResponse,
   type JsonRpcNotification
-} from './remote-frame-protocol'
+} from './remote-exec/remote-frame-protocol'
 import {
   SshMultiplexerTransportWriter,
   type MultiplexerTransport,
diff --git a/src/main/ssh/ssh-connection-auth-fallback.test.ts b/src/main/ssh/ssh-connection-auth-fallback.test.ts
index 4fdd70fb4c5..ffccecf5f26 100644
--- a/src/main/ssh/ssh-connection-auth-fallback.test.ts
+++ b/src/main/ssh/ssh-connection-auth-fallback.test.ts
@@ -16,24 +16,24 @@ import {
   walkInitialAuthLadder
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -41,10 +41,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-channel-error.test.ts b/src/main/ssh/ssh-connection-channel-error.test.ts
index 5d742020034..717c6011944 100644
--- a/src/main/ssh/ssh-connection-channel-error.test.ts
+++ b/src/main/ssh/ssh-connection-channel-error.test.ts
@@ -6,21 +6,21 @@ import { resetSshConnectionMocks, ssh2Mock } from './ssh-connection-test-harness
 import * as sshClientMock from './__tests__/ssh-connection-test-client'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -28,10 +28,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-channel-open.test.ts b/src/main/ssh/ssh-connection-channel-open.test.ts
index 6ae28e10e72..999dd9744e9 100644
--- a/src/main/ssh/ssh-connection-channel-open.test.ts
+++ b/src/main/ssh/ssh-connection-channel-open.test.ts
@@ -11,21 +11,21 @@ import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -33,10 +33,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-direct-startup.test.ts b/src/main/ssh/ssh-connection-direct-startup.test.ts
index 10b7731374c..761184083e8 100644
--- a/src/main/ssh/ssh-connection-direct-startup.test.ts
+++ b/src/main/ssh/ssh-connection-direct-startup.test.ts
@@ -4,24 +4,24 @@ import { resetSshConnectionMocks, spawnSystemSshCommandMock } from './ssh-connec
 import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
 import type { createSystemCommandChannel } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -29,10 +29,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-file-transfer.test.ts b/src/main/ssh/ssh-connection-file-transfer.test.ts
index 3b176ccb125..48a43b73301 100644
--- a/src/main/ssh/ssh-connection-file-transfer.test.ts
+++ b/src/main/ssh/ssh-connection-file-transfer.test.ts
@@ -2,31 +2,34 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 import { resetSshConnectionMocks } from './ssh-connection-test-harness'
 import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
 import {
   downloadFileViaSystemSsh,
   uploadFileViaSystemSsh,
   writeBufferViaSystemSsh
-} from './system-ssh-file-binary-transfer'
-import { uploadDirectoryViaSystemSsh, writeFileViaSystemSsh } from './system-ssh-file-transfer'
+} from './system-transport/system-ssh-file-binary-transfer'
+import {
+  uploadDirectoryViaSystemSsh,
+  writeFileViaSystemSsh
+} from './system-transport/system-ssh-file-transfer'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -34,10 +37,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-file-transfers.ts b/src/main/ssh/ssh-connection-file-transfers.ts
index c15a0880586..930d7303dfa 100644
--- a/src/main/ssh/ssh-connection-file-transfers.ts
+++ b/src/main/ssh/ssh-connection-file-transfers.ts
@@ -14,9 +14,12 @@ import {
   downloadFileViaSystemSsh,
   uploadFileViaSystemSsh,
   writeBufferViaSystemSsh
-} from './system-ssh-file-binary-transfer'
-import { uploadDirectoryViaSystemSsh, writeFileViaSystemSsh } from './system-ssh-file-transfer'
-import type { SystemSshBuildArgsOptions } from './system-ssh-args'
+} from './system-transport/system-ssh-file-binary-transfer'
+import {
+  uploadDirectoryViaSystemSsh,
+  writeFileViaSystemSsh
+} from './system-transport/system-ssh-file-transfer'
+import type { SystemSshBuildArgsOptions } from './system-transport/system-ssh-args'
 
 export type SshRemoteFileOptions = {
   hostPlatform?: RemoteHostPlatform
diff --git a/src/main/ssh/ssh-connection-github-probe.test.ts b/src/main/ssh/ssh-connection-github-probe.test.ts
index e825fc28a28..43519f474d5 100644
--- a/src/main/ssh/ssh-connection-github-probe.test.ts
+++ b/src/main/ssh/ssh-connection-github-probe.test.ts
@@ -7,24 +7,24 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -32,10 +32,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-gssapi-fallback.test.ts b/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
index 41a6e67fff0..46ad95b9145 100644
--- a/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
+++ b/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
@@ -17,24 +17,24 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -42,10 +42,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-host-key-store-wiring.test.ts b/src/main/ssh/ssh-connection-host-key-store-wiring.test.ts
index 5b3a834337f..456aefa212c 100644
--- a/src/main/ssh/ssh-connection-host-key-store-wiring.test.ts
+++ b/src/main/ssh/ssh-connection-host-key-store-wiring.test.ts
@@ -15,7 +15,7 @@ import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:f
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 // Type-only, so it is erased before vi.mock's hoisted factory runs.
-import type * as SshGConfigResolution from './ssh-g-config-resolution'
+import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
 import type * as Ssh2 from 'ssh2'
 
 const VALID_ED25519_HOST_KEY = Buffer.from(
@@ -76,7 +76,7 @@ vi.mock('ssh2', async (importOriginal) => {
   }
 })
 
-vi.mock('./ssh-g-config-resolution', async (importOriginal) => ({
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) => ({
   ...(await importOriginal<typeof SshGConfigResolution>()),
   resolveWithSshG: vi.fn(async () => null)
 }))
diff --git a/src/main/ssh/ssh-connection-host-key-verification.test.ts b/src/main/ssh/ssh-connection-host-key-verification.test.ts
index f8f82745d5f..1e862f68b9b 100644
--- a/src/main/ssh/ssh-connection-host-key-verification.test.ts
+++ b/src/main/ssh/ssh-connection-host-key-verification.test.ts
@@ -7,21 +7,21 @@ import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -29,10 +29,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-manager-registry.test.ts b/src/main/ssh/ssh-connection-manager-registry.test.ts
index 5352a1ba890..215e0f87419 100644
--- a/src/main/ssh/ssh-connection-manager-registry.test.ts
+++ b/src/main/ssh/ssh-connection-manager-registry.test.ts
@@ -4,21 +4,21 @@ import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnectionManager } from './ssh-connection-manager'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -26,10 +26,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts b/src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts
index 80fdc1a5b28..8614611ace3 100644
--- a/src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts
+++ b/src/main/ssh/ssh-connection-manager-sign-in-reuse.test.ts
@@ -14,21 +14,21 @@ import {
 } from './ssh-credential-decline'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -36,10 +36,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts b/src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts
index 1477c08f650..8118b0d91f6 100644
--- a/src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts
+++ b/src/main/ssh/ssh-connection-reconnect-handshake-loss.test.ts
@@ -12,21 +12,21 @@ import { SshConnection } from './ssh-connection'
 import { CONNECT_TIMEOUT_MS, RECONNECT_BACKOFF_MS } from './ssh-connection-utils'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -34,10 +34,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-reconnect-ladder.test.ts b/src/main/ssh/ssh-connection-reconnect-ladder.test.ts
index 53acff12fd4..28acfbd4c25 100644
--- a/src/main/ssh/ssh-connection-reconnect-ladder.test.ts
+++ b/src/main/ssh/ssh-connection-reconnect-ladder.test.ts
@@ -17,26 +17,26 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
 import { CONNECT_TIMEOUT_MS, RECONNECT_BACKOFF_MS } from './ssh-connection-utils'
 import { MIN_SSH_RELAY_GRACE_PERIOD_SECONDS } from '../../shared/ssh-types'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -44,10 +44,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-sftp-namespace.test.ts b/src/main/ssh/ssh-connection-sftp-namespace.test.ts
index 59b48c3e50f..ea2fa10dace 100644
--- a/src/main/ssh/ssh-connection-sftp-namespace.test.ts
+++ b/src/main/ssh/ssh-connection-sftp-namespace.test.ts
@@ -7,10 +7,10 @@ import { mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as SystemSshArgs from './system-ssh-args'
-import type * as SystemSshFileBinaryTransfer from './system-ssh-file-binary-transfer'
-import type * as SystemSshFileTransfer from './system-ssh-file-transfer'
-import type * as SshGConfigResolution from './ssh-g-config-resolution'
+import type * as SystemSshArgs from './system-transport/system-ssh-args'
+import type * as SystemSshFileBinaryTransfer from './system-transport/system-ssh-file-binary-transfer'
+import type * as SystemSshFileTransfer from './system-transport/system-ssh-file-transfer'
+import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
 
 vi.mock('ssh2', () => ({
   BaseAgent: class {},
@@ -19,25 +19,28 @@ vi.mock('ssh2', () => ({
   utils: { parseKey: vi.fn() }
 }))
 
-vi.mock('./system-ssh-args', async (importOriginal) => ({
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) => ({
   ...(await importOriginal<typeof SystemSshArgs>()),
   getOrcaControlSocketPath: vi.fn().mockReturnValue(null)
 }))
-vi.mock('./system-ssh-command', () => ({ spawnSystemSsh: vi.fn(), spawnSystemSshCommand: vi.fn() }))
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) => ({
+vi.mock('./system-transport/system-ssh-command', () => ({
+  spawnSystemSsh: vi.fn(),
+  spawnSystemSshCommand: vi.fn()
+}))
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) => ({
   ...(await importOriginal<typeof SystemSshFileBinaryTransfer>()),
   downloadFileViaSystemSsh: vi.fn().mockResolvedValue(undefined),
   uploadFileViaSystemSsh: vi.fn().mockResolvedValue(undefined),
   writeBufferViaSystemSsh: vi.fn().mockResolvedValue(undefined)
 }))
-vi.mock('./system-ssh-file-transfer', async (importOriginal) => ({
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) => ({
   ...(await importOriginal<typeof SystemSshFileTransfer>()),
   uploadDirectoryViaSystemSsh: vi.fn().mockResolvedValue(undefined),
   writeFileViaSystemSsh: vi.fn().mockResolvedValue(undefined)
 }))
 
 vi.mock('./ssh-control-socket', () => ({ removeControlSocketPath: vi.fn() }))
-vi.mock('./ssh-g-config-resolution', async (importOriginal) => ({
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) => ({
   ...(await importOriginal<typeof SshGConfigResolution>()),
   resolveWithSshG: vi.fn().mockResolvedValue(null)
 }))
@@ -46,7 +49,10 @@ import { SshConnection } from './ssh-connection'
 import type { SftpNamespacePathMapping } from './sftp-namespace-resolution'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 import { isSshSessionLimitError } from './ssh-session-limit-error'
-import { uploadDirectoryViaSystemSsh, writeFileViaSystemSsh } from './system-ssh-file-transfer'
+import {
+  uploadDirectoryViaSystemSsh,
+  writeFileViaSystemSsh
+} from './system-transport/system-ssh-file-transfer'
 import type { SshTarget } from '../../shared/ssh-types'
 
 const SHELL_HOME = '/var/services/homes/alice'
diff --git a/src/main/ssh/ssh-connection-store-orcad-ownership.test.ts b/src/main/ssh/ssh-connection-store-orcad-ownership.test.ts
index 0b5dfd0d8b7..9d306eb8e30 100644
--- a/src/main/ssh/ssh-connection-store-orcad-ownership.test.ts
+++ b/src/main/ssh/ssh-connection-store-orcad-ownership.test.ts
@@ -12,7 +12,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh-config-parser', () => ({
+vi.mock('./config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/ssh/ssh-connection-store.test.ts b/src/main/ssh/ssh-connection-store.test.ts
index 03b7dd54fc9..9507e993e30 100644
--- a/src/main/ssh/ssh-connection-store.test.ts
+++ b/src/main/ssh/ssh-connection-store.test.ts
@@ -8,7 +8,7 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-vi.mock('./ssh-config-parser', () => ({
+vi.mock('./config/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
 }))
diff --git a/src/main/ssh/ssh-connection-store.ts b/src/main/ssh/ssh-connection-store.ts
index e2b6ba74550..e032d1928a5 100644
--- a/src/main/ssh/ssh-connection-store.ts
+++ b/src/main/ssh/ssh-connection-store.ts
@@ -2,7 +2,7 @@ import type { Store } from '../persistence'
 import type { SshRepoReadoption, SshTarget } from '../../shared/ssh-types'
 import { RUNTIME_OWNED_SSH_TARGET_ID_PREFIX } from '../../shared/execution-host'
 import { normalizeSshConfigAlias } from '../../shared/ssh-config-alias'
-import { loadUserSshConfig, sshConfigHostsToTargets } from './ssh-config-parser'
+import { loadUserSshConfig, sshConfigHostsToTargets } from './config/ssh-config-parser'
 import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
 import {
   buildRemovedSshTargetTombstone,
diff --git a/src/main/ssh/ssh-connection-system-transport.test.ts b/src/main/ssh/ssh-connection-system-transport.test.ts
index 461a541d39f..b8c1f3e370b 100644
--- a/src/main/ssh/ssh-connection-system-transport.test.ts
+++ b/src/main/ssh/ssh-connection-system-transport.test.ts
@@ -21,8 +21,8 @@ import {
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
 import { shouldUseSystemSshTransport } from './ssh-transport-selection'
-import { resolveWithSshG } from './ssh-g-config-resolution'
-import { writeFileViaSystemSsh } from './system-ssh-file-transfer'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import { writeFileViaSystemSsh } from './system-transport/system-ssh-file-transfer'
 import { CONNECT_TIMEOUT_MS } from './ssh-connection-utils'
 import type { SshTarget } from '../../shared/ssh-types'
 import {
@@ -31,21 +31,21 @@ import {
 } from './ssh-security-key-identity.test-fixture'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -53,10 +53,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection-test-fixtures.ts b/src/main/ssh/ssh-connection-test-fixtures.ts
index 45de1425340..5c8b9c568c6 100644
--- a/src/main/ssh/ssh-connection-test-fixtures.ts
+++ b/src/main/ssh/ssh-connection-test-fixtures.ts
@@ -3,7 +3,7 @@ import { vi } from 'vitest'
 import type { Mock } from 'vitest'
 import type { AnyAuthMethod, AuthenticationType } from 'ssh2'
 import type { SshConnectionCallbacks } from './ssh-connection-utils'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 import type { SshTarget } from '../../shared/ssh-types'
 
 export function createTarget(overrides?: Partial<SshTarget>): SshTarget {
diff --git a/src/main/ssh/ssh-connection-test-harness.ts b/src/main/ssh/ssh-connection-test-harness.ts
index 1ad441fd11d..633dbb5b57b 100644
--- a/src/main/ssh/ssh-connection-test-harness.ts
+++ b/src/main/ssh/ssh-connection-test-harness.ts
@@ -2,14 +2,14 @@ import { vi } from 'vitest'
 import { createSystemCommandChannel, createSystemSshProcess } from './ssh-connection-test-fixtures'
 import type { SshConnection } from './ssh-connection'
 import type { MockSystemCommandChannel, MockSystemSshProcess } from './ssh-connection-test-fixtures'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
-import type { SystemSshBuildArgsOptions } from './system-ssh-args'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
+import type { SystemSshBuildArgsOptions } from './system-transport/system-ssh-args'
 import type { SshTarget } from '../../shared/ssh-types'
-import type * as SystemSshArgs from './system-ssh-args'
-import type * as SystemSshCommand from './system-ssh-command'
-import type * as SystemSshFileBinaryTransfer from './system-ssh-file-binary-transfer'
-import type * as SystemSshFileTransfer from './system-ssh-file-transfer'
-import type * as SshGConfigResolution from './ssh-g-config-resolution'
+import type * as SystemSshArgs from './system-transport/system-ssh-args'
+import type * as SystemSshCommand from './system-transport/system-ssh-command'
+import type * as SystemSshFileBinaryTransfer from './system-transport/system-ssh-file-binary-transfer'
+import type * as SystemSshFileTransfer from './system-transport/system-ssh-file-transfer'
+import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
 import { resetSsh2ClientState, ssh2Mock } from './__tests__/ssh-connection-test-client'
 export {
   clientInstances,
diff --git a/src/main/ssh/ssh-connection-utils.test.ts b/src/main/ssh/ssh-connection-utils.test.ts
index bd1ea5fbf7e..9edbb5331a1 100644
--- a/src/main/ssh/ssh-connection-utils.test.ts
+++ b/src/main/ssh/ssh-connection-utils.test.ts
@@ -32,7 +32,7 @@ import { findDefaultKeyFile, resolveAgentSocket } from './ssh-auth-resolution'
 import { resolveEffectiveProxy } from './ssh-proxy-command'
 import { walkInitialAuthLadder } from './ssh-connection-test-fixtures'
 import type { SshTarget } from '../../shared/ssh-types'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 
 // ── isTransientError ─────────────────────────────────────────────────
 
diff --git a/src/main/ssh/ssh-connection-utils.ts b/src/main/ssh/ssh-connection-utils.ts
index 8a95b54c57c..6598fee3c65 100644
--- a/src/main/ssh/ssh-connection-utils.ts
+++ b/src/main/ssh/ssh-connection-utils.ts
@@ -1,6 +1,6 @@
 import type { ConnectConfig } from 'ssh2'
 import type { SshTarget, SshConnectionState } from '../../shared/ssh-types'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 import {
   findEncryptedPrivateKeyPath,
   isUnencryptedPrivateKey,
@@ -10,7 +10,7 @@ import {
   resolveUnencryptedExplicitPrivateKeys
 } from './ssh-auth-resolution'
 import { configurePrivateKeyAuthentication } from './ssh-private-key-authentication'
-import { isOpenSshConfigBackedTarget } from './system-ssh-args'
+import { isOpenSshConfigBackedTarget } from './system-transport/system-ssh-args'
 
 export type SshCredentialKind = 'passphrase' | 'password' | 'keyboard-interactive'
 
diff --git a/src/main/ssh/ssh-connection-wake-retry.test.ts b/src/main/ssh/ssh-connection-wake-retry.test.ts
index afcc34d74d2..d431fd9c7d1 100644
--- a/src/main/ssh/ssh-connection-wake-retry.test.ts
+++ b/src/main/ssh/ssh-connection-wake-retry.test.ts
@@ -16,27 +16,27 @@ import {
   createTarget
 } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
-import { resolveWithSshG } from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
 import { SshConnectionManager } from './ssh-connection-manager'
 import { RECONNECT_BACKOFF_MS } from './ssh-connection-utils'
 import { recordSshUserDisconnected, resetSshUserDisconnectsForTests } from './ssh-user-disconnect'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -44,10 +44,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection.test.ts b/src/main/ssh/ssh-connection.test.ts
index 1239f45c182..41c2d6cf03b 100644
--- a/src/main/ssh/ssh-connection.test.ts
+++ b/src/main/ssh/ssh-connection.test.ts
@@ -12,21 +12,21 @@ import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
 import { SshConnection } from './ssh-connection'
 
 vi.mock('ssh2', async () => (await import('./ssh-connection-test-harness')).createSsh2Module())
-vi.mock('./system-ssh-binary', async () =>
+vi.mock('./system-transport/system-ssh-binary', async () =>
   (await import('./ssh-connection-test-harness')).createSystemSshBinaryModule()
 )
-vi.mock('./system-ssh-args', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-args', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshArgsMocks(await importOriginal())
 )
-vi.mock('./system-ssh-command', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-command', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshCommandMocks(await importOriginal())
 )
-vi.mock('./system-ssh-file-binary-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-binary-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileBinaryTransferMocks(
     await importOriginal()
   )
 )
-vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
+vi.mock('./system-transport/system-ssh-file-transfer', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSystemSshFileTransferMocks(
     await importOriginal()
   )
@@ -34,10 +34,10 @@ vi.mock('./system-ssh-file-transfer', async (importOriginal) =>
 vi.mock('./ssh-control-socket', async () =>
   (await import('./ssh-connection-test-harness')).createControlSocketModule()
 )
-vi.mock('./ssh-config-parser', async () =>
+vi.mock('./config/ssh-config-parser', async () =>
   (await import('./ssh-connection-test-harness')).createSshConfigParserModule()
 )
-vi.mock('./ssh-g-config-resolution', async (importOriginal) =>
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) =>
   (await import('./ssh-connection-test-harness')).withSshGConfigResolutionMocks(
     await importOriginal()
   )
diff --git a/src/main/ssh/ssh-connection.ts b/src/main/ssh/ssh-connection.ts
index d17ca46b8ed..1d638dcfdef 100644
--- a/src/main/ssh/ssh-connection.ts
+++ b/src/main/ssh/ssh-connection.ts
@@ -25,8 +25,8 @@ import {
   getOrcaControlSocketPath,
   isOpenSshConfigBackedTarget,
   type SystemSshBuildArgsOptions
-} from './system-ssh-args'
-import { spawnSystemSshCommand } from './system-ssh-command'
+} from './system-transport/system-ssh-args'
+import { spawnSystemSshCommand } from './system-transport/system-ssh-command'
 import { removeControlSocketPath } from './ssh-control-socket'
 import {
   INITIAL_RETRY_ATTEMPTS,
@@ -61,7 +61,7 @@ import {
   siteConfigMayRestrictHostKeys,
   sshGArgsForHost,
   type SshResolvedConfig
-} from './ssh-g-config-resolution'
+} from './config/ssh-g-config-resolution'
 import {
   boundSshHostKeyStoreFile,
   loadTrustedHostKeys,
@@ -73,7 +73,7 @@ import {
   loadKnownHostsEvidence,
   resolveKnownHostsFiles,
   resolveKnownHostsLookupHost
-} from './ssh-known-hosts-source'
+} from './config/ssh-known-hosts-source'
 import {
   createCancelledConnectAttemptError,
   isCancelledConnectAttemptError
@@ -83,7 +83,7 @@ import {
   isTransientReconnectError
 } from './ssh-reconnect-error-classification'
 import { SshReconnectLadder } from './ssh-reconnect-ladder'
-import { mayUserSshConfigClaimAlias } from './ssh-config-alias-claim'
+import { mayUserSshConfigClaimAlias } from './config/ssh-config-alias-claim'
 import {
   didDeferKeyboardInteractive,
   didOfferKeyboardInteractive,
diff --git a/src/main/ssh/ssh-control-socket.ts b/src/main/ssh/ssh-control-socket.ts
index 4020a9459f8..78cd1b490b0 100644
--- a/src/main/ssh/ssh-control-socket.ts
+++ b/src/main/ssh/ssh-control-socket.ts
@@ -3,7 +3,7 @@ import { lstatSync, mkdirSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { isAbsolute, join as pathJoin } from 'node:path'
 import type { SshTarget } from '../../shared/ssh-types'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 
 export type SystemSshResolvedConfig = Pick<
   SshResolvedConfig,
diff --git a/src/main/ssh/ssh-credential-prompt-login-grace-wire.test.ts b/src/main/ssh/ssh-credential-prompt-login-grace-wire.test.ts
index 7a6dfff5ba9..0bcc8c197ce 100644
--- a/src/main/ssh/ssh-credential-prompt-login-grace-wire.test.ts
+++ b/src/main/ssh/ssh-credential-prompt-login-grace-wire.test.ts
@@ -7,10 +7,10 @@ import { SshConnection } from './ssh-connection'
 import { INITIAL_RETRY_DELAY_MS } from './ssh-connection-utils'
 import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
 import { initSshHostKeyStoreFile } from './ssh-host-key-store'
-import { resolveWithSshG } from './ssh-g-config-resolution'
-import type * as SshGConfigResolution from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
 
-vi.mock('./ssh-g-config-resolution', async (importOriginal) => ({
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) => ({
   ...(await importOriginal<typeof SshGConfigResolution>()),
   resolveWithSshG: vi.fn()
 }))
diff --git a/src/main/ssh/ssh-exec-rc-stdout-noise.test.ts b/src/main/ssh/ssh-exec-rc-stdout-noise.test.ts
index c7af6197b92..f7e00bf66c4 100644
--- a/src/main/ssh/ssh-exec-rc-stdout-noise.test.ts
+++ b/src/main/ssh/ssh-exec-rc-stdout-noise.test.ts
@@ -7,7 +7,7 @@ import { PassThrough } from 'node:stream'
 import { describe, expect, it, vi } from 'vitest'
 import { runProcess } from '@orca/process-host'
 import { wrapRemoteCommandForPosixShell, type SshExecOptions } from './ssh-connection-utils'
-import { execCommand, isSshCommandExitError } from './remote-exec-command'
+import { execCommand, isSshCommandExitError } from './remote-exec/remote-exec-command'
 import { readRemoteHomeCommand } from './ssh-remote-commands'
 import type { SshConnection } from './ssh-connection'
 import { tryResolveViaLoginShell } from './ssh-remote-node-resolution'
diff --git a/src/main/ssh/ssh-exec-stdin-file-transfer.test.ts b/src/main/ssh/ssh-exec-stdin-file-transfer.test.ts
index efd6d01d9cb..1720c386aa8 100644
--- a/src/main/ssh/ssh-exec-stdin-file-transfer.test.ts
+++ b/src/main/ssh/ssh-exec-stdin-file-transfer.test.ts
@@ -24,7 +24,7 @@ import {
   writeStringViaExecStdin
 } from './ssh-exec-stdin-file-transfer'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
-import { makePosixWriteFileCommand } from './system-ssh-file-binary-transfer'
+import { makePosixWriteFileCommand } from './system-transport/system-ssh-file-binary-transfer'
 
 const directories: string[] = []
 afterEach(() => {
diff --git a/src/main/ssh/ssh-exec-stdin-file-transfer.ts b/src/main/ssh/ssh-exec-stdin-file-transfer.ts
index 4bbadd5ad44..d9d750353c4 100644
--- a/src/main/ssh/ssh-exec-stdin-file-transfer.ts
+++ b/src/main/ssh/ssh-exec-stdin-file-transfer.ts
@@ -13,11 +13,11 @@ import { posix } from 'node:path'
 import { Readable } from 'node:stream'
 import type { RemoteInstallTransport } from '../managed-server/install/remote-install-transport'
 import { shellEscape } from './ssh-connection-utils'
-import { execCommand } from './remote-exec-command'
+import { execCommand } from './remote-exec/remote-exec-command'
 import { RELAY_DEPLOY_TIMEOUT_MS } from '../managed-server/install/remote-deploy-timing'
 import type { RemoteHostPlatform } from './ssh-remote-platform'
-import { makePosixWriteFileCommand } from './system-ssh-file-binary-transfer'
-import { collectLocalUploadPlan } from './system-ssh-file-transfer'
+import { makePosixWriteFileCommand } from './system-transport/system-ssh-file-binary-transfer'
+import { collectLocalUploadPlan } from './system-transport/system-ssh-file-transfer'
 
 export const EXEC_STDIN_WRITE_DONE = 'ORCA_EXEC_STDIN_WRITE_DONE'
 
diff --git a/src/main/ssh/ssh-host-key-decision.ts b/src/main/ssh/ssh-host-key-decision.ts
index a42f0463269..02707dcade9 100644
--- a/src/main/ssh/ssh-host-key-decision.ts
+++ b/src/main/ssh/ssh-host-key-decision.ts
@@ -5,7 +5,7 @@
  * rather than importing its sources so a test states its own trust state instead of writing files.
  * See docs/reference/ssh-host-key-verification.md.
  */
-import type { KnownHostsOutcome } from './ssh-known-hosts'
+import type { KnownHostsOutcome } from './config/ssh-known-hosts'
 
 /** Phase 1 ships no dialog; `prompt` is reserved for Phase 2 and never produced today. */
 export type HostKeyAction = 'accept' | 'accept-and-remember' | 'reject' | 'prompt'
diff --git a/src/main/ssh/ssh-host-key-store.ts b/src/main/ssh/ssh-host-key-store.ts
index d764084eb17..a29f009967b 100644
--- a/src/main/ssh/ssh-host-key-store.ts
+++ b/src/main/ssh/ssh-host-key-store.ts
@@ -13,7 +13,7 @@ import {
   readHostKeyType,
   type KnownHostsOutcome,
   type KnownHostsQuery
-} from './ssh-known-hosts'
+} from './config/ssh-known-hosts'
 
 const STORE_FILE_NAME = 'ssh-host-keys.json'
 const STORE_VERSION = 1
diff --git a/src/main/ssh/ssh-host-key-verifier.test.ts b/src/main/ssh/ssh-host-key-verifier.test.ts
index 3edb812ec3d..01cb2a62296 100644
--- a/src/main/ssh/ssh-host-key-verifier.test.ts
+++ b/src/main/ssh/ssh-host-key-verifier.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
-import { parseKnownHosts } from './ssh-known-hosts'
+import { parseKnownHosts } from './config/ssh-known-hosts'
 import {
   createHostKeyVerifier,
   DEFAULT_SERVER_HOST_KEY_ALGORITHMS,
diff --git a/src/main/ssh/ssh-host-key-verifier.ts b/src/main/ssh/ssh-host-key-verifier.ts
index ab1b01aa05d..65da407ee84 100644
--- a/src/main/ssh/ssh-host-key-verifier.ts
+++ b/src/main/ssh/ssh-host-key-verifier.ts
@@ -14,7 +14,7 @@ import {
   readHostKeyType,
   type KnownHostsEntry,
   type KnownHostsOutcome
-} from './ssh-known-hosts'
+} from './config/ssh-known-hosts'
 import { decideHostKey, type HostKeyDecision } from './ssh-host-key-decision'
 
 export type TrustedHostKeyLookup = (query: {
diff --git a/src/main/ssh/ssh-keyboard-interactive-wire.test.ts b/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
index 77f74e90c9c..494503ec137 100644
--- a/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
+++ b/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
@@ -6,10 +6,10 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { SshConnection } from './ssh-connection'
 import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
 import { initSshHostKeyStoreFile } from './ssh-host-key-store'
-import { resolveWithSshG } from './ssh-g-config-resolution'
-import type * as SshGConfigResolution from './ssh-g-config-resolution'
+import { resolveWithSshG } from './config/ssh-g-config-resolution'
+import type * as SshGConfigResolution from './config/ssh-g-config-resolution'
 
-vi.mock('./ssh-g-config-resolution', async (importOriginal) => ({
+vi.mock('./config/ssh-g-config-resolution', async (importOriginal) => ({
   ...(await importOriginal<typeof SshGConfigResolution>()),
   resolveWithSshG: vi.fn()
 }))
diff --git a/src/main/ssh/ssh-multi-factor-authentication.test.ts b/src/main/ssh/ssh-multi-factor-authentication.test.ts
index 694ee8b21dc..cab4c2d4c95 100644
--- a/src/main/ssh/ssh-multi-factor-authentication.test.ts
+++ b/src/main/ssh/ssh-multi-factor-authentication.test.ts
@@ -18,7 +18,7 @@ import {
 } from 'ssh2'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshTarget } from '../../shared/ssh-types'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 import { buildConnectConfig, type BuildConnectConfigOptions } from './ssh-connection-utils'
 
 vi.mock('node:os', async (importOriginal) => {
diff --git a/src/main/ssh/ssh-multi-key-authentication.test.ts b/src/main/ssh/ssh-multi-key-authentication.test.ts
index 7badbfb5cd2..afa3e2b07c1 100644
--- a/src/main/ssh/ssh-multi-key-authentication.test.ts
+++ b/src/main/ssh/ssh-multi-key-authentication.test.ts
@@ -24,10 +24,10 @@ vi.mock('fs', () => ({
 
 import { buildConnectConfig } from './ssh-connection-utils'
 import { getPassphrasePrivateKeyPath } from './ssh-private-key-authentication'
-import { buildSshArgs } from './system-ssh-args'
+import { buildSshArgs } from './system-transport/system-ssh-args'
 import { walkInitialAuthLadder } from './ssh-connection-test-fixtures'
 import type { SshTarget } from '../../shared/ssh-types'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 
 function makeTarget(overrides: Partial<SshTarget> = {}): SshTarget {
   return {
diff --git a/src/main/ssh/ssh-proxy-command.ts b/src/main/ssh/ssh-proxy-command.ts
index a597ab5b55a..8b60a1ad5c7 100644
--- a/src/main/ssh/ssh-proxy-command.ts
+++ b/src/main/ssh/ssh-proxy-command.ts
@@ -3,9 +3,9 @@ import { spawnProcess } from '@orca/process-host'
 import { Duplex } from 'node:stream'
 import type { Socket as NetSocket } from 'node:net'
 import type { SshTarget } from '../../shared/ssh-types'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 import { shellEscape } from './ssh-connection-utils'
-import { isOpenSshConfigBackedTarget } from './system-ssh-args'
+import { isOpenSshConfigBackedTarget } from './system-transport/system-ssh-args'
 
 // Why: ProxyJump and jumpHost are syntactic sugar for ProxyCommand.
 // OpenSSH internally converts `ProxyJump bastion` to
diff --git a/src/main/ssh/ssh-remote-node-install-guidance.ts b/src/main/ssh/ssh-remote-node-install-guidance.ts
index af8b1bba92c..5e08bdc1842 100644
--- a/src/main/ssh/ssh-remote-node-install-guidance.ts
+++ b/src/main/ssh/ssh-remote-node-install-guidance.ts
@@ -1,6 +1,6 @@
 import type { SshConnection } from './ssh-connection'
 import { createSshOperationAbortError } from './ssh-connection-utils'
-import { execCommand } from './remote-exec-command'
+import { execCommand } from './remote-exec/remote-exec-command'
 import { isSshSessionLimitError } from './ssh-session-limit-error'
 
 export type RemoteNodeResolutionOptions = {
diff --git a/src/main/ssh/ssh-remote-node-resolution.test.ts b/src/main/ssh/ssh-remote-node-resolution.test.ts
index 8a01050dbed..7375c772299 100644
--- a/src/main/ssh/ssh-remote-node-resolution.test.ts
+++ b/src/main/ssh/ssh-remote-node-resolution.test.ts
@@ -1,4 +1,4 @@
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 import { execFileSync } from 'node:child_process'
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
@@ -9,7 +9,7 @@ import { getRemoteHostPlatform } from './ssh-remote-platform'
 
 const execCommandMock = vi.hoisted(() => vi.fn())
 
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: execCommandMock
 }))
diff --git a/src/main/ssh/ssh-remote-node-resolution.ts b/src/main/ssh/ssh-remote-node-resolution.ts
index ef58f2004d3..05ff680e6f3 100644
--- a/src/main/ssh/ssh-remote-node-resolution.ts
+++ b/src/main/ssh/ssh-remote-node-resolution.ts
@@ -7,7 +7,7 @@ import {
   buildPosixNodeInstallGuidance,
   type RemoteNodeResolutionOptions
 } from './ssh-remote-node-install-guidance'
-import { execCommand, isSshCommandExitError } from './remote-exec-command'
+import { execCommand, isSshCommandExitError } from './remote-exec/remote-exec-command'
 import {
   buildPosixNodeToolchainProbe,
   buildWindowsNodeToolchainProbe,
diff --git a/src/main/ssh/ssh-remote-platform-detection.test.ts b/src/main/ssh/ssh-remote-platform-detection.test.ts
index a7b3445e609..07e91aa58b6 100644
--- a/src/main/ssh/ssh-remote-platform-detection.test.ts
+++ b/src/main/ssh/ssh-remote-platform-detection.test.ts
@@ -1,11 +1,11 @@
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from './remote-exec/remote-exec-command'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SshConnection } from './ssh-connection'
-import { SSH_EXEC_TIMEOUT_CODE } from './remote-exec-command'
+import { SSH_EXEC_TIMEOUT_CODE } from './remote-exec/remote-exec-command'
 
 const execCommandMock = vi.hoisted(() => vi.fn())
 
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('./remote-exec/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: execCommandMock
 }))
diff --git a/src/main/ssh/ssh-remote-platform-detection.ts b/src/main/ssh/ssh-remote-platform-detection.ts
index 09cc9f0d623..dd20d20fad8 100644
--- a/src/main/ssh/ssh-remote-platform-detection.ts
+++ b/src/main/ssh/ssh-remote-platform-detection.ts
@@ -3,12 +3,12 @@ import {
   getProcessOutputFields,
   iterateProcessOutputLines
 } from '../../shared/process-output-field-scanner'
-import { parseUnameToRelayPlatform, type RelayPlatform } from './remote-frame-protocol'
+import { parseUnameToRelayPlatform, type RelayPlatform } from './remote-exec/remote-frame-protocol'
 import {
   execCommand,
   isSshExecTimeout,
   isUnconfirmedSshCommandTermination
-} from './remote-exec-command'
+} from './remote-exec/remote-exec-command'
 import { isSshSessionLimitError } from './ssh-session-limit-error'
 import { getRemoteHostPlatform, type RemoteHostPlatform } from './ssh-remote-platform'
 import { powerShellCommand } from './ssh-remote-powershell'
diff --git a/src/main/ssh/ssh-remote-platform.ts b/src/main/ssh/ssh-remote-platform.ts
index 1fcd9ede6d7..1b892551900 100644
--- a/src/main/ssh/ssh-remote-platform.ts
+++ b/src/main/ssh/ssh-remote-platform.ts
@@ -1,4 +1,4 @@
-import type { RelayPlatform } from './remote-frame-protocol'
+import type { RelayPlatform } from './remote-exec/remote-frame-protocol'
 
 export type RemotePathFlavor = 'posix' | 'windows'
 export type RemoteCommandDialect = 'posix' | 'powershell'
diff --git a/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts b/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
index 0db271c18be..adc186e1f8c 100644
--- a/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
+++ b/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
@@ -7,7 +7,7 @@ import { decodeRemotePowerShellScript, powerShellCommand } from './ssh-remote-po
 import {
   makeWindowsPublishStagedFileCommand,
   makeWindowsWriteFileCommand
-} from './system-ssh-windows-file-write'
+} from './system-transport/system-ssh-windows-file-write'
 
 const windows = getRemoteHostPlatform('win32-x64')
 // Why: sshd runs an exec request through its DefaultShell, which is cmd.exe on a
diff --git a/src/main/ssh/ssh-security-key-identity.test.ts b/src/main/ssh/ssh-security-key-identity.test.ts
index a16f5d2d96d..026a12d9141 100644
--- a/src/main/ssh/ssh-security-key-identity.test.ts
+++ b/src/main/ssh/ssh-security-key-identity.test.ts
@@ -15,7 +15,7 @@ import { requiresSystemSshForSecurityKey } from './ssh-transport-selection'
 
 const { findSystemSshMock } = vi.hoisted(() => ({ findSystemSshMock: vi.fn() }))
 
-vi.mock('./system-ssh-binary', () => ({ findSystemSsh: findSystemSshMock }))
+vi.mock('./system-transport/system-ssh-binary', () => ({ findSystemSsh: findSystemSshMock }))
 
 vi.mock('node:os', async (importOriginal) => {
   const actual = await importOriginal<{ homedir: () => string }>()
diff --git a/src/main/ssh/ssh-system-transport.integration.test.ts b/src/main/ssh/ssh-system-transport.integration.test.ts
index 81d1daa6439..2df57ba5094 100644
--- a/src/main/ssh/ssh-system-transport.integration.test.ts
+++ b/src/main/ssh/ssh-system-transport.integration.test.ts
@@ -7,7 +7,7 @@ vi.mock('electron', () => ({
 }))
 
 import { SshConnection } from './ssh-connection'
-import { uploadDirectoryViaSystemSsh } from './system-ssh-file-transfer'
+import { uploadDirectoryViaSystemSsh } from './system-transport/system-ssh-file-transfer'
 import type { SshTarget } from '../../shared/ssh-types'
 import { relayArtifactFilenames } from './relay-install-artifacts'
 
diff --git a/src/main/ssh/ssh-transport-selection.ts b/src/main/ssh/ssh-transport-selection.ts
index ffa311eb4d6..8434dedc4c8 100644
--- a/src/main/ssh/ssh-transport-selection.ts
+++ b/src/main/ssh/ssh-transport-selection.ts
@@ -1,16 +1,16 @@
 import { constants } from 'node:fs'
 import { open, stat } from 'node:fs/promises'
 import type { SshTarget } from '../../shared/ssh-types'
-import type { SshResolvedConfig } from './ssh-g-config-resolution'
+import type { SshResolvedConfig } from './config/ssh-g-config-resolution'
 import { listDefaultIdentityFilePaths, resolveIdentityFilePaths } from './ssh-auth-resolution'
-import { resolveSshConfigHomePath } from './ssh-config-path-expansion'
+import { resolveSshConfigHomePath } from './config/ssh-config-path-expansion'
 import {
   MAX_SSH_IDENTITY_FILE_BYTES,
   isOpenSshSecurityKeyPrivateKey,
   isOpenSshSecurityKeyPublicKey
 } from './ssh-security-key-identity'
-import { isOpenSshConfigBackedTarget } from './system-ssh-args'
-import { findSystemSsh } from './system-ssh-binary'
+import { isOpenSshConfigBackedTarget } from './system-transport/system-ssh-args'
+import { findSystemSsh } from './system-transport/system-ssh-binary'
 
 type TransportResolvedConfig = Pick<
   SshResolvedConfig,
diff --git a/src/main/ssh/system-ssh-args.ts b/src/main/ssh/system-transport/system-ssh-args.ts
similarity index 99%
rename from src/main/ssh/system-ssh-args.ts
rename to src/main/ssh/system-transport/system-ssh-args.ts
index 6cf77af4b10..e2134681fa7 100644
--- a/src/main/ssh/system-ssh-args.ts
+++ b/src/main/ssh/system-transport/system-ssh-args.ts
@@ -1,5 +1,5 @@
-import type { SshTarget } from '../../shared/ssh-types'
-import { getControlSocketPath, type SystemSshResolvedConfig } from './ssh-control-socket'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { getControlSocketPath, type SystemSshResolvedConfig } from '../ssh-control-socket'
 
 export type SystemSshBuildArgsOptions = {
   configFile?: string
diff --git a/src/main/ssh/system-ssh-binary.test.ts b/src/main/ssh/system-transport/system-ssh-binary.test.ts
similarity index 100%
rename from src/main/ssh/system-ssh-binary.test.ts
rename to src/main/ssh/system-transport/system-ssh-binary.test.ts
diff --git a/src/main/ssh/system-ssh-binary.ts b/src/main/ssh/system-transport/system-ssh-binary.ts
similarity index 100%
rename from src/main/ssh/system-ssh-binary.ts
rename to src/main/ssh/system-transport/system-ssh-binary.ts
diff --git a/src/main/ssh/system-ssh-command.ts b/src/main/ssh/system-transport/system-ssh-command.ts
similarity index 98%
rename from src/main/ssh/system-ssh-command.ts
rename to src/main/ssh/system-transport/system-ssh-command.ts
index 15f099a5f88..f75931588a0 100644
--- a/src/main/ssh/system-ssh-command.ts
+++ b/src/main/ssh/system-transport/system-ssh-command.ts
@@ -1,8 +1,8 @@
 import { spawn, type ChildProcess } from 'node:child_process'
 import { Duplex } from 'node:stream'
 import type { ClientChannel } from 'ssh2'
-import type { SshTarget } from '../../shared/ssh-types'
-import { wrapRemoteCommandForPosixShell, type SshExecOptions } from './ssh-connection-utils'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { wrapRemoteCommandForPosixShell, type SshExecOptions } from '../ssh-connection-utils'
 import { buildSshArgs, type SystemSshBuildArgsOptions } from './system-ssh-args'
 import { findSystemSsh } from './system-ssh-binary'
 
diff --git a/src/main/ssh/system-ssh-dynamic-forward-process.test.ts b/src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts
similarity index 100%
rename from src/main/ssh/system-ssh-dynamic-forward-process.test.ts
rename to src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts
diff --git a/src/main/ssh/system-ssh-dynamic-forward-process.ts b/src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts
similarity index 98%
rename from src/main/ssh/system-ssh-dynamic-forward-process.ts
rename to src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts
index e036dacd927..07cc7d1f101 100644
--- a/src/main/ssh/system-ssh-dynamic-forward-process.ts
+++ b/src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts
@@ -1,6 +1,6 @@
 import { spawn, type ChildProcess } from 'node:child_process'
 import { connect, createServer, type AddressInfo, type Socket } from 'node:net'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { buildSshArgs, type SystemSshBuildArgsOptions } from './system-ssh-args'
 import { findSystemSsh } from './system-ssh-binary'
 import { waitForSystemSshForwardStop } from './system-ssh-forward-process'
diff --git a/src/main/ssh/system-ssh-file-binary-transfer.ts b/src/main/ssh/system-transport/system-ssh-file-binary-transfer.ts
similarity index 96%
rename from src/main/ssh/system-ssh-file-binary-transfer.ts
rename to src/main/ssh/system-transport/system-ssh-file-binary-transfer.ts
index 8ab036563c9..e7ce97f0bf3 100644
--- a/src/main/ssh/system-ssh-file-binary-transfer.ts
+++ b/src/main/ssh/system-transport/system-ssh-file-binary-transfer.ts
@@ -4,16 +4,16 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import type { Writable } from 'node:stream'
 import { pipeline } from 'node:stream/promises'
-import type { SshTarget } from '../../shared/ssh-types'
-import { shellEscape } from './ssh-connection-utils'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { shellEscape } from '../ssh-connection-utils'
 import {
   getSystemSshBuildArgsFromOperationOptions,
   type SystemSshBuildArgsOptions
 } from './system-ssh-args'
 import { spawnSystemSshCommand } from './system-ssh-command'
-import { isWindowsRemoteHost, type RemoteHostPlatform } from './ssh-remote-platform'
-import { powerShellCommand } from './ssh-remote-powershell'
-import { quotePowerShellLiteral as powerShellLiteral } from '../../shared/powershell-native-argument'
+import { isWindowsRemoteHost, type RemoteHostPlatform } from '../ssh-remote-platform'
+import { powerShellCommand } from '../ssh-remote-powershell'
+import { quotePowerShellLiteral as powerShellLiteral } from '../../../shared/powershell-native-argument'
 import {
   awaitWithSystemSshAbort,
   throwIfAborted,
diff --git a/src/main/ssh/system-ssh-file-transfer.ts b/src/main/ssh/system-transport/system-ssh-file-transfer.ts
similarity index 96%
rename from src/main/ssh/system-ssh-file-transfer.ts
rename to src/main/ssh/system-transport/system-ssh-file-transfer.ts
index 377435440fe..4c6ea1e16e2 100644
--- a/src/main/ssh/system-ssh-file-transfer.ts
+++ b/src/main/ssh/system-transport/system-ssh-file-transfer.ts
@@ -1,10 +1,10 @@
-import { DirectoryTransferBudget } from './ssh-directory-transfer-budget'
+import { DirectoryTransferBudget } from '../ssh-directory-transfer-budget'
 import { spawn, type ChildProcess } from 'node:child_process'
 import { lstat, opendir } from 'node:fs/promises'
 import { join as pathJoin } from 'node:path'
 import { pipeline } from 'node:stream/promises'
-import type { SshTarget } from '../../shared/ssh-types'
-import { shellEscape, wrapRemoteCommandForPosixShell } from './ssh-connection-utils'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { shellEscape, wrapRemoteCommandForPosixShell } from '../ssh-connection-utils'
 import { findSystemSsh } from './system-ssh-binary'
 import {
   buildSshArgs,
@@ -12,8 +12,12 @@ import {
   type SystemSshBuildArgsOptions
 } from './system-ssh-args'
 import { spawnSystemSshCommand } from './system-ssh-command'
-import { isWindowsRemoteHost, joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
-import { powerShellCommand } from './ssh-remote-powershell'
+import {
+  isWindowsRemoteHost,
+  joinRemotePath,
+  type RemoteHostPlatform
+} from '../ssh-remote-platform'
+import { powerShellCommand } from '../ssh-remote-powershell'
 import {
   awaitWithSystemSshAbort,
   killProcess,
diff --git a/src/main/ssh/system-ssh-forward-process.test.ts b/src/main/ssh/system-transport/system-ssh-forward-process.test.ts
similarity index 99%
rename from src/main/ssh/system-ssh-forward-process.test.ts
rename to src/main/ssh/system-transport/system-ssh-forward-process.test.ts
index cefc09915db..05c4b299e2d 100644
--- a/src/main/ssh/system-ssh-forward-process.test.ts
+++ b/src/main/ssh/system-transport/system-ssh-forward-process.test.ts
@@ -43,7 +43,7 @@ import {
   waitForSystemSshForwardStartup,
   waitForSystemSshForwardStop
 } from './system-ssh-forward-process'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 const SYSTEM_SSH_PATH =
   process.platform === 'win32' ? 'C:\\Windows\\System32\\OpenSSH\\ssh.exe' : '/usr/bin/ssh'
diff --git a/src/main/ssh/system-ssh-forward-process.ts b/src/main/ssh/system-transport/system-ssh-forward-process.ts
similarity index 99%
rename from src/main/ssh/system-ssh-forward-process.ts
rename to src/main/ssh/system-transport/system-ssh-forward-process.ts
index a79a1086947..964d81da3a1 100644
--- a/src/main/ssh/system-ssh-forward-process.ts
+++ b/src/main/ssh/system-transport/system-ssh-forward-process.ts
@@ -3,7 +3,7 @@ import { connect, createServer } from 'node:net'
 import { buildSshArgs, type SystemSshBuildArgsOptions } from './system-ssh-args'
 import { findSystemSsh } from './system-ssh-binary'
 import { stopOrphanedOrcaSshForward } from './system-ssh-orphaned-forward'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 export const SYSTEM_SSH_FORWARD_STARTUP_GRACE_MS = 750
 export const SYSTEM_SSH_FORWARD_LISTENER_PROBE_INTERVAL_MS = 50
diff --git a/src/main/ssh/system-ssh-operation-lifecycle.ts b/src/main/ssh/system-transport/system-ssh-operation-lifecycle.ts
similarity index 100%
rename from src/main/ssh/system-ssh-operation-lifecycle.ts
rename to src/main/ssh/system-transport/system-ssh-operation-lifecycle.ts
diff --git a/src/main/ssh/system-ssh-operations.test.ts b/src/main/ssh/system-transport/system-ssh-operations.test.ts
similarity index 99%
rename from src/main/ssh/system-ssh-operations.test.ts
rename to src/main/ssh/system-transport/system-ssh-operations.test.ts
index 5f3347509ff..59f58d971b1 100644
--- a/src/main/ssh/system-ssh-operations.test.ts
+++ b/src/main/ssh/system-transport/system-ssh-operations.test.ts
@@ -30,9 +30,9 @@ import {
 } from './system-ssh-file-binary-transfer'
 import { spawnSystemSsh, spawnSystemSshCommand } from './system-ssh-command'
 import { uploadDirectoryViaSystemSsh, writeFileViaSystemSsh } from './system-ssh-file-transfer'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { SystemSshResolvedConfig } from './ssh-control-socket'
+import { getRemoteHostPlatform } from '../ssh-remote-platform'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { SystemSshResolvedConfig } from '../ssh-control-socket'
 
 const SYSTEM_SSH_PATH =
   process.platform === 'win32' ? 'C:\\Windows\\System32\\OpenSSH\\ssh.exe' : '/usr/bin/ssh'
diff --git a/src/main/ssh/system-ssh-orphaned-forward.test.ts b/src/main/ssh/system-transport/system-ssh-orphaned-forward.test.ts
similarity index 100%
rename from src/main/ssh/system-ssh-orphaned-forward.test.ts
rename to src/main/ssh/system-transport/system-ssh-orphaned-forward.test.ts
diff --git a/src/main/ssh/system-ssh-orphaned-forward.ts b/src/main/ssh/system-transport/system-ssh-orphaned-forward.ts
similarity index 96%
rename from src/main/ssh/system-ssh-orphaned-forward.ts
rename to src/main/ssh/system-transport/system-ssh-orphaned-forward.ts
index 237d68905fe..2fa75291dc8 100644
--- a/src/main/ssh/system-ssh-orphaned-forward.ts
+++ b/src/main/ssh/system-transport/system-ssh-orphaned-forward.ts
@@ -5,12 +5,12 @@
  * Orca would spawn for this same forward and host, and whose parent is gone, qualifies: a user's
  * own ssh and a live Orca's tunnel never match.
  */
-import { getFreshShellForegroundSnapshot } from '../../shared/process-table-snapshot-reader'
-import { readWindowsProcessTableFresh } from '../windows/windows-process-table'
+import { getFreshShellForegroundSnapshot } from '../../../shared/process-table-snapshot-reader'
+import { readWindowsProcessTableFresh } from '../../windows/windows-process-table'
 import {
   PROCESS_START_TIME_TOLERANCE_MS,
   readProcessStartTimeMs
-} from '../runtime/agent-session-process-identity-probe'
+} from '../../runtime/agent-session-process-identity-probe'
 
 export type SshForwardProcessRow = {
   pid: number
diff --git a/src/main/ssh/system-ssh-sftp-args.test.ts b/src/main/ssh/system-transport/system-ssh-sftp-args.test.ts
similarity index 100%
rename from src/main/ssh/system-ssh-sftp-args.test.ts
rename to src/main/ssh/system-transport/system-ssh-sftp-args.test.ts
diff --git a/src/main/ssh/system-ssh-sftp-args.ts b/src/main/ssh/system-transport/system-ssh-sftp-args.ts
similarity index 100%
rename from src/main/ssh/system-ssh-sftp-args.ts
rename to src/main/ssh/system-transport/system-ssh-sftp-args.ts
diff --git a/src/main/ssh/system-ssh-sftp-path.test.ts b/src/main/ssh/system-transport/system-ssh-sftp-path.test.ts
similarity index 100%
rename from src/main/ssh/system-ssh-sftp-path.test.ts
rename to src/main/ssh/system-transport/system-ssh-sftp-path.test.ts
diff --git a/src/main/ssh/system-ssh-sftp-path.ts b/src/main/ssh/system-transport/system-ssh-sftp-path.ts
similarity index 96%
rename from src/main/ssh/system-ssh-sftp-path.ts
rename to src/main/ssh/system-transport/system-ssh-sftp-path.ts
index 2b5bfe53f02..dcc4fdb36e6 100644
--- a/src/main/ssh/system-ssh-sftp-path.ts
+++ b/src/main/ssh/system-transport/system-ssh-sftp-path.ts
@@ -1,4 +1,4 @@
-import { normalizeWindowsRemotePath } from './ssh-remote-platform'
+import { normalizeWindowsRemotePath } from '../ssh-remote-platform'
 
 /**
  * A path this transfer cannot express to sftp. Callers treat it as "use another transport", never
diff --git a/src/main/ssh/system-ssh-sftp-transfer.ts b/src/main/ssh/system-transport/system-ssh-sftp-transfer.ts
similarity index 99%
rename from src/main/ssh/system-ssh-sftp-transfer.ts
rename to src/main/ssh/system-transport/system-ssh-sftp-transfer.ts
index e0a0a1bc424..058254481a9 100644
--- a/src/main/ssh/system-ssh-sftp-transfer.ts
+++ b/src/main/ssh/system-transport/system-ssh-sftp-transfer.ts
@@ -1,6 +1,6 @@
 import { accessSync, constants, existsSync, statSync } from 'node:fs'
 import { posix, win32 } from 'node:path'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { buildSshArgs, type SystemSshBuildArgsOptions } from './system-ssh-args'
 import { findSystemSsh } from './system-ssh-binary'
 import {
diff --git a/src/main/ssh/system-ssh-upload-plan-budget.test.ts b/src/main/ssh/system-transport/system-ssh-upload-plan-budget.test.ts
similarity index 96%
rename from src/main/ssh/system-ssh-upload-plan-budget.test.ts
rename to src/main/ssh/system-transport/system-ssh-upload-plan-budget.test.ts
index d623c036992..4e95b78fab6 100644
--- a/src/main/ssh/system-ssh-upload-plan-budget.test.ts
+++ b/src/main/ssh/system-transport/system-ssh-upload-plan-budget.test.ts
@@ -7,7 +7,7 @@ vi.mock('node:fs/promises', async (load) => ({
   lstat: stats
 }))
 import { collectLocalUploadPlan } from './system-ssh-file-transfer'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { getRemoteHostPlatform } from '../ssh-remote-platform'
 
 it('stops the upload producer at its retained-plan ceiling before any transfer starts', async () => {
   let visited = 0
diff --git a/src/main/ssh/system-ssh-windows-file-write.ts b/src/main/ssh/system-transport/system-ssh-windows-file-write.ts
similarity index 97%
rename from src/main/ssh/system-ssh-windows-file-write.ts
rename to src/main/ssh/system-transport/system-ssh-windows-file-write.ts
index 5efc788aa77..2d56a23ea98 100644
--- a/src/main/ssh/system-ssh-windows-file-write.ts
+++ b/src/main/ssh/system-transport/system-ssh-windows-file-write.ts
@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto'
-import { powerShellCommand } from './ssh-remote-powershell'
-import { quotePowerShellLiteral as powerShellLiteral } from '../../shared/powershell-native-argument'
-import { normalizeWindowsRemotePath } from './ssh-remote-platform'
+import { powerShellCommand } from '../ssh-remote-powershell'
+import { quotePowerShellLiteral as powerShellLiteral } from '../../../shared/powershell-native-argument'
+import { normalizeWindowsRemotePath } from '../ssh-remote-platform'
 
 /**
  * Suffix marking the path a Windows write lands on before it is published by rename.
diff --git a/src/main/ssh/system-ssh-windows-upload.test.ts b/src/main/ssh/system-transport/system-ssh-windows-upload.test.ts
similarity index 99%
rename from src/main/ssh/system-ssh-windows-upload.test.ts
rename to src/main/ssh/system-transport/system-ssh-windows-upload.test.ts
index 967923aefb7..2f3acdd2101 100644
--- a/src/main/ssh/system-ssh-windows-upload.test.ts
+++ b/src/main/ssh/system-transport/system-ssh-windows-upload.test.ts
@@ -47,7 +47,7 @@ import { uploadFileViaSystemSsh, writeBufferViaSystemSsh } from './system-ssh-fi
 import { WINDOWS_STAGED_WRITE_SUFFIX } from './system-ssh-windows-file-write'
 import { waitForChannelClose } from './system-ssh-operation-lifecycle'
 import * as windowsFileWrite from './system-ssh-windows-file-write'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { getRemoteHostPlatform } from '../ssh-remote-platform'
 import {
   clearWindowsRemoteWriteCapabilitiesForTests,
   getWindowsRemoteWriteCapabilities
@@ -58,7 +58,7 @@ import {
   WINDOWS_STDIN_WRITE_TIMEOUT_MS,
   writeWindowsRemoteFile
 } from './system-ssh-windows-write-strategy'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 type FakeChannel = EventEmitter & {
   stdin: Writable
diff --git a/src/main/ssh/system-ssh-windows-write-capabilities.test.ts b/src/main/ssh/system-transport/system-ssh-windows-write-capabilities.test.ts
similarity index 98%
rename from src/main/ssh/system-ssh-windows-write-capabilities.test.ts
rename to src/main/ssh/system-transport/system-ssh-windows-write-capabilities.test.ts
index 7926341a141..b424389e767 100644
--- a/src/main/ssh/system-ssh-windows-write-capabilities.test.ts
+++ b/src/main/ssh/system-transport/system-ssh-windows-write-capabilities.test.ts
@@ -4,7 +4,7 @@
  * re-probed once per file, and two targets pointing at one machine learn the same fact twice.
  */
 import { afterEach, describe, expect, it } from 'vitest'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 import {
   clearWindowsRemoteWriteCapabilitiesForTests,
   getWindowsRemoteWriteCapabilities,
diff --git a/src/main/ssh/system-ssh-windows-write-capabilities.ts b/src/main/ssh/system-transport/system-ssh-windows-write-capabilities.ts
similarity index 94%
rename from src/main/ssh/system-ssh-windows-write-capabilities.ts
rename to src/main/ssh/system-transport/system-ssh-windows-write-capabilities.ts
index 902818a4158..cb37d2567fd 100644
--- a/src/main/ssh/system-ssh-windows-write-capabilities.ts
+++ b/src/main/ssh/system-transport/system-ssh-windows-write-capabilities.ts
@@ -1,5 +1,5 @@
-import type { SshTarget } from '../../shared/ssh-types'
-import { CapabilityProbeCache } from '../../shared/capability-probe-cache'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { CapabilityProbeCache } from '../../../shared/capability-probe-cache'
 
 /**
  * Whether a Windows host can take a file write over the sftp subsystem, and whether it has a
diff --git a/src/main/ssh/system-ssh-windows-write-strategy.ts b/src/main/ssh/system-transport/system-ssh-windows-write-strategy.ts
similarity index 99%
rename from src/main/ssh/system-ssh-windows-write-strategy.ts
rename to src/main/ssh/system-transport/system-ssh-windows-write-strategy.ts
index e8016db313c..8c1b69622a7 100644
--- a/src/main/ssh/system-ssh-windows-write-strategy.ts
+++ b/src/main/ssh/system-transport/system-ssh-windows-write-strategy.ts
@@ -1,4 +1,4 @@
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { getSystemSshBuildArgsFromOperationOptions } from './system-ssh-args'
 import { spawnSystemSshCommand } from './system-ssh-command'
 import {
diff --git a/src/main/startup/headless-serve-ssh-registration.test.ts b/src/main/startup/headless-serve-ssh-registration.test.ts
index 785cec01c6c..567498b94e5 100644
--- a/src/main/startup/headless-serve-ssh-registration.test.ts
+++ b/src/main/startup/headless-serve-ssh-registration.test.ts
@@ -5,7 +5,7 @@ const mocks = await vi.hoisted(async () => {
   return createSshIpcMocks()
 })
 
-vi.mock('../ssh/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
+vi.mock('../ssh/config/ssh-config-host-picker', () => mocks.sshConfigHostPicker)
 vi.mock('electron', () => mocks.electron)
 vi.mock('../ssh/ssh-connection-store', () => mocks.sshConnectionStore)
 vi.mock('../ipc/ssh-host-server-connect', () => mocks.hostServerConnect)
diff --git a/src/main/worktree-removal-close-records.test.ts b/src/main/worktree-removal-close-records.test.ts
index cfad31f4d20..7762fb79b9f 100644
--- a/src/main/worktree-removal-close-records.test.ts
+++ b/src/main/worktree-removal-close-records.test.ts
@@ -20,7 +20,7 @@ import {
 
 let hasCreatedStoreInCase = false
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/worktree-removal-session-partition-fencing.test.ts b/src/main/worktree-removal-session-partition-fencing.test.ts
index 8a5f1dad8a4..dd04d427f8e 100644
--- a/src/main/worktree-removal-session-partition-fencing.test.ts
+++ b/src/main/worktree-removal-session-partition-fencing.test.ts
@@ -15,7 +15,7 @@ import { toRuntimeExecutionHostId } from '../shared/execution-host'
 
 let hasCreatedStoreInCase = false
 
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
diff --git a/src/main/wsl/wsl-command-loop.test.ts b/src/main/wsl/wsl-command-loop.test.ts
index 8bcc120eebb..c4972575d56 100644
--- a/src/main/wsl/wsl-command-loop.test.ts
+++ b/src/main/wsl/wsl-command-loop.test.ts
@@ -4,7 +4,7 @@ import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import { spawnProcess } from '@orca/process-host'
 import type { PipedChildProcess } from '@orca/process-host/process-spec'
-import { execCommand } from '../ssh/remote-exec-command'
+import { execCommand } from '../ssh/remote-exec/remote-exec-command'
 import { WSL_COMMAND_LOOP_ARGV0, WSL_COMMAND_LOOP_SCRIPT } from './wsl-command-loop'
 import { createWslCommandLoopPool, type WslCommandLoopPool } from './wsl-command-loop-pool'
 
diff --git a/src/main/wsl/wsl-directory-upload.ts b/src/main/wsl/wsl-directory-upload.ts
index c262551a0ef..f8829e9c46a 100644
--- a/src/main/wsl/wsl-directory-upload.ts
+++ b/src/main/wsl/wsl-directory-upload.ts
@@ -11,10 +11,13 @@ import { Readable } from 'node:stream'
 import { parseWslUncPath, toLinuxPath } from '../../shared/wsl-paths'
 import type { RemoteInstallTransport } from '../managed-server/install/remote-install-transport'
 import { shellEscape } from '../ssh/ssh-connection-utils'
-import { execCommand } from '../ssh/remote-exec-command'
+import { execCommand } from '../ssh/remote-exec/remote-exec-command'
 import { RELAY_DEPLOY_TIMEOUT_MS } from '../managed-server/install/remote-deploy-timing'
 import { getRemoteHostPlatform } from '../ssh/ssh-remote-platform'
-import { collectLocalUploadPlan, type LocalUploadPlan } from '../ssh/system-ssh-file-transfer'
+import {
+  collectLocalUploadPlan,
+  type LocalUploadPlan
+} from '../ssh/system-transport/system-ssh-file-transfer'
 import { buildUstarEntryHeader, USTAR_BLOCK_BYTES, ustarPaddingBytes } from '../ustar-entry-header'
 
 export const WSL_GUEST_SOURCE_UNAVAILABLE = 'ORCA_WSL_GUEST_SOURCE_UNAVAILABLE'
diff --git a/src/main/wsl/wsl-guest-process-identity.ts b/src/main/wsl/wsl-guest-process-identity.ts
index 728f2b407dc..f4c9b8c18ac 100644
--- a/src/main/wsl/wsl-guest-process-identity.ts
+++ b/src/main/wsl/wsl-guest-process-identity.ts
@@ -5,7 +5,7 @@
  * a wall-clock start time would then mistake a live process for a new one, or the reverse.
  */
 import type { OrcadHostTransport } from '../ssh/orcad-host-transport'
-import { execCommand } from '../ssh/remote-exec-command'
+import { execCommand } from '../ssh/remote-exec/remote-exec-command'
 
 export type WslGuestIdentity = {
   /** `<boot_id>:<pid 1 start ticks>`; a distro restart (or a VM restart) changes it. */
diff --git a/src/main/wsl/wsl-host-ssh-orcad-conflict.ts b/src/main/wsl/wsl-host-ssh-orcad-conflict.ts
index 6598f9d825f..e8ac3e95269 100644
--- a/src/main/wsl/wsl-host-ssh-orcad-conflict.ts
+++ b/src/main/wsl/wsl-host-ssh-orcad-conflict.ts
@@ -18,7 +18,7 @@ import {
   type KnownRuntimeEnvironment
 } from '../../shared/runtime-environments'
 import type { OrcadHostTransport } from '../ssh/orcad-host-transport'
-import { execCommand } from '../ssh/remote-exec-command'
+import { execCommand } from '../ssh/remote-exec/remote-exec-command'
 
 // Prints only the public half; the private key never leaves the distro.
 const READ_PUBLIC_KEY = `sed -n 's/.*"publicKeyB64"[[:space:]]*:[[:space:]]*"\\([A-Za-z0-9+/=]*\\)".*/\\1/p' "$HOME/.orca/${E2EE_KEYPAIR_FILENAME}" 2>/dev/null | head -n 1`
diff --git a/src/main/wsl/wsl-orcad-deploy.test.ts b/src/main/wsl/wsl-orcad-deploy.test.ts
index 45d330ee634..a91741d61b0 100644
--- a/src/main/wsl/wsl-orcad-deploy.test.ts
+++ b/src/main/wsl/wsl-orcad-deploy.test.ts
@@ -33,7 +33,7 @@ vi.mock('./wsl-orcad-instance-adoption', () => ({ adoptUnrecordedWslOrcad: mocks
 vi.mock('../../shared/app-environment', () => ({
   getAppEnvironment: () => ({ getVersion: () => '1.5.0', getPath: () => '/user-data' })
 }))
-vi.mock('../ssh/remote-exec-command', () => ({ execCommand: mocks.exec }))
+vi.mock('../ssh/remote-exec/remote-exec-command', () => ({ execCommand: mocks.exec }))
 vi.mock('../managed-server/install/orcad-remote-context', () => ({
   resolveOrcadRemoteContext: mocks.resolveContext
 }))
diff --git a/src/main/wsl/wsl-orcad-deploy.ts b/src/main/wsl/wsl-orcad-deploy.ts
index 4e18115ec89..f68200f0f1b 100644
--- a/src/main/wsl/wsl-orcad-deploy.ts
+++ b/src/main/wsl/wsl-orcad-deploy.ts
@@ -28,7 +28,7 @@ import { resolveOrcadRemoteContext } from '../managed-server/install/orcad-remot
 import { deployOrcad } from '../ssh/orcad-remote-deploy'
 import { ORCAD_PID_FILENAME } from '../managed-server/install/orcad-remote-host-support'
 import { shellEscape } from '../ssh/ssh-connection-utils'
-import { execCommand } from '../ssh/remote-exec-command'
+import { execCommand } from '../ssh/remote-exec/remote-exec-command'
 import { joinRemotePath } from '../ssh/ssh-remote-platform'
 import { readLocalFullVersion } from '../managed-server/install/remote-versioned-install'
 import { createWslDistroHolder, type WslDistroHolder } from './wsl-distro-holder'
diff --git a/src/main/wsl/wsl-orcad-host-transport-loops.test.ts b/src/main/wsl/wsl-orcad-host-transport-loops.test.ts
index 8b2a2262e1f..df91578ffe3 100644
--- a/src/main/wsl/wsl-orcad-host-transport-loops.test.ts
+++ b/src/main/wsl/wsl-orcad-host-transport-loops.test.ts
@@ -2,7 +2,7 @@ import { Readable } from 'node:stream'
 import { afterEach, describe, expect, it } from 'vitest'
 import { spawnProcess } from '@orca/process-host'
 import type { PipedChildProcess, PipedProcessSpec } from '@orca/process-host/process-spec'
-import { execCommand } from '../ssh/remote-exec-command'
+import { execCommand } from '../ssh/remote-exec/remote-exec-command'
 import { createWslOrcadHostTransport, type WslOrcadHostTransport } from './wsl-orcad-host-transport'
 
 const posix = process.platform !== 'win32'
diff --git a/src/main/wsl/wsl-orcad-host-transport.test.ts b/src/main/wsl/wsl-orcad-host-transport.test.ts
index 2392667bbf6..a31be8deb1b 100644
--- a/src/main/wsl/wsl-orcad-host-transport.test.ts
+++ b/src/main/wsl/wsl-orcad-host-transport.test.ts
@@ -3,7 +3,7 @@ import { EventEmitter } from 'node:events'
 import { PassThrough, Readable } from 'node:stream'
 import { describe, expect, it, vi } from 'vitest'
 import type { PipedChildProcess, PipedProcessSpec } from '@orca/process-host/process-spec'
-import { execCommand } from '../ssh/remote-exec-command'
+import { execCommand } from '../ssh/remote-exec/remote-exec-command'
 import { isWslOrcadHostTarget } from '../ssh/orcad-host-transport'
 import { createWslOrcadHostTransport } from './wsl-orcad-host-transport'
 
diff --git a/src/main/wsl/wsl-orcad-real-distro-lane.test.ts b/src/main/wsl/wsl-orcad-real-distro-lane.test.ts
index d5f7afe501b..a2028e911bf 100644
--- a/src/main/wsl/wsl-orcad-real-distro-lane.test.ts
+++ b/src/main/wsl/wsl-orcad-real-distro-lane.test.ts
@@ -30,7 +30,7 @@ import {
   ORCAD_TEMPLATE_MANIFEST_FILENAME
 } from '../../shared/orcad-artifacts'
 import { requestOrcadTerminalCensus } from '../ssh/orcad-terminal-census-client'
-import { execCommand } from '../ssh/remote-exec-command'
+import { execCommand } from '../ssh/remote-exec/remote-exec-command'
 import { readConfirmedRunningWslDistros } from '../wsl-background-distro-gate'
 import { readWindowsProcessTableFresh } from '../windows/windows-process-table'
 import { resolveWslInteropSpawnCwd } from '../wsl-interop-spawn-directory'
diff --git a/src/wsl-guest/protocol-json-payload.test.ts b/src/wsl-guest/protocol-json-payload.test.ts
index c634b94e0fd..a8c09e667a5 100644
--- a/src/wsl-guest/protocol-json-payload.test.ts
+++ b/src/wsl-guest/protocol-json-payload.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import * as mainProtocol from '../main/ssh/remote-frame-protocol'
+import * as mainProtocol from '../main/ssh/remote-exec/remote-frame-protocol'
 import {
   HEADER_LENGTH,
   MAX_MESSAGE_SIZE,
diff --git a/src/wsl-guest/protocol.ts b/src/wsl-guest/protocol.ts
index b65723f45b8..72f0606ebd9 100644
--- a/src/wsl-guest/protocol.ts
+++ b/src/wsl-guest/protocol.ts
@@ -1,4 +1,4 @@
-// Self-contained relay protocol — mirrors src/main/ssh/remote-frame-protocol.ts
+// Self-contained relay protocol — mirrors src/main/ssh/remote-exec/remote-frame-protocol.ts
 // but has no Electron dependencies. Deployed standalone to remote hosts.
 
 import {
diff --git a/tests/e2e/cross-version-wire/released-relay-transport.ts b/tests/e2e/cross-version-wire/released-relay-transport.ts
index fff3c01f32c..805d807f8f3 100644
--- a/tests/e2e/cross-version-wire/released-relay-transport.ts
+++ b/tests/e2e/cross-version-wire/released-relay-transport.ts
@@ -8,7 +8,7 @@ import {
   SshChannelMultiplexer,
   type MultiplexerTransport
 } from '../../../src/main/ssh/ssh-channel-multiplexer'
-import { RELAY_SENTINEL } from '../../../src/main/ssh/remote-frame-protocol'
+import { RELAY_SENTINEL } from '../../../src/main/ssh/remote-exec/remote-frame-protocol'
 
 const SENTINEL = Buffer.from(RELAY_SENTINEL, 'utf-8')
 const OWNER_HELD_DISCONNECTED = -32045
diff --git a/tests/e2e/host-agent-launch-settings-hook-bookkeeping.unit.test.ts b/tests/e2e/host-agent-launch-settings-hook-bookkeeping.unit.test.ts
index 590d9936c46..fc0a40407f1 100644
--- a/tests/e2e/host-agent-launch-settings-hook-bookkeeping.unit.test.ts
+++ b/tests/e2e/host-agent-launch-settings-hook-bookkeeping.unit.test.ts
@@ -17,7 +17,7 @@ vi.mock('../../src/main/telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../../src/main/telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../../src/main/ssh/ssh-config-parser', () => ({
+vi.mock('../../src/main/ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))