@tiphareth/dsh-hardssh 0.1.2 → 0.2.2

package/lib/client.js

@@ -7,25 +7,59 @@ window.__ModuleLoader__.load({
 		//#region \0rolldown/runtime.js
 		var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 		//#endregion
-		let react_dom_client = require("react-dom/client");
 		let react = require("react");
-		let react_dom = require("react-dom");
 		let react_jsx_runtime = require("react/jsx-runtime");
+		let react_dom = require("react-dom");
+		let react_dom_client = require("react-dom/client");
 		//#region src/client-http.ts
 		/**
-		* Browser-side HTTP helpers for the dsh-hardssh route clients.
-		* Plain fetch / same-origin — bundled inline into the client bundle.
+		* The single transport error: HTTP status plus the PARSED response body, so
+		* no caller re-parses a response and no field is flattened away. The SSH
+		* client re-exports it as `SshApiError`; the workspace client subclasses it as
+		* `WorkspaceApiError`. Both are this class at runtime, so the UI's
+		* `instanceof` / `.code` / `.hostKeyFingerprint` checks keep working.
 		*/
-		/** Error carrying the route's JSON error message and stable code/status. */
 		var HttpApiError = class extends Error {
-			code;
 			status;
-			constructor(message, code, status) {
+			body;
+			constructor(message, status, body) {
 				super(message);
-				this.code = code;
 				this.status = status;
+				this.body = body;
 				this.name = "HttpApiError";
 			}
+			/** Stable machine code from the route error body. */
+			get code() {
+				return typeof this.body?.code === "string" ? this.body.code : void 0;
+			}
+			/** Which secret a connection needs when {@link code} === 'NEEDS_PASSWORD'. */
+			get secret() {
+				const secret = this.body?.secret;
+				return secret === "password" || secret === "passphrase" ? secret : void 0;
+			}
+			/** The fingerprint when a host key was refused. */
+			get hostKeyFingerprint() {
+				return typeof this.body?.hostKeyFingerprint === "string" ? this.body.hostKeyFingerprint : void 0;
+			}
+			/** Mismatch detail (expected vs actual) when the host key changed. */
+			get hostKeyMismatch() {
+				const mismatch = this.body?.hostKeyMismatch;
+				if (typeof mismatch !== "object" || mismatch === null) return void 0;
+				const { expected, actual } = mismatch;
+				if (typeof expected !== "string" || typeof actual !== "string") return void 0;
+				return {
+					expected,
+					actual
+				};
+			}
+			/** Vault lockout: attempts left. */
+			get remaining() {
+				return typeof this.body?.remaining === "number" ? this.body.remaining : void 0;
+			}
+			/** Vault lockout: milliseconds until the next attempt is allowed. */
+			get retryAfterMs() {
+				return typeof this.body?.retryAfterMs === "number" ? this.body.retryAfterMs : void 0;
+			}
 		};
 		/** Query-string helper (skips undefined and empty values). */
 		function buildQuery(params) {
@@ -34,27 +68,45 @@ window.__ModuleLoader__.load({
 			const text = search.toString();
 			return text === "" ? "" : "?" + text;
 		}
-		/** Parse a JSON response or throw an HttpApiError (code/status preserved). */
-		async function readJson$1(response) {
-			let body;
+		/** Parse a JSON response or throw {@link HttpApiError} (status + body kept). */
+		async function readJson(response) {
+			const body = await parseJson(response);
+			if (body === void 0) throw new HttpApiError(`HTTP ${response.status}: invalid JSON response`, response.status);
+			if (!response.ok) throw errorFor(response.status, body);
+			return body;
+		}
+		/**
+		* Throw {@link HttpApiError} for a response that does NOT carry a JSON
+		* success body (streamed upload/download): a JSON error body is still parsed
+		* and preserved, so the caller sees the route's code instead of raw text.
+		* @param response - the non-ok response (or a stream that could not start).
+		* @param fallback - message prefix used when the route sent no `error` field.
+		*/
+		async function throwHttpError(response, fallback) {
+			const object = bodyObject(await parseJson(response));
+			throw new HttpApiError(typeof object?.error === "string" ? object.error : `${fallback}: HTTP ${response.status}`, response.status, object);
+		}
+		/** Parse a response body as JSON; undefined when absent or not JSON. */
+		async function parseJson(response) {
 			try {
-				body = await response.json();
+				return await response.json();
 			} catch {
-				throw new HttpApiError(`HTTP ${response.status}: invalid JSON response`, void 0, response.status);
+				return;
 			}
-			if (!response.ok) {
-				const record = typeof body === "object" && body !== null ? body : void 0;
-				throw new HttpApiError(typeof record?.error === "string" ? record.error : `HTTP ${response.status}`, typeof record?.code === "string" ? record.code : void 0, response.status);
-			}
-			return body;
+		}
+		/** The parsed body as an error-body record, or undefined for non-objects. */
+		function bodyObject(body) {
+			return typeof body === "object" && body !== null ? body : void 0;
+		}
+		/** Build the transport error for a non-ok response. */
+		function errorFor(status, body) {
+			const object = bodyObject(body);
+			return new HttpApiError(typeof object?.error === "string" ? object.error : `HTTP ${status}`, status, object);
 		}
 		//#endregion
 		//#region src/protocol.ts
 		const WORKSPACE_API = {
 			state: "/api/dsh-hardssh/state",
-			tree: "/api/dsh-hardssh/tree",
-			file: "/api/dsh-hardssh/file",
-			search: "/api/dsh-hardssh/search",
 			sshWorkspaces: "/api/dsh-hardssh/ws",
 			sshWorkspaceDir: "/api/dsh-hardssh/ws/dir"
 		};
@@ -70,11 +122,11 @@ window.__ModuleLoader__.load({
 		var WorkspaceApi = class {
 			/** List the SSH-bound workspaces. */
 			async listWorkspaces() {
-				return (await readJson$1(await fetch(WORKSPACE_API.sshWorkspaces))).workspaces;
+				return (await readJson(await fetch(WORKSPACE_API.sshWorkspaces))).workspaces;
 			}
 			/** Create one SSH-bound workspace. */
 			async createWorkspace(input) {
-				return (await readJson$1(await fetch(WORKSPACE_API.sshWorkspaces, {
+				return (await readJson(await fetch(WORKSPACE_API.sshWorkspaces, {
 					method: "POST",
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify(input)
@@ -82,7 +134,7 @@ window.__ModuleLoader__.load({
 			}
 			/** Rename one SSH-bound workspace. */
 			async renameWorkspace(id, title) {
-				return (await readJson$1(await fetch(WORKSPACE_API.sshWorkspaces + "/item" + buildQuery({ id }), {
+				return (await readJson(await fetch(WORKSPACE_API.sshWorkspaces + "/item" + buildQuery({ id }), {
 					method: "PATCH",
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify({ title })
@@ -90,58 +142,28 @@ window.__ModuleLoader__.load({
 			}
 			/** Delete one SSH-bound workspace. */
 			async deleteWorkspace(id) {
-				await readJson$1(await fetch(WORKSPACE_API.sshWorkspaces + "/item" + buildQuery({ id }), { method: "DELETE" }));
+				await readJson(await fetch(WORKSPACE_API.sshWorkspaces + "/item" + buildQuery({ id }), { method: "DELETE" }));
 			}
 			/** List the configured SSH hosts (from the shared dsh-ssh store). */
 			async listHosts() {
-				return (await readJson$1(await fetch(WORKSPACE_API.sshWorkspaces + "/hosts"))).hosts;
+				return (await readJson(await fetch(WORKSPACE_API.sshWorkspaces + "/hosts"))).hosts;
 			}
 			/** Browse a remote directory (for the workspace picker). */
 			async listRemoteDir(alias, path) {
-				return await readJson$1(await fetch(WORKSPACE_API.sshWorkspaceDir + buildQuery({
+				return await readJson(await fetch(WORKSPACE_API.sshWorkspaceDir + buildQuery({
 					alias,
 					path
 				})));
 			}
-			async list(root, path) {
-				return (await readJson$1(await fetch(WORKSPACE_API.tree + buildQuery({
-					root,
-					path
-				})))).listing;
-			}
-			async read(root, path) {
-				return (await readJson$1(await fetch(WORKSPACE_API.file + buildQuery({
-					root,
-					path
-				})))).file;
-			}
-			async write(root, path, content, expectedMtime) {
-				return (await readJson$1(await fetch(WORKSPACE_API.file, {
-					method: "PUT",
-					headers: { "content-type": "application/json" },
-					body: JSON.stringify({
-						root,
-						path,
-						content,
-						expectedMtime
-					})
-				}))).result;
-			}
-			async search(root, queryText) {
-				return (await readJson$1(await fetch(WORKSPACE_API.search + buildQuery({
-					root,
-					query: queryText
-				})))).search;
-			}
 		};
 		const HOSTS_API = "/api/dsh-ssh/hosts";
 		const TEST_API = "/api/dsh-ssh/test";
 		var SshHostsApi = class {
 			async list() {
-				return (await readJson$1(await fetch(HOSTS_API))).hosts;
+				return (await readJson(await fetch(HOSTS_API))).hosts;
 			}
 			async create(payload) {
-				return (await readJson$1(await fetch(HOSTS_API, {
+				return (await readJson(await fetch(HOSTS_API, {
 					method: "POST",
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify(payload)
@@ -151,7 +173,7 @@ window.__ModuleLoader__.load({
 			*  may carry only the fields being changed; omitted auth keeps the stored
 			*  secret. */
 			async update(alias, payload) {
-				return (await readJson$1(await fetch(`${HOSTS_API}?alias=${encodeURIComponent(alias)}`, {
+				return (await readJson(await fetch(`${HOSTS_API}?alias=${encodeURIComponent(alias)}`, {
 					method: "PATCH",
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify(payload)
@@ -159,10 +181,10 @@ window.__ModuleLoader__.load({
 			}
 			/** Delete a host (DELETE /api/dsh-ssh/hosts?alias=鈥?. */
 			async remove(alias) {
-				await readJson$1(await fetch(`${HOSTS_API}?alias=${encodeURIComponent(alias)}`, { method: "DELETE" }));
+				await readJson(await fetch(`${HOSTS_API}?alias=${encodeURIComponent(alias)}`, { method: "DELETE" }));
 			}
 			async test(alias) {
-				return (await readJson$1(await fetch(TEST_API, {
+				return (await readJson(await fetch(TEST_API, {
 					method: "POST",
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify({ alias })
@@ -193,38 +215,25 @@ window.__ModuleLoader__.load({
 		* Browser-side API client for the /api/dsh-ssh route family. The only data
 		* access path the panel components use — plain fetch/WebSocket, same origin.
 		*/
-		/** Error carrying the route's JSON error message. */
-		var SshApiError = class extends Error {
-			/** Stable machine code from the route error body (HOST_KEY_*, HOST_IN_USE, …). */
-			code;
-			hostKeyFingerprint;
-			constructor(message, code, hostKeyFingerprint) {
-				super(message);
-				this.name = "SshApiError";
-				this.code = code;
-				this.hostKeyFingerprint = hostKeyFingerprint;
-			}
-		};
-		/** Parse a JSON response or throw an SshApiError. */
-		async function readJson(response) {
-			let body;
-			try {
-				body = await response.json();
-			} catch {
-				throw new SshApiError(`HTTP ${response.status}: invalid JSON response`);
-			}
-			if (!response.ok) {
-				const record = typeof body === "object" && body !== null ? body : {};
-				throw new SshApiError(typeof record.error === "string" ? record.error : `HTTP ${response.status}`, typeof record.code === "string" ? record.code : void 0, typeof record.hostKeyFingerprint === "string" ? record.hostKeyFingerprint : void 0);
-			}
-			return body;
-		}
-		/** Query-string helper. */
-		function query(params) {
-			const search = new URLSearchParams();
-			for (const [key, value] of Object.entries(params)) if (value !== void 0 && value !== "") search.set(key, String(value));
-			const text = search.toString();
-			return text === "" ? "" : "?" + text;
+		/** Query-string helper (shared transport helper, no local copy). */
+		const query = buildQuery;
+		/**
+		* Structured fields of one streamed (`application/x-ndjson`) failure frame.
+		* The upload route currently sends only `error`, so the interactive-gate
+		* fields are picked up when present and simply absent otherwise — the same
+		* shape the JSON routes produce, so callers handle one error type.
+		*/
+		function frameFailure(frame) {
+			const record = frame;
+			const secret = record.secret;
+			return {
+				...typeof record.error === "string" ? { error: record.error } : {},
+				...typeof record.code === "string" ? { code: record.code } : {},
+				...secret === "password" || secret === "passphrase" ? { secret } : {},
+				...typeof record.hostKeyFingerprint === "string" ? { hostKeyFingerprint: record.hostKeyFingerprint } : {},
+				...typeof record.remaining === "number" ? { remaining: record.remaining } : {},
+				...typeof record.retryAfterMs === "number" ? { retryAfterMs: record.retryAfterMs } : {}
+			};
 		}
 		/** The browser half's only data entry point. */
 		var SshApi = class {
@@ -323,45 +332,60 @@ window.__ModuleLoader__.load({
 			* Upload one file (raw bytes) to a remote path. Progress arrives through
 			* the NDJSON response stream; resolves when the result frame lands.
 			*/
-			async uploadFile(file, alias, remotePath, onProgress) {
+			async uploadFile(file, alias, remotePath, onProgress, signal) {
 				const response = await fetch(SSH_API.upload + query({
 					alias,
 					remotePath
 				}), {
 					method: "POST",
-					body: file
+					body: file,
+					signal
 				});
-				if (!response.ok || response.body === null) throw new SshApiError(`upload failed: HTTP ${response.status}`);
+				if (!response.ok) await throwHttpError(response, "upload failed");
+				if (response.body === null) throw new HttpApiError("upload failed: the response carried no body stream", response.status);
 				const reader = response.body.getReader();
 				const decoder = new TextDecoder();
 				let buffer = "";
-				let finalError;
+				let failure;
 				let sawResult = false;
+				let commitStarted = false;
+				let readerDone = false;
 				let transferredBytes = 0;
-				for (;;) {
-					const { done, value } = await reader.read();
-					if (done) break;
-					buffer += decoder.decode(value, { stream: true });
-					const lines = buffer.split("\n");
-					buffer = lines.pop() ?? "";
-					for (const line of lines) {
-						if (line.trim() === "") continue;
-						let parsed;
-						try {
-							parsed = JSON.parse(line);
-						} catch {
-							continue;
-						}
-						if (parsed.type === "progress") onProgress?.(parsed.progress);
-						else if (parsed.type === "result") {
-							sawResult = true;
-							if (parsed.ok) transferredBytes = parsed.transferredBytes ?? 0;
-							finalError = parsed.ok ? void 0 : parsed.error ?? "upload failed";
+				try {
+					for (;;) {
+						const { done, value } = await reader.read();
+						if (done) {
+							readerDone = true;
+							break;
+						}
+						buffer += decoder.decode(value, { stream: true });
+						const lines = buffer.split("\n");
+						buffer = lines.pop() ?? "";
+						for (const line of lines) {
+							if (line.trim() === "") continue;
+							let parsed;
+							try {
+								parsed = JSON.parse(line);
+							} catch {
+								continue;
+							}
+							if (parsed.type === "progress") onProgress?.(parsed.progress);
+							else if (parsed.type === "commit") commitStarted = true;
+							else if (parsed.type === "result") {
+								sawResult = true;
+								if (parsed.ok) transferredBytes = parsed.transferredBytes ?? 0;
+								else failure = frameFailure(parsed);
+							}
 						}
 					}
+				} catch (error) {
+					if (commitStarted) throw new HttpApiError("upload connection closed after commit began; the remote result is unknown", response.status, { code: "RESULT_UNKNOWN" });
+					throw error;
+				} finally {
+					if (!readerDone) await reader.cancel().catch(() => void 0);
 				}
-				if (finalError !== void 0) throw new SshApiError(finalError);
-				if (!sawResult) throw new SshApiError("upload ended without a result frame — the transfer did not complete");
+				if (failure !== void 0) throw new HttpApiError(typeof failure.error === "string" ? failure.error : "upload failed", response.status, failure);
+				if (!sawResult) throw new HttpApiError(commitStarted ? "upload connection closed after commit began; the remote result is unknown" : "upload ended without a result frame — the remote destination was not published", response.status, commitStarted ? { code: "RESULT_UNKNOWN" } : { code: "ABORTED" });
 				return { transferredBytes };
 			}
 			/**
@@ -369,15 +393,13 @@ window.__ModuleLoader__.load({
 			* disk when the File System Access API is available (no full-file RAM
 			* copy); otherwise falls back to an in-memory Blob.
 			*/
-			async downloadFile(alias, remotePath, onProgress) {
+			async downloadFile(alias, remotePath, onProgress, signal) {
 				const response = await fetch(SSH_API.download + query({
 					alias,
 					remotePath
-				}));
-				if (!response.ok || response.body === null) {
-					const text = await response.text().catch(() => "");
-					throw new SshApiError(text !== "" && text.startsWith("{") ? text : `download failed: HTTP ${response.status}`);
-				}
+				}), { signal });
+				if (!response.ok) await throwHttpError(response, "download failed");
+				if (response.body === null) throw new HttpApiError("download failed: the response carried no body stream", response.status);
 				const total = Number(response.headers.get("content-length") ?? "0");
 				const disposition = response.headers.get("content-disposition") ?? "";
 				const filename = /filename="([^"]+)"/.exec(disposition)?.[1] ?? remotePath.split("/").pop() ?? "download";
@@ -387,6 +409,8 @@ window.__ModuleLoader__.load({
 				let writable;
 				const chunks = [];
 				let received = 0;
+				let readerDone = false;
+				let writableClosed = false;
 				const progress = () => {
 					onProgress?.({
 						phase: "transferring",
@@ -397,33 +421,52 @@ window.__ModuleLoader__.load({
 					});
 				};
 				try {
-					if (picker !== void 0) {
-						writable = await (await picker.call(window, { suggestedName: filename })).createWritable();
-						streamed = true;
+					try {
+						if (picker !== void 0) {
+							const handle = await picker.call(window, { suggestedName: filename });
+							signal?.throwIfAborted();
+							writable = await handle.createWritable();
+							streamed = true;
+						}
+					} catch (error) {
+						if (signal?.aborted === true) throw error;
 					}
-				} catch {}
-				for (;;) {
-					const { done, value } = await reader.read();
-					if (done) break;
-					if (writable !== void 0) await writable.write(value);
-					else chunks.push(value);
-					received += value.length;
-					progress();
+					for (;;) {
+						signal?.throwIfAborted();
+						const { done, value } = await reader.read();
+						if (done) {
+							readerDone = true;
+							break;
+						}
+						if (writable !== void 0) await writable.write(value);
+						else chunks.push(value);
+						received += value.length;
+						progress();
+					}
+					signal?.throwIfAborted();
+					if (writable !== void 0) {
+						await writable.close();
+						writableClosed = true;
+					}
+					onProgress?.({
+						phase: "done",
+						file: remotePath,
+						transferred: received,
+						total: received > 0 ? received : total,
+						percent: 100
+					});
+					return {
+						blob: streamed ? void 0 : new Blob(chunks),
+						filename,
+						streamed,
+						bytes: received
+					};
+				} catch (error) {
+					chunks.length = 0;
+					if (!readerDone) await reader.cancel(error).catch(() => void 0);
+					if (writable !== void 0 && !writableClosed) await writable.abort?.(error).catch(() => void 0);
+					throw error;
 				}
-				if (writable !== void 0) await writable.close();
-				onProgress?.({
-					phase: "done",
-					file: remotePath,
-					transferred: received,
-					total: received > 0 ? received : total,
-					percent: 100
-				});
-				return {
-					blob: streamed ? void 0 : new Blob(chunks),
-					filename,
-					streamed,
-					bytes: received
-				};
 			}
 			/** Open a WebSocket terminal session. */
 			openTerminal(alias, cols, rows) {
@@ -433,22 +476,96 @@ window.__ModuleLoader__.load({
 					rows
 				});
 				const socket = new WebSocket(url);
+				const MAX_PENDING_INPUT = 65536;
+				let ready = false;
+				let finalized = false;
+				let queuedInput = "";
+				let queuedResize;
+				let readyListener;
+				let readyDelivered = false;
+				let outputListener;
+				let exitListener;
+				let exitRecord;
+				let exitDelivered = false;
+				const deliverReady = () => {
+					if (!ready || readyDelivered || readyListener === void 0) return;
+					readyDelivered = true;
+					readyListener();
+				};
+				const deliverExit = () => {
+					if (exitRecord === void 0 || exitDelivered || exitListener === void 0) return;
+					exitDelivered = true;
+					exitListener(exitRecord.code, exitRecord.error);
+				};
+				const finalize = (code, error) => {
+					if (finalized) return;
+					finalized = true;
+					queuedInput = "";
+					queuedResize = void 0;
+					exitRecord = error === void 0 ? { code } : {
+						code,
+						error
+					};
+					deliverExit();
+				};
+				const sendFrame = (frame) => {
+					if (finalized || !ready || socket.readyState !== WebSocket.OPEN) return;
+					socket.send(JSON.stringify(frame));
+				};
 				const connection = {
-					onReady: void 0,
-					onOutput: void 0,
-					onExit: void 0,
+					get onReady() {
+						return readyListener;
+					},
+					set onReady(listener) {
+						readyListener = listener;
+						deliverReady();
+					},
+					get onOutput() {
+						return outputListener;
+					},
+					set onOutput(listener) {
+						outputListener = listener;
+					},
+					get onExit() {
+						return exitListener;
+					},
+					set onExit(listener) {
+						exitListener = listener;
+						deliverExit();
+					},
 					send: (data) => {
-						if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify({
+						if (finalized) return;
+						if (!ready || socket.readyState !== WebSocket.OPEN) {
+							if (queuedInput.length + data.length > MAX_PENDING_INPUT) {
+								finalize(null, "terminal input buffer exceeded before ready");
+								try {
+									socket.close(1008, "terminal input buffer exceeded");
+								} catch {}
+								return;
+							}
+							queuedInput += data;
+							return;
+						}
+						sendFrame({
 							type: "input",
 							data
-						}));
+						});
 					},
-					resize: (cols, rows) => {
-						if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify({
+					resize: (nextCols, nextRows) => {
+						if (finalized) return;
+						const frame = {
 							type: "resize",
-							cols,
-							rows
-						}));
+							cols: nextCols,
+							rows: nextRows
+						};
+						if (!ready || socket.readyState !== WebSocket.OPEN) {
+							queuedResize = {
+								cols: nextCols,
+								rows: nextRows
+							};
+							return;
+						}
+						sendFrame(frame);
 					},
 					close: () => {
 						try {
@@ -457,21 +574,54 @@ window.__ModuleLoader__.load({
 					}
 				};
 				socket.onmessage = (event) => {
-					let frame;
 					try {
-						frame = JSON.parse(event.data);
+						const value = JSON.parse(event.data);
+						if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("invalid terminal frame");
+						const frame = value;
+						if (frame.type === "ready" && typeof frame.alias === "string") {
+							if (ready || finalized) return;
+							ready = true;
+							deliverReady();
+							if (queuedResize !== void 0) {
+								sendFrame({
+									type: "resize",
+									...queuedResize
+								});
+								queuedResize = void 0;
+							}
+							if (queuedInput !== "") {
+								sendFrame({
+									type: "input",
+									data: queuedInput
+								});
+								queuedInput = "";
+							}
+							return;
+						}
+						if (frame.type === "output" && typeof frame.data === "string") {
+							outputListener?.(frame.data);
+							return;
+						}
+						if (frame.type === "exit" && (typeof frame.code === "number" || frame.code === null) && (frame.error === void 0 || typeof frame.error === "string")) {
+							finalize(frame.code, frame.error);
+							try {
+								socket.close(1e3);
+							} catch {}
+							return;
+						}
+						throw new Error("invalid terminal frame");
 					} catch {
-						return;
+						finalize(null, "invalid terminal server frame");
+						try {
+							socket.close(1008, "invalid terminal server frame");
+						} catch {}
 					}
-					if (frame.type === "ready") connection.onReady?.();
-					else if (frame.type === "output") connection.onOutput?.(frame.data);
-					else if (frame.type === "exit") connection.onExit?.(frame.code, frame.error);
 				};
 				socket.onclose = () => {
-					connection.onExit?.(null, "connection closed");
+					finalize(null, "connection closed");
 				};
 				socket.onerror = () => {
-					connection.onExit?.(null, "connection error");
+					finalize(null, "connection error");
 				};
 				return connection;
 			}
@@ -523,7 +673,14 @@ window.__ModuleLoader__.load({
 			"manager.label": "SSH 工作区",
 			"manager.tooltip": "管理 SSH 工作区：绑定服务器目录，绑定后的会话在远程操作，其余会话在本机",
 			"manager.title": "SSH 工作区管理",
+			"panel.workspaces": "SSH 工作区",
+			"ops.tab": "SSH",
+			"ops.guide": "打开 SSH 运维面板：终端、传输、隧道、集群",
 			"manager.empty": "还没有 SSH 工作区",
+			"manager.connected": "已连接",
+			"manager.disconnected": "未连接",
+			"manager.connectionUnknown": "状态未知",
+			"manager.connectionError": "无法读取服务器连接状态：%s",
 			"manager.delete": "删除",
 			"manager.editServer": "编辑服务器",
 			"manager.deleteServer": "删除服务器",
@@ -567,7 +724,14 @@ window.__ModuleLoader__.load({
 			"manager.label": "SSH workspaces",
 			"manager.tooltip": "Manage SSH workspaces: bind a server directory — sessions in a bound workspace operate remotely, all others stay local",
 			"manager.title": "SSH Workspaces",
+			"panel.workspaces": "SSH workspaces",
+			"ops.tab": "SSH",
+			"ops.guide": "Open the SSH operations panel: terminal, transfer, tunnels, cluster",
 			"manager.empty": "No SSH workspaces yet",
+			"manager.connected": "Connected",
+			"manager.disconnected": "Disconnected",
+			"manager.connectionUnknown": "Status unknown",
+			"manager.connectionError": "Could not read server connection state: %s",
 			"manager.delete": "Delete",
 			"manager.editServer": "Edit server",
 			"manager.deleteServer": "Delete server",
@@ -632,6 +796,8 @@ window.__ModuleLoader__.load({
 			};
 			listeners = /* @__PURE__ */ new Set();
 			timer;
+			/** Monotonic list-workspaces request id; only the newest request may commit. */
+			refreshSequence = 0;
 			constructor(api) {
 				this.api = api;
 			}
@@ -648,9 +814,12 @@ window.__ModuleLoader__.load({
 				for (const listener of [...this.listeners]) listener();
 			}
 			async refresh() {
+				const request = ++this.refreshSequence;
 				try {
+					const workspaces = await this.api.listWorkspaces();
+					if (request !== this.refreshSequence) return;
 					const next = {
-						workspaces: await this.api.listWorkspaces(),
+						workspaces,
 						error: null
 					};
 					if (!sameLedger(this.state.workspaces, next.workspaces) || this.state.error !== null) {
@@ -658,6 +827,7 @@ window.__ModuleLoader__.load({
 						this.emit();
 					}
 				} catch (error) {
+					if (request !== this.refreshSequence) return;
 					const message = error instanceof Error ? error.message : String(error);
 					if (this.state.error !== message) {
 						this.state = {
@@ -673,6 +843,7 @@ window.__ModuleLoader__.load({
 				this.timer = window.setInterval(() => void this.refresh(), POLL_MS);
 			}
 			stop() {
+				this.refreshSequence += 1;
 				if (this.timer !== void 0) {
 					window.clearInterval(this.timer);
 					this.timer = void 0;
@@ -703,7 +874,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region \0dsh-css:C:\Users\Kether\.dsh\dsh-hardssh\packages\dsh-hardssh\src\client\workspace.module.css.mjs
-		const css$1 = ".-bXcdG_dialogGrid{grid-template-columns:1fr;gap:10px;display:grid}.-bXcdG_field{flex-direction:column;gap:5px;display:flex}.-bXcdG_field>span{color:var(--dsw-alias-label-primary,#0f1115);font-size:13px;font-weight:500}.-bXcdG_field input,.-bXcdG_field select{box-sizing:border-box;min-height:36px;color:var(--dsw-alias-label-primary,#0f1115);background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#00000024);border-radius:8px;outline:none;padding:7px 10px;font-family:inherit;font-size:13px;transition:border-color .15s,box-shadow .15s}.-bXcdG_field select option{background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#0f1115)}.-bXcdG_field input::placeholder,.-bXcdG_field select::placeholder{color:var(--dsw-alias-label-tertiary,#81858c)}.-bXcdG_field input:focus,.-bXcdG_field select:focus{border-color:var(--dsw-alias-brand-primary-new-colorprimary-new-color,#4176e6);box-shadow:0 0 0 2px #4176e626}.-bXcdG_dialogFail{background:var(--dsw-alias-state-error-bg,#f53f3f1a);border:1px solid var(--dsw-alias-state-error-primary,#f53f3f66);color:var(--dsw-alias-state-error-primary,#d03050);border-radius:6px;margin-top:10px;padding:8px 12px;font-size:12px}.-bXcdG_dialogInfo{background:var(--dsw-alias-bg-base-2,#0000000a);border:1px solid var(--dsw-alias-border-l2,#0000001a);color:#000;border-radius:6px;margin-top:10px;padding:8px 12px;font-size:12px}.-bXcdG_dialogActions{justify-content:flex-end;gap:8px;margin-top:14px;display:flex}.-bXcdG_button{border:1px solid var(--dsw-alias-border-l2,#00000026);color:var(--dsw-alias-label-primary,#0f1115);cursor:pointer;background:0 0;border-radius:8px;padding:7px 15px;font-family:inherit;font-size:13px;transition:background .15s}.-bXcdG_button:hover:not(:disabled){background:var(--dsw-alias-bg-overlay,#0000000d)}.-bXcdG_button:disabled{opacity:.55;cursor:default}.-bXcdG_buttonPrimary{background:var(--dsw-alias-button-primary-fill,#0f1115);color:var(--dsw-alias-label-primary-foreground,#fff);border-color:#0000;font-weight:600}.-bXcdG_buttonPrimary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover,#2b2f36);color:var(--dsw-alias-label-primary-foreground,#fff)}.-bXcdG_dialogHint{color:var(--dsw-alias-label-tertiary,#81858c);margin-top:10px;font-size:11.5px;line-height:1.45}.-bXcdG_hostRow{border:1px solid var(--dsw-alias-border-l2,#0000001a);background:var(--dsw-alias-bg-base,#00000005);color:var(--dsw-alias-label-primary,#0f1115);border-radius:8px;align-items:center;gap:8px;padding:7px 10px;font-size:13px;display:flex}.-bXcdG_hostRow:hover{background:var(--dsw-alias-bg-overlay,#0000000d)}.-bXcdG_hostAlias{color:var(--dsw-alias-label-primary,#0f1115);white-space:nowrap;font-size:13px;font-weight:500}.-bXcdG_hostMeta{text-overflow:ellipsis;white-space:nowrap;min-width:0;color:var(--dsw-alias-label-tertiary,#81858c);flex:1;font-size:12px;overflow:hidden}.-bXcdG_danger{background:var(--dsw-alias-state-error-primary,#d03050);color:#fff;border-color:#0000}.-bXcdG_managerButton{border:1px solid var(--dsw-alias-border-l2,#0003);color:#000;min-width:111px;height:32px;font-family:var(--dsw-font-family,-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, system-ui, \"PingFang SC\", \"Microsoft YaHei\", sans-serif);cursor:pointer;white-space:nowrap;background:0 0;border-radius:12px;justify-content:center;align-items:center;gap:4px;padding:6px 12px;font-size:13px;font-weight:400;line-height:20px;transition:background .15s,border-color .15s;display:inline-flex}.-bXcdG_managerButton:hover{background:var(--dsw-alias-bg-overlay,#0000000d)}.-bXcdG_managerButton svg{flex:none}.-bXcdG_managerMenuHeader{color:var(--dsw-alias-label-primary,#0f1115);margin:0 0 2px;font-size:13px;font-weight:600}.-bXcdG_managerMenuClose{float:right;color:var(--dsw-alias-label-secondary,#61666b);cursor:pointer;background:0 0;border:none;padding:0 2px;font-size:14px;line-height:18px}.-bXcdG_managerMenuClose:hover{color:var(--dsw-alias-label-primary,#0f1115)}.-bXcdG_menuDropdown{z-index:99999;box-sizing:border-box;background:var(--dsw-alias-bg-base,#fff);border:1px solid var(--dsw-alias-border-l1,#0000000a);min-width:230px;max-width:calc(100vw - 16px);max-height:min(600px,100vh - 64px);color:var(--dsw-alias-label-primary,#0f1115);font-family:var(--dsw-font-family,-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, system-ui, \"PingFang SC\", \"Microsoft YaHei\", sans-serif);scrollbar-width:thin;scrollbar-color:var(--dsw-alias-label-caption,#80808080) transparent;border-radius:12px;padding:8px;font-size:13px;line-height:20px;position:fixed;overflow:hidden auto}.-bXcdG_menuItem{width:100%;color:var(--dsw-alias-label-primary,#0f1115);font:inherit;text-align:left;cursor:pointer;white-space:nowrap;background:0 0;border:none;border-radius:8px;align-items:center;gap:9px;padding:8px 11px;transition:background .12s,color .12s;display:flex}.-bXcdG_menuItem:hover:not(:disabled){background:var(--dsw-alias-bg-overlay,#0000000d)}.-bXcdG_menuItem:disabled{opacity:.55;cursor:default}.-bXcdG_menuItemIcon{flex:none;font-size:14px;line-height:1}.-bXcdG_menuDivider{background:var(--dsw-alias-border-l2,#0000001a);height:1px;margin:5px 9px}.-bXcdG_managerGroupHeader{border-bottom:1px solid var(--dsw-alias-border-l2,#0000001a);margin-bottom:5px}.-bXcdG_menuItemIconButton{border:1px solid var(--dsw-alias-border-l2,#00000026);width:22px;height:22px;color:var(--dsw-alias-label-secondary,#4a5060);cursor:pointer;background:0 0;border-radius:6px;flex:none;justify-content:center;align-items:center;font-size:13px;line-height:1;transition:background .12s,color .12s,border-color .12s;display:inline-flex}.-bXcdG_menuItemIconButton:hover:not(:disabled){background:var(--dsw-alias-bg-overlay,#0000000f);border-color:var(--dsw-alias-border-l3,#0000001f);color:var(--dsw-alias-label-primary,#0f1115)}.-bXcdG_menuItemIconButton:disabled{opacity:.4;cursor:default}";
+		const css$1 = ".-bXcdG_dialogGrid{grid-template-columns:1fr;gap:10px;display:grid}.-bXcdG_field{flex-direction:column;gap:5px;display:flex}.-bXcdG_field>span{color:var(--dsw-alias-label-primary,#0f1115);font-size:13px;font-weight:500}.-bXcdG_field input,.-bXcdG_field select{box-sizing:border-box;min-height:36px;color:var(--dsw-alias-label-primary,#0f1115);background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#00000024);border-radius:8px;outline:none;padding:7px 10px;font-family:inherit;font-size:13px;transition:border-color .15s,box-shadow .15s}.-bXcdG_field select option{background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#0f1115)}.-bXcdG_field input::placeholder,.-bXcdG_field select::placeholder{color:var(--dsw-alias-label-tertiary,#81858c)}.-bXcdG_field input:focus,.-bXcdG_field select:focus{border-color:var(--dsw-alias-brand-primary-new-colorprimary-new-color,#4176e6);box-shadow:0 0 0 2px #4176e626}.-bXcdG_dialogFail{background:var(--dsw-alias-state-error-bg,#f53f3f1a);border:1px solid var(--dsw-alias-state-error-primary,#f53f3f66);color:var(--dsw-alias-state-error-primary,#d03050);border-radius:6px;margin-top:10px;padding:8px 12px;font-size:12px}.-bXcdG_dialogInfo{background:var(--dsw-alias-bg-base-2,#0000000a);border:1px solid var(--dsw-alias-border-l2,#0000001a);color:var(--dsw-alias-label-primary,#0f1115);border-radius:6px;margin-top:10px;padding:8px 12px;font-size:12px}.-bXcdG_dialogActions{justify-content:flex-end;gap:8px;margin-top:14px;display:flex}.-bXcdG_button{border:1px solid var(--dsw-alias-border-l2,#00000026);color:var(--dsw-alias-label-primary,#0f1115);cursor:pointer;background:0 0;border-radius:8px;padding:7px 15px;font-family:inherit;font-size:13px;transition:background .15s}.-bXcdG_button:hover:not(:disabled){background:var(--dsw-alias-bg-overlay,#0000000d)}.-bXcdG_button:disabled{opacity:.55;cursor:default}.-bXcdG_buttonPrimary{background:var(--dsw-alias-button-primary-fill,#0f1115);color:var(--dsw-alias-label-primary-foreground,#fff);border-color:#0000;font-weight:600}.-bXcdG_buttonPrimary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover,#2b2f36);color:var(--dsw-alias-label-primary-foreground,#fff)}.-bXcdG_dialogHint{color:var(--dsw-alias-label-tertiary,#81858c);margin-top:10px;font-size:11.5px;line-height:1.45}.-bXcdG_hostRow{border:1px solid var(--dsw-alias-border-l2,#0000001a);background:var(--dsw-alias-bg-base,#00000005);color:var(--dsw-alias-label-primary,#0f1115);border-radius:8px;align-items:center;gap:8px;padding:7px 10px;font-size:13px;display:flex}.-bXcdG_hostRow:hover{background:var(--dsw-alias-bg-overlay,#0000000d)}.-bXcdG_hostAlias{color:var(--dsw-alias-label-primary,#0f1115);white-space:nowrap;font-size:13px;font-weight:500}.-bXcdG_hostMeta{text-overflow:ellipsis;white-space:nowrap;min-width:0;color:var(--dsw-alias-label-tertiary,#81858c);flex:1;font-size:12px;overflow:hidden}.-bXcdG_danger{background:var(--dsw-alias-state-error-primary,#d03050);color:#fff;border-color:#0000}.-bXcdG_managerButton{border:1px solid var(--dsw-alias-border-l2,#0003);min-width:111px;height:32px;color:var(--dsw-alias-label-primary,#0f1115);font-family:var(--dsw-font-family,-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, system-ui, \"PingFang SC\", \"Microsoft YaHei\", sans-serif);cursor:pointer;white-space:nowrap;background:0 0;border-radius:12px;justify-content:center;align-items:center;gap:4px;padding:6px 12px;font-size:13px;font-weight:400;line-height:20px;transition:background .15s,border-color .15s;display:inline-flex}.-bXcdG_managerButton:hover{background:var(--dsw-alias-bg-overlay,#0000000d)}.-bXcdG_managerButton svg{flex:none}.-bXcdG_managerMenuHeader{color:var(--dsw-alias-label-primary,#0f1115);margin:0 0 2px;font-size:13px;font-weight:600}.-bXcdG_managerMenuClose{float:right;color:var(--dsw-alias-label-secondary,#61666b);cursor:pointer;background:0 0;border:none;padding:0 2px;font-size:14px;line-height:18px}.-bXcdG_managerMenuClose:hover{color:var(--dsw-alias-label-primary,#0f1115)}.-bXcdG_menuDropdown{z-index:99999;box-sizing:border-box;background:var(--dsw-alias-bg-base,#fff);border:1px solid var(--dsw-alias-border-l1,#0000000a);min-width:230px;max-width:calc(100vw - 16px);max-height:min(600px,100vh - 64px);color:var(--dsw-alias-label-primary,#0f1115);font-family:var(--dsw-font-family,-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, system-ui, \"PingFang SC\", \"Microsoft YaHei\", sans-serif);scrollbar-width:thin;scrollbar-color:var(--dsw-alias-label-caption,#80808080) transparent;border-radius:12px;padding:8px;font-size:13px;line-height:20px;position:fixed;overflow:hidden auto}.-bXcdG_menuItem{width:100%;color:var(--dsw-alias-label-primary,#0f1115);font:inherit;text-align:left;cursor:pointer;white-space:nowrap;background:0 0;border:none;border-radius:8px;align-items:center;gap:9px;padding:8px 11px;transition:background .12s,color .12s;display:flex}.-bXcdG_menuItem:hover:not(:disabled){background:var(--dsw-alias-bg-overlay,#0000000d)}.-bXcdG_menuItem:disabled{opacity:.55;cursor:default}.-bXcdG_menuItemIcon{flex:none;font-size:14px;line-height:1}.-bXcdG_menuDivider{background:var(--dsw-alias-border-l2,#0000001a);height:1px;margin:5px 9px}.-bXcdG_managerGroupHeader{border-bottom:1px solid var(--dsw-alias-border-l2,#0000001a);margin-bottom:5px}.-bXcdG_connectionBadge{color:var(--dsw-alias-label-secondary,#61666b);white-space:nowrap;border:1px solid var(--dsw-alias-border-l2,#0000001f);border-radius:999px;flex:none;align-items:center;gap:5px;padding:1px 7px;font-size:11px;line-height:18px;display:inline-flex}.-bXcdG_connectionDot{background:var(--dsw-alias-label-tertiary,#81858c);border-radius:50%;width:7px;height:7px}.-bXcdG_connectionBadge[data-state=connected]{color:var(--dsw-alias-state-success-primary,#18a058);border-color:color-mix(in srgb, var(--dsw-alias-state-success-primary,#18a058) 48%, transparent)}.-bXcdG_connectionBadge[data-state=connected] .-bXcdG_connectionDot{background:var(--dsw-alias-state-success-primary,#18a058)}.-bXcdG_connectionBadge[data-state=disconnected]{color:var(--dsw-alias-label-tertiary,#81858c)}.-bXcdG_menuItemIconButton{border:1px solid var(--dsw-alias-border-l2,#00000026);width:22px;height:22px;color:var(--dsw-alias-label-secondary,#4a5060);cursor:pointer;background:0 0;border-radius:6px;flex:none;justify-content:center;align-items:center;font-size:13px;line-height:1;transition:background .12s,color .12s,border-color .12s;display:inline-flex}.-bXcdG_menuItemIconButton:hover:not(:disabled){background:var(--dsw-alias-bg-overlay,#0000000f);border-color:var(--dsw-alias-border-l3,#0000001f);color:var(--dsw-alias-label-primary,#0f1115)}.-bXcdG_menuItemIconButton:disabled{opacity:.4;cursor:default}.-bXcdG_managerPanel{box-sizing:border-box;width:100%;height:100%;min-height:0;color:var(--dsw-alias-label-primary,#0f1115);font-family:var(--dsw-font-family,-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, system-ui, \"PingFang SC\", \"Microsoft YaHei\", sans-serif);scrollbar-width:thin;scrollbar-color:var(--dsw-alias-label-caption,#80808080) transparent;padding:16px 20px 24px;font-size:13px;line-height:20px;overflow-y:auto}.-bXcdG_managerPanelHeader{align-items:center;gap:10px;margin-bottom:12px;display:flex}.-bXcdG_managerPanelTitle{white-space:nowrap;flex:1;margin:0;font-size:16px;font-weight:700}.-bXcdG_managerPanelGroup{margin-bottom:14px}.-bXcdG_managerPanelFooter{border-top:1px solid var(--dsw-alias-border-l2,#0000001a);margin-top:8px;padding-top:8px}";
 		const tagId$1 = "@tiphareth/dsh-hardssh/workspace.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$1) + "]") === null) {
 			const tag = document.createElement("style");
@@ -715,6 +886,8 @@ window.__ModuleLoader__.load({
 		var workspace_module_css_default = {
 			"button": "-bXcdG_button",
 			"buttonPrimary": "-bXcdG_buttonPrimary",
+			"connectionBadge": "-bXcdG_connectionBadge",
+			"connectionDot": "-bXcdG_connectionDot",
 			"danger": "-bXcdG_danger",
 			"dialogActions": "-bXcdG_dialogActions",
 			"dialogFail": "-bXcdG_dialogFail",
@@ -729,6 +902,11 @@ window.__ModuleLoader__.load({
 			"managerGroupHeader": "-bXcdG_managerGroupHeader",
 			"managerMenuClose": "-bXcdG_managerMenuClose",
 			"managerMenuHeader": "-bXcdG_managerMenuHeader",
+			"managerPanel": "-bXcdG_managerPanel",
+			"managerPanelFooter": "-bXcdG_managerPanelFooter",
+			"managerPanelGroup": "-bXcdG_managerPanelGroup",
+			"managerPanelHeader": "-bXcdG_managerPanelHeader",
+			"managerPanelTitle": "-bXcdG_managerPanelTitle",
 			"menuDivider": "-bXcdG_menuDivider",
 			"menuDropdown": "-bXcdG_menuDropdown",
 			"menuItem": "-bXcdG_menuItem",
@@ -779,6 +957,13 @@ window.__ModuleLoader__.load({
 			"tab.transfer": "传输",
 			"tab.tunnels": "隧道",
 			"tab.cluster": "集群",
+			"session.server": "当前服务器",
+			"session.target": "跟随当前会话：{alias} · {remoteRoot}",
+			"session.localTitle": "当前会话位于本地工作区",
+			"session.localUnavailable": "SSH 操作台仅适用于 SSH 工作区会话。请切换到远程会话后使用。",
+			"connectionError.title": "无法连接服务器 {alias}",
+			"connectionError.intro": "SSH 连接未建立，请检查服务器地址、网络和认证配置。",
+			"connectionError.close": "知道了",
 			"hosts.empty": "尚未配置主机。点击「新增主机」添加，或从 ~/.ssh/config 导入。",
 			"hosts.add": "新增主机",
 			"hosts.import": "导入 ~/.ssh/config",
@@ -833,7 +1018,7 @@ window.__ModuleLoader__.load({
 			"terminal.selectHost": "选择主机",
 			"terminal.connect": "连接",
 			"terminal.disconnect": "断开",
-			"terminal.placeholder": "选择主机后点击「连接」打开远程终端。",
+			"terminal.placeholder": "点击「连接」打开当前会话服务器的远程终端。",
 			"terminal.connecting": "正在连接…",
 			"terminal.ready": "终端已连接（{alias}）",
 			"terminal.exited": "终端已退出（{alias}）",
@@ -926,6 +1111,13 @@ window.__ModuleLoader__.load({
 			"tab.transfer": "Transfer",
 			"tab.tunnels": "Tunnels",
 			"tab.cluster": "Cluster",
+			"session.server": "Current server",
+			"session.target": "Following current session: {alias} · {remoteRoot}",
+			"session.localTitle": "This session uses a local workspace",
+			"session.localUnavailable": "The SSH console is available only for SSH workspace sessions. Switch to a remote session to use it.",
+			"connectionError.title": "Unable to connect to {alias}",
+			"connectionError.intro": "The SSH connection was not established. Check the server address, network, and authentication settings.",
+			"connectionError.close": "OK",
 			"hosts.empty": "No hosts configured. Click \"Add host\" or import from ~/.ssh/config.",
 			"hosts.add": "Add host",
 			"hosts.import": "Import ~/.ssh/config",
@@ -980,7 +1172,7 @@ window.__ModuleLoader__.load({
 			"terminal.selectHost": "Select host",
 			"terminal.connect": "Connect",
 			"terminal.disconnect": "Disconnect",
-			"terminal.placeholder": "Select a host and click \"Connect\" to open the remote terminal.",
+			"terminal.placeholder": "Click \"Connect\" to open a terminal on the current session server.",
 			"terminal.connecting": "Connecting…",
 			"terminal.ready": "Terminal connected ({alias})",
 			"terminal.exited": "Terminal exited ({alias})",
@@ -1092,7 +1284,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region \0dsh-css:C:\Users\Kether\.dsh\dsh-hardssh\packages\dsh-hardssh\src\client\ssh\panel\panel.module.css.mjs
-		const css = "[data-pane=conversation]{position:relative}[data-dsh-ssh-view]{z-index:5;display:none;position:absolute;inset:0}html[data-dsh-ssh-active] [data-dsh-ssh-view]{display:block}html[data-dsh-ssh-active] [data-pane=conversation]>:not([data-dsh-ssh-view]){display:none}.GAuiuG_entry{width:100%;height:32px;color:var(--dsw-alias-label-secondary);cursor:pointer;white-space:nowrap;background:0 0;border:none;border-radius:8px;align-items:center;gap:8px;padding:0 12px;font-size:13px;display:flex}.GAuiuG_entry:hover{background:var(--dsw-specific-sidebar-nav-item-hover);color:var(--dsw-alias-label-primary)}.GAuiuG_entry[data-active]{background:var(--dsw-specific-sidebar-nav-item-active);color:var(--dsw-alias-label-primary);font-weight:600}.GAuiuG_entryIcon{flex:none;justify-content:center;align-items:center;display:inline-flex}.GAuiuG_entryLabel{text-overflow:ellipsis;overflow:hidden}[data-dsh-frame][data-sidebar-collapsed] .GAuiuG_entry{justify-content:center;width:100%;padding:0}[data-dsh-frame][data-sidebar-collapsed] .GAuiuG_entryLabel{display:none}.GAuiuG_view{overflow:hidden}.GAuiuG_panel{background:var(--dsw-alias-bg-base);min-width:0;height:100%;min-height:0;color:var(--dsw-alias-label-primary);font-family:var(--dsw-font-family);flex-direction:column;gap:10px;padding:14px 16px 16px;display:flex}.GAuiuG_panelHeader{flex:none;align-items:center;gap:10px;display:flex}.GAuiuG_panelTitle{color:var(--dsw-alias-label-primary);white-space:nowrap;flex:1;margin:0;font-size:16px;font-weight:700}.GAuiuG_tabBar{border-bottom:1px solid var(--dsw-alias-border-l1);flex:none;gap:2px;display:flex}.GAuiuG_tab{color:var(--dsw-alias-label-secondary);cursor:pointer;white-space:nowrap;background:0 0;border:none;border-bottom:2px solid #0000;border-radius:6px 6px 0 0;padding:7px 14px;font-size:13px}.GAuiuG_tab:hover{color:var(--dsw-alias-label-primary);background:var(--dsw-alias-interactive-bg-hover)}.GAuiuG_tab[data-active]{color:var(--dsw-alias-label-primary);border-bottom-color:var(--dsw-alias-state-business-primary);font-weight:600}.GAuiuG_panelContent{flex-direction:column;flex:1;min-height:0;display:flex;overflow:hidden}.GAuiuG_tabBody{flex-direction:column;flex:1;gap:10px;min-height:0;display:flex;overflow:hidden auto}.GAuiuG_fillBody{flex-direction:column;flex:1;gap:10px;min-height:0;display:flex;overflow:hidden}.GAuiuG_toolbar,.GAuiuG_controls{flex-wrap:wrap;flex:none;align-items:center;gap:8px;display:flex}.GAuiuG_controls .GAuiuG_input{flex:0 260px;min-width:150px}.GAuiuG_toolbarSpacer{flex:1}.GAuiuG_search{min-width:120px;color:var(--dsw-alias-label-primary);background:var(--dsw-specific-input-major);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;outline:none;flex:0 260px;padding:6px 10px;font-size:13px}.GAuiuG_search::placeholder{color:var(--dsw-alias-label-tertiary)}.GAuiuG_tableWrap{border:1px solid var(--dsw-alias-border-l1);border-radius:10px;flex:1;min-height:0;overflow:auto}.GAuiuG_table{border-collapse:collapse;width:100%;font-size:12.5px}.GAuiuG_table th{z-index:1;text-align:left;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);border-bottom:1px solid var(--dsw-alias-border-l1);white-space:nowrap;padding:8px 10px;font-weight:600;position:sticky;top:0}.GAuiuG_table td{border-bottom:1px solid var(--dsw-alias-separator-primary);vertical-align:top;padding:7px 10px}.GAuiuG_table tbody tr:last-child td{border-bottom:none}.GAuiuG_table tbody tr:hover td{background:var(--dsw-alias-interactive-bg-hover)}.GAuiuG_mono{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}.GAuiuG_cellMuted{color:var(--dsw-alias-label-tertiary)}.GAuiuG_actions{white-space:nowrap;align-items:center;gap:8px;display:flex}.GAuiuG_inlineTest{color:var(--dsw-alias-label-secondary);align-items:center;gap:6px;font-size:11.5px;display:inline-flex}.GAuiuG_inlineTest[data-status=ok]{color:var(--dsw-alias-state-success-primary)}.GAuiuG_inlineTest[data-status=fail]{color:var(--dsw-alias-state-error-primary)}.GAuiuG_badge{border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);white-space:nowrap;border-radius:999px;padding:1px 8px;font-size:11px;line-height:1.6;display:inline-block}.GAuiuG_badge[data-kind=key]{color:var(--dsw-alias-state-business-primary);border-color:var(--dsw-alias-state-business-primary)}.GAuiuG_badge[data-kind=password]{color:var(--dsw-alias-state-warn-primary);border-color:var(--dsw-alias-state-warn-primary)}.GAuiuG_badge[data-status=ok]{color:var(--dsw-alias-state-success-primary);border-color:var(--dsw-alias-state-success-primary)}.GAuiuG_badge[data-status=fail]{color:var(--dsw-alias-state-error-primary);border-color:var(--dsw-alias-state-error-primary)}.GAuiuG_badge[data-status=timeout]{color:var(--dsw-alias-state-warn-primary);border-color:var(--dsw-alias-state-warn-primary)}.GAuiuG_primaryButton{color:var(--dsw-alias-label-primary-foreground);background:var(--dsw-alias-button-info-fill);cursor:pointer;white-space:nowrap;border:none;border-radius:8px;padding:6px 14px;font-size:13px;font-weight:600}.GAuiuG_primaryButton:hover:not(:disabled){background:var(--dsw-alias-button-info-hover)}.GAuiuG_primaryButton:disabled{opacity:.5;cursor:default}.GAuiuG_ghostButton{color:var(--dsw-alias-label-primary);border:1px solid var(--dsw-alias-border-l2);cursor:pointer;white-space:nowrap;background:0 0;border-radius:8px;padding:5px 12px;font-size:12px}.GAuiuG_ghostButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.GAuiuG_ghostButton:disabled{opacity:.45;cursor:default}.GAuiuG_iconButton{width:26px;height:26px;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border:none;border-radius:6px;justify-content:center;align-items:center;padding:0;font-size:13px;display:inline-flex}.GAuiuG_iconButton:hover{background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary)}.GAuiuG_linkButton{color:var(--dsw-alias-state-business-primary);cursor:pointer;white-space:nowrap;background:0 0;border:none;padding:0;font-size:12px}.GAuiuG_linkButton:hover:not(:disabled){text-decoration:underline}.GAuiuG_linkButton:disabled{opacity:.45;cursor:default}.GAuiuG_linkButton[data-danger]{color:var(--dsw-alias-state-error-primary)}.GAuiuG_spinner{border:2px solid var(--dsw-alias-state-business-primary);vertical-align:-1px;border-top-color:#0000;border-radius:50%;flex:none;width:11px;height:11px;animation:.8s linear infinite GAuiuG_dshSshSpin;display:inline-block}@keyframes GAuiuG_dshSshSpin{to{transform:rotate(360deg)}}.GAuiuG_banner{border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);overflow-wrap:anywhere;border-radius:8px;padding:8px 12px;font-size:12.5px;line-height:1.5}.GAuiuG_banner[data-kind=ok]{color:var(--dsw-alias-state-success-primary);border-color:var(--dsw-alias-state-success-primary)}.GAuiuG_banner[data-kind=error]{color:var(--dsw-alias-state-error-primary);border-color:var(--dsw-alias-state-error-primary)}.GAuiuG_banner[data-kind=info]{color:var(--dsw-alias-state-business-primary);border-color:var(--dsw-alias-state-business-primary)}.GAuiuG_empty,.GAuiuG_loading{text-align:center;color:var(--dsw-alias-label-tertiary);padding:28px 12px;font-size:12.5px}.GAuiuG_modalBackdrop{z-index:40;background:var(--dsw-alias-bg-mask-1,#00000073);justify-content:center;align-items:center;padding:24px;display:flex;position:fixed;inset:0}.GAuiuG_modal{box-sizing:border-box;background:var(--dsw-alias-bg-base,#fff);border:1px solid var(--dsw-alias-border-l1,#0000000a);color:#000;width:min(560px,100vw - 48px);min-width:0;min-height:0;max-height:calc(100vh - 48px);font-family:var(--dsw-font-family,-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, system-ui, \"PingFang SC\", \"Microsoft YaHei\", sans-serif);border-radius:12px;flex-direction:column;display:flex;position:relative;overflow:hidden}.GAuiuG_modalHeader{box-sizing:border-box;flex:none;align-items:center;gap:10px;min-width:0;padding:14px 18px 10px;display:flex}.GAuiuG_modalTitle{color:#000;flex:1;align-items:center;gap:8px;margin:0;font-size:15px;font-weight:600;display:flex}.GAuiuG_whaleMark{background:radial-gradient(circle at 32% 30%,#ffffffb3 0 12%,#0000 13%),radial-gradient(circle at 50% 60%,#4d6bfe 0 42%,#0000 43%);border-radius:50% 50% 38% 38%;flex:none;width:14px;height:14px;box-shadow:0 0 0 1px #4d6bfe59}.GAuiuG_modalBody{overscroll-behavior:contain;scrollbar-width:thin;scrollbar-color:var(--dsw-alias-label-caption,#80808080) transparent;flex-direction:column;flex:auto;gap:12px;min-width:0;min-height:0;padding:4px 18px 8px;display:flex;overflow:hidden auto}.GAuiuG_modalBody::-webkit-scrollbar{width:6px}.GAuiuG_modalBody::-webkit-scrollbar-thumb{background:var(--dsw-alias-label-caption,#80808080);border-radius:6px}.GAuiuG_modalBody::-webkit-scrollbar-track{background:0 0}.GAuiuG_modalFooter{box-sizing:border-box;border-top:1px solid var(--dsw-alias-border-l2,#00000014);flex:none;justify-content:flex-end;align-items:center;gap:10px;min-width:0;padding:12px 18px 14px;display:flex}.GAuiuG_modalPrimary{background:var(--dsw-alias-button-primary-fill,#0f1115);color:var(--dsw-alias-label-primary-foreground,#fff);cursor:pointer;border:none;border-radius:8px;padding:7px 18px;font-family:inherit;font-size:13px;font-weight:600;transition:background .15s}.GAuiuG_modalPrimary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover,#2b2f36)}.GAuiuG_modalPrimary:disabled{opacity:.5;cursor:default}.GAuiuG_modalGhost{border:1px solid var(--dsw-alias-border-l2,#00000026);color:var(--dsw-alias-label-primary,#0f1115);cursor:pointer;background:0 0;border-radius:8px;padding:7px 15px;font-family:inherit;font-size:13px;transition:background .15s}.GAuiuG_modalGhost:hover:not(:disabled){background:var(--dsw-alias-bg-overlay,#0000000d)}.GAuiuG_modalGhost:disabled{opacity:.5;cursor:default}.GAuiuG_formError{background:var(--dsw-alias-state-error-bg,#f53f3f1a);border:1px solid var(--dsw-alias-state-error-primary,#f53f3f66);color:var(--dsw-alias-state-error-primary,#d03050);border-radius:6px;margin:0 18px 2px;padding:8px 12px;font-size:12px}.GAuiuG_hint{color:var(--dsw-alias-label-tertiary,#81858c);font-size:11.5px;line-height:1.45}.GAuiuG_field{flex-direction:column;gap:5px;min-width:0;display:flex}.GAuiuG_fieldLabel{color:var(--dsw-alias-label-primary,#0f1115);font-size:13px;font-weight:500}.GAuiuG_input{box-sizing:border-box;width:100%;min-width:0;min-height:36px;color:var(--dsw-alias-label-primary,#0f1115);background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#00000024);border-radius:8px;outline:none;padding:7px 10px;font-family:inherit;font-size:13px;transition:border-color .15s,box-shadow .15s}.GAuiuG_input:focus{border-color:var(--dsw-alias-brand-primary-new-colorprimary-new-color,#4176e6);box-shadow:0 0 0 2px #4176e626}.GAuiuG_input::placeholder{color:var(--dsw-alias-label-tertiary,#81858c)}.GAuiuG_input:disabled{opacity:.5}.GAuiuG_formRow{grid-template-columns:minmax(0,1.25fr) minmax(0,1fr);gap:12px;min-width:0;display:grid}.GAuiuG_radioRow{align-items:center;gap:18px;display:flex}.GAuiuG_radioLabel{color:#000;cursor:pointer;align-items:center;gap:7px;font-size:13px;display:inline-flex}.GAuiuG_radioLabel input[type=radio]{accent-color:var(--dsw-alias-brand-primary-new-colorprimary-new-color,#4176e6)}.GAuiuG_termBody{flex-direction:column;flex:1;gap:8px;min-height:0;display:flex;overflow:hidden}.GAuiuG_termWrap{border:1px solid var(--dsw-alias-border-l1);background:#0b0e14;border-radius:10px;flex:1;min-height:0;position:relative;overflow:hidden}.GAuiuG_termContainer{padding:8px 10px;position:absolute;inset:0}.GAuiuG_termPlaceholder{z-index:2;text-align:center;color:var(--dsw-alias-label-tertiary);background:var(--dsw-alias-bg-base);justify-content:center;align-items:center;padding:0 24px;font-size:12.5px;display:flex;position:absolute;inset:0}.GAuiuG_hiddenFile{display:none}.GAuiuG_browsePanel{border:1px solid var(--dsw-alias-border-l1);border-radius:10px;flex-direction:column;flex:none;display:flex;overflow:hidden}.GAuiuG_browseHeader{background:var(--dsw-alias-bg-layer-2);border-bottom:1px solid var(--dsw-alias-border-l1);align-items:center;gap:8px;padding:8px 10px;display:flex}.GAuiuG_browsePath{text-overflow:ellipsis;white-space:nowrap;min-width:0;color:var(--dsw-alias-label-secondary);flex:1;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;overflow:hidden}.GAuiuG_browseList{max-height:240px;overflow:hidden auto}.GAuiuG_dirRow{text-align:left;width:100%;min-width:0;font:inherit;color:var(--dsw-alias-label-primary);border:none;border-bottom:1px solid var(--dsw-alias-separator-primary);cursor:pointer;background:0 0;grid-template-columns:minmax(0,1fr) auto auto;gap:12px;padding:5px 10px;font-size:12.5px;display:grid}.GAuiuG_dirRow:hover{background:var(--dsw-alias-interactive-bg-hover)}.GAuiuG_dirRow[data-type=dir] .GAuiuG_dirName{color:var(--dsw-alias-state-business-primary)}.GAuiuG_dirRow[data-up]{color:var(--dsw-alias-label-secondary)}.GAuiuG_dirName{text-overflow:ellipsis;white-space:nowrap;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;overflow:hidden}.GAuiuG_dirType{color:var(--dsw-alias-label-tertiary);white-space:nowrap}.GAuiuG_dirSize{color:var(--dsw-alias-label-tertiary);white-space:nowrap;text-align:right}.GAuiuG_transferBlock{flex-direction:column;flex:none;gap:6px;display:flex}.GAuiuG_progressMeta{min-width:0;color:var(--dsw-alias-label-secondary);flex-wrap:wrap;gap:12px;font-size:12px;display:flex}.GAuiuG_progressTrack{background:var(--dsw-alias-interactive-bg-hover);border-radius:999px;height:8px;overflow:hidden}.GAuiuG_progressBar{background:var(--dsw-alias-state-business-primary);border-radius:999px;height:100%;transition:width .12s linear}.GAuiuG_tunnelList{flex-direction:column;flex:none;gap:8px;display:flex}.GAuiuG_tunnelRow{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:10px;align-items:center;gap:10px;padding:8px 12px;display:flex}.GAuiuG_tunnelRow[data-state=forwarding]{border-color:var(--dsw-alias-state-success-primary)}.GAuiuG_tunnelRow[data-state=connecting]{border-color:var(--dsw-alias-state-warn-primary)}.GAuiuG_tunnelRow[data-state=failed]{border-color:var(--dsw-alias-state-error-primary)}.GAuiuG_tunnelLabel{text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12.5px;overflow:hidden}.GAuiuG_formCard{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l1);border-radius:10px;flex-direction:column;flex:none;gap:10px;padding:12px;display:flex}.GAuiuG_clusterForm{flex-direction:column;flex:none;gap:8px;display:flex}.GAuiuG_clusterFilters{grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:10px;display:grid}.GAuiuG_commandInput{min-height:96px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}.GAuiuG_cellDetails summary{cursor:pointer;color:var(--dsw-alias-label-secondary);font-size:12px}.GAuiuG_cellPre{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);white-space:pre-wrap;word-break:break-all;border-radius:6px;max-height:180px;margin:4px 0 0;padding:6px 8px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:11.5px;overflow:auto}@media (max-width:420px){.GAuiuG_formRow{grid-template-columns:1fr}}.GAuiuG_fingerprintIntro{color:#000;margin:0 0 10px;font-size:13px;line-height:1.5}.GAuiuG_fingerprintCode{border:1px solid var(--dsw-alias-border-l2,#0000001f);background:var(--dsw-specific-input-major,#f2f3f5);color:#1f2229;word-break:break-all;-webkit-user-select:text;user-select:text;border-radius:6px;padding:10px 12px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:13px;display:block}.GAuiuG_fingerprintWarn{color:var(--dsw-alias-state-error-primary,#d03050);margin:10px 0 0;font-size:12px;line-height:1.5}";
+		const css = ".GAuiuG_panel{background:var(--dsw-alias-bg-base);min-width:0;height:100%;min-height:0;color:var(--dsw-alias-label-primary);font-family:var(--dsw-font-family);flex-direction:column;gap:10px;padding:14px 16px 16px;display:flex;position:relative}.GAuiuG_tabBar{border-bottom:1px solid var(--dsw-alias-border-l1);flex:none;gap:2px;display:flex}.GAuiuG_tab{color:var(--dsw-alias-label-secondary);cursor:pointer;white-space:nowrap;background:0 0;border:none;border-bottom:2px solid #0000;border-radius:6px 6px 0 0;padding:7px 14px;font-size:13px}.GAuiuG_tab:hover{color:var(--dsw-alias-label-primary);background:var(--dsw-alias-interactive-bg-hover)}.GAuiuG_tab[data-active]{color:var(--dsw-alias-label-primary);border-bottom-color:var(--dsw-alias-state-business-primary);font-weight:600}.GAuiuG_panelContent{flex-direction:column;flex:1;min-height:0;display:flex;overflow:hidden}.GAuiuG_sessionTarget{color:var(--dsw-alias-label-secondary);text-overflow:ellipsis;white-space:nowrap;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l1);border-radius:7px;flex:none;padding:5px 9px;font-size:12px;line-height:18px;overflow:hidden}.GAuiuG_targetBadge{min-height:30px;color:var(--dsw-alias-state-business-primary);white-space:nowrap;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-state-business-primary);border-radius:8px;align-items:center;padding:4px 10px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;display:inline-flex}.GAuiuG_disabledSurface{opacity:.4;filter:blur(3px);pointer-events:none;-webkit-user-select:none;user-select:none;flex-direction:column;flex:1;gap:10px;min-height:0;display:flex}.GAuiuG_disabledPlaceholder{background:linear-gradient(var(--dsw-alias-bg-layer-2), var(--dsw-alias-bg-layer-2)) 0 0 / 100% 34px no-repeat, repeating-linear-gradient(180deg, transparent 0 34px, var(--dsw-alias-separator-primary) 34px 35px);border:1px solid var(--dsw-alias-border-l1);border-radius:10px;flex:1;min-height:180px}.GAuiuG_localSessionMask{z-index:2;color:var(--dsw-alias-label-primary);text-align:center;background:color-mix(in srgb, var(--dsw-alias-bg-base) 72%, transparent);-webkit-backdrop-filter:blur(2px);backdrop-filter:blur(2px);flex-direction:column;justify-content:center;align-items:center;gap:8px;padding:32px;display:flex;position:absolute;inset:0}.GAuiuG_localSessionMask strong{font-size:15px}.GAuiuG_localSessionMask span{max-width:340px;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:1.55}.GAuiuG_tabBody{flex-direction:column;flex:1;gap:10px;min-height:0;display:flex;overflow:hidden auto}.GAuiuG_fillBody{flex-direction:column;flex:1;gap:10px;min-height:0;display:flex;overflow:hidden}.GAuiuG_toolbar,.GAuiuG_controls{flex-wrap:wrap;flex:none;align-items:center;gap:8px;display:flex}.GAuiuG_controls .GAuiuG_input{flex:0 260px;min-width:150px}.GAuiuG_toolbarSpacer{flex:1}.GAuiuG_search{min-width:120px;color:var(--dsw-alias-label-primary);background:var(--dsw-specific-input-major);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;outline:none;flex:0 260px;padding:6px 10px;font-size:13px}.GAuiuG_search::placeholder{color:var(--dsw-alias-label-tertiary)}.GAuiuG_tableWrap{border:1px solid var(--dsw-alias-border-l1);border-radius:10px;flex:1;min-height:0;overflow:auto}.GAuiuG_table{border-collapse:collapse;width:100%;font-size:12.5px}.GAuiuG_table th{z-index:1;text-align:left;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);border-bottom:1px solid var(--dsw-alias-border-l1);white-space:nowrap;padding:8px 10px;font-weight:600;position:sticky;top:0}.GAuiuG_table td{border-bottom:1px solid var(--dsw-alias-separator-primary);vertical-align:top;padding:7px 10px}.GAuiuG_table tbody tr:last-child td{border-bottom:none}.GAuiuG_table tbody tr:hover td{background:var(--dsw-alias-interactive-bg-hover)}.GAuiuG_mono{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}.GAuiuG_cellMuted{color:var(--dsw-alias-label-tertiary)}.GAuiuG_actions{white-space:nowrap;align-items:center;gap:8px;display:flex}.GAuiuG_inlineTest{color:var(--dsw-alias-label-secondary);align-items:center;gap:6px;font-size:11.5px;display:inline-flex}.GAuiuG_inlineTest[data-status=ok]{color:var(--dsw-alias-state-success-primary)}.GAuiuG_inlineTest[data-status=fail]{color:var(--dsw-alias-state-error-primary)}.GAuiuG_badge{border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);white-space:nowrap;border-radius:999px;padding:1px 8px;font-size:11px;line-height:1.6;display:inline-block}.GAuiuG_badge[data-kind=key]{color:var(--dsw-alias-state-business-primary);border-color:var(--dsw-alias-state-business-primary)}.GAuiuG_badge[data-kind=password]{color:var(--dsw-alias-state-warn-primary);border-color:var(--dsw-alias-state-warn-primary)}.GAuiuG_badge[data-status=ok]{color:var(--dsw-alias-state-success-primary);border-color:var(--dsw-alias-state-success-primary)}.GAuiuG_badge[data-status=fail]{color:var(--dsw-alias-state-error-primary);border-color:var(--dsw-alias-state-error-primary)}.GAuiuG_badge[data-status=timeout]{color:var(--dsw-alias-state-warn-primary);border-color:var(--dsw-alias-state-warn-primary)}.GAuiuG_primaryButton{color:var(--dsw-alias-label-primary-foreground);background:var(--dsw-alias-button-info-fill);cursor:pointer;white-space:nowrap;border:none;border-radius:8px;padding:6px 14px;font-size:13px;font-weight:600}.GAuiuG_primaryButton:hover:not(:disabled){background:var(--dsw-alias-button-info-hover)}.GAuiuG_primaryButton:disabled{opacity:.5;cursor:default}.GAuiuG_ghostButton{color:var(--dsw-alias-label-primary);border:1px solid var(--dsw-alias-border-l2);cursor:pointer;white-space:nowrap;background:0 0;border-radius:8px;padding:5px 12px;font-size:12px}.GAuiuG_ghostButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.GAuiuG_ghostButton:disabled{opacity:.45;cursor:default}.GAuiuG_linkButton{color:var(--dsw-alias-state-business-primary);cursor:pointer;white-space:nowrap;background:0 0;border:none;padding:0;font-size:12px}.GAuiuG_linkButton:hover:not(:disabled){text-decoration:underline}.GAuiuG_linkButton:disabled{opacity:.45;cursor:default}.GAuiuG_linkButton[data-danger]{color:var(--dsw-alias-state-error-primary)}.GAuiuG_spinner{border:2px solid var(--dsw-alias-state-business-primary);vertical-align:-1px;border-top-color:#0000;border-radius:50%;flex:none;width:11px;height:11px;animation:.8s linear infinite GAuiuG_dshSshSpin;display:inline-block}@keyframes GAuiuG_dshSshSpin{to{transform:rotate(360deg)}}.GAuiuG_banner{border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);overflow-wrap:anywhere;border-radius:8px;padding:8px 12px;font-size:12.5px;line-height:1.5}.GAuiuG_banner[data-kind=ok]{color:var(--dsw-alias-state-success-primary);border-color:var(--dsw-alias-state-success-primary)}.GAuiuG_banner[data-kind=error]{color:var(--dsw-alias-state-error-primary);border-color:var(--dsw-alias-state-error-primary)}.GAuiuG_banner[data-kind=info]{color:var(--dsw-alias-state-business-primary);border-color:var(--dsw-alias-state-business-primary)}.GAuiuG_empty,.GAuiuG_loading{text-align:center;color:var(--dsw-alias-label-tertiary);padding:28px 12px;font-size:12.5px}.GAuiuG_modalBackdrop{z-index:40;background:var(--dsw-alias-bg-mask-1,#00000073);justify-content:center;align-items:center;padding:24px;display:flex;position:fixed;inset:0}.GAuiuG_modal{box-sizing:border-box;background:var(--dsw-alias-bg-base,#fff);border:1px solid var(--dsw-alias-border-l1,#0000000a);width:min(560px,100vw - 48px);min-width:0;min-height:0;max-height:calc(100vh - 48px);color:var(--dsw-alias-label-primary,#0f1115);font-family:var(--dsw-font-family,-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, system-ui, \"PingFang SC\", \"Microsoft YaHei\", sans-serif);border-radius:12px;flex-direction:column;display:flex;position:relative;overflow:hidden}.GAuiuG_modalHeader{box-sizing:border-box;flex:none;align-items:center;gap:10px;min-width:0;padding:14px 18px 10px;display:flex}.GAuiuG_modalTitle{color:var(--dsw-alias-label-primary,#0f1115);flex:1;align-items:center;gap:8px;margin:0;font-size:15px;font-weight:600;display:flex}.GAuiuG_whaleMark{background:radial-gradient(circle at 32% 30%,#ffffffb3 0 12%,#0000 13%),radial-gradient(circle at 50% 60%,#4d6bfe 0 42%,#0000 43%);border-radius:50% 50% 38% 38%;flex:none;width:14px;height:14px;box-shadow:0 0 0 1px #4d6bfe59}.GAuiuG_modalBody{overscroll-behavior:contain;scrollbar-width:thin;scrollbar-color:var(--dsw-alias-label-caption,#80808080) transparent;flex-direction:column;flex:auto;gap:12px;min-width:0;min-height:0;padding:4px 18px 8px;display:flex;overflow:hidden auto}.GAuiuG_modalBody::-webkit-scrollbar{width:6px}.GAuiuG_modalBody::-webkit-scrollbar-thumb{background:var(--dsw-alias-label-caption,#80808080);border-radius:6px}.GAuiuG_modalBody::-webkit-scrollbar-track{background:0 0}.GAuiuG_modalFooter{box-sizing:border-box;border-top:1px solid var(--dsw-alias-border-l2,#00000014);flex:none;justify-content:flex-end;align-items:center;gap:10px;min-width:0;padding:12px 18px 14px;display:flex}.GAuiuG_modalPrimary{background:var(--dsw-alias-button-primary-fill,#0f1115);color:var(--dsw-alias-label-primary-foreground,#fff);cursor:pointer;border:none;border-radius:8px;padding:7px 18px;font-family:inherit;font-size:13px;font-weight:600;transition:background .15s}.GAuiuG_modalPrimary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover,#2b2f36)}.GAuiuG_modalPrimary:disabled{opacity:.5;cursor:default}.GAuiuG_modalGhost{border:1px solid var(--dsw-alias-border-l2,#00000026);color:var(--dsw-alias-label-primary,#0f1115);cursor:pointer;background:0 0;border-radius:8px;padding:7px 15px;font-family:inherit;font-size:13px;transition:background .15s}.GAuiuG_modalGhost:hover:not(:disabled){background:var(--dsw-alias-bg-overlay,#0000000d)}.GAuiuG_modalGhost:disabled{opacity:.5;cursor:default}.GAuiuG_formError{background:var(--dsw-alias-state-error-bg,#f53f3f1a);border:1px solid var(--dsw-alias-state-error-primary,#f53f3f66);color:var(--dsw-alias-state-error-primary,#d03050);border-radius:6px;margin:0 18px 2px;padding:8px 12px;font-size:12px}.GAuiuG_hint{color:var(--dsw-alias-label-tertiary,#81858c);font-size:11.5px;line-height:1.45}.GAuiuG_field{flex-direction:column;gap:5px;min-width:0;display:flex}.GAuiuG_fieldLabel{color:var(--dsw-alias-label-primary,#0f1115);font-size:13px;font-weight:500}.GAuiuG_input{box-sizing:border-box;width:100%;min-width:0;min-height:36px;color:var(--dsw-alias-label-primary,#0f1115);background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#00000024);border-radius:8px;outline:none;padding:7px 10px;font-family:inherit;font-size:13px;transition:border-color .15s,box-shadow .15s}.GAuiuG_input:focus{border-color:var(--dsw-alias-brand-primary-new-colorprimary-new-color,#4176e6);box-shadow:0 0 0 2px #4176e626}.GAuiuG_input::placeholder{color:var(--dsw-alias-label-tertiary,#81858c)}.GAuiuG_input:disabled{opacity:.5}.GAuiuG_formRow{grid-template-columns:minmax(0,1.25fr) minmax(0,1fr);gap:12px;min-width:0;display:grid}.GAuiuG_radioRow{align-items:center;gap:18px;display:flex}.GAuiuG_radioLabel{color:var(--dsw-alias-label-primary,#0f1115);cursor:pointer;align-items:center;gap:7px;font-size:13px;display:inline-flex}.GAuiuG_radioLabel input[type=radio]{accent-color:var(--dsw-alias-brand-primary-new-colorprimary-new-color,#4176e6)}.GAuiuG_termBody{flex-direction:column;flex:1;gap:8px;min-height:0;display:flex;overflow:hidden}.GAuiuG_termWrap{border:1px solid var(--dsw-alias-border-l1);background:#0b0e14;border-radius:10px;flex:1;min-height:0;position:relative;overflow:hidden}.GAuiuG_termContainer{padding:8px 10px;position:absolute;inset:0}.GAuiuG_termPlaceholder{z-index:2;text-align:center;color:var(--dsw-alias-label-tertiary);background:var(--dsw-alias-bg-base);justify-content:center;align-items:center;padding:0 24px;font-size:12.5px;display:flex;position:absolute;inset:0}.GAuiuG_hiddenFile{display:none}.GAuiuG_browsePanel{border:1px solid var(--dsw-alias-border-l1);border-radius:10px;flex-direction:column;flex:none;display:flex;overflow:hidden}.GAuiuG_browseHeader{background:var(--dsw-alias-bg-layer-2);border-bottom:1px solid var(--dsw-alias-border-l1);align-items:center;gap:8px;padding:8px 10px;display:flex}.GAuiuG_browsePath{text-overflow:ellipsis;white-space:nowrap;min-width:0;color:var(--dsw-alias-label-secondary);flex:1;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;overflow:hidden}.GAuiuG_browseList{max-height:240px;overflow:hidden auto}.GAuiuG_dirRow{text-align:left;width:100%;min-width:0;font:inherit;color:var(--dsw-alias-label-primary);border:none;border-bottom:1px solid var(--dsw-alias-separator-primary);cursor:pointer;background:0 0;grid-template-columns:minmax(0,1fr) auto auto;gap:12px;padding:5px 10px;font-size:12.5px;display:grid}.GAuiuG_dirRow:hover{background:var(--dsw-alias-interactive-bg-hover)}.GAuiuG_dirRow[data-type=dir] .GAuiuG_dirName{color:var(--dsw-alias-state-business-primary)}.GAuiuG_dirRow[data-up]{color:var(--dsw-alias-label-secondary)}.GAuiuG_dirName{text-overflow:ellipsis;white-space:nowrap;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;overflow:hidden}.GAuiuG_dirType{color:var(--dsw-alias-label-tertiary);white-space:nowrap}.GAuiuG_dirSize{color:var(--dsw-alias-label-tertiary);white-space:nowrap;text-align:right}.GAuiuG_transferBlock{flex-direction:column;flex:none;gap:6px;display:flex}.GAuiuG_progressMeta{min-width:0;color:var(--dsw-alias-label-secondary);flex-wrap:wrap;gap:12px;font-size:12px;display:flex}.GAuiuG_progressTrack{background:var(--dsw-alias-interactive-bg-hover);border-radius:999px;height:8px;overflow:hidden}.GAuiuG_progressBar{background:var(--dsw-alias-state-business-primary);border-radius:999px;height:100%;transition:width .12s linear}.GAuiuG_tunnelList{flex-direction:column;flex:none;gap:8px;display:flex}.GAuiuG_tunnelRow{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:10px;align-items:center;gap:10px;padding:8px 12px;display:flex}.GAuiuG_tunnelRow[data-state=forwarding]{border-color:var(--dsw-alias-state-success-primary)}.GAuiuG_tunnelRow[data-state=connecting]{border-color:var(--dsw-alias-state-warn-primary)}.GAuiuG_tunnelRow[data-state=failed]{border-color:var(--dsw-alias-state-error-primary)}.GAuiuG_tunnelLabel{text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12.5px;overflow:hidden}.GAuiuG_formCard{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l1);border-radius:10px;flex-direction:column;flex:none;gap:10px;padding:12px;display:flex}.GAuiuG_clusterForm{flex-direction:column;flex:none;gap:8px;display:flex}.GAuiuG_clusterFilters{grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:10px;display:grid}.GAuiuG_commandInput{min-height:96px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}.GAuiuG_cellDetails summary{cursor:pointer;color:var(--dsw-alias-label-secondary);font-size:12px}.GAuiuG_cellPre{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);white-space:pre-wrap;word-break:break-all;border-radius:6px;max-height:180px;margin:4px 0 0;padding:6px 8px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:11.5px;overflow:auto}@media (max-width:420px){.GAuiuG_formRow{grid-template-columns:1fr}}.GAuiuG_fingerprintIntro{color:var(--dsw-alias-label-primary,#0f1115);margin:0 0 10px;font-size:13px;line-height:1.5}.GAuiuG_fingerprintCode{border:1px solid var(--dsw-alias-border-l2,#0000001f);background:var(--dsw-specific-input-major,#f2f3f5);color:var(--dsw-alias-label-primary,#0f1115);word-break:break-all;-webkit-user-select:text;user-select:text;border-radius:6px;padding:10px 12px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:13px;display:block}.GAuiuG_fingerprintWarn{color:var(--dsw-alias-state-error-primary,#d03050);margin:10px 0 0;font-size:12px;line-height:1.5}";
 		const tagId = "@tiphareth/dsh-hardssh/panel.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
 			const tag = document.createElement("style");
@@ -1120,11 +1312,10 @@ window.__ModuleLoader__.load({
 			"dirRow": "GAuiuG_dirRow",
 			"dirSize": "GAuiuG_dirSize",
 			"dirType": "GAuiuG_dirType",
+			"disabledPlaceholder": "GAuiuG_disabledPlaceholder",
+			"disabledSurface": "GAuiuG_disabledSurface",
 			"dshSshSpin": "GAuiuG_dshSshSpin",
 			"empty": "GAuiuG_empty",
-			"entry": "GAuiuG_entry",
-			"entryIcon": "GAuiuG_entryIcon",
-			"entryLabel": "GAuiuG_entryLabel",
 			"field": "GAuiuG_field",
 			"fieldLabel": "GAuiuG_fieldLabel",
 			"fillBody": "GAuiuG_fillBody",
@@ -1137,11 +1328,11 @@ window.__ModuleLoader__.load({
 			"ghostButton": "GAuiuG_ghostButton",
 			"hiddenFile": "GAuiuG_hiddenFile",
 			"hint": "GAuiuG_hint",
-			"iconButton": "GAuiuG_iconButton",
 			"inlineTest": "GAuiuG_inlineTest",
 			"input": "GAuiuG_input",
 			"linkButton": "GAuiuG_linkButton",
 			"loading": "GAuiuG_loading",
+			"localSessionMask": "GAuiuG_localSessionMask",
 			"modal": "GAuiuG_modal",
 			"modalBackdrop": "GAuiuG_modalBackdrop",
 			"modalBody": "GAuiuG_modalBody",
@@ -1153,8 +1344,6 @@ window.__ModuleLoader__.load({
 			"mono": "GAuiuG_mono",
 			"panel": "GAuiuG_panel",
 			"panelContent": "GAuiuG_panelContent",
-			"panelHeader": "GAuiuG_panelHeader",
-			"panelTitle": "GAuiuG_panelTitle",
 			"primaryButton": "GAuiuG_primaryButton",
 			"progressBar": "GAuiuG_progressBar",
 			"progressMeta": "GAuiuG_progressMeta",
@@ -1162,12 +1351,14 @@ window.__ModuleLoader__.load({
 			"radioLabel": "GAuiuG_radioLabel",
 			"radioRow": "GAuiuG_radioRow",
 			"search": "GAuiuG_search",
+			"sessionTarget": "GAuiuG_sessionTarget",
 			"spinner": "GAuiuG_spinner",
 			"tab": "GAuiuG_tab",
 			"tabBar": "GAuiuG_tabBar",
 			"tabBody": "GAuiuG_tabBody",
 			"table": "GAuiuG_table",
 			"tableWrap": "GAuiuG_tableWrap",
+			"targetBadge": "GAuiuG_targetBadge",
 			"termBody": "GAuiuG_termBody",
 			"termContainer": "GAuiuG_termContainer",
 			"termPlaceholder": "GAuiuG_termPlaceholder",
@@ -1178,7 +1369,6 @@ window.__ModuleLoader__.load({
 			"tunnelLabel": "GAuiuG_tunnelLabel",
 			"tunnelList": "GAuiuG_tunnelList",
 			"tunnelRow": "GAuiuG_tunnelRow",
-			"view": "GAuiuG_view",
 			"whaleMark": "GAuiuG_whaleMark"
 		};
 		//#endregion
@@ -1190,7 +1380,7 @@ window.__ModuleLoader__.load({
 		* exposes the secret-free summary).
 		*/
 		/** Split a comma-separated input into a trimmed, non-empty string list. */
-		function splitList$1(text) {
+		function splitList(text) {
 			return text.split(",").map((part) => part.trim()).filter((part) => part !== "");
 		}
 		/** Initial form state: the summary's public fields plus empty secrets. */
@@ -1257,10 +1447,10 @@ window.__ModuleLoader__.load({
 						keyPath: form.keyPath.trim(),
 						passphrase: form.passphrase === "" ? void 0 : form.passphrase
 					},
-					proxyJump: splitList$1(form.proxyJump),
+					proxyJump: splitList(form.proxyJump),
 					description: form.description.trim() === "" ? void 0 : form.description.trim(),
 					environment: form.environment.trim() === "" ? void 0 : form.environment.trim(),
-					tags: splitList$1(form.tags),
+					tags: splitList(form.tags),
 					location: form.location.trim() === "" ? void 0 : form.location.trim()
 				};
 				setSaving(true);
@@ -1576,99 +1766,36 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
-		//#region src/client/manager-button.tsx
+		//#region src/client/workspace-panel.tsx
 		/**
-		* The SSH workspace manager: a session-header button opening a dropdown that
-		* lists SSH-bound workspaces grouped by server (two-level: server → its
-		* workspaces) and lets the operator:
-		* - delete a workspace (existing),
-		* - edit / delete a SERVER (gear / minus on each server row; deleting a
-		*   server is allowed only when it backs no workspace — the API also enforces
-		*   this with a 409 HOST_IN_USE),
-		* - create a new server (bottom action), reusing the host form dialog.
-		* Rendering is a portal dropdown with its own React root (the shell exposes
-		* no modal slot for external plugins).
+		* The SSH workspace manager as a CENTER panel (left sidebar global entry →
+		* `main` slot). Content is unchanged from the old session-header dropdown:
+		* server rows with their SSH-bound workspaces underneath, server edit/delete
+		* (delete is refused while the server still backs a workspace), and a
+		* "new server" action at the bottom.
+		*
+		* This is a plain panel body: no portal, no anchoring, no click-outside
+		* dismissal. The left sidebar owns the entry row and the center column owns
+		* the frame; closing the panel is the shell's business (select the
+		* Conversation row back), not ours.
 		*/
-		/** The session-header button. Slot-injected props: manager + sshApi. */
-		function WorkspaceManagerButton(props) {
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
-				type: "button",
-				className: workspace_module_css_default.managerButton,
-				"data-ssh-workspace-manager": "",
-				title: tt$1("manager.tooltip"),
-				onClick: (event) => openManager(props.manager, props.sshApi, event.currentTarget),
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
-					viewBox: "0 0 16 16",
-					width: "12",
-					height: "12",
-					fill: "none",
-					stroke: "currentColor",
-					strokeWidth: "1.4",
-					strokeLinecap: "round",
-					strokeLinejoin: "round",
-					"aria-hidden": "true",
-					children: [
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "2",
-							y: "3",
-							width: "12",
-							height: "10",
-							rx: "2"
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", { d: "M6 6.5l2.2 1.6L6 9.7" }),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", { d: "M9.5 9.5h2" })
-					]
-				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: tt$1("manager.label") })]
-			});
-		}
-		/** Open the manager dropdown, anchored under the trigger button. */
-		function openManager(manager, sshApi, trigger) {
-			const element = document.createElement("div");
-			element.dataset.sshWorkspaceManagerOverlay = "";
-			document.body.appendChild(element);
-			const root = (0, react_dom_client.createRoot)(element);
-			const close = () => {
-				root.unmount();
-				element.remove();
-			};
-			let anchor;
-			if (trigger !== void 0) {
-				const rect = trigger.getBoundingClientRect();
-				anchor = {
-					bottom: rect.bottom,
-					left: rect.left
-				};
-			}
-			root.render(/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ManagerOverlay, {
-				manager,
-				sshApi,
-				onClose: close,
-				anchor
-			}));
-		}
-		/** The manager dropdown: server + workspace rows, with server CRUD. */
-		function ManagerOverlay(props) {
-			const [workspaces, setWorkspaces] = (0, react.useState)(null);
+		/** The workspace manager panel body. */
+		function WorkspaceManagerPanel({ manager, sshApi }) {
+			const [workspaces, setWorkspaces] = (0, react.useState)(() => manager.getSnapshot().workspaces);
 			const [hosts, setHosts] = (0, react.useState)(null);
+			const [connectedAliases, setConnectedAliases] = (0, react.useState)(null);
+			/** Why connection state is unavailable — surfaced, never silently degraded. */
+			const [connectionError, setConnectionError] = (0, react.useState)(null);
 			const [error, setError] = (0, react.useState)(null);
 			const [deleting, setDeleting] = (0, react.useState)(null);
 			const [deletingAlias, setDeletingAlias] = (0, react.useState)(null);
 			const [hostDialog, setHostDialog] = (0, react.useState)(null);
-			const menuRef = (0, react.useRef)(null);
-			(0, react.useEffect)(() => {
-				const onMouseDown = (event) => {
-					if (menuRef.current !== null && menuRef.current.contains(event.target)) return;
-					props.onClose();
-				};
-				document.addEventListener("mousedown", onMouseDown);
-				return () => document.removeEventListener("mousedown", onMouseDown);
-			}, [props]);
-			const load = () => {
-				setWorkspaces(props.manager.getSnapshot().workspaces);
-			};
 			const loadHosts = () => {
-				if (props.sshApi === void 0) return;
-				props.sshApi.listHosts().then((list) => {
+				if (sshApi === void 0) {
+					setHosts([]);
+					return;
+				}
+				sshApi.listHosts().then((list) => {
 					setHosts(list);
 				}, (cause) => {
 					setError(cause instanceof Error ? cause.message : String(cause));
@@ -1676,74 +1803,89 @@ window.__ModuleLoader__.load({
 				});
 			};
 			(0, react.useEffect)(() => {
-				load();
-				props.manager.refresh();
-				const unsubscribe = props.manager.subscribe(() => {
-					load();
+				setWorkspaces(manager.getSnapshot().workspaces);
+				manager.refresh();
+				const unsubscribe = manager.subscribe(() => {
+					setWorkspaces(manager.getSnapshot().workspaces);
 				});
 				loadHosts();
+				let disposed = false;
+				const refreshConnections = async () => {
+					if (sshApi === void 0) {
+						if (!disposed) setConnectedAliases(/* @__PURE__ */ new Set());
+						return;
+					}
+					try {
+						const aliases = await sshApi.connectedAliases();
+						if (disposed) return;
+						setConnectedAliases(new Set(aliases));
+						setConnectionError(null);
+					} catch (cause) {
+						if (disposed) return;
+						setConnectedAliases(null);
+						setConnectionError(cause instanceof Error ? cause.message : String(cause));
+					}
+				};
+				refreshConnections();
+				const timer = window.setInterval(() => {
+					refreshConnections();
+				}, 3e3);
 				return () => {
+					disposed = true;
+					window.clearInterval(timer);
 					unsubscribe();
 				};
-			}, []);
+			}, [manager, sshApi]);
 			const remove = (id) => {
 				setDeleting(id);
-				props.manager.remove(id).catch((e) => setError(e instanceof Error ? e.message : String(e))).finally(() => setDeleting(null));
+				manager.remove(id).catch((cause) => setError(cause instanceof Error ? cause.message : String(cause))).finally(() => setDeleting(null));
 			};
 			const deleteHost = (alias) => {
-				if (props.sshApi === void 0) return;
+				if (sshApi === void 0) return;
 				setDeletingAlias(alias);
-				props.sshApi.deleteHost(alias).then(() => {
+				sshApi.deleteHost(alias).then(() => {
 					loadHosts();
-				}).catch((e) => setError(e instanceof Error ? e.message : String(e))).finally(() => setDeletingAlias(null));
+				}).catch((cause) => setError(cause instanceof Error ? cause.message : String(cause))).finally(() => setDeletingAlias(null));
 			};
 			const savedHost = () => {
 				setHostDialog(null);
 				loadHosts();
-				props.manager.refresh();
+				manager.refresh();
 			};
-			const anchorTop = props.anchor !== void 0 ? props.anchor.bottom + 4 : 56;
-			const anchorLeft = props.anchor !== void 0 ? props.anchor.left : Math.max(8, window.innerWidth - 380);
-			const top = Math.max(8, Math.min(anchorTop, window.innerHeight - 340));
-			const left = Math.max(8, Math.min(anchorLeft, window.innerWidth - 380));
-			return (0, react_dom.createPortal)(/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				ref: menuRef,
-				className: workspace_module_css_default.menuDropdown,
-				"data-ssh-workspace-manager-menu": "",
-				style: {
-					top,
-					left,
-					width: 380
-				},
-				onClick: (event) => event.stopPropagation(),
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: workspace_module_css_default.managerPanel,
 				children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
-						className: workspace_module_css_default.managerMenuHeader,
-						children: [tt$1("manager.title"), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-							type: "button",
-							className: workspace_module_css_default.managerMenuClose,
-							onClick: props.onClose,
-							"aria-label": tt$1("create.cancel"),
-							children: "×"
-						})]
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: workspace_module_css_default.managerPanelHeader,
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", {
+							className: workspace_module_css_default.managerPanelTitle,
+							children: tt$1("manager.title")
+						})
 					}),
 					error !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: workspace_module_css_default.dialogFail,
 						children: error
 					}),
-					workspaces === null && hosts === null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					connectionError !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: workspace_module_css_default.dialogFail,
+						"data-test": "connection-state-error",
+						children: tt$1("manager.connectionError", connectionError)
+					}),
+					hosts === null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: workspace_module_css_default.dialogInfo,
 						children: tt$1("panel.loading")
 					}),
-					workspaces !== null && workspaces.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					workspaces.length === 0 && hosts !== null && hosts.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: workspace_module_css_default.dialogHint,
 						children: tt$1("manager.empty")
 					}),
 					hosts !== null && hosts.map((host) => {
-						const hostWorkspaces = workspaces === null ? [] : workspaces.filter((w) => w.alias === host.alias);
+						const hostWorkspaces = workspaces.filter((workspace) => workspace.alias === host.alias);
 						const inUse = hostWorkspaces.length > 0;
+						const connectionState = connectedAliases === null ? "unknown" : connectedAliases.has(host.alias) ? "connected" : "disconnected";
+						const connectionLabel = connectionState === "connected" ? tt$1("manager.connected") : connectionState === "disconnected" ? tt$1("manager.disconnected") : tt$1("manager.connectionUnknown");
 						return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-							style: { marginBottom: 10 },
+							className: workspace_module_css_default.managerPanelGroup,
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: workspace_module_css_default.managerGroupHeader,
 								style: {
@@ -1766,6 +1908,15 @@ window.__ModuleLoader__.load({
 										},
 										children: host.alias
 									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+										className: workspace_module_css_default.connectionBadge,
+										"data-state": connectionState,
+										title: connectionLabel,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: workspace_module_css_default.connectionDot,
+											"aria-hidden": "true"
+										}), connectionLabel]
+									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 										className: workspace_module_css_default.hostMeta,
 										style: { fontSize: 11 },
@@ -1831,7 +1982,7 @@ window.__ModuleLoader__.load({
 											overflow: "hidden",
 											textOverflow: "ellipsis",
 											whiteSpace: "nowrap",
-											maxWidth: 150
+											maxWidth: 220
 										},
 										children: workspace.remoteRoot
 									}),
@@ -1845,7 +1996,7 @@ window.__ModuleLoader__.load({
 										},
 										disabled: deleting === workspace.id,
 										onClick: () => {
-											if (!deleting) remove(workspace.id);
+											if (deleting === null) remove(workspace.id);
 										},
 										children: deleting === workspace.id ? "…" : tt$1("manager.delete")
 									})
@@ -1853,12 +2004,8 @@ window.__ModuleLoader__.load({
 							}, workspace.id))]
 						}, host.alias);
 					}),
-					props.sshApi !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						style: {
-							marginTop: 4,
-							borderTop: `1px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.1))`,
-							paddingTop: 6
-						},
+					sshApi !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: workspace_module_css_default.managerPanelFooter,
 						children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
 							type: "button",
 							className: workspace_module_css_default.menuItem,
@@ -1871,8 +2018,8 @@ window.__ModuleLoader__.load({
 							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: tt$1("manager.newHost") })]
 						})
 					}),
-					hostDialog !== null && props.sshApi !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HostFormDialog, {
-						api: props.sshApi,
+					hostDialog !== null && sshApi !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HostFormDialog, {
+						api: sshApi,
 						editing: hostDialog.mode === "edit" ? hostDialog.host : null,
 						onClose: () => {
 							setHostDialog(null);
@@ -1880,7 +2027,60 @@ window.__ModuleLoader__.load({
 						onSaved: savedHost
 					})
 				]
-			}), document.body);
+			});
+		}
+		//#endregion
+		//#region src/client/workspace-panel-entry.tsx
+		/** The main-panel key AND the sidebar row id: one identity addresses both. */
+		const WORKSPACE_PANEL_ID = "dsh-hardssh-workspaces";
+		/** Order among the global panel rows; the shipped rows sit around 0. */
+		const WORKSPACE_PANEL_ORDER = 100;
+		/** The cloud/terminal glyph the workspace row shows in both the wide and rail sidebar. */
+		function WorkspacePanelIcon({ size }) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				viewBox: "0 0 16 16",
+				width: size,
+				height: size,
+				fill: "none",
+				stroke: "currentColor",
+				strokeWidth: "1.3",
+				strokeLinecap: "round",
+				strokeLinejoin: "round",
+				"aria-hidden": "true",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
+						x: "2",
+						y: "2.5",
+						width: "12",
+						height: "11",
+						rx: "1.5"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", { d: "M4.5 5.5l2.5 2.5-2.5 2.5" }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", { d: "M8.5 10.5h3" })
+				]
+			});
+		}
+		/**
+		* Register the left-sidebar row and the center panel body.
+		* @param ctx - client root context carrying the slot registry.
+		* @param deps - the workspace manager and the host API the panel uses.
+		*/
+		function registerWorkspacePanel(ctx, deps) {
+			const inject = () => ({
+				manager: deps.manager,
+				sshApi: deps.sshApi
+			});
+			ctx.slots.inject("sidebar.panellist", () => ctx.slots.register({
+				name: "sidebar.panellist",
+				id: WORKSPACE_PANEL_ID,
+				order: WORKSPACE_PANEL_ORDER,
+				label: () => tt$1("panel.workspaces")
+			}, WorkspacePanelIcon));
+			ctx.slots.inject("main", () => ctx.slots.register({
+				name: "main",
+				key: WORKSPACE_PANEL_ID,
+				inject
+			}, WorkspaceManagerPanel));
 		}
 		//#endregion
 		//#region src/client/migrate.ts
@@ -2043,6 +2243,13 @@ window.__ModuleLoader__.load({
 				password: ""
 			});
 			const [savingHost, setSavingHost] = (0, react.useState)(false);
+			const openRef = (0, react.useRef)(open);
+			openRef.current = open;
+			const localPickRequestSequence = (0, react.useRef)(0);
+			const hostsRequestSequence = (0, react.useRef)(0);
+			const directoryRequestSequence = (0, react.useRef)(0);
+			const createWorkspaceRequestSequence = (0, react.useRef)(0);
+			const createHostRequestSequence = (0, react.useRef)(0);
 			(0, react.useEffect)(() => {
 				if (!open) return;
 				setChoice("menu");
@@ -2050,6 +2257,9 @@ window.__ModuleLoader__.load({
 				setDirPath("");
 				setTitle("");
 				setDirEntries([]);
+				setLoading(false);
+				setCreating(false);
+				setSavingHost(false);
 				setError(null);
 				setAddingHost(false);
 				setNewHost({
@@ -2060,7 +2270,19 @@ window.__ModuleLoader__.load({
 					password: ""
 				});
 				setAnchorRect();
-				props.listHosts().then((list) => setHosts(list)).catch(() => setHosts([]));
+				const request = ++hostsRequestSequence.current;
+				props.listHosts().then((list) => {
+					if (request === hostsRequestSequence.current && openRef.current) setHosts(list);
+				}, () => {
+					if (request === hostsRequestSequence.current && openRef.current) setHosts([]);
+				});
+				return () => {
+					localPickRequestSequence.current += 1;
+					hostsRequestSequence.current += 1;
+					directoryRequestSequence.current += 1;
+					createWorkspaceRequestSequence.current += 1;
+					createHostRequestSequence.current += 1;
+				};
 			}, [open]);
 			/** Locate the trigger element that just opened the flow and anchor the menu
 			*  directly under it. Priority: the focused element (the button the operator
@@ -2105,42 +2327,50 @@ window.__ModuleLoader__.load({
 			if (!open) return null;
 			/** Choose "Local workspace": drive the native chooser once. */
 			const pickLocal = () => {
+				const request = ++localPickRequestSequence.current;
 				setChoice("picking-local");
 				props.pickDirectory().then((path) => {
+					if (request !== localPickRequestSequence.current || !openRef.current) return;
 					if (path === null) outcome.current.onCancel();
 					else outcome.current.onPicked(path);
-				}, (reason) => outcome.current.onError(reason instanceof Error ? reason.message : String(reason)));
+				}, (reason) => {
+					if (request === localPickRequestSequence.current && openRef.current) outcome.current.onError(reason instanceof Error ? reason.message : String(reason));
+				});
 			};
 			/** Browse a remote dir level for the SSH branch. When the connection needs
 			*  a credential (host key untrusted / session password), run the interactive
 			*  gate first, then retry — the operator never sees a raw "connect" error. */
 			const browse = async (alias, path) => {
+				const request = ++directoryRequestSequence.current;
 				if (alias === "") {
 					setError(tt$1("create.needHost"));
 					return;
 				}
-				for (let attempt = 0; attempt < 3; attempt++) {
-					setLoading(true);
-					setError(null);
-					try {
+				setLoading(true);
+				setError(null);
+				try {
+					for (let attempt = 0; attempt < 3; attempt++) try {
 						const result = await props.listRemoteDir(alias, path);
+						if (request !== directoryRequestSequence.current || !openRef.current) return;
 						setDirPath(result.path);
 						setDirEntries(result.entries);
 						setChoice("browsing");
-						setLoading(false);
 						return;
 					} catch (e) {
+						if (request !== directoryRequestSequence.current || !openRef.current) return;
 						const code = e?.code;
-						const interactive = code === "NEEDS_PASSWORD" || code === "HOST_KEY_UNKNOWN" || code === "HOST_KEY_MISMATCH";
-						setLoading(false);
-						if (!interactive) {
+						if (!(code === "NEEDS_PASSWORD" || code === "HOST_KEY_UNKNOWN" || code === "HOST_KEY_MISMATCH")) {
 							setError(e instanceof Error ? e.message : String(e));
 							return;
 						}
-						if (!await props.ensureConnected(alias)) return;
+						const connected = await props.ensureConnected(alias);
+						if (request !== directoryRequestSequence.current || !openRef.current) return;
+						if (!connected) return;
 					}
+					if (request === directoryRequestSequence.current && openRef.current) setError(tt$1("create.needConnect"));
+				} finally {
+					if (request === directoryRequestSequence.current && openRef.current) setLoading(false);
 				}
-				setError(tt$1("create.needConnect"));
 			};
 			/** Create the SSH workspace; on success hand the anchor to the owner. */
 			const createSsh = async () => {
@@ -2148,6 +2378,7 @@ window.__ModuleLoader__.load({
 					setError(host === "" ? tt$1("create.needHost") : dirPath === "" ? tt$1("create.needDir") : tt$1("create.needTitle"));
 					return;
 				}
+				const request = ++createWorkspaceRequestSequence.current;
 				setCreating(true);
 				setError(null);
 				try {
@@ -2156,11 +2387,12 @@ window.__ModuleLoader__.load({
 						alias: host,
 						remoteRoot: dirPath
 					});
+					if (request !== createWorkspaceRequestSequence.current || !openRef.current) return;
 					outcome.current.onPicked(record.anchorPath);
 				} catch (e) {
-					setError(e instanceof Error ? e.message : String(e));
+					if (request === createWorkspaceRequestSequence.current && openRef.current) setError(e instanceof Error ? e.message : String(e));
 				} finally {
-					setCreating(false);
+					if (request === createWorkspaceRequestSequence.current && openRef.current) setCreating(false);
 				}
 			};
 			/** Save a newly-added SSH host, refresh the list, select it, and close the
@@ -2171,6 +2403,7 @@ window.__ModuleLoader__.load({
 					setError(tt$1("host.needFields"));
 					return;
 				}
+				const request = ++createHostRequestSequence.current;
 				setSavingHost(true);
 				setError(null);
 				try {
@@ -2184,7 +2417,10 @@ window.__ModuleLoader__.load({
 							password: newHost.password
 						}
 					});
+					if (request !== createHostRequestSequence.current || !openRef.current) return;
+					const hostsRequest = ++hostsRequestSequence.current;
 					const list = await props.listHosts();
+					if (request !== createHostRequestSequence.current || hostsRequest !== hostsRequestSequence.current || !openRef.current) return;
 					setHosts(list);
 					setHost(created.alias);
 					setAddingHost(false);
@@ -2196,9 +2432,9 @@ window.__ModuleLoader__.load({
 						password: ""
 					});
 				} catch (e) {
-					setError(e instanceof Error ? e.message : String(e));
+					if (request === createHostRequestSequence.current && openRef.current) setError(e instanceof Error ? e.message : String(e));
 				} finally {
-					setSavingHost(false);
+					if (request === createHostRequestSequence.current && openRef.current) setSavingHost(false);
 				}
 			};
 			const menuWidth = choice === "menu" ? 200 : 360;
@@ -2358,6 +2594,7 @@ window.__ModuleLoader__.load({
 								style: { gridColumn: "1 / -1" },
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: tt$1("create.host") }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
 									value: host,
+									disabled: loading,
 									onChange: (event) => setHost(event.target.value),
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
 										value: "",
@@ -2384,6 +2621,7 @@ window.__ModuleLoader__.load({
 									gridColumn: "1 / -1",
 									padding: "5px 8px"
 								},
+								disabled: loading,
 								onClick: () => setAddingHost(true),
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 									className: workspace_module_css_default.menuItemIcon,
@@ -2395,6 +2633,7 @@ window.__ModuleLoader__.load({
 								style: { gridColumn: "1 / -1" },
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: tt$1("create.dir") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 									value: dirPath,
+									disabled: loading,
 									onChange: (event) => setDirPath(event.target.value),
 									placeholder: tt$1("create.dirPlaceholder"),
 									spellCheck: false
@@ -2428,12 +2667,12 @@ window.__ModuleLoader__.load({
 								type: "button",
 								className: workspace_module_css_default.button,
 								onClick: () => setChoice("menu"),
-								disabled: busy || creating,
+								disabled: busy || creating || loading,
 								children: tt$1("create.cancel")
 							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 								type: "button",
 								className: `${workspace_module_css_default.button} ${workspace_module_css_default.buttonPrimary}`,
-								disabled: busy || creating,
+								disabled: busy || creating || loading,
 								onClick: () => void createSsh(),
 								children: creating ? tt$1("create.connecting") : tt$1("create.submit")
 							})]
@@ -2491,6 +2730,7 @@ window.__ModuleLoader__.load({
 								}), dirEntries.filter((entry) => entry.type === "dir").map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
 									type: "button",
 									className: workspace_module_css_default.hostRow,
+									disabled: loading,
 									style: {
 										width: "100%",
 										textAlign: "left",
@@ -2499,7 +2739,7 @@ window.__ModuleLoader__.load({
 										alignItems: "center",
 										border: "none",
 										background: "transparent",
-										cursor: "pointer",
+										cursor: loading ? "default" : "pointer",
 										padding: "4px 6px"
 									},
 									onClick: () => {
@@ -2517,11 +2757,13 @@ window.__ModuleLoader__.load({
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									type: "button",
 									className: workspace_module_css_default.button,
+									disabled: loading,
 									onClick: () => setChoice("ssh"),
 									children: tt$1("create.cancel")
 								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									type: "button",
 									className: `${workspace_module_css_default.button} ${workspace_module_css_default.buttonPrimary}`,
+									disabled: loading,
 									onClick: () => setChoice("ssh"),
 									children: tt$1("flow.useThisDir")
 								})]
@@ -2532,92 +2774,58 @@ window.__ModuleLoader__.load({
 			}), document.body);
 		}
 		//#endregion
-		//#region src/client/workspace-badges.ts
+		//#region src/client/ssh/panel/ConnectionErrorDialog.tsx
+		/** User-visible terminal connection failure surfaced by the Session connect gate. */
+		/** A small acknowledgement dialog for non-interactive SSH connection failures. */
+		function ConnectionErrorDialog({ alias, detail, onClose }) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: panel_module_css_default.modalBackdrop,
+				onClick: onClose,
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: panel_module_css_default.modal,
+					role: "alertdialog",
+					"aria-modal": "true",
+					"aria-labelledby": "dsh-ssh-connection-error-title",
+					onClick: (event) => {
+						event.stopPropagation();
+					},
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: panel_module_css_default.modalHeader,
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+								id: "dsh-ssh-connection-error-title",
+								className: panel_module_css_default.modalTitle,
+								children: tt("connectionError.title", { alias })
+							})
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: panel_module_css_default.modalBody,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: tt("connectionError.intro") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: panel_module_css_default.formError,
+								children: detail
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: panel_module_css_default.modalFooter,
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: panel_module_css_default.modalPrimary,
+								autoFocus: true,
+								onClick: onClose,
+								children: tt("connectionError.close")
+							})
+						})
+					]
+				})
+			});
+		}
+		//#endregion
+		//#region src/client/ssh/panel/HostFingerprintDialog.tsx
 		/**
-		* Sidebar workspace-row augmentation: labels every host workspace row whose
-		* title matches an SSH-bound workspace with a compact remote badge
-		* (`alias @ remoteRoot`), so a glance tells a local workspace from a remote
-		* one. Pure DOM-level extension (the sidebar shell exposes no slot for row
-		* decoration), following the dsh-ssh sidebar-entry precedent: a
-		* MutationObserver self-heals when React re-renders displace the injected
-		* badge.
-		*
-		* The row title alone matches: SSH-bound workspace titles are unique enough
-		* in practice (the ledger title is what the row shows). A title match against
-		* `~/.dsh/ssh-workspaces/<id>` anchors also works when the host picks that
-		* default title.
-		*
-		* @module dsh-hardssh/client/workspace-badges
-		*/
-		const PROJECT_ROW_SELECTOR$1 = "[class*=\"projectRow\"]";
-		const TITLE_SELECTOR$1 = "[class*=\"title\"]";
-		/** Render a small remote badge element. The cloud icon marks "remote";
-		*  connected servers render in DeepSeek blue, disconnected stay gray. The
-		*  tooltip shows the REMOTE directory plus the server, e.g.
-		*  `/data/app (prod-01)`. */
-		function makeBadge(alias, remoteRoot, connected) {
-			const badge = document.createElement("span");
-			badge.dataset.sshBadge = connected ? "connected" : "disconnected";
-			badge.title = `${remoteRoot}（${alias}）`;
-			badge.setAttribute("style", connected ? "display:inline-flex;align-items:center;gap:3px;margin-left:6px;max-width:120px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:11px;line-height:16px;color:#1476E6;border:1px solid #1476E6;border-radius:999px;padding:0 6px;background:#D4E0F7;flex:none" : "display:inline-flex;align-items:center;gap:3px;margin-left:6px;max-width:120px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:11px;line-height:16px;color:var(--dsw-alias-label-tertiary,rgba(128,128,128,.75));border:1px solid var(--dsw-alias-line-secondary,rgba(128,128,128,.28));border-radius:999px;padding:0 6px;background:var(--dsw-alias-interactive-bg-hover,rgba(128,128,128,.10));flex:none");
-			const icon = document.createElement("span");
-			icon.setAttribute("style", "display:inline-flex;flex:none;line-height:1");
-			icon.innerHTML = "<svg viewBox=\"0 0 1024 1024\" width=\"11\" height=\"11\" fill=\"currentColor\" aria-hidden=\"true\"><path d=\"M743.936 758.499556h-273.066667c-17.066667 0-34.133333-17.066667-34.133333-34.133334s17.066667-34.133333 34.133333-34.133333h273.066667c28.444444 0 153.6-5.688889 153.6-130.844445 0-142.222222-153.6-164.977778-159.288889-164.977777-17.066667 0-28.444444-11.377778-28.444444-22.755556-22.755556-85.333333-108.088889-142.222222-193.422223-130.844444-136.533333 0-176.355556 79.644444-199.111111 164.977777-5.688889 5.688889-22.755556 17.066667-39.822222 17.066667 0 0-153.6 5.688889-153.6 142.222222 0 119.466667 130.844444 125.155556 153.6 125.155556 17.066667 0 34.133333 17.066667 34.133333 34.133333s-17.066667 34.133333-34.133333 34.133334c-113.777778 0-227.555556-62.577778-227.555555-193.422223 0-142.222222 119.466667-204.8 199.111111-210.488889 22.755556-68.266667 79.644444-193.422222 261.688889-193.422222 113.777778-11.377778 216.177778 56.888889 256 164.977778 79.644444 17.066667 199.111111 79.644444 199.111111 233.244444 5.688889 136.533333-108.088889 199.111111-221.866667 199.111112z\"/><path d=\"M573.269333 866.588444c-11.377778 0-17.066667-5.688889-22.755555-11.377777l-108.088889-108.088889c-5.688889-5.688889-11.377778-17.066667-11.377778-22.755556s5.688889-17.066667 11.377778-22.755555l108.088889-108.088889c11.377778-11.377778 34.133333-11.377778 51.2 0 11.377778 11.377778 11.377778 34.133333 0 51.2l-79.644445 79.644444 79.644445 79.644445c11.377778 11.377778 11.377778 34.133333 0 51.2-5.688889 5.688889-17.066667 11.377778-28.444445 11.377777z\"/></svg>";
-			const label = document.createElement("span");
-			label.textContent = alias;
-			label.setAttribute("style", "font-weight:400");
-			badge.append(icon, label);
-			return badge;
-		}
-		/**
-		* Mount the row-decoration pass. Queries the sidebar for project rows and
-		* appends a remote badge when the row's title belongs to an SSH workspace.
-		* Badges of aliases in `connected` render blue, others gray. Self-heals via
-		* MutationObserver on the sidebar container (rows re-render on
-		* session/workspace changes).
-		* @param workspaces - the SSH workspace records (id/title/alias/remoteRoot).
-		* @param connected - aliases with a live pooled connection (badge coloring).
-		* @returns disposer.
-		*/
-		function mountWorkspaceBadges(workspaces, connected) {
-			const byTitle = /* @__PURE__ */ new Map();
-			for (const workspace of workspaces) byTitle.set(workspace.title, workspace);
-			/** Decorate one project row (idempotent: skip rows already tagged). */
-			const decorate = (row) => {
-				if (row.querySelector("[data-ssh-badge]") !== null) return;
-				const titleEl = row.querySelector(TITLE_SELECTOR$1);
-				if (titleEl === null || titleEl === void 0) return;
-				const title = titleEl.textContent?.trim() ?? "";
-				const target = byTitle.get(title);
-				if (target === void 0) return;
-				const isConnected = connected?.has(target.alias) ?? false;
-				row.title = `${target.remoteRoot}（${target.alias}）`;
-				titleEl.appendChild(makeBadge(target.alias, target.remoteRoot, isConnected));
-			};
-			/** Scan the sidebar column for project rows and decorate each. */
-			const scan = () => {
-				for (const row of document.querySelectorAll(PROJECT_ROW_SELECTOR$1)) decorate(row);
-			};
-			const observer = new MutationObserver(() => {
-				scan();
-			});
-			observer.observe(document.body, {
-				childList: true,
-				subtree: true
-			});
-			scan();
-			return () => {
-				observer.disconnect();
-				for (const badge of document.querySelectorAll("[data-ssh-badge]")) badge.remove();
-			};
-		}
-		//#endregion
-		//#region src/client/ssh/panel/HostFingerprintDialog.tsx
-		/**
-		* Host fingerprint confirm dialog: shown when a connection is refused because
-		* the server's host key is not trusted yet (TOFU first encounter) or changed
-		* (possible MITM / key rotation). Displays the canonical SHA256 fingerprint
-		* and lets the operator confirm (trust) or reset (forget) the record.
+		* Host fingerprint confirm dialog: shown when a connection is refused because
+		* the server's host key is not trusted yet (TOFU first encounter) or changed
+		* (possible MITM / key rotation). Displays the canonical SHA256 fingerprint
+		* and lets the operator confirm (trust) or reset (forget) the record.
 		*/
 		/** Confirm (or reset) one host key. */
 		function HostFingerprintDialog({ api, alias, fingerprintSha256, mismatch, onClose, onTrusted }) {
@@ -2729,7 +2937,7 @@ window.__ModuleLoader__.load({
 		* process exit. Nothing is written to disk.
 		*/
 		/** Prompt for a session-only credential. */
-		function SessionSecretDialog({ api, alias, user, secret, onClose, onProvided }) {
+		function SessionSecretDialog({ api, alias, user, secret, reason, onClose, onProvided }) {
 			const [value, setValue] = (0, react.useState)("");
 			const [busy, setBusy] = (0, react.useState)(false);
 			const [error, setError] = (0, react.useState)(null);
@@ -2770,22 +2978,29 @@ window.__ModuleLoader__.load({
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: panel_module_css_default.modalBody,
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-								className: panel_module_css_default.input,
-								type: "password",
-								value,
-								autoFocus: true,
-								placeholder: secret === "password" ? tt("sessionSecret.placeholder") : tt("sessionSecret.placeholderPassphrase"),
-								onChange: (event) => {
-									setValue(event.target.value);
-								},
-								onKeyDown: (event) => {
-									if (event.key === "Enter") submit();
-								}
-							}), error !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-								className: panel_module_css_default.formError,
-								children: error
-							})]
+							children: [
+								reason !== void 0 && reason !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: panel_module_css_default.formError,
+									children: reason
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: panel_module_css_default.input,
+									type: "password",
+									value,
+									autoFocus: true,
+									placeholder: secret === "password" ? tt("sessionSecret.placeholder") : tt("sessionSecret.placeholderPassphrase"),
+									onChange: (event) => {
+										setValue(event.target.value);
+									},
+									onKeyDown: (event) => {
+										if (event.key === "Enter") submit();
+									}
+								}),
+								error !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: panel_module_css_default.formError,
+									children: error
+								})
+							]
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: panel_module_css_default.modalFooter,
@@ -2810,58 +3025,58 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
-		//#region src/client/workspace-gate.ts
+		//#region src/client/connect-host.ts
 		/**
-		* Sidebar workspace-row click gate: when the operator clicks an SSH-bound
-		* workspace row in the session sidebar, ensure the server connection can
-		* actually be established BEFORE the shell proceeds with the native open —
-		* otherwise the shell surfaces raw SSH errors (host key untrusted, session
-		* password missing) and the workspace appears "dead" with no prompt.
+		* Probe-and-prompt for an SSH alias, with a browser-session pass cache.
 		*
-		* The gate runs the engine's /test probe (a real, lightweight connect):
-		* - HOST_KEY_UNKNOWN / HOST_KEY_MISMATCH → the host fingerprint confirm
-		*   dialog (HostFingerprintDialog; TOFU first encounter / key rotation);
-		* - NEEDS_PASSWORD / NEEDS_PASSPHRASE → the VSCode-style session password
-		*   dialog (SessionSecretDialog; never persisted, session-only);
-		* - ok → mark the alias as gated (5-minute TTL — trust is durable and the
-		*   session password survives in the engine table) and re-dispatch the click.
+		* This is the interactive connection gate on its own — no row, no banner, no
+		* DOM decoration. Flows that surface their own errors (the workspace creation
+		* directory browser) call `connectHost` and get a plain boolean.
 		*
-		* Pure DOM-level extension following the workspace-badges precedent: the
-		* sidebar shell exposes no row slot, so a MutationObserver self-heals when
-		* React re-renders displace the injected listener. A capture-phase listener
-		* on the row blocks the shell's click while a dialog is needed, then lets
-		* clicks through once the alias has passed the gate.
+		* The probe is the engine's `/test` route (a real, lightweight connect):
+		* - `HOST_KEY_UNKNOWN` / `HOST_KEY_MISMATCH` → the host fingerprint dialog
+		*   (TOFU first encounter / key rotation);
+		* - `NEEDS_PASSWORD` / `NEEDS_PASSPHRASE` → the VSCode-style session password
+		*   dialog (never persisted, session-only);
+		* - ok → the alias is marked passed for a TTL (trust is durable and the session
+		*   password survives in the engine's session table until the process exits).
 		*
-		* @module dsh-hardssh/client/workspace-gate
+		* @module dsh-hardssh/client/connect-host
 		*/
-		const PROJECT_ROW_SELECTOR = "[class*=\"projectRow\"]";
-		const TITLE_SELECTOR = "[class*=\"title\"]";
-		/** A passed gate stays valid this long (trust is durable; the session
-		*  password table lives in the host process for the session). */
+		/** A passed alias stays valid this long (trust is durable; the session password
+		*  table lives in the host process for the session). */
 		const GATE_TTL_MS = 3e5;
 		/** Cap on interactive retry rounds (wrong password loops etc.). */
 		const MAX_ATTEMPTS = 3;
-		/** alias → last successful gate timestamp (browser-session scope). */
-		const gatePassedAt = /* @__PURE__ */ new Map();
-		/** alias → in-flight gate promise (no duplicate dialogs on multi-click). */
+		/** alias → last successful probe timestamp (browser-session scope). */
+		const passedAt = /* @__PURE__ */ new Map();
+		/** alias → in-flight probe promise (no duplicate dialogs on multi-click). */
 		const pending = /* @__PURE__ */ new Map();
 		/** alias → SSH login name (fetched once for the user@alias prompt). */
 		let hostsCache = null;
+		/** At most one visible non-interactive failure dialog per alias. */
+		const failureDialogs = /* @__PURE__ */ new Map();
 		async function hostsUser(api, alias) {
 			if (hostsCache === null) try {
 				const list = await api.listHosts();
 				hostsCache = new Map(list.map((host) => [host.alias, host.user]));
 			} catch {
-				hostsCache = /* @__PURE__ */ new Map();
+				return;
 			}
 			return hostsCache.get(alias);
 		}
+		/** Whether the alias passed the gate within its TTL. */
 		function gateActive(alias, now) {
-			const at = gatePassedAt.get(alias);
+			const at = passedAt.get(alias);
 			return at !== void 0 && now - at < GATE_TTL_MS;
 		}
-		/** Mount a dialog component into a fresh portal root; returns its closer.
-		*  The dialog's onClose prop is forced to the closer so cancel works. */
+		/**
+		* Mount a dialog component into a fresh root; returns its closer. The dialog's
+		* `onClose` prop is CHAINED: the caller's handler (resolving its promise) runs
+		* first, then the root is torn down. Without the chaining a cancel would
+		* unmount the dialog but never resolve the caller's promise, leaving the alias
+		* stuck "in flight" so later calls stop prompting.
+		*/
 		function mountModal(node) {
 			const host = document.createElement("div");
 			host.dataset.sshGateDialog = "";
@@ -2871,24 +3086,31 @@ window.__ModuleLoader__.load({
 				root.unmount();
 				host.remove();
 			};
+			const callerOnClose = node.props.onClose;
+			const chainedOnClose = callerOnClose !== void 0 ? () => {
+				callerOnClose();
+				close();
+			} : close;
 			root.render((0, react.createElement)(node.type, {
 				...node.props,
-				onClose: close
+				onClose: chainedOnClose
 			}));
 			return close;
 		}
-		/** Transient inline error under the clicked row (removed after 8 s).
-		*  A null row means the caller owns error surfacing — stay silent. */
-		function showBanner(row, alias, message) {
-			if (row === null) return;
-			const banner = document.createElement("div");
-			banner.dataset.sshGateError = "";
-			banner.textContent = `${tt$1("gate.failed", alias)}: ${message}`;
-			banner.setAttribute("style", "margin:2px 4px;padding:6px 8px;font-size:12px;color:#b00020;background:rgba(176,0,32,.08);border-radius:4px;white-space:normal;line-height:1.5");
-			row.insertAdjacentElement("afterend", banner);
-			setTimeout(() => {
-				banner.remove();
-			}, 8e3);
+		/** Log and surface one concrete non-interactive connection failure. */
+		function reportConnectionFailure(alias, detail) {
+			console.warn(`[dsh-hardssh] SSH probe failed for '${alias}': ${detail}`);
+			if (typeof document === "undefined") return false;
+			failureDialogs.get(alias)?.();
+			const close = mountModal((0, react.createElement)(ConnectionErrorDialog, {
+				alias,
+				detail,
+				onClose: () => {
+					failureDialogs.delete(alias);
+				}
+			}));
+			failureDialogs.set(alias, close);
+			return false;
 		}
 		/** Interactive prompts, resolving true when the user finished the action. */
 		function promptFingerprint(api, alias, fingerprintSha256, mismatch) {
@@ -2908,7 +3130,7 @@ window.__ModuleLoader__.load({
 				}));
 			});
 		}
-		function promptSecret(api, alias, secret) {
+		function promptSecret(api, alias, secret, reason) {
 			return new Promise((resolve) => {
 				let closed = false;
 				const finish = (ok) => {
@@ -2922,6 +3144,7 @@ window.__ModuleLoader__.load({
 						alias,
 						user,
 						secret,
+						reason,
 						onClose: () => {
 							finish(false);
 						},
@@ -2934,39 +3157,56 @@ window.__ModuleLoader__.load({
 			});
 		}
 		/**
-		* Probe + prompt until connected. Resolves true when the alias may proceed
-		* (the gate passed); false when the user cancelled or the failure is not
-		* interactive (banner left behind).
+		* Probe + prompt until connected. Resolves true when the alias may proceed;
+		* false when the user cancelled or the failure is not interactive. When a
+		* credential was already supplied and the retry still fails (wrong password,
+		* unreachable host, network drop, …), the password dialog re-opens WITH the
+		* failure reason shown, VSCode style — no silent "stuck" states.
+		*
+		* @param api - the SSH API client.
+		* @param alias - the host alias to gate.
 		*/
-		function ensureConnected(api, alias, row) {
+		function connectHost(api, alias) {
 			if (gateActive(alias, Date.now())) return Promise.resolve(true);
 			const inFlight = pending.get(alias);
 			if (inFlight !== void 0) return inFlight;
 			const attempt = (async () => {
+				let secretKind;
+				let lastFailure = null;
 				for (let i = 0; i < MAX_ATTEMPTS; i++) try {
 					const result = await api.testHost(alias);
 					if (result.ok) {
-						gatePassedAt.set(alias, Date.now());
+						passedAt.set(alias, Date.now());
 						return true;
 					}
 					if (result.code === "NEEDS_PASSWORD" && (result.secret === "password" || result.secret === "passphrase")) {
-						if (await promptSecret(api, alias, result.secret)) continue;
+						secretKind = result.secret;
+						if (await promptSecret(api, alias, result.secret, lastFailure ?? void 0)) {
+							lastFailure = null;
+							continue;
+						}
 						return false;
 					}
-					showBanner(row, alias, result.error ?? "connection failed");
-					return false;
+					lastFailure = result.error ?? "connection failed";
+					return reportConnectionFailure(alias, lastFailure);
 				} catch (cause) {
-					if (cause instanceof SshApiError && (cause.code === "HOST_KEY_UNKNOWN" || cause.code === "HOST_KEY_MISMATCH")) {
+					if (cause instanceof HttpApiError && (cause.code === "HOST_KEY_UNKNOWN" || cause.code === "HOST_KEY_MISMATCH")) {
 						const fingerprint = cause.hostKeyFingerprint ?? "";
 						if (fingerprint !== "" && await promptFingerprint(api, alias, fingerprint, cause.code === "HOST_KEY_MISMATCH")) continue;
-						if (fingerprint === "") showBanner(row, alias, cause.message);
+						if (fingerprint === "") return reportConnectionFailure(alias, cause.message);
+						return false;
+					}
+					lastFailure = cause instanceof Error ? cause.message : String(cause);
+					if (secretKind !== void 0) {
+						if (await promptSecret(api, alias, secretKind, lastFailure)) {
+							lastFailure = null;
+							continue;
+						}
 						return false;
 					}
-					showBanner(row, alias, cause instanceof Error ? cause.message : String(cause));
-					return false;
+					return reportConnectionFailure(alias, lastFailure);
 				}
-				showBanner(row, alias, tt$1("gate.retryLimit"));
-				return false;
+				return reportConnectionFailure(alias, lastFailure ?? tt$1("gate.retryLimit"));
 			})();
 			pending.set(alias, attempt);
 			attempt.finally(() => {
@@ -2974,68 +3214,199 @@ window.__ModuleLoader__.load({
 			});
 			return attempt;
 		}
-		/** Silent prompt-only connection gate (no row / banner) for flows that
-		*  surface their own errors (e.g. the directory browser). */
-		function connectHost(api, alias) {
-			return ensureConnected(api, alias, null);
+		//#endregion
+		//#region src/client/workspace-badges.ts
+		/**
+		* Sidebar workspace-row augmentation: labels every host workspace row whose
+		* title matches an SSH-bound workspace with a compact remote badge
+		* (`alias @ remoteRoot`), so a glance tells a local workspace from a remote
+		* one. Pure DOM-level extension (the sidebar shell exposes no slot for row
+		* decoration), following the dsh-ssh sidebar-entry precedent: a
+		* MutationObserver self-heals when React re-renders displace the injected
+		* badge.
+		*
+		* The row title alone matches: SSH-bound workspace titles are unique enough
+		* in practice (the ledger title is what the row shows). A title match against
+		* `~/.dsh/ssh-workspaces/<id>` anchors also works when the host picks that
+		* default title.
+		*
+		* @module dsh-hardssh/client/workspace-badges
+		*/
+		const PROJECT_ROW_SELECTOR = "[class*=\"projectRow\"]";
+		const TITLE_SELECTOR = "[class*=\"title\"]";
+		/** Render a small remote badge element. The cloud icon marks "remote";
+		*  connected servers render in DeepSeek blue, disconnected stay gray. The
+		*  tooltip shows the REMOTE directory plus the server, e.g.
+		*  `/data/app (prod-01)`. */
+		function makeBadge(alias, remoteRoot, connected) {
+			const badge = document.createElement("span");
+			badge.dataset.sshBadge = connected ? "connected" : "disconnected";
+			badge.title = `${remoteRoot}（${alias}）`;
+			badge.setAttribute("style", connected ? "display:inline-flex;align-items:center;gap:3px;margin-left:6px;max-width:120px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:11px;line-height:16px;color:#1476E6;border:1px solid #1476E6;border-radius:999px;padding:0 6px;background:#D4E0F7;flex:none" : "display:inline-flex;align-items:center;gap:3px;margin-left:6px;max-width:120px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:11px;line-height:16px;color:var(--dsw-alias-label-tertiary,rgba(128,128,128,.75));border:1px solid var(--dsw-alias-line-secondary,rgba(128,128,128,.28));border-radius:999px;padding:0 6px;background:var(--dsw-alias-interactive-bg-hover,rgba(128,128,128,.10));flex:none");
+			const icon = document.createElement("span");
+			icon.setAttribute("style", "display:inline-flex;flex:none;line-height:1");
+			icon.innerHTML = "<svg viewBox=\"0 0 1024 1024\" width=\"11\" height=\"11\" fill=\"currentColor\" aria-hidden=\"true\"><path d=\"M743.936 758.499556h-273.066667c-17.066667 0-34.133333-17.066667-34.133333-34.133334s17.066667-34.133333 34.133333-34.133333h273.066667c28.444444 0 153.6-5.688889 153.6-130.844445 0-142.222222-153.6-164.977778-159.288889-164.977777-17.066667 0-28.444444-11.377778-28.444444-22.755556-22.755556-85.333333-108.088889-142.222222-193.422223-130.844444-136.533333 0-176.355556 79.644444-199.111111 164.977777-5.688889 5.688889-22.755556 17.066667-39.822222 17.066667 0 0-153.6 5.688889-153.6 142.222222 0 119.466667 130.844444 125.155556 153.6 125.155556 17.066667 0 34.133333 17.066667 34.133333 34.133333s-17.066667 34.133333-34.133333 34.133334c-113.777778 0-227.555556-62.577778-227.555555-193.422223 0-142.222222 119.466667-204.8 199.111111-210.488889 22.755556-68.266667 79.644444-193.422222 261.688889-193.422222 113.777778-11.377778 216.177778 56.888889 256 164.977778 79.644444 17.066667 199.111111 79.644444 199.111111 233.244444 5.688889 136.533333-108.088889 199.111111-221.866667 199.111112z\"/><path d=\"M573.269333 866.588444c-11.377778 0-17.066667-5.688889-22.755555-11.377777l-108.088889-108.088889c-5.688889-5.688889-11.377778-17.066667-11.377778-22.755556s5.688889-17.066667 11.377778-22.755555l108.088889-108.088889c11.377778-11.377778 34.133333-11.377778 51.2 0 11.377778 11.377778 11.377778 34.133333 0 51.2l-79.644445 79.644444 79.644445 79.644445c11.377778 11.377778 11.377778 34.133333 0 51.2-5.688889 5.688889-17.066667 11.377778-28.444445 11.377777z\"/></svg>";
+			const label = document.createElement("span");
+			label.textContent = alias;
+			label.setAttribute("style", "font-weight:400");
+			badge.append(icon, label);
+			return badge;
 		}
 		/**
-		* Mount the click gate over every sidebar workspace row whose title belongs
-		* to an SSH-bound workspace. Self-heals via MutationObserver. Returns a
-		* disposer that removes listeners and injected state.
+		* Mount the row-decoration pass. Queries the sidebar for project rows and
+		* appends a remote badge when the row's title belongs to an SSH workspace.
+		* Badges of aliases in `connected` render blue, others gray. Self-heals via
+		* MutationObserver on the sidebar container (rows re-render on
+		* session/workspace changes).
+		* @param workspaces - the SSH workspace records (id/title/alias/remoteRoot).
+		* @param connected - aliases with a live pooled connection (badge coloring).
+		* @returns disposer.
 		*/
-		function mountWorkspaceGates(workspaces, api) {
+		function mountWorkspaceBadges(workspaces, connected) {
 			const byTitle = /* @__PURE__ */ new Map();
-			for (const workspace of workspaces) byTitle.set(workspace.title, workspace.alias);
-			const attach = (row) => {
-				if (row.dataset.sshGate !== void 0) return;
+			for (const workspace of workspaces) byTitle.set(workspace.title, workspace);
+			/** Decorate one project row: ALWAYS keep the row tooltip = the REMOTE
+			*  directory (server), never the local anchor path the shell would show;
+			*  mount the badge once (idempotent via the guard). Re-runs on every scan,
+			*  so a shell re-render that resets <title> gets corrected. */
+			const decorate = (row) => {
 				const titleEl = row.querySelector(TITLE_SELECTOR);
 				if (titleEl === null || titleEl === void 0) return;
-				const alias = byTitle.get(titleEl.textContent?.trim() ?? "");
-				if (alias === void 0) return;
-				row.dataset.sshGate = "1";
-				row.addEventListener("click", (event) => {
-					if (gateActive(alias, Date.now())) return;
-					event.preventDefault();
-					event.stopPropagation();
-					ensureConnected(api, alias, row).then((ok) => {
-						if (ok) row.click();
-					});
-				}, true);
+				const title = titleEl.textContent?.trim() ?? "";
+				const target = byTitle.get(title);
+				if (target === void 0) return;
+				const desiredTitle = `${target.remoteRoot}（${target.alias}）`;
+				if (row.title !== desiredTitle) row.title = desiredTitle;
+				if (row.querySelector("[data-ssh-badge]") !== null) return;
+				const isConnected = connected?.has(target.alias) ?? false;
+				titleEl.appendChild(makeBadge(target.alias, target.remoteRoot, isConnected));
 			};
+			/** Scan the sidebar column for project rows and decorate each. */
 			const scan = () => {
-				for (const row of document.querySelectorAll(PROJECT_ROW_SELECTOR)) attach(row);
+				for (const row of document.querySelectorAll(PROJECT_ROW_SELECTOR)) decorate(row);
 			};
 			const observer = new MutationObserver(() => {
 				scan();
 			});
 			observer.observe(document.body, {
 				childList: true,
-				subtree: true
+				subtree: true,
+				attributes: true,
+				attributeFilter: ["title"]
 			});
 			scan();
 			return () => {
 				observer.disconnect();
-				for (const row of document.querySelectorAll("[data-ssh-gate]")) delete row.dataset.sshGate;
+				for (const badge of document.querySelectorAll("[data-ssh-badge]")) badge.remove();
 			};
 		}
 		//#endregion
+		//#region src/client/session-connect-gate.ts
+		/** Normalize one path for anchor comparison: unified separators, no trailing
+		*  separator, and case-folded for Windows-shaped paths (Windows anchors are
+		*  case-insensitive; POSIX anchors are not).
+		*
+		*  Deliberately a SECOND implementation of `base/ledger.ts`'s
+		*  `normalizeAnchorPath`: the base module imports `node:fs` for its own
+		*  persistence and therefore cannot be pulled into the browser bundle. Keep the
+		*  two in step — the host-side duplicates were consolidated for exactly this
+		*  reason, and this one is the documented exception. */
+		function normalizeAnchor(path) {
+			const unified = path.replace(/\\/gu, "/").replace(/\/+$/u, "");
+			if (/^[a-zA-Z]:\//u.test(unified) || unified.startsWith("//")) return unified.toLowerCase();
+			return unified;
+		}
+		/** True when `cwd` is the anchor itself or sits inside it. */
+		function isUnderAnchor(anchor, cwd) {
+			return cwd === anchor || cwd.startsWith(`${anchor}/`);
+		}
+		/**
+		* Build the cwd → workspace resolver over a live workspace list. The LONGEST
+		* matching anchor wins, so a workspace nested under another one still routes to
+		* its own server.
+		* @param workspaces - live records carrying an anchor path.
+		* @returns resolver returning the owning record, or undefined when unbound.
+		*/
+		function makeAnchorWorkspaceResolver(workspaces) {
+			return (cwd) => {
+				if (cwd === void 0 || cwd === "") return void 0;
+				const target = normalizeAnchor(cwd);
+				let best;
+				let bestLength = -1;
+				for (const workspace of workspaces()) {
+					const anchor = normalizeAnchor(workspace.anchorPath);
+					if (anchor === "" || !isUnderAnchor(anchor, target)) continue;
+					if (anchor.length > bestLength) {
+						bestLength = anchor.length;
+						best = workspace;
+					}
+				}
+				return best;
+			};
+		}
+		/** Alias-only compatibility face used by the connection gate. */
+		function makeAnchorAliasResolver(workspaces) {
+			const resolve = makeAnchorWorkspaceResolver(workspaces);
+			return (cwd) => resolve(cwd)?.alias;
+		}
+		/**
+		* Watch the session list and probe the server behind every SSH-bound session
+		* the operator opens or creates.
+		*
+		* The first pass ADOPTS the existing list without probing: a GUI restore must
+		* not fire one connection dialog per remembered session. Only the session the
+		* shell actually selects (including the restored current one) and sessions
+		* created after that pass trigger a probe.
+		*
+		* @param deps - session list view, anchor resolver and probe.
+		* @returns disposer removing the subscription.
+		*/
+		function mountSessionConnectGate(deps) {
+			const adopted = /* @__PURE__ */ new Set();
+			let primed = false;
+			let lastCurrent;
+			/** Probe the server owning one session's workspace (best-effort). */
+			const probe = (sessionId) => {
+				if (sessionId === void 0) return;
+				const alias = deps.aliasForCwd(deps.sessions.sessionCwd(sessionId));
+				if (alias === void 0) return;
+				deps.ensureConnected(alias).catch((error) => {
+					console.warn("[dsh-hardssh] session connect gate failed:", error);
+				});
+			};
+			const pass = () => {
+				if (!primed && deps.sessions.phase() !== "ready") return;
+				const ids = deps.sessions.sessionIds();
+				const probed = /* @__PURE__ */ new Set();
+				if (!primed) {
+					for (const id of ids) adopted.add(id);
+					primed = true;
+				} else for (const id of ids) {
+					if (adopted.has(id)) continue;
+					adopted.add(id);
+					probed.add(id);
+					probe(id);
+				}
+				const current = deps.sessions.currentSessionId();
+				if (current !== lastCurrent) {
+					lastCurrent = current;
+					if (current !== void 0 && !probed.has(current)) probe(current);
+				}
+			};
+			const dispose = deps.sessions.subscribe(pass);
+			pass();
+			return dispose;
+		}
+		//#endregion
 		//#region src/client/ssh/panel/ClusterTab.tsx
 		/**
-		* Cluster tab: run one command across many hosts (aliases / environment /
-		* tags filters) and inspect per-host results. Stdout/stderr render in
+		* Cluster tab: run one command against the selected Session's fixed server and
+		* inspect its result. Stdout/stderr render in
 		* collapsed <details> blocks; status renders as a colored badge.
 		*/
-		/** Split a comma-separated input into a trimmed, non-empty string list. */
-		function splitList(text) {
-			return text.split(",").map((part) => part.trim()).filter((part) => part !== "");
-		}
 		/** The cluster execution tab. */
-		function ClusterTab({ api }) {
+		function ClusterTab({ api, alias }) {
 			const [command, setCommand] = (0, react.useState)("");
-			const [aliases, setAliases] = (0, react.useState)("");
-			const [environment, setEnvironment] = (0, react.useState)("");
-			const [tags, setTags] = (0, react.useState)("");
 			const [running, setRunning] = (0, react.useState)(false);
 			const [results, setResults] = (0, react.useState)(null);
 			const [error, setError] = (0, react.useState)(null);
@@ -3045,13 +3416,9 @@ window.__ModuleLoader__.load({
 				setRunning(true);
 				setError(null);
 				try {
-					const aliasList = splitList(aliases);
-					const tagList = splitList(tags);
 					const outcome = await api.cluster({
 						command: command.trim(),
-						aliases: aliasList.length > 0 ? aliasList : void 0,
-						environment: environment.trim() === "" ? void 0 : environment.trim(),
-						tags: tagList.length > 0 ? tagList : void 0
+						aliases: [alias]
 					});
 					setResults(outcome);
 				} catch (cause) {
@@ -3080,421 +3447,93 @@ window.__ModuleLoader__.load({
 								})]
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: panel_module_css_default.clusterFilters,
-								children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										className: panel_module_css_default.input,
-										placeholder: tt("cluster.aliases"),
-										value: aliases,
-										onChange: (event) => {
-											setAliases(event.target.value);
-										}
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										className: panel_module_css_default.input,
-										placeholder: tt("cluster.environment"),
-										value: environment,
-										onChange: (event) => {
-											setEnvironment(event.target.value);
-										}
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										className: panel_module_css_default.input,
-										placeholder: tt("cluster.tags"),
-										value: tags,
-										onChange: (event) => {
-											setTags(event.target.value);
-										}
-									})
-								]
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-								type: "button",
-								className: panel_module_css_default.primaryButton,
-								disabled: running || command.trim() === "",
-								onClick: () => {
-									run();
-								},
-								children: tt("cluster.run")
-							}) })
-						]
-					}),
-					error !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: panel_module_css_default.banner,
-						"data-kind": "error",
-						children: tt("common.error", { error })
-					}),
-					results === null && error === null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: panel_module_css_default.empty,
-						children: tt("cluster.empty")
-					}),
-					results !== null && results.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: panel_module_css_default.empty,
-						children: tt("cluster.noMatch")
-					}),
-					results !== null && results.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: panel_module_css_default.tableWrap,
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("table", {
-							className: panel_module_css_default.table,
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("thead", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.alias") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.status") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.exit") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.stdout") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.stderr") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.error") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.duration") })
-							] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: results.map((result) => {
-								const status = result.ok ? "ok" : result.timedOut === true ? "timeout" : "fail";
-								const label = result.ok ? tt("cluster.ok") : result.timedOut === true ? tt("cluster.timeout") : tt("cluster.fail");
-								return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", {
-										className: panel_module_css_default.mono,
-										children: result.alias
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										className: panel_module_css_default.badge,
-										"data-status": status,
-										children: label
-									}) }),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", {
-										className: panel_module_css_default.mono,
-										children: result.exitCode ?? "-"
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: result.stdout !== void 0 && result.stdout !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
-										className: panel_module_css_default.cellDetails,
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("summary", { children: tt("cluster.col.stdout") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
-											className: panel_module_css_default.cellPre,
-											children: result.stdout
-										})]
-									}) }),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: result.stderr !== void 0 && result.stderr !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
-										className: panel_module_css_default.cellDetails,
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("summary", { children: tt("cluster.col.stderr") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
-											className: panel_module_css_default.cellPre,
-											children: result.stderr
-										})]
-									}) }),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", {
-										className: panel_module_css_default.cellMuted,
-										children: result.error ?? ""
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", {
-										className: panel_module_css_default.mono,
-										children: result.durationMs !== void 0 ? result.durationMs + " ms" : "-"
-									})
-								] }, result.alias);
-							}) })]
-						})
-					})
-				]
-			});
-		}
-		//#endregion
-		//#region src/client/ssh/panel/HostsTab.tsx
-		/**
-		* Hosts tab: the host table with search (debounced through listHosts),
-		* add/edit/delete/test actions, ~/.ssh/config import, and a connect action
-		* that hands the alias to the terminal tab via onConnect.
-		*/
-		/** The hosts table plus its toolbar and dialogs. */
-		function HostsTab({ api, onConnect }) {
-			const [hosts, setHosts] = (0, react.useState)(null);
-			const [error, setError] = (0, react.useState)(null);
-			const [search, setSearch] = (0, react.useState)("");
-			const [testingAlias, setTestingAlias] = (0, react.useState)(null);
-			const [testResults, setTestResults] = (0, react.useState)({});
-			const [importing, setImporting] = (0, react.useState)(false);
-			const [notice, setNotice] = (0, react.useState)(null);
-			const [dialog, setDialog] = (0, react.useState)(null);
-			const [hostKeyConfirm, setHostKeyConfirm] = (0, react.useState)(null);
-			const [secretConfirm, setSecretConfirm] = (0, react.useState)(null);
-			const seqRef = (0, react.useRef)(0);
-			const load = (0, react.useCallback)(async (query) => {
-				const seq = ++seqRef.current;
-				try {
-					const list = await api.listHosts(query);
-					if (seq !== seqRef.current) return;
-					setHosts(list);
-					setError(null);
-				} catch (cause) {
-					if (seq !== seqRef.current) return;
-					setError(errorMessage(cause));
-				}
-			}, [api]);
-			(0, react.useEffect)(() => {
-				load();
-			}, [load]);
-			(0, react.useEffect)(() => {
-				const timer = setTimeout(() => {
-					const query = search.trim();
-					load(query === "" ? void 0 : query);
-				}, 300);
-				return () => {
-					clearTimeout(timer);
-				};
-			}, [search, load]);
-			const runTest = async (alias) => {
-				setTestingAlias(alias);
-				try {
-					const result = await api.testHost(alias);
-					if (result.code === "NEEDS_PASSWORD" && (result.secret === "password" || result.secret === "passphrase")) {
-						setSecretConfirm({
-							alias,
-							secret: result.secret,
-							user: hosts?.find((host) => host.alias === alias)?.user
-						});
-						setTestingAlias(null);
-						return;
-					}
-					setTestResults((prev) => ({
-						...prev,
-						[alias]: result
-					}));
-				} catch (cause) {
-					if (cause instanceof SshApiError && (cause.code === "HOST_KEY_UNKNOWN" || cause.code === "HOST_KEY_MISMATCH")) {
-						setHostKeyConfirm({
-							alias,
-							fingerprintSha256: cause.hostKeyFingerprint ?? "",
-							mismatch: cause.code === "HOST_KEY_MISMATCH"
-						});
-						setTestingAlias(null);
-						return;
-					}
-					setTestResults((prev) => ({
-						...prev,
-						[alias]: {
-							ok: false,
-							error: errorMessage(cause)
-						}
-					}));
-				} finally {
-					setTestingAlias(null);
-				}
-			};
-			/** After the fingerprint is confirmed (or reset), retry the test. */
-			const retryAfterFingerprint = async (alias) => {
-				setHostKeyConfirm(null);
-				await runTest(alias);
-			};
-			/** After the session secret is provided, retry the test. */
-			const retryAfterSecret = async (alias) => {
-				setSecretConfirm(null);
-				await runTest(alias);
-			};
-			const deleteHost = async (alias) => {
-				if (!window.confirm(tt("hosts.deleteConfirm", { alias }))) return;
-				try {
-					await api.deleteHost(alias);
-					load();
-				} catch (cause) {
-					setError(errorMessage(cause));
-				}
-			};
-			const importConfig = async () => {
-				setImporting(true);
-				try {
-					const result = await api.importSshConfig();
-					setNotice(tt("hosts.imported", {
-						parsed: result.parsed,
-						added: result.added,
-						skipped: result.skipped
-					}));
-					load();
-				} catch (cause) {
-					setError(errorMessage(cause));
-				} finally {
-					setImporting(false);
-				}
-			};
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: panel_module_css_default.fillBody,
-				children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: panel_module_css_default.toolbar,
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-								className: panel_module_css_default.search,
-								type: "search",
-								placeholder: tt("hosts.search"),
-								value: search,
-								onChange: (event) => {
-									setSearch(event.target.value);
-								}
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { className: panel_module_css_default.toolbarSpacer }),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-								type: "button",
-								className: panel_module_css_default.primaryButton,
-								onClick: () => {
-									setDialog({ mode: "create" });
-								},
-								children: tt("hosts.add")
+								className: panel_module_css_default.controls,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: panel_module_css_default.fieldLabel,
+									children: tt("session.server")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: panel_module_css_default.targetBadge,
+									children: alias
+								})]
 							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 								type: "button",
-								className: panel_module_css_default.ghostButton,
-								disabled: importing,
+								className: panel_module_css_default.primaryButton,
+								disabled: running || command.trim() === "",
 								onClick: () => {
-									importConfig();
+									run();
 								},
-								children: importing ? tt("common.loading") : tt("hosts.import")
-							})
+								children: tt("cluster.run")
+							}) })
 						]
 					}),
-					notice !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: panel_module_css_default.banner,
-						"data-kind": "ok",
-						children: notice
-					}),
 					error !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: panel_module_css_default.banner,
 						"data-kind": "error",
 						children: tt("common.error", { error })
 					}),
-					hosts === null && error === null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: panel_module_css_default.loading,
-						children: tt("common.loading")
+					results === null && error === null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: panel_module_css_default.empty,
+						children: tt("cluster.empty")
 					}),
-					hosts !== null && hosts.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					results !== null && results.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: panel_module_css_default.empty,
-						children: tt("hosts.empty")
+						children: tt("cluster.noMatch")
 					}),
-					hosts !== null && hosts.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					results !== null && results.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: panel_module_css_default.tableWrap,
 						children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("table", {
 							className: panel_module_css_default.table,
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("thead", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("hosts.col.alias") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("hosts.col.host") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("hosts.col.user") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("hosts.col.auth") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("hosts.col.environment") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("hosts.col.tags") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("hosts.col.description") }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("hosts.col.actions") })
-							] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: hosts.map((host) => {
-								const test = testResults[host.alias];
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.alias") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.status") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.exit") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.stdout") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.stderr") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.error") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: tt("cluster.col.duration") })
+							] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: results.map((result) => {
+								const status = result.ok ? "ok" : result.timedOut === true ? "timeout" : "fail";
+								const label = result.ok ? tt("cluster.ok") : result.timedOut === true ? tt("cluster.timeout") : tt("cluster.fail");
 								return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", {
 										className: panel_module_css_default.mono,
-										children: host.alias
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", {
-										className: panel_module_css_default.mono,
-										children: [
-											host.host,
-											":",
-											host.port
-										]
+										children: result.alias
 									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: host.user }),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 										className: panel_module_css_default.badge,
-										"data-kind": host.auth,
-										children: host.auth === "key" ? tt("form.auth.key") : tt("form.auth.password")
+										"data-status": status,
+										children: label
 									}) }),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", {
-										className: panel_module_css_default.cellMuted,
-										children: host.environment ?? ""
+										className: panel_module_css_default.mono,
+										children: result.exitCode ?? "-"
 									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: result.stdout !== void 0 && result.stdout !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
+										className: panel_module_css_default.cellDetails,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("summary", { children: tt("cluster.col.stdout") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
+											className: panel_module_css_default.cellPre,
+											children: result.stdout
+										})]
+									}) }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: result.stderr !== void 0 && result.stderr !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
+										className: panel_module_css_default.cellDetails,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("summary", { children: tt("cluster.col.stderr") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
+											className: panel_module_css_default.cellPre,
+											children: result.stderr
+										})]
+									}) }),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", {
 										className: panel_module_css_default.cellMuted,
-										children: host.tags.join(", ")
+										children: result.error ?? ""
 									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", {
-										className: panel_module_css_default.cellMuted,
-										children: host.description ?? ""
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										className: panel_module_css_default.actions,
-										children: [
-											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-												type: "button",
-												className: panel_module_css_default.linkButton,
-												disabled: testingAlias === host.alias,
-												onClick: () => {
-													runTest(host.alias);
-												},
-												children: testingAlias === host.alias ? tt("hosts.testing") : tt("hosts.test")
-											}),
-											testingAlias === host.alias && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-												className: panel_module_css_default.spinner,
-												"aria-hidden": "true"
-											}),
-											test !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-												className: panel_module_css_default.inlineTest,
-												"data-status": test.ok ? "ok" : "fail",
-												children: test.ok ? tt("hosts.testOk", { latency: test.latencyMs ?? 0 }) : tt("hosts.testFail", { error: test.error ?? "" })
-											}),
-											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-												type: "button",
-												className: panel_module_css_default.linkButton,
-												onClick: () => {
-													setDialog({
-														mode: "edit",
-														host
-													});
-												},
-												children: tt("hosts.edit")
-											}),
-											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-												type: "button",
-												className: panel_module_css_default.linkButton,
-												"data-danger": true,
-												onClick: () => {
-													deleteHost(host.alias);
-												},
-												children: tt("hosts.delete")
-											}),
-											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-												type: "button",
-												className: panel_module_css_default.ghostButton,
-												onClick: () => {
-													onConnect(host.alias);
-												},
-												children: tt("hosts.connected")
-											})
-										]
-									}) })
-								] }, host.alias);
+										className: panel_module_css_default.mono,
+										children: result.durationMs !== void 0 ? result.durationMs + " ms" : "-"
+									})
+								] }, result.alias);
 							}) })]
 						})
-					}),
-					dialog !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HostFormDialog, {
-						api,
-						editing: dialog.mode === "edit" ? dialog.host : null,
-						onClose: () => {
-							setDialog(null);
-						},
-						onSaved: () => {
-							setDialog(null);
-							load();
-						}
-					}),
-					hostKeyConfirm !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HostFingerprintDialog, {
-						api,
-						alias: hostKeyConfirm.alias,
-						fingerprintSha256: hostKeyConfirm.fingerprintSha256,
-						mismatch: hostKeyConfirm.mismatch,
-						onClose: () => {
-							setHostKeyConfirm(null);
-						},
-						onTrusted: () => {
-							retryAfterFingerprint(hostKeyConfirm.alias);
-						}
-					}),
-					secretConfirm !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionSecretDialog, {
-						api,
-						alias: secretConfirm.alias,
-						user: secretConfirm.user,
-						secret: secretConfirm.secret,
-						onClose: () => {
-							setSecretConfirm(null);
-						},
-						onProvided: () => {
-							retryAfterSecret(secretConfirm.alias);
-						}
 					})
 				]
 			});
@@ -16543,8 +16582,9 @@ window.__ModuleLoader__.load({
 		//#region src/client/ssh/panel/TerminalTab.tsx
 		/**
 		* Terminal tab: an xterm.js PTY view over the host's WebSocket terminal route.
-		* A host <select> plus connect/disconnect controls; the terminal container is
-		* sized by FitAddon (default 80x24 before first fit). On remote exit the last
+		* The target alias is inherited from the selected Session; only connect /
+		* disconnect controls remain. The terminal container is sized by FitAddon
+		* (default 80x24 before first fit). On remote exit the last
 		* output stays visible and input is disabled. xterm's stylesheet is injected
 		* once per page load (module-level guard).
 		*/
@@ -16560,9 +16600,7 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(style);
 		}
 		/** The xterm terminal view. */
-		function TerminalTab({ api, presetAlias, requestId }) {
-			const [hosts, setHosts] = (0, react.useState)([]);
-			const [alias, setAlias] = (0, react.useState)(presetAlias ?? "");
+		function TerminalTab({ api, alias }) {
 			const [status, setStatus] = (0, react.useState)({ kind: "idle" });
 			const containerRef = (0, react.useRef)(null);
 			const termRef = (0, react.useRef)(null);
@@ -16571,26 +16609,6 @@ window.__ModuleLoader__.load({
 			(0, react.useEffect)(() => {
 				ensureXtermCss();
 			}, []);
-			(0, react.useEffect)(() => {
-				let disposed = false;
-				(async () => {
-					try {
-						const list = await api.listHosts();
-						if (!disposed) setHosts(list);
-					} catch (cause) {
-						if (!disposed) setStatus({
-							kind: "error",
-							detail: errorMessage(cause)
-						});
-					}
-				})();
-				return () => {
-					disposed = true;
-				};
-			}, [api]);
-			(0, react.useEffect)(() => {
-				if (presetAlias !== void 0) setAlias(presetAlias);
-			}, [presetAlias, requestId]);
 			const teardown = () => {
 				const connection = connRef.current;
 				connRef.current = null;
@@ -16642,6 +16660,7 @@ window.__ModuleLoader__.load({
 				term.loadAddon(fit);
 				term.open(container);
 				fit.fit();
+				term.options.disableStdin = true;
 				const connection = api.openTerminal(target, term.cols, term.rows);
 				termRef.current = term;
 				fitRef.current = fit;
@@ -16651,6 +16670,7 @@ window.__ModuleLoader__.load({
 					connection.send(data);
 				});
 				connection.onReady = () => {
+					term.options.disableStdin = false;
 					setStatus({
 						kind: "connected",
 						alias: target
@@ -16683,29 +16703,14 @@ window.__ModuleLoader__.load({
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: panel_module_css_default.controls,
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-								className: panel_module_css_default.input,
-								value: alias,
-								onChange: (event) => {
-									setAlias(event.target.value);
-								},
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-									value: "",
-									children: tt("terminal.selectHost")
-								}), hosts.map((host) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
-									value: host.alias,
-									children: [
-										host.alias,
-										" (",
-										host.host,
-										")"
-									]
-								}, host.alias))]
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: panel_module_css_default.targetBadge,
+								children: alias
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 								type: "button",
 								className: panel_module_css_default.primaryButton,
-								disabled: alias === "" || active,
+								disabled: active,
 								onClick: connect,
 								children: tt("terminal.connect")
 							}),
@@ -16745,7 +16750,7 @@ window.__ModuleLoader__.load({
 							className: panel_module_css_default.termContainer
 						}), status.kind === "idle" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: panel_module_css_default.termPlaceholder,
-							children: hosts.length === 0 ? tt("hosts.empty") : tt("terminal.placeholder")
+							children: tt("terminal.placeholder")
 						})]
 					})
 				]
@@ -16777,33 +16782,22 @@ window.__ModuleLoader__.load({
 			return tt("transfer.gib", { value: (bytes / 1073741824).toFixed(1) });
 		}
 		/** The upload/download tab. */
-		function TransferTab({ api }) {
-			const [hosts, setHosts] = (0, react.useState)([]);
+		function TransferTab({ api, alias, remoteRoot }) {
 			const [listError, setListError] = (0, react.useState)(null);
-			const [alias, setAlias] = (0, react.useState)("");
-			const [remotePath, setRemotePath] = (0, react.useState)("");
+			const [remotePath, setRemotePath] = (0, react.useState)(remoteRoot);
 			const [browseOpen, setBrowseOpen] = (0, react.useState)(false);
-			const [browseDir, setBrowseDir] = (0, react.useState)("/");
+			const [browseDir, setBrowseDir] = (0, react.useState)(remoteRoot);
 			const [entries, setEntries] = (0, react.useState)([]);
 			const [browsing, setBrowsing] = (0, react.useState)(false);
 			const [transfer, setTransfer] = (0, react.useState)(null);
 			const [status, setStatus] = (0, react.useState)(null);
 			const fileRef = (0, react.useRef)(null);
 			const seqRef = (0, react.useRef)(0);
-			(0, react.useEffect)(() => {
-				let disposed = false;
-				(async () => {
-					try {
-						const list = await api.listHosts();
-						if (!disposed) setHosts(list);
-					} catch (cause) {
-						if (!disposed) setListError(errorMessage(cause));
-					}
-				})();
-				return () => {
-					disposed = true;
-				};
-			}, [api]);
+			const transferAbortRef = (0, react.useRef)(null);
+			(0, react.useEffect)(() => () => {
+				transferAbortRef.current?.abort(Object.assign(/* @__PURE__ */ new Error("transfer tab unmounted"), { name: "AbortError" }));
+				transferAbortRef.current = null;
+			}, []);
 			const loadDir = async (path) => {
 				if (alias === "") return;
 				const seq = ++seqRef.current;
@@ -16825,15 +16819,16 @@ window.__ModuleLoader__.load({
 				}
 			};
 			const openBrowse = () => {
-				if (alias === "") return;
 				setBrowseOpen(true);
-				const path = remotePath.trim() === "" ? "/" : remotePath.trim();
+				const path = remotePath.trim() === "" ? remoteRoot : remotePath.trim();
 				loadDir(path);
 			};
 			const handleFile = async (event) => {
 				const file = event.target.files?.[0];
 				event.target.value = "";
 				if (file === void 0 || alias === "" || remotePath.trim() === "" || transfer !== null) return;
+				const controller = new AbortController();
+				transferAbortRef.current = controller;
 				setStatus(null);
 				setTransfer({
 					kind: "upload",
@@ -16843,6 +16838,7 @@ window.__ModuleLoader__.load({
 				});
 				try {
 					const outcome = await api.uploadFile(file, alias, remotePath.trim(), (progress) => {
+						if (transferAbortRef.current !== controller || controller.signal.aborted) return;
 						setTransfer((prev) => prev === null ? prev : {
 							kind: "upload",
 							phase: progress.phase,
@@ -16850,22 +16846,27 @@ window.__ModuleLoader__.load({
 							speedBps: progress.speedBps,
 							file: progress.file
 						});
-					});
-					setStatus({
+					}, controller.signal);
+					if (transferAbortRef.current === controller && !controller.signal.aborted) setStatus({
 						kind: "ok",
 						bytes: outcome.transferredBytes
 					});
 				} catch (cause) {
-					setStatus({
+					if (transferAbortRef.current === controller && !controller.signal.aborted) setStatus({
 						kind: "error",
 						error: errorMessage(cause)
 					});
 				} finally {
-					setTransfer(null);
+					if (transferAbortRef.current === controller) {
+						transferAbortRef.current = null;
+						if (!controller.signal.aborted) setTransfer(null);
+					}
 				}
 			};
 			const handleDownload = async () => {
 				if (alias === "" || remotePath.trim() === "" || transfer !== null) return;
+				const controller = new AbortController();
+				transferAbortRef.current = controller;
 				setStatus(null);
 				setTransfer({
 					kind: "download",
@@ -16875,6 +16876,7 @@ window.__ModuleLoader__.load({
 				});
 				try {
 					const result = await api.downloadFile(alias, remotePath.trim(), (progress) => {
+						if (transferAbortRef.current !== controller || controller.signal.aborted) return;
 						setTransfer((prev) => prev === null ? prev : {
 							kind: "download",
 							phase: progress.phase,
@@ -16882,7 +16884,8 @@ window.__ModuleLoader__.load({
 							speedBps: progress.speedBps,
 							file: progress.file
 						});
-					});
+					}, controller.signal);
+					if (transferAbortRef.current !== controller || controller.signal.aborted) return;
 					if (!result.streamed && result.blob !== void 0) {
 						const url = URL.createObjectURL(result.blob);
 						const anchor = document.createElement("a");
@@ -16900,39 +16903,27 @@ window.__ModuleLoader__.load({
 						bytes: result.bytes
 					});
 				} catch (cause) {
-					setStatus({
+					if (transferAbortRef.current === controller && !controller.signal.aborted) setStatus({
 						kind: "error",
 						error: errorMessage(cause)
 					});
 				} finally {
-					setTransfer(null);
+					if (transferAbortRef.current === controller) {
+						transferAbortRef.current = null;
+						if (!controller.signal.aborted) setTransfer(null);
+					}
 				}
 			};
-			const ready = alias !== "" && remotePath.trim() !== "" && transfer === null;
+			const ready = remotePath.trim() !== "" && transfer === null;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: panel_module_css_default.tabBody,
 				children: [
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: panel_module_css_default.controls,
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-								className: panel_module_css_default.input,
-								value: alias,
-								onChange: (event) => {
-									setAlias(event.target.value);
-								},
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-									value: "",
-									children: tt("transfer.selectHost")
-								}), hosts.map((host) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
-									value: host.alias,
-									children: [
-										host.alias,
-										" (",
-										host.host,
-										")"
-									]
-								}, host.alias))]
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: panel_module_css_default.targetBadge,
+								children: alias
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 								className: panel_module_css_default.input,
@@ -16945,7 +16936,6 @@ window.__ModuleLoader__.load({
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 								type: "button",
 								className: panel_module_css_default.ghostButton,
-								disabled: alias === "",
 								onClick: openBrowse,
 								children: tt("transfer.browseRemote")
 							}),
@@ -17074,28 +17064,14 @@ window.__ModuleLoader__.load({
 		* and a new-tunnel form.
 		*/
 		/** The tunnels tab. */
-		function TunnelsTab({ api }) {
-			const [hosts, setHosts] = (0, react.useState)([]);
+		function TunnelsTab({ api, alias }) {
 			const [tunnels, setTunnels] = (0, react.useState)(null);
 			const [error, setError] = (0, react.useState)(null);
 			const [notice, setNotice] = (0, react.useState)(null);
-			const [alias, setAlias] = (0, react.useState)("");
 			const [remotePort, setRemotePort] = (0, react.useState)("");
 			const [remoteHost, setRemoteHost] = (0, react.useState)("");
 			const [localPort, setLocalPort] = (0, react.useState)("");
 			const [busy, setBusy] = (0, react.useState)(false);
-			(0, react.useEffect)(() => {
-				let disposed = false;
-				(async () => {
-					try {
-						const list = await api.listHosts();
-						if (!disposed) setHosts(list);
-					} catch {}
-				})();
-				return () => {
-					disposed = true;
-				};
-			}, [api]);
 			const seqRef = (0, react.useRef)(0);
 			(0, react.useEffect)(() => {
 				const load = async () => {
@@ -17103,7 +17079,7 @@ window.__ModuleLoader__.load({
 					try {
 						const list = await api.listTunnels();
 						if (seq !== seqRef.current) return;
-						setTunnels(list);
+						setTunnels(list.filter((tunnel) => tunnel.alias === alias));
 						setError(null);
 					} catch (cause) {
 						if (seq !== seqRef.current) return;
@@ -17117,7 +17093,7 @@ window.__ModuleLoader__.load({
 				return () => {
 					clearInterval(timer);
 				};
-			}, [api]);
+			}, [api, alias]);
 			const refresh = async () => {
 				const seq = ++seqRef.current;
 				try {
@@ -17142,7 +17118,7 @@ window.__ModuleLoader__.load({
 				if (!window.confirm(tt("tunnel.stopAllConfirm"))) return;
 				setBusy(true);
 				try {
-					await api.stopAllTunnels(alias === "" ? void 0 : alias);
+					await api.stopAllTunnels(alias);
 					await refresh();
 				} catch (cause) {
 					setError(errorMessage(cause));
@@ -17251,19 +17227,9 @@ window.__ModuleLoader__.load({
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 										className: panel_module_css_default.fieldLabel,
 										children: tt("tunnel.alias")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-										className: panel_module_css_default.input,
-										value: alias,
-										onChange: (event) => {
-											setAlias(event.target.value);
-										},
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-											value: "",
-											children: tt("terminal.selectHost")
-										}), hosts.map((host) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-											value: host.alias,
-											children: host.alias
-										}, host.alias))]
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: panel_module_css_default.targetBadge,
+										children: alias
 									})]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
@@ -17317,7 +17283,7 @@ window.__ModuleLoader__.load({
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 							type: "button",
 							className: panel_module_css_default.primaryButton,
-							disabled: busy || alias === "" || remotePort.trim() === "",
+							disabled: busy || remotePort.trim() === "",
 							onClick: () => {
 								start();
 							},
@@ -17330,18 +17296,13 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/ssh/panel/SshPanel.tsx
 		/**
-		* The SSH operations panel shell: a header with a close control, a five-tab
-		* bar, and the active tab's content. Tab state lives here (browser session
-		* state); inactive tabs unmount, so each tab fetches its own data on
-		* activation. The hosts tab's connect action switches here to the terminal
-		* tab with the chosen alias preselected.
+		* Session-scoped SSH operations console. The right sidebar follows the selected
+		* Session, so every operation inherits that Session's SSH workspace target.
+		* Individual tabs never offer a host picker. A local Session mounts no operation
+		* body and shows a blurred unavailable mask instead.
 		*/
 		/** The tab bar definition (labels resolved at render time). */
 		const TABS = [
-			{
-				id: "hosts",
-				label: () => tt("tab.hosts")
-			},
 			{
 				id: "terminal",
 				label: () => tt("tab.terminal")
@@ -17359,36 +17320,39 @@ window.__ModuleLoader__.load({
 				label: () => tt("tab.cluster")
 			}
 		];
-		/** The tabbed SSH panel. */
-		function SshPanel({ controller, api }) {
-			const [activeTab, setActiveTab] = (0, react.useState)("hosts");
-			const [connectRequest, setConnectRequest] = (0, react.useState)(null);
-			const handleConnect = (alias) => {
-				setActiveTab("terminal");
-				setConnectRequest((prev) => ({
-					alias,
-					nonce: (prev?.nonce ?? 0) + 1
-				}));
-			};
+		/** The tabbed SSH operations console. */
+		function SshPanel({ api, target }) {
+			const [activeTab, setActiveTab] = (0, react.useState)("terminal");
+			const sessionTarget = (0, react.useSyncExternalStore)(target.subscribe, target.getSnapshot, target.getSnapshot);
+			if (sessionTarget === null) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: panel_module_css_default.panel,
+				"data-session-mode": "local",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: panel_module_css_default.disabledSurface,
+					"aria-hidden": "true",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: panel_module_css_default.tabBar,
+						role: "presentation",
+						children: TABS.map((tab) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: panel_module_css_default.tab,
+							children: tab.label()
+						}, tab.id))
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: panel_module_css_default.panelContent,
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { className: panel_module_css_default.disabledPlaceholder })
+					})]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: panel_module_css_default.localSessionMask,
+					role: "status",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: tt("session.localTitle") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: tt("session.localUnavailable") })]
+				})]
+			});
+			const targetKey = `${sessionTarget.sessionId}:${sessionTarget.workspaceId}:${sessionTarget.alias}`;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: panel_module_css_default.panel,
+				"data-session-mode": "ssh",
+				"data-session-alias": sessionTarget.alias,
 				children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: panel_module_css_default.panelHeader,
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", {
-							className: panel_module_css_default.panelTitle,
-							children: tt("panel.title")
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-							type: "button",
-							className: panel_module_css_default.iconButton,
-							title: tt("common.close"),
-							"aria-label": tt("common.close"),
-							onClick: () => {
-								controller.close();
-							},
-							children: "x"
-						})]
-					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: panel_module_css_default.tabBar,
 						role: "tablist",
@@ -17404,271 +17368,172 @@ window.__ModuleLoader__.load({
 							children: tab.label()
 						}, tab.id))
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: panel_module_css_default.sessionTarget,
+						title: sessionTarget.remoteRoot,
+						children: tt("session.target", {
+							alias: sessionTarget.alias,
+							remoteRoot: sessionTarget.remoteRoot
+						})
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: panel_module_css_default.panelContent,
 						children: [
-							activeTab === "hosts" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HostsTab, {
+							activeTab === "terminal" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(TerminalTab, {
 								api,
-								onConnect: handleConnect
+								alias: sessionTarget.alias
 							}),
-							activeTab === "terminal" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(TerminalTab, {
+							activeTab === "transfer" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(TransferTab, {
+								api,
+								alias: sessionTarget.alias,
+								remoteRoot: sessionTarget.remoteRoot
+							}),
+							activeTab === "tunnels" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(TunnelsTab, {
 								api,
-								presetAlias: connectRequest?.alias,
-								requestId: connectRequest?.nonce
+								alias: sessionTarget.alias
 							}),
-							activeTab === "transfer" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(TransferTab, { api }),
-							activeTab === "tunnels" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(TunnelsTab, { api }),
-							activeTab === "cluster" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ClusterTab, { api })
+							activeTab === "cluster" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ClusterTab, {
+								api,
+								alias: sessionTarget.alias
+							})
 						]
-					})
+					}, targetKey)
 				]
 			});
 		}
 		//#endregion
-		//#region src/client/ssh/mount.tsx
-		/**
-		* Panel view mounting.
-		*
-		* The `conversation` slot is single-occupant (ui-conversation) and external
-		* plugins cannot declare slots, so the panel takes over the center column at
-		* the DOM level: a container is appended inside the `[data-pane="conversation"]`
-		* grid item (an extra trailing child React never manages), and a stylesheet
-		* rule hides the conversation content while the panel is active. Toggling is
-		* a data attribute on <html> — no React involvement, so the conversation
-		* subtree underneath stays mounted and stateful.
-		*/
-		const CONVERSATION_COLUMN_SELECTOR = "[data-pane=\"conversation\"]";
-		const ACTIVE_ATTR = "data-dsh-ssh-active";
-		/** Find the center column, or undefined while the frame is not mounted. */
-		function conversationColumn() {
-			return document.querySelector(CONVERSATION_COLUMN_SELECTOR) ?? void 0;
-		}
+		//#region src/client/ssh/ops-tab.tsx
+		/** This implementation's identity in the tab system; also the body/title key. */
+		const OPS_TAB_ID = "@tiphareth/dsh-hardssh/operations";
+		/** The page kind `ctx.sidebarRight.openTab(kind)` names. */
+		const OPS_TAB_KIND = "hardssh-operations";
 		/**
-		* Mount the panel React tree into the center column and bind its visibility
-		* to the controller's panelOpen state.
-		* @param controller - the panel controller driving the view.
-		* @param api - the SSH API client the tabs operate through.
-		* @returns disposer unmounting the tree and restoring the column.
+		* Register the regression type, its body, and its chip title.
+		* @param ctx - client root context carrying the tab registry and slot registry.
+		* @param api - the SSH API client the panel's tabs operate through.
+		* @param target - live target inherited from the selected Session.
 		*/
-		function mountPanel(controller, api) {
-			let root;
-			let container;
-			const ensure = () => {
-				if (container !== void 0) {
-					if (container.isConnected) return;
-					root?.unmount();
-					root = void 0;
-					container.remove();
-					container = void 0;
-				}
-				const column = conversationColumn();
-				if (column === void 0) return;
-				container = document.createElement("div");
-				container.dataset.dshSshView = "";
-				container.className = panel_module_css_default.view;
-				column.appendChild(container);
-				root = (0, react_dom_client.createRoot)(container);
-				root.render(/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SshPanel, {
-					controller,
-					api
-				}));
-			};
-			const waitObserver = new MutationObserver(() => {
-				ensure();
-			});
-			waitObserver.observe(document.body, {
-				childList: true,
-				subtree: true
-			});
-			const applyActive = () => {
-				if (controller.getSnapshot().panelOpen) document.documentElement.setAttribute(ACTIVE_ATTR, "");
-				else document.documentElement.removeAttribute(ACTIVE_ATTR);
-			};
-			const unsubscribe = controller.subscribe(applyActive);
-			applyActive();
-			ensure();
-			return () => {
-				waitObserver.disconnect();
-				unsubscribe();
-				document.documentElement.removeAttribute(ACTIVE_ATTR);
-				root?.unmount();
-				root = void 0;
-				container?.remove();
-				container = void 0;
-			};
-		}
-		//#endregion
-		//#region src/client/ssh/panel/controller.ts
-		/** The panel state owner the sidebar entry toggles and the view renders from. */
-		var PanelController = class {
-			panelOpen = false;
-			listeners = /* @__PURE__ */ new Set();
-			getSnapshot() {
-				return { panelOpen: this.panelOpen };
-			}
-			subscribe(fn) {
-				this.listeners.add(fn);
-				return () => {
-					this.listeners.delete(fn);
-				};
-			}
-			open() {
-				if (this.panelOpen) return;
-				this.panelOpen = true;
-				this.notify();
-			}
-			close() {
-				if (!this.panelOpen) return;
-				this.panelOpen = false;
-				this.notify();
-			}
-			toggle() {
-				if (this.panelOpen) this.close();
-				else this.open();
-			}
-			notify() {
-				for (const fn of [...this.listeners]) fn();
-			}
-		};
-		//#endregion
-		//#region src/client/ssh/sidebar-entry.ts
-		/** The sidebar column is the grid item AppFrame renders with this pane marker. */
-		const SIDEBAR_COLUMN_SELECTOR = "[data-pane=\"sidebar\"]";
-		/** Find the sidebar shell root element, or undefined while not yet mounted. */
-		function sidebarRoot() {
-			return document.querySelector(SIDEBAR_COLUMN_SELECTOR)?.firstElementChild ?? void 0;
-		}
-		/** The New Session button: the shell's only direct-child button of the root. */
-		function newSessionButton(root) {
-			for (const child of root.children) if (child.tagName === "BUTTON") return child;
-		}
-		/** Build the entry row (a detached button; insert once the shell is up). */
-		function createEntry(controller) {
-			const entry = document.createElement("button");
-			entry.type = "button";
-			entry.dataset.dshSshEntry = "";
-			entry.className = panel_module_css_default.entry;
-			entry.setAttribute("aria-label", tt("entry.label"));
-			entry.setAttribute("title", tt("entry.tooltip"));
-			entry.innerHTML = "<span class=\"" + panel_module_css_default.entryIcon + "\"><svg viewBox=\"0 0 16 16\" width=\"14\" height=\"14\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.3\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"2\" y=\"2.5\" width=\"12\" height=\"11\" rx=\"1.5\"/><path d=\"M4.5 5.5l2.5 2.5-2.5 2.5\"/><path d=\"M8.5 10.5h3\"/></svg></span><span class=\"" + panel_module_css_default.entryLabel + "\">" + tt("entry.label") + "</span>";
-			entry.addEventListener("click", () => {
-				controller.toggle();
-			});
-			return entry;
-		}
-		/** Re-insert the entry after the New Session button (before the browser region). */
-		function placeEntry(root, entry) {
-			const button = newSessionButton(root);
-			if (button === void 0) return false;
-			if (entry.parentElement !== root) root.insertBefore(entry, button.nextElementSibling);
-			return true;
+		function registerOperationsTab(ctx, api, target) {
+			ctx.effect(() => ctx.sidebarRightTabs.register({
+				id: OPS_TAB_ID,
+				kind: OPS_TAB_KIND,
+				title: () => tt$1("ops.tab"),
+				guide: [{
+					order: 100,
+					title: () => tt$1("ops.tab"),
+					description: () => tt$1("ops.guide")
+				}]
+			}), "dsh-hardssh: operations tab type");
+			ctx.slots.inject("sidebar.right.pane.tab", () => ctx.slots.register({
+				name: "sidebar.right.pane.tab",
+				key: OPS_TAB_ID,
+				inject: () => ({
+					api,
+					target
+				})
+			}, SshPanel));
+			ctx.slots.inject("sidebar.right.pane.tab.title", () => ctx.slots.register({
+				name: "sidebar.right.pane.tab.title",
+				key: OPS_TAB_ID
+			}, OpsTabTitle));
 		}
-		/**
-		* Mount the sidebar entry, waiting for the shell to render and self-healing
-		* on later React re-renders.
-		* @param controller - the panel controller the entry toggles.
-		* @returns disposer removing the entry and its observers.
-		*/
-		function mountSidebarEntry(controller) {
-			const entry = createEntry(controller);
-			let root;
-			let placed = false;
-			const tryPlace = () => {
-				if (placed) return;
-				if (root !== void 0 && !root.isConnected) {
-					rootObserver.disconnect();
-					root = void 0;
-				}
-				root ??= sidebarRoot();
-				if (root === void 0) return;
-				placed = placeEntry(root, entry);
-				if (placed) rootObserver.observe(root, {
-					childList: true,
-					subtree: true
-				});
-			};
-			const waitObserver = new MutationObserver(() => {
-				tryPlace();
-			});
-			waitObserver.observe(document.body, {
-				childList: true,
-				subtree: true
-			});
-			const rootObserver = new MutationObserver(() => {
-				if (root === void 0 || !root.isConnected) {
-					placed = false;
-					tryPlace();
-					return;
-				}
-				if (!root.contains(entry)) placed = placeEntry(root, entry);
-			});
-			const unsubscribe = controller.subscribe(() => {
-				entry.dataset.active = controller.getSnapshot().panelOpen ? "true" : void 0;
-			});
-			entry.dataset.active = controller.getSnapshot().panelOpen ? "true" : void 0;
-			tryPlace();
-			return () => {
-				waitObserver.disconnect();
-				rootObserver.disconnect();
-				unsubscribe();
-				entry.remove();
-			};
+		/** The tab chip and floating-panel header text. */
+		function OpsTabTitle() {
+			return tt$1("ops.tab");
 		}
 		//#endregion
 		//#region src/client/ssh/apply.ts
 		/** Locale namespace this capability owns (kept as 'dsh-ssh'). */
 		const NS = "dsh-ssh";
 		/**
-		* Mount the SSH operations surfaces (sidebar entry + operations panel).
-		* @param ctx - client root context (locale service).
+		* Mount the SSH operations surfaces (locale dictionaries + the right-Sidebar tab).
+		* @param ctx - client root context (locale service, slot registry, tab registry).
+		* @param api - shared SSH API client.
+		* @param target - selected Session's fixed SSH target, or null for local Sessions.
 		*/
-		function mountSshOperations(ctx) {
+		function mountSshOperations(ctx, api, target) {
+			try {
+				registerOperationsTab(ctx, api, target);
+			} catch (error) {
+				console.warn("[dsh-ssh] operations tab registration failed:", error);
+			}
 			ctx.effect(() => ctx.locale.register(NS, {
 				zh,
 				en
 			}), "dsh-ssh: dictionaries");
-			const controller = new PanelController();
-			const api = new SshApi();
-			const disposers = [];
-			try {
-				disposers.push(mountSidebarEntry(controller));
-				disposers.push(mountPanel(controller, api));
-			} catch (error) {
-				console.warn("[dsh-ssh] mount failed:", error);
-			}
-			ctx.effect(() => () => {
-				for (const dispose of disposers.splice(0)) dispose();
-			}, "dsh-ssh: ui mounts");
+		}
+		//#endregion
+		//#region src/client/ssh/session-target.ts
+		/** Build one stable Session → SSH target source over the public session list and workspace manager. */
+		function createSessionSshTargetSource(sessions, manager) {
+			const workspaceForCwd = makeAnchorWorkspaceResolver(() => manager.getSnapshot().workspaces);
+			let cachedKey;
+			let cachedValue = null;
+			const getSnapshot = () => {
+				const sessionId = sessions.currentSessionId();
+				const cwd = sessionId === void 0 ? void 0 : sessions.sessionCwd(sessionId);
+				const workspace = workspaceForCwd(cwd);
+				const key = workspace === void 0 || sessionId === void 0 ? `local\u0000${sessionId ?? ""}\u0000${cwd ?? ""}` : `ssh\u0000${sessionId}\u0000${workspace.id}\u0000${workspace.alias}\u0000${workspace.remoteRoot}`;
+				if (key === cachedKey) return cachedValue;
+				cachedKey = key;
+				cachedValue = workspace === void 0 || sessionId === void 0 ? null : {
+					sessionId,
+					workspaceId: workspace.id,
+					alias: workspace.alias,
+					remoteRoot: workspace.remoteRoot
+				};
+				return cachedValue;
+			};
+			return {
+				getSnapshot,
+				subscribe: (listener) => {
+					const disposeSessions = sessions.subscribe(listener);
+					const disposeWorkspaces = manager.subscribe(listener);
+					return () => {
+						disposeSessions();
+						disposeWorkspaces();
+					};
+				}
+			};
 		}
 		//#endregion
 		//#region src/client/index.ts
-		/** Required services: slots for the header buttons + directory-flow holes,
-		*  locale for the copy, workspaces for the native local-directory chooser. */
+		/** Required services: slots for the extension seats, locale for copy,
+		*  workspaces for the native local-directory chooser, sessions for the
+		*  open/new-session connection gate, and sidebarRightTabs for the SSH
+		*  operations console type. Keep the registry explicit: without it Cordis may
+		*  activate this client before ui-sidebar-right provides the service; the
+		*  guarded registration then degrades silently and no HardSSH tab exists. */
 		const inject = [
 			"slots",
 			"locale",
-			"workspaces"
+			"workspaces",
+			"sessions",
+			"sidebarRightTabs"
 		];
 		/** Apply the browser half. */
 		function apply(ctx) {
-			mountSshOperations(ctx);
-			ctx.effect(() => ctx.locale.register(NS$1, dictionaries), "dsh-hardssh: dictionaries");
 			const api = new WorkspaceApi();
 			const hostsApi = new SshHostsApi();
 			const sshApi = new SshApi();
 			const manager = new WorkspaceManager(api);
+			const sessionList = ctx.sessions.list;
+			const sessions = {
+				subscribe: (listener) => sessionList.subscribe(listener),
+				phase: () => sessionList.getSnapshot().phase,
+				currentSessionId: () => sessionList.getSnapshot().current,
+				sessionIds: () => sessionList.getSnapshot().ids,
+				sessionCwd: (id) => {
+					return sessionList.getSnapshot().byId[id]?.cwd;
+				}
+			};
+			mountSshOperations(ctx, sshApi, createSessionSshTargetSource(sessions, manager));
+			ctx.effect(() => ctx.locale.register(NS$1, dictionaries), "dsh-hardssh: dictionaries");
 			const disposers = [];
 			try {
-				ctx.slots.inject("conversation.session.header.utilities", () => {
-					return ctx.slots.register({
-						name: "conversation.session.header.utilities",
-						id: "ssh-workspace-manager",
-						order: -10,
-						inject: () => ({
-							manager,
-							sshApi
-						})
-					}, WorkspaceManagerButton);
+				registerWorkspacePanel(ctx, {
+					manager,
+					sshApi
 				});
 				const flowInject = () => ({
 					pickDirectory: () => ctx.workspaces.pickDirectory(),
@@ -17729,25 +17594,10 @@ window.__ModuleLoader__.load({
 					window.clearInterval(connTimer);
 				});
 				refreshConnections();
-				let gateDispose;
-				const refreshGates = () => {
-					try {
-						const workspaces = manager.getSnapshot().workspaces;
-						gateDispose?.();
-						gateDispose = mountWorkspaceGates(workspaces.map((workspace) => ({
-							id: workspace.id,
-							title: workspace.title,
-							alias: workspace.alias
-						})), sshApi);
-					} catch (error) {
-						console.warn("[dsh-hardssh] gate refresh failed:", error);
-					}
-				};
-				disposers.push(() => {
-					gateDispose?.();
-				});
-				disposers.push(manager.subscribe(() => {
-					refreshGates();
+				disposers.push(mountSessionConnectGate({
+					sessions,
+					aliasForCwd: makeAnchorAliasResolver(() => manager.getSnapshot().workspaces),
+					ensureConnected: (alias) => connectHost(sshApi, alias)
 				}));
 			} catch (error) {
 				console.warn("[dsh-hardssh] mount failed:", error);