fix(#2952): automated Cursor CLI fix

feat(vault): 添加动态组路径支持用于自动化脚本

application/app/AppSideEffects.tsx

@@ -18,6 +18,7 @@ import {
 import { getNotesSnapshot } from '../state/notesStore';
 import { useVaultAgentBridge } from '../state/useVaultAgentBridge';
 import { useWindowControls } from '../state/useWindowControls';
+import { useTerminalKeyboardFocus } from '../state/useTerminalKeyboardFocus';
 import { useEditorTabChromeList } from '../state/editorTabStore';
 import {
   isPluginViewTabId,
@@ -132,12 +133,15 @@ export function AppSideEffects() {
     terminalSettings,
     hotkeyScheme,
     keyBindings,
+    disableTerminalFontZoom,
     isHotkeyRecording,
     showSftpTab,
     shellOnlyTabNumberShortcuts,
     workspaceFocusStyle,
   } = settings;
 
+  useTerminalKeyboardFocus(hotkeyScheme !== 'disabled' && !disableTerminalFontZoom);
+
   const discoveredShells = useDiscoveredShells();
 
   // Sync workspace focus indicator style to DOM for CSS targeting
@@ -196,6 +200,7 @@ export function AppSideEffects() {
     readPersistedHosts,
     groupConfigs,
     updateGroupConfigs,
+    commitVaultGroupMutation,
   } = vaultState;
 
   const hostsRef = useRef(hosts);
@@ -1279,6 +1284,7 @@ export function AppSideEffects() {
     groupConfigs,
     updateGroupConfigs,
     updateManagedSources,
+    commitVaultGroupMutation,
     updatePortForwardingRules: importPortForwardingRules,
     startTunnel,
     stopTunnel,

application/app/AppView.tsx

@@ -34,6 +34,7 @@ import { useMainWindowInputFocusRecovery } from '../state/useMainWindowInputFocu
 import { useExternalMcpToggleState } from '../state/useExternalMcpToggleState';
 import { selectPluginThemeTokens } from '../state/pluginContributionEnvironment';
 import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+import { resolveEffectiveTerminalHost } from '../../domain/terminalHostResolution';
 import { pluginViewTabStore, usePluginViewTabs } from '../state/pluginViewTabStore';
 import { buildPluginSettingScopeCatalog } from '../state/usePluginSettingScopeCatalog';
 import { useWorkSurfaceHostEditor } from '../state/useWorkSurfaceHostEditor';
@@ -257,7 +258,7 @@ function AppViewInner({ domains }: AppViewProps) {
 
   const {
     addShellHistoryEntry, removeShellHistoryEntry, addSessionToWorkspace, addToWorkspaceDialog, appendHostToWorkspace, appendLocalTerminalToWorkspace,
-    clearAndRemoveSource, clearAndRemoveSources, closeLogView, closeSession, closeTabsBatch, closeWorkspace, commitPluginImporterData, commitVaultImportTransaction, copySessionToNewWindowWithCurrentShell, copySessionWithCurrentShell, copyWorkspaceWithCurrentShell,
+    clearAndRemoveSource, clearAndRemoveSources, closeLogView, closeSession, closeTabsBatch, closeWorkspace, commitPluginImporterData, commitVaultImportTransaction, commitVaultGroupMutation, copySessionToNewWindowWithCurrentShell, copySessionWithCurrentShell, copyWorkspaceWithCurrentShell,
     convertKnownHostToHost, createWorkspaceFromSessions, createWorkspaceFromTargets, createWorkspaceWithHosts,
     customGroups, currentTerminalTheme, deepLinkHostDraft, draggingSessionId, effectiveKnownHosts, editorTabs, editorWordWrap, emptyVaultConflict,
     followAppTerminalTheme,
@@ -317,6 +318,29 @@ function AppViewInner({ domains }: AppViewProps) {
     setAddToWorkspaceDialog({ mode: 'append', workspaceId });
   }, [setAddToWorkspaceDialog]);
 
+  const validProxyProfileIds = useMemo(
+    () => new Set(proxyProfiles.map((profile) => profile.id)),
+    [proxyProfiles],
+  );
+
+  const resolveWorkspaceAppendHost = useCallback((host: typeof hosts[number]) => (
+    resolveEffectiveTerminalHost({
+      host,
+      groupConfigs,
+      proxyProfiles,
+      validProxyProfileIds,
+    })
+  ), [groupConfigs, proxyProfiles, validProxyProfileIds]);
+
+  const handleAppendHostToWorkspace = useCallback((workspaceId: string, hostId: string) => {
+    const host = hosts.find((entry) => entry.id === hostId);
+    if (!host) return;
+    const ws = workspaces.find((entry) => entry.id === workspaceId);
+    if (!ws) return;
+    const rootDir = ws.root.type === 'split' ? ws.root.direction : 'vertical';
+    appendHostToWorkspace(workspaceId, resolveWorkspaceAppendHost(host), rootDir);
+  }, [appendHostToWorkspace, hosts, resolveWorkspaceAppendHost, workspaces]);
+
   const isPeerSessionWindow = typeof window !== 'undefined'
     && window.location.hash.startsWith('#/session-window');
   const externalMcpToggle = useExternalMcpToggleState();
@@ -471,6 +495,7 @@ function AppViewInner({ domains }: AppViewProps) {
         onEndSessionDrag={handleEndSessionDrag}
         onReorderTabs={reorderWorkTabs}
         onRemoveSessionFromWorkspace={removeSessionFromWorkspace}
+        onAppendHostToWorkspace={handleAppendHostToWorkspace}
         showSftpTab={showSftpTab}
         showHostTreeSidebar={showHostTreeSidebar}
         switchTabKeyBinding={keyBindings.find((binding) => binding.action === 'switchToTab') ?? null}
@@ -567,6 +592,7 @@ function AppViewInner({ domains }: AppViewProps) {
             onUpdateManagedSources={updateManagedSources}
             onReadPersistedManagedSources={readPersistedManagedSources}
             onCommitVaultImportTransaction={commitVaultImportTransaction}
+            onCommitVaultGroupMutation={commitVaultGroupMutation}
             onClearAndRemoveManagedSource={clearAndRemoveSource}
             onClearAndRemoveManagedSources={clearAndRemoveSources}
             onUnmanageSource={unmanageSource}
@@ -659,6 +685,7 @@ function AppViewInner({ domains }: AppViewProps) {
           onCreateWorkspaceFromSessions={createWorkspaceFromSessions}
           onAddSessionToWorkspace={addSessionToWorkspace}
           onRequestAddToWorkspace={handleRequestAddToWorkspace}
+          onAppendHostToWorkspace={handleAppendHostToWorkspace}
           onUpdateSplitSizes={updateSplitSizes}
           onSetDraggingSessionId={setDraggingSessionId}
           onToggleWorkspaceViewMode={toggleWorkspaceViewMode}
@@ -780,13 +807,7 @@ function AppViewInner({ domains }: AppViewProps) {
         <AddToWorkspaceDialog
           open
           onOpenChange={(open) => { if (!open) setAddToWorkspaceDialog(null); }}
-          // Filter serial hosts only in append mode — appendHostToWorkspace
-          // has no serial code path. Create mode goes through
-          // createWorkspaceFromTargets, which builds a SerialConfig-backed
-          // session for serial hosts, so those should remain pickable.
-          hosts={addToWorkspaceDialog.mode === 'append'
-            ? hosts.filter((h) => h.protocol !== 'serial')
-            : hosts}
+          hosts={hosts}
           workspaceTitle={
             addToWorkspaceDialog.mode === 'append'
               ? workspaces.find((w) => w.id === addToWorkspaceDialog.workspaceId)?.title
@@ -805,7 +826,11 @@ function AppViewInner({ domains }: AppViewProps) {
                 if (target.kind === 'local') {
                   appendLocalTerminalToWorkspace(addToWorkspaceDialog.workspaceId, undefined, rootDir);
                 } else {
-                  appendHostToWorkspace(addToWorkspaceDialog.workspaceId, target.host, rootDir);
+                  appendHostToWorkspace(
+                    addToWorkspaceDialog.workspaceId,
+                    resolveWorkspaceAppendHost(target.host),
+                    rootDir,
+                  );
                 }
               }
             } else {

application/app/AppView.workspaceHostAppend.test.ts

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+const source = readFileSync(new URL('./AppView.tsx', import.meta.url), 'utf8');
+
+test('workspace append resolves group defaults before creating host sessions', () => {
+  assert.match(source, /resolveEffectiveTerminalHost\(\{/);
+  assert.match(source, /groupConfigs,/);
+  assert.match(source, /proxyProfiles,/);
+  assert.match(
+    source,
+    /appendHostToWorkspace\(workspaceId, resolveWorkspaceAppendHost\(host\), rootDir\)/,
+  );
+  assert.match(
+    source,
+    /appendHostToWorkspace\([\s\S]*?resolveWorkspaceAppendHost\(target\.host\),[\s\S]*?rootDir/,
+  );
+});

application/app/hosts/VaultHost.tsx

@@ -38,6 +38,7 @@ export function VaultHost() {
       removeShellHistoryEntry: actions?.removeShellHistoryEntry,
       commitPluginImporterData: actions?.commitPluginImporterData,
       commitVaultImportTransaction: actions?.commitVaultImportTransaction,
+      commitVaultGroupMutation: actions?.commitVaultGroupMutation,
       convertKnownHostToHost: actions?.convertKnownHostToHost,
       customGroups: vault.customGroups,
       deepLinkHostDraft: local.deepLinkHostDraft,

application/app/publishers/VaultPublisher.tsx

@@ -67,6 +67,7 @@ export function VaultPublisher({ children }: VaultPublisherProps) {
     readPersistedManagedSources,
     commitPluginImporterData,
     commitVaultImportTransaction,
+    commitVaultGroupMutation,
     updateHostDistro,
     updateHostLastConnected,
     addShellHistoryEntry,
@@ -138,6 +139,7 @@ export function VaultPublisher({ children }: VaultPublisherProps) {
       readPersistedManagedSources,
       commitPluginImporterData,
       commitVaultImportTransaction,
+      commitVaultGroupMutation,
       updateHostDistro,
       updateHostLastConnected,
       addShellHistoryEntry,
@@ -150,6 +152,7 @@ export function VaultPublisher({ children }: VaultPublisherProps) {
     addShellHistoryEntry,
     commitPluginImporterData,
     commitVaultImportTransaction,
+    commitVaultGroupMutation,
     convertKnownHostToHost,
     importOrReuseKey,
     readPersistedHosts,

application/i18n/locales/en/ai.ts

@@ -53,6 +53,7 @@ export const enAiMessages: Messages = {
   'ai.providers.apiKey.placeholder': 'Enter API key',
   'ai.providers.apiKey.decrypting': 'Decrypting...',
   'ai.providers.baseUrl': 'Base URL',
+  'ai.providers.baseUrl.anthropicHelp': 'Anthropic-compatible: host with or without /v1 (for example https://gateway.example or https://gateway.example/v1). Detection and chat both use /v1/models and /v1/messages.',
   'ai.providers.skipTLSVerify': 'Skip TLS certificate verification (for self-signed certs)',
   'ai.providers.defaultModel': 'Default Model',
   'ai.providers.defaultModel.placeholder': 'e.g. gpt-4o, claude-sonnet-4-20250514',

application/i18n/locales/en/scripts.ts

@@ -18,8 +18,11 @@ export const enScriptsMessages = {
   'scripts.editor.modalSubtitle': 'Edit metadata and script code in a larger workspace.',
   'scripts.editor.lineCount': '{count} lines',
   'scripts.editor.resize': 'Resize editor',
-  'scripts.targets.hint': 'Automatic triggers apply to selected hosts, or to all hosts when that option is enabled.',
+  'scripts.targets.hint': 'Selected groups are resolved dynamically, so hosts added later are included automatically.',
   'scripts.targets.connectOrderHint': 'Run order for connect scripts is configured per host under Host details → Automation.',
+  'scripts.targets.currentHostMismatch': 'This script is not assigned to the current host.',
+  'hostDetails.automation.groupScripts': 'Inherited group scripts',
+  'hostDetails.automation.groupScriptsHint': 'These scripts follow the host group dynamically and are ordered before the host-specific queue.',
   'scripts.actions.runNowHint': 'Run on selected targets, or on all connectable hosts when that option is enabled.',
   'scripts.actions.runParallel': 'Run on all tabs (parallel)',
   'scripts.actions.runSequential': 'Run on all tabs (sequential)',

application/i18n/locales/en/terminal.ts

@@ -659,6 +659,9 @@ export const enTerminalMessages: Messages = {
   'snippets.scriptEditor.modalTitle': 'Edit script',
   'snippets.targets.title': 'Targets',
   'snippets.targets.add': 'Add targets',
+  'snippets.targets.selectHosts': 'Hosts',
+  'snippets.targets.selectGroups': 'Groups',
+  'snippets.targets.noGroups': 'No groups found',
   'snippets.targets.allHosts': 'Apply to all hosts',
   'snippets.targets.allHostsShort': 'All hosts',
   'snippets.targets.allHostsActive': 'Applies to every connectable host.',

application/i18n/locales/ru/ai.ts

@@ -34,6 +34,7 @@ export const ruAiMessages: Messages = {
   'ai.providers.apiKey.placeholder': 'Введите API-ключ',
   'ai.providers.apiKey.decrypting': 'Расшифровка...',
   'ai.providers.baseUrl': 'Базовый URL',
+  'ai.providers.baseUrl.anthropicHelp': 'Anthropic-совместимый: хост с /v1 или без (например https://gateway.example или https://gateway.example/v1). Проверка и чат используют /v1/models и /v1/messages.',
   'ai.providers.skipTLSVerify': 'Пропустить проверку TLS-сертификата (для самоподписанных сертификатов)',
   'ai.providers.defaultModel': 'Модель по умолчанию',
   'ai.providers.defaultModel.placeholder': 'например, gpt-4o, claude-sonnet-4-20250514',

application/i18n/locales/ru/scripts.ts

@@ -18,8 +18,11 @@ export const ruScriptsMessages = {
   'scripts.editor.modalSubtitle': 'Редактируйте метаданные и код скрипта в большом рабочем пространстве.',
   'scripts.editor.lineCount': '{count} строк',
   'scripts.editor.resize': 'Изменить размер редактора',
-  'scripts.targets.hint': 'Автоматические триггеры применяются к выбранным хостам или ко всем хостам, если включена эта настройка.',
+  'scripts.targets.hint': 'Выбранные группы разрешаются динамически, поэтому новые хосты включаются автоматически.',
   'scripts.targets.connectOrderHint': 'Порядок запуска скриптов подключения настраивается для каждого хоста в разделе «Сведения о хосте → Автоматизация».',
+  'scripts.targets.currentHostMismatch': 'Этот скрипт не назначен текущему хосту.',
+  'hostDetails.automation.groupScripts': 'Унаследованные скрипты группы',
+  'hostDetails.automation.groupScriptsHint': 'Эти скрипты динамически следуют за группой хоста и выполняются перед очередью хоста.',
   'scripts.actions.runNowHint': 'Запускается для выбранных целей либо для всех доступных для подключения хостов, если включена эта настройка.',
   'scripts.actions.runParallel': 'Запустить на всех вкладках (параллельно)',
   'scripts.actions.runSequential': 'Запустить на всех вкладках (последовательно)',

application/i18n/locales/ru/terminal.ts

@@ -681,6 +681,9 @@ export const ruTerminalMessages: Messages = {
   'snippets.field.variableDefault': 'по умолчанию {value}',
   'snippets.targets.title': 'Цели',
   'snippets.targets.add': 'Добавить цели',
+  'snippets.targets.selectHosts': 'Хосты',
+  'snippets.targets.selectGroups': 'Группы',
+  'snippets.targets.noGroups': 'Группы не найдены',
   'snippets.history.title': 'История оболочки',
   'snippets.history.subtitle': '{count} команд',
   'snippets.history.emptyTitle': 'История оболочки пока пуста',

application/i18n/locales/zh-CN/ai.ts

@@ -53,6 +53,7 @@ export const zhCNAiMessages: Messages = {
   'ai.providers.apiKey.placeholder': '输入 API Key',
   'ai.providers.apiKey.decrypting': '解密中...',
   'ai.providers.baseUrl': 'Base URL',
+  'ai.providers.baseUrl.anthropicHelp': 'Anthropic 兼容：可填不带或带 /v1 的主机（例如 https://gateway.example 或 https://gateway.example/v1）。检测与聊天都会请求 /v1/models、/v1/messages。',
   'ai.providers.skipTLSVerify': '跳过 TLS 证书验证（用于自签名证书）',
   'ai.providers.defaultModel': '默认模型',
   'ai.providers.defaultModel.placeholder': '例如 gpt-4o, claude-sonnet-4-20250514',

application/i18n/locales/zh-CN/scripts.ts

@@ -18,8 +18,11 @@ export const zhCNScriptsMessages = {
   'scripts.editor.modalSubtitle': '在更大的工作区中编辑脚本元数据和代码。',
   'scripts.editor.lineCount': '{count} 行',
   'scripts.editor.resize': '调整编辑器高度',
-  'scripts.targets.hint': '自动触发作用于所选主机；勾选「对所有主机生效」则作用于全部可连接主机。',
+  'scripts.targets.hint': '所选分组会动态匹配，之后加入分组的主机也会自动生效。',
   'scripts.targets.connectOrderHint': '连接脚本的执行顺序请在主机详情 → 自动化 中调整。',
+  'scripts.targets.currentHostMismatch': '此脚本未分配给当前主机。',
+  'hostDetails.automation.groupScripts': '分组继承脚本',
+  'hostDetails.automation.groupScriptsHint': '这些脚本动态跟随主机所在分组，并在主机专属队列之前执行。',
   'scripts.actions.runNowHint': '在所选目标主机上运行；勾选「对所有主机生效」时在所有可连接主机上运行。',
   'scripts.actions.runParallel': '在所有标签页并行运行',
   'scripts.actions.runSequential': '在所有标签页顺序运行',

application/i18n/locales/zh-CN/terminal.ts

@@ -742,8 +742,11 @@ export const zhCNTerminalMessages: Messages = {
   'snippets.scriptEditor.expand': '弹窗编辑',
   'snippets.scriptEditor.resize': '调整编辑器高度',
   'snippets.scriptEditor.modalTitle': '编辑脚本',
-  'snippets.targets.title': '目标主机',
-  'snippets.targets.add': '添加目标主机',
+  'snippets.targets.title': '执行目标',
+  'snippets.targets.add': '添加目标',
+  'snippets.targets.selectHosts': '选择主机',
+  'snippets.targets.selectGroups': '选择分组',
+  'snippets.targets.noGroups': '未找到分组',
   'snippets.targets.allHosts': '对所有主机生效',
   'snippets.targets.allHostsShort': '所有主机',
   'snippets.targets.allHostsActive': '将作用于所有可连接的主机。',

application/i18n/locales/zh-TW/ai.ts

@@ -53,6 +53,7 @@ export const zhTWAiMessages: Messages = {
   'ai.providers.apiKey.placeholder': '輸入 API Key',
   'ai.providers.apiKey.decrypting': '解密中...',
   'ai.providers.baseUrl': 'Base URL',
+  'ai.providers.baseUrl.anthropicHelp': 'Anthropic 相容：可填不帶或帶 /v1 的主機（例如 https://gateway.example 或 https://gateway.example/v1）。偵測與聊天都會請求 /v1/models、/v1/messages。',
   'ai.providers.skipTLSVerify': '跳過 TLS 憑證驗證（用於自我簽署憑證）',
   'ai.providers.defaultModel': '預設模型',
   'ai.providers.defaultModel.placeholder': '例如 gpt-4o, claude-sonnet-4-20250514',

application/i18n/locales/zh-TW/scripts.ts

@@ -18,8 +18,11 @@ export const zhTWScriptsMessages = {
   'scripts.editor.modalSubtitle': '在更大的工作區中編輯指令碼的中繼資料與程式碼。',
   'scripts.editor.lineCount': '{count} 行',
   'scripts.editor.resize': '調整編輯器高度',
-  'scripts.targets.hint': '自動觸發會作用於所選主機；勾選「對所有主機生效」則作用於全部可連線的主機。',
+  'scripts.targets.hint': '所選分組會動態比對，之後加入分組的主機也會自動生效。',
   'scripts.targets.connectOrderHint': '連線指令碼的執行順序請在主機詳情 → 自動化 中調整。',
+  'scripts.targets.currentHostMismatch': '此指令碼未分配給目前主機。',
+  'hostDetails.automation.groupScripts': '分組繼承指令碼',
+  'hostDetails.automation.groupScriptsHint': '這些指令碼會動態跟隨主機所在分組，並在主機專屬佇列之前執行。',
   'scripts.actions.runNowHint': '在所選目標主機上執行；勾選「對所有主機生效」時在所有可連線的主機上執行。',
   'scripts.actions.runParallel': '在所有標籤頁並行執行',
   'scripts.actions.runSequential': '在所有標籤頁依序執行',

application/i18n/locales/zh-TW/terminal.ts

@@ -739,8 +739,11 @@ export const zhTWTerminalMessages: Messages = {
   'snippets.scriptEditor.expand': '彈出視窗編輯',
   'snippets.scriptEditor.resize': '調整編輯器高度',
   'snippets.scriptEditor.modalTitle': '編輯指令碼',
-  'snippets.targets.title': '目標主機',
-  'snippets.targets.add': '新增目標主機',
+  'snippets.targets.title': '執行目標',
+  'snippets.targets.add': '新增目標',
+  'snippets.targets.selectHosts': '選擇主機',
+  'snippets.targets.selectGroups': '選擇分組',
+  'snippets.targets.noGroups': '未找到分組',
   'snippets.history.title': 'Shell 歷史',
   'snippets.history.subtitle': '{count} 條指令',
   'snippets.history.emptyTitle': '暫無 Shell 歷史',

application/state/scriptAutomationCoordinator.test.ts

@@ -1,11 +1,14 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 import {
+  runConnectScriptsSequential,
   selectScriptOverlayRun,
   setScriptRuns,
   waitForScriptRun,
 } from './scriptAutomationCoordinator.ts';
 import type { ScriptRun } from '@/types/global/netcatty-bridge-script.d.ts';
+import type { Snippet } from '@/domain/models';
+import { netcattyBridge } from '@/infrastructure/services/netcattyBridge.ts';
 
 test('waitForScriptRun resolves when run is already completed on subscribe', async () => {
   const runId = 'run-already-done';
@@ -64,3 +67,182 @@ test('selectScriptOverlayRun does not resurface older completed runs after dismi
   dismissedRunIds.add(latestRun.runId);
   assert.equal(selectScriptOverlayRun([olderRun, latestRun], 'sess1', dismissedRunIds), undefined);
 });
+
+test('runConnectScriptsSequential cancels only its own queued run and waits for stop', async () => {
+  const originalGet = netcattyBridge.get;
+  const sessionId = 'sess-connect-abort';
+  let queuedRunId: string | undefined;
+  let releaseStop: (() => void) | undefined;
+  const scriptStopCalls: string[] = [];
+  const storage = new Map<string, string>();
+  Object.defineProperty(globalThis, 'localStorage', {
+    configurable: true,
+    value: {
+      getItem: (key: string) => storage.get(key) ?? null,
+      setItem: (key: string, value: string) => { storage.set(key, String(value)); },
+      removeItem: (key: string) => { storage.delete(key); },
+      clear: () => { storage.clear(); },
+    },
+  });
+
+  setScriptRuns([{
+    runId: 'unrelated-active-run',
+    scriptId: 'manual-script',
+    sessionId,
+    status: 'running',
+    startedAt: Date.now(),
+    logs: [],
+  }]);
+
+  netcattyBridge.get = () => ({
+    scriptRun: async (params) => {
+      queuedRunId = params.runId;
+      assert.equal(params.returnWhenQueued, true);
+      return { runId: params.runId!, runIds: [params.runId!] };
+    },
+    scriptStop: (id: string) => new Promise((resolve) => {
+      scriptStopCalls.push(id);
+      releaseStop = () => resolve({ ok: true });
+    }),
+  }) as ReturnType<typeof netcattyBridge.get>;
+
+  const controller = new AbortController();
+  let stopCurrentRun: (() => Promise<void>) | null = null;
+  const snippet: Snippet = {
+    id: 'connect-script',
+    label: 'Connect',
+    command: 'nct.session.sleep(60)',
+    kind: 'script',
+  };
+
+  try {
+    const running = runConnectScriptsSequential({
+      scripts: [snippet],
+      sessionId,
+      signal: controller.signal,
+      onCancelableRunChange: (stop) => { stopCurrentRun = stop; },
+    });
+    void running.catch(() => {});
+    await Promise.resolve();
+    controller.abort();
+    for (let attempt = 0; attempt < 10 && scriptStopCalls.length === 0; attempt += 1) {
+      await new Promise<void>((resolve) => setImmediate(resolve));
+    }
+    assert.deepEqual(scriptStopCalls, [queuedRunId]);
+    assert.notEqual(queuedRunId, 'unrelated-active-run');
+    assert.equal(typeof stopCurrentRun, 'function');
+
+    let settled = false;
+    void running.finally(() => { settled = true; }).catch(() => {});
+    await Promise.resolve();
+    assert.equal(settled, false);
+
+    releaseStop?.();
+    await assert.rejects(
+      () => running,
+      (error: unknown) => error instanceof DOMException && error.name === 'AbortError',
+    );
+  } finally {
+    netcattyBridge.get = originalGet;
+    setScriptRuns([]);
+    Reflect.deleteProperty(globalThis, 'localStorage');
+  }
+});
+
+test('runConnectScriptsSequential retries the exact stop after a transient failure', async () => {
+  const originalGet = netcattyBridge.get;
+  const storage = new Map<string, string>();
+  const stopCalls: string[] = [];
+  let stopCurrentRun: (() => Promise<void>) | null = null;
+  Object.defineProperty(globalThis, 'localStorage', {
+    configurable: true,
+    value: {
+      getItem: (key: string) => storage.get(key) ?? null,
+      setItem: (key: string, value: string) => { storage.set(key, String(value)); },
+      removeItem: (key: string) => { storage.delete(key); },
+      clear: () => { storage.clear(); },
+    },
+  });
+
+  netcattyBridge.get = () => ({
+    scriptRun: async (params) => ({ runId: params.runId!, runIds: [params.runId!] }),
+    scriptStop: async (id: string) => {
+      stopCalls.push(id);
+      return { ok: stopCalls.length > 1 };
+    },
+  }) as ReturnType<typeof netcattyBridge.get>;
+
+  const controller = new AbortController();
+  try {
+    const running = runConnectScriptsSequential({
+      scripts: [{ id: 'retry-stop', label: 'Retry stop', command: 'await nct.sleep(60)', kind: 'script' }],
+      sessionId: 'sess-retry-stop',
+      signal: controller.signal,
+      onCancelableRunChange: (stop) => { stopCurrentRun = stop; },
+    });
+    void running.catch(() => {});
+    for (let attempt = 0; attempt < 10 && !stopCurrentRun; attempt += 1) {
+      await new Promise<void>((resolve) => setImmediate(resolve));
+    }
+    controller.abort();
+    await assert.rejects(() => running, /could not be stopped/);
+    assert.equal(typeof stopCurrentRun, 'function');
+    await stopCurrentRun!();
+    assert.equal(stopCalls.length, 2);
+  } finally {
+    netcattyBridge.get = originalGet;
+    setScriptRuns([]);
+    Reflect.deleteProperty(globalThis, 'localStorage');
+  }
+});
+
+test('runConnectScriptsSequential does not treat a script error named Aborted as cancellation', async () => {
+  const originalGet = netcattyBridge.get;
+  const storage = new Map<string, string>();
+  const scriptStopCalls: string[] = [];
+  Object.defineProperty(globalThis, 'localStorage', {
+    configurable: true,
+    value: {
+      getItem: (key: string) => storage.get(key) ?? null,
+      setItem: (key: string, value: string) => { storage.set(key, String(value)); },
+      removeItem: (key: string) => { storage.delete(key); },
+      clear: () => { storage.clear(); },
+    },
+  });
+
+  netcattyBridge.get = () => ({
+    scriptRun: async (params) => {
+      setScriptRuns([{
+        runId: params.runId!,
+        scriptId: params.scriptId,
+        sessionId: params.sessionId!,
+        status: 'failed',
+        startedAt: Date.now() - 10,
+        endedAt: Date.now(),
+        error: 'Aborted',
+        logs: [],
+      }]);
+      return { runId: params.runId!, runIds: [params.runId!] };
+    },
+    scriptStop: async (id: string) => {
+      scriptStopCalls.push(id);
+      return { ok: true };
+    },
+  }) as ReturnType<typeof netcattyBridge.get>;
+
+  try {
+    await assert.rejects(
+      () => runConnectScriptsSequential({
+        scripts: [{ id: 'fails', label: 'Fails', command: "throw new Error('Aborted')", kind: 'script' }],
+        sessionId: 'sess-real-error',
+        signal: new AbortController().signal,
+      }),
+      /Aborted/,
+    );
+    assert.deepEqual(scriptStopCalls, []);
+  } finally {
+    netcattyBridge.get = originalGet;
+    setScriptRuns([]);
+    Reflect.deleteProperty(globalThis, 'localStorage');
+  }
+});

application/state/scriptAutomationCoordinator.ts

@@ -83,6 +83,8 @@ export function getActiveScriptRunForSession(sessionId: string): ScriptRun | und
 }
 
 export async function runAutomationScript(params: {
+  runId?: string;
+  returnWhenQueued?: boolean;
   snippet: Snippet;
   sessionId: string;
   sessionIds?: string[];
@@ -104,6 +106,8 @@ export async function runAutomationScript(params: {
     throw new Error('Script bridge unavailable');
   }
   return bridge.scriptRun({
+    runId: params.runId,
+    returnWhenQueued: params.returnWhenQueued,
     scriptId: params.snippet.id,
     scriptLabel: params.snippet.label,
     content: params.snippet.command,
@@ -176,6 +180,7 @@ export async function runConnectScriptsSequential(params: {
   scripts: Snippet[];
   sessionId: string;
   signal?: AbortSignal;
+  onCancelableRunChange?: (stopCurrentRun: (() => Promise<void>) | null) => void;
   onScriptStart?: (snippet: Snippet) => void;
   onScriptComplete?: (snippet: Snippet) => void;
   sessionMeta?: {
@@ -185,18 +190,63 @@ export async function runConnectScriptsSequential(params: {
     username?: string;
   };
 }): Promise<void> {
-  for (const snippet of params.scripts) {
+  const throwIfAborted = () => {
     if (params.signal?.aborted) {
-      throw new Error('Aborted');
+      throw new DOMException('Connect script run cancelled', 'AbortError');
     }
+  };
+
+  for (const snippet of params.scripts) {
+    throwIfAborted();
+    const runId = crypto.randomUUID();
+    let stopPromise: Promise<void> | undefined;
+    let stopped = false;
     params.onScriptStart?.(snippet);
-    const { runId } = await runAutomationScript({
+    const queueAccepted = runAutomationScript({
+      runId,
+      returnWhenQueued: true,
       snippet,
       sessionId: params.sessionId,
       sessionMeta: params.sessionMeta,
     });
-    await waitForScriptRun(runId, { signal: params.signal });
-    params.onScriptComplete?.(snippet);
+    const stopThisRun = () => {
+      if (stopPromise) return stopPromise;
+      const attempt = queueAccepted.then(async () => {
+        const result = await stopScriptRun(runId);
+        if (!result.ok) {
+          throw new Error(`Connect script run could not be stopped: ${runId}`);
+        }
+        stopped = true;
+      });
+      stopPromise = attempt;
+      void attempt.catch(() => {
+        if (stopPromise === attempt) stopPromise = undefined;
+      });
+      return attempt;
+    };
+    params.onCancelableRunChange?.(stopThisRun);
+    const onAbort = () => {
+      void stopThisRun().catch(() => {});
+    };
+    params.signal?.addEventListener('abort', onAbort, { once: true });
+
+    try {
+      await queueAccepted;
+      throwIfAborted();
+      await waitForScriptRun(runId, { signal: params.signal });
+      params.onScriptComplete?.(snippet);
+    } catch (err) {
+      if (params.signal?.aborted) {
+        await stopThisRun();
+        throw new DOMException('Connect script run cancelled', 'AbortError');
+      }
+      throw err;
+    } finally {
+      params.signal?.removeEventListener('abort', onAbort);
+      if (!params.signal?.aborted || stopped) {
+        params.onCancelableRunChange?.(null);
+      }
+    }
   }
 }
 

application/state/sessionFactories.test.ts

@@ -2,9 +2,9 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import type { Host } from "../../domain/models";
-import { applyGroupDefaults } from "../../domain/groupConfig";
 import { prepareSerialConfigForSavedHost } from "../../domain/serialBackspace";
 import { buildTelnetDeepLinkConnectionHost } from "../../domain/telnetDeepLink";
+import { resolveEffectiveTerminalHost } from "../../domain/terminalHostResolution";
 import {
   createHostTerminalSession,
   createSerialTerminalSession,
@@ -74,7 +74,34 @@ test("serial session factories snapshot effective legacy Backspace behavior", ()
   assert.equal(explicitDefaultSession.serialConfig?.backspaceBehavior, "default");
 });
 
-test("saved quick-connect hosts can inherit Ctrl-H after moving into a group", () => {
+test("workspace host factory creates a complete serial session", () => {
+  const session = createWorkspaceHostTerminalSession("session-serial", host({
+    protocol: "serial",
+    hostname: "COM7",
+    port: 57600,
+    username: "",
+    serialConfig: {
+      path: "COM7",
+      baudRate: 57600,
+      dataBits: 7,
+      stopBits: 2,
+      parity: "even",
+    },
+  }), "workspace-1");
+
+  assert.equal(session.workspaceId, "workspace-1");
+  assert.equal(session.protocol, "serial");
+  assert.deepEqual(session.serialConfig, {
+    path: "COM7",
+    baudRate: 57600,
+    dataBits: 7,
+    stopBits: 2,
+    parity: "even",
+    backspaceBehavior: "default",
+  });
+});
+
+test("workspace append snapshots serial Backspace behavior inherited from a group", () => {
   const savedHost = host({
     protocol: "serial",
     hostname: "COM3",
@@ -87,12 +114,15 @@ test("saved quick-connect hosts can inherit Ctrl-H after moving into a group", (
       backspaceBehavior: "default",
     }),
   });
-  const effectiveHost = applyGroupDefaults(savedHost, {
-    backspaceBehavior: "ctrl-h",
+  const effectiveHost = resolveEffectiveTerminalHost({
+    host: savedHost,
+    groupConfigs: [{ path: "network", backspaceBehavior: "ctrl-h" }],
+    proxyProfiles: [],
   });
 
-  const session = createHostTerminalSession("session-1", effectiveHost);
+  const session = createWorkspaceHostTerminalSession("session-1", effectiveHost, "workspace-1");
 
+  assert.equal(session.workspaceId, "workspace-1");
   assert.equal(session.serialConfig?.backspaceBehavior, "ctrl-h");
 });
 

application/state/settingsStorageSync.ts

@@ -568,6 +568,7 @@ export function useSettingsStorageSync({
     setShowRecentHostsState,
     setShowSftpTabState,
     setShellOnlyTabNumberShortcutsState,
+    setShowTabNumberBadgesState,
     setDisableTerminalFontZoomState,
     setRestorePreviousSessionState,
     setRestoreTerminalCwdState,

application/state/sftp/dedicatedTransferResume.ts

@@ -162,7 +162,6 @@ export async function openTransferSftpSession(
     if (
       !wantDedicated
       && options?.sourceSessionId
-      && !host.sftpSudo
       && bridge.openSftpForSession
     ) {
       try {

application/state/sftp/ensureRemoteSftpSession.test.ts

@@ -2,7 +2,7 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import type { Host } from "../../../domain/models";
-import { ensureRemoteSftpSession } from "./ensureRemoteSftpSession";
+import { ensureRemoteSftpSession, probeSftpSession } from "./ensureRemoteSftpSession";
 import type { SftpPane } from "./types";
 
 const host = {
@@ -37,6 +37,24 @@ const remotePane = (connectionId: string): SftpPane => ({
 
 const noopReleaseConnection = async () => {};
 
+test("SFTP session probe accepts a virtual root directory", async () => {
+  const calls: Array<[string, string]> = [];
+  const ok = await probeSftpSession({
+    realpathSftp: async (sftpId, remotePath) => {
+      calls.push([sftpId, remotePath]);
+      return "/";
+    },
+  }, "sftp-jumpserver");
+
+  assert.equal(ok, true);
+  assert.deepEqual(calls, [["sftp-jumpserver", "."]]);
+});
+
+test("SFTP session probe does not require home discovery", async () => {
+  const ok = await probeSftpSession(undefined, "sftp-live");
+  assert.equal(ok, true);
+});
+
 test("returns an existing mapped SFTP session without reconnecting", async () => {
   let connectCalls = 0;
   const sftpId = await ensureRemoteSftpSession({

application/state/sftp/ensureRemoteSftpSession.ts

@@ -3,6 +3,24 @@ import type { MutableRefObject } from "react";
 import { isSessionError } from "./errors";
 import type { SftpPane } from "./types";
 
+export interface SftpSessionProbeBridge {
+  realpathSftp?: (sftpId: string, path: string) => Promise<string>;
+}
+
+/**
+ * Probe the SFTP protocol itself instead of using remote home discovery.
+ * Restricted/chroot servers can deny SSH exec or expose '/' as their virtual
+ * root while the SFTP session remains fully usable.
+ */
+export async function probeSftpSession(
+  bridge: SftpSessionProbeBridge | null | undefined,
+  sftpId: string,
+): Promise<boolean> {
+  if (!bridge?.realpathSftp) return true;
+  await bridge.realpathSftp(sftpId, ".");
+  return true;
+}
+
 export interface EnsureRemoteSftpSessionParams {
   side: "left" | "right";
   getActivePane: (side: "left" | "right") => SftpPane | null;

application/state/sftp/useSftpConnections.test.ts

@@ -3,8 +3,12 @@
 
 import test from "node:test";
 import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
 
 import {
+  buildSftpConnectInFlightKey,
+  buildSftpHomeDirCandidates,
+  runSftpConnectOnceByKey,
   createSftpConnectionId,
   createPinnedReconnectSideResolver,
   openSftpConnectionOnce,
@@ -15,12 +19,62 @@ import {
   resolvePinnedReconnectSide,
 } from "./useSftpConnections.ts";
 
+test("home dir candidates prefer user home then root", () => {
+  assert.deepEqual(buildSftpHomeDirCandidates("deploy"), ["/home/deploy", "/root"]);
+  assert.deepEqual(buildSftpHomeDirCandidates("root"), ["/root"]);
+  assert.deepEqual(buildSftpHomeDirCandidates(undefined), ["/root"]);
+  assert.deepEqual(buildSftpHomeDirCandidates(null), ["/root"]);
+});
+
 test("connection ids stay unique even when connects start in the same millisecond", () => {
   const ids = ["uuid-a", "uuid-b"];
   assert.equal(createSftpConnectionId("left", () => ids.shift()!), "left-uuid-a");
   assert.equal(createSftpConnectionId("left", () => ids.shift()!), "left-uuid-b");
 });
 
+test("runSftpConnectOnceByKey shares an in-flight connect for the same tab and endpoint", async () => {
+  const inFlight = new Map<string, Promise<void>>();
+  let runs = 0;
+  let releaseFirst: (() => void) | undefined;
+
+  const first = runSftpConnectOnceByKey(inFlight, "left:tab-1:host-key:ssh-session-1:/home", async () => {
+    runs += 1;
+    await new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+  });
+  const second = runSftpConnectOnceByKey(inFlight, "left:tab-1:host-key:ssh-session-1:/home", async () => {
+    runs += 1;
+  });
+
+  assert.equal(runs, 1);
+  releaseFirst?.();
+  await Promise.all([first, second]);
+  assert.equal(runs, 1);
+  assert.equal(inFlight.size, 0);
+});
+
+test("buildSftpConnectInFlightKey uses the allocated tab id for forced new tabs", () => {
+  const first = buildSftpConnectInFlightKey({
+    side: "left",
+    tabId: "new-tab-a",
+    targetConnectionKey: "host-key",
+    sourceSessionId: "ssh-session-1",
+    initialPath: "/home",
+    forceNewTab: true,
+  });
+  const second = buildSftpConnectInFlightKey({
+    side: "left",
+    tabId: "new-tab-b",
+    targetConnectionKey: "host-key",
+    sourceSessionId: "ssh-session-1",
+    initialPath: "/home",
+    forceNewTab: true,
+  });
+
+  assert.notEqual(first, second);
+});
+
 const openOptions = {
   sessionId: "sftp-request-1",
   hostname: "192.168.9.138",
@@ -73,6 +127,43 @@ test("openSftpWithSessionPreference falls back to normal SFTP when session reuse
   assert.deepEqual(calls, ["openForSession:ssh-session-1", "openSftp:sftp-request-1"]);
 });
 
+test("openSftpWithSessionPreference tries session reuse for sudo SFTP before fresh auth", async () => {
+  const calls: string[] = [];
+  let passedOptions: NetcattySSHOptions | undefined;
+  const sftpId = await openSftpWithSessionPreference({
+    bridge: {
+      openSftpForSession: async (sessionId: string, options?: NetcattySSHOptions) => {
+        calls.push(`openForSession:${sessionId}`);
+        passedOptions = options;
+        return "sudo-session-backed-sftp";
+      },
+      openSftp: async () => {
+        calls.push("openSftp");
+        return "fresh-sftp";
+      },
+    },
+    sourceSessionId: "ssh-session-1",
+    openOptions: {
+      ...openOptions,
+      sudo: true,
+      password: "sudo-pass",
+    },
+  });
+
+  assert.equal(sftpId, "sudo-session-backed-sftp");
+  assert.deepEqual(calls, ["openForSession:ssh-session-1"]);
+  assert.equal(passedOptions?.sudo, true);
+  assert.equal(passedOptions?.password, "sudo-pass");
+});
+
+test("remote browse connect does not discard sourceSessionId for sudo hosts", () => {
+  const source = readFileSync(new URL("./useSftpConnections.ts", import.meta.url), "utf8");
+  assert.doesNotMatch(
+    source,
+    /host\.sftpSudo\s*\?\s*undefined\s*:\s*options\?\.sourceSessionId/,
+  );
+});
+
 test("openSftpWithSessionPreference opens normal SFTP without a source session", async () => {
   const calls: string[] = [];
   const sftpId = await openSftpWithSessionPreference({

application/state/sftp/useSftpConnections.ts

@@ -97,6 +97,13 @@ export async function releaseSftpConnectionMetadata(params: {
   params.onRemoteSessionClosed?.(sftpId);
 }
 
+/** Hardcoded home-path candidates when SSH exec / listable realpath fail. */
+export function buildSftpHomeDirCandidates(username?: string | null): string[] {
+  if (username === "root") return ["/root"];
+  if (username) return [`/home/${username}`, "/root"];
+  return ["/root"];
+}
+
 export function createSftpConnectionId(
   side: "left" | "right",
   randomUUID: () => string = () => crypto.randomUUID(),
@@ -176,6 +183,41 @@ export function createPinnedReconnectSideResolver(
   };
 }
 
+export function runSftpConnectOnceByKey(
+  inFlight: Map<string, Promise<void>>,
+  key: string,
+  run: () => Promise<void>,
+): Promise<void> {
+  const existing = inFlight.get(key);
+  if (existing) return existing;
+
+  const promise = run().finally(() => {
+    if (inFlight.get(key) === promise) {
+      inFlight.delete(key);
+    }
+  });
+  inFlight.set(key, promise);
+  return promise;
+}
+
+export function buildSftpConnectInFlightKey(params: {
+  side: "left" | "right";
+  tabId: string;
+  targetConnectionKey: string;
+  sourceSessionId?: string;
+  initialPath?: string;
+  forceNewTab?: boolean;
+}): string {
+  return [
+    params.side,
+    params.tabId,
+    params.targetConnectionKey,
+    params.sourceSessionId ?? "",
+    params.initialPath ?? "",
+    params.forceNewTab ? "force-new-tab" : "",
+  ].join("\u0000");
+}
+
 interface UseSftpConnectionsResult {
   connect: (side: "left" | "right", host: Host | "local", options?: SftpConnectOptions) => Promise<void>;
   disconnect: (side: "left" | "right") => Promise<void>;
@@ -249,6 +291,7 @@ export const useSftpConnections = ({
   const [hostKeyVerification, setHostKeyVerification] = useState<SftpHostKeyVerificationState | null>(null);
   const hostKeyVerificationRef = useRef<(SftpHostKeyVerificationState & { requestId: string; sessionId: string }) | null>(null);
   const activeHostKeySessionsRef = useRef<Map<string, { side: "left" | "right"; tabId: string }>>(new Map());
+  const connectInFlightRef = useRef<Map<string, Promise<void>>>(new Map());
 
   const setPendingHostKeyVerification = useCallback((
     next: (SftpHostKeyVerificationState & { requestId: string; sessionId: string }) | null,
@@ -426,21 +469,31 @@ export const useSftpConnections = ({
       // immediately, avoiding race conditions with deferred effects.
       options?.onTabCreated?.(activeTabId);
 
-      const connectionId = createSftpConnectionId(side);
+      const connectInFlightKey = buildSftpConnectInFlightKey({
+        side,
+        tabId: activeTabId,
+        targetConnectionKey,
+        sourceSessionId: host === "local" ? undefined : options?.sourceSessionId,
+        initialPath: effectiveInitialPath,
+        forceNewTab: options?.forceNewTab,
+      });
 
-      navSeqRef.current[side] += 1;
-      const connectRequestId = navSeqRef.current[side];
-      const getTargetPane = () => {
-        const targetSide = resolveTargetSide();
-        const tabs = targetSide === "left" ? leftTabsRef.current.tabs : rightTabsRef.current.tabs;
-        return tabs.find((tab) => tab.id === activeTabId) ?? null;
-      };
-      const isTargetConnectionCurrent = () => {
-        const pane = getTargetPane();
-        if (!pane) return false;
-        if (pane.connection?.id === connectionId) return true;
-        return !pane.connection && navSeqRef.current[side] === connectRequestId;
-      };
+      return runSftpConnectOnceByKey(connectInFlightRef.current, connectInFlightKey, async () => {
+        const connectionId = createSftpConnectionId(side);
+
+        navSeqRef.current[side] += 1;
+        const connectRequestId = navSeqRef.current[side];
+        const getTargetPane = () => {
+          const targetSide = resolveTargetSide();
+          const tabs = targetSide === "left" ? leftTabsRef.current.tabs : rightTabsRef.current.tabs;
+          return tabs.find((tab) => tab.id === activeTabId) ?? null;
+        };
+        const isTargetConnectionCurrent = () => {
+          const pane = getTargetPane();
+          if (!pane) return false;
+          if (pane.connection?.id === connectionId) return true;
+          return !pane.connection && navSeqRef.current[side] === connectRequestId;
+        };
       const isTargetConnectionAtPath = (path: string) => {
         const connection = getTargetPane()?.connection;
         if (!connection) return navSeqRef.current[side] === connectRequestId;
@@ -573,9 +626,7 @@ export const useSftpConnections = ({
           sharedHostCache?.path,
         );
 
-        // Sudo never reuses a terminal shell; normalize before UI state so
-        // reusedConnection (spinner/overlay) matches the actual open path.
-        const sourceSessionId = host.sftpSudo ? undefined : options?.sourceSessionId;
+        const sourceSessionId = options?.sourceSessionId;
 
         const connection: SftpConnection = {
           id: connectionId,
@@ -698,15 +749,7 @@ export const useSftpConnections = ({
             }
 
             if (!detected) {
-              const candidates: string[] = [];
-              if (credentials.username === "root") {
-                candidates.push("/root");
-              } else if (credentials.username) {
-                candidates.push(`/home/${credentials.username}`);
-                candidates.push("/root");
-              } else {
-                candidates.push("/root");
-              }
+              const candidates = buildSftpHomeDirCandidates(credentials.username);
               const statSftp = bridge?.statSftp;
               if (statSftp) {
                 for (const candidate of candidates) {
@@ -784,6 +827,23 @@ export const useSftpConnections = ({
                 // root also failed
               }
             }
+            // Last resort: home candidates. Covers provisional "/" from realpath
+            // when discovery treated root as home and listing it failed, so
+            // /home/<user> or /root can still recover the session.
+            if (!fallbackSucceeded) {
+              for (const candidate of buildSftpHomeDirCandidates(credentials.username)) {
+                if (candidate === startPath) continue;
+                try {
+                  files = await listRemoteFiles(sftpId, candidate, filenameEncoding);
+                  startPath = candidate;
+                  homeDir = candidate;
+                  fallbackSucceeded = true;
+                  break;
+                } catch {
+                  // Ignore missing/permission errors
+                }
+              }
+            }
             if (!fallbackSucceeded) {
               throw new Error("Cannot list any remote directory");
             }
@@ -855,6 +915,7 @@ export const useSftpConnections = ({
           unsubSftpProgress?.();
         }
       }
+      });
     },
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [

application/state/terminalKeyboardFocus.ts

@@ -0,0 +1,98 @@
+const TERMINAL_KEYBOARD_TARGET_SELECTOR =
+  ".xterm, .xterm-helper-textarea, .xterm-screen, .xterm-viewport";
+
+type FocusDocument = Pick<Document, "activeElement" | "addEventListener" | "removeEventListener">;
+type FocusWindow = Pick<Window, "addEventListener" | "removeEventListener">;
+
+export const isTerminalKeyboardTarget = (target: EventTarget | null): boolean => {
+  const element = target as (Element & {
+    closest?: (selector: string) => Element | null;
+  }) | null;
+  return Boolean(element?.closest?.(TERMINAL_KEYBOARD_TARGET_SELECTOR));
+};
+
+export function installTerminalKeyboardFocusTracking(
+  documentRef: FocusDocument,
+  windowRef: FocusWindow,
+  onFocusChange: (focused: boolean) => void,
+): () => void {
+  let pendingPointerTarget: EventTarget | null | undefined;
+  let pendingPointerClearTimer: ReturnType<typeof setTimeout> | undefined;
+  let isTracking = true;
+  let windowFocused = true;
+
+  const clearPendingPointerTarget = () => {
+    if (pendingPointerClearTimer !== undefined) {
+      clearTimeout(pendingPointerClearTimer);
+      pendingPointerClearTimer = undefined;
+    }
+    pendingPointerTarget = undefined;
+  };
+
+  const publishForTarget = (target: EventTarget | null) => {
+    if (!isTracking) return;
+    onFocusChange(windowFocused && isTerminalKeyboardTarget(target));
+  };
+
+  const handlePointerDown = (event: Event) => {
+    clearPendingPointerTarget();
+    pendingPointerTarget = event.target;
+    pendingPointerClearTimer = setTimeout(() => {
+      const pointerTarget = pendingPointerTarget;
+      clearPendingPointerTarget();
+      if (pointerTarget !== undefined) {
+        publishForTarget(documentRef.activeElement);
+      }
+    }, 0);
+  };
+
+  const handleFocusIn = (event: Event) => {
+    clearPendingPointerTarget();
+    publishForTarget(event.target);
+  };
+
+  const handleFocusOut = () => {
+    queueMicrotask(() => {
+      if (!isTracking) return;
+      const pointerTarget = pendingPointerTarget;
+      clearPendingPointerTarget();
+      if (!windowFocused) {
+        onFocusChange(false);
+        return;
+      }
+      if (pointerTarget !== undefined) {
+        publishForTarget(documentRef.activeElement);
+        return;
+      }
+      publishForTarget(documentRef.activeElement);
+    });
+  };
+
+  const handleWindowBlur = () => {
+    windowFocused = false;
+    clearPendingPointerTarget();
+    onFocusChange(false);
+  };
+
+  const handleWindowFocus = () => {
+    windowFocused = true;
+    publishForTarget(documentRef.activeElement);
+  };
+
+  publishForTarget(documentRef.activeElement);
+  documentRef.addEventListener("pointerdown", handlePointerDown, true);
+  documentRef.addEventListener("focusin", handleFocusIn, true);
+  documentRef.addEventListener("focusout", handleFocusOut, true);
+  windowRef.addEventListener("blur", handleWindowBlur);
+  windowRef.addEventListener("focus", handleWindowFocus);
+
+  return () => {
+    isTracking = false;
+    documentRef.removeEventListener("pointerdown", handlePointerDown, true);
+    documentRef.removeEventListener("focusin", handleFocusIn, true);
+    documentRef.removeEventListener("focusout", handleFocusOut, true);
+    windowRef.removeEventListener("blur", handleWindowBlur);
+    windowRef.removeEventListener("focus", handleWindowFocus);
+    clearPendingPointerTarget();
+  };
+}

application/state/useExternalMcpSessionSync.test.ts

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+import { createLatestPayloadSync } from './useExternalMcpSessionSync.ts';
+
+const hookSource = readFileSync(new URL('./useExternalMcpSessionSync.ts', import.meta.url), 'utf8');
+const appSource = readFileSync(new URL('../app/AppSideEffects.tsx', import.meta.url), 'utf8');
+const preloadSource = readFileSync(new URL('../../electron/preload/api.cjs', import.meta.url), 'utf8');
+const handlerSource = readFileSync(
+  new URL('../../electron/bridges/aiBridge/agentProcessHandlers.cjs', import.meta.url),
+  'utf8',
+);
+
+test('app live session sync stays mounted and is independent of External MCP enablement', () => {
+  assert.match(appSource, /useExternalMcpSessionSync\(\{/);
+  assert.match(hookSource, /bridge\.aiMcpUpdateLiveSessions\?\.\(nextPayload\)/);
+  assert.match(hookSource, /liveSyncRef\.current\.push\(payload, serialized\)/);
+  assert.match(hookSource, /bridge\.aiMcpUpdateSessions\?\.\(/);
+  assert.match(hookSource, /externalSyncRef\.current\.push\(payload, serialized\)/);
+  assert.doesNotMatch(
+    hookSource,
+    /if \(!enabled\)[\s\S]{0,300}aiMcpUpdateLiveSessions/,
+  );
+});
+
+test('live session sync has a complete renderer to main-process IPC path', () => {
+  assert.match(preloadSource, /netcatty:ai:mcp:update-live-sessions/);
+  assert.match(handlerSource, /netcatty:ai:mcp:update-live-sessions/);
+  assert.match(handlerSource, /mcpServerBridge\.updateLiveSessionMetadata/);
+});
+
+test('latest payload sync converges to A-B-A while B is in flight', async () => {
+  let releaseB: (() => void) | undefined;
+  const sent: string[] = [];
+  const sync = createLatestPayloadSync(async (payload: string) => {
+    sent.push(payload);
+    if (payload === 'B') {
+      await new Promise<void>((resolve) => {
+        releaseB = resolve;
+      });
+    }
+    return { ok: true };
+  });
+
+  await sync.push('A');
+  const sendingB = sync.push('B');
+  void sync.push('A');
+  releaseB?.();
+  await sendingB;
+
+  assert.deepEqual(sent, ['A', 'B', 'A']);
+});
+
+test('cancelling a payload sync drops a queued update', async () => {
+  let releaseA: (() => void) | undefined;
+  const sent: string[] = [];
+  const sync = createLatestPayloadSync(async (payload: string) => {
+    sent.push(payload);
+    if (payload === 'A') {
+      await new Promise<void>((resolve) => {
+        releaseA = resolve;
+      });
+    }
+    return { ok: true };
+  });
+
+  const sendingA = sync.push('A');
+  void sync.push('B');
+  sync.cancel();
+  releaseA?.();
+  await sendingA;
+
+  assert.deepEqual(sent, ['A']);
+});

application/state/useExternalMcpSessionSync.ts

@@ -17,6 +17,49 @@ type UseExternalMcpSessionSyncOptions = {
   portForwardingRules: PortForwardingRule[];
 };
 
+export function createLatestPayloadSync<T>(
+  send: (payload: T) => Promise<unknown>,
+) {
+  let desired: { serialized: string; payload: T } | null = null;
+  let acknowledged = '';
+  let inFlight: Promise<void> | null = null;
+  let cancelled = false;
+
+  const pump = async () => {
+    while (!cancelled && desired && desired.serialized !== acknowledged) {
+      const target = desired;
+      try {
+        const result = await send(target.payload);
+        if (cancelled) break;
+        if (result && typeof result === 'object' && 'ok' in result && (result as { ok?: boolean }).ok === false) {
+          if (desired === target) break;
+          continue;
+        }
+        acknowledged = target.serialized;
+      } catch {
+        if (desired === target) break;
+      }
+    }
+  };
+
+  return {
+    push(payload: T, serialized = JSON.stringify(payload)): Promise<void> {
+      if (cancelled) return Promise.resolve();
+      desired = { payload, serialized };
+      if (!inFlight) {
+        inFlight = pump().finally(() => {
+          inFlight = null;
+        });
+      }
+      return inFlight;
+    },
+    cancel(): void {
+      cancelled = true;
+      desired = null;
+    },
+  };
+}
+
 function isMainAppWindow(): boolean {
   if (typeof window === 'undefined') return false;
   const hash = window.location.hash || '';
@@ -43,7 +86,6 @@ export function useExternalMcpSessionSync({
     void enabledTick;
     return readExternalMcpStoredEnabled();
   }, [enabledTick]);
-  const syncGenerationRef = useRef(0);
 
   useEffect(() => {
     const bump = () => setEnabledTick((value) => value + 1);
@@ -77,34 +119,41 @@ export function useExternalMcpSessionSync({
     });
   }, [sessions, sessionHostsMap, hosts, portForwardingRules]);
 
-  const lastSentSerializedRef = useRef('');
+  const liveSyncRef = useRef<ReturnType<typeof createLatestPayloadSync<typeof payload>> | null>(null);
+  const externalSyncRef = useRef<ReturnType<typeof createLatestPayloadSync<typeof payload>> | null>(null);
+
+  useEffect(() => {
+    if (!isMainAppWindow()) return;
+    const bridge = netcattyBridge.get();
+    if (!bridge?.aiMcpUpdateLiveSessions) return;
+    const serialized = JSON.stringify(payload);
+    liveSyncRef.current ??= createLatestPayloadSync((nextPayload) => (
+      Promise.resolve(bridge.aiMcpUpdateLiveSessions?.(nextPayload))
+    ));
+    void liveSyncRef.current.push(payload, serialized);
+  }, [payload]);
 
   useEffect(() => {
     if (!isMainAppWindow()) return;
     if (!enabled) {
-      syncGenerationRef.current += 1;
-      lastSentSerializedRef.current = '';
+      // Recreate the synchronizer after re-enabling because disabling can
+      // clear the main-process scope even when the renderer payload is equal.
+      externalSyncRef.current?.cancel();
+      externalSyncRef.current = null;
       return;
     }
     const bridge = netcattyBridge.get();
     if (!bridge?.aiMcpUpdateSessions) return;
 
     const serialized = JSON.stringify(payload);
-    if (serialized === lastSentSerializedRef.current) return;
-
-    const generation = ++syncGenerationRef.current;
     const timeoutId = window.setTimeout(() => {
-      void Promise.resolve(bridge.aiMcpUpdateSessions?.(payload, EXTERNAL_MCP_CHAT_SESSION_ID))
-        .then((result) => {
-          if (generation !== syncGenerationRef.current) return;
-          if (result && typeof result === 'object' && 'ok' in result && (result as { ok?: boolean }).ok === false) {
-            return;
-          }
-          lastSentSerializedRef.current = serialized;
-        })
-        .catch(() => {
-          // Leave the ref unset so the next effect can retry.
-        });
+      externalSyncRef.current ??= createLatestPayloadSync((nextPayload) => (
+        Promise.resolve(bridge.aiMcpUpdateSessions?.(
+          nextPayload,
+          EXTERNAL_MCP_CHAT_SESSION_ID,
+        ))
+      ));
+      void externalSyncRef.current.push(payload, serialized);
     }, 250);
 
     return () => {

application/state/useOutputTriggers.test.ts

@@ -1,5 +1,7 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
 import {
   createDeferredOutputTriggerEventProcessor,
   createOutputTriggerScanBuffer,
@@ -7,6 +9,7 @@ import {
   findMatchEndingAfter,
   hasApplicableOutputTriggerSnippet,
   inspectDroppedOutputOverflowAlternateScreenState,
+  useOutputTriggers,
 } from './useOutputTriggers.ts';
 import { createTerminalOutputTriggerFilter } from '@/domain/terminalOutputTriggerFilter.ts';
 import type { Snippet } from '@/domain/models';
@@ -93,6 +96,80 @@ test('hasApplicableOutputTriggerSnippet requires a runnable output trigger for t
   assert.equal(hasApplicableOutputTriggerSnippet(snippets, 'host-a'), true);
 });
 
+test('hasApplicableOutputTriggerSnippet follows the host current group', () => {
+  const snippets: Snippet[] = [{
+    id: 'group-trigger',
+    label: 'Group trigger',
+    command: '',
+    kind: 'script',
+    trigger: 'onOutput',
+    triggerPattern: 'READY',
+    targetGroups: ['Production'],
+  }];
+  assert.equal(
+    hasApplicableOutputTriggerSnippet(snippets, { id: 'host-a', group: 'Production/Web' }),
+    true,
+  );
+  assert.equal(
+    hasApplicableOutputTriggerSnippet(snippets, { id: 'host-a', group: 'Staging' }),
+    false,
+  );
+});
+
+test('equivalent host objects do not reset a pending output trigger match', async () => {
+  const actEnvironment = globalThis as typeof globalThis & {
+    IS_REACT_ACT_ENVIRONMENT?: boolean;
+  };
+  const previousActEnvironment = actEnvironment.IS_REACT_ACT_ENVIRONMENT;
+  actEnvironment.IS_REACT_ACT_ENVIRONMENT = true;
+  const snippets: Snippet[] = [{
+    id: 'stable-host-trigger',
+    label: 'Stable host trigger',
+    command: '',
+    kind: 'script',
+    trigger: 'onOutput',
+    triggerPattern: 'READY',
+    targetGroups: ['Production'],
+  }];
+  let appendOutput: ((chunk: string) => void) | undefined;
+  let runCount = 0;
+  let renderer: ReactTestRenderer | null = null;
+  const onRunScript = () => {
+    runCount += 1;
+  };
+
+  const Probe = ({ host }: { host: { id: string; group: string } }) => {
+    appendOutput = useOutputTriggers({
+      sessionId: 'session-1',
+      host,
+      snippets,
+      onRunScript,
+    }).appendOutput;
+    return null;
+  };
+
+  await act(async () => {
+    renderer = create(React.createElement(Probe, {
+      host: { id: 'host-a', group: 'Production/Web' },
+    }));
+  });
+  try {
+    await act(async () => {
+      appendOutput?.('REA');
+      renderer?.update(React.createElement(Probe, {
+        host: { id: 'host-a', group: 'Production/Web' },
+      }));
+      appendOutput?.('DY');
+      await new Promise((resolve) => setTimeout(resolve, 40));
+    });
+  } finally {
+    await act(async () => renderer?.unmount());
+    actEnvironment.IS_REACT_ACT_ENVIRONMENT = previousActEnvironment;
+  }
+
+  assert.equal(runCount, 1);
+});
+
 test('output trigger scan buffer consumes scanned content and only keeps overlap', () => {
   const buffer = createOutputTriggerScanBuffer(4);
 

application/state/useOutputTriggers.ts

@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useMemo, useRef } from 'react';
-import type { Snippet } from '@/domain/models';
+import type { Host, Snippet } from '@/domain/models';
 import { snippetAppliesToOutputTrigger } from '@/domain/snippetTargets.ts';
 import { isScriptSnippet } from '@/domain/snippetScript.ts';
 import {
@@ -19,7 +19,7 @@ const OUTPUT_TRIGGER_DROPPED_OVERFLOW_SCAN_WINDOW_CHARS = 2048;
 
 type OutputTriggerContext = {
   sessionId: string;
-  hostId?: string;
+  host?: Pick<Host, 'id' | 'group'>;
   snippets: Snippet[];
   onRunScript: (snippet: Snippet, sessionId: string) => void | Promise<void>;
 };
@@ -575,22 +575,31 @@ export function findMatchEndingAfter(text: string, pattern: string, minEndOffset
   return null;
 }
 
-export function hasApplicableOutputTriggerSnippet(snippets: Snippet[], hostId?: string): boolean {
+export function hasApplicableOutputTriggerSnippet(
+  snippets: Snippet[],
+  host?: Pick<Host, 'id' | 'group'> | string,
+): boolean {
   return snippets.some((snippet) => (
     isScriptSnippet(snippet)
     && snippet.trigger === 'onOutput'
     && Boolean(snippet.triggerPattern)
     && Boolean(snippet.id)
-    && snippetAppliesToOutputTrigger(snippet, hostId)
+    && snippetAppliesToOutputTrigger(snippet, host)
   ));
 }
 
 export function useOutputTriggers({
   sessionId,
-  hostId,
+  host,
   snippets,
   onRunScript,
 }: OutputTriggerContext) {
+  const targetHostId = host?.id;
+  const targetHostGroup = host?.group;
+  const targetHost = useMemo(
+    () => targetHostId ? { id: targetHostId, group: targetHostGroup } : undefined,
+    [targetHostGroup, targetHostId],
+  );
   const launchingRef = useRef(false);
   const lastTriggerMatchEndRef = useRef(new Map<string, number>());
   const serverOutputFilterRef = useRef(createTerminalOutputTriggerFilter());
@@ -600,8 +609,8 @@ export function useOutputTriggers({
   const pendingDroppedOverflowFinalActionRef = useRef<'leave' | null>(null);
   const pendingDroppedOverflowScanStateResetRef = useRef(false);
   const hasOutputTriggers = useMemo(
-    () => hasApplicableOutputTriggerSnippet(snippets, hostId),
-    [hostId, snippets],
+    () => hasApplicableOutputTriggerSnippet(snippets, targetHost),
+    [snippets, targetHost],
   );
 
   const scanOutput = useCallback((scannableText: string) => {
@@ -621,7 +630,7 @@ export function useOutputTriggers({
       if (!isScriptSnippet(snippet) || snippet.trigger !== 'onOutput' || !snippet.triggerPattern || !snippet.id) {
         continue;
       }
-      if (!snippetAppliesToOutputTrigger(snippet, hostId)) continue;
+      if (!snippetAppliesToOutputTrigger(snippet, targetHost)) continue;
       try {
         const matched = findMatchEndingAfter(scanWindow.text, snippet.triggerPattern, scanWindow.minEndOffset);
         if (!matched) {
@@ -647,7 +656,7 @@ export function useOutputTriggers({
         // ignore invalid regex
       }
     }
-  }, [hasOutputTriggers, hostId, onRunScript, sessionId, snippets]);
+  }, [hasOutputTriggers, onRunScript, sessionId, snippets, targetHost]);
 
   const scanOutputRef = useRef(scanOutput);
   scanOutputRef.current = scanOutput;
@@ -813,7 +822,7 @@ export function useOutputTriggers({
     outputTriggerScanSuppressedRef.current = false;
     pendingDroppedOverflowFinalActionRef.current = null;
     pendingDroppedOverflowScanStateResetRef.current = false;
-  }, [sessionId, hostId, hasOutputTriggers, outputTriggerEventProcessor]);
+  }, [sessionId, targetHost, hasOutputTriggers, outputTriggerEventProcessor]);
 
   useEffect(() => () => {
     outputTriggerEventProcessor.reset();

application/state/useSessionState.ts

@@ -797,11 +797,6 @@ export const useSessionState = ({
     host: Host,
     direction: SplitDirection = 'vertical',
   ): string | null => {
-    // Serial hosts use a different session constructor; they currently
-    // only enter workspaces via createSerialSession + drag, so reject
-    // them here to avoid a partially-constructed session.
-    if (host.protocol === 'serial') return null;
-
     // Cheap early-exit using the ref when the workspace is clearly
     // absent. The authoritative check lives inside the setWorkspaces
     // updater below so we also cover the concurrent-close race.

application/state/useSessionStateWorkspaceStrictMode.test.ts

@@ -105,4 +105,8 @@ test('workspace host creation paths use the host session snapshot factory', () =
     source,
     /createWorkspaceHostTerminalSession\(newSessionId,\s*host,\s*workspaceId\)/,
   );
+  assert.doesNotMatch(
+    source,
+    /if \(host\.protocol === 'serial'\) return null/,
+  );
 });

application/state/useSftpState.ts

@@ -30,7 +30,7 @@ import { buildSftpHostCredentials } from "./sftp/useSftpHostCredentials";
 import { useSftpFileWatch } from "./sftp/useSftpFileWatch";
 import { useSftpSessionCleanup } from "./sftp/useSftpSessionCleanup";
 import { useSftpSessionErrors } from "./sftp/useSftpSessionErrors";
-import { ensureRemoteSftpSession } from "./sftp/ensureRemoteSftpSession";
+import { ensureRemoteSftpSession, probeSftpSession } from "./sftp/ensureRemoteSftpSession";
 import { openTransferSftpSession } from "./sftp/dedicatedTransferResume";
 import {
   createTransferPoolKeyCache,
@@ -316,9 +316,7 @@ export const useSftpState = (
       // Prefer borrowing the live (or parked) terminal SSH transport so MFA is
       // not repeated. Transport leases keep the shared conn alive after the
       // terminal tab closes until the transfer SFTP lease is returned.
-      const sourceSessionId = !host.sftpSudo
-        ? resolveTransferSourceSessionId?.(host.id, host)
-        : undefined;
+      const sourceSessionId = resolveTransferSourceSessionId?.(host.id, host);
       if (sourceSessionId) {
         try {
           logger.info(
@@ -608,16 +606,7 @@ export const useSftpState = (
         forceReconnect: ensureOptions?.forceReconnect,
         releaseConnection,
         tabId,
-        probeSession: async (sftpId) => {
-          // Lightweight liveness check; any session-error from the bridge
-          // triggers a reconnect in ensureRemoteSftpSession.
-          if (!bridge?.getSftpHomeDir) return true;
-          const result = await bridge.getSftpHomeDir(sftpId);
-          if (result && result.success === false) {
-            throw new Error(result.error || "SFTP session not found");
-          }
-          return true;
-        },
+        probeSession: (sftpId) => probeSftpSession(bridge, sftpId),
       });
     },
     resolveConnectedHost: (tabId) => connectedHostByTabIdRef.current.get(tabId) ?? null,
@@ -704,6 +693,12 @@ export const useSftpState = (
         const pane = getActivePane(side);
         if (!pane?.connection || pane.connection.isLocal) continue;
         if (sftpSessionsRef.current.has(pane.connection.id)) continue;
+        const connectedHost = connectedHostByTabIdRef.current.get(pane.id) ?? null;
+        const vaultHost = hosts.find((host) => host.id === pane.connection?.hostId) ?? null;
+        const targetHost = connectedHost && connectedHost !== "local" ? connectedHost : vaultHost;
+        const resolvedSourceSessionId = targetHost
+          ? resolveBrowseSourceSessionId?.(targetHost.id, targetHost)
+          : undefined;
         try {
           await ensureRemoteSftpSession({
             side,
@@ -713,16 +708,10 @@ export const useSftpState = (
             connect,
             resolveConnectedHost: (id) => connectedHostByTabIdRef.current.get(id) ?? null,
             resolveHostById: (hostId) => hosts.find((host) => host.id === hostId) ?? null,
-            resolveSourceSessionId: resolveBrowseSourceSessionId,
-            probeSession: async (sftpId) => {
-              const bridge = netcattyBridge.get();
-              if (!bridge?.getSftpHomeDir) return true;
-              const result = await bridge.getSftpHomeDir(sftpId);
-              if (result && result.success === false) {
-                throw new Error(result.error || "SFTP session not found");
-              }
-              return true;
-            },
+            resolveSourceSessionId: resolvedSourceSessionId
+              ? () => resolvedSourceSessionId
+              : resolveBrowseSourceSessionId,
+            probeSession: (sftpId) => probeSftpSession(netcattyBridge.get(), sftpId),
             releaseConnection,
           });
           logger.info(`[SFTP] Restored browse session on ${side}`);

application/state/useTerminalKeyboardFocus.test.ts

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  installTerminalKeyboardFocusTracking,
+  isTerminalKeyboardTarget,
+} from "./terminalKeyboardFocus";
+
+const targetWithClosest = (matches: boolean) => ({
+  closest: (selector: string) => {
+    assert.match(selector, /\.xterm/);
+    return matches ? {} : null;
+  },
+}) as unknown as EventTarget;
+
+test("terminal keyboard target detection recognizes xterm descendants", () => {
+  assert.equal(isTerminalKeyboardTarget(targetWithClosest(true)), true);
+  assert.equal(isTerminalKeyboardTarget(targetWithClosest(false)), false);
+  assert.equal(isTerminalKeyboardTarget(null), false);
+});
+
+test("terminal keyboard focus tracking publishes deduplicated focus transitions and cleans up", async () => {
+  const listeners = new Map<string, (event?: Event) => void>();
+  const removed: string[] = [];
+  const body = targetWithClosest(false);
+  const terminal = targetWithClosest(true);
+  const documentRef = {
+    activeElement: body as unknown as Element,
+    addEventListener: (type: string, listener: (event?: Event) => void) => {
+      listeners.set(type, listener);
+    },
+    removeEventListener: (type: string) => {
+      removed.push(type);
+    },
+  } as unknown as Document;
+  const windowRef = {
+    addEventListener: (type: string, listener: (event?: Event) => void) => {
+      listeners.set(`window:${type}`, listener);
+    },
+    removeEventListener: (type: string) => {
+      removed.push(`window:${type}`);
+    },
+  } as unknown as Window;
+  const changes: boolean[] = [];
+  const cleanup = installTerminalKeyboardFocusTracking(documentRef, windowRef, (focused) => {
+    if (changes.at(-1) !== focused) changes.push(focused);
+  });
+
+  assert.deepEqual(changes, [false]);
+
+  listeners.get("pointerdown")?.({ target: terminal } as unknown as Event);
+  listeners.get("focusin")?.({ target: terminal } as unknown as Event);
+  assert.deepEqual(changes, [false, true]);
+
+  (documentRef as unknown as { activeElement: Element }).activeElement = terminal as unknown as Element;
+  listeners.get("pointerdown")?.({ target: body } as unknown as Event);
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  assert.deepEqual(changes, [false, true]);
+
+  (documentRef as unknown as { activeElement: Element }).activeElement = body as unknown as Element;
+  listeners.get("focusout")?.();
+  await Promise.resolve();
+  assert.deepEqual(changes, [false, true, false]);
+
+  listeners.get("window:blur")?.();
+  assert.deepEqual(changes, [false, true, false]);
+
+  (documentRef as unknown as { activeElement: Element }).activeElement = terminal as unknown as Element;
+  listeners.get("window:focus")?.();
+  assert.deepEqual(changes, [false, true, false, true]);
+
+  cleanup();
+  assert.deepEqual(removed.sort(), ["focusin", "focusout", "pointerdown", "window:blur", "window:focus"]);
+});

application/state/useTerminalKeyboardFocus.ts

@@ -0,0 +1,33 @@
+import { useEffect } from "react";
+import { netcattyBridge } from "../../infrastructure/services/netcattyBridge";
+import { installTerminalKeyboardFocusTracking } from "./terminalKeyboardFocus";
+
+export function useTerminalKeyboardFocus(enabled = true): void {
+  useEffect(() => {
+    if (!enabled) return undefined;
+    const bridge = netcattyBridge.get();
+    if (!bridge?.setTerminalKeyboardFocus) return undefined;
+
+    let lastPublished: boolean | undefined;
+    const publish = (focused: boolean) => {
+      if (focused === lastPublished) return;
+      lastPublished = focused;
+      try {
+        bridge.setTerminalKeyboardFocus?.(focused);
+      } catch {
+        // Browser preview or a disposed Electron bridge.
+      }
+    };
+
+    const cleanupTracking = installTerminalKeyboardFocusTracking(
+      document,
+      window,
+      publish,
+    );
+
+    return () => {
+      cleanupTracking();
+      publish(false);
+    };
+  }, [enabled]);
+}

application/state/useVaultAgentBridge.test.ts

@@ -5,6 +5,7 @@ import {
   resolveVaultAgentEffectiveHost,
   resolveVaultAgentNotes,
 } from './useVaultAgentBridge';
+import type { Host } from '../../domain/models';
 import { publishNotesSnapshot } from './notesStore';
 
 type Snapshot = Parameters<typeof haveSameVaultAgentSnapshot>[0];
@@ -28,10 +29,10 @@ describe('haveSameVaultAgentSnapshot', () => {
 
 describe('resolveVaultAgentEffectiveHost', () => {
   it('uses the latest snapshotted group defaults', () => {
-    const host = {
+    const host: Host = {
       id: 'host-1', label: 'Host', hostname: 'host.test', username: 'root',
       group: 'production', tags: [], os: 'linux',
-    } as const;
+    };
 
     assert.equal(
       resolveVaultAgentEffectiveHost(host, [{ path: 'production', protocol: 'telnet' }], []).protocol,

application/state/useVaultAgentBridge.ts

@@ -16,6 +16,10 @@ import {
   resolveDefaultKeyPassphraseAliases,
 } from '../defaultKeyPassphrases';
 import { getNotesActions, getNotesSnapshot, subscribeNotes } from './notesStore';
+import type {
+  VaultGroupMutationResult,
+  VaultGroupMutationState,
+} from '../../domain/vaultGroupMutation';
 
 export interface UseVaultAgentBridgeInput {
   hosts: Host[];
@@ -29,12 +33,17 @@ export interface UseVaultAgentBridgeInput {
   terminalSettings?: Pick<TerminalSettings, 'keepaliveInterval' | 'keepaliveCountMax'>;
   updateHosts: (hosts: Host[]) => void;
   updateKeys: (keys: SSHKey[]) => Promise<unknown> | unknown;
-  updateSnippets: (snippets: Snippet[]) => void;
+  updateSnippets: (
+    snippets: Snippet[] | ((current: Snippet[]) => Snippet[]),
+  ) => void;
   customGroups: string[];
   updateCustomGroups: (groups: string[]) => void;
   groupConfigs: GroupConfig[];
   updateGroupConfigs: (configs: GroupConfig[]) => void;
   updateManagedSources: (sources: ManagedSource[]) => void;
+  commitVaultGroupMutation: (
+    mutate: (current: VaultGroupMutationState) => VaultGroupMutationResult,
+  ) => Promise<VaultGroupMutationResult | { ok: false; superseded: true }>;
   updatePortForwardingRules: (rules: PortForwardingRule[]) => void;
   /** Optional override; defaults to notesStore so App need not subscribe to notes. */
   notes?: VaultNote[];
@@ -185,6 +194,17 @@ export function useVaultAgentBridge(input: UseVaultAgentBridgeInput): void {
           vaultSnapshotRef.current.hosts = hosts;
           current.updateHosts(hosts);
         },
+        commitVaultGroupMutation: async (mutate) => {
+          const result = await current.commitVaultGroupMutation(mutate);
+          if (result.ok) {
+            vaultSnapshotRef.current.customGroups = result.state.groups;
+            vaultSnapshotRef.current.groupConfigs = result.state.configs;
+            vaultSnapshotRef.current.hosts = result.state.hosts;
+            vaultSnapshotRef.current.managedSources = result.state.managedSources;
+            vaultSnapshotRef.current.snippets = result.state.snippets;
+          }
+          return result;
+        },
         saveKeyPassphrase: (keyPath, passphrase) => rememberKeyPassphrase({
           keyPath,
           passphrase,
@@ -222,9 +242,11 @@ export function useVaultAgentBridge(input: UseVaultAgentBridgeInput): void {
           vaultSnapshotRef.current.notes = notes;
           applyUpdateNotes(notes);
         },
-        updateSnippets: (nextSnippets) => {
-          vaultSnapshotRef.current.snippets = nextSnippets;
-          current.updateSnippets(nextSnippets);
+        updateSnippets: (snippetUpdate) => {
+          vaultSnapshotRef.current.snippets = typeof snippetUpdate === 'function'
+            ? snippetUpdate(vaultSnapshotRef.current.snippets)
+            : snippetUpdate;
+          current.updateSnippets(snippetUpdate);
         },
         startTunnel: current.startTunnel,
         stopTunnel: current.stopTunnel,

application/state/useVaultGroupDeletion.test.tsx

@@ -31,19 +31,16 @@ test("group deletion removes saved settings in the same Vault transaction", asyn
       managedSources: storedSources,
       onReadPersistedHosts: async () => [],
       onReadPersistedManagedSources: () => storedSources,
-      onCommitVaultImportTransaction: async (
-        _hosts,
-        updateGroups,
-        updateSources,
-        updateGroupConfigs,
-      ) => {
-        committedGroupConfigs = updateGroupConfigs?.(storedGroupConfigs) ?? storedGroupConfigs;
-        return {
-          status: "persisted",
-          groups: updateGroups(storedGroups),
-          sources: updateSources(storedSources),
-          groupConfigs: committedGroupConfigs,
-        };
+      onCommitVaultGroupMutation: async (mutate) => {
+        const result = mutate({
+          groups: storedGroups,
+          configs: storedGroupConfigs,
+          hosts: [],
+          managedSources: storedSources,
+          snippets: [],
+        });
+        if (result.ok) committedGroupConfigs = result.state.configs;
+        return result;
       },
     });
     return null;
@@ -102,14 +99,9 @@ test("group deletion restores managed files when the persisted Vault cannot be r
       onClearAndRemoveManagedSources: async () => async () => {
         restoreCount += 1;
       },
-      onCommitVaultImportTransaction: async () => {
+      onCommitVaultGroupMutation: async () => {
         commitCount += 1;
-        return {
-          status: "persisted",
-          groups: [],
-          sources: [],
-          groupConfigs: [],
-        };
+        throw new Error("unexpected commit");
       },
     });
     return null;
@@ -187,21 +179,15 @@ test("group deletion retries file clearing when another managed source enters th
           restoreCount += 1;
         };
       },
-      onCommitVaultImportTransaction: async (
-        _hosts,
-        updateGroups,
-        updateSources,
-        updateGroupConfigs,
-        expectedHosts,
-      ) => {
+      onCommitVaultGroupMutation: async (mutate) => {
         commitCount += 1;
-        assert.deepEqual(expectedHosts, []);
-        return {
-          status: "persisted",
-          groups: updateGroups(["Production"]),
-          sources: updateSources([firstSource, concurrentSource]),
-          groupConfigs: updateGroupConfigs?.([]) ?? [],
-        };
+        return mutate({
+          groups: ["Production"],
+          configs: [],
+          hosts: [],
+          managedSources: [firstSource, concurrentSource],
+          snippets: [],
+        });
       },
     });
     return null;
@@ -228,3 +214,67 @@ test("group deletion retries file clearing when another managed source enters th
   assert.equal(restoreCount, 1);
   assert.equal(commitCount, 1);
 });
+
+test("group deletion restores managed files and does not report success when commit fails", async () => {
+  const actEnvironment = globalThis as typeof globalThis & {
+    IS_REACT_ACT_ENVIRONMENT?: boolean;
+  };
+  const previousActEnvironment = actEnvironment.IS_REACT_ACT_ENVIRONMENT;
+  actEnvironment.IS_REACT_ACT_ENVIRONMENT = true;
+
+  const source: ManagedSource = {
+    id: "managed-production",
+    type: "ssh_config",
+    filePath: "/tmp/managed-production.conf",
+    groupName: "Production",
+    lastSyncedAt: 1,
+  };
+  let deleteGroups: ((paths: Iterable<string>) => Promise<void>) | undefined;
+  let renderer: ReactTestRenderer | null = null;
+  let restoreCount = 0;
+  let reportedCount = 0;
+
+  const Probe = () => {
+    deleteGroups = useVaultGroupDeletion({
+      customGroups: ["Production"],
+      hosts: [],
+      groupConfigs: [],
+      managedSources: [source],
+      onReadPersistedHosts: async () => [],
+      onReadPersistedManagedSources: () => [source],
+      onClearAndRemoveManagedSources: async () => async () => {
+        restoreCount += 1;
+      },
+      onCommitVaultGroupMutation: async () => {
+        throw new Error("Vault quota exhausted");
+      },
+      onDeletedPaths: () => {
+        reportedCount += 1;
+      },
+    });
+    return null;
+  };
+
+  let deletionError: unknown;
+  try {
+    await act(async () => {
+      renderer = create(React.createElement(Probe));
+    });
+    try {
+      await act(async () => {
+        await deleteGroups?.(["Production"]);
+      });
+    } catch (error) {
+      deletionError = error;
+    }
+  } finally {
+    await act(async () => {
+      renderer?.unmount();
+    });
+    actEnvironment.IS_REACT_ACT_ENVIRONMENT = previousActEnvironment;
+  }
+
+  assert.match(String(deletionError), /quota exhausted/i);
+  assert.equal(restoreCount, 1);
+  assert.equal(reportedCount, 0);
+});

application/state/useVaultGroupDeletion.ts

@@ -1,7 +1,12 @@
 import { useCallback, useRef } from "react";
 
 import type { GroupConfig, Host, ManagedSource } from "../../domain/models";
+import { removeSnippetTargetGroupPaths } from "../../domain/hostGroupPathMutations";
 import { buildVaultGroupDeletion } from "../../domain/vaultGroupDeletion";
+import type {
+  VaultGroupMutationResult,
+  VaultGroupMutationState,
+} from "../../domain/vaultGroupMutation";
 import {
   type VaultLockHandle,
   withVaultImportLock,
@@ -26,7 +31,7 @@ export function useVaultGroupDeletion({
   managedSources,
   onReadPersistedHosts,
   onReadPersistedManagedSources,
-  onCommitVaultImportTransaction,
+  onCommitVaultGroupMutation,
   onClearAndRemoveManagedSource,
   onClearAndRemoveManagedSources,
   onDeletedPaths,
@@ -37,22 +42,10 @@ export function useVaultGroupDeletion({
   managedSources: ManagedSource[];
   onReadPersistedHosts: () => Promise<Host[]>;
   onReadPersistedManagedSources: () => ManagedSource[];
-  onCommitVaultImportTransaction: (
-    hosts: Host[],
-    updateGroups: (current: string[]) => string[],
-    updateSources: (current: ManagedSource[]) => ManagedSource[],
-    updateGroupConfigs?: (current: GroupConfig[]) => GroupConfig[],
-    expectedHosts?: Host[],
+  onCommitVaultGroupMutation: (
+    mutate: (current: VaultGroupMutationState) => VaultGroupMutationResult,
     lock?: VaultLockHandle | null,
-  ) => Promise<
-    | {
-      status: "persisted";
-      groups: string[];
-      sources: ManagedSource[];
-      groupConfigs: GroupConfig[];
-    }
-    | { status: "superseded" }
-  >;
+  ) => Promise<VaultGroupMutationResult | { ok: false; superseded: true }>;
   onClearAndRemoveManagedSource?: (source: ManagedSource) => Promise<() => Promise<void>>;
   onClearAndRemoveManagedSources?: (sources: ManagedSource[]) => Promise<() => Promise<void>>;
   onDeletedPaths?: (selectedRoots: string[]) => void;
@@ -120,29 +113,16 @@ export function useVaultGroupDeletion({
           }
           deletion = refreshedDeletion;
 
-          const expectedHosts = latestRef.current.hosts;
           const expectedSources = deletion.sourcesToRemove;
-          const nextHosts = deletion.hosts.filter(
-            (host) => !additionallyDeletedHostIds.has(host.id),
-          );
-          const transaction = await onCommitVaultImportTransaction(
-            nextHosts,
-            (currentGroups) => buildVaultGroupDeletion({
-              selectedPaths,
-              deleteHosts,
-              customGroups: currentGroups,
-              hosts: [],
-              groupConfigs: [],
-              managedSources: [],
-            }).customGroups,
-            (currentSources) => {
+          const transaction = await onCommitVaultGroupMutation(
+            (current) => {
               const currentDeletion = buildVaultGroupDeletion({
                 selectedPaths,
                 deleteHosts,
-                customGroups: [],
-                hosts: [],
-                groupConfigs: [],
-                managedSources: currentSources,
+                customGroups: current.groups,
+                hosts: current.hosts,
+                groupConfigs: current.configs,
+                managedSources: current.managedSources,
               });
               if (!managedSourceSnapshotsMatch(
                 expectedSources,
@@ -150,29 +130,40 @@ export function useVaultGroupDeletion({
               )) {
                 throw RETRY_VAULT_GROUP_DELETION;
               }
-              const removedIds = new Set(expectedSources.map((source) => source.id));
-              return currentSources.filter((source) => !removedIds.has(source.id));
+              return {
+                ok: true,
+                state: {
+                  groups: currentDeletion.customGroups,
+                  hosts: currentDeletion.hosts.filter(
+                    (host) => !additionallyDeletedHostIds.has(host.id),
+                  ),
+                  configs: currentDeletion.groupConfigs,
+                  managedSources: current.managedSources.filter(
+                    (source) => !currentDeletion.sourcesToRemove.some(
+                      (removed) => removed.id === source.id,
+                    ),
+                  ),
+                  snippets: removeSnippetTargetGroupPaths(
+                    current.snippets,
+                    currentDeletion.selectedRoots,
+                  ),
+                },
+              };
             },
-            (currentGroupConfigs) => buildVaultGroupDeletion({
-              selectedPaths,
-              deleteHosts,
-              customGroups: [],
-              hosts: [],
-              groupConfigs: currentGroupConfigs,
-              managedSources: [],
-            }).groupConfigs,
-            expectedHosts,
             lock,
           );
-          if (transaction.status === "superseded") {
-            // Release the lock so concurrent host saves can finish before retry.
+          if (!transaction.ok && "superseded" in transaction) {
+            // Release the lock so concurrent saves can finish before retry.
             return { status: "retry" as const, restoreManagedFiles };
           }
+          if ("error" in transaction) {
+            throw new Error(transaction.error);
+          }
           latestRef.current = {
-            customGroups: transaction.groups,
-            hosts: nextHosts,
-            groupConfigs: transaction.groupConfigs,
-            managedSources: transaction.sources,
+            customGroups: transaction.state.groups,
+            hosts: transaction.state.hosts,
+            groupConfigs: transaction.state.configs,
+            managedSources: transaction.state.managedSources,
           };
           return {
             status: "done" as const,
@@ -205,7 +196,7 @@ export function useVaultGroupDeletion({
   }, [
     onClearAndRemoveManagedSource,
     onClearAndRemoveManagedSources,
-    onCommitVaultImportTransaction,
+    onCommitVaultGroupMutation,
     onDeletedPaths,
     onReadPersistedHosts,
     onReadPersistedManagedSources,

application/state/useVaultState.snippetsDelete.test.ts

@@ -66,7 +66,7 @@ test("updateSnippets disk writes take the shared vault lock", () => {
   // and be visible to waitForPendingVaultWrites.
   assert.match(
     source,
-    /const updateSnippets = useCallback\(\(\s*data: Snippet\[\],\s*options\?: \{ replace\?: boolean \},\s*\) => \{[\s\S]*withVaultImportLock\("vault", async \(\) => \{[\s\S]*localStorageAdapter\.write\(STORAGE_KEY_SNIPPETS, rebased\)/,
+    /const updateSnippets = useCallback\(\([\s\S]*withVaultImportLock\("vault", async \(\) => \{[\s\S]*localStorageAdapter\.write\(STORAGE_KEY_SNIPPETS, rebased\)/,
   );
   assert.match(
     source,
@@ -95,6 +95,24 @@ test("updateSnippets rebases onto the latest persisted snapshot under the lock",
   );
 });
 
+test("updateSnippets functional updates derive from the latest in-memory snapshot", () => {
+  // Group deletion can wait for managed-source cleanup. A script created while
+  // it waits must still be present when the deletion callback removes the old
+  // group path, so updater callbacks must not derive from the initiating render.
+  assert.match(
+    source,
+    /data: Snippet\[\] \| \(\(current: Snippet\[\]\) => Snippet\[\]\)/,
+  );
+  assert.match(
+    source,
+    /const updater = typeof data === "function" \? data : null;[\s\S]*const current = snippetsRef\.current;[\s\S]*typeof data === "function" \? data\(current\) : data/,
+  );
+  assert.match(
+    source,
+    /updater\(rebaseSnippetVaultWrite\(\{\s*base,\s*ours: current,\s*theirs: latestPersisted,\s*\}\)\)/,
+  );
+});
+
 test("clearVaultData replaces snippets without additive rebase", () => {
   // Clear All Local Data must not preserve concurrent disk-only snippet adds
   // that rebaseSnippetVaultWrite would otherwise keep.
@@ -108,7 +126,7 @@ test("clearVaultData replaces snippets without additive rebase", () => {
   );
   assert.match(
     source,
-    /replace\s*\?\s*cleaned\s*:\s*rebaseSnippetVaultWrite/,
+    /replace\s*\?\s*cleaned\s*:\s*updater\s*\?\s*updater\(rebaseSnippetVaultWrite/,
   );
   assert.match(
     source,
@@ -145,7 +163,7 @@ test("updateSnippets keeps the persisted rebase ancestor across superseded saves
   );
   assert.match(
     source,
-    /const base = snippetsWriteBaseRef\.current \?\? snippetsRef\.current/,
+    /const current = snippetsRef\.current;\s*const base = snippetsWriteBaseRef\.current \?\? current/,
   );
   assert.match(
     source,

application/state/useVaultState.ts

@@ -106,10 +106,15 @@ import {
   persistVaultImportMetadata,
   readStoredArray,
 } from "./vaultImportPersistence";
+import type {
+  VaultGroupMutationResult,
+  VaultGroupMutationState,
+} from "../../domain/vaultGroupMutation";
 import {
   commitPluginImporterTransaction,
   recoverPluginImporterTransaction,
 } from "./pluginImporterTransaction";
+import { commitVaultGroupMutationPersistence } from "./vaultGroupMutationPersistence";
 
 type ExportableVaultData = {
   hosts: Host[];
@@ -296,6 +301,7 @@ export const useVaultState = () => {
   const managedSourcesRef = useRef<ManagedSource[]>([]);
   const hostsRef = useRef<Host[]>([]);
   const snippetsRef = useRef<Snippet[]>([]);
+  const groupConfigsRef = useRef<GroupConfig[]>([]);
   const notesRef = useRef<VaultNote[]>([]);
   const noteGroupsRef = useRef<string[]>([]);
   const notesPersistFailureNotifiedAtRef = useRef(0);
@@ -303,6 +309,7 @@ export const useVaultState = () => {
   managedSourcesRef.current = managedSources;
   hostsRef.current = hosts;
   snippetsRef.current = snippets;
+  groupConfigsRef.current = groupConfigs;
   notesRef.current = notes;
   noteGroupsRef.current = noteGroups;
 
@@ -314,6 +321,7 @@ export const useVaultState = () => {
   const identitiesWriteVersion = useRef(0);
   const proxyProfilesWriteVersion = useRef(0);
   const snippetsWriteVersion = useRef(0);
+  const managedSourcesWriteVersion = useRef(0);
   // Tracks the latest local updateSnippets schedule. Storage events also bump
   // snippetsWriteVersion (to invalidate naive writers), so queued saves must
   // key supersede checks off this owner instead of that shared counter.
@@ -340,6 +348,7 @@ export const useVaultState = () => {
   const identitiesWritePendingRef = useRef<Promise<unknown>>(Promise.resolve());
   const groupConfigsWritePendingRef = useRef<Promise<unknown>>(Promise.resolve());
   const snippetsWritePendingRef = useRef<Promise<unknown>>(Promise.resolve());
+  const managedSourcesWritePendingRef = useRef<Promise<unknown>>(Promise.resolve());
 
   const waitForPendingVaultWrites = useCallback(async () => {
     while (true) {
@@ -365,6 +374,7 @@ export const useVaultState = () => {
         identitiesWritePendingRef.current,
         groupConfigsWritePendingRef.current,
         snippetsWritePendingRef.current,
+        managedSourcesWritePendingRef.current,
       ];
       await Promise.all(writePending);
       if (
@@ -373,6 +383,7 @@ export const useVaultState = () => {
         && writePending[2] === identitiesWritePendingRef.current
         && writePending[3] === groupConfigsWritePendingRef.current
         && writePending[4] === snippetsWritePendingRef.current
+        && writePending[5] === managedSourcesWritePendingRef.current
         && encryptPending[0] === hostsEncryptPendingRef.current
         && encryptPending[1] === keysEncryptPendingRef.current
         && encryptPending[2] === identitiesEncryptPendingRef.current
@@ -643,7 +654,7 @@ export const useVaultState = () => {
   }, []);
 
   const updateSnippets = useCallback((
-    data: Snippet[],
+    data: Snippet[] | ((current: Snippet[]) => Snippet[]),
     options?: { replace?: boolean },
   ) => {
     // Capture the pre-update snapshot for a 3-way rebase once we hold the lock.
@@ -653,7 +664,9 @@ export const useVaultState = () => {
     // second edit does not rebase against the first save's optimistic memory.
     const replace =
       options?.replace === true || snippetsWriteReplaceRef.current;
-    const base = snippetsWriteBaseRef.current ?? snippetsRef.current;
+    const updater = typeof data === "function" ? data : null;
+    const current = snippetsRef.current;
+    const base = snippetsWriteBaseRef.current ?? current;
     if (options?.replace === true) {
       snippetsWriteReplaceRef.current = true;
     }
@@ -667,7 +680,9 @@ export const useVaultState = () => {
     } else if (snippetsWriteBaseRef.current === null) {
       snippetsWriteBaseRef.current = base;
     }
-    const cleaned = normalizeVaultOrder(data);
+    const cleaned = normalizeVaultOrder(
+      typeof data === "function" ? data(current) : data,
+    );
     const ver = ++snippetsWriteVersion.current;
     snippetsWriteOwnerRef.current = ver;
     // Keep live snapshot ahead of React commit so same-tick readers (delete,
@@ -681,20 +696,25 @@ export const useVaultState = () => {
     // skips the additive rebase so a concurrent disk-only add cannot survive.
     const writePromise = withVaultImportLock("vault", async () => {
       if (snippetsWriteOwnerRef.current !== ver) return "superseded" as const;
-      const rebased = normalizeVaultOrder(
-        replace
-          ? cleaned
+      const latestPersisted = normalizeVaultOrder(
+        readStoredArray<Snippet>(
+          STORAGE_KEY_SNIPPETS,
+          localStorageAdapter.readString(STORAGE_KEY_SNIPPETS),
+        ),
+      );
+      const rebased = normalizeVaultOrder(replace
+        ? cleaned
+        : updater
+          ? updater(rebaseSnippetVaultWrite({
+              base,
+              ours: current,
+              theirs: latestPersisted,
+            }))
           : rebaseSnippetVaultWrite({
               base,
               ours: cleaned,
-              theirs: normalizeVaultOrder(
-                readStoredArray<Snippet>(
-                  STORAGE_KEY_SNIPPETS,
-                  localStorageAdapter.readString(STORAGE_KEY_SNIPPETS),
-                ),
-              ),
-            }),
-      );
+              theirs: latestPersisted,
+            }));
       const persisted = localStorageAdapter.write(STORAGE_KEY_SNIPPETS, rebased);
       if (!persisted) {
         // Keep the pre-update ancestor. Clearing it here would make the next
@@ -852,6 +872,7 @@ export const useVaultState = () => {
     setCustomGroups(next);
 
     const cleanedGroupConfigs = buildGroupConfigsForGroups(next, groupConfigs);
+    groupConfigsRef.current = cleanedGroupConfigs;
     setGroupConfigs(cleanedGroupConfigs);
     const configsVer = ++groupConfigsWriteVersion.current;
     const encryptPromise = encryptGroupConfigs(cleanedGroupConfigs);
@@ -880,13 +901,105 @@ export const useVaultState = () => {
     const next = typeof data === "function" ? data(managedSourcesRef.current) : data;
     managedSourcesRef.current = next;
     setManagedSources(next);
-    void withVaultImportLock("vault", async () => {
+    const ver = ++managedSourcesWriteVersion.current;
+    const writePromise = withVaultImportLock("vault", async () => {
       // Latest ref wins if another update ran while waiting for the lock.
-      if (managedSourcesRef.current !== next) return;
-      localStorageAdapter.write(STORAGE_KEY_MANAGED_SOURCES, next);
+      if (ver !== managedSourcesWriteVersion.current) return "superseded" as const;
+      return localStorageAdapter.write(STORAGE_KEY_MANAGED_SOURCES, next)
+        ? "written" as const
+        : "failed" as const;
     });
+    managedSourcesWritePendingRef.current = writePromise;
+    return writePromise;
   }, []);
 
+  const commitVaultGroupMutation = useCallback(async (
+    mutate: (current: VaultGroupMutationState) => VaultGroupMutationResult,
+    lock?: VaultLockHandle | null,
+  ): Promise<VaultGroupMutationResult | { ok: false; superseded: true }> => {
+    const captureVersions = () => ({
+      hosts: hostsWriteVersion.current,
+      snippets: snippetsWriteVersion.current,
+      groups: customGroupsWriteVersion.current,
+      configs: groupConfigsWriteVersion.current,
+      sources: managedSourcesWriteVersion.current,
+    });
+    const versionsAreCurrent = (versions: ReturnType<typeof captureVersions>) => (
+      versions.hosts === hostsWriteVersion.current
+      && versions.snippets === snippetsWriteVersion.current
+      && versions.groups === customGroupsWriteVersion.current
+      && versions.configs === groupConfigsWriteVersion.current
+      && versions.sources === managedSourcesWriteVersion.current
+    );
+    const stateMatchesLiveSnapshot = (current: VaultGroupMutationState) => (
+      JSON.stringify(current.hosts) === JSON.stringify(hostsRef.current)
+      && JSON.stringify(current.snippets) === JSON.stringify(snippetsRef.current)
+      && JSON.stringify(current.groups) === JSON.stringify(customGroupsRef.current)
+      && JSON.stringify(current.configs) === JSON.stringify(groupConfigsRef.current)
+      && JSON.stringify(current.managedSources) === JSON.stringify(managedSourcesRef.current)
+    );
+    const runCommit = async (
+      versions: ReturnType<typeof captureVersions>,
+    ): Promise<VaultGroupMutationResult | { ok: false; superseded: true }> => {
+      const result = await commitVaultGroupMutationPersistence({
+        storage: localStorageAdapter,
+        mutate,
+        prepareState: (state) => {
+          const groups = Array.from(new Set(state.groups));
+          return {
+            groups,
+            configs: buildGroupConfigsForGroups(groups, state.configs),
+            hosts: normalizeVaultOrder(state.hosts.map((host) => sanitizeHost(host))),
+            managedSources: state.managedSources,
+            snippets: normalizeVaultOrder(state.snippets),
+          };
+        },
+        decryptHosts: async (items) => normalizeVaultOrder(
+          (await decryptHosts(items)).map((host) => sanitizeHost(host)),
+        ),
+        decryptConfigs: async (items) => normalizeVaultOrder(
+          (await decryptGroupConfigs(items)).map(sanitizeGroupConfig),
+        ),
+        encryptHosts,
+        encryptConfigs: encryptGroupConfigs,
+        isCurrent: () => versionsAreCurrent(versions),
+        validateCurrent: lock ? stateMatchesLiveSnapshot : undefined,
+      });
+      if (!result.ok) return result;
+      const nextState = result.state;
+      ++hostsWriteVersion.current;
+      ++snippetsWriteVersion.current;
+      snippetsWriteOwnerRef.current = snippetsWriteVersion.current;
+      ++customGroupsWriteVersion.current;
+      ++groupConfigsWriteVersion.current;
+      ++managedSourcesWriteVersion.current;
+      hostsRef.current = nextState.hosts;
+      snippetsRef.current = nextState.snippets;
+      customGroupsRef.current = nextState.groups;
+      managedSourcesRef.current = nextState.managedSources;
+      snippetsWriteBaseRef.current = null;
+      snippetsWriteReplaceRef.current = false;
+      setHosts(nextState.hosts);
+      setSnippets(nextState.snippets);
+      setCustomGroups(nextState.groups);
+      setManagedSources(nextState.managedSources);
+      setGroupConfigs(nextState.configs);
+      groupConfigsRef.current = nextState.configs;
+      return { ok: true, state: nextState };
+    };
+
+    if (lock) {
+      const versions = captureVersions();
+      return withVaultImportLockIfNeeded("vault", () => runCommit(versions), lock);
+    }
+    while (true) {
+      await waitForPendingVaultWrites();
+      const versions = captureVersions();
+      const result = await withVaultImportLock("vault", () => runCommit(versions));
+      if (!("superseded" in result)) return result;
+    }
+  }, [waitForPendingVaultWrites]);
+
   const readPersistedManagedSources = useCallback((): ManagedSource[] => (
     readStoredArray<ManagedSource>(
       STORAGE_KEY_MANAGED_SOURCES,
@@ -996,6 +1109,8 @@ export const useVaultState = () => {
       ++groupConfigsWriteVersion.current;
       customGroupsRef.current = result.groups;
       managedSourcesRef.current = result.sources;
+      hostsRef.current = cleanedHosts;
+      groupConfigsRef.current = nextGroupConfigs;
       setHosts(cleanedHosts);
       setCustomGroups(result.groups);
       setManagedSources(result.sources);
@@ -1018,6 +1133,7 @@ export const useVaultState = () => {
     // sit in memory and re-persist with `fontFamilyOverride: true` until
     // the next reload. Mirrors updateHosts → sanitizeHost.
     const cleaned = normalizeVaultOrder(data.map(sanitizeGroupConfig));
+    groupConfigsRef.current = cleaned;
     setGroupConfigs(cleaned);
     const ver = ++groupConfigsWriteVersion.current;
     const encryptPromise = encryptGroupConfigs(cleaned);
@@ -1461,7 +1577,10 @@ export const useVaultState = () => {
         const savedManagedSources = localStorageAdapter.read<ManagedSource[]>(
           STORAGE_KEY_MANAGED_SOURCES,
         );
-        if (savedManagedSources) setManagedSources(savedManagedSources);
+        if (savedManagedSources) {
+          managedSourcesRef.current = savedManagedSources;
+          setManagedSources(savedManagedSources);
+        }
 
         // Load group configs
         const savedGroupConfigs = localStorageAdapter.read<GroupConfig[]>(STORAGE_KEY_GROUP_CONFIGS);
@@ -1471,6 +1590,7 @@ export const useVaultState = () => {
           if (cancelled) return;
           if (gcVer === groupConfigsWriteVersion.current) {
             const sanitizedGC = normalizeVaultOrder(decryptedGC.map(sanitizeGroupConfig));
+            groupConfigsRef.current = sanitizedGC;
             setGroupConfigs(sanitizedGC);
             encryptGroupConfigs(sanitizedGC).then((enc) => {
               if (gcVer === groupConfigsWriteVersion.current)
@@ -1641,6 +1761,7 @@ export const useVaultState = () => {
       if (key === STORAGE_KEY_GROUPS) {
         const next = safeParse<string[]>(event.newValue) ?? [];
         ++customGroupsWriteVersion.current;
+        customGroupsRef.current = next;
         setCustomGroups(next);
         return;
       }
@@ -1695,6 +1816,8 @@ export const useVaultState = () => {
 
       if (key === STORAGE_KEY_MANAGED_SOURCES) {
         const next = safeParse<ManagedSource[]>(event.newValue) ?? [];
+        ++managedSourcesWriteVersion.current;
+        managedSourcesRef.current = next;
         setManagedSources(next);
         return;
       }
@@ -1705,8 +1828,11 @@ export const useVaultState = () => {
         const seq = ++groupConfigsReadSeq.current;
         const writeAtStart = groupConfigsWriteVersion.current;
         decryptGroupConfigs(next).then((dec) => {
-          if (seq === groupConfigsReadSeq.current && writeAtStart === groupConfigsWriteVersion.current)
-            setGroupConfigs(normalizeVaultOrder(dec.map(sanitizeGroupConfig)));
+          if (seq === groupConfigsReadSeq.current && writeAtStart === groupConfigsWriteVersion.current) {
+            const normalized = normalizeVaultOrder(dec.map(sanitizeGroupConfig));
+            groupConfigsRef.current = normalized;
+            setGroupConfigs(normalized);
+          }
         });
         return;
       }
@@ -1794,7 +1920,7 @@ export const useVaultState = () => {
   const importData = useCallback(
     (payload: Partial<ExportableVaultData>): Promise<void> => {
       const encryptedWrites: Promise<void>[] = [];
-      if (payload.hosts) encryptedWrites.push(updateHosts(payload.hosts));
+      if (payload.hosts) encryptedWrites.push(updateHosts(payload.hosts).then(() => undefined));
       if (payload.keys) encryptedWrites.push(updateKeys(payload.keys));
       if (payload.identities) encryptedWrites.push(updateIdentities(payload.identities));
       if (Array.isArray(payload.proxyProfiles)) encryptedWrites.push(updateProxyProfiles(payload.proxyProfiles));
@@ -1952,6 +2078,8 @@ export const useVaultState = () => {
         ]);
         customGroupsRef.current = nextGroups;
         snippetsRef.current = nextSnippets;
+        hostsRef.current = nextHosts;
+        groupConfigsRef.current = nextGroupConfigs;
         snippetsWriteBaseRef.current = null;
         snippetsWriteReplaceRef.current = false;
         setHosts(nextHosts);
@@ -2008,6 +2136,7 @@ export const useVaultState = () => {
     updateManagedSources,
     readPersistedManagedSources,
     commitVaultImportTransaction,
+    commitVaultGroupMutation,
     updateGroupConfigs,
     addShellHistoryEntry,
     clearShellHistory,

application/state/vaultGroupMutationPersistence.test.ts

@@ -0,0 +1,220 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import type { Host, Snippet } from '../../domain/models';
+import {
+  remapSnippetTargetGroupPaths,
+  removeSnippetTargetGroupPaths,
+} from '../../domain/hostGroupPathMutations';
+import {
+  STORAGE_KEY_GROUP_CONFIGS,
+  STORAGE_KEY_GROUPS,
+  STORAGE_KEY_HOSTS,
+  STORAGE_KEY_MANAGED_SOURCES,
+  STORAGE_KEY_SNIPPETS,
+} from '../../infrastructure/config/storageKeys';
+import { commitVaultGroupMutationPersistence } from './vaultGroupMutationPersistence';
+
+const createStorage = (initial: Record<string, unknown>, failKey?: string) => {
+  const values = new Map(Object.entries(initial).map(([key, value]) => [key, JSON.stringify(value)]));
+  return {
+    values,
+    read<T>(key: string): T | null {
+      const value = values.get(key);
+      return value === undefined ? null : JSON.parse(value) as T;
+    },
+    readString: (key: string) => values.get(key) ?? null,
+    write<T>(key: string, value: T) {
+      if (key === failKey) return false;
+      values.set(key, JSON.stringify(value));
+      return true;
+    },
+    writeString(key: string, value: string) {
+      values.set(key, value);
+      return true;
+    },
+    remove(key: string) {
+      values.delete(key);
+    },
+  };
+};
+
+const identity = async <T>(value: T): Promise<T> => value;
+const prepareState = <T>(value: T): T => value;
+
+const initialHost: Host = {
+  id: 'host-1', label: 'Host', hostname: 'host.test', username: 'root',
+  group: 'prod', tags: [], os: 'linux',
+};
+const initialSnippet: Snippet = {
+  id: 'script-1', label: 'Deploy', command: 'nct.log(1)', kind: 'script',
+  targetGroups: ['prod'],
+};
+
+function initialVault() {
+  return {
+    [STORAGE_KEY_HOSTS]: [initialHost],
+    [STORAGE_KEY_GROUPS]: ['prod'],
+    [STORAGE_KEY_MANAGED_SOURCES]: [],
+    [STORAGE_KEY_GROUP_CONFIGS]: [{ path: 'prod', username: 'root' }],
+    [STORAGE_KEY_SNIPPETS]: [initialSnippet],
+  };
+}
+
+test('group rename rolls back every Vault key when the snippet write fails', async () => {
+  const initial = initialVault();
+  const storage = createStorage(initial, STORAGE_KEY_SNIPPETS);
+
+  await assert.rejects(commitVaultGroupMutationPersistence({
+    storage,
+    mutate: (current) => ({
+      ok: true,
+      state: {
+        ...current,
+        groups: ['production'],
+        configs: current.configs.map((config) => ({ ...config, path: 'production' })),
+        hosts: current.hosts.map((host) => ({ ...host, group: 'production' })),
+        snippets: remapSnippetTargetGroupPaths(current.snippets, 'prod', 'production'),
+      },
+    }),
+    prepareState,
+    decryptHosts: identity,
+    decryptConfigs: identity,
+    encryptHosts: identity,
+    encryptConfigs: identity,
+    isCurrent: () => true,
+  }), /rejected importer transaction/);
+
+  for (const [key, value] of Object.entries(initial)) {
+    assert.deepEqual(storage.read(key), value);
+  }
+});
+
+test('group delete rolls back every Vault key when the snippet write fails', async () => {
+  const initial = initialVault();
+  const storage = createStorage(initial, STORAGE_KEY_SNIPPETS);
+
+  await assert.rejects(commitVaultGroupMutationPersistence({
+    storage,
+    mutate: (current) => ({
+      ok: true,
+      state: {
+        ...current,
+        groups: [],
+        configs: [],
+        hosts: current.hosts.map((host) => ({ ...host, group: undefined })),
+        snippets: removeSnippetTargetGroupPaths(current.snippets, ['prod']),
+      },
+    }),
+    prepareState,
+    decryptHosts: identity,
+    decryptConfigs: identity,
+    encryptHosts: identity,
+    encryptConfigs: identity,
+    isCurrent: () => true,
+  }), /rejected importer transaction/);
+
+  for (const [key, value] of Object.entries(initial)) {
+    assert.deepEqual(storage.read(key), value);
+  }
+});
+
+test('group rename preserves a concurrent snippet update from the locked snapshot', async () => {
+  const concurrentSnippet = { ...initialSnippet, command: 'nct.log(2)' };
+  const addedSnippet: Snippet = {
+    id: 'script-2', label: 'Check', command: 'nct.log(3)', kind: 'script',
+    targetGroups: ['prod/child'],
+  };
+  const storage = createStorage({
+    ...initialVault(),
+    [STORAGE_KEY_SNIPPETS]: [concurrentSnippet, addedSnippet],
+  });
+
+  const result = await commitVaultGroupMutationPersistence({
+    storage,
+    mutate: (current) => ({
+      ok: true,
+      state: {
+        ...current,
+        groups: ['production'],
+        snippets: remapSnippetTargetGroupPaths(current.snippets, 'prod', 'production'),
+      },
+    }),
+    prepareState,
+    decryptHosts: identity,
+    decryptConfigs: identity,
+    encryptHosts: identity,
+    encryptConfigs: identity,
+    isCurrent: () => true,
+  });
+
+  assert.equal(result.ok, true);
+  const saved = storage.read<Snippet[]>(STORAGE_KEY_SNIPPETS) ?? [];
+  assert.equal(saved[0]?.command, 'nct.log(2)');
+  assert.deepEqual(saved.map((snippet) => snippet.targetGroups), [
+    ['production'],
+    ['production/child'],
+  ]);
+});
+
+test('group delete cleans targets from the latest persisted snippet snapshot', async () => {
+  const concurrentSnippet = { ...initialSnippet, command: 'nct.log(2)' };
+  const addedSnippet: Snippet = {
+    id: 'script-2', label: 'Check', command: 'nct.log(3)', kind: 'script',
+    targetGroups: ['prod/child', 'staging'],
+  };
+  const storage = createStorage({
+    ...initialVault(),
+    [STORAGE_KEY_SNIPPETS]: [concurrentSnippet, addedSnippet],
+  });
+
+  const result = await commitVaultGroupMutationPersistence({
+    storage,
+    mutate: (current) => ({
+      ok: true,
+      state: {
+        ...current,
+        groups: [],
+        snippets: removeSnippetTargetGroupPaths(current.snippets, ['prod']),
+      },
+    }),
+    prepareState,
+    decryptHosts: identity,
+    decryptConfigs: identity,
+    encryptHosts: identity,
+    encryptConfigs: identity,
+    isCurrent: () => true,
+  });
+
+  assert.equal(result.ok, true);
+  const saved = storage.read<Snippet[]>(STORAGE_KEY_SNIPPETS) ?? [];
+  assert.equal(saved[0]?.command, 'nct.log(2)');
+  assert.deepEqual(saved.map((snippet) => snippet.targetGroups), [
+    [],
+    ['staging'],
+  ]);
+});
+
+test('group mutation stops before writing when memory is ahead of persisted Vault state', async () => {
+  const storage = createStorage(initialVault());
+  let mutateCalled = false;
+
+  const result = await commitVaultGroupMutationPersistence({
+    storage,
+    mutate: (current) => {
+      mutateCalled = true;
+      return { ok: true, state: current };
+    },
+    prepareState,
+    decryptHosts: identity,
+    decryptConfigs: identity,
+    encryptHosts: identity,
+    encryptConfigs: identity,
+    isCurrent: () => true,
+    validateCurrent: (current) => current.snippets[0]?.command === 'nct.log(2)',
+  });
+
+  assert.deepEqual(result, { ok: false, superseded: true });
+  assert.equal(mutateCalled, false);
+  assert.deepEqual(storage.read<Snippet[]>(STORAGE_KEY_SNIPPETS), [initialSnippet]);
+});

application/state/vaultGroupMutationPersistence.ts

@@ -0,0 +1,97 @@
+import type { GroupConfig, Host, ManagedSource, Snippet } from '../../domain/models';
+import type {
+  VaultGroupMutationResult,
+  VaultGroupMutationState,
+} from '../../domain/vaultGroupMutation';
+import {
+  STORAGE_KEY_GROUP_CONFIGS,
+  STORAGE_KEY_GROUPS,
+  STORAGE_KEY_HOSTS,
+  STORAGE_KEY_MANAGED_SOURCES,
+  STORAGE_KEY_SNIPPETS,
+} from '../../infrastructure/config/storageKeys';
+import { commitPluginImporterTransaction } from './pluginImporterTransaction';
+import { readStoredArray } from './vaultImportPersistence';
+
+type TransactionStorage = {
+  read<T>(key: string): T | null;
+  readString(key: string): string | null;
+  write<T>(key: string, value: T): boolean;
+  writeString(key: string, value: string): boolean;
+  remove(key: string): void;
+};
+
+const GROUP_MUTATION_KEYS = [
+  STORAGE_KEY_HOSTS,
+  STORAGE_KEY_GROUPS,
+  STORAGE_KEY_MANAGED_SOURCES,
+  STORAGE_KEY_GROUP_CONFIGS,
+  STORAGE_KEY_SNIPPETS,
+] as const;
+
+export async function commitVaultGroupMutationPersistence({
+  storage,
+  mutate,
+  prepareState,
+  decryptHosts,
+  decryptConfigs,
+  encryptHosts,
+  encryptConfigs,
+  isCurrent,
+  validateCurrent,
+}: {
+  storage: TransactionStorage;
+  mutate: (current: VaultGroupMutationState) => VaultGroupMutationResult;
+  prepareState: (state: VaultGroupMutationState) => VaultGroupMutationState;
+  decryptHosts: (hosts: Host[]) => Promise<Host[]>;
+  decryptConfigs: (configs: GroupConfig[]) => Promise<GroupConfig[]>;
+  encryptHosts: (hosts: Host[]) => Promise<unknown>;
+  encryptConfigs: (configs: GroupConfig[]) => Promise<unknown>;
+  isCurrent: () => boolean;
+  validateCurrent?: (current: VaultGroupMutationState) => boolean;
+}): Promise<VaultGroupMutationResult | { ok: false; superseded: true }> {
+  const raw = new Map(GROUP_MUTATION_KEYS.map((key) => [key, storage.readString(key)]));
+  const [hosts, configs] = await Promise.all([
+    decryptHosts(readStoredArray<Host>(STORAGE_KEY_HOSTS, raw.get(STORAGE_KEY_HOSTS) ?? null)),
+    decryptConfigs(readStoredArray<GroupConfig>(
+      STORAGE_KEY_GROUP_CONFIGS,
+      raw.get(STORAGE_KEY_GROUP_CONFIGS) ?? null,
+    )),
+  ]);
+  const current: VaultGroupMutationState = {
+    groups: readStoredArray<string>(STORAGE_KEY_GROUPS, raw.get(STORAGE_KEY_GROUPS) ?? null),
+    configs,
+    hosts,
+    managedSources: readStoredArray<ManagedSource>(
+      STORAGE_KEY_MANAGED_SOURCES,
+      raw.get(STORAGE_KEY_MANAGED_SOURCES) ?? null,
+    ),
+    snippets: readStoredArray<Snippet>(STORAGE_KEY_SNIPPETS, raw.get(STORAGE_KEY_SNIPPETS) ?? null),
+  };
+  if (!isCurrent() || (validateCurrent && !validateCurrent(current))) {
+    return { ok: false, superseded: true };
+  }
+  const mutation = mutate(current);
+  if (!mutation.ok) return mutation;
+
+  const nextState = prepareState(mutation.state);
+  const [encryptedHosts, encryptedConfigs] = await Promise.all([
+    encryptHosts(nextState.hosts),
+    encryptConfigs(nextState.configs),
+  ]);
+  if (
+    !isCurrent()
+    || GROUP_MUTATION_KEYS.some((key) => storage.readString(key) !== raw.get(key))
+  ) {
+    return { ok: false, superseded: true };
+  }
+
+  commitPluginImporterTransaction(storage, [
+    [STORAGE_KEY_HOSTS, encryptedHosts],
+    [STORAGE_KEY_GROUPS, nextState.groups],
+    [STORAGE_KEY_MANAGED_SOURCES, nextState.managedSources],
+    [STORAGE_KEY_GROUP_CONFIGS, encryptedConfigs],
+    [STORAGE_KEY_SNIPPETS, nextState.snippets],
+  ]);
+  return { ok: true, state: nextState };
+}

application/state/vaultHostTreeActionsStore.ts

@@ -12,7 +12,7 @@ export interface VaultHostTreeActions {
   onNewGroup: (parentPath?: string) => void;
   onRenameGroup: (groupPath: string) => void;
   onDeleteGroup: (groupPath: string) => void;
-  commitInlineGroupRename: (name: string) => void;
+  commitInlineGroupRename: (name: string) => boolean | void | Promise<boolean | void>;
   cancelInlineGroupEdit: () => void;
   commitInlineHostRename: (name: string) => void;
   cancelInlineHostEdit: () => void;

application/state/vaultSnapshotStore.test.ts

@@ -81,6 +81,7 @@ test('vault actions register and unregister', () => {
     readPersistedManagedSources: noop,
     commitPluginImporterData: noop,
     commitVaultImportTransaction: noop,
+    commitVaultGroupMutation: noop,
     updateHostDistro: noop,
     updateHostLastConnected: noop,
     addShellHistoryEntry: noop,

application/state/vaultSnapshotStore.ts

@@ -58,6 +58,7 @@ export type VaultSnapshotActions = Pick<
   | 'readPersistedManagedSources'
   | 'commitPluginImporterData'
   | 'commitVaultImportTransaction'
+  | 'commitVaultGroupMutation'
   | 'updateHostDistro'
   | 'updateHostLastConnected'
   | 'addShellHistoryEntry'

components/HostTreeView.tsx

@@ -290,7 +290,7 @@ interface HostTreeViewProps {
   onDeleteGroup: (groupPath: string) => void;
   moveHostToGroup: (hostId: string, groupPath: string | null) => void;
   moveGroup: (sourcePath: string, targetParent: string | null) => void;
-  commitInlineGroupRename?: (name: string) => void;
+  commitInlineGroupRename?: (name: string) => boolean | void | Promise<boolean | void>;
   cancelInlineGroupEdit?: () => void;
   managedGroupPaths?: Set<string>;
   onUnmanageGroup?: (groupPath: string) => void;
@@ -330,7 +330,7 @@ interface TreeNodeProps {
   onDeleteGroup: (groupPath: string) => void;
   moveHostToGroup: (hostId: string, groupPath: string | null) => void;
   moveGroup: (sourcePath: string, targetParent: string | null) => void;
-  commitInlineGroupRename?: (name: string) => void;
+  commitInlineGroupRename?: (name: string) => boolean | void | Promise<boolean | void>;
   cancelInlineGroupEdit?: () => void;
   managedGroupPaths?: Set<string>;
   onUnmanageGroup?: (groupPath: string) => void;
@@ -759,7 +759,11 @@ const HostTreeItem: React.FC<HostTreeItemProps> = ({
             : -1}
           onFocus={() => onActiveTreeItemChange(`host:${host.id}`)}
           draggable={!isMultiSelectMode}
-          onDragStart={(e) => e.dataTransfer.setData("host-id", host.id)}
+          onDragStart={(e) => {
+            // copyMove: vault reorder uses move; focus-sidebar append uses copy.
+            e.dataTransfer.effectAllowed = "copyMove";
+            e.dataTransfer.setData("host-id", host.id);
+          }}
           onClick={() => {
             const action = resolveHostActivateAction({
               behavior: normalizedHostClickBehavior,

components/SelectGroupDialog.tsx

@@ -0,0 +1,168 @@
+import { CheckSquare, FolderTree, Search, Square } from 'lucide-react';
+import React, { useMemo, useState } from 'react';
+import { useI18n } from '@/application/i18n/I18nProvider';
+import type { Host } from '@/domain/models';
+import { Button } from '@/components/ui/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Input } from '@/components/ui/input';
+import { FixedSizeVirtualList } from '@/components/ui/FixedSizeVirtualList';
+import { cn } from '@/lib/utils';
+
+export interface SelectGroupDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  hosts: Host[];
+  customGroups?: string[];
+  selectedGroupPaths: string[];
+  onSelectionChange: (selectedGroupPaths: string[]) => void;
+}
+
+const GROUP_ROW_HEIGHT = 48;
+
+function collectGroupPaths(
+  hosts: Host[],
+  customGroups: string[],
+  selectedGroupPaths: string[],
+): string[] {
+  const paths = new Set<string>();
+  for (const groupPath of [...customGroups, ...selectedGroupPaths]) {
+    const parts = groupPath.split('/').filter(Boolean);
+    for (let index = 1; index <= parts.length; index += 1) {
+      paths.add(parts.slice(0, index).join('/'));
+    }
+  }
+  for (const host of hosts) {
+    const parts = host.group?.split('/').filter(Boolean) ?? [];
+    for (let index = 1; index <= parts.length; index += 1) {
+      paths.add(parts.slice(0, index).join('/'));
+    }
+  }
+  return [...paths].sort((left, right) => left.localeCompare(right));
+}
+
+function countHostsByGroupPath(hosts: Host[]): Map<string, number> {
+  const counts = new Map<string, number>();
+  for (const host of hosts) {
+    if (host.protocol === 'serial') continue;
+    const parts = host.group?.split('/').filter(Boolean) ?? [];
+    for (let index = 1; index <= parts.length; index += 1) {
+      const path = parts.slice(0, index).join('/');
+      counts.set(path, (counts.get(path) ?? 0) + 1);
+    }
+  }
+  return counts;
+}
+
+export const SelectGroupDialog: React.FC<SelectGroupDialogProps> = ({
+  open,
+  onOpenChange,
+  hosts,
+  customGroups = [],
+  selectedGroupPaths,
+  onSelectionChange,
+}) => {
+  const { t } = useI18n();
+  const [searchQuery, setSearchQuery] = useState('');
+  const selected = useMemo(() => new Set(selectedGroupPaths), [selectedGroupPaths]);
+  const groupPaths = useMemo(
+    () => collectGroupPaths(hosts, customGroups, selectedGroupPaths),
+    [customGroups, hosts, selectedGroupPaths],
+  );
+  const displayedPaths = useMemo(() => {
+    const query = searchQuery.trim().toLocaleLowerCase();
+    if (!query) return groupPaths;
+    return groupPaths.filter((path) => path.toLocaleLowerCase().includes(query));
+  }, [groupPaths, searchQuery]);
+  const hostCountByPath = useMemo(() => countHostsByGroupPath(hosts), [hosts]);
+
+  const togglePath = (path: string) => {
+    if (selected.has(path)) {
+      onSelectionChange(selectedGroupPaths.filter((candidate) => candidate !== path));
+      return;
+    }
+    onSelectionChange([...selectedGroupPaths, path]);
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-md h-[min(78vh,600px)] flex flex-col p-0 gap-0 overflow-hidden">
+        <DialogHeader className="px-4 pt-4 pb-3 shrink-0 border-b border-border/60">
+          <DialogTitle className="text-base">{t('snippets.targets.selectGroups')}</DialogTitle>
+        </DialogHeader>
+
+        <div className="px-4 py-3 border-b border-border/60 shrink-0">
+          <div className="relative">
+            <Search
+              size={14}
+              className="absolute left-3 top-1/2 -translate-y-1/2 text-muted-foreground"
+            />
+            <Input
+              value={searchQuery}
+              onChange={(event) => setSearchQuery(event.target.value)}
+              placeholder={t('common.searchPlaceholder')}
+              className="h-8 pl-8"
+            />
+          </div>
+        </div>
+
+        <div className="flex-1 min-h-0 p-3">
+          {displayedPaths.length === 0 ? (
+            <p className="py-10 text-center text-sm text-muted-foreground">
+              {t('snippets.targets.noGroups')}
+            </p>
+          ) : (
+            <FixedSizeVirtualList
+              className="h-full"
+              items={displayedPaths}
+              itemHeight={GROUP_ROW_HEIGHT}
+              getItemKey={(path) => path}
+              renderItem={(path) => {
+                const isSelected = selected.has(path);
+                const depth = Math.max(0, path.split('/').filter(Boolean).length - 1);
+                const label = path.split('/').filter(Boolean).pop() ?? path;
+                const hostCount = hostCountByPath.get(path) ?? 0;
+                return (
+                  <button
+                    type="button"
+                    className={cn(
+                      'w-full h-11 flex items-center gap-2.5 rounded-lg px-2.5 text-left transition-colors',
+                      isSelected ? 'bg-primary/10 text-foreground' : 'hover:bg-muted/70',
+                    )}
+                    style={{ paddingLeft: `${10 + depth * 16}px` }}
+                    onClick={() => togglePath(path)}
+                  >
+                    {isSelected ? (
+                      <CheckSquare size={16} className="text-primary shrink-0" />
+                    ) : (
+                      <Square size={16} className="text-muted-foreground shrink-0" />
+                    )}
+                    <FolderTree size={16} className="text-primary shrink-0" />
+                    <span className="min-w-0 flex-1">
+                      <span className="block truncate text-sm font-medium">{label}</span>
+                      <span className="block truncate text-[11px] text-muted-foreground">{path}</span>
+                    </span>
+                    <span className="text-[11px] text-muted-foreground shrink-0">
+                      {t('vault.groups.hostsCount', { count: hostCount })}
+                    </span>
+                  </button>
+                );
+              }}
+            />
+          )}
+        </div>
+
+        <DialogFooter className="px-4 py-3 border-t border-border/60 shrink-0">
+          <Button className="w-full" onClick={() => onOpenChange(false)}>
+            {t('selectHost.continueWithCount', { count: selectedGroupPaths.length })}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};

components/SftpSidePanel.tsx

@@ -86,6 +86,7 @@ import { scheduleDeferredTerminalFocus } from "./systemManager/tmuxActionFocus";
 import {
   connectionKeyMatchesHost,
   findReusableSftpSidePanelTab,
+  isPendingSameEndpointSshSession,
   shouldAcceptPendingSftpUpload,
   shouldResetSftpSidePanelSourceSession,
   shouldSkipSftpSidePanelAutoConnect,
@@ -560,6 +561,12 @@ const SftpSidePanelInner: React.FC<SftpSidePanelProps> = ({
       activeHost.username,
       activeHost.sftpFileProtocol,
     );
+    const pendingSameEndpointSession = sessions.find((session) => (
+      isPendingSameEndpointSshSession(session, activeHost)
+    ));
+    if (!activeSessionId && pendingSameEndpointSession) {
+      return;
+    }
     const sessionChanged = shouldResetSftpSidePanelSourceSession(
       lastSourceSessionIdRef.current,
       activeSessionId,
@@ -737,7 +744,7 @@ const SftpSidePanelInner: React.FC<SftpSidePanelProps> = ({
         tabConnectionKeyMapRef.current.set(tabId, connectionKey);
       },
     });
-  }, [activeHost, activeSessionId, initialLocation, interactiveWorkActive]);
+  }, [activeHost, activeSessionId, initialLocation, interactiveWorkActive, sessions]);
 
   useEffect(() => {
     if (!activeHost || !isVisible) return;

components/SnippetsManager.tsx

@@ -18,7 +18,11 @@ import {
   type SnippetExportPayload,
   type SnippetImportConflictAction,
 } from '../domain/snippetTransfer';
-import { getRunnableHostsForSnippet, snippetHasRunTargets } from '../domain/snippetTargets.ts';
+import {
+  getRunnableHostsForSnippet,
+  resolveSnippetTargetGroupsForSave,
+  snippetHasRunTargets,
+} from '../domain/snippetTargets.ts';
 import { removeHostConnectScript, syncHostsForSnippetTargetChange } from '../domain/hostConnectScripts.ts';
 import { flattenSnippetCommandPreview } from '../domain/snippetPreview.ts';
 import { deleteSelectedSnippetsFromVault } from '../domain/snippetSelection.ts';
@@ -486,6 +490,7 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
     targets: [],
   });
   const [targetSelection, setTargetSelection] = useState<string[]>([]);
+  const [targetGroupSelection, setTargetGroupSelection] = useState<string[]>([]);
   const [copiedId, setCopiedId] = useState<string | null>(null);
   const [selectedPackage, setSelectedPackage] = useState<string | null>(null);
   const [newPackageName, setNewPackageName] = useState('');
@@ -735,6 +740,7 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
     if (snippet) {
       setEditingSnippet(snippet);
       setTargetSelection(snippet.targetsAllHosts ? [] : (snippet.targets || []));
+      setTargetGroupSelection(snippet.targetsAllHosts ? [] : (snippet.targetGroups || []));
     } else {
       setEditingSnippet(asScript ? {
         label: '',
@@ -751,6 +757,7 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
         targets: [],
       });
       setTargetSelection([]);
+      setTargetGroupSelection([]);
     }
     setRightPanelMode('edit-snippet');
   }, [selectedPackage]);
@@ -773,6 +780,10 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
       tags: editingSnippet.tags || [],
       package: editingSnippet.package || '',
       targets: editingSnippet.targetsAllHosts ? [] : targetSelection,
+      targetGroups: resolveSnippetTargetGroupsForSave(
+        editingSnippet,
+        targetGroupSelection,
+      ),
       targetsAllHosts: editingSnippet.targetsAllHosts || undefined,
       shortkey: editingSnippet.shortkey,
       noAutoRun: editingSnippet.noAutoRun,
@@ -784,7 +795,7 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
       trigger: editingSnippet.trigger,
       triggerPattern: editingSnippet.triggerPattern,
     };
-  }, [editingSnippet, targetSelection]);
+  }, [editingSnippet, targetGroupSelection, targetSelection]);
 
   const syncHostsAfterSnippetSave = useCallback((
     savedSnippet: Snippet,
@@ -855,6 +866,7 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
     setRightPanelMode('none');
     setEditingSnippet({ label: '', command: '', package: '', targets: [] });
     setTargetSelection([]);
+    setTargetGroupSelection([]);
   };
 
   const hostById = useMemo(() => (
@@ -1663,6 +1675,8 @@ const SnippetsManager: React.FC<SnippetsManagerProps> = ({
       customGroups={customGroups}
       targetSelection={targetSelection}
       setTargetSelection={setTargetSelection}
+      targetGroupSelection={targetGroupSelection}
+      setTargetGroupSelection={setTargetGroupSelection}
       handleTargetSelect={handleTargetSelect}
       handleTargetSelectionChange={handleTargetSelectionChange}
       handleTargetPickerBack={handleTargetPickerBack}

components/SnippetsRightPanel.tsx

@@ -3,6 +3,7 @@ import { parseSnippetVariables } from '../domain/snippetVariables';
 import { Check, Clock, Keyboard, Loader2, Package, RotateCcw, Trash2 } from 'lucide-react';
 import { cn } from '../lib/utils';
 import SelectHostPanel from './SelectHostPanel';
+import { SelectGroupDialog } from './SelectGroupDialog';
 import { AsidePanel, AsidePanelContent, AsidePanelFooter } from './ui/aside-panel';
 import { Button } from './ui/button';
 import { Card } from './ui/card';
@@ -17,7 +18,10 @@ import { Combobox } from './ui/combobox';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from './ui/select';
 import { HistoryItem } from './SnippetsHistoryItem';
 import type { Snippet } from '@/domain/models';
-import { getRunnableHostsForSnippet } from '@/domain/snippetTargets.ts';
+import {
+  getRunnableHostsForSnippet,
+  resolveSnippetTargetGroupsForSave,
+} from '@/domain/snippetTargets.ts';
 import { STORAGE_KEY_SNIPPETS_PANEL_WIDTH } from '@/infrastructure/config/storageKeys.ts';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -29,6 +33,8 @@ export const SnippetsRightPanel: React.FC<SnippetsRightPanelProps> = ({
   customGroups,
   targetSelection,
   setTargetSelection,
+  targetGroupSelection,
+  setTargetGroupSelection,
   handleTargetSelect,
   handleTargetSelectionChange,
   handleTargetPickerBack,
@@ -71,6 +77,7 @@ export const SnippetsRightPanel: React.FC<SnippetsRightPanelProps> = ({
     [editingSnippet?.command],
   );
   const [scriptEditorModalOpen, setScriptEditorModalOpen] = useState(false);
+  const [groupPickerOpen, setGroupPickerOpen] = useState(false);
   const isEditingScript = isScriptSnippet(editingSnippet as import('../types').Snippet);
   const snippetsPanelResizeProps = {
     resizable: true as const,
@@ -81,8 +88,12 @@ export const SnippetsRightPanel: React.FC<SnippetsRightPanelProps> = ({
   const runnableEditingSnippet = useMemo(() => ({
     ...(editingSnippet as Snippet),
     targets: editingSnippet.targetsAllHosts ? [] : targetSelection,
+    targetGroups: resolveSnippetTargetGroupsForSave(
+      editingSnippet,
+      targetGroupSelection,
+    ),
     targetsAllHosts: editingSnippet.targetsAllHosts || undefined,
-  }), [editingSnippet, targetSelection]);
+  }), [editingSnippet, targetGroupSelection, targetSelection]);
 
   const runTargets = useMemo(
     () => getRunnableHostsForSnippet(runnableEditingSnippet, hosts),
@@ -99,10 +110,12 @@ export const SnippetsRightPanel: React.FC<SnippetsRightPanelProps> = ({
   const handleTargetsAllHostsChange = (checked: boolean) => {
     if (checked) {
       setTargetSelection([]);
+      setTargetGroupSelection([]);
       setEditingSnippet({
         ...editingSnippet,
         targetsAllHosts: true,
         targets: [],
+        targetGroups: undefined,
       });
       return;
     }
@@ -137,6 +150,7 @@ export const SnippetsRightPanel: React.FC<SnippetsRightPanelProps> = ({
 
     if (rightPanelMode === 'edit-snippet') {
       return (
+        <>
         <AsidePanel
           open={true}
           onClose={handleClosePanel}
@@ -266,7 +280,9 @@ export const SnippetsRightPanel: React.FC<SnippetsRightPanelProps> = ({
             <SnippetTargetsSection
               t={t}
               targetHosts={targetHosts}
+              targetGroups={isEditingScript ? targetGroupSelection : []}
               onEditTargets={openTargetPicker}
+              onEditGroups={isEditingScript ? () => setGroupPickerOpen(true) : undefined}
               hint={isEditingScript
                 ? (editingSnippet.trigger === 'onConnect'
                   ? t('scripts.targets.connectOrderHint')
@@ -386,11 +402,29 @@ export const SnippetsRightPanel: React.FC<SnippetsRightPanelProps> = ({
               selectedHostIds={targetSelection}
               onSelectHost={handleTargetSelect}
               onSelectionChange={handleTargetSelectionChange}
+              selectedGroupPaths={targetGroupSelection}
+              onGroupSelectionChange={setTargetGroupSelection}
               targetsAllHosts={Boolean(editingSnippet.targetsAllHosts)}
               onTargetsAllHostsChange={handleTargetsAllHostsChange}
             />
           ) : null}
         </AsidePanel>
+        <SelectGroupDialog
+          open={groupPickerOpen}
+          onOpenChange={setGroupPickerOpen}
+          hosts={hosts}
+          customGroups={customGroups}
+          selectedGroupPaths={targetGroupSelection}
+          onSelectionChange={(nextGroups) => {
+            setTargetGroupSelection(nextGroups);
+            setEditingSnippet({
+              ...editingSnippet,
+              targetGroups: nextGroups,
+              targetsAllHosts: undefined,
+            });
+          }}
+        />
+        </>
       );
     }
 

components/Terminal.tsx

@@ -121,6 +121,7 @@ import { useVaultSnapshotField } from "@/application/state/vaultSnapshotStore.ts
 import { netcattyBridge } from "@/infrastructure/services/netcattyBridge.ts";
 import { ScriptExecutionOverlay } from "./terminal/ScriptExecutionOverlay";
 import { isScriptSnippet } from "@/domain/snippetScript.ts";
+import { snippetCanRunInTerminal } from "@/domain/snippetTargets.ts";
 import { useOutputTriggers } from "@/application/state/useOutputTriggers.ts";
 import { TerminalComposeBar } from "./terminal/TerminalComposeBar";
 import { TerminalContextMenu } from "./terminal/TerminalContextMenu";
@@ -225,8 +226,16 @@ import {
 } from "./terminal/terminalRuntimeMount";
 import type { CreateXTermRuntimeContext } from "./terminal/runtime/createXTermRuntime";
 import { TerminalView } from "./terminal/TerminalView";
+import {
+  cancelConnectAutomationBatch,
+  createConnectAutomationBatch,
+  trackConnectAutomationStop,
+  type ConnectAutomationBatch,
+} from "./terminal/connectAutomationBatch";
 import {
   getInitialTerminalStatus,
+  resolveTerminalVaultInitialized,
+  shouldResetConnectAutomationOnReconnect,
   shouldSuppressHostStartupCommandOnReconnect,
   shouldStartTerminalBackend,
 } from "./terminal/restoredSessionGate";
@@ -270,6 +279,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
   sessionId,
   workspaceId,
   restoreState,
+  vaultInitializedOverride,
   pendingInitialCwd,
   shellType,
   lastCwd,
@@ -359,10 +369,15 @@ const TerminalComponent: React.FC<TerminalProps> = ({
   }, []);
   // Reactive vault-ready flag so restored panes re-arm boot after hydration
   // (module isVaultInitialized() alone is not a React dependency).
-  const vaultInitialized = useVaultSnapshotField("isVaultInitialized");
+  const sharedVaultInitialized = useVaultSnapshotField("isVaultInitialized");
+  const vaultInitialized = resolveTerminalVaultInitialized(
+    sharedVaultInitialized,
+    vaultInitializedOverride,
+  );
   const connectScriptsConsumedRef = useRef(false);
   const connectScriptsCompletedIdsRef = useRef(new Set<string>());
   const connectScriptsInFlightRef = useRef(false);
+  const connectScriptsBatchRef = useRef<ConnectAutomationBatch | null>(null);
   const pendingScriptRunIdRef = useRef<string | null>(null);
   const pendingScriptHandledRef = useRef<Snippet | null>(null);
   const pendingScriptRef = useRef(pendingScript);
@@ -413,7 +428,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
   const scriptSessionName = sessionDisplayName || host.label;
   const outputTriggers = useOutputTriggers({
     sessionId,
-    hostId: host.id,
+    host,
     snippets,
     onRunScript: (snippet, sid) => runAutomationScript({
       snippet,
@@ -424,7 +439,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
         hostname: host.hostname,
         username: host.username,
       },
-    }).catch((err) => {
+    }).then(() => undefined).catch((err) => {
       const message = err instanceof Error ? err.message : String(err);
       toast.error(message.includes('Observer mode') ? t('scripts.observer.blocked') : message);
       throw err;
@@ -1603,7 +1618,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
     terminalCwdTracker,
   ]);
 
-  const cleanupSession = async () => {
+  const cleanupSession = async (options?: { retainOwnership?: boolean }) => {
     const closingSessionId = sessionRef.current;
     xtermRuntimeRef.current?.flushKittyKeyboardReleases();
     sessionRef.current = null;
@@ -1631,7 +1646,10 @@ const TerminalComponent: React.FC<TerminalProps> = ({
       // Still notify main so in-flight SSH passphrase prompts for this UI
       // sessionId are aborted even before a backend session was attached.
       try {
-        await terminalBackend.closeSession(sessionId, { bootEpoch: resolveCloseBootEpoch() });
+        await terminalBackend.closeSession(sessionId, {
+          bootEpoch: resolveCloseBootEpoch(),
+          ...(options?.retainOwnership === true ? { retainOwnership: true } : {}),
+        });
       } catch (err) {
         logger.warn("Failed to cancel pending session boot on disconnect", err);
       }
@@ -1740,7 +1758,10 @@ const TerminalComponent: React.FC<TerminalProps> = ({
         clearTerminalSessionFlowAck(closingSessionId);
       }
       try {
-        await terminalBackend.closeSession(closingSessionId, { bootEpoch: resolveCloseBootEpoch() });
+        await terminalBackend.closeSession(closingSessionId, {
+          bootEpoch: resolveCloseBootEpoch(),
+          ...(options?.retainOwnership === true ? { retainOwnership: true } : {}),
+        });
       } catch (err) {
         logger.warn("Failed to close SSH session", err);
       }
@@ -2511,9 +2532,19 @@ const TerminalComponent: React.FC<TerminalProps> = ({
     if (!shouldEvaluateConnect && !hasPendingWork) return;
     if (connectScriptsInFlightRef.current) return;
 
+    const batch = createConnectAutomationBatch();
+    connectScriptsBatchRef.current = batch;
+    connectScriptsInFlightRef.current = true;
+    const batchStillActive = () => (
+      !batch.controller.signal.aborted && connectScriptsBatchRef.current === batch
+    );
+
     // Defer until xterm has rendered login output and the main-process output tap
     // has populated SessionOutputBuffer (avoids waitForPrompt racing an empty buffer).
+    let timerFired = false;
     const timer = window.setTimeout(() => {
+      timerFired = true;
+      if (!batchStillActive()) return;
       const runPending = Boolean(pendingOne);
       const connectQueueNow = connectScriptsConsumedRef.current
         ? []
@@ -2542,6 +2573,10 @@ const TerminalComponent: React.FC<TerminalProps> = ({
         })) {
           connectScriptsConsumedRef.current = true;
         }
+        if (connectScriptsBatchRef.current === batch) {
+          connectScriptsBatchRef.current = null;
+          connectScriptsInFlightRef.current = false;
+        }
         return;
       }
 
@@ -2550,11 +2585,13 @@ const TerminalComponent: React.FC<TerminalProps> = ({
         connectQueueNow.map((item) => item.id).filter((id): id is string => Boolean(id)),
       );
 
-      connectScriptsInFlightRef.current = true;
-
       void runConnectScriptsSequential({
         scripts: scriptsToRun,
         sessionId,
+        signal: batch.controller.signal,
+        onCancelableRunChange: (stopCurrentRun) => (
+          trackConnectAutomationStop(batch, stopCurrentRun)
+        ),
         sessionMeta: {
           connected: true,
           name: scriptSessionName,
@@ -2562,6 +2599,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
           username: host.username,
         },
         onScriptComplete: (snippet) => {
+          if (!batchStillActive()) return;
           if (snippet.id && connectIdsInBatch.has(snippet.id)) {
             connectScriptsCompletedIdsRef.current.add(snippet.id);
           }
@@ -2575,6 +2613,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
         },
       })
         .then(() => {
+          if (!batchStillActive()) return;
           const resolvedAfterRun = resolveConnectScriptsForHost(host, snippets);
           const doneAfterRun = resolvedAfterRun.length === 0
             || resolvedAfterRun.every(
@@ -2585,6 +2624,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
           }
         })
         .catch(async (err) => {
+          if (!batchStillActive()) return;
           const message = err instanceof Error ? err.message : String(err);
           toast.error(message.includes('Observer mode') ? t('scripts.observer.blocked') : message);
           connectScriptsConsumedRef.current = true;
@@ -2600,6 +2640,10 @@ const TerminalComponent: React.FC<TerminalProps> = ({
             await runConnectScriptsSequential({
               scripts: [pendingScriptToMark],
               sessionId,
+              signal: batch.controller.signal,
+              onCancelableRunChange: (stopCurrentRun) => (
+                trackConnectAutomationStop(batch, stopCurrentRun)
+              ),
               sessionMeta: {
                 connected: true,
                 name: scriptSessionName,
@@ -2607,6 +2651,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
                 username: host.username,
               },
               onScriptComplete: (snippet) => {
+                if (!batchStillActive()) return;
                 if (snippet.id) {
                   pendingScriptRunIdRef.current = snippet.id;
                 } else {
@@ -2615,16 +2660,32 @@ const TerminalComponent: React.FC<TerminalProps> = ({
               },
             });
           } catch (pendingErr) {
+            if (!batchStillActive()) return;
             const pendingMessage = pendingErr instanceof Error ? pendingErr.message : String(pendingErr);
             toast.error(pendingMessage.includes('Observer mode') ? t('scripts.observer.blocked') : pendingMessage);
           }
         })
         .finally(() => {
-          connectScriptsInFlightRef.current = false;
+          if (
+            !batch.controller.signal.aborted
+            && connectScriptsBatchRef.current === batch
+          ) {
+            connectScriptsBatchRef.current = null;
+            connectScriptsInFlightRef.current = false;
+          }
         });
     }, 400);
 
-    return () => window.clearTimeout(timer);
+    return () => {
+      window.clearTimeout(timer);
+      if (!timerFired && connectScriptsBatchRef.current === batch) {
+        batch.controller.abort();
+        connectScriptsBatchRef.current = null;
+        connectScriptsInFlightRef.current = false;
+      } else if (statusRef.current !== "connected") {
+        void cancelConnectAutomationBatch(batch).catch(() => {});
+      }
+    };
   }, [effectiveTerminalProtocol, host, isPendingScriptAlreadyHandled, moshShellReady, pendingScript, pendingScriptId, scriptSessionName, sessionId, snippets, status, t]);
 
   useEffect(() => {
@@ -3013,6 +3074,10 @@ const TerminalComponent: React.FC<TerminalProps> = ({
 
   const executeSnippet = useCallback(async (snippet: Snippet) => {
     if (isScriptSnippet(snippet)) {
+      if (!snippetCanRunInTerminal(snippet, host)) {
+        toast.error(t('scripts.targets.currentHostMismatch'));
+        return;
+      }
       try {
         await runAutomationScript({
           snippet,
@@ -3035,7 +3100,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
     executeSnippetCommand(command, snippet.noAutoRun, {
       multiLineRunMode: snippet.multiLineRunMode,
     });
-  }, [executeSnippetCommand, host.hostname, host.username, scriptSessionName, sessionId, t]);
+  }, [executeSnippetCommand, host, scriptSessionName, sessionId, t]);
 
   const onSnippetShortkeyRef = useRef(executeSnippet);
   onSnippetShortkeyRef.current = executeSnippet;
@@ -3249,7 +3314,7 @@ const TerminalComponent: React.FC<TerminalProps> = ({
     setPendingHostKeyRequestId(null);
     setError(null);
     setProgressLogs((prev) => [...prev, "Disconnected by user."]);
-    void cleanupSession();
+    void cleanupSession({ retainOwnership: true });
     updateStatus("disconnected");
     setChainProgress(null);
     setIsDisconnectedDialogDismissed(false);
@@ -3352,20 +3417,8 @@ const TerminalComponent: React.FC<TerminalProps> = ({
       return;
     }
     if (!termRef.current) return;
-    if (mode === "manual") {
-      clearAutoReconnect();
-      prepareRestoredReconnect();
-      // A clone's first connection can fail (auth/host-key/transport) before the
-      // inherited `cd` is consumed. prepareRestoredReconnect() just cleared the
-      // intent for non-restored sessions, so re-arm it here; the callback no-ops
-      // once the cwd was consumed or when there is no pending inherited cwd.
-      prepareInitialCwdIntent();
-    } else {
-      restoreCwdIntentRef.current = null;
-      suppressHostStartupCommandRef.current = shouldSuppressHostStartupCommandOnReconnect("automatic");
-    }
-    // Claim the retry before awaiting close. A close/cancel/unmount during the
-    // awaited backend cleanup invalidates this token and stops the continuation.
+    // Claim the retry before awaiting either script cancellation or backend
+    // cleanup. A second reconnect/cancel invalidates this continuation.
     const retryToken = Symbol("retry");
     retryTokenRef.current = retryToken;
     reconnectPreparationTokenRef.current = retryToken;
@@ -3376,8 +3429,61 @@ const TerminalComponent: React.FC<TerminalProps> = ({
       }
     };
 
+    const connectAutomationBatch = connectScriptsBatchRef.current;
+    if (connectAutomationBatch) {
+      try {
+        await cancelConnectAutomationBatch(connectAutomationBatch);
+      } catch (error) {
+        finishReconnectPreparation();
+        const message = error instanceof Error ? error.message : String(error);
+        toast.error(message);
+        if (mode === "auto" && retryTokenStillCurrent()) {
+          // Return to disconnected so the existing auto-reconnect loop can
+          // schedule another attempt, including another exact stop request.
+          updateStatus("disconnected");
+        }
+        return;
+      }
+      if (!retryTokenStillCurrent()) {
+        finishReconnectPreparation();
+        return;
+      }
+      if (connectScriptsBatchRef.current === connectAutomationBatch) {
+        connectScriptsBatchRef.current = null;
+        connectScriptsInFlightRef.current = false;
+      }
+    }
+
+    if (mode === "manual") {
+      clearAutoReconnect();
+      // Manual reconnect skips the disconnected status transition that normally
+      // clears these refs, so onConnect scripts would otherwise stay consumed.
+      if (shouldResetConnectAutomationOnReconnect(
+        restoreState === "restored-disconnected" ? "restored" : "manual",
+      )) {
+        // The prior batch is now stopped, so its callbacks cannot mutate these
+        // newly allocated guards for the fresh manual connection.
+        connectScriptsConsumedRef.current = false;
+        connectScriptsCompletedIdsRef.current = new Set();
+        connectScriptsInFlightRef.current = false;
+      }
+      prepareRestoredReconnect();
+      // A clone's first connection can fail (auth/host-key/transport) before the
+      // inherited `cd` is consumed. prepareRestoredReconnect() just cleared the
+      // intent for non-restored sessions, so re-arm it here; the callback no-ops
+      // once the cwd was consumed or when there is no pending inherited cwd.
+      prepareInitialCwdIntent();
+    } else {
+      // An automatic reconnect replaces the transport but remains the same user
+      // session. Stop old automation above, then preserve the existing policy of
+      // not starting onConnect scripts again on the replacement transport.
+      connectScriptsConsumedRef.current = true;
+      restoreCwdIntentRef.current = null;
+      suppressHostStartupCommandRef.current = shouldSuppressHostStartupCommandOnReconnect("automatic");
+    }
+
     try {
-      await cleanupSession();
+      await cleanupSession({ retainOwnership: true });
     } catch (error) {
       finishReconnectPreparation();
       throw error;

components/TerminalLayer.tsx

@@ -220,6 +220,7 @@ const TerminalLayerInner: React.FC<TerminalLayerProps> = ({
   onCreateWorkspaceFromSessions,
   onAddSessionToWorkspace,
   onRequestAddToWorkspace,
+  onAppendHostToWorkspace,
   onUpdateSplitSizes,
   onSetDraggingSessionId,
   onToggleWorkspaceViewMode,
@@ -2107,6 +2108,7 @@ const TerminalLayerInner: React.FC<TerminalLayerProps> = ({
     onCopySession,
     onCopySessionToNewWindow,
     onRequestAddToWorkspace,
+    onAppendHostToWorkspace,
     onSessionData,
     onSetDraggingSessionId,
     onSetWorkspaceFocusedSession,

components/TerminalPopupPage.test.ts

@@ -141,6 +141,10 @@ test('popup terminals resolve complete host config and pass jump hosts into Term
   assert.match(source, /onDeleteSnippets=\{deleteSelectedSnippets\}/);
 });
 
+test('popup terminals use their window-local vault readiness', () => {
+  assert.match(source, /vaultInitializedOverride=\{vaultInitialized\}/);
+});
+
 test('popup provider tree mounts the plugin authentication host', () => {
   assert.match(source, /import \{ PluginAuthenticationHost \} from '\.\/plugins\/PluginAuthenticationHost';/);
   assert.match(

components/TerminalPopupPage.tsx

@@ -467,6 +467,7 @@ function TerminalPopupPageInner() {
               accentMode={settings.accentMode}
               customAccent={settings.customAccent}
               terminalSettings={settings.terminalSettings}
+              vaultInitializedOverride={vaultInitialized}
               disableTerminalFontZoom={settings.disableTerminalFontZoom}
               sessionId={sessionId}
               startupCommand={isAttachMode ? undefined : config.startupCommand}

components/TopTabs.test.ts

@@ -361,6 +361,14 @@ test("workspace session drag data is recognized with a dedicated drag type", ()
   assert.equal(getWorkspaceSessionDragId(transfer), "session-1");
 });
 
+test("TopTabs wires host drops to workspace tabs without replacing tab reorder", () => {
+  assert.match(topTabsSource, /appendHostFromWorkspaceDrop/);
+  assert.match(topTabsSource, /workspaceMap\.has\(targetTabId\)/);
+  assert.match(topTabsSource, /dropEffect = 'copy'/);
+  assert.match(topTabsSource, /isHostDropTarget=\{hostDropWorkspaceId === workspace\.id\}/);
+  assert.match(appViewSource, /<TopTabs[\s\S]*?onAppendHostToWorkspace=\{handleAppendHostToWorkspace\}/);
+});
+
 test("workspace session drag id falls back to the legacy session id", () => {
   const transfer = {
     types: ["session-id"],

components/TopTabs.tsx

@@ -7,6 +7,10 @@ import { buildTabShortcutNumberById } from '../application/app/tabShortcutTarget
 import { useShortcutModifierHeld } from '../application/state/useShortcutModifierHeld';
 import type { EditorTabChrome } from '../application/state/editorTabStore';
 import { collectSessionIds } from '../domain/workspace';
+import {
+  appendHostFromWorkspaceDrop,
+  resolveFocusSidebarDragKind,
+} from '../domain/focusSidebarHostDrop';
 import type { DynamicTabTitleMode, KeyBinding } from '../domain/models';
 
 import { getTopTabInsertionTarget, getWorkspaceSessionDragId, hasWorkspaceSessionDrag } from '../application/state/terminalDragData';
@@ -156,6 +160,7 @@ interface TopTabsProps {
     sessionId: string,
     tabInsertionTarget?: { tabId: string; position: 'before' | 'after'; additionalTabIds?: readonly string[] },
   ) => void;
+  onAppendHostToWorkspace?: (workspaceId: string, hostId: string) => void;
   showSftpTab: boolean;
   showHostTreeSidebar: boolean;
   switchTabKeyBinding: Pick<KeyBinding, 'mac' | 'pc'> | null;
@@ -201,6 +206,7 @@ const TopTabsInner: React.FC<TopTabsProps> = ({
   onEndSessionDrag,
   onReorderTabs,
   onRemoveSessionFromWorkspace,
+  onAppendHostToWorkspace,
   showSftpTab,
   showHostTreeSidebar,
   switchTabKeyBinding,
@@ -260,6 +266,7 @@ const TopTabsInner: React.FC<TopTabsProps> = ({
   // Tab reorder drag state
   const [dropIndicator, setDropIndicator] = useState<{ tabId: string; position: 'before' | 'after' } | null>(null);
   const [isDraggingForReorder, setIsDraggingForReorder] = useState(false);
+  const [hostDropWorkspaceId, setHostDropWorkspaceId] = useState<string | null>(null);
   const draggedTabIdRef = useRef<string | null>(null);
   const [isWindowFullscreen, setIsWindowFullscreen] = useState(false);
 
@@ -521,12 +528,28 @@ const TopTabsInner: React.FC<TopTabsProps> = ({
     draggedTabIdRef.current = null;
     setDropIndicator(null);
     setIsDraggingForReorder(false);
+    setHostDropWorkspaceId(null);
     onEndSessionDrag();
   }, [onEndSessionDrag]);
 
   const handleTabDragOver = useCallback((e: React.DragEvent, tabId: string) => {
+    const dragKind = resolveFocusSidebarDragKind({ types: e.dataTransfer.types });
+    if (dragKind === 'host-append') {
+      if (!onAppendHostToWorkspace || !workspaceMap.has(tabId)) {
+        setHostDropWorkspaceId(null);
+        return;
+      }
+      e.preventDefault();
+      e.stopPropagation();
+      e.dataTransfer.dropEffect = 'copy';
+      setDropIndicator(null);
+      setHostDropWorkspaceId(tabId);
+      return;
+    }
+
     e.preventDefault();
     e.dataTransfer.dropEffect = 'move';
+    setHostDropWorkspaceId(null);
 
     if (hasWorkspaceSessionDrag(e.dataTransfer)) {
       setDropIndicator(null);
@@ -544,16 +567,40 @@ const TopTabsInner: React.FC<TopTabsProps> = ({
 
     // Always update drop indicator on drag over to ensure it doesn't get stuck
     setDropIndicator({ tabId, position });
-  }, []);
+  }, [onAppendHostToWorkspace, workspaceMap]);
 
-  const handleTabDragLeave = useCallback((_e: React.DragEvent) => {
+  const handleTabDragLeave = useCallback((e: React.DragEvent) => {
+    const next = e.relatedTarget;
+    if (next instanceof Node && e.currentTarget.contains(next)) return;
+    setHostDropWorkspaceId(null);
     // Don't clear drop indicator on drag leave - let onDragOver manage it
     // This prevents the indicator from flickering/disappearing during fast drags
     // The indicator will be cleared when drag ends or on drop
   }, []);
 
   const handleTabDrop = useCallback((e: React.DragEvent, targetTabId: string) => {
+    const dragKind = resolveFocusSidebarDragKind({ types: e.dataTransfer.types });
+    if (dragKind === 'host-append') {
+      const handled = Boolean(
+        onAppendHostToWorkspace
+        && workspaceMap.has(targetTabId)
+        && appendHostFromWorkspaceDrop({
+          types: e.dataTransfer.types,
+          getData: (type) => e.dataTransfer.getData(type),
+          workspaceId: targetTabId,
+          onAppendHostToWorkspace,
+        }),
+      );
+      setHostDropWorkspaceId(null);
+      setDropIndicator(null);
+      if (!handled) return;
+      e.preventDefault();
+      e.stopPropagation();
+      return;
+    }
+
     e.preventDefault();
+    setHostDropWorkspaceId(null);
     if (hasWorkspaceSessionDrag(e.dataTransfer)) {
       const draggedSessionId = getWorkspaceSessionDragId(e.dataTransfer);
       const draggedSession = sessions.find((s) => s.id === draggedSessionId);
@@ -582,7 +629,7 @@ const TopTabsInner: React.FC<TopTabsProps> = ({
 
     setDropIndicator(null);
     setIsDraggingForReorder(false);
-  }, [dropIndicator, onEndSessionDrag, onRemoveSessionFromWorkspace, onReorderTabs, sessions, workspaces]);
+  }, [dropIndicator, onAppendHostToWorkspace, onEndSessionDrag, onRemoveSessionFromWorkspace, onReorderTabs, sessions, workspaceMap, workspaces]);
 
   const handleTabBarDrop = useCallback((e: React.DragEvent) => {
     if (!hasWorkspaceSessionDrag(e.dataTransfer)) return;
@@ -872,6 +919,7 @@ const TopTabsInner: React.FC<TopTabsProps> = ({
             shiftStyle={shiftStyle}
             showDropIndicatorBefore={showDropIndicatorBefore}
             showDropIndicatorAfter={showDropIndicatorAfter}
+            isHostDropTarget={hostDropWorkspaceId === workspace.id}
             onTabDragStart={handleTabDragStart}
             onTabDragEnd={handleTabDragEnd}
             onTabDragOver={handleTabDragOver}
@@ -1208,6 +1256,7 @@ export const topTabsAreEqual = (prev: TopTabsProps, next: TopTabsProps): boolean
     prev.onCopySession === next.onCopySession &&
     prev.onCopySessionToNewWindow === next.onCopySessionToNewWindow &&
     prev.onEditHost === next.onEditHost &&
+    prev.onAppendHostToWorkspace === next.onAppendHostToWorkspace &&
     prev.onCopyWorkspace === next.onCopyWorkspace &&
     prev.onOpenSettings === next.onOpenSettings &&
     prev.externalMcpEnabled === next.externalMcpEnabled &&

components/VaultView.sortPersistence.test.tsx

@@ -60,48 +60,66 @@ const renderVault = (sortMode: string | null, hosts: Host[]) => {
   return renderToStaticMarkup(
     React.createElement(
       I18nProvider,
-      { locale: "en" },
-      React.createElement(
-        TooltipProvider,
-        null,
-        React.createElement(VaultView, {
-          hosts,
-          keys: [],
-          identities: [],
-          proxyProfiles: [],
-          snippets: [],
-          snippetPackages: [],
-          customGroups: [],
-          knownHosts: [],
-          managedSources: [],
-          sessionCount: 0,
-          hotkeyScheme: "mac",
-          keyBindings: [],
-          terminalThemeId: "default",
-          terminalFontSize: 14,
-          onOpenSettings: noop,
-          onOpenQuickSwitcher: noop,
-          onCreateLocalTerminal: noop,
-          onDeleteHost: noop,
-          onConnect: noop,
-          onUpdateHosts: noop,
-          onUpdateKeys: noop,
-          onImportOrReuseKey: () => fallbackKey,
-          onUpdateIdentities: noop,
-          onUpdateProxyProfiles: noop,
-          onUpdateSnippets: noop,
-          onUpdateSnippetPackages: noop,
-          onUpdateCustomGroups: noop,
-          onUpdateKnownHosts: noop,
-          onUpdateManagedSources: noop,
-          onConvertKnownHost: noop,
-          onOpenLogView: noop,
-          groupConfigs: [],
-          onUpdateGroupConfigs: noop,
-          showRecentHosts: false,
-          showOnlyUngroupedHostsInRoot: false,
-        }),
-      ),
+      {
+        locale: "en",
+        children: React.createElement(
+          TooltipProvider,
+          null,
+          React.createElement(VaultView, {
+            hosts,
+            keys: [],
+            identities: [],
+            proxyProfiles: [],
+            snippets: [],
+            snippetPackages: [],
+            customGroups: [],
+            knownHosts: [],
+            managedSources: [],
+            sessionCount: 0,
+            hotkeyScheme: "mac",
+            keyBindings: [],
+            terminalThemeId: "default",
+            terminalFontSize: 14,
+            onOpenSettings: noop,
+            onOpenQuickSwitcher: noop,
+            onCreateLocalTerminal: noop,
+            onDeleteHost: noop,
+            onConnect: noop,
+            onUpdateHosts: noop,
+            onUpdateKeys: noop,
+            onImportOrReuseKey: () => fallbackKey,
+            onUpdateIdentities: noop,
+            onUpdateProxyProfiles: noop,
+            onUpdateSnippets: noop,
+            onUpdateSnippetPackages: noop,
+            onUpdateCustomGroups: noop,
+            onUpdateKnownHosts: noop,
+            onUpdateManagedSources: noop,
+            onReadPersistedHosts: async () => hosts,
+            onReadPersistedManagedSources: () => [],
+            onCommitPluginImporterData: async () => 0,
+            onCommitVaultImportTransaction: async () => ({
+              status: "persisted" as const,
+              groups: [],
+              sources: [],
+              groupConfigs: [],
+            }),
+            onCommitVaultGroupMutation: async (mutate) => mutate({
+              groups: [],
+              configs: [],
+              hosts,
+              managedSources: [],
+              snippets: [],
+            }),
+            onConvertKnownHost: noop,
+            onOpenLogView: noop,
+            groupConfigs: [],
+            onUpdateGroupConfigs: noop,
+            showRecentHosts: false,
+            showOnlyUngroupedHostsInRoot: false,
+          }),
+        ),
+      },
     ),
   );
 };

components/VaultView.tsx

@@ -52,6 +52,10 @@ import type { VaultLockHandle } from "../application/state/vaultManagedImportLoc
 import { useTreeExpandedState } from "../application/state/useTreeExpandedState";
 import { useVaultGroupDeletion } from "../application/state/useVaultGroupDeletion";
 import type { VaultHostPersistenceResult } from "../application/state/vaultImportProgress";
+import type {
+  VaultGroupMutationResult,
+  VaultGroupMutationState,
+} from "../domain/vaultGroupMutation";
 import type { PluginImporterCommitRequest } from "../application/state/usePluginImporterCommit";
 import { buildVaultCsvCredentialOptions } from "../application/vaultCsvExportCredentials";
 import { sanitizeCredentialValue } from "../domain/credentials";
@@ -69,6 +73,9 @@ import {
   upsertHostById,
 } from "../domain/host";
 import { exportHostsToCsvWithStats } from "../domain/vaultImport";
+import {
+  remapSnippetTargetGroupPaths,
+} from "../domain/hostGroupPathMutations";
 import {
   reorderVaultItems,
   reorderVaultStrings,
@@ -261,6 +268,10 @@ interface VaultViewProps {
     }
     | { status: "superseded" }
   >;
+  onCommitVaultGroupMutation: (
+    mutate: (current: VaultGroupMutationState) => VaultGroupMutationResult,
+    lock?: VaultLockHandle | null,
+  ) => Promise<VaultGroupMutationResult | { ok: false; superseded: true }>;
   onClearAndRemoveManagedSource?: (source: ManagedSource) => Promise<() => Promise<void>>;
   onClearAndRemoveManagedSources?: (sources: ManagedSource[]) => Promise<() => Promise<void>>;
   onUnmanageSource?: (sourceId: string) => void;
@@ -325,6 +336,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
   onUpdateManagedSources,
   onReadPersistedManagedSources,
   onCommitVaultImportTransaction,
+  onCommitVaultGroupMutation,
   onClearAndRemoveManagedSource,
   onClearAndRemoveManagedSources,
   onUnmanageSource,
@@ -951,7 +963,66 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
     setIsNewFolderOpen(false);
   };
 
-  const submitRenameGroup = () => {
+  const commitGroupPathChange = useCallback(async (
+    sourcePath: string,
+    nextPath: string,
+    replacementConfig?: GroupConfig,
+  ) => {
+    try {
+      return await onCommitVaultGroupMutation((current) => {
+        if (!current.groups.includes(sourcePath)) {
+          return { ok: false, error: `Group "${sourcePath}" was not found.` };
+        }
+        const belongsToTree = (path: string) => (
+          path === sourcePath || path.startsWith(`${sourcePath}/`)
+        );
+        const rename = (path: string) => (
+          path === sourcePath
+            ? nextPath
+            : path.startsWith(`${sourcePath}/`)
+              ? nextPath + path.slice(sourcePath.length)
+              : path
+        );
+        const occupied = new Set([
+          ...current.groups.filter((path) => !belongsToTree(path)),
+          ...current.configs.map((config) => config.path).filter((path) => !belongsToTree(path)),
+        ]);
+        const collision = [
+          ...current.groups,
+          ...current.configs.map((config) => config.path),
+        ].filter(belongsToTree).map(rename).find((path) => occupied.has(path));
+        if (collision) return { ok: false, error: `Group "${collision}" already exists.` };
+
+        const configs = current.configs.map((config) => {
+          if (replacementConfig && config.path === sourcePath) {
+            return { ...replacementConfig, path: nextPath };
+          }
+          return belongsToTree(config.path) ? { ...config, path: rename(config.path) } : config;
+        });
+        if (replacementConfig && !current.configs.some((config) => config.path === sourcePath)) {
+          configs.push({ ...replacementConfig, path: nextPath });
+        }
+        return {
+          ok: true,
+          state: {
+            groups: Array.from(new Set(current.groups.map(rename))),
+            configs,
+            hosts: current.hosts.map((host) => (
+              host.group && belongsToTree(host.group) ? { ...host, group: rename(host.group) } : host
+            )),
+            managedSources: current.managedSources.map((source) => (
+              belongsToTree(source.groupName) ? { ...source, groupName: rename(source.groupName) } : source
+            )),
+            snippets: remapSnippetTargetGroupPaths(current.snippets, sourcePath, nextPath),
+          },
+        };
+      });
+    } catch (error) {
+      return { ok: false as const, error: error instanceof Error ? error.message : String(error) };
+    }
+  }, [onCommitVaultGroupMutation]);
+
+  const submitRenameGroup = async () => {
     if (!renameTargetPath) return;
 
     const nextName = renameGroupName.trim();
@@ -972,37 +1043,11 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
       return;
     }
 
-    const updatedGroups = customGroups.map((g) => {
-      if (g === renameTargetPath) return nextPath;
-      if (g.startsWith(renameTargetPath + "/"))
-        return nextPath + g.slice(renameTargetPath.length);
-      return g;
-    });
-    const updatedHosts = hosts.map((h) => {
-      const g = h.group || "";
-      if (g === renameTargetPath) return { ...h, group: nextPath };
-      if (g.startsWith(renameTargetPath + "/"))
-        return { ...h, group: nextPath + g.slice(renameTargetPath.length) };
-      return h;
-    });
-
-    // Update managed sources if any match the renamed group path
-    const updatedManagedSources = managedSources.map((s) => {
-      if (s.groupName === renameTargetPath)
-        return { ...s, groupName: nextPath };
-      if (s.groupName.startsWith(renameTargetPath + "/"))
-        return {
-          ...s,
-          groupName: nextPath + s.groupName.slice(renameTargetPath.length),
-        };
-      return s;
-    });
-    if (updatedManagedSources.some((s, i) => s !== managedSources[i])) {
-      onUpdateManagedSources(updatedManagedSources);
+    const result = await commitGroupPathChange(renameTargetPath, nextPath);
+    if ("superseded" in result || "error" in result) {
+      setRenameGroupError("superseded" in result ? t("common.error") : result.error);
+      return;
     }
-
-    onUpdateCustomGroups(Array.from(new Set(updatedGroups)));
-    onUpdateHosts(updatedHosts);
     if (
       selectedGroupPath &&
       (selectedGroupPath === renameTargetPath ||
@@ -1026,7 +1071,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
   }, []);
 
   const handleSaveGroupConfig = useCallback(
-    (config: GroupConfig, _newName?: string, _newParent?: string | null) => {
+    async (config: GroupConfig, _newName?: string, _newParent?: string | null) => {
       const oldPath = editingGroupPath!;
       const newPath = config.path; // Panel already computed the correct path
 
@@ -1044,41 +1089,11 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
 
       // Handle path change (rename or parent change)
       if (newPath !== oldPath) {
-        // Update groups, hosts, managed sources, and configs for path change
-        const updatedGroups = customGroups.map((g) => {
-          if (g === oldPath) return newPath;
-          if (g.startsWith(oldPath + "/"))
-            return newPath + g.slice(oldPath.length);
-          return g;
-        });
-        const updatedHosts = hosts.map((h) => {
-          const g = h.group || "";
-          if (g === oldPath) return { ...h, group: newPath };
-          if (g.startsWith(oldPath + "/"))
-            return { ...h, group: newPath + g.slice(oldPath.length) };
-          return h;
-        });
-        const updatedManagedSources = managedSources.map((s) => {
-          if (s.groupName === oldPath) return { ...s, groupName: newPath };
-          if (s.groupName.startsWith(oldPath + "/"))
-            return {
-              ...s,
-              groupName: newPath + s.groupName.slice(oldPath.length),
-            };
-          return s;
-        });
-        if (updatedManagedSources.some((s, i) => s !== managedSources[i])) {
-          onUpdateManagedSources(updatedManagedSources);
+        const result = await commitGroupPathChange(oldPath, newPath, config);
+        if ("superseded" in result || "error" in result) {
+          toast.error("superseded" in result ? t("common.error") : result.error);
+          return;
         }
-        onUpdateCustomGroups(Array.from(new Set(updatedGroups)));
-        onUpdateHosts(updatedHosts);
-        // Update child config paths too
-        const finalConfigs = updatedConfigs.map((c) => {
-          if (c.path.startsWith(oldPath + "/"))
-            return { ...c, path: newPath + c.path.slice(oldPath.length) };
-          return c;
-        });
-        onUpdateGroupConfigs(finalConfigs);
         if (selectedGroupPath === oldPath) setSelectedGroupPath(newPath);
         if (selectedGroupPath?.startsWith(oldPath + "/")) {
           setSelectedGroupPath(
@@ -1096,13 +1111,9 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
       groupConfigs,
       editingGroupPath,
       customGroups,
-      hosts,
-      managedSources,
       selectedGroupPath,
+      commitGroupPathChange,
       onUpdateGroupConfigs,
-      onUpdateCustomGroups,
-      onUpdateHosts,
-      onUpdateManagedSources,
       t,
     ],
   );
@@ -1129,7 +1140,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
     managedSources,
     onReadPersistedHosts,
     onReadPersistedManagedSources,
-    onCommitVaultImportTransaction,
+    onCommitVaultGroupMutation,
     onClearAndRemoveManagedSource,
     onClearAndRemoveManagedSources,
     onDeletedPaths: handleDeletedGroupPaths,
@@ -1138,7 +1149,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
   const deleteGroupPath = (path: string, deleteHosts: boolean = false) =>
     deleteGroupPaths([path], deleteHosts);
 
-  const moveGroup = (sourcePath: string, targetParent: string | null) => {
+  const moveGroup = async (sourcePath: string, targetParent: string | null) => {
     const name = sourcePath.split("/").filter(Boolean).pop() || "";
     const newPath = targetParent ? `${targetParent}/${name}` : name;
     if (newPath === sourcePath || newPath.startsWith(sourcePath + "/")) return;
@@ -1146,50 +1157,17 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
       toast.error(t("vault.groups.errors.duplicatePath"));
       return;
     }
-    const updatedGroups = customGroups.map((g) => {
-      if (g === sourcePath) return newPath;
-      if (g.startsWith(sourcePath + "/"))
-        return newPath + g.slice(sourcePath.length);
-      return g;
-    });
-    const updatedHosts = hosts.map((h) => {
-      const g = h.group || "";
-      if (g === sourcePath) return { ...h, group: newPath };
-      if (g.startsWith(sourcePath + "/"))
-        return { ...h, group: newPath + g.slice(sourcePath.length) };
-      return h;
-    });
-    // Update managed sources if any match the moved group path
-    const updatedManagedSources = managedSources.map((s) => {
-      if (s.groupName === sourcePath) return { ...s, groupName: newPath };
-      if (s.groupName.startsWith(sourcePath + "/"))
-        return {
-          ...s,
-          groupName: newPath + s.groupName.slice(sourcePath.length),
-        };
-      return s;
-    });
-    if (updatedManagedSources.some((s, i) => s !== managedSources[i])) {
-      onUpdateManagedSources(updatedManagedSources);
-    }
-    onUpdateCustomGroups(Array.from(new Set(updatedGroups)));
-    onUpdateHosts(updatedHosts);
-    // Update group configs for moved paths
-    const updatedGroupConfigs = groupConfigs.map((c) => {
-      if (c.path === sourcePath) return { ...c, path: newPath };
-      if (c.path.startsWith(sourcePath + "/"))
-        return { ...c, path: newPath + c.path.slice(sourcePath.length) };
-      return c;
-    });
-    if (updatedGroupConfigs.some((c, i) => c !== groupConfigs[i])) {
-      onUpdateGroupConfigs(updatedGroupConfigs);
+    const result = await commitGroupPathChange(sourcePath, newPath);
+    if ("superseded" in result || "error" in result) {
+      toast.error("superseded" in result ? t("common.error") : result.error);
+      return;
     }
     if (
       selectedGroupPath &&
       (selectedGroupPath === sourcePath ||
         selectedGroupPath.startsWith(sourcePath + "/"))
     ) {
-      setSelectedGroupPath(newPath);
+      setSelectedGroupPath(newPath + selectedGroupPath.slice(sourcePath.length));
     }
   };
 
@@ -1321,8 +1299,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
     hosts,
     managedSources,
     onUpdateCustomGroups,
-    onUpdateHosts,
-    onUpdateManagedSources,
+    onCommitGroupPathChange: commitGroupPathChange,
     selectedGroupPath,
     setSelectedGroupPath,
     ensurePathExpanded: treeExpandedState.ensurePathExpanded,
@@ -1688,6 +1665,7 @@ export const vaultViewAreEqual = (
     prev.onReadPersistedHosts === next.onReadPersistedHosts &&
     prev.onReadPersistedManagedSources === next.onReadPersistedManagedSources &&
     prev.onCommitVaultImportTransaction === next.onCommitVaultImportTransaction &&
+    prev.onCommitVaultGroupMutation === next.onCommitVaultGroupMutation &&
     prev.onCommitPluginImporterData === next.onCommitPluginImporterData &&
     prev.showRecentHosts === next.showRecentHosts &&
     prev.hostClickBehavior === next.hostClickBehavior &&

components/host/HostDetailsScriptsSection.tsx

@@ -1,10 +1,11 @@
-import { Globe, Link2, Play, Trash2 } from 'lucide-react';
+import { FolderTree, Globe, Link2, Play, Trash2 } from 'lucide-react';
 import React, { useCallback, useMemo, useState, type DragEvent } from 'react';
 import type { Host, Snippet } from '@/domain/models';
 import {
   appendHostConnectScript,
   getEditableHostConnectScriptIds,
   getGlobalConnectScripts,
+  getGroupConnectScriptsForHost,
   removeHostConnectScript,
   reorderHostConnectScript,
 } from '@/domain/hostConnectScripts.ts';
@@ -63,6 +64,16 @@ export const HostDetailsScriptsSection: React.FC<HostDetailsScriptsSectionProps>
     () => getEditableHostConnectScriptIds(host, snippets),
     [host, snippets],
   );
+  const groupScripts = useMemo(
+    () => getGroupConnectScriptsForHost(host, snippets).filter(
+      (script) => !script.id || !queueIds.includes(script.id),
+    ),
+    [host, queueIds, snippets],
+  );
+  const groupScriptIds = useMemo(
+    () => new Set(groupScripts.map((script) => script.id)),
+    [groupScripts],
+  );
   const queuedScripts = useMemo(
     () => queueIds
       .map((id) => scriptById(snippets, id))
@@ -73,10 +84,11 @@ export const HostDetailsScriptsSection: React.FC<HostDetailsScriptsSectionProps>
     () => scripts.filter((script) => {
       if (!script.id) return false;
       if (script.targetsAllHosts) return false;
+      if (groupScriptIds.has(script.id)) return false;
       if (queueIds.includes(script.id)) return false;
       return true;
     }),
-    [queueIds, scripts],
+    [groupScriptIds, queueIds, scripts],
   );
   const linkOptions = useMemo(
     () => linkableScripts.map((script) => ({
@@ -170,6 +182,41 @@ export const HostDetailsScriptsSection: React.FC<HostDetailsScriptsSectionProps>
           </div>
         ) : null}
 
+        {groupScripts.length > 0 ? (
+          <div className="space-y-2">
+            <div className="flex items-center gap-1.5">
+              <FolderTree size={12} className="text-muted-foreground shrink-0" />
+              <label className="text-xs text-muted-foreground">
+                {t('hostDetails.automation.groupScripts')}
+              </label>
+            </div>
+            <p className="text-[10px] text-muted-foreground leading-relaxed">
+              {t('hostDetails.automation.groupScriptsHint')}
+            </p>
+            <div className="space-y-1.5">
+              {groupScripts.map((script) => (
+                <div
+                  key={script.id}
+                  className="flex items-center gap-2.5 px-2.5 py-2 rounded-md border border-border/50 bg-primary/5"
+                >
+                  <VaultEntityIcon
+                    className={cn(vaultEntityIconSmClass, vaultAutomationScriptIconClass)}
+                    icon={<Play size={14} />}
+                  />
+                  <div className="min-w-0 flex-1">
+                    <div className="text-sm font-medium truncate">
+                      {script.label || t('scripts.running.unnamed')}
+                    </div>
+                    <div className="text-[10px] text-muted-foreground truncate">
+                      {script.targetGroups?.join(', ')}
+                    </div>
+                  </div>
+                </div>
+              ))}
+            </div>
+          </div>
+        ) : null}
+
         <div className="space-y-2">
           {queuedScripts.length === 0 ? (
             <p className="text-[11px] text-muted-foreground">{t('hostDetails.automation.connectQueueEmpty')}</p>

components/host/HostTreeGroupInlineRenameInput.test.tsx

@@ -0,0 +1,55 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+
+import { HostTreeGroupInlineRenameInput } from './HostTreeGroupInlineRenameInput';
+
+test('inline group rename can retry after an asynchronous commit failure', async () => {
+  const actEnvironment = globalThis as typeof globalThis & {
+    IS_REACT_ACT_ENVIRONMENT?: boolean;
+  };
+  const previousActEnvironment = actEnvironment.IS_REACT_ACT_ENVIRONMENT;
+  actEnvironment.IS_REACT_ACT_ENVIRONMENT = true;
+
+  let renderer: ReactTestRenderer | null = null;
+  let attempts = 0;
+
+  try {
+    await act(async () => {
+      renderer = create(React.createElement(HostTreeGroupInlineRenameInput, {
+        initialName: 'prod',
+        onCommit: async () => {
+          attempts += 1;
+          return attempts > 1;
+        },
+        onCancel: () => undefined,
+      }));
+    });
+    const input = renderer!.root.findByType('input');
+
+    await act(async () => {
+      input.props.onKeyDown({
+        key: 'Enter',
+        preventDefault: () => undefined,
+        stopPropagation: () => undefined,
+      });
+      await Promise.resolve();
+    });
+    await act(async () => {
+      input.props.onKeyDown({
+        key: 'Enter',
+        preventDefault: () => undefined,
+        stopPropagation: () => undefined,
+      });
+      await Promise.resolve();
+    });
+
+    assert.equal(attempts, 2);
+  } finally {
+    await act(async () => {
+      renderer?.unmount();
+    });
+    actEnvironment.IS_REACT_ACT_ENVIRONMENT = previousActEnvironment;
+  }
+});

components/host/HostTreeGroupInlineRenameInput.tsx

@@ -4,7 +4,7 @@ import { cn } from '../../lib/utils';
 
 type HostTreeGroupInlineRenameInputProps = {
   initialName: string;
-  onCommit: (name: string) => void;
+  onCommit: (name: string) => boolean | void | Promise<boolean | void>;
   onCancel: () => void;
   className?: string;
   style?: React.CSSProperties;
@@ -19,7 +19,7 @@ export const HostTreeGroupInlineRenameInput: React.FC<HostTreeGroupInlineRenameI
 }) => {
   const inputRef = useRef<HTMLInputElement>(null);
   const [value, setValue] = useState(initialName);
-  const committedRef = useRef(false);
+  const submittingRef = useRef(false);
 
   useEffect(() => {
     const input = inputRef.current;
@@ -28,15 +28,20 @@ export const HostTreeGroupInlineRenameInput: React.FC<HostTreeGroupInlineRenameI
     input.select();
   }, []);
 
-  const commit = () => {
-    if (committedRef.current) return;
-    committedRef.current = true;
-    onCommit(value);
+  const commit = async () => {
+    if (submittingRef.current) return;
+    submittingRef.current = true;
+    try {
+      const committed = await onCommit(value);
+      if (committed === false) submittingRef.current = false;
+    } catch {
+      submittingRef.current = false;
+    }
   };
 
   const cancel = () => {
-    if (committedRef.current) return;
-    committedRef.current = true;
+    if (submittingRef.current) return;
+    submittingRef.current = true;
     onCancel();
   };
 
@@ -49,7 +54,7 @@ export const HostTreeGroupInlineRenameInput: React.FC<HostTreeGroupInlineRenameI
       onChange={(event) => setValue(event.target.value)}
       onBlur={() => {
         queueMicrotask(() => {
-          commit();
+          void commit();
         });
       }}
       onClick={(event) => event.stopPropagation()}
@@ -64,7 +69,7 @@ export const HostTreeGroupInlineRenameInput: React.FC<HostTreeGroupInlineRenameI
         event.stopPropagation();
         if (event.key === 'Enter') {
           event.preventDefault();
-          commit();
+          void commit();
         }
         if (event.key === 'Escape') {
           event.preventDefault();

components/notes/NotesManager.perf.test.ts

@@ -8,6 +8,25 @@ const layoutSource = readFileSync(
   "utf8",
 );
 
+test("notes tree width resize avoids React setState on every pointermove", () => {
+  // Dragging the sidebar used to call setTreeWidth per pixel and re-render the
+  // whole NotesManager (including MDXEditor). Live width must stay on the DOM
+  // until pointerup commits state + localStorage.
+  assert.match(managerSource, /treeAsideRef/);
+  assert.match(managerSource, /requestAnimationFrame/);
+  assert.match(managerSource, /aside\.style\.width = `\$\{width\}px`/);
+  assert.match(
+    managerSource,
+    /const handlePointerMove = \(moveEvent: PointerEvent\) => \{[\s\S]*?requestAnimationFrame/,
+  );
+  assert.doesNotMatch(
+    managerSource,
+    /const handlePointerMove = \(moveEvent: PointerEvent\) => \{\s*\n\s*setTreeWidth\(/,
+  );
+  assert.match(managerSource, /persistTreeWidth\(nextWidth\)/);
+  assert.match(managerSource, /isTreeResizing && "pointer-events-none"/);
+});
+
 test("note content drafts stay in refs so MDX keystrokes do not rebuild the shell", () => {
   assert.doesNotMatch(
     managerSource,

components/notes/NotesManager.test.tsx

@@ -8,6 +8,7 @@ import { I18nProvider } from "../../application/i18n/I18nProvider.tsx";
 import type { VaultNote } from "../../types.ts";
 import { TooltipProvider } from "../ui/tooltip.tsx";
 import {
+  clampNotesTreeWidth,
   getFallbackNoteSelectionState,
   getNoteActionTargetGroup,
   getNoteGroupSelectionState,
@@ -83,6 +84,36 @@ test("NotesManager balances folder and note tree icon sizes", () => {
   assert.match(markup, /width="16" height="16"[^>]*class="lucide lucide-file-text/);
 });
 
+test("NotesManager tree scroll area constrains width so titles can truncate", () => {
+  const markup = renderNotes();
+
+  // Radix ScrollArea viewport child is display:table by default; force block +
+  // min-w-0 so narrowing the notes sidebar ellipsizes long titles instead of
+  // clipping them. React encodes `&` / `>` in class attributes.
+  assert.match(
+    markup,
+    /data-radix-scroll-area-viewport\](?:>|>)div\]:!block/,
+  );
+  assert.match(
+    markup,
+    /data-radix-scroll-area-viewport\](?:>|>)div\]:!min-w-0/,
+  );
+  assert.match(markup, /data-notes-drop-zone="root"/);
+  assert.match(markup, /min-h-full min-w-0 space-y-1 overflow-hidden/);
+  // Aside stays unclipped so the resize handle's outer half remains hit-testable;
+  // truncation is enforced by the inner tree shell + ScrollArea constraints.
+  assert.match(markup, /aside class="[^"]*min-w-0[^"]*flex-col bg-background/);
+  assert.match(markup, /flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden/);
+  assert.match(markup, /role="separator"/);
+  assert.match(markup, /translate-x-1\/2 cursor-col-resize/);
+});
+
+test("clampNotesTreeWidth keeps the sidebar within the design range", () => {
+  assert.equal(clampNotesTreeWidth(100), 160);
+  assert.equal(clampNotesTreeWidth(300), 300);
+  assert.equal(clampNotesTreeWidth(900), 520);
+});
+
 test("NotesManager selection helpers keep note and folder selection exclusive", () => {
   const notes = [note(), note({ id: "note-2", title: "Deploy", group: "Deploy" })];
   const noteSelection = getNoteSelectionState(notes[0], false);

components/notes/NotesManager.tsx

@@ -100,11 +100,16 @@ type NotesToolbarPanel = "search" | null;
 const toolbarIconButtonClass = "netcatty-tab h-6 w-6 shrink-0 rounded-md p-0 hover:bg-transparent";
 const menuItemClass = "flex h-8 w-full items-center rounded-md px-3 text-left text-sm hover:bg-secondary";
 const NOTES_TREE_DEFAULT_WIDTH = 300;
-const NOTES_TREE_MIN_WIDTH = 220;
+/** Narrow enough for nested folders + ellipsis; toolbar scrolls if needed. */
+const NOTES_TREE_MIN_WIDTH = 160;
 const NOTES_TREE_MAX_WIDTH = 520;
 const NOTE_DRAG_TYPE = "application/x-netcatty-note-id";
 const NOTE_GROUP_DRAG_TYPE = "application/x-netcatty-note-group-path";
 
+export function clampNotesTreeWidth(value: number): number {
+  return Math.max(NOTES_TREE_MIN_WIDTH, Math.min(NOTES_TREE_MAX_WIDTH, value));
+}
+
 export const normalizeNoteEditorMode = (value: string | null): NoteEditorMode | null =>
   value === "edit" || value === "preview" ? value : null;
 
@@ -388,6 +393,9 @@ export const NotesManager: React.FC<NotesManagerProps> = ({
     NOTES_TREE_DEFAULT_WIDTH,
     { min: NOTES_TREE_MIN_WIDTH, max: NOTES_TREE_MAX_WIDTH },
   );
+  const treeAsideRef = useRef<HTMLElement | null>(null);
+  const treeWidthRef = useRef(treeWidth);
+  treeWidthRef.current = treeWidth;
   const searchInputRef = useRef<HTMLInputElement>(null);
   const importFileInputRef = useRef<HTMLInputElement>(null);
   const isImportingMarkdownRef = useRef(false);
@@ -1232,7 +1240,7 @@ export const NotesManager: React.FC<NotesManagerProps> = ({
     return (
       <div
         key={`new-folder-${parent || "root"}`}
-        className="flex h-7 items-center px-2 text-sm"
+        className="flex h-7 min-w-0 items-center px-2 text-sm"
         style={{ paddingLeft: depth * 16 + 4 }}
       >
         <div className="mr-1 h-5 w-4 shrink-0" />
@@ -1444,23 +1452,53 @@ export const NotesManager: React.FC<NotesManagerProps> = ({
     event.stopPropagation();
 
     const startX = event.clientX;
-    const startWidth = treeWidth;
+    const startWidth = treeWidthRef.current;
     const previousCursor = document.body.style.cursor;
     const previousUserSelect = document.body.style.userSelect;
+    const aside = treeAsideRef.current;
+    let frame = 0;
+    let latestWidth = startWidth;
 
+    // Avoid setState on every pointermove — NotesManager owns the MDX editor and
+    // re-rendering it per pixel makes sidebar resize feel stuck.
     setIsTreeResizing(true);
     document.body.style.cursor = "col-resize";
     document.body.style.userSelect = "none";
+    if (aside) {
+      aside.style.willChange = "width";
+    }
 
-    const clampWidth = (value: number) =>
-      Math.max(NOTES_TREE_MIN_WIDTH, Math.min(NOTES_TREE_MAX_WIDTH, value));
-
-    const handlePointerMove = (moveEvent: PointerEvent) => {
-      setTreeWidth(clampWidth(startWidth + moveEvent.clientX - startX));
+    const applyWidth = (width: number) => {
+      latestWidth = width;
+      if (aside) {
+        aside.style.width = `${width}px`;
+      }
     };
 
-    const handlePointerUp = (upEvent: PointerEvent) => {
-      const nextWidth = clampWidth(startWidth + upEvent.clientX - startX);
+    const handlePointerMove = (moveEvent: PointerEvent) => {
+      const nextWidth = clampNotesTreeWidth(startWidth + moveEvent.clientX - startX);
+      if (frame) {
+        latestWidth = nextWidth;
+        return;
+      }
+      latestWidth = nextWidth;
+      frame = window.requestAnimationFrame(() => {
+        frame = 0;
+        applyWidth(latestWidth);
+      });
+    };
+
+    const handlePointerUp = () => {
+      if (frame) {
+        window.cancelAnimationFrame(frame);
+        frame = 0;
+      }
+      const nextWidth = clampNotesTreeWidth(latestWidth);
+      applyWidth(nextWidth);
+      if (aside) {
+        aside.style.willChange = "";
+      }
+      treeWidthRef.current = nextWidth;
       setTreeWidth(nextWidth);
       persistTreeWidth(nextWidth);
       setIsTreeResizing(false);
@@ -1474,7 +1512,7 @@ export const NotesManager: React.FC<NotesManagerProps> = ({
     window.addEventListener("pointermove", handlePointerMove);
     window.addEventListener("pointerup", handlePointerUp);
     window.addEventListener("pointercancel", handlePointerUp);
-  }, [persistTreeWidth, setTreeWidth, treeWidth]);
+  }, [persistTreeWidth, setTreeWidth]);
 
   return (
     <div className="relative flex h-full min-h-0 flex-col overflow-hidden">
@@ -1491,16 +1529,20 @@ export const NotesManager: React.FC<NotesManagerProps> = ({
       <div className="flex min-h-0 flex-1">
         {shouldShowNotesTree && (
           <aside
+            ref={treeAsideRef}
             className={cn(
-              "relative flex flex-col bg-background",
-              isSidebarMode ? "min-w-0 flex-1" : "shrink-0 border-r border-border/60",
+              // min-w-0 on the aside; overflow-hidden stays on the inner tree shell
+              // so the resize separator's translate-x-1/2 hit area is not clipped.
+              "relative flex min-w-0 flex-col bg-background",
+              isSidebarMode ? "flex-1" : "shrink-0 border-r border-border/60",
             )}
             style={isSidebarMode ? undefined : { width: treeWidth }}
           >
-          <div className="flex-shrink-0">
+          <div className="flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden">
+          <div className="min-w-0 flex-shrink-0 overflow-hidden">
             <div className={cn(
               TERMINAL_SIDE_PANEL_INNER_HEADER_CLASS,
-              "flex items-center gap-1 border-b border-border/60 px-1.5",
+              "flex min-w-0 items-center gap-1 overflow-x-auto border-b border-border/60 px-1.5 [scrollbar-width:none] [&::-webkit-scrollbar]:hidden",
             )}>
               <Tooltip>
                 <TooltipTrigger asChild>
@@ -1645,9 +1687,13 @@ export const NotesManager: React.FC<NotesManagerProps> = ({
               </div>
             </div>
           </div>
-          <ScrollArea className="flex-1">
+          {/* Radix ScrollArea viewport child defaults to display:table, which
+              expands to content width and blocks title ellipsis on narrow trees.
+              Force block + min-w-0 so rows shrink with the sidebar (same pattern
+              as AsidePanelContent). */}
+          <ScrollArea className="min-w-0 flex-1 [&>[data-radix-scroll-area-viewport]>div]:!block [&>[data-radix-scroll-area-viewport]>div]:!min-w-0">
             <div
-              className="min-h-full space-y-1 px-1.5 pt-1.5 pb-4"
+              className="min-h-full min-w-0 space-y-1 overflow-hidden px-1.5 pt-1.5 pb-4"
               data-notes-drop-zone="root"
               onDragOver={(event) => {
                 if (!hasNotesTreeDrag(event.dataTransfer)) return;
@@ -1667,6 +1713,7 @@ export const NotesManager: React.FC<NotesManagerProps> = ({
               )}
             </div>
           </ScrollArea>
+          </div>
           {!isSidebarMode && (
             <div
               role="separator"
@@ -1685,7 +1732,14 @@ export const NotesManager: React.FC<NotesManagerProps> = ({
         )}
 
         {!isSidebarMode && (
-        <main className="flex min-w-0 flex-1 flex-col bg-background">
+        <main
+          className={cn(
+            "flex min-w-0 flex-1 flex-col bg-background",
+            // Keep the editor out of hit-testing / paint thrash while the tree
+            // width is driven from the DOM during resize.
+            isTreeResizing && "pointer-events-none",
+          )}
+        >
           {selectedNoteView ? (
             <>
               <div className="flex min-h-[54px] shrink-0 items-center gap-3 px-8 pt-6 pb-1" data-note-title-row>

components/scripts/QuickScriptEditorDialog.tsx

@@ -6,6 +6,7 @@ import {
 } from '@/domain/snippetScript.ts';
 import {
   getRunnableHostsForSnippet,
+  resolveSnippetTargetGroupsForSave,
 } from '@/domain/snippetTargets.ts';
 import {
   removeHostConnectScript,
@@ -54,11 +55,13 @@ export const QuickScriptEditorDialog: React.FC<QuickScriptEditorDialogProps> = (
   const [open, setOpen] = useState(false);
   const [editingSnippet, setEditingSnippet] = useState<Partial<Snippet>>(createBlankScript);
   const [targetSelection, setTargetSelection] = useState<string[]>([]);
+  const [targetGroupSelection, setTargetGroupSelection] = useState<string[]>([]);
 
   useEffect(() => {
     const handler = () => {
       setEditingSnippet(createBlankScript());
       setTargetSelection([]);
+      setTargetGroupSelection([]);
       setOpen(true);
     };
     window.addEventListener('netcatty:scripts:add', handler);
@@ -71,6 +74,7 @@ export const QuickScriptEditorDialog: React.FC<QuickScriptEditorDialogProps> = (
       if (!snippet || !isScriptSnippet(snippet)) return;
       setEditingSnippet(snippet);
       setTargetSelection(snippet.targetsAllHosts ? [] : (snippet.targets ?? []));
+      setTargetGroupSelection(snippet.targetsAllHosts ? [] : (snippet.targetGroups ?? []));
       setOpen(true);
     };
     window.addEventListener('netcatty:snippets:edit', handler);
@@ -112,6 +116,7 @@ export const QuickScriptEditorDialog: React.FC<QuickScriptEditorDialogProps> = (
       if (detail.editAfterSave) {
         setEditingSnippet(snippet);
         setTargetSelection([]);
+        setTargetGroupSelection([]);
         setOpen(true);
       }
     };
@@ -132,8 +137,12 @@ export const QuickScriptEditorDialog: React.FC<QuickScriptEditorDialogProps> = (
   const runnableSnippet = useMemo(() => ({
     ...(editingSnippet as Snippet),
     targets: editingSnippet.targetsAllHosts ? [] : targetSelection,
+    targetGroups: resolveSnippetTargetGroupsForSave(
+      editingSnippet,
+      targetGroupSelection,
+    ),
     targetsAllHosts: editingSnippet.targetsAllHosts || undefined,
-  }), [editingSnippet, targetSelection]);
+  }), [editingSnippet, targetGroupSelection, targetSelection]);
 
   const runTargets = useMemo(
     () => getRunnableHostsForSnippet(runnableSnippet, hosts),
@@ -174,6 +183,10 @@ export const QuickScriptEditorDialog: React.FC<QuickScriptEditorDialogProps> = (
       tags: editingSnippet.tags ?? [],
       package: packagePath,
       targets: editingSnippet.targetsAllHosts ? [] : targetSelection,
+      targetGroups: resolveSnippetTargetGroupsForSave(
+        editingSnippet,
+        targetGroupSelection,
+      ),
       targetsAllHosts: editingSnippet.targetsAllHosts || undefined,
       kind: 'script',
       language: editingSnippet.language ?? 'javascript',
@@ -182,7 +195,7 @@ export const QuickScriptEditorDialog: React.FC<QuickScriptEditorDialogProps> = (
       triggerPattern: editingSnippet.triggerPattern,
       order: editingSnippet.order,
     };
-  }, [editingSnippet, onCreatePackage, packages, targetSelection]);
+  }, [editingSnippet, onCreatePackage, packages, targetGroupSelection, targetSelection]);
 
   const persistSnippet = useCallback((): Snippet | null => {
     const savedSnippet = buildSavedSnippet();
@@ -238,10 +251,12 @@ export const QuickScriptEditorDialog: React.FC<QuickScriptEditorDialogProps> = (
   const handleTargetsAllHostsChange = useCallback((checked: boolean) => {
     if (checked) {
       setTargetSelection([]);
+      setTargetGroupSelection([]);
       setEditingSnippet((prev) => ({
         ...prev,
         targetsAllHosts: true,
         targets: [],
+        targetGroups: undefined,
       }));
       return;
     }
@@ -266,6 +281,8 @@ export const QuickScriptEditorDialog: React.FC<QuickScriptEditorDialogProps> = (
       selectedHostIds={targetSelection}
       onSelectHost={handleSelectHost}
       onSelectionChange={handleSelectionChange}
+      selectedGroupPaths={targetGroupSelection}
+      onGroupSelectionChange={setTargetGroupSelection}
       targetsAllHosts={Boolean(editingSnippet.targetsAllHosts)}
       onTargetsAllHostsChange={handleTargetsAllHostsChange}
     />

components/scripts/ScriptEditorModal.tsx

@@ -5,9 +5,11 @@ import type { Host, Snippet } from '@/domain/models';
 import { DEFAULT_SCRIPT_TEMPLATE } from '@/domain/snippetScript.ts';
 import { scheduleWindowInputFocus } from '@/application/state/windowInputFocus';
 import { SelectHostDialog } from '@/components/SelectHostDialog';
+import { SelectGroupDialog } from '@/components/SelectGroupDialog';
 import { ScriptCodeEditor } from './ScriptCodeEditor';
 import { ScriptMetaFields } from './ScriptMetaFields';
 import { SnippetTargetsSection } from '@/components/snippets/SnippetTargetsSection';
+import { resolveSnippetTargetGroupsForSave } from '@/domain/snippetTargets.ts';
 import { Button } from '@/components/ui/button';
 import { Dialog, DialogContent, DialogTitle } from '@/components/ui/dialog';
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip';
@@ -26,6 +28,8 @@ export interface ScriptEditorModalProps {
   selectedHostIds: string[];
   onSelectHost: (host: Host) => void;
   onSelectionChange?: (selectedHostIds: string[]) => void;
+  selectedGroupPaths?: string[];
+  onGroupSelectionChange?: (selectedGroupPaths: string[]) => void;
   targetsAllHosts?: boolean;
   onTargetsAllHostsChange?: (checked: boolean) => void;
 }
@@ -53,11 +57,14 @@ export const ScriptEditorModal: React.FC<ScriptEditorModalProps> = ({
   selectedHostIds,
   onSelectHost,
   onSelectionChange,
+  selectedGroupPaths = [],
+  onGroupSelectionChange,
   targetsAllHosts = false,
   onTargetsAllHostsChange,
 }) => {
   const { t } = useI18n();
   const [targetPickerOpen, setTargetPickerOpen] = useState(false);
+  const [groupPickerOpen, setGroupPickerOpen] = useState(false);
 
   const handleOpenChange = useCallback((isOpen: boolean) => {
     if (!isOpen) {
@@ -81,9 +88,10 @@ export const ScriptEditorModal: React.FC<ScriptEditorModalProps> = ({
     onChange({
       ...snippet,
       targets: selectedHostIds,
+      targetGroups: resolveSnippetTargetGroupsForSave(snippet, selectedGroupPaths),
       targetsAllHosts: undefined,
     });
-  }, [onChange, selectedHostIds, snippet]);
+  }, [onChange, selectedGroupPaths, selectedHostIds, snippet]);
 
   const language = 'javascript';
   const editorValue = snippet.command || DEFAULT_SCRIPT_TEMPLATE;
@@ -146,9 +154,13 @@ export const ScriptEditorModal: React.FC<ScriptEditorModalProps> = ({
                 variant="embedded"
                 t={t}
                 targetHosts={targetHosts}
+                targetGroups={selectedGroupPaths}
                 onEditTargets={() => {
                   if (!targetsAllHosts) setTargetPickerOpen(true);
                 }}
+                onEditGroups={onGroupSelectionChange ? () => {
+                  if (!targetsAllHosts) setGroupPickerOpen(true);
+                } : undefined}
                 hint={t('scripts.targets.hint')}
                 targetsAllHosts={targetsAllHosts}
                 onTargetsAllHostsChange={onTargetsAllHostsChange}
@@ -192,6 +204,21 @@ export const ScriptEditorModal: React.FC<ScriptEditorModalProps> = ({
         onSelectionChange={onSelectionChange}
         onConfirm={handleTargetsConfirm}
       />
+      <SelectGroupDialog
+        open={groupPickerOpen}
+        onOpenChange={setGroupPickerOpen}
+        hosts={hosts}
+        customGroups={customGroups}
+        selectedGroupPaths={selectedGroupPaths}
+        onSelectionChange={(nextGroups) => {
+          onGroupSelectionChange?.(nextGroups);
+          onChange({
+            ...snippet,
+            targetGroups: nextGroups,
+            targetsAllHosts: undefined,
+          });
+        }}
+      />
     </>
   );
 };

components/settings/tabs/ai/ModelSelector.tsx

@@ -3,6 +3,7 @@ import { Check, ChevronDown, RefreshCw } from "lucide-react";
 import type { AIProviderId, ProviderStyle } from "../../../../infrastructure/ai/types";
 import { resolveProviderStyle } from "../../../../infrastructure/ai/types";
 import { buildModelDiscoveryHeaders, resolveModelsDiscoveryEndpoint } from "../../../../infrastructure/ai/modelDiscoveryHeaders";
+import { buildProviderProbeUrl } from "../../../../infrastructure/ai/providerConnectionProbe";
 import { useI18n } from "../../../../application/i18n/I18nProvider";
 import { Button } from "../../../ui/button";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../../../ui/tooltip";
@@ -150,7 +151,7 @@ export const ModelSelector: React.FC<{
       if (bridge.aiAllowlistAddHost && baseURL) {
         await bridge.aiAllowlistAddHost(baseURL);
       }
-      const url = `${baseURL.replace(/\/+$/, "")}${effectiveModelsEndpoint}`;
+      const url = buildProviderProbeUrl(baseURL, effectiveModelsEndpoint);
       const headers = buildModelDiscoveryHeaders(resolvedStyle, apiKey);
       const result = await bridge.aiFetch(url, "GET", headers, undefined, undefined, undefined, undefined, skipTLSVerify);
       if (!result.ok) {

components/settings/tabs/ai/ProviderConfigForm.tsx

@@ -509,6 +509,9 @@ export const ProviderConfigForm: React.FC<{
           placeholder={preset?.defaultBaseURL || "https://"}
           className="w-full h-8 rounded-md border border-input bg-background px-3 text-sm placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
         />
+        {resolvedStyle === "anthropic" ? (
+          <p className="text-[11px] text-muted-foreground/70">{t('ai.providers.baseUrl.anthropicHelp')}</p>
+        ) : null}
       </div>
 
       {/* Default Model */}

components/sftp/SftpHostPicker.test.ts

@@ -50,7 +50,7 @@ test("sftp host picker uses single-line quick switcher row layout", () => {
   assert.doesNotMatch(source, /text-xs text-muted-foreground truncate/);
 });
 
-test("sftp host picker omits sourceSessionId for sudo connected hosts", () => {
+test("sftp host picker passes sourceSessionId for sudo connected hosts", () => {
   assert.match(source, /sftpSourceSessionIdForHost/);
   assert.match(
     source,
@@ -60,11 +60,6 @@ test("sftp host picker omits sourceSessionId for sudo connected hosts", () => {
     source,
     /onSelectHost\(\s*item\.entry\.host,\s*sourceSessionId \? \{ sourceSessionId \} : undefined,\s*\)/,
   );
-  // Must not always pass sessionId as a reuse hint (sudo would hide the spinner).
-  assert.doesNotMatch(
-    source,
-    /onSelectHost\(item\.entry\.host, \{ sourceSessionId: item\.entry\.sessionId \}\)/,
-  );
 });
 
 test("sftp host picker virtualizes the host list", () => {

components/sftp/sftpSidePanelAutoConnect.test.ts

@@ -4,6 +4,7 @@ import type { SftpPane } from "../../application/state/sftp/types";
 import {
   connectionKeyMatchesHost,
   findReusableSftpSidePanelTab,
+  isPendingSameEndpointSshSession,
   isRemoteSftpTabHealthy,
   shouldAcceptPendingSftpUpload,
   shouldResetSftpSidePanelSourceSession,
@@ -77,6 +78,35 @@ test("shouldSkipSftpSidePanelAutoConnect rejects when the active tab has no endp
   );
 });
 
+test("isPendingSameEndpointSshSession only waits for actively connecting SSH sessions", () => {
+  const host = {
+    id: "host-1",
+    hostname: "server.example",
+    port: 22,
+    username: "root",
+  };
+  const baseSession = {
+    hostId: "host-1",
+    hostname: "server.example",
+    port: 22,
+    username: "root",
+    protocol: "ssh",
+  };
+
+  assert.equal(
+    isPendingSameEndpointSshSession({ ...baseSession, status: "connecting" }, host),
+    true,
+  );
+  assert.equal(
+    isPendingSameEndpointSshSession({ ...baseSession, status: "disconnected" }, host),
+    false,
+  );
+  assert.equal(
+    isPendingSameEndpointSshSession({ ...baseSession, status: "connected" }, host),
+    false,
+  );
+});
+
 test("connectionKeyMatchesHost accepts host-id prefix keys", () => {
   assert.equal(connectionKeyMatchesHost("host-1:server:22:ssh::root", "host-1"), true);
   assert.equal(connectionKeyMatchesHost("host-2:server:22:ssh::root", "host-1"), false);

components/sftp/sftpSidePanelAutoConnect.ts

@@ -33,6 +33,36 @@ export function shouldSkipSftpSidePanelAutoConnect(
   return isRemoteSftpTabHealthy(activeTab, hasBackendSession);
 }
 
+export function isPendingSameEndpointSshSession(
+  session: {
+    hostId?: string | null;
+    status?: string;
+    hostname?: string | null;
+    port?: number | null;
+    username?: string | null;
+    protocol?: string | null;
+    moshEnabled?: boolean;
+    etEnabled?: boolean;
+  },
+  host: {
+    id: string;
+    hostname: string;
+    port?: number | null;
+    username: string;
+  },
+): boolean {
+  return Boolean(
+    session.hostId === host.id
+    && session.status === "connecting"
+    && session.hostname === host.hostname
+    && (session.port ?? 22) === (host.port ?? 22)
+    && session.username === host.username
+    && (session.protocol === "ssh" || session.protocol === undefined)
+    && !session.moshEnabled
+    && !session.etEnabled,
+  );
+}
+
 /** Whether a stored endpoint key still belongs to the live connection's host. */
 export function connectionKeyMatchesHost(
   connectionKey: string | null | undefined,

components/snippets/SnippetTargetsSection.test.tsx

@@ -0,0 +1,47 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { SnippetTargetsSection } from './SnippetTargetsSection';
+
+const t = (key: string) => ({
+  'snippets.targets.title': 'Targets',
+  'snippets.targets.selectHosts': 'Select hosts',
+  'snippets.targets.selectGroups': 'Select groups',
+  'snippets.targets.add': 'Add targets',
+  'snippets.targets.allHosts': 'All hosts',
+  'snippets.targets.allHostsShort': 'All hosts',
+  'snippets.targets.allHostsActive': 'Every host',
+}[key] ?? key);
+
+test('renders dynamic group targets separately from explicit hosts', () => {
+  const markup = renderToStaticMarkup(
+    <SnippetTargetsSection
+      t={t}
+      targetHosts={[]}
+      targetGroups={['Production/Web']}
+      onEditTargets={() => undefined}
+      onEditGroups={() => undefined}
+    />,
+  );
+  assert.match(markup, /Production\/Web/);
+  assert.match(markup, /Select hosts/);
+  assert.match(markup, /Select groups/);
+});
+
+test('all-host mode hides host and group pickers', () => {
+  const markup = renderToStaticMarkup(
+    <SnippetTargetsSection
+      t={t}
+      targetHosts={[]}
+      targetGroups={['Production']}
+      onEditTargets={() => undefined}
+      onEditGroups={() => undefined}
+      targetsAllHosts
+      onTargetsAllHostsChange={() => undefined}
+    />,
+  );
+  assert.doesNotMatch(markup, /Select hosts/);
+  assert.doesNotMatch(markup, /Select groups/);
+  assert.match(markup, /Every host/);
+});

components/snippets/SnippetTargetsSection.tsx

@@ -1,3 +1,4 @@
+import { FolderTree, Server } from 'lucide-react';
 import React from 'react';
 import { DistroAvatar } from '../DistroAvatar';
 import { Button } from '@/components/ui/button';
@@ -10,6 +11,8 @@ export interface SnippetTargetsSectionProps {
   t: (key: string, params?: Record<string, unknown>) => string;
   targetHosts: Host[];
   onEditTargets: () => void;
+  targetGroups?: string[];
+  onEditGroups?: () => void;
   hint?: string;
   variant?: 'card' | 'embedded';
   targetsAllHosts?: boolean;
@@ -25,6 +28,8 @@ const TargetsBody: React.FC<{
   t: SnippetTargetsSectionProps['t'];
   targetHosts: Host[];
   onEditTargets: () => void;
+  targetGroups?: string[];
+  onEditGroups?: () => void;
   hint?: string;
   embedded?: boolean;
   targetsAllHosts?: boolean;
@@ -33,6 +38,8 @@ const TargetsBody: React.FC<{
   t,
   targetHosts,
   onEditTargets,
+  targetGroups = [],
+  onEditGroups,
   hint,
   embedded = false,
   targetsAllHosts = false,
@@ -50,14 +57,28 @@ const TargetsBody: React.FC<{
 
       <div className="flex items-center gap-1 min-w-0">
         {!targetsAllHosts ? (
-          <Button
-            variant="ghost"
-            size="sm"
-            className={cn(actionButtonClass(embedded), 'text-primary')}
-            onClick={onEditTargets}
-          >
-            {targetHosts.length > 0 ? t('action.edit') : t('snippets.targets.add')}
-          </Button>
+          <>
+            <Button
+              variant="ghost"
+              size="sm"
+              className={cn(actionButtonClass(embedded), 'text-primary gap-1')}
+              onClick={onEditTargets}
+            >
+              <Server size={12} />
+              {t('snippets.targets.selectHosts')}
+            </Button>
+            {onEditGroups ? (
+              <Button
+                variant="ghost"
+                size="sm"
+                className={cn(actionButtonClass(embedded), 'text-primary gap-1')}
+                onClick={onEditGroups}
+              >
+                <FolderTree size={12} />
+                {t('snippets.targets.selectGroups')}
+              </Button>
+            ) : null}
+          </>
         ) : null}
 
         {onTargetsAllHostsChange ? (
@@ -91,7 +112,7 @@ const TargetsBody: React.FC<{
       >
         {t('snippets.targets.allHostsActive')}
       </p>
-    ) : targetHosts.length === 0 ? (
+    ) : targetHosts.length === 0 && targetGroups.length === 0 ? (
       embedded ? null : (
         <Button
           variant="secondary"
@@ -103,6 +124,18 @@ const TargetsBody: React.FC<{
       )
     ) : (
       <div className={cn('gap-2', embedded ? 'flex flex-wrap' : 'space-y-2')}>
+        {targetGroups.map((groupPath) => (
+          <div
+            key={`group:${groupPath}`}
+            className={cn(
+              'flex items-center gap-2 rounded-lg border border-border/60 bg-primary/5 max-w-full',
+              embedded ? 'px-2 py-1.5 text-xs' : 'px-3 py-2 text-sm',
+            )}
+          >
+            <FolderTree size={14} className="text-primary shrink-0" />
+            <span className="truncate font-medium">{groupPath}</span>
+          </div>
+        ))}
         {targetHosts.map((host) => (
           embedded ? (
             <div
@@ -133,6 +166,8 @@ export const SnippetTargetsSection: React.FC<SnippetTargetsSectionProps> = ({
   t,
   targetHosts,
   onEditTargets,
+  targetGroups,
+  onEditGroups,
   hint,
   variant = 'card',
   targetsAllHosts,
@@ -143,6 +178,8 @@ export const SnippetTargetsSection: React.FC<SnippetTargetsSectionProps> = ({
       t={t}
       targetHosts={targetHosts}
       onEditTargets={onEditTargets}
+      targetGroups={targetGroups}
+      onEditGroups={onEditGroups}
       hint={hint}
       embedded={variant === 'embedded'}
       targetsAllHosts={targetsAllHosts}

components/systemManager/SystemManagerSidePanel.test.tsx

@@ -64,6 +64,16 @@ test("overview tab reuses the shared server stats source", () => {
   assert.doesNotMatch(source, /backend\.getServerStats/);
 });
 
+test("overview network interfaces show cumulative RX/TX totals alongside rates", () => {
+  const source = readFileSync(new URL("./SystemOverviewTab.tsx", import.meta.url), "utf8");
+
+  assert.match(source, /stats\.netInterfaces\.slice\(0, 5\)\.map/);
+  assert.match(source, /formatBytes\(iface\.rxBytes\)/);
+  assert.match(source, /formatBytes\(iface\.txBytes\)/);
+  assert.match(source, /formatThroughput\(iface\.rxSpeed\)/);
+  assert.match(source, /formatThroughput\(iface\.txSpeed\)/);
+});
+
 test("overview tab stays mounted and only pauses polling while another system tab is active", () => {
   const source = readFileSync(new URL("./SystemManagerSidePanel.tsx", import.meta.url), "utf8");
 

components/systemManager/SystemOverviewTab.tsx

@@ -53,6 +53,7 @@ function formatPercent(value: number | null | undefined, digits = 0): string {
 function formatBytes(bytes: number): string {
   const value = Number(bytes);
   if (!Number.isFinite(value) || value <= 0) return '0 B';
+  if (value >= 1024 ** 4) return `${(value / 1024 ** 4).toFixed(1)} TB`;
   if (value >= 1024 ** 3) return `${(value / 1024 ** 3).toFixed(1)} GB`;
   if (value >= 1024 ** 2) return `${(value / 1024 ** 2).toFixed(1)} MB`;
   if (value >= 1024) return `${(value / 1024).toFixed(1)} KB`;
@@ -396,11 +397,16 @@ export const SystemOverviewTab = memo(function SystemOverviewTab({
             {stats.netInterfaces.length > 0 ? (
               <div className="space-y-2">
                 {stats.netInterfaces.slice(0, 5).map((iface) => (
-                  <div key={iface.name} className="grid grid-cols-[1fr_auto] items-center gap-2 text-[11px]">
-                    <span className="min-w-0 truncate text-foreground">{iface.name}</span>
-                    <span className="shrink-0 tabular-nums text-muted-foreground">
+                  <div key={iface.name} className="space-y-0.5">
+                    <div className="grid grid-cols-[1fr_auto] items-center gap-2 text-[11px]">
+                      <span className="min-w-0 truncate text-foreground">{iface.name}</span>
+                      <span className="shrink-0 tabular-nums text-muted-foreground">
+                        {t('systemManager.overview.rx')} {formatBytes(iface.rxBytes)} · {t('systemManager.overview.tx')} {formatBytes(iface.txBytes)}
+                      </span>
+                    </div>
+                    <div className="text-right text-[10px] tabular-nums text-muted-foreground/80">
                       {t('systemManager.overview.rx')} {formatThroughput(iface.rxSpeed)} · {t('systemManager.overview.tx')} {formatThroughput(iface.txSpeed)}
-                    </span>
+                    </div>
                   </div>
                 ))}
               </div>

components/terminal/TerminalAutocomplete.tsx

@@ -21,6 +21,7 @@ interface TerminalAutocompleteProps {
   termRef: RefObject<XTerm | null>;
   sessionId: string;
   hostId: string;
+  hostGroup?: string;
   hostOs: "linux" | "windows" | "macos";
   settings?: Partial<AutocompleteSettings>;
   protocol?: string;
@@ -63,6 +64,7 @@ export function TerminalAutocomplete({
   termRef,
   sessionId,
   hostId,
+  hostGroup,
   hostOs,
   settings,
   protocol,
@@ -119,6 +121,7 @@ export function TerminalAutocomplete({
         ...(options.cwd ? { cwd: options.cwd } : {}),
       },
       hostOs,
+      hostGroup,
       cwdSource: options.cwdSource,
       snippets: options.snippets,
       maximum: options.maxResults ?? 15,
@@ -126,12 +129,13 @@ export function TerminalAutocomplete({
       signal: options.signal,
       onLatePathSuggestions: options.onLatePathSuggestions,
     });
-  }, [allowHostStyleGreaterThanPrompt, hostId, hostOs, isPluginCompletionProviderAvailable, protocol, sensitiveInputActiveRef, sessionId, settings?.historyScope, status, workspaceId]);
+  }, [allowHostStyleGreaterThanPrompt, hostGroup, hostId, hostOs, isPluginCompletionProviderAvailable, protocol, sensitiveInputActiveRef, sessionId, settings?.historyScope, status, workspaceId]);
   const autocomplete = useTerminalAutocomplete({
     termRef,
     containerRef,
     sessionId,
     hostId,
+    hostGroup,
     hostOs,
     settings,
     onAcceptText,

components/terminal/TerminalContextMenu.test.ts

@@ -20,6 +20,7 @@ const shouldSuppressMouseTrackingContextMenu = (
   terminalContextMenu as {
     shouldSuppressMouseTrackingContextMenu?: (options: {
       isAlternateScreen?: boolean;
+      terminalMouseTrackingMode?: string;
       showReconnectAction?: boolean;
       forceMenuInAlternateScreen?: boolean;
     }) => boolean;
@@ -41,6 +42,7 @@ const shouldOpenTerminalContextMenu = (
       event: { shiftKey?: boolean; nativeEvent: MouseEvent };
       rightClickBehavior?: "context-menu" | "paste" | "select-word";
       isAlternateScreen?: boolean;
+      terminalMouseTrackingMode?: string;
       showReconnectAction?: boolean;
       forceMenuInAlternateScreen?: boolean;
     }) => boolean;
@@ -50,6 +52,7 @@ const shouldRenderTerminalContextMenuContent = (
   terminalContextMenu as {
     shouldRenderTerminalContextMenuContent?: (options: {
       isAlternateScreen?: boolean;
+      terminalMouseTrackingMode?: string;
       showReconnectAction?: boolean;
       allowSuppressedMenuContent?: boolean;
     }) => boolean;
@@ -60,6 +63,7 @@ const shouldAllowSuppressedTerminalContextMenuContent = (
     shouldAllowSuppressedTerminalContextMenuContent?: (options: {
       event: { shiftKey?: boolean; nativeEvent: MouseEvent };
       isAlternateScreen?: boolean;
+      terminalMouseTrackingMode?: string;
       showReconnectAction?: boolean;
     }) => boolean;
   }
@@ -338,6 +342,65 @@ test("opens and renders middle-click menu while alternate-screen mouse tracking
   );
 });
 
+test("uses the current mouse tracking mode when the cached state is stale", () => {
+  assert.equal(typeof shouldOpenTerminalContextMenu, "function");
+  assert.equal(typeof shouldRenderTerminalContextMenuContent, "function");
+  if (
+    typeof shouldOpenTerminalContextMenu !== "function" ||
+    typeof shouldRenderTerminalContextMenuContent !== "function"
+  ) {
+    return;
+  }
+
+  const event = {
+    nativeEvent: {} as MouseEvent,
+  };
+
+  // xterm has already stopped reporting mouse events, but React still has
+  // the previous tracking state: paste/select-word must not be dropped.
+  assert.equal(
+    shouldOpenTerminalContextMenu({
+      event,
+      rightClickBehavior: "paste",
+      isAlternateScreen: true,
+      terminalMouseTrackingMode: "none",
+      showReconnectAction: false,
+    }),
+    false,
+  );
+  assert.equal(
+    shouldRenderTerminalContextMenuContent({
+      isAlternateScreen: true,
+      terminalMouseTrackingMode: "none",
+      showReconnectAction: false,
+      allowSuppressedMenuContent: false,
+    }),
+    true,
+  );
+
+  // Conversely, a newly active xterm mode must still suppress the app menu
+  // while the cached React state has not caught up.
+  assert.equal(
+    shouldOpenTerminalContextMenu({
+      event,
+      rightClickBehavior: "context-menu",
+      isAlternateScreen: false,
+      terminalMouseTrackingMode: "vt200",
+      showReconnectAction: false,
+    }),
+    false,
+  );
+  assert.equal(
+    shouldRenderTerminalContextMenuContent({
+      isAlternateScreen: false,
+      terminalMouseTrackingMode: "vt200",
+      showReconnectAction: false,
+      allowSuppressedMenuContent: false,
+    }),
+    false,
+  );
+});
+
 test("opens Shift right-click menu content for all right-click modes while mouse tracking suppresses unmodified menus", () => {
   assert.equal(typeof shouldOpenTerminalContextMenu, "function");
   assert.equal(typeof shouldRenderTerminalContextMenuContent, "function");

components/terminal/TerminalContextMenu.tsx

@@ -27,7 +27,7 @@ import {
   ContextMenuShortcut,
   ContextMenuTrigger,
 } from '../ui/context-menu';
-import { isMiddleClickContextMenuEvent } from './runtime/middleClickBehavior';
+import { isMiddleClickContextMenuEvent, isMouseTrackingActive } from './runtime/middleClickBehavior';
 import { collectOwnedPluginMenus, comparePluginMenus, usePluginContributions } from '../../application/state/usePluginContributions';
 import { buildTerminalPluginContributionContext } from '../../application/state/pluginContributionContexts';
 import { PluginContributionIcon } from '../plugins/PluginContributionIcon';
@@ -44,6 +44,8 @@ export interface TerminalContextMenuProps {
   keyBindings?: KeyBinding[];
   rightClickBehavior?: RightClickBehavior;
   isAlternateScreen?: boolean;
+  /** Read the current xterm mouse-tracking mode when handling a right-click. */
+  getMouseTrackingMode?: () => string | undefined;
   /** When true, show the app context menu even while a fullscreen app (tmux/vim) holds mouse tracking. */
   showContextMenuOverFullscreenApps?: boolean;
   onCopy?: () => void;
@@ -75,13 +77,22 @@ export const shouldShowReconnectAction = ({
 
 export const shouldSuppressMouseTrackingContextMenu = ({
   isAlternateScreen,
+  terminalMouseTrackingMode,
   showReconnectAction,
   forceMenuInAlternateScreen,
 }: {
   isAlternateScreen?: boolean;
+  terminalMouseTrackingMode?: string;
   showReconnectAction?: boolean;
   forceMenuInAlternateScreen?: boolean;
-}): boolean => Boolean(isAlternateScreen && !showReconnectAction && !forceMenuInAlternateScreen);
+}): boolean => Boolean(
+  isMouseTrackingActive({
+    mouseTracking: Boolean(isAlternateScreen),
+    terminalMouseTrackingMode,
+  })
+  && !showReconnectAction
+  && !forceMenuInAlternateScreen,
+);
 
 export const shouldShowAddSelectionToAIContextMenuAction = (
   onAddSelectionToAI?: () => void,
@@ -93,42 +104,48 @@ export const shouldShowUploadClipboardImageContextMenuAction = (
 
 export const shouldRenderTerminalContextMenuContent = ({
   isAlternateScreen,
+  terminalMouseTrackingMode,
   showReconnectAction,
   allowSuppressedMenuContent,
   forceMenuInAlternateScreen,
 }: {
   isAlternateScreen?: boolean;
+  terminalMouseTrackingMode?: string;
   showReconnectAction?: boolean;
   allowSuppressedMenuContent?: boolean;
   forceMenuInAlternateScreen?: boolean;
 }): boolean =>
   allowSuppressedMenuContent ||
-  !shouldSuppressMouseTrackingContextMenu({ isAlternateScreen, showReconnectAction, forceMenuInAlternateScreen });
+  !shouldSuppressMouseTrackingContextMenu({ isAlternateScreen, terminalMouseTrackingMode, showReconnectAction, forceMenuInAlternateScreen });
 
 export const shouldAllowSuppressedTerminalContextMenuContent = ({
   event,
   isAlternateScreen,
+  terminalMouseTrackingMode,
   showReconnectAction,
   forceMenuInAlternateScreen,
 }: {
   event: { shiftKey?: boolean; nativeEvent: MouseEvent };
   isAlternateScreen?: boolean;
+  terminalMouseTrackingMode?: string;
   showReconnectAction?: boolean;
   forceMenuInAlternateScreen?: boolean;
 }): boolean =>
   isMiddleClickContextMenuEvent(event.nativeEvent)
-  || Boolean(event.shiftKey && shouldSuppressMouseTrackingContextMenu({ isAlternateScreen, showReconnectAction, forceMenuInAlternateScreen }));
+  || Boolean(event.shiftKey && shouldSuppressMouseTrackingContextMenu({ isAlternateScreen, terminalMouseTrackingMode, showReconnectAction, forceMenuInAlternateScreen }));
 
 export const shouldOpenTerminalContextMenu = ({
   event,
   rightClickBehavior = 'context-menu',
   isAlternateScreen,
+  terminalMouseTrackingMode,
   showReconnectAction,
   forceMenuInAlternateScreen,
 }: {
   event: { shiftKey?: boolean; nativeEvent: MouseEvent };
   rightClickBehavior?: RightClickBehavior;
   isAlternateScreen?: boolean;
+  terminalMouseTrackingMode?: string;
   showReconnectAction?: boolean;
   forceMenuInAlternateScreen?: boolean;
 }): boolean => {
@@ -140,7 +157,7 @@ export const shouldOpenTerminalContextMenu = ({
     return true;
   }
 
-  if (shouldSuppressMouseTrackingContextMenu({ isAlternateScreen, showReconnectAction, forceMenuInAlternateScreen })) {
+  if (shouldSuppressMouseTrackingContextMenu({ isAlternateScreen, terminalMouseTrackingMode, showReconnectAction, forceMenuInAlternateScreen })) {
     return false;
   }
 
@@ -159,6 +176,7 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
   keyBindings,
   rightClickBehavior = 'context-menu',
   isAlternateScreen = false,
+  getMouseTrackingMode,
   showContextMenuOverFullscreenApps = false,
   onCopy,
   onPaste,
@@ -233,6 +251,8 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
   const clearShortcut = getShortcut('clear-buffer');
   const showReconnectAction = shouldShowReconnectAction({ isReconnectable, onReconnect });
 
+  const terminalMouseTrackingMode = getMouseTrackingMode?.();
+
   // Handle right-click: intercept for paste/select-word unless Shift is held
   // or rightClickBehavior is 'context-menu'. The ContextMenuTrigger stays always
   // enabled so Shift+Right-Click opens the menu on the first click.
@@ -241,15 +261,17 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
       // In alternate screen (tmux, vim, etc.), let the terminal application
       // handle right-click natively to avoid conflicting menus. Reconnect is
       // still available after disconnect, even if mouse tracking was left on.
+      const currentMouseTrackingMode = getMouseTrackingMode?.();
       const shouldOpenMenu = shouldOpenTerminalContextMenu({
         event: e,
         rightClickBehavior,
         isAlternateScreen,
+        terminalMouseTrackingMode: currentMouseTrackingMode,
         showReconnectAction,
         forceMenuInAlternateScreen: showContextMenuOverFullscreenApps,
       });
 
-      if (!shouldOpenMenu && shouldSuppressMouseTrackingContextMenu({ isAlternateScreen, showReconnectAction, forceMenuInAlternateScreen: showContextMenuOverFullscreenApps })) {
+      if (!shouldOpenMenu && shouldSuppressMouseTrackingContextMenu({ isAlternateScreen, terminalMouseTrackingMode: currentMouseTrackingMode, showReconnectAction, forceMenuInAlternateScreen: showContextMenuOverFullscreenApps })) {
         e.preventDefault();
         return;
       }
@@ -265,6 +287,7 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
         setAllowSuppressedMenuContent(shouldAllowSuppressedTerminalContextMenuContent({
           event: e,
           isAlternateScreen,
+          terminalMouseTrackingMode: currentMouseTrackingMode,
           showReconnectAction,
           forceMenuInAlternateScreen: showContextMenuOverFullscreenApps,
         }));
@@ -279,7 +302,7 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
         onSelectWord?.();
       }
     },
-    [rightClickBehavior, onPaste, onSelectWord, isAlternateScreen, showReconnectAction, showContextMenuOverFullscreenApps],
+    [rightClickBehavior, onPaste, onSelectWord, isAlternateScreen, getMouseTrackingMode, showReconnectAction, showContextMenuOverFullscreenApps],
   );
 
   // Always use ContextMenu wrapper to maintain consistent React tree structure
@@ -294,6 +317,7 @@ export const TerminalContextMenu: React.FC<TerminalContextMenuProps> = ({
       </ContextMenuTrigger>
       {shouldRenderTerminalContextMenuContent({
         isAlternateScreen,
+        terminalMouseTrackingMode,
         showReconnectAction,
         allowSuppressedMenuContent,
         forceMenuInAlternateScreen: showContextMenuOverFullscreenApps,

components/terminal/TerminalServerStats.tsx

@@ -7,7 +7,7 @@ import { HoverCard, HoverCardContent, HoverCardTrigger } from '../ui/hover-card'
 import { Tooltip, TooltipContent, TooltipTrigger } from '../ui/tooltip';
 import { formatNetSpeed } from './terminalHelpers';
 import { useServerStats } from '../../application/state/useServerStats';
-import { formatDiskCapacityGb, resolveTerminalDiskSummary } from './serverStatsFormat';
+import { formatDiskCapacityRange, resolveTerminalDiskSummary } from './serverStatsFormat';
 
 interface TerminalServerStatsProps {
   sessionId: string;
@@ -263,7 +263,7 @@ export const TerminalServerStats: React.FC<TerminalServerStatsProps> = ({
                         diskSummary.percent !== null && diskSummary.percent >= 80 && diskSummary.percent < 90 && "text-amber-400"
                       )}>
                         {diskSummary.used !== null && diskSummary.total !== null && diskSummary.percent !== null
-                          ? `${formatDiskCapacityGb(diskSummary.used)}/${formatDiskCapacityGb(diskSummary.total)}G (${diskSummary.percent}%)`
+                          ? `${formatDiskCapacityRange(diskSummary.used, diskSummary.total)} (${diskSummary.percent}%)`
                           : diskSummary.percent !== null
                             ? `${diskSummary.percent}%`
                             : '--'}
@@ -295,7 +295,7 @@ export const TerminalServerStats: React.FC<TerminalServerStatsProps> = ({
                                   "text-[11px] font-medium whitespace-nowrap",
                                   disk.percent >= 90 ? "text-red-400" : disk.percent >= 80 ? "text-amber-400" : "text-emerald-400"
                                 )}>
-                                  {formatDiskCapacityGb(disk.used)}/{formatDiskCapacityGb(disk.total)}G ({disk.percent}%)
+                                  {formatDiskCapacityRange(disk.used, disk.total)} ({disk.percent}%)
                                 </span>
                               </div>
                               <div className="w-full h-1.5 bg-muted rounded-full overflow-hidden">

components/terminal/TerminalView.test.tsx

@@ -394,7 +394,7 @@ test("manual disconnect keeps the session pane for reconnect", () => {
   assert.match(body, /isBootActiveRef\.current = false/);
   assert.match(body, /setIsCancelling\(true\)/);
   assert.match(body, /updateStatus\("disconnected"\)/);
-  assert.match(body, /void cleanupSession\(\)/);
+  assert.match(body, /void cleanupSession\(\{ retainOwnership: true \}\)/);
   assert.match(source, /trackSessionCleanup/);
   assert.doesNotMatch(body, /onCloseSession/);
   assert.match(source, /handleDisconnect: \(attachExistingSession \|\| compactToolbar\) \? undefined : handleDisconnect/);

components/terminal/TerminalView.tsx

@@ -492,6 +492,7 @@ function TerminalViewInner({ ctx }: { ctx: TerminalViewContext }) {
       keyBindings={keyBindings}
       rightClickBehavior={terminalSettings?.rightClickBehavior}
       isAlternateScreen={hasMouseTracking}
+      getMouseTrackingMode={() => termRef.current?.modes.mouseTrackingMode}
       showContextMenuOverFullscreenApps={terminalSettings?.showContextMenuOverFullscreenApps}
       onCopy={terminalContextActions.onCopy}
       onPaste={terminalContextActions.onPaste}
@@ -992,6 +993,7 @@ function TerminalViewInner({ ctx }: { ctx: TerminalViewContext }) {
             termRef={termRef}
             sessionId={sessionId}
             hostId={host.id}
+            hostGroup={host.group}
             hostOs={autocompleteHostOs}
             settings={autocompleteSettings}
             protocol={effectiveTerminalProtocol ?? resolveEffectiveTerminalProtocol(host)}

components/terminal/ThemeSidePanel.test.ts

@@ -13,3 +13,10 @@ test("hidden selected theme uses the normal theme item row", () => {
   assert.match(source, /hiddenSelectedTheme && \(\s*<ThemeItem/);
   assert.doesNotMatch(source, /terminal\.hiddenTheme\.title[\s\S]*terminal\.hiddenTheme\.desc/);
 });
+
+test("theme side panel tabs are vertically centered in the header", () => {
+  assert.match(
+    source,
+    /TERMINAL_SIDE_PANEL_INNER_HEADER_CLASS, 'flex items-center px-1\.5 gap-0\.5 border-b'/,
+  );
+});

components/terminal/ThemeSidePanel.tsx

@@ -311,7 +311,7 @@ const ThemeSidePanelInner: React.FC<ThemeSidePanelProps> = ({
       >
         {/* Tab Bar */}
         <div
-          className={cn(TERMINAL_SIDE_PANEL_INNER_HEADER_CLASS, 'flex px-1.5 gap-0.5 border-b')}
+          className={cn(TERMINAL_SIDE_PANEL_INNER_HEADER_CLASS, 'flex items-center px-1.5 gap-0.5 border-b')}
           style={{ borderColor: 'var(--terminal-panel-border)' }}
         >
           <button

components/terminal/autocomplete/completionEngine.ts

@@ -242,6 +242,7 @@ export async function getCompletions(
   input: string,
   options: {
     hostId?: string;
+    hostGroup?: string;
     os?: "linux" | "windows" | "macos";
     maxResults?: number;
     /** Session ID for remote path completion */
@@ -397,7 +398,10 @@ export async function getCompletions(
   // a snippet's label collides with an existing history entry's text, the
   // score-sort + final dedup below keeps the snippet (the higher-scored one).
   if (options.snippets && options.snippets.length > 0 && ctx.wordIndex === 0) {
-    for (const snippetSuggestion of getSnippetSuggestions(input, options.snippets, { hostId })) {
+    for (const snippetSuggestion of getSnippetSuggestions(input, options.snippets, {
+      hostId,
+      hostGroup: options.hostGroup,
+    })) {
       suggestions.push(snippetSuggestion);
     }
   }

components/terminal/autocomplete/snippetCompleter.ts

@@ -7,31 +7,37 @@
  * Snippet so the accept path can run it through the canonical executeSnippetCommand.
  */
 import type { Snippet } from "../../../domain/models";
+import { snippetAppliesToHost } from "../../../domain/snippetTargets";
 import { matchesSearchQuery } from "../../../lib/searchMatcher";
 import type { CompletionSuggestion } from "./completionEngine";
 
 const SNIPPET_BASE_SCORE = 2000; // Above history (1000+freq) per "snippet > history".
 const SNIPPET_PREFIX_BONUS = 100;
 
-function snippetAvailableForAutocomplete(snippet: Snippet, hostId?: string): boolean {
+function snippetAvailableForAutocomplete(
+  snippet: Snippet,
+  host: { hostId?: string; hostGroup?: string },
+): boolean {
   if (snippet.targetsAllHosts) return true;
-  if (snippet.targets && snippet.targets.length > 0) {
-    return hostId !== undefined && snippet.targets.includes(hostId);
-  }
-  return true;
+  const hasScopedTargets = Boolean(
+    snippet.targets?.length || snippet.targetGroups !== undefined,
+  );
+  if (!hasScopedTargets) return true;
+  if (!host.hostId) return false;
+  return snippetAppliesToHost(snippet, { id: host.hostId, group: host.hostGroup });
 }
 
 export function getSnippetSuggestions(
   input: string,
   snippets: Snippet[],
-  options: { hostId?: string } = {},
+  options: { hostId?: string; hostGroup?: string } = {},
 ): CompletionSuggestion[] {
   const needle = input.trim().toLowerCase();
   if (!needle || !Array.isArray(snippets)) return [];
 
   const out: CompletionSuggestion[] = [];
   for (const snippet of snippets) {
-    if (!snippetAvailableForAutocomplete(snippet, options.hostId)) continue;
+    if (!snippetAvailableForAutocomplete(snippet, options)) continue;
     const label = (snippet.label || "").toLowerCase();
     const firstLine = (snippet.command || "").split("\n")[0].trim().toLowerCase();
 

components/terminal/autocomplete/terminalCompletionProviders.ts

@@ -13,6 +13,7 @@ import type { AutocompleteHistoryScope, Snippet } from '../../../domain/models';
 export interface TerminalCompletionProviderRequest {
   input: string;
   session: NetcattyTerminalSessionSnapshot;
+  hostGroup?: string;
   hostOs: 'linux' | 'windows' | 'macos';
   cwdSource?: AutocompleteCwdSource;
   snippets?: Snippet[];
@@ -63,6 +64,7 @@ export async function provideTerminalCompletions(
 ): Promise<CompletionSuggestion[]> {
   const builtInPromise = getCompletions(request.input, {
     hostId: request.session.hostId,
+    hostGroup: request.hostGroup,
     os: request.hostOs,
     maxResults: request.maximum,
     sessionId: request.session.sessionId,

components/terminal/autocomplete/useTerminalAutocomplete.ts

@@ -149,6 +149,7 @@ interface UseTerminalAutocompleteOptions {
   containerRef: RefObject<HTMLElement | null>;
   sessionId: string;
   hostId: string;
+  hostGroup?: string;
   hostOs: "linux" | "windows" | "macos";
   settings?: Partial<AutocompleteSettings>;
   /** Callback to write text to the terminal session — replaces CustomEvent */
@@ -200,6 +201,7 @@ export function useTerminalAutocomplete(
     containerRef,
     sessionId,
     hostId,
+    hostGroup,
     hostOs,
     settings: userSettings,
     onAcceptText,
@@ -237,6 +239,8 @@ export function useTerminalAutocomplete(
   onAcceptSnippetRef.current = onAcceptSnippet;
   const hostIdRef = useRef(hostId);
   hostIdRef.current = hostId;
+  const hostGroupRef = useRef(hostGroup);
+  hostGroupRef.current = hostGroup;
   const hostOsRef = useRef(hostOs);
   hostOsRef.current = hostOs;
   const sessionIdRef = useRef(sessionId);
@@ -1048,6 +1052,7 @@ export function useTerminalAutocomplete(
     try {
       completions = await provideCompletionsRef.current(input, {
         hostId: hostIdRef.current,
+        hostGroup: hostGroupRef.current,
         os: hostOsRef.current,
         maxResults: settingsRef.current.maxSuggestions,
         historyScope: settingsRef.current.historyScope,

components/terminal/completionEngineSnippets.test.ts

@@ -19,6 +19,27 @@ test("getCompletions does not surface snippets past the command position", async
   assert.equal(out.find((s) => s.source === "snippet"), undefined);
 });
 
+test("getCompletions applies dynamic group targets to the current host", async () => {
+  const groupedSnippet: Snippet = {
+    ...deploySnippet,
+    targetGroups: ["Production"],
+  };
+
+  const matching = await getCompletions("dep", {
+    hostId: "host-prod",
+    hostGroup: "Production/Web",
+    snippets: [groupedSnippet],
+  });
+  const outside = await getCompletions("dep", {
+    hostId: "host-dev",
+    hostGroup: "Development",
+    snippets: [groupedSnippet],
+  });
+
+  assert.ok(matching.some((suggestion) => suggestion.source === "snippet"));
+  assert.equal(outside.some((suggestion) => suggestion.source === "snippet"), false);
+});
+
 test("getCompletions returns more than 8 snippet matches when default maxSuggestions allows it", async () => {
   const snippets: Snippet[] = Array.from({ length: 20 }, (_, i) => ({
     id: `s${i}`,

components/terminal/connectAutomationBatch.test.ts

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  cancelConnectAutomationBatch,
+  createConnectAutomationBatch,
+  trackConnectAutomationStop,
+} from "./connectAutomationBatch.ts";
+
+test("cancel waits for the stop operation registered by the abort listener", async () => {
+  const batch = createConnectAutomationBatch();
+  let releaseStop: (() => void) | undefined;
+  let stopFinished = false;
+
+  batch.controller.signal.addEventListener("abort", () => {
+    trackConnectAutomationStop(batch, () => new Promise<void>((resolve) => {
+      releaseStop = () => {
+        stopFinished = true;
+        resolve();
+      };
+    }));
+  }, { once: true });
+
+  const cancelling = cancelConnectAutomationBatch(batch);
+  await Promise.resolve();
+  assert.equal(stopFinished, false);
+  releaseStop?.();
+  await cancelling;
+  assert.equal(stopFinished, true);
+});
+
+test("cancel surfaces a backend stop failure", async () => {
+  const batch = createConnectAutomationBatch();
+  batch.controller.signal.addEventListener("abort", () => {
+    trackConnectAutomationStop(batch, async () => {
+      throw new Error("stop failed");
+    });
+  }, { once: true });
+
+  await assert.rejects(() => cancelConnectAutomationBatch(batch), /stop failed/);
+});
+
+test("cancel can retry a stop operation after a transient failure", async () => {
+  const batch = createConnectAutomationBatch();
+  let attempts = 0;
+  trackConnectAutomationStop(batch, async () => {
+    attempts += 1;
+    if (attempts === 1) throw new Error("temporary stop failure");
+  });
+
+  await assert.rejects(
+    () => cancelConnectAutomationBatch(batch),
+    /temporary stop failure/,
+  );
+  await cancelConnectAutomationBatch(batch);
+  assert.equal(attempts, 2);
+});

components/terminal/connectAutomationBatch.ts

@@ -0,0 +1,25 @@
+export interface ConnectAutomationBatch {
+  controller: AbortController;
+  stopCurrentRun: (() => Promise<void>) | null;
+}
+
+export const createConnectAutomationBatch = (): ConnectAutomationBatch => ({
+  controller: new AbortController(),
+  stopCurrentRun: null,
+});
+
+export const trackConnectAutomationStop = (
+  batch: ConnectAutomationBatch,
+  stopCurrentRun: (() => Promise<void>) | null,
+): void => {
+  batch.stopCurrentRun = stopCurrentRun;
+};
+
+export const cancelConnectAutomationBatch = async (
+  batch: ConnectAutomationBatch,
+): Promise<void> => {
+  batch.controller.abort();
+  if (batch.stopCurrentRun) {
+    await batch.stopCurrentRun();
+  }
+};

components/terminal/keywordHighlight.test.ts

@@ -1156,6 +1156,10 @@ test("user scroll during Enter keeps prior highlights mounted", async () => {
       getTranslatedLineIndexes().some((lineY) => lineY >= 10 && lineY < 20),
       "scrollback browsing during Enter should synchronously scan newly revealed lines",
     );
+    assert.ok(
+      decorationStates.some((state) => !state.isDisposed && state.line >= 10 && state.line < 13),
+      "scrollback browsing during Enter should apply highlights on newly revealed lines",
+    );
     raf.flush();
 
     assert.equal(
@@ -1417,7 +1421,9 @@ test("Enter dirty work continues after a queued full refresh", async () => {
     handlers.data?.("\r");
     setLineText(22, "redrawn without a keyword");
     handlers.writeParsed?.();
-    await new Promise((resolve) => { setTimeout(resolve, 340); });
+    // Idle Enter suppresses decoration mutation until the Enter guard clears
+    // (~600ms) so prompt redraw cannot flash still-visible keywords.
+    await new Promise((resolve) => { setTimeout(resolve, 850); });
     raf.flush();
 
     const originalDisposed = originalDecoration.isDisposed;
@@ -1587,15 +1593,99 @@ test("continuous Enter output still refreshes highlights periodically", async ()
 
     handlers.data?.("\r");
     setLineText(22, "DEPLOY");
-    for (let index = 0; index < 20; index += 1) {
-      handlers.writeParsed?.();
-      raf.flush();
-      await new Promise((resolve) => { setTimeout(resolve, 50); });
+    const internals = highlighter as unknown as {
+      lastRefreshTime: number;
+      lastUserInputAt: number;
+    };
+    // Sustained output must be a write burst, not spaced callbacks that look
+    // like a multi-batch prompt redraw.
+    internals.lastUserInputAt = Number.NEGATIVE_INFINITY;
+    const originalPerformance = globalThis.performance;
+    let simulatedNow = 0;
+    Object.defineProperty(globalThis, "performance", {
+      configurable: true,
+      value: {
+        now: () => simulatedNow,
+      },
+    });
+    try {
+      for (let index = 0; index < 12; index += 1) {
+        simulatedNow += 10;
+        internals.lastRefreshTime = Number.NEGATIVE_INFINITY;
+        handlers.writeParsed?.();
+        raf.flush();
+      }
+    } finally {
+      Object.defineProperty(globalThis, "performance", {
+        configurable: true,
+        value: originalPerformance,
+      });
     }
 
     assert.ok(
       decorationStates.some(({ isDisposed }) => !isDisposed),
-      "ongoing output should not postpone new highlights until the stream stops",
+      "ongoing write-burst output should not postpone new highlights until the stream stops",
+    );
+    highlighter.dispose();
+  } finally {
+    raf.restore();
+  }
+});
+
+test("slow post-Enter output still applies highlights after the Enter guard", () => {
+  const raf = installAnimationFrameQueue();
+  try {
+    const { term, decorationStates, handlers, setLineText } = createFakeTerminal("no match", {
+      lineCount: 40,
+    });
+    term.buffer.active.viewportY = 20;
+    term.buffer.active.baseY = 20;
+    term.buffer.active.cursorY = 2;
+    const highlighter = new KeywordHighlighter(term as never);
+    highlighter.setRules([{
+      id: "deploy",
+      label: "Deploy",
+      patterns: ["DEPLOY"],
+      color: "#F87171",
+      enabled: true,
+    }], true);
+    raf.flush();
+    assert.equal(decorationStates.filter(({ isDisposed }) => !isDisposed).length, 0);
+
+    const internals = highlighter as unknown as {
+      lastRefreshTime: number;
+      lastUserInputAt: number;
+    };
+    const originalPerformance = globalThis.performance;
+    let simulatedNow = 1_000;
+    Object.defineProperty(globalThis, "performance", {
+      configurable: true,
+      value: {
+        now: () => simulatedNow,
+      },
+    });
+    try {
+      handlers.data?.("\r");
+      setLineText(22, "DEPLOY");
+      internals.lastUserInputAt = Number.NEGATIVE_INFINITY;
+      // Intervals above WRITE_BURST_INTERVAL_MS never reach the burst
+      // threshold, and each write rearms the real idle timer.
+      for (let index = 0; index < 10; index += 1) {
+        simulatedNow += 80;
+        internals.lastRefreshTime = Number.NEGATIVE_INFINITY;
+        handlers.writeParsed?.();
+        raf.flush();
+      }
+    } finally {
+      Object.defineProperty(globalThis, "performance", {
+        configurable: true,
+        value: originalPerformance,
+      });
+    }
+
+    assert.ok(
+      decorationStates.some(({ isDisposed }) => !isDisposed),
+      "steady non-bursty output should highlight after the Enter window, not wait for a pause",
     );
     highlighter.dispose();
   } finally {
@@ -1923,7 +2013,9 @@ test("Enter input still detects redraws away from the cursor", async () => {
     handlers.data?.("\r");
     setLineText(20, "redrawn without a keyword");
     handlers.writeParsed?.();
-    await new Promise((resolve) => { setTimeout(resolve, 220); });
+    // Idle Enter defers decoration dispose/apply until the Enter guard clears.
+    await new Promise((resolve) => { setTimeout(resolve, 850); });
+    raf.flush();
 
     assert.equal(originalDecoration.isDisposed, true);
     highlighter.dispose();
@@ -2245,6 +2337,301 @@ test("idle Enter scroll before writeParsed does not rescan visible keywords", ()
   }
 });
 
+test("idle Enter scroll before buffer dims update does not rescan", () => {
+  const raf = installAnimationFrameQueue();
+  try {
+    const {
+      term,
+      decorationStates,
+      handlers,
+      getTranslateCount,
+      resetTranslateCount,
+      refreshCalls,
+      resetRefreshCalls,
+    } = createFakeTerminal("hello DEPLOY world", { lineCount: 40 });
+    term.buffer.active.viewportY = 20;
+    term.buffer.active.baseY = 20;
+    term.buffer.active.cursorY = 2;
+    const highlighter = new KeywordHighlighter(term as never);
+    highlighter.setRules([{
+      id: "deploy",
+      label: "Deploy",
+      patterns: ["DEPLOY"],
+      color: "#F87171",
+      enabled: true,
+    }], true);
+    raf.flush();
+    const existingDecorations = [...decorationStates];
+    assert.ok(existingDecorations.length > 0);
+
+    const internals = highlighter as unknown as {
+      lastWriteAt: number;
+      lastRenderRange: { start: number; end: number } | null;
+    };
+    internals.lastWriteAt = performance.now() - 10_000;
+    internals.lastRenderRange = null;
+    resetTranslateCount();
+    resetRefreshCalls();
+
+    // Ubuntu RTT: onScroll can fire while length/baseY/cursor still match the
+    // last snapshot, so output-driven detection is false. Bottom-pinned Enter
+    // must still defer — requiring hasOutputDrivenViewportChange reopens flash.
+    handlers.data?.("\r");
+    handlers.scroll?.();
+
+    assert.equal(
+      getTranslateCount(),
+      0,
+      "Enter-pending bottom scroll without buffer-dim change must not rescan",
+    );
+    assert.deepEqual(
+      refreshCalls,
+      [],
+      "Enter-pending bottom scroll without buffer-dim change must not repaint",
+    );
+    assert.equal(
+      existingDecorations.filter(({ isDisposed }) => isDisposed).length,
+      0,
+      "Enter-pending bottom scroll must keep existing keyword decorations mounted",
+    );
+    highlighter.dispose();
+  } finally {
+    raf.restore();
+  }
+});
+
+test("idle Enter prompt redraw does not repaint existing keyword rows", async () => {
+  const raf = installAnimationFrameQueue();
+  try {
+    const {
+      term,
+      decorationStates,
+      handlers,
+      setLineText,
+      refreshCalls,
+      resetRefreshCalls,
+    } = createFakeTerminal("hello DEPLOY world", { lineCount: 40 });
+    term.buffer.active.viewportY = 20;
+    term.buffer.active.baseY = 20;
+    term.buffer.active.cursorY = 2;
+    const highlighter = new KeywordHighlighter(term as never);
+    highlighter.setRules([
+      {
+        id: "deploy",
+        label: "Deploy",
+        patterns: ["DEPLOY"],
+        color: "#F87171",
+        enabled: true,
+      },
+      {
+        id: "prompt",
+        label: "Prompt",
+        patterns: ["~", "#"],
+        color: "#60A5FA",
+        enabled: true,
+      },
+    ], true);
+    raf.flush();
+    const existingDecorations = [...decorationStates];
+    assert.ok(existingDecorations.length > 0);
+    resetRefreshCalls();
+
+    handlers.data?.("\r");
+    term.buffer.active.viewportY += 1;
+    term.buffer.active.baseY += 1;
+    term.buffer.active.length += 1;
+    // New prompt line matches custom ~/# rules — applying those decorations
+    // makes xterm repaint the full viewport and flashes still-visible keywords.
+    setLineText(22, "user@host:~# ");
+    handlers.scroll?.();
+    handlers.writeParsed?.();
+    await new Promise((resolve) => { setTimeout(resolve, 220); });
+    raf.flush();
+
+    assert.equal(
+      existingDecorations.filter(({ isDisposed }) => isDisposed).length,
+      0,
+      "idle Enter must keep prior keyword decorations mounted",
+    );
+    assert.deepEqual(
+      refreshCalls,
+      [],
+      "idle Enter prompt redraw must not register decorations that force a viewport repaint",
+    );
+    highlighter.dispose();
+  } finally {
+    raf.restore();
+  }
+});
+
+test("idle Enter keeps suppression across split echo and prompt writes", async () => {
+  const raf = installAnimationFrameQueue();
+  try {
+    const {
+      term,
+      decorationStates,
+      handlers,
+      setLineText,
+      refreshCalls,
+      resetRefreshCalls,
+    } = createFakeTerminal("hello DEPLOY world", { lineCount: 40 });
+    term.buffer.active.viewportY = 20;
+    term.buffer.active.baseY = 20;
+    term.buffer.active.cursorY = 2;
+    const highlighter = new KeywordHighlighter(term as never);
+    highlighter.setRules([
+      {
+        id: "deploy",
+        label: "Deploy",
+        patterns: ["DEPLOY"],
+        color: "#F87171",
+        enabled: true,
+      },
+      {
+        id: "prompt",
+        label: "Prompt",
+        patterns: ["~", "#"],
+        color: "#60A5FA",
+        enabled: true,
+      },
+    ], true);
+    raf.flush();
+    const existingDecorations = [...decorationStates];
+    assert.ok(existingDecorations.length > 0);
+    resetRefreshCalls();
+
+    handlers.data?.("\r");
+    // Batch 1: newline echo advances the buffer.
+    term.buffer.active.viewportY += 1;
+    term.buffer.active.baseY += 1;
+    term.buffer.active.length += 1;
+    handlers.scroll?.();
+    handlers.writeParsed?.();
+    await new Promise((resolve) => { setTimeout(resolve, 40); });
+    raf.flush();
+
+    // Batch 2: prompt text for the same idle Enter (custom ~/# matches).
+    setLineText(22, "user@host:~# ");
+    handlers.writeParsed?.();
+    await new Promise((resolve) => { setTimeout(resolve, 40); });
+    raf.flush();
+
+    // Batch 3: trailing mode/control write — still the same prompt redraw,
+    // not sustained command output.
+    handlers.writeParsed?.();
+    await new Promise((resolve) => { setTimeout(resolve, 220); });
+    raf.flush();
+
+    assert.equal(
+      existingDecorations.filter(({ isDisposed }) => isDisposed).length,
+      0,
+      "split idle-Enter writes must keep prior keyword decorations mounted",
+    );
+    assert.deepEqual(
+      refreshCalls,
+      [],
+      "a three-batch idle prompt must not register decorations that flash the viewport",
+    );
+    highlighter.dispose();
+  } finally {
+    raf.restore();
+  }
+});
+
+test("pre-Enter write burst does not lift idle-Enter decoration suppression", () => {
+  const raf = installAnimationFrameQueue();
+  try {
+    const {
+      term,
+      decorationStates,
+      handlers,
+      setLineText,
+      refreshCalls,
+      resetRefreshCalls,
+    } = createFakeTerminal("hello DEPLOY world", { lineCount: 40 });
+    term.buffer.active.viewportY = 20;
+    term.buffer.active.baseY = 20;
+    term.buffer.active.cursorY = 2;
+    const highlighter = new KeywordHighlighter(term as never);
+    highlighter.setRules([
+      {
+        id: "deploy",
+        label: "Deploy",
+        patterns: ["DEPLOY"],
+        color: "#F87171",
+        enabled: true,
+      },
+      {
+        id: "prompt",
+        label: "Prompt",
+        patterns: ["~", "#"],
+        color: "#60A5FA",
+        enabled: true,
+      },
+    ], true);
+    raf.flush();
+    const existingDecorations = [...decorationStates];
+    assert.ok(existingDecorations.length > 0);
+    resetRefreshCalls();
+
+    const internals = highlighter as unknown as {
+      recentWriteBurst: number;
+      lastWriteAt: number;
+      lastBurstDecayAt: number;
+    };
+    const originalPerformance = globalThis.performance;
+    let simulatedNow = 1_000;
+    Object.defineProperty(globalThis, "performance", {
+      configurable: true,
+      value: {
+        now: () => simulatedNow,
+      },
+    });
+    try {
+      internals.recentWriteBurst = 8;
+      internals.lastWriteAt = simulatedNow;
+      internals.lastBurstDecayAt = simulatedNow;
+
+      handlers.data?.("\r");
+      term.buffer.active.viewportY += 1;
+      term.buffer.active.baseY += 1;
+      term.buffer.active.length += 1;
+      handlers.scroll?.();
+      simulatedNow += 5;
+      handlers.writeParsed?.();
+      raf.flush();
+
+      setLineText(22, "user@host:~# ");
+      simulatedNow += 5;
+      handlers.writeParsed?.();
+      raf.flush();
+
+      simulatedNow += 5;
+      handlers.writeParsed?.();
+      raf.flush();
+    } finally {
+      Object.defineProperty(globalThis, "performance", {
+        configurable: true,
+        value: originalPerformance,
+      });
+    }
+
+    assert.equal(
+      existingDecorations.filter(({ isDisposed }) => isDisposed).length,
+      0,
+      "stale pre-Enter burst must not dispose still-visible keyword decorations",
+    );
+    assert.deepEqual(
+      refreshCalls,
+      [],
+      "stale pre-Enter burst must not register prompt decorations that flash the viewport",
+    );
+    highlighter.dispose();
+  } finally {
+    raf.restore();
+  }
+});
+
 test("Enter without write clears pending so later user scroll can highlight", async () => {
   const raf = installAnimationFrameQueue();
   try {

components/terminal/keywordHighlight.ts

@@ -123,6 +123,18 @@ export class KeywordHighlighter implements IDisposable {
   private enterQueuedWriteCancellationPending = false;
   private enterViewportScanInProgress = false;
   private enterViewportScanNeedsRepeat = false;
+  /** True while idle-Enter output should not mutate decorations (xterm full-viewport repaint flash). */
+  private enterSuppressDecorationMutation = false;
+  /**
+   * Whether onWriteParsed has already observed the current Enter submission.
+   * Prompt redraw can span several writeParsed batches (control sequences,
+   * prompt text, mode sets); callback count is not a sustained-output signal.
+   */
+  private enterWriteParsedSeen = false;
+  /** performance.now() when the current Enter started suppressing mutations. */
+  private enterSuppressionStartedAt = 0;
+  /** Viewport browsing state before the latest scroll handler ran. */
+  private wasBrowsingScrollback = false;
   private static readonly DIRTY_SCAN_PADDING = XTERM_PERFORMANCE_CONFIG.highlighting.dirtyScanPadding;
   private static readonly INPUT_QUIET_MS = XTERM_PERFORMANCE_CONFIG.highlighting.inputQuietMs;
   private static readonly WRITE_BURST_INTERVAL_MS = 28;
@@ -154,6 +166,17 @@ export class KeywordHighlighter implements IDisposable {
         if (data.includes("\r") || data.includes("\n")) {
           this.enterInputPending = true;
           this.enterQueuedWriteCancellationPending = true;
+          // First prompt redraw after Enter must not register/dispose decorations:
+          // xterm repaints the full viewport on decoration mutation and flashes
+          // still-visible keyword highlights (custom ~/# rules make this obvious).
+          this.enterSuppressDecorationMutation = true;
+          this.enterWriteParsedSeen = false;
+          this.enterSuppressionStartedAt = performance.now();
+          // Pre-Enter burst must not lift mute on a split prompt. Keep
+          // lastWriteAt so output-driven scroll detection still works before
+          // the first post-Enter updateWriteBurst.
+          this.recentWriteBurst = 0;
+          this.lastBurstDecayAt = 0;
           // Time-bound Enter protection even when no echo/write arrives (echo
           // off, stalled PTY). onWriteParsed re-arms this on each write.
           this.scheduleEnterInputIdleClear();
@@ -224,11 +247,25 @@ export class KeywordHighlighter implements IDisposable {
         const inputProtectionActive = this.isInputProtectionActive(performance.now());
         if (inputProtectionActive || this.enterInputPending) {
           if (this.enterInputPending) {
-            if (this.enterViewportScanInProgress) {
+            if (this.enterWriteParsedSeen) {
               this.updateWriteBurst();
-              this.enterViewportScanNeedsRepeat = true;
+              // Multi-batch prompt redraw is still not command output. Keep
+              // decoration mute until a write burst or the Enter idle guard.
+              if (this.shouldLiftEnterDecorationSuppression()) {
+                this.enterSuppressDecorationMutation = false;
+              }
+              if (this.enterViewportScanInProgress) {
+                this.enterViewportScanNeedsRepeat = true;
+              } else {
+                const buffer = this.term.buffer.active;
+                this.addDirtyRange(buffer.viewportY, buffer.viewportY + this.term.rows - 1);
+                this.enterViewportScanInProgress = true;
+              }
             } else {
+              this.enterWriteParsedSeen = true;
               this.markDirtyFromWrite({ includeViewportProbe: false });
+              // Index the viewport while muted so multi-frame Enter continuation
+              // can finish; decoration mutate stays suppressed for idle prompt.
               const buffer = this.term.buffer.active;
               this.addDirtyRange(buffer.viewportY, buffer.viewportY + this.term.rows - 1);
               this.enterViewportScanInProgress = true;
@@ -266,6 +303,7 @@ export class KeywordHighlighter implements IDisposable {
       })
     );
     this.lastBufferSnapshot = this.readBufferSnapshot();
+    this.wasBrowsingScrollback = this.isBrowsingScrollback();
   }
 
   public setRules(rules: readonly RuntimeKeywordHighlightRule[], enabled: boolean) {
@@ -430,6 +468,9 @@ export class KeywordHighlighter implements IDisposable {
     this.enterQueuedWriteCancellationPending = false;
     this.enterViewportScanInProgress = false;
     this.enterViewportScanNeedsRepeat = false;
+    this.enterSuppressDecorationMutation = false;
+    this.enterWriteParsedSeen = false;
+    this.enterSuppressionStartedAt = 0;
     if (hadDecorations) {
       this.term.refresh(0, this.term.rows - 1);
     }
@@ -715,16 +756,23 @@ export class KeywordHighlighter implements IDisposable {
 
   private triggerViewportChangeRefresh() {
     const isBrowsingScrollback = this.isBrowsingScrollback();
+    // End (or other jump-to-bottom) while Enter is pending: we were browsing
+    // scrollback and just landed on the bottom without waiting for echo.
+    // Distinguish that from idle-Enter echo still pinned at the bottom.
+    const returningToBottomFromScrollback =
+      this.wasBrowsingScrollback && !isBrowsingScrollback;
+    this.wasBrowsingScrollback = isBrowsingScrollback;
     // Enter echo often emits onScroll before onWriteParsed. After an idle gap
     // lastWriteAt looks stale and lastRenderRange is usually null (cleared by
     // the previous write refresh), so the output-driven scroll path would
     // synchronously rescan the viewport and flash keywords still on screen.
-    // Keep real scrollback browsing synchronous; only defer the bottom-pinned
-    // viewport movement that can be caused by the pending Enter echo.
+    // Keep real scrollback browsing synchronous; defer bottom-pinned Enter
+    // echo even when buffer dims have not updated yet (Ubuntu RTT). Do not
+    // require hasOutputDrivenViewportChange — that hole reopened the flash.
     if (
       this.enterInputPending
       && !isBrowsingScrollback
-      && this.hasOutputDrivenViewportChange()
+      && !returningToBottomFromScrollback
     ) {
       if (this.pendingRefreshReason === "scroll") {
         this.cancelQueuedRefreshSchedule();
@@ -1086,6 +1134,9 @@ export class KeywordHighlighter implements IDisposable {
     this.enterInputIdleTimer = setTimeout(() => {
       this.enterInputIdleTimer = null;
       this.enterInputPending = false;
+      this.enterSuppressDecorationMutation = false;
+      this.enterWriteParsedSeen = false;
+      this.enterSuppressionStartedAt = 0;
       // Catch up any viewport motion deferred while Enter protection blocked
       // scroll refresh (e.g. user scrolled during the post-Enter window).
       this.markVisibleRangeDirty();
@@ -1093,6 +1144,23 @@ export class KeywordHighlighter implements IDisposable {
     }, KeywordHighlighter.ENTER_INPUT_GUARD_MS);
   }
 
+  /**
+   * True when follow-up Enter writes look like sustained command output.
+   * WriteParsed callback count alone cannot prove that — a split prompt may
+   * need three (or more) batches — so a write burst lifts mute early.
+   * Slow streams never burst and keep rearming the idle timer; after the
+   * Enter window, prompt redraw is done and mutation is safe.
+   */
+  private shouldLiftEnterDecorationSuppression(): boolean {
+    if (!this.enterSuppressDecorationMutation) return false;
+    const now = performance.now();
+    if (this.isWriteBurstActive(now)) return true;
+    return (
+      this.enterSuppressionStartedAt > 0
+      && now - this.enterSuppressionStartedAt >= KeywordHighlighter.ENTER_INPUT_GUARD_MS
+    );
+  }
+
   private isBrowsingScrollback(): boolean {
     const buffer = this.term.buffer.active;
     return buffer.viewportY < buffer.baseY;
@@ -1516,16 +1584,25 @@ export class KeywordHighlighter implements IDisposable {
     if (end < start) return;
     const buffer = this.term.buffer.active;
     const pressure = getTerminalOutputPressure(this.term);
+    // Idle Enter must not mutate prompt-area decorations (xterm full-viewport
+    // flash). A real scrollback browse still needs new decorations: the scroll
+    // path records lastRenderRange even when this guard skips apply.
+    const allowEnterBrowseDecorations = this.enterSuppressDecorationMutation
+      && this.isBrowsingScrollback();
     for (let lineY = start; lineY <= end; lineY++) {
       const line = buffer.getLine(lineY);
       if (!line) {
-        this.disposeLineDecorations(lineY);
+        if (!this.enterSuppressDecorationMutation) {
+          this.disposeLineDecorations(lineY);
+        }
         continue;
       }
 
       const lineText = line.translateToString(true); // true = trim right whitespace
       if (!lineText) {
-        this.disposeLineDecorations(lineY);
+        if (!this.enterSuppressDecorationMutation) {
+          this.disposeLineDecorations(lineY);
+        }
         continue;
       }
 
@@ -1536,7 +1613,9 @@ export class KeywordHighlighter implements IDisposable {
           : this.scanWrappedLine(buffer, lineY, line, lineText, wrappedBlockCache)
         : this.getCachedRanges(line, lineText);
       if (cachedRanges.length === 0) {
-        this.disposeLineDecorations(lineY);
+        if (!this.enterSuppressDecorationMutation) {
+          this.disposeLineDecorations(lineY);
+        }
         continue;
       }
 
@@ -1553,6 +1632,18 @@ export class KeywordHighlighter implements IDisposable {
         continue;
       }
 
+      // Idle Enter: keep prior decorations mounted. Scrollback browse still
+      // creates decorations on unindexed lines so matches are visible before
+      // the 600ms guard; lines that already have decorations stay untouched.
+      if (this.enterSuppressDecorationMutation) {
+        if (!allowEnterBrowseDecorations) {
+          continue;
+        }
+        if (existing && existing.decorations.length > 0) {
+          continue;
+        }
+      }
+
       this.disposeLineDecorations(lineY, existing);
       this.applyLineDecorations(lineY, cachedRanges, signature, cursorAbsoluteY);
     }

components/terminal/restoredSessionGate.test.ts

@@ -4,6 +4,8 @@ import { readFileSync } from "node:fs";
 
 import {
   getInitialTerminalStatus,
+  resolveTerminalVaultInitialized,
+  shouldResetConnectAutomationOnReconnect,
   shouldSuppressHostStartupCommandOnReconnect,
   shouldStartTerminalBackend,
 } from "./restoredSessionGate.ts";
@@ -41,12 +43,108 @@ test("terminal boot waits for vaultInitialized before creating a backend session
   );
 });
 
+test("terminal popup can supply its own completed vault hydration state", () => {
+  const terminalSource = readFileSync(new URL("../Terminal.tsx", import.meta.url), "utf8");
+  const popupSource = readFileSync(new URL("../TerminalPopupPage.tsx", import.meta.url), "utf8");
+
+  assert.match(
+    terminalSource,
+    /const vaultInitialized = resolveTerminalVaultInitialized\(\s*sharedVaultInitialized,\s*vaultInitializedOverride,\s*\);/,
+  );
+  assert.match(popupSource, /vaultInitializedOverride=\{vaultInitialized\}/);
+  assert.equal(resolveTerminalVaultInitialized(false, true), true);
+  assert.equal(resolveTerminalVaultInitialized(false), false);
+  assert.equal(resolveTerminalVaultInitialized(true, false), false);
+});
+
 test("host startup command policy distinguishes restored and automatic reconnects", () => {
   assert.equal(shouldSuppressHostStartupCommandOnReconnect("restored"), false);
   assert.equal(shouldSuppressHostStartupCommandOnReconnect("manual"), false);
   assert.equal(shouldSuppressHostStartupCommandOnReconnect("automatic"), true);
 });
 
+test("connect automation reset policy distinguishes manual and automatic reconnects", () => {
+  assert.equal(shouldResetConnectAutomationOnReconnect("manual"), true);
+  assert.equal(shouldResetConnectAutomationOnReconnect("restored"), true);
+  assert.equal(shouldResetConnectAutomationOnReconnect("automatic"), false);
+});
+
+test("manual reconnect resets connect automation before opening a new session", () => {
+  const source = readFileSync(new URL("../Terminal.tsx", import.meta.url), "utf8");
+  const reconnectIndex = source.indexOf("const startReconnect = ");
+  const cancelBatchIndex = source.indexOf(
+    "await cancelConnectAutomationBatch(connectAutomationBatch)",
+    reconnectIndex,
+  );
+  const manualBranchIndex = source.indexOf('if (mode === "manual")', reconnectIndex);
+  const stopFailureRetryIndex = source.indexOf(
+    'if (mode === "auto" && retryTokenStillCurrent())',
+    cancelBatchIndex,
+  );
+  const stopFailureDisconnectedIndex = source.indexOf(
+    'updateStatus("disconnected")',
+    stopFailureRetryIndex,
+  );
+  const resetConsumedIndex = source.indexOf(
+    "connectScriptsConsumedRef.current = false",
+    manualBranchIndex,
+  );
+  const resetCompletedIndex = source.indexOf(
+    "connectScriptsCompletedIdsRef.current = new Set()",
+    manualBranchIndex,
+  );
+  const resetInFlightIndex = source.indexOf(
+    "connectScriptsInFlightRef.current = false",
+    manualBranchIndex,
+  );
+  const connectingIndex = source.indexOf('updateStatus("connecting")', manualBranchIndex);
+  const autoElseIndex = source.indexOf("} else {", manualBranchIndex);
+  const autoSuppressIndex = source.indexOf(
+    'shouldSuppressHostStartupCommandOnReconnect("automatic")',
+    autoElseIndex,
+  );
+
+  assert.notEqual(reconnectIndex, -1);
+  assert.notEqual(cancelBatchIndex, -1);
+  assert.notEqual(manualBranchIndex, -1);
+  assert.notEqual(stopFailureRetryIndex, -1);
+  assert.notEqual(stopFailureDisconnectedIndex, -1);
+  assert.notEqual(resetConsumedIndex, -1);
+  assert.notEqual(resetCompletedIndex, -1);
+  assert.notEqual(resetInFlightIndex, -1);
+  assert.notEqual(connectingIndex, -1);
+  assert.notEqual(autoElseIndex, -1);
+  assert.notEqual(autoSuppressIndex, -1);
+  assert.ok(
+    cancelBatchIndex < manualBranchIndex
+      && cancelBatchIndex < resetConsumedIndex
+      && cancelBatchIndex < resetCompletedIndex
+      && cancelBatchIndex < resetInFlightIndex,
+    "every reconnect must await onConnect cancellation before manual guards are cleared",
+  );
+  assert.ok(
+    stopFailureRetryIndex < stopFailureDisconnectedIndex
+      && stopFailureDisconnectedIndex < manualBranchIndex,
+    "automatic reconnect must return to disconnected when stopping the old batch fails",
+  );
+  assert.ok(
+    resetConsumedIndex < connectingIndex && resetCompletedIndex < connectingIndex,
+    "manual reconnect must clear connect-automation consumption before status becomes connecting",
+  );
+  assert.ok(
+    autoElseIndex < autoSuppressIndex && autoSuppressIndex < connectingIndex,
+    "automatic reconnect must keep the existing connect-automation consumption decision",
+  );
+  assert.ok(
+    !source.slice(autoElseIndex, connectingIndex).includes("connectScriptsConsumedRef.current = false"),
+    "automatic reconnect must not reset connect-automation refs",
+  );
+  assert.match(
+    source.slice(autoElseIndex, connectingIndex),
+    /connectScriptsConsumedRef\.current = true/,
+    "automatic reconnect must stop the old batch without queuing it again",
+  );
+});
 test("restored disconnected sessions still create a terminal runtime before backend startup", () => {
   const source = readFileSync(new URL("./useTerminalEffects.ts", import.meta.url), "utf8");
   const runtimeIndex = source.indexOf("const runtime = createXTermRuntime");

components/terminal/restoredSessionGate.ts

@@ -7,6 +7,11 @@ export const getInitialTerminalStatus = (): TerminalSession["status"] => (
   "connecting"
 );
 
+export const resolveTerminalVaultInitialized = (
+  sharedVaultInitialized: boolean,
+  windowVaultInitialized?: boolean,
+): boolean => windowVaultInitialized ?? sharedVaultInitialized;
+
 /**
  * Backend start waits for vault hydration so restored sessions cannot dial SSH
  * with empty keys while hosts have already been published mid-init.
@@ -16,3 +21,11 @@ export const shouldStartTerminalBackend = (): boolean => isVaultInitialized();
 export const shouldSuppressHostStartupCommandOnReconnect = (
   mode: TerminalReconnectMode,
 ): boolean => mode === "automatic";
+
+/**
+ * Manual and restored reconnects are a fresh "connect" for automation scripts.
+ * Automatic reconnect after a drop must not re-run onConnect scripts mid-session.
+ */
+export const shouldResetConnectAutomationOnReconnect = (
+  mode: TerminalReconnectMode,
+): boolean => mode !== "automatic";

components/terminal/runtime/middleClickBehavior.test.ts

@@ -70,6 +70,27 @@ test("mouse-tracking context menu capture lets Shift-modified mouse events pass
   );
 });
 
+test("mouse-tracking context menu capture prefers the terminal's current mode over stale cached state", () => {
+  assert.equal(
+    shouldInterceptMouseTrackingContextMenu({
+      event: { shiftKey: false } as MouseEvent,
+      mouseTracking: false,
+      terminalMouseTrackingMode: "vt200",
+      status: "connected",
+    }),
+    true,
+  );
+  assert.equal(
+    shouldInterceptMouseTrackingContextMenu({
+      event: { shiftKey: false } as MouseEvent,
+      mouseTracking: true,
+      terminalMouseTrackingMode: "none",
+      status: "connected",
+    }),
+    false,
+  );
+});
+
 test("mouse-tracking context menu capture yields to the fullscreen-apps menu setting for context-menu clicks", () => {
   // Setting on + context-menu behavior: do NOT intercept, so Radix opens the menu.
   assert.equal(
@@ -255,6 +276,31 @@ test("right-click mousedown is stopped when the fullscreen-apps menu setting for
   );
 });
 
+test("right-click mousedown also uses the terminal's current mode", () => {
+  assert.equal(
+    shouldStopShiftRightClickMouseTrackingMouseDown({
+      event: { button: 2, shiftKey: false } as MouseEvent,
+      mouseTracking: false,
+      terminalMouseTrackingMode: "vt200",
+      status: "connected",
+      rightClickBehavior: "context-menu",
+      forceMenuInAlternateScreen: true,
+    }),
+    true,
+  );
+  assert.equal(
+    shouldStopShiftRightClickMouseTrackingMouseDown({
+      event: { button: 2, shiftKey: false } as MouseEvent,
+      mouseTracking: true,
+      terminalMouseTrackingMode: "none",
+      status: "connected",
+      rightClickBehavior: "context-menu",
+      forceMenuInAlternateScreen: true,
+    }),
+    false,
+  );
+});
+
 test("Shift right-click mousedown capture is limited to connected mouse tracking", () => {
   const baseEvent = {
     button: 2,

components/terminal/runtime/middleClickBehavior.ts

@@ -16,6 +16,8 @@ type ShiftSelectionReplayMouseEvent = MouseEvent & {
 export interface MouseTrackingContextMenuCaptureState {
   event: MouseEvent;
   mouseTracking: boolean;
+  /** Current xterm mouse tracking mode, when available at event time. */
+  terminalMouseTrackingMode?: string;
   status?: string | null;
   /** The user's configured right-click action. */
   rightClickBehavior?: RightClickBehavior;
@@ -33,6 +35,8 @@ export interface ShiftMouseSelectionReplayState {
 export interface ShiftRightClickMouseDownCaptureState {
   event: MouseEvent;
   mouseTracking: boolean;
+  /** Current xterm mouse tracking mode, when available at event time. */
+  terminalMouseTrackingMode?: string;
   status?: string | null;
   /** The user's configured right-click action. */
   rightClickBehavior?: RightClickBehavior;
@@ -90,14 +94,23 @@ const forcesMenuOverMouseTracking = ({
   forceMenuInAlternateScreen?: boolean;
 }): boolean => Boolean(forceMenuInAlternateScreen && rightClickBehavior === "context-menu");
 
+export const isMouseTrackingActive = ({
+  mouseTracking,
+  terminalMouseTrackingMode,
+}: Pick<MouseTrackingContextMenuCaptureState, "mouseTracking" | "terminalMouseTrackingMode">): boolean =>
+  terminalMouseTrackingMode === undefined
+    ? mouseTracking
+    : terminalMouseTrackingMode !== "none";
+
 export const shouldInterceptMouseTrackingContextMenu = ({
   event,
   mouseTracking,
+  terminalMouseTrackingMode,
   status,
   rightClickBehavior,
   forceMenuInAlternateScreen,
 }: MouseTrackingContextMenuCaptureState): boolean =>
-  mouseTracking
+  isMouseTrackingActive({ mouseTracking, terminalMouseTrackingMode })
   && status === "connected"
   && !event.shiftKey
   && !isMiddleClickContextMenuEvent(event)
@@ -122,11 +135,12 @@ export const shouldReplayShiftMouseSelectionAsMacOption = ({
 export const shouldStopShiftRightClickMouseTrackingMouseDown = ({
   event,
   mouseTracking,
+  terminalMouseTrackingMode,
   status,
   rightClickBehavior,
   forceMenuInAlternateScreen,
 }: ShiftRightClickMouseDownCaptureState): boolean =>
-  mouseTracking
+  isMouseTrackingActive({ mouseTracking, terminalMouseTrackingMode })
   && status === "connected"
   && event.button === 2
   && (event.shiftKey || forcesMenuOverMouseTracking({ rightClickBehavior, forceMenuInAlternateScreen }));

components/terminal/serverStatsFormat.test.ts

@@ -3,6 +3,7 @@ import assert from "node:assert/strict";
 
 import {
   formatDiskCapacityGb,
+  formatDiskCapacityRange,
   resolveTerminalDiskSummary,
 } from "./serverStatsFormat.ts";
 
@@ -14,6 +15,32 @@ test("disk capacity uses at most two decimal places", () => {
   assert.equal(formatDiskCapacityGb(10.5), "10.5");
 });
 
+test("disk capacity stays in G below a terabyte", () => {
+  assert.equal(formatDiskCapacityRange(71.12, 878.15), "71.12/878.15G");
+  assert.equal(formatDiskCapacityRange(0.01, 0.5), "0.01/0.5G");
+  // 1023 GiB is still the largest value rendered in G.
+  assert.equal(formatDiskCapacityRange(1, 1023), "1/1023G");
+});
+
+test("disk capacity switches to T once a value reaches a terabyte", () => {
+  // Both sides in terabytes: one shared suffix.
+  assert.equal(formatDiskCapacityRange(8807.55, 118736.4), "8.6/115.95T");
+  assert.equal(formatDiskCapacityRange(2048, 4096), "2/4T");
+});
+
+test("disk capacity keeps the used figure when the sides differ in scale", () => {
+  // A total-driven unit would render these as 0.13/6.93T and 0/6.93T,
+  // discarding how much is actually in use.
+  assert.equal(formatDiskCapacityRange(136.37, 7096.47), "136.37G/6.93T");
+  assert.equal(formatDiskCapacityRange(3.25, 7096.47), "3.25G/6.93T");
+  assert.equal(formatDiskCapacityRange(1, 1024), "1G/1T");
+});
+
+test("disk capacity switches to P for petabyte-scale pools", () => {
+  assert.equal(formatDiskCapacityRange(1_048_576, 2_097_152), "1/2P");
+  assert.equal(formatDiskCapacityRange(512, 2_097_152), "512G/2P");
+});
+
 test("terminal disk summary totals every mounted filesystem", () => {
   const summary = resolveTerminalDiskSummary({
     diskUsed: 9.285,

components/terminal/serverStatsFormat.ts

@@ -20,6 +20,42 @@ export function formatDiskCapacityGb(value: number): string {
   return Number(value.toFixed(2)).toString();
 }
 
+/** Capacity units, ascending from the GiB the collectors report in. */
+const DISK_CAPACITY_UNITS = ["G", "T", "P"] as const;
+
+/** Pick the largest unit that keeps a GiB value at or above 1. */
+export function resolveDiskCapacityUnit(valueGb: number): { unit: string; divisor: number } {
+  let divisor = 1;
+  let index = 0;
+  while (
+    Math.abs(valueGb) / divisor >= 1024
+    && index < DISK_CAPACITY_UNITS.length - 1
+  ) {
+    divisor *= 1024;
+    index += 1;
+  }
+  return { unit: DISK_CAPACITY_UNITS[index], divisor };
+}
+
+/**
+ * Render a used/total pair, both reported in GiB.
+ *
+ * Each side is scaled independently so a mostly-empty multi-terabyte pool keeps
+ * its used figure — `136.37G/6.93T` rather than the `0.13/6.93T` a total-driven
+ * unit would produce, or the unreadable `136.37/7096.47G` of a fixed one. When
+ * both land in the same unit the suffix is written once, keeping the familiar
+ * `71.12/878.15G` shape for ordinary disks.
+ */
+export function formatDiskCapacityRange(usedGb: number, totalGb: number): string {
+  const used = resolveDiskCapacityUnit(usedGb);
+  const total = resolveDiskCapacityUnit(totalGb);
+  const usedText = formatDiskCapacityGb(usedGb / used.divisor);
+  const totalText = formatDiskCapacityGb(totalGb / total.divisor);
+  return used.unit === total.unit
+    ? `${usedText}/${totalText}${total.unit}`
+    : `${usedText}${used.unit}/${totalText}${total.unit}`;
+}
+
 export function resolveTerminalDiskSummary(
   stats: TerminalDiskStats,
 ): TerminalDiskSummary {