feat: Stop archives a session, Sleep keeps it; SSH keys per type (#82); update Auto fix

- Stop (a tab's or pane's X, Close tab) now archives the session it held (DELETE /api/run/:id?archive=1); the new Sleep (moon left of the X, and in the tab, pane and session right-click menus) stops the pane but keeps the session listed to resume later. Shared endRuns in client/src/lib/stopSession.ts. - Git identity (#82): an account keeps an ED25519 AND an RSA key (AWS CodeCommit takes only RSA), every ssh git offers both, and a member's ~/.gitconfig gets core.sshCommand so a git typed in a terminal uses them. - Update dialog: Auto fix starts a Claude Code session on the install folder with the failed update's error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 11:51:26 +07:00
parent 58be04a4e7
commit 0a1dcfeb7f
28 changed files with 813 additions and 225 deletions
@@ -16,9 +16,13 @@
 * — and the poll waits for the old server to actually go DOWN first, because it
 * keeps answering while the chain installs. New skills/slash commands still
 * need `/reload-plugins` in an already-open Claude Code session; nothing a
- * background process can do for it. Escape, the backdrop and "Not now" close it
- * for this page load only (never while applying); "Skip this version" is the
- * one persistent, per-version dismiss.
+ * background process can do for it. Escape, the backdrop and × close it for
+ * this page load only (never while applying); "Skip this version" is the one
+ * persistent, per-version dismiss. After a failed update, "Auto fix" hands the
+ * error to an AI agent: it opens (or adopts) a workspace on the install folder
+ * and starts a Claude Code session there with the error as its prompt — the
+ * agent fixes whatever blocked the update (a dirty lockfile, a failed build…)
+ * and runs the update command; the dashboard itself still decides nothing.
 *
 * ## State sources
 * - Initial fetch via `api.updates.status()` on mount.
@@ -81,7 +85,18 @@

 import { useCallback, useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Download, X, Copy, Check, RefreshCw, Zap, ExternalLink } from "lucide-react";
+import { useNavigate } from "react-router-dom";
+import {
+  Download,
+  X,
+  Copy,
+  Check,
+  RefreshCw,
+  Zap,
+  ExternalLink,
+  SkipForward,
+  Wrench,
+} from "lucide-react";
 import { api } from "../lib/api";
 import { eventBus } from "../lib/eventBus";
 import { copyText } from "../lib/clipboard";
@@ -89,6 +104,7 @@ import { toast } from "../lib/toast";
 import { useDialog } from "../hooks/useDialog";
 import type { UpdateStatusPayload, WSMessage } from "../lib/types";
 import { usePermissions } from "./AuthGate";
+import { startInFreeTab } from "./lanes/startSession";

 /** `localStorage` key storing the dismissed release tag (or upstream SHA). */
 const DISMISS_KEY = "agent-monitor-update-dismissed-sha";
@@ -107,6 +123,32 @@ function isAutoApplicable(situation: UpdateStatusPayload["situation"]): boolean
  );
 }

+/** The prompt the Auto fix session starts with: what failed, where, and the
+ *  limits that keep the agent from taking down the dashboard it runs under. */
+function autoFixPrompt(status: UpdateStatusPayload, error: string): string {
+  const target = status.latest_release || status.remote_ref || "the newest version";
+  const plugin = status.situation === "plugin_managed";
+  return [
+    `The AgentHub dashboard's self-update to ${target} failed${status.local_version ? ` (running ${status.local_version})` : ""}.`,
+    plugin
+      ? "AgentHub is installed as a Claude Code plugin (the `agenthub` plugin from the `agenthub` marketplace)."
+      : `The install is the git checkout at ${status.repo_root}.`,
+    "",
+    "Error:",
+    "```",
+    error,
+    "```",
+    ...(status.manual_command ? ["", "Update command:", "```", status.manual_command, "```"] : []),
+    "",
+    "Find the cause, fix it, then finish the update" +
+      (plugin
+        ? " (`claude plugin marketplace update agenthub` then `claude plugin update agenthub@agenthub`)."
+        : " by running the update command."),
+    "Rules: never lose the user's work — before discarding any local change, save it (e.g. `git diff > ~/agenthub-update-backup.patch`) and say where; do not stop or restart the AgentHub server, and never kill tmux sessions or the tmux server (this session runs inside one).",
+    "When done, tell me what you changed; I will restart the dashboard from its update prompt.",
+  ].join("\n");
+}
+
 /** Narrow unknown WebSocket payloads to {@link UpdateStatusPayload}. */
 function isUpdatePayload(x: unknown): x is UpdateStatusPayload {
  return typeof x === "object" && x !== null && "git_repo" in x && "update_available" in x;
@@ -130,7 +172,7 @@ export function UpdateNotifier() {
  const { t } = useTranslation("updates");
  const [status, setStatus] = useState<UpdateStatusPayload | null>(null);
  const [dismissedSha, setDismissedSha] = useState<string | null>(loadDismissedSha);
-  // Closed for THIS page load only (Escape, backdrop, ×, "Not now") — the
+  // Closed for THIS page load only (Escape, backdrop, ×) — the
  // persistent per-version dismiss is the explicit "Skip this version".
  const [closedKey, setClosedKey] = useState<string | null>(null);
  const panelRef = useRef<HTMLDivElement>(null);
@@ -139,6 +181,8 @@ export function UpdateNotifier() {
  const [checking, setChecking] = useState(false);
  const [applying, setApplying] = useState(false);
  const [restarting, setRestarting] = useState(false);
+  const [fixing, setFixing] = useState(false);
+  const navigate = useNavigate();

  const syncFromPayload = useCallback((s: UpdateStatusPayload) => {
    setStatus(s);
@@ -200,7 +244,7 @@ export function UpdateNotifier() {
    dismissedSha !== dismissKey &&
    closedKey !== dismissKey
  );
-  const busy = applying || restarting;
+  const busy = applying || restarting || fixing;

  const closeForNow = useCallback(() => {
    if (busy || !dismissKey) return;
@@ -317,6 +361,29 @@ export function UpdateNotifier() {
    }
  };

+  // Hand the failure to an AI agent: a workspace on the install folder (the
+  // home for a plugin install — never a lane inside the plugin cache) and a
+  // Claude Code session there with the error as its first prompt.
+  const autoFix = async () => {
+    if (busy || !status || !error) return;
+    setFixing(true);
+    try {
+      const plugin = status.situation === "plugin_managed";
+      const { lane } = await api.lanes.ensure({
+        ...(plugin || !status.repo_root ? {} : { cwd: status.repo_root, exact: true }),
+        title: t("autoFixWorkspace"),
+        tool: "claude",
+      });
+      const runId = await startInFreeTab(lane.id, { prompt: autoFixPrompt(status, error) });
+      if (dismissKey) setClosedKey(dismissKey);
+      navigate(`/workspace?lane=${lane.id}&run=${encodeURIComponent(runId)}`);
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : t("autoFixError"));
+    } finally {
+      setFixing(false);
+    }
+  };
+
  if (!show || !status) return null;

  const refLabel = status.remote_ref || "origin";
@@ -493,16 +560,9 @@ export function UpdateNotifier() {
            title={t("skipVersionHint")}
            className="btn-ghost disabled:opacity-60 disabled:cursor-not-allowed"
          >
+            <SkipForward className="w-3.5 h-3.5" aria-hidden />
            {t("skipVersion")}
          </button>
-          <button
-            type="button"
-            onClick={closeForNow}
-            disabled={busy}
-            className="btn-ghost disabled:opacity-60 disabled:cursor-not-allowed"
-          >
-            {t("later")}
-          </button>
          {status.manual_command ? (
            <button
              type="button"
@@ -514,11 +574,28 @@ export function UpdateNotifier() {
              {copied ? t("copied") : t("copy")}
            </button>
          ) : null}
+          {/* Only after a failed update: an AI agent takes the error from here. */}
+          {error ? (
+            <button
+              type="button"
+              onClick={autoFix}
+              disabled={busy}
+              title={t("autoFixHint")}
+              className="btn-ghost disabled:opacity-60 disabled:cursor-not-allowed"
+            >
+              {fixing ? (
+                <RefreshCw className="w-3.5 h-3.5 animate-spin" aria-hidden />
+              ) : (
+                <Wrench className="w-3.5 h-3.5" aria-hidden />
+              )}
+              {t("autoFix")}
+            </button>
+          ) : null}
          {isAutoApplicable(status.situation) ? (
            <button
              type="button"
              onClick={applyNow}
-              disabled={applying || restarting}
+              disabled={busy}
              className="btn-primary disabled:opacity-70"
            >
              {applying || restarting ? (
@@ -19,6 +19,18 @@ import type { UpdateStatusPayload } from "../../lib/types";
 const statusMock = vi.fn();
 const checkMock = vi.fn();
 const applyMock = vi.fn();
+const ensureMock = vi.fn();
+const startMock = vi.fn();
+const navigateMock = vi.fn();
+
+vi.mock("react-router-dom", async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  useNavigate: () => navigateMock,
+}));
+
+vi.mock("../lanes/startSession", () => ({
+  startInFreeTab: (...args: unknown[]) => startMock(...args),
+}));

 vi.mock("../../lib/api", async (importOriginal) => {
  const actual = await importOriginal<Record<string, unknown>>();
@@ -30,6 +42,7 @@ vi.mock("../../lib/api", async (importOriginal) => {
        check: (...args: unknown[]) => checkMock(...args),
        apply: (...args: unknown[]) => applyMock(...args),
      },
+      lanes: { ensure: (...args: unknown[]) => ensureMock(...args) },
    },
  };
 });
@@ -56,6 +69,9 @@ beforeEach(() => {
  statusMock.mockReset().mockResolvedValue(BASE_STATUS);
  checkMock.mockReset().mockResolvedValue(BASE_STATUS);
  applyMock.mockReset();
+  ensureMock.mockReset().mockResolvedValue({ lane: { id: 7 }, created: true });
+  startMock.mockReset().mockResolvedValue("agenthub-lane-7-1");
+  navigateMock.mockReset();
  try {
    localStorage.clear();
  } catch {
@@ -274,7 +290,7 @@ describe("UpdateNotifier — closing vs skipping", () => {

  it("Check for updates re-opens a modal closed with Later", async () => {
    render(<UpdateNotifier />);
-    await userEvent.click(await screen.findByText(i18n.t("updates:later")));
+    await userEvent.click(await screen.findByRole("button", { name: i18n.t("updates:later") }));
    await waitFor(() =>
      expect(screen.queryByText(i18n.t("updates:title"))).not.toBeInTheDocument()
    );
@@ -290,3 +306,26 @@ describe("UpdateNotifier — closing vs skipping", () => {
    expect(screen.getByText(i18n.t("updates:title"))).toBeInTheDocument();
  });
 });
+
+describe("UpdateNotifier — Auto fix", () => {
+  it("offers no Not now button, and Auto fix only once an update failed", async () => {
+    applyMock.mockRejectedValue(new Error("Command failed: git merge --ff-only v2.8.0"));
+    render(<UpdateNotifier />);
+    await screen.findByText(i18n.t("updates:updateNow"));
+    expect(screen.queryByText(i18n.t("updates:later"))).not.toBeInTheDocument();
+    expect(screen.queryByText(i18n.t("updates:autoFix"))).not.toBeInTheDocument();
+
+    await userEvent.click(screen.getByText(i18n.t("updates:updateNow")));
+    await userEvent.click(await screen.findByText(i18n.t("updates:autoFix")));
+
+    await waitFor(() => expect(navigateMock).toHaveBeenCalled());
+    expect(ensureMock).toHaveBeenCalledWith(
+      expect.objectContaining({ cwd: "/repo", exact: true, tool: "claude" })
+    );
+    const [laneId, body] = startMock.mock.calls[0] ?? [];
+    expect(laneId).toBe(7);
+    expect(body.prompt).toContain("git merge --ff-only v2.8.0");
+    expect(body.prompt).toContain(BASE_STATUS.manual_command);
+    expect(navigateMock).toHaveBeenCalledWith("/workspace?lane=7&run=agenthub-lane-7-1");
+  });
+});
@@ -254,7 +254,7 @@ describe("WorkspaceTree", () => {
    let menu = screen.getByTestId("session-menu-s-old");
    // Ended: no pane to split or close.
    expect(within(menu).queryByText("Open in split")).toBeNull();
-    expect(within(menu).queryByText("Close tab (stops its session)")).toBeNull();
+    expect(within(menu).queryByText("Close tab (stops and archives its session)")).toBeNull();
    await user.click(within(menu).getByText("Rename"));
    expect(screen.queryByTestId("session-menu-s-old")).toBeNull();
    expect(screen.getByTestId("workspace-session-rename-s-old")).toBeInTheDocument();
@@ -271,11 +271,17 @@ describe("WorkspaceTree", () => {
    await user.click(within(screen.getByTestId("session-menu-s-live")).getByText("Archive"));
    expect(api.sessions.patch).toHaveBeenCalledWith("s-live", { archived: true });

+    await right(screen.getByTestId("workspace-session-s-live"));
+    await user.click(screen.getByTestId("session-menu-sleep"));
+    expect(api.run.kill).toHaveBeenCalledWith("agenthub-lane-1-2", { archive: false });
+
    await right(screen.getByTestId("workspace-session-s-live"));
    await user.click(
-      within(screen.getByTestId("session-menu-s-live")).getByText("Close tab (stops its session)")
+      within(screen.getByTestId("session-menu-s-live")).getByText(
+        "Close tab (stops and archives its session)"
+      )
    );
-    expect(api.run.kill).toHaveBeenCalledWith("agenthub-lane-1-2");
+    expect(api.run.kill).toHaveBeenCalledWith("agenthub-lane-1-2", { archive: true });
  });

  it("archiving a worktree session removes its worktree first, after asking", async () => {
@@ -5,19 +5,20 @@
 * does: open it the way its click does (a live pane attaches, an ended session
 * opens its conversation — never a resume), open a live one in a split,
 * rename / pin / unpin / archive / unarchive when the list offers them, copy its id, open
- * its analysis page, and close its live tab (`DELETE /api/run/:id`, what the
- * tab's X does — after the same confirm for an AI tab, which may be mid-turn).
+ * its analysis page, and end its live tab as the tab's buttons do (`endRuns`,
+ * after the same confirm for an AI tab, which may be mid-turn): **Sleep** stops
+ * it and keeps the session listed to resume later, **Close tab** stops it and
+ * archives the session.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
-import { api, type RunHandle } from "../../lib/api";
+import type { RunHandle } from "../../lib/api";
 import type { Session } from "../../lib/types";
 import { ContextMenu, MenuItem, MenuSeparator, type MenuPoint } from "../ContextMenu";
-import { confirmDialog } from "../../lib/confirm";
 import { copyText } from "../../lib/clipboard";
-import { toast } from "../../lib/toast";
+import { canSleep, endRuns } from "../../lib/stopSession";

 export function SessionMenu({
  laneId,
@@ -50,24 +51,12 @@ export function SessionMenu({
    onClose();
    fn();
  };
-  const closeTab = async () => {
+  // Stop archives the session; Sleep keeps it listed to resume later
+  // (`endRuns` asks first for an AI pane, which may be mid-turn).
+  const endTab = (sleep: boolean) => {
    if (!run) return;
    onClose();
-    if (
-      run.tool !== "shell" &&
-      !(await confirmDialog({
-        title: t("tabs.stopTitle", { name: session?.name || t("tree.newSession") }),
-        message: t("tabs.stopBody"),
-        confirmLabel: t("tabs.stopConfirm"),
-        destructive: true,
-      }))
-    )
-      return;
-    try {
-      await api.run.kill(run.id);
-    } catch (err) {
-      toast.error(err);
-    }
+    void endRuns([run], { sleep, name: session?.name || t("tree.newSession"), t });
  };

  return (
@@ -105,8 +94,13 @@ export function SessionMenu({
      {(run || onArchive || onUnarchive) && <MenuSeparator />}
      {onUnarchive && <MenuItem onSelect={pick(onUnarchive)}>{t("tree.unarchive")}</MenuItem>}
      {onArchive && <MenuItem onSelect={pick(onArchive)}>{t("sessionMenu.archive")}</MenuItem>}
+      {canSleep(run) && (
+        <MenuItem testId="session-menu-sleep" onSelect={() => endTab(true)}>
+          {t("tabs.sleep")}
+        </MenuItem>
+      )}
      {run && (
-        <MenuItem danger onSelect={() => void closeTab()}>
+        <MenuItem danger onSelect={() => endTab(false)}>
          {t("tabs.close")}
        </MenuItem>
      )}
@@ -8,8 +8,11 @@
 * prompt it started on, else its tool and number; a combo tab shows every
 * pane's icon and name. A tab carries a state dot (waiting for you / error /
 * running — a combo shows the most urgent, with screen-reader text). A tab's
- * X stops every session in it (`DELETE /api/run/:id`) — after a confirm when
- * one is an AI tool, since it may be mid-turn; a shell closes at once. Arrow
+ * X stops every session in it AND archives them (`endRuns`,
+ * `DELETE /api/run/:id?archive=1`); the moon beside it (and the tab menu's
+ * Sleep) stops its AI sessions but keeps them listed, to resume later. Either
+ * asks first when one is an AI tool, since it may be mid-turn; a shell closes
+ * at once. Arrow
 * keys, Home and End move between tabs (one tab stop, APG). Errors are
 * toasts. The `+` menu opens a new tab in the free slot the server picks
 * (`slot: "auto"`) — a plain shell (`POST /api/lanes/:id/start {shell: true}`)
@@ -48,13 +51,13 @@ import {
 } from "react";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
-import { House, Plus, Settings, Settings2, SquareTerminal, X } from "lucide-react";
+import { House, Moon, Plus, Settings, Settings2, SquareTerminal, X } from "lucide-react";
 import { api } from "../../lib/api";
 import { useSettingsHref } from "../../lib/settingsLink";
 import type { RunHandle } from "../../lib/api";
 import { isSessionAwaitingInput, type Lane, type Session } from "../../lib/types";
 import { toast } from "../../lib/toast";
-import { confirmDialog } from "../../lib/confirm";
+import { canSleep, endRuns } from "../../lib/stopSession";
 import { copyText } from "../../lib/clipboard";
 import { isSubmitEnter } from "../../lib/keys";
 import { useAiTools } from "../../hooks/useAiTools";
@@ -432,30 +435,10 @@ export function ConsoleTabs({
    }
  };

-  // An AI session may be mid-turn: stopping a tab holding one asks first. A
-  // shell holds no agent.
-  const close = async (tab: Tab) => {
-    if (
-      tab.runs.some((r) => r.tool !== "shell") &&
-      !(await confirmDialog({
-        title:
-          tab.runs.length > 1
-            ? t("tabs.stopGroupTitle", { count: tab.runs.length })
-            : t("tabs.stopTitle", { name: label(tab.focus) }),
-        message: t("tabs.stopBody"),
-        confirmLabel: t("tabs.stopConfirm"),
-        destructive: true,
-      }))
-    )
-      return;
-    for (const r of tab.runs) {
-      try {
-        await api.run.kill(r.id);
-        onClosed(r.id);
-      } catch (err) {
-        toast.error(err);
-      }
-    }
+  // Stop archives the tab's sessions; Sleep keeps them listed to resume
+  // (`endRuns` asks first for an AI pane, which may be mid-turn).
+  const close = async (tab: Tab, sleep = false) => {
+    for (const id of await endRuns(tab.runs, { sleep, name: label(tab.focus), t })) onClosed(id);
  };

  const startRename = (r: RunHandle) => {
@@ -638,6 +621,20 @@ export function ConsoleTabs({
                <span className="truncate">{tabLabel(tab)}</span>
                {state && <RunDot state={state} />}
              </button>
+              {tab.runs.some(canSleep) && (
+                <button
+                  type="button"
+                  data-testid={`console-tab-sleep-${tab.key}`}
+                  onClick={() => void close(tab, true)}
+                  aria-label={t("tabs.sleep")}
+                  title={t("tabs.sleep")}
+                  className={`shrink-0 rounded p-0.5 hover:bg-surface-4 hover:text-fg-primary ${
+                    active ? "" : "opacity-0 group-hover:opacity-100 focus:opacity-100"
+                  }`}
+                >
+                  <Moon className="h-3.5 w-3.5" />
+                </button>
+              )}
              <button
                type="button"
                data-testid={`console-tab-close-${tab.key}`}
@@ -785,6 +782,14 @@ export function ConsoleTabs({
            </>
          )}
          <MenuSeparator />
+          {ctxTab.runs.some(canSleep) && (
+            <MenuItem
+              testId="console-tab-menu-sleep"
+              onSelect={pickTab((tab) => void close(tab, true))}
+            >
+              {t("tabs.sleep")}
+            </MenuItem>
+          )}
          <MenuItem danger onSelect={pickTab((tab) => void close(tab))}>
            {t("tabs.close")}
          </MenuItem>
@@ -10,7 +10,9 @@
 * there, on its middle to swap), pick another live session for it, split it
 * right or down, or take the pane OUT of this tab (its session keeps running
 * in a tab of its own — so its icon is not the tab's stop X), or stop its
- * session there (X, `onStop`) without taking it out first. The grid shows
+ * session there (X, `onStop`, which archives it) or put an AI session to
+ * sleep (the moon left of it, `onSleep`: stopped but kept to resume) without
+ * taking it out first. The grid shows
 * one tab's panes; `onChange` applies through `updateActive`, so a session
 * dropped or swapped in from another tab leaves that tab. A header names the pane's session and
 * shows its state dot, as its tab does.
@@ -40,11 +42,13 @@ import {
  GripVertical,
  MessageSquare,
  Minimize2,
+  Moon,
  Rows2,
  SquareTerminal,
  X,
 } from "lucide-react";
 import type { RunHandle } from "../../lib/api";
+import { canSleep } from "../../lib/stopSession";
 import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../ContextMenu";
 import {
  EMPTY_GROUPS,
@@ -402,6 +406,7 @@ export function PaneGrid({
  onNewSplit,
  stateOf,
  onStop,
+  onSleep,
  keyOf = (slot) => slot,
  kept = [],
 }: {
@@ -410,8 +415,10 @@ export function PaneGrid({
  keyOf?: (slot: number) => number;
  /** Panes kept mounted, always hidden — never in the layout. */
  kept?: { key: number; node: ReactNode }[];
-  /** Stops the session in `slot` (the header's X). */
+  /** Stops (and archives) the session in `slot` (the header's X). */
  onStop?: (slot: number) => void;
+  /** Sleeps the AI session in `slot`: stopped, kept to resume (the moon). */
+  onSleep?: (slot: number) => void;
  /** A live AI run's state for its header dot (none for a shell). */
  stateOf?: (r: RunHandle) => RunState | null;
  /** Every slot to keep mounted; those not in the layout are hidden. */
@@ -641,6 +648,18 @@ export function PaneGrid({
                  >
                    <Minimize2 className="h-3.5 w-3.5" />
                  </button>
+                  {run && onSleep && canSleep(run) && (
+                    <button
+                      type="button"
+                      data-testid={`pane-sleep-${slot}`}
+                      title={t("panes.sleep")}
+                      aria-label={t("panes.sleep")}
+                      onClick={() => onSleep(slot)}
+                      className="flex h-6 w-6 items-center justify-center rounded text-fg-muted hover:bg-surface-4 hover:text-fg-primary"
+                    >
+                      <Moon className="h-3.5 w-3.5" />
+                    </button>
+                  )}
                  {run && onStop && (
                    <button
                      type="button"
@@ -696,6 +715,11 @@ export function PaneGrid({
          <MenuItem onSelect={pickPane((slot) => onChange((l) => closeInLayout(l, slot)))}>
            {t("panes.closeShort")}
          </MenuItem>
+          {onSleep && canSleep(runOf(paneCtx.menu.item)) && (
+            <MenuItem testId="pane-menu-sleep" onSelect={pickPane(onSleep)}>
+              {t("panes.sleep")}
+            </MenuItem>
+          )}
          {onStop && runOf(paneCtx.menu.item) && (
            <MenuItem testId="pane-menu-stop" onSelect={pickPane(onStop)}>
              {t("panes.stop")}
@@ -4,9 +4,11 @@
 * commit author (name + email in the account's global git config — prefilled
 * from Settings → Account while unset, since a member's commits fail without
 * one), the SSH
- * key a clone (Add workspace → Clone) and the pushes from that clone use —
- * make one, copy its public half to add to GitHub/GitLab, replace or delete
- * it — and, for a user with their own Linux account (S3), their own HTTPS
+ * keys a clone (Add workspace → Clone) and the pushes from that clone use —
+ * an ED25519 and/or an RSA one (AWS CodeCommit takes only RSA) — make one, copy its public half to add to GitHub/GitLab, replace or delete
+ * it, and whether git typed in the account's own terminal uses it too (a
+ * switch over `core.sshCommand` in its `~/.gitconfig`, issue #82) — and, for
+ * a user with their own Linux account (S3), their own HTTPS
 * logins. The host account's HTTPS logins are the shared Git credentials
 * table above it, so this lists them only for a member. The private key and
 * every token are write-only: the server never returns them. A host identity
@@ -21,6 +23,7 @@ import { confirmDialog } from "../../lib/confirm";
 import { copyText } from "../../lib/clipboard";
 import { toast } from "../../lib/toast";
 import { useAuth } from "../AuthGate";
+import { Switch } from "../Switch";

 const INPUT =
  "w-full rounded border border-border-light bg-surface-0 px-2 py-1 text-xs text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none";
@@ -65,23 +68,24 @@ export function GitIdentitySettings() {
  };

  // ed25519 suits GitHub/GitLab/Gitea; AWS IAM (CodeCommit) accepts only RSA.
+  // An account may hold one of each; an older server answers `ssh` only.
+  const keys = id ? (id.sshKeys ?? (id.ssh ? [id.ssh] : [])) : [];
+  const terminal = id?.sshTerminal ?? id?.ssh?.terminal ?? null;
  const [keyType, setKeyType] = useState<"ed25519" | "rsa">("ed25519");
+  const typeTaken = keys.some((k) => (k.type ?? "ed25519") === keyType);
  const generate = async () => {
    if (
-      id?.ssh &&
+      typeTaken &&
      !(await confirmDialog({
        title: t("gitIdentity.replaceConfirm"),
        confirmLabel: t("gitIdentity.replace"),
      }))
    )
      return;
-    await run(
-      () => api.gitIdentity.generateKey(Boolean(id?.ssh), keyType),
-      t("gitIdentity.keyMade")
-    );
+    await run(() => api.gitIdentity.generateKey(typeTaken, keyType), t("gitIdentity.keyMade"));
  };

-  const removeKey = async () => {
+  const removeKey = async (type?: "ed25519" | "rsa") => {
    if (
      !(await confirmDialog({
        title: t("gitIdentity.removeKeyConfirm"),
@@ -89,7 +93,7 @@ export function GitIdentitySettings() {
      }))
    )
      return;
-    await run(() => api.gitIdentity.removeKey());
+    await run(() => api.gitIdentity.removeKey(type));
  };

  const saveLogin = async () => {
@@ -151,7 +155,7 @@ export function GitIdentitySettings() {

  return (
    <div className="space-y-4">
-      <p className="max-w-2xl text-xs text-fg-muted">
+      <p className="text-xs text-fg-muted">
        {member ? t("gitIdentity.descriptionMember") : t("gitIdentity.descriptionHost")}
      </p>

@@ -162,7 +166,7 @@ export function GitIdentitySettings() {
      )}

      <form
-        className="max-w-2xl space-y-2 rounded-lg border border-border p-3"
+        className="space-y-2 rounded-lg border border-border p-3"
        onSubmit={(e) => {
          e.preventDefault();
          void saveAuthor();
@@ -202,7 +206,7 @@ export function GitIdentitySettings() {
        )}
      </form>

-      <div className="max-w-2xl space-y-2 rounded-lg border border-border p-3">
+      <div className="space-y-2 rounded-lg border border-border p-3">
        <div className="flex items-center gap-2">
          <KeyRound className="h-4 w-4 text-fg-muted" aria-hidden />
          <h3 className="flex-1 text-xs font-semibold text-fg-primary">
@@ -222,46 +226,64 @@ export function GitIdentitySettings() {
          )}
          {id.writable && (
            <button type="button" className={BTN} disabled={busy} onClick={() => void generate()}>
-              {id.ssh ? <RefreshCw className="h-3.5 w-3.5" /> : <Plus className="h-3.5 w-3.5" />}
-              {id.ssh ? t("gitIdentity.replace") : t("gitIdentity.generate")}
+              {typeTaken ? <RefreshCw className="h-3.5 w-3.5" /> : <Plus className="h-3.5 w-3.5" />}
+              {typeTaken ? t("gitIdentity.replace") : t("gitIdentity.generate")}
            </button>
          )}
        </div>
-        {id.ssh ? (
+        {keys.length ? (
          <>
-            <textarea
-              readOnly
-              aria-label={t("gitIdentity.publicKey")}
-              value={id.ssh.publicKey}
-              rows={3}
-              onFocus={(e) => e.currentTarget.select()}
-              className={`${INPUT} resize-none break-all font-mono text-[11px]`}
-            />
-            <div className="flex flex-wrap items-center gap-2">
-              <span className="min-w-0 flex-1 truncate font-mono text-[10px] text-fg-muted">
-                {id.ssh.type === "rsa" ? "RSA 4096 · " : id.ssh.type ? "ED25519 · " : ""}
-                {id.ssh.fingerprint}
-              </span>
-              <button
-                type="button"
-                className={BTN}
-                onClick={() => void copyText(id.ssh?.publicKey ?? "")}
-              >
-                <Copy className="h-3.5 w-3.5" />
-                {t("gitIdentity.copy")}
-              </button>
-              {id.writable && (
-                <button
-                  type="button"
-                  className={`${BTN} hover:text-status-danger`}
-                  disabled={busy}
-                  onClick={() => void removeKey()}
-                >
-                  <Trash2 className="h-3.5 w-3.5" />
-                  {t("gitIdentity.remove")}
-                </button>
-              )}
-            </div>
+            {keys.map((k) => (
+              <div key={k.type ?? "ed25519"} className="space-y-1.5">
+                <textarea
+                  readOnly
+                  aria-label={`${t("gitIdentity.publicKey")} ${k.type === "rsa" ? "RSA" : "ED25519"}`}
+                  value={k.publicKey}
+                  rows={k.type === "rsa" ? 4 : 2}
+                  onFocus={(e) => e.currentTarget.select()}
+                  className={`${INPUT} resize-none break-all font-mono text-[11px]`}
+                />
+                <div className="flex flex-wrap items-center gap-2">
+                  <span className="min-w-0 flex-1 truncate font-mono text-[10px] text-fg-muted">
+                    {k.type === "rsa" ? "RSA 4096 · " : "ED25519 · "}
+                    {k.fingerprint}
+                  </span>
+                  <button type="button" className={BTN} onClick={() => void copyText(k.publicKey)}>
+                    <Copy className="h-3.5 w-3.5" />
+                    {t("gitIdentity.copy")}
+                  </button>
+                  {id.writable && (
+                    <button
+                      type="button"
+                      className={`${BTN} hover:text-status-danger`}
+                      disabled={busy}
+                      onClick={() => void removeKey(k.type)}
+                    >
+                      <Trash2 className="h-3.5 w-3.5" />
+                      {t("gitIdentity.remove")}
+                    </button>
+                  )}
+                </div>
+              </div>
+            ))}
+            {terminal && (
+              <div className="flex items-start gap-2 rounded border border-border p-2">
+                <div className="min-w-0 flex-1">
+                  <div className="text-[11px] text-fg-primary">{t("gitIdentity.terminal")}</div>
+                  <div className="text-[10px] text-fg-muted">
+                    {terminal === "foreign"
+                      ? t("gitIdentity.terminalForeign")
+                      : t("gitIdentity.terminalHint")}
+                  </div>
+                </div>
+                <Switch
+                  label={t("gitIdentity.terminal")}
+                  checked={terminal === "on"}
+                  disabled={busy || !id.writable || terminal === "foreign"}
+                  onChange={(on) => void run(() => api.gitIdentity.setTerminalSsh(on))}
+                />
+              </div>
+            )}
            <p className="text-[10px] text-fg-muted">{t("gitIdentity.addKeyHint")}</p>
          </>
        ) : (
@@ -270,7 +292,7 @@ export function GitIdentitySettings() {
      </div>

      {member && (
-        <div className="max-w-2xl space-y-2 rounded-lg border border-border p-3">
+        <div className="space-y-2 rounded-lg border border-border p-3">
          <div className="flex items-center gap-2">
            <h3 className="flex-1 text-xs font-semibold text-fg-primary">
              {t("gitIdentity.httpsTitle")}
@@ -19,6 +19,7 @@ vi.mock("../../../lib/api", () => ({
      get: vi.fn(),
      generateKey: vi.fn(),
      removeKey: vi.fn(),
+      setTerminalSsh: vi.fn(),
      saveHttps: vi.fn(),
      saveAuthor: vi.fn(),
      removeHttps: vi.fn(),
@@ -51,7 +52,7 @@ describe("GitIdentitySettings", () => {
    await userEvent.click(await screen.findByRole("button", { name: "Generate SSH key" }));
    expect(confirmDialog).not.toHaveBeenCalled();
    expect(api.gitIdentity.generateKey).toHaveBeenCalledWith(false, "ed25519");
-    expect(await screen.findByLabelText("Public key")).toHaveValue(KEY.publicKey);
+    expect(await screen.findByLabelText(/^Public key/)).toHaveValue(KEY.publicKey);
  });

  it("copies the public key and asks before replacing it", async () => {
@@ -97,6 +98,31 @@ describe("GitIdentitySettings", () => {
    expect(await screen.findByText(/^RSA 4096 · /)).toBeInTheDocument();
  });

+  it("adds an RSA key beside the ED25519 one and deletes each on its own", async () => {
+    const RSA = {
+      type: "rsa" as const,
+      publicKey: "ssh-rsa AAAAB3 an@agenthub",
+      fingerprint: "SHA256:r",
+    };
+    const ED = { ...KEY, type: "ed25519" as const };
+    vi.mocked(api.gitIdentity.get).mockResolvedValue(view({ ssh: ED, sshKeys: [ED] }));
+    vi.mocked(api.gitIdentity.generateKey).mockResolvedValue(
+      view({ ssh: ED, sshKeys: [ED, RSA], sshTerminal: "on" })
+    );
+    vi.mocked(api.gitIdentity.removeKey).mockResolvedValue(view({ ssh: ED, sshKeys: [ED] }));
+    render(<GitIdentitySettings />);
+    await userEvent.selectOptions(await screen.findByLabelText("Key type"), "rsa");
+    // No RSA key yet: a plain Generate, no replace prompt, the ED25519 key stays.
+    await userEvent.click(screen.getByRole("button", { name: "Generate SSH key" }));
+    expect(confirmDialog).not.toHaveBeenCalled();
+    expect(api.gitIdentity.generateKey).toHaveBeenCalledWith(false, "rsa");
+    expect(await screen.findByLabelText("Public key RSA")).toHaveValue(RSA.publicKey);
+    expect(screen.getByLabelText("Public key ED25519")).toHaveValue(ED.publicKey);
+    expect(screen.getByRole("switch", { name: /terminal/ })).toBeChecked();
+    await userEvent.click(screen.getAllByRole("button", { name: "Delete" })[1]!);
+    await waitFor(() => expect(api.gitIdentity.removeKey).toHaveBeenCalledWith("rsa"));
+  });
+
  it("warns while the commit author is unset and saves it", async () => {
    vi.mocked(api.gitIdentity.get).mockResolvedValue(view({ author: { name: null, email: null } }));
    vi.mocked(api.gitIdentity.saveAuthor).mockResolvedValue(view());
@@ -118,7 +144,7 @@ describe("GitIdentitySettings", () => {
      view({ account: "host", writable: false, ssh: KEY })
    );
    render(<GitIdentitySettings />);
-    expect(await screen.findByLabelText("Public key")).toBeInTheDocument();
+    expect(await screen.findByLabelText(/^Public key/)).toBeInTheDocument();
    expect(screen.queryByRole("button", { name: "Replace key" })).toBeNull();
    expect(screen.queryByRole("button", { name: "Add login" })).toBeNull();
  });