chore: v2.8.7 — Git SSH keys in tabs, safer Artifacts preview and search

- Settings → Git → Your git identity: SSH keys are one tab per host kind
  (GitHub · GitLab, AWS CodeCommit, More keys, Other hosts); opens on the
  AWS tab when only an RSA key exists.
- Artifacts: a file type the sandboxed preview cannot show (Office, zip,
  PDF) offers Download only, never a blank Preview.
- Artifacts search: `%`/`_`/`\` in a query match literally (LIKE ... ESCAPE).
- Skill frontmatter rewrite replaces a key with its continuation lines and
  quotes values YAML could misread.
- Plugin marketplace.json is read with a 1 MB streaming cap.
- Artifact lists look each owner up once.

client/src/components/settings/GitIdentitySettings.tsx

@@ -13,7 +13,8 @@
  * that same file, so a plain `ssh://git-codecommit…` URL works), and for
  * SEVERAL accounts (two AWS accounts, a second GitHub user) named keys made
  * beside the default ones plus a login per account NAME (`ssh://<name>/…`),
- * each tied to the one key it uses — and, for
+ * each tied to the one key it uses (the SSH part is split into tabs: one per
+ * kind of host, the extra keys, the other hosts) — and, for
  * a user with their own Linux account (S3), their own HTTPS
  * logins. The host account's HTTPS logins are the shared Git credentials
  * table above it, so this lists them only for a member. The private key and
@@ -23,12 +24,23 @@
  */
 import { useCallback, useEffect, useState, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
-import { Copy, KeyRound, Plus, RefreshCw, Trash2 } from "lucide-react";
+import {
+  Cloud,
+  Copy,
+  GitBranch,
+  KeyRound,
+  KeySquare,
+  Plus,
+  RefreshCw,
+  Server,
+  Trash2,
+} from "lucide-react";
 import { api, type GitIdentity } from "../../lib/api";
 import { confirmDialog } from "../../lib/confirm";
 import { copyText } from "../../lib/clipboard";
 import { toast } from "../../lib/toast";
 import { useAuth } from "../AuthGate";
+import { PageTabs } from "../PageTabs";
 import { Switch } from "../Switch";
 
 const INPUT =
@@ -180,6 +192,8 @@ export function GitIdentitySettings() {
   const me = auth.mode === "server" ? auth.user : null;
   // null = not edited: the field shows the saved value, else the account's.
   const [author, setAuthor] = useState<{ name: string; email: string } | null>(null);
+  // null = not picked: opens on the first kind of host that has a key.
+  const [sshTab, setSshTab] = useState<string | null>(null);
 
   const load = useCallback(async () => {
     try {
@@ -378,6 +392,31 @@ export function GitIdentitySettings() {
     authorUnset ||
     authorShown.name.trim() !== (id.author.name ?? "") ||
     authorShown.email.trim() !== (id.author.email ?? "");
+  // The SSH keys, one tab per kind of host — every section at once was a wall.
+  const sshTabs = [
+    { id: "git", label: t("gitIdentity.tabGit"), Icon: GitBranch },
+    { id: "aws", label: t("gitIdentity.awsTitle"), Icon: Cloud },
+    ...(named.length > 0 || id.writable
+      ? [
+          {
+            id: "more",
+            label: named.length
+              ? `${t("gitIdentity.tabMore")} (${named.length})`
+              : t("gitIdentity.tabMore"),
+            Icon: KeySquare,
+          },
+        ]
+      : []),
+    ...(id.sshUsers !== undefined && (otherRows.length > 0 || id.writable)
+      ? [{ id: "other", label: t("gitIdentity.tabOther"), Icon: Server }]
+      : []),
+  ];
+  const activeSshTab =
+    sshTab && sshTabs.some((x) => x.id === sshTab)
+      ? sshTab
+      : !keyOf("ed25519") && keyOf("rsa")
+        ? "aws"
+        : "git";
   const saveAuthor = async () => {
     const ok = await run(
       () =>
@@ -452,43 +491,252 @@ export function GitIdentitySettings() {
         </div>
         <p className="text-[11px] text-fg-muted">{t("gitIdentity.sshIntro")}</p>
 
-        <KeyCard
-          title={t("gitIdentity.gitHubTitle")}
-          sub={t("gitIdentity.gitHubSub")}
-          type="ed25519"
-          k={keyOf("ed25519")}
-          id={id}
-          busy={busy}
-          onGenerate={generate}
-          onRemove={removeKey}
+        <PageTabs
+          ariaLabel={t("gitIdentity.sshTitle")}
+          tabs={sshTabs}
+          activeId={activeSshTab}
+          onSelect={setSshTab}
         >
-          <Step n={2}>{t("gitIdentity.gitHubStepAdd")}</Step>
-          <Step n={3}>
-            {t("gitIdentity.gitHubStepClone")}
-            <Code>git clone git@github.com:&lt;org&gt;/&lt;repo&gt;.git</Code>
-          </Step>
-        </KeyCard>
+          {activeSshTab === "git" && (
+            <KeyCard
+              title={t("gitIdentity.gitHubTitle")}
+              sub={t("gitIdentity.gitHubSub")}
+              type="ed25519"
+              k={keyOf("ed25519")}
+              id={id}
+              busy={busy}
+              onGenerate={generate}
+              onRemove={removeKey}
+            >
+              <Step n={2}>{t("gitIdentity.gitHubStepAdd")}</Step>
+              <Step n={3}>
+                {t("gitIdentity.gitHubStepClone")}
+                <Code>git clone git@github.com:&lt;org&gt;/&lt;repo&gt;.git</Code>
+              </Step>
+            </KeyCard>
+          )}
 
-        <KeyCard
-          title={t("gitIdentity.awsTitle")}
-          sub={t("gitIdentity.awsSub")}
-          type="rsa"
-          k={keyOf("rsa")}
-          id={id}
-          busy={busy}
-          onGenerate={generate}
-          onRemove={removeKey}
-        >
-          <Step n={2}>{t("gitIdentity.awsStepUpload")}</Step>
-          <Step n={3}>
-            {t("gitIdentity.awsStepKeyId")}
-            {id.sshUsers === undefined ? null : (
-              <>
-                {awsRows.map((r) => (
-                  <div key={r.alias ?? r.host} className="mt-1 flex items-center gap-2">
+          {activeSshTab === "aws" && (
+            <KeyCard
+              title={t("gitIdentity.awsTitle")}
+              sub={t("gitIdentity.awsSub")}
+              type="rsa"
+              k={keyOf("rsa")}
+              id={id}
+              busy={busy}
+              onGenerate={generate}
+              onRemove={removeKey}
+            >
+              <Step n={2}>{t("gitIdentity.awsStepUpload")}</Step>
+              <Step n={3}>
+                {t("gitIdentity.awsStepKeyId")}
+                {id.sshUsers === undefined ? null : (
+                  <>
+                    {awsRows.map((r) => (
+                      <div key={r.alias ?? r.host} className="mt-1 flex items-center gap-2">
+                        <span className="min-w-0 flex-1 truncate font-mono text-[11px] text-fg-secondary">
+                          {r.alias ? `${r.alias} · ` : ""}
+                          {r.region} · {r.user} · {keyLabel(r.key)}
+                        </span>
+                        {id.writable && (
+                          <button
+                            type="button"
+                            className={`${BTN} hover:text-status-danger`}
+                            disabled={busy}
+                            aria-label={`${t("gitIdentity.remove")} ${r.alias ?? r.host}`}
+                            onClick={() =>
+                              void run(() => api.gitIdentity.removeSshUser(r.alias ?? r.host))
+                            }
+                          >
+                            <Trash2 className="h-3.5 w-3.5" />
+                          </button>
+                        )}
+                      </div>
+                    ))}
+                    {id.writable && (
+                      <form
+                        className="mt-1 grid gap-2 sm:grid-cols-[2fr_1fr_1fr_1fr_auto]"
+                        onSubmit={(e) => {
+                          e.preventDefault();
+                          void saveAws();
+                        }}
+                      >
+                        <input
+                          aria-label={t("gitIdentity.awsKeyId")}
+                          placeholder="APKA…"
+                          autoComplete="off"
+                          value={aws.keyId}
+                          onChange={(e) => setAws({ ...aws, keyId: e.target.value })}
+                          className={`${INPUT} font-mono`}
+                        />
+                        <select
+                          aria-label={t("gitIdentity.awsRegion")}
+                          value={aws.region}
+                          onChange={(e) => setAws({ ...aws, region: e.target.value })}
+                          className="select !py-1 !text-xs"
+                        >
+                          {AWS_REGIONS.map((r) => (
+                            <option key={r} value={r}>
+                              {r}
+                            </option>
+                          ))}
+                        </select>
+                        <input
+                          aria-label={t("gitIdentity.alias")}
+                          title={t("gitIdentity.aliasHint")}
+                          placeholder={t("gitIdentity.aliasPlaceholder")}
+                          autoComplete="off"
+                          value={aws.alias}
+                          onChange={(e) => setAws({ ...aws, alias: e.target.value })}
+                          className={`${INPUT} font-mono`}
+                        />
+                        {keySelect(aws.key, (key) => setAws({ ...aws, key }), "rsa")}
+                        <button type="submit" className={BTN} disabled={busy || !aws.keyId.trim()}>
+                          {t("gitIdentity.awsSave")}
+                        </button>
+                      </form>
+                    )}
+                    <div className="mt-1 text-[10px] text-fg-muted">{t("gitIdentity.awsMany")}</div>
+                  </>
+                )}
+              </Step>
+              {awsRows.length > 0 && (
+                <div className="rounded border border-status-success/40 bg-status-success/10 p-2 text-[11px] text-fg-primary">
+                  {t("gitIdentity.awsReady")}
+                  {awsRows.map((r) => (
+                    <Code key={r.alias ?? r.host}>
+                      git clone ssh://{r.alias ?? r.host}/v1/repos/&lt;repo&gt;
+                    </Code>
+                  ))}
+                </div>
+              )}
+            </KeyCard>
+          )}
+
+          {activeSshTab === "more" && (
+            <section
+              aria-label={t("gitIdentity.moreKeysTitle")}
+              className="space-y-2 rounded border border-border p-2.5"
+            >
+              <div className="flex flex-wrap items-center gap-2">
+                <div className="min-w-0 flex-1">
+                  <div className="text-xs font-medium text-fg-primary">
+                    {t("gitIdentity.moreKeysTitle")}
+                  </div>
+                  <div className="text-[10px] text-fg-muted">{t("gitIdentity.moreKeysSub")}</div>
+                </div>
+                {id.writable && !newKey && (
+                  <button
+                    type="button"
+                    className={BTN}
+                    disabled={busy}
+                    onClick={() => setNewKey({ name: "", type: "rsa" })}
+                  >
+                    <Plus className="h-3.5 w-3.5" />
+                    {t("gitIdentity.newKey")}
+                  </button>
+                )}
+              </div>
+              {newKey && (
+                <form
+                  className="grid gap-2 sm:grid-cols-[2fr_1fr_auto_auto]"
+                  onSubmit={(e) => {
+                    e.preventDefault();
+                    void makeNamed();
+                  }}
+                >
+                  <input
+                    aria-label={t("gitIdentity.keyName")}
+                    placeholder={t("gitIdentity.keyNamePlaceholder")}
+                    autoComplete="off"
+                    autoFocus
+                    value={newKey.name}
+                    onChange={(e) => setNewKey({ ...newKey, name: e.target.value })}
+                    className={`${INPUT} font-mono`}
+                  />
+                  <select
+                    aria-label={t("gitIdentity.keyType")}
+                    value={newKey.type}
+                    onChange={(e) =>
+                      setNewKey({ ...newKey, type: e.target.value === "rsa" ? "rsa" : "ed25519" })
+                    }
+                    className="select !py-1 !text-xs"
+                  >
+                    <option value="rsa">RSA 4096 (AWS)</option>
+                    <option value="ed25519">ED25519</option>
+                  </select>
+                  <button type="submit" className={BTN} disabled={busy || !newKey.name.trim()}>
+                    {t("gitIdentity.generate")}
+                  </button>
+                  <button type="button" className={BTN} onClick={() => setNewKey(null)}>
+                    {t("gitCreds.cancel")}
+                  </button>
+                </form>
+              )}
+              {named.map((k) => (
+                <div
+                  key={k.id}
+                  className="space-y-1 rounded border border-border-light p-2"
+                  data-testid="git-named-key"
+                >
+                  <div className="flex flex-wrap items-center gap-2">
+                    <span className="font-mono text-[11px] font-medium text-fg-primary">
+                      {k.name}
+                    </span>
+                    <span className="rounded bg-surface-3 px-1.5 py-0.5 text-[10px] text-fg-secondary">
+                      {k.type === "rsa" ? "RSA" : "ED25519"}
+                    </span>
+                    <span className="min-w-0 flex-1 truncate font-mono text-[10px] text-fg-muted">
+                      {k.fingerprint}
+                    </span>
+                    <button
+                      type="button"
+                      className={BTN}
+                      onClick={() => void copyText(k.publicKey)}
+                    >
+                      <Copy className="h-3.5 w-3.5" />
+                      {t("gitIdentity.copy")}
+                    </button>
+                    {id.writable && (
+                      <button
+                        type="button"
+                        className={`${BTN} hover:text-status-danger`}
+                        disabled={busy}
+                        aria-label={`${t("gitIdentity.remove")} ${k.name}`}
+                        onClick={() => void removeNamed(k.id!)}
+                      >
+                        <Trash2 className="h-3.5 w-3.5" />
+                      </button>
+                    )}
+                  </div>
+                  <textarea
+                    readOnly
+                    aria-label={`${t("gitIdentity.publicKey")} ${k.name}`}
+                    value={k.publicKey}
+                    rows={2}
+                    onFocus={(e) => e.currentTarget.select()}
+                    className={`${INPUT} resize-none break-all font-mono text-[10px]`}
+                  />
+                </div>
+              ))}
+            </section>
+          )}
+
+          {activeSshTab === "other" && (
+            <section
+              aria-label={t("gitIdentity.otherTitle")}
+              className="space-y-1.5 rounded border border-border p-2.5"
+            >
+              <div className="text-xs font-medium text-fg-primary">
+                {t("gitIdentity.otherTitle")}
+              </div>
+              <div className="space-y-1.5">
+                <div className="text-[10px] text-fg-muted">{t("gitIdentity.otherHint")}</div>
+                {otherRows.map((r) => (
+                  <div key={r.alias ?? r.host} className="flex items-center gap-2">
                     <span className="min-w-0 flex-1 truncate font-mono text-[11px] text-fg-secondary">
-                      {r.alias ? `${r.alias} · ` : ""}
-                      {r.region} · {r.user} · {keyLabel(r.key)}
+                      {r.alias ? `ssh://${r.alias}/ → ` : ""}
+                      {r.user}@{r.host} · {keyLabel(r.key)}
                     </span>
                     {id.writable && (
                       <button
@@ -507,167 +755,50 @@ export function GitIdentitySettings() {
                 ))}
                 {id.writable && (
                   <form
-                    className="mt-1 grid gap-2 sm:grid-cols-[2fr_1fr_1fr_1fr_auto]"
+                    className="grid gap-2 sm:grid-cols-[2fr_1fr_1fr_1fr_auto]"
                     onSubmit={(e) => {
                       e.preventDefault();
-                      void saveAws();
+                      void saveOther();
                     }}
                   >
                     <input
-                      aria-label={t("gitIdentity.awsKeyId")}
-                      placeholder="APKA…"
-                      autoComplete="off"
-                      value={aws.keyId}
-                      onChange={(e) => setAws({ ...aws, keyId: e.target.value })}
+                      aria-label={t("gitIdentity.otherHost")}
+                      placeholder="git.example.com"
+                      value={other.host}
+                      onChange={(e) => setOther({ ...other, host: e.target.value })}
+                      className={`${INPUT} font-mono`}
+                    />
+                    <input
+                      aria-label={t("gitIdentity.otherUser")}
+                      placeholder={t("gitIdentity.otherUser")}
+                      autoComplete="off"
+                      value={other.user}
+                      onChange={(e) => setOther({ ...other, user: e.target.value })}
                       className={`${INPUT} font-mono`}
                     />
-                    <select
-                      aria-label={t("gitIdentity.awsRegion")}
-                      value={aws.region}
-                      onChange={(e) => setAws({ ...aws, region: e.target.value })}
-                      className="select !py-1 !text-xs"
-                    >
-                      {AWS_REGIONS.map((r) => (
-                        <option key={r} value={r}>
-                          {r}
-                        </option>
-                      ))}
-                    </select>
                     <input
                       aria-label={t("gitIdentity.alias")}
                       title={t("gitIdentity.aliasHint")}
                       placeholder={t("gitIdentity.aliasPlaceholder")}
                       autoComplete="off"
-                      value={aws.alias}
-                      onChange={(e) => setAws({ ...aws, alias: e.target.value })}
+                      value={other.alias}
+                      onChange={(e) => setOther({ ...other, alias: e.target.value })}
                       className={`${INPUT} font-mono`}
                     />
-                    {keySelect(aws.key, (key) => setAws({ ...aws, key }), "rsa")}
-                    <button type="submit" className={BTN} disabled={busy || !aws.keyId.trim()}>
+                    {keySelect(other.key, (key) => setOther({ ...other, key }))}
+                    <button
+                      type="submit"
+                      className={BTN}
+                      disabled={busy || !other.host.trim() || !other.user.trim()}
+                    >
                       {t("gitIdentity.awsSave")}
                     </button>
                   </form>
                 )}
-                <div className="mt-1 text-[10px] text-fg-muted">{t("gitIdentity.awsMany")}</div>
-              </>
-            )}
-          </Step>
-          {awsRows.length > 0 && (
-            <div className="rounded border border-status-success/40 bg-status-success/10 p-2 text-[11px] text-fg-primary">
-              {t("gitIdentity.awsReady")}
-              {awsRows.map((r) => (
-                <Code key={r.alias ?? r.host}>
-                  git clone ssh://{r.alias ?? r.host}/v1/repos/&lt;repo&gt;
-                </Code>
-              ))}
-            </div>
+              </div>
+            </section>
           )}
-        </KeyCard>
-
-        {(named.length > 0 || id.writable) && (
-          <section
-            aria-label={t("gitIdentity.moreKeysTitle")}
-            className="space-y-2 rounded border border-border p-2.5"
-          >
-            <div className="flex flex-wrap items-center gap-2">
-              <div className="min-w-0 flex-1">
-                <div className="text-xs font-medium text-fg-primary">
-                  {t("gitIdentity.moreKeysTitle")}
-                </div>
-                <div className="text-[10px] text-fg-muted">{t("gitIdentity.moreKeysSub")}</div>
-              </div>
-              {id.writable && !newKey && (
-                <button
-                  type="button"
-                  className={BTN}
-                  disabled={busy}
-                  onClick={() => setNewKey({ name: "", type: "rsa" })}
-                >
-                  <Plus className="h-3.5 w-3.5" />
-                  {t("gitIdentity.newKey")}
-                </button>
-              )}
-            </div>
-            {newKey && (
-              <form
-                className="grid gap-2 sm:grid-cols-[2fr_1fr_auto_auto]"
-                onSubmit={(e) => {
-                  e.preventDefault();
-                  void makeNamed();
-                }}
-              >
-                <input
-                  aria-label={t("gitIdentity.keyName")}
-                  placeholder={t("gitIdentity.keyNamePlaceholder")}
-                  autoComplete="off"
-                  autoFocus
-                  value={newKey.name}
-                  onChange={(e) => setNewKey({ ...newKey, name: e.target.value })}
-                  className={`${INPUT} font-mono`}
-                />
-                <select
-                  aria-label={t("gitIdentity.keyType")}
-                  value={newKey.type}
-                  onChange={(e) =>
-                    setNewKey({ ...newKey, type: e.target.value === "rsa" ? "rsa" : "ed25519" })
-                  }
-                  className="select !py-1 !text-xs"
-                >
-                  <option value="rsa">RSA 4096 (AWS)</option>
-                  <option value="ed25519">ED25519</option>
-                </select>
-                <button type="submit" className={BTN} disabled={busy || !newKey.name.trim()}>
-                  {t("gitIdentity.generate")}
-                </button>
-                <button type="button" className={BTN} onClick={() => setNewKey(null)}>
-                  {t("gitCreds.cancel")}
-                </button>
-              </form>
-            )}
-            {named.map((k) => (
-              <div
-                key={k.id}
-                className="space-y-1 rounded border border-border-light p-2"
-                data-testid="git-named-key"
-              >
-                <div className="flex flex-wrap items-center gap-2">
-                  <span className="font-mono text-[11px] font-medium text-fg-primary">
-                    {k.name}
-                  </span>
-                  <span className="rounded bg-surface-3 px-1.5 py-0.5 text-[10px] text-fg-secondary">
-                    {k.type === "rsa" ? "RSA" : "ED25519"}
-                  </span>
-                  <span className="min-w-0 flex-1 truncate font-mono text-[10px] text-fg-muted">
-                    {k.fingerprint}
-                  </span>
-                  <button type="button" className={BTN} onClick={() => void copyText(k.publicKey)}>
-                    <Copy className="h-3.5 w-3.5" />
-                    {t("gitIdentity.copy")}
-                  </button>
-                  {id.writable && (
-                    <button
-                      type="button"
-                      className={`${BTN} hover:text-status-danger`}
-                      disabled={busy}
-                      aria-label={`${t("gitIdentity.remove")} ${k.name}`}
-                      onClick={() => void removeNamed(k.id!)}
-                    >
-                      <Trash2 className="h-3.5 w-3.5" />
-                    </button>
-                  )}
-                </div>
-                <textarea
-                  readOnly
-                  aria-label={`${t("gitIdentity.publicKey")} ${k.name}`}
-                  value={k.publicKey}
-                  rows={2}
-                  onFocus={(e) => e.currentTarget.select()}
-                  className={`${INPUT} resize-none break-all font-mono text-[10px]`}
-                />
-              </div>
-            ))}
-          </section>
-        )}
+        </PageTabs>
 
         {terminal && (
           <div className="flex items-start gap-2 rounded border border-border p-2">
@@ -687,80 +818,6 @@ export function GitIdentitySettings() {
             />
           </div>
         )}
-
-        {id.sshUsers !== undefined && (otherRows.length > 0 || id.writable) && (
-          <details className="rounded border border-border p-2" open={otherRows.length > 0}>
-            <summary className="cursor-pointer text-[11px] text-fg-primary">
-              {t("gitIdentity.otherTitle")}
-            </summary>
-            <div className="mt-1.5 space-y-1.5">
-              <div className="text-[10px] text-fg-muted">{t("gitIdentity.otherHint")}</div>
-              {otherRows.map((r) => (
-                <div key={r.alias ?? r.host} className="flex items-center gap-2">
-                  <span className="min-w-0 flex-1 truncate font-mono text-[11px] text-fg-secondary">
-                    {r.alias ? `ssh://${r.alias}/ → ` : ""}
-                    {r.user}@{r.host} · {keyLabel(r.key)}
-                  </span>
-                  {id.writable && (
-                    <button
-                      type="button"
-                      className={`${BTN} hover:text-status-danger`}
-                      disabled={busy}
-                      aria-label={`${t("gitIdentity.remove")} ${r.alias ?? r.host}`}
-                      onClick={() =>
-                        void run(() => api.gitIdentity.removeSshUser(r.alias ?? r.host))
-                      }
-                    >
-                      <Trash2 className="h-3.5 w-3.5" />
-                    </button>
-                  )}
-                </div>
-              ))}
-              {id.writable && (
-                <form
-                  className="grid gap-2 sm:grid-cols-[2fr_1fr_1fr_1fr_auto]"
-                  onSubmit={(e) => {
-                    e.preventDefault();
-                    void saveOther();
-                  }}
-                >
-                  <input
-                    aria-label={t("gitIdentity.otherHost")}
-                    placeholder="git.example.com"
-                    value={other.host}
-                    onChange={(e) => setOther({ ...other, host: e.target.value })}
-                    className={`${INPUT} font-mono`}
-                  />
-                  <input
-                    aria-label={t("gitIdentity.otherUser")}
-                    placeholder={t("gitIdentity.otherUser")}
-                    autoComplete="off"
-                    value={other.user}
-                    onChange={(e) => setOther({ ...other, user: e.target.value })}
-                    className={`${INPUT} font-mono`}
-                  />
-                  <input
-                    aria-label={t("gitIdentity.alias")}
-                    title={t("gitIdentity.aliasHint")}
-                    placeholder={t("gitIdentity.aliasPlaceholder")}
-                    autoComplete="off"
-                    value={other.alias}
-                    onChange={(e) => setOther({ ...other, alias: e.target.value })}
-                    className={`${INPUT} font-mono`}
-                  />
-                  {keySelect(other.key, (key) => setOther({ ...other, key }))}
-                  <button
-                    type="submit"
-                    className={BTN}
-                    disabled={busy || !other.host.trim() || !other.user.trim()}
-                  >
-                    {t("gitIdentity.awsSave")}
-                  </button>
-                </form>
-              )}
-            </div>
-          </details>
-        )}
         <p className="text-[10px] text-fg-muted">{t("gitIdentity.privateNote")}</p>
       </div>
 

client/src/components/settings/__tests__/GitIdentitySettings.test.tsx

@@ -4,7 +4,8 @@
  * first, and a member (S3) adds an HTTPS login of their own while the host's
  * view leaves HTTPS to the shared Git credentials table, and an SSH user per
  * host is saved — AWS CodeCommit's key ID inside its own RSA section, any
- * other host under "Other SSH hosts" — so the sections never mix; a named key
+ * other host under "Other SSH hosts" — each kind of host in its own tab, so
+ * the sections never mix; a named key
  * is made beside the default ones, and a second AWS account is saved under
  * its own name with the one key it uses.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -47,6 +48,10 @@ const view = (over: Partial<GitIdentity> = {}): GitIdentity => ({
   ...over,
 });
 
+/** Opens one tab of the SSH keys. */
+const tab = async (name: string | RegExp) =>
+  userEvent.click(await screen.findByRole("tab", { name }));
+
 beforeEach(() => {
   vi.clearAllMocks();
 });
@@ -100,6 +105,7 @@ describe("GitIdentitySettings", () => {
       view({ ssh: { ...KEY, type: "rsa", publicKey: "ssh-rsa AAAAB3 an@agenthub" } })
     );
     render(<GitIdentitySettings />);
+    await tab("AWS CodeCommit");
     const aws = await screen.findByRole("region", { name: "AWS CodeCommit" });
     await userEvent.click(within(aws).getByRole("button", { name: "Generate key" }));
     expect(api.gitIdentity.generateKey).toHaveBeenCalledWith(false, "rsa");
@@ -119,11 +125,14 @@ describe("GitIdentitySettings", () => {
     vi.mocked(api.gitIdentity.removeKey).mockResolvedValue(view({ ssh: ED, sshKeys: [ED] }));
     render(<GitIdentitySettings />);
     const gh = await screen.findByRole("region", { name: /GitHub/ });
-    const aws = screen.getByRole("region", { name: "AWS CodeCommit" });
     expect(within(gh).getByLabelText("Public key ED25519")).toHaveValue(ED.publicKey);
-    expect(within(aws).getByLabelText("Public key RSA")).toHaveValue(RSA.publicKey);
-    // Each section explains only its own host.
+    // One tab at a time: the other host's section is not on screen.
+    expect(screen.queryByRole("region", { name: "AWS CodeCommit" })).toBeNull();
     expect(within(gh).queryByText(/IAM/)).toBeNull();
+    await tab("AWS CodeCommit");
+    const aws = screen.getByRole("region", { name: "AWS CodeCommit" });
+    expect(screen.queryByRole("region", { name: /GitHub/ })).toBeNull();
+    expect(within(aws).getByLabelText("Public key RSA")).toHaveValue(RSA.publicKey);
     expect(within(aws).queryByText(/GitHub/)).toBeNull();
     expect(screen.getByRole("switch", { name: /terminal/ })).toBeChecked();
     await userEvent.click(within(aws).getByRole("button", { name: "Delete" }));
@@ -160,7 +169,7 @@ describe("GitIdentitySettings", () => {
       view({ ssh: KEY, sshUsers: [{ host: "git.example.com", user: "deploy" }] })
     );
     render(<GitIdentitySettings />);
-    await userEvent.click(await screen.findByText("Other SSH hosts (advanced)"));
+    await tab("Other hosts");
     await userEvent.type(screen.getByLabelText("Host"), "ssh://git.example.com/x");
     await userEvent.type(screen.getByLabelText("User name"), "deploy");
     const form = screen.getByLabelText("Host").closest("form")!;
@@ -228,13 +237,17 @@ describe("GitIdentitySettings", () => {
       view({ sshKeys: [RSA], sshUsers: [] })
     );
     render(<GitIdentitySettings />);
-    const more = await screen.findByRole("region", { name: "More SSH keys" });
+    // Only an RSA key: the AWS tab opens first.
+    expect(await screen.findByRole("region", { name: "AWS CodeCommit" })).toBeInTheDocument();
+    await tab("More keys");
+    let more = screen.getByRole("region", { name: "More SSH keys" });
     await userEvent.click(within(more).getByRole("button", { name: "New key" }));
     await userEvent.type(within(more).getByLabelText("Key name"), "AWS-Prod");
     await userEvent.click(within(more).getByRole("button", { name: "Generate key" }));
     expect(api.gitIdentity.generateKey).toHaveBeenCalledWith(false, "rsa", "aws-prod");
     expect(await within(more).findByLabelText("Public key aws-prod")).toHaveValue("ssh-rsa B prod");
 
+    await tab("AWS CodeCommit");
     const aws = screen.getByRole("region", { name: "AWS CodeCommit" });
     await userEvent.type(within(aws).getByLabelText("SSH key ID"), "APKA2");
     await userEvent.type(within(aws).getByLabelText("Account name"), "aws-prod");
@@ -251,6 +264,8 @@ describe("GitIdentitySettings", () => {
     ).toBeInTheDocument();
     expect(within(aws).getByText("git clone ssh://aws-prod/v1/repos/<repo>")).toBeInTheDocument();
 
+    await tab("More keys (1)");
+    more = screen.getByRole("region", { name: "More SSH keys" });
     await userEvent.click(within(more).getByRole("button", { name: "Delete aws-prod" }));
     await waitFor(() =>
       expect(api.gitIdentity.removeKeyById).toHaveBeenCalledWith("id_rsa_aws-prod")