diff --git a/client/src/components/lanes/FileExplorer.tsx b/client/src/components/lanes/FileExplorer.tsx
index 6ed9bd0d..7387ea9d 100644
--- a/client/src/components/lanes/FileExplorer.tsx
+++ b/client/src/components/lanes/FileExplorer.tsx
@@ -102,6 +102,11 @@ type Clip = { place: FsPlace; paths: string[]; cut: boolean };
 // The clipboard outlives the dialog and a workspace switch, like a desktop's.
 let clipboard: Clip | null = null;
 
+/** A menu item's handler that closes its menu first. */
+const pick = (m: { close: () => void }, fn: () => void) => () => {
+  m.close();
+  fn();
+};
 /** The workspace id of a place, or null for a home. */
 const laneOf = (t: FsPlace) => (isHomePlace(t) ? null : typeof t === "number" ? t : t.lane);
 /** A workspace's own folder (not a session worktree or an extra folder), or a home. */
@@ -279,6 +284,9 @@ export function FileBrowser({
   const fileInput = useRef<HTMLInputElement>(null);
   const folderInput = useRef<HTMLInputElement>(null);
   const ctx = useContextMenu<FsEntry | null>();
+  // The sidebar's places and the path bar's crumbs have their own menus.
+  const placeCtx = useContextMenu<{ home: string } | { lane: Lane }>();
+  const crumbCtx = useContextMenu<string>();
 
   // A new caller target (another workspace's Files tab, the page's URL) —
   // not the echo of our own `go()` through the page's URL, which would wipe
@@ -668,6 +676,18 @@ export function FileBrowser({
     const item = trash.find((i) => i.id === id);
     await run(() => api.files.purge(target, id, item?.store), t("fx.purged"));
   };
+  /** Empty one user's whole Trash from the Trash root — asked first. */
+  const emptyTrashOf = async (home: string, count: number) => {
+    const ok = await confirmDialog({
+      title: t("fx.emptyTrashTitle"),
+      message: t("fx.emptyTrashBody", {
+        count,
+        where: home === "me" ? t("fx.myTrash") : t("fx.trashOf", { name: homeName(home) }),
+      }),
+      confirmLabel: t("fx.emptyTrash"),
+    });
+    if (ok) await run(() => api.files.purge({ home }, "all"), t("fx.purged"));
+  };
   const restoreItem = (id: string) => {
     const item = trash.find((i) => i.id === id);
     void run(() => api.files.restore(target, id, item?.store), t("fx.restored"));
@@ -772,6 +792,7 @@ export function FileBrowser({
               <button
                 type="button"
                 onClick={() => go("", { home: "me" })}
+                onContextMenu={(e) => placeCtx.open(e, { home: "me" })}
                 className={placeClass(
                   view === "files" && isHomePlace(target) && target.home === "me"
                 )}
@@ -794,6 +815,7 @@ export function FileBrowser({
                     type="button"
                     title={t("fx.readOnlyHome")}
                     onClick={() => go("", { home: h.id })}
+                    onContextMenu={(e) => placeCtx.open(e, { home: h.id })}
                     className={placeClass(
                       view === "files" && isHomePlace(target) && target.home === h.id
                     )}
@@ -814,6 +836,7 @@ export function FileBrowser({
               type="button"
               title={l.cwd}
               onClick={() => go("", l.id)}
+              onContextMenu={(e) => placeCtx.open(e, { lane: l })}
               className={placeClass(
                 view === "files" && !isHomePlace(target) && laneOf(target) === l.id
               )}
@@ -902,6 +925,7 @@ export function FileBrowser({
                   <button
                     type="button"
                     onClick={() => go("")}
+                    onContextMenu={(e) => crumbCtx.open(e, "")}
                     onDragOver={(e) => e.preventDefault()}
                     onDrop={(e) => void onDrop(e, "")}
                     className={`flex shrink-0 items-center gap-1.5 rounded px-2 py-1 text-sm hover:bg-surface-3 ${
@@ -921,6 +945,7 @@ export function FileBrowser({
                       <button
                         type="button"
                         onClick={() => go(crumbs.slice(0, i + 1).join("/"))}
+                        onContextMenu={(e) => crumbCtx.open(e, crumbs.slice(0, i + 1).join("/"))}
                         onDragOver={(e) => e.preventDefault()}
                         onDrop={(e) => void onDrop(e, crumbs.slice(0, i + 1).join("/"))}
                         className={`rounded px-2 py-1 text-sm hover:bg-surface-3 ${
@@ -1266,6 +1291,8 @@ export function FileBrowser({
             loading={loading}
             homeName={homeName}
             onOpen={openTrash}
+            onEmpty={(home, count) => void emptyTrashOf(home, count)}
+            onRefresh={() => void load()}
           />
         ) : (
           <TrashView
@@ -1274,6 +1301,7 @@ export function FileBrowser({
             laneName={laneName}
             onRestore={restoreItem}
             onPurge={(id) => void purge(id)}
+            onRefresh={() => void load()}
           />
         )}
 
@@ -1449,6 +1477,78 @@ export function FileBrowser({
         </ContextMenu>
       )}
 
+      {placeCtx.menu && (
+        <ContextMenu
+          x={placeCtx.menu.x}
+          y={placeCtx.menu.y}
+          onClose={placeCtx.close}
+          testId="fx-place-menu"
+        >
+          {"lane" in placeCtx.menu.item
+            ? (() => {
+                const l = placeCtx.menu.item.lane;
+                return (
+                  <>
+                    <MenuItem onSelect={pick(placeCtx, () => go("", l.id))}>
+                      {t("fx.open")}
+                    </MenuItem>
+                    <MenuItem onSelect={pick(placeCtx, () => void copyText(l.cwd))}>
+                      {t("fx.copyPath")}
+                    </MenuItem>
+                  </>
+                );
+              })()
+            : (() => {
+                const home = (placeCtx.menu.item as { home: string }).home;
+                return (
+                  <>
+                    <MenuItem onSelect={pick(placeCtx, () => go("", { home }))}>
+                      {t("fx.open")}
+                    </MenuItem>
+                    <MenuItem onSelect={pick(placeCtx, () => openTrash(home))}>
+                      {t("fx.openTrash")}
+                    </MenuItem>
+                  </>
+                );
+              })()}
+        </ContextMenu>
+      )}
+
+      {crumbCtx.menu && (
+        <ContextMenu
+          x={crumbCtx.menu.x}
+          y={crumbCtx.menu.y}
+          onClose={crumbCtx.close}
+          testId="fx-crumb-menu"
+        >
+          {(() => {
+            const dir = crumbCtx.menu.item;
+            const name = dir.split("/").pop() || placeName(target);
+            return (
+              <>
+                <MenuItem onSelect={pick(crumbCtx, () => go(dir))}>{t("fx.open")}</MenuItem>
+                <MenuItem
+                  onSelect={pick(crumbCtx, () =>
+                    download([{ name, path: dir, type: "dir", size: null, mtime: 0 }])
+                  )}
+                >
+                  {t("fx.downloadZip")}
+                </MenuItem>
+                {!ro && clip && (
+                  <MenuItem onSelect={pick(crumbCtx, () => void paste(dir))}>
+                    {t("fx.pasteInto")}
+                  </MenuItem>
+                )}
+                <MenuSeparator />
+                <MenuItem onSelect={pick(crumbCtx, () => void copyText(dir || "/"))}>
+                  {t("fx.copyPath")}
+                </MenuItem>
+              </>
+            );
+          })()}
+        </ContextMenu>
+      )}
+
       {ask && (
         <div
           className="absolute inset-0 z-20 flex items-center justify-center bg-black/50"
@@ -1763,6 +1863,8 @@ function TrashFolders({
   loading,
   homeName,
   onOpen,
+  onEmpty,
+  onRefresh,
 }: {
   homes: FsHome[];
   /** Every Trash's items, merged, each tagged with its `home`. */
@@ -1773,13 +1875,20 @@ function TrashFolders({
   loading: boolean;
   homeName: (id: string) => string;
   onOpen: (home: string) => void;
+  onEmpty: (home: string, count: number) => void;
+  onRefresh: () => void;
 }) {
   const { t } = useTranslation(["lanes"]);
+  const menu = useContextMenu<string | null>();
   const counts = new Map<string, number>();
   for (const i of items) if (i.home) counts.set(i.home, (counts.get(i.home) ?? 0) + 1);
   const ordered = [...homes.filter((h) => h.id === "me"), ...homes.filter((h) => h.id !== "me")];
   return (
-    <div className="flex min-h-0 flex-1 flex-col" data-testid="fx-trash-root">
+    <div
+      className="flex min-h-0 flex-1 flex-col"
+      data-testid="fx-trash-root"
+      onContextMenu={(e) => menu.open(e, null)}
+    >
       <div className="border-b border-border px-4 py-2 text-sm text-fg-secondary">
         {t("fx.trashFoldersHint")}
       </div>
@@ -1799,6 +1908,7 @@ function TrashFolders({
               type="button"
               title={t("fx.trashOf", { name: h.id === "me" ? t("fx.myHome") : h.label })}
               onClick={() => onOpen(h.id)}
+              onContextMenu={(e) => menu.open(e, h.id)}
               className="flex flex-col items-center gap-1 rounded-lg px-2 py-3 text-center hover:bg-surface-2"
               data-testid="fx-trash-folder"
             >
@@ -1833,6 +1943,32 @@ function TrashFolders({
           );
         })}
       </div>
+      {menu.menu && (
+        <ContextMenu
+          x={menu.menu.x}
+          y={menu.menu.y}
+          onClose={menu.close}
+          testId="fx-trash-root-menu"
+        >
+          {menu.menu.item !== null ? (
+            (() => {
+              const home = menu.menu.item;
+              const n = counts.get(home) ?? 0;
+              return (
+                <>
+                  <MenuItem onSelect={pick(menu, () => onOpen(home))}>{t("fx.open")}</MenuItem>
+                  <MenuSeparator />
+                  <MenuItem danger disabled={!n} onSelect={pick(menu, () => onEmpty(home, n))}>
+                    {t("fx.emptyTrash")}
+                  </MenuItem>
+                </>
+              );
+            })()
+          ) : (
+            <MenuItem onSelect={pick(menu, onRefresh)}>{t("fx.refresh")}</MenuItem>
+          )}
+        </ContextMenu>
+      )}
     </div>
   );
 }
@@ -1843,16 +1979,23 @@ function TrashView({
   laneName,
   onRestore,
   onPurge,
+  onRefresh,
 }: {
   items: FsTrashItem[];
   error: string | null;
+  onRefresh: () => void;
   laneName: (id: number) => string;
   onRestore: (id: string) => void;
   onPurge: (id: string) => void;
 }) {
   const { t } = useTranslation(["lanes"]);
+  const menu = useContextMenu<FsTrashItem | null>();
   return (
-    <div className="flex min-h-0 flex-1 flex-col" data-testid="fx-trash">
+    <div
+      className="flex min-h-0 flex-1 flex-col"
+      data-testid="fx-trash"
+      onContextMenu={(e) => menu.open(e, null)}
+    >
       {error && (
         <div className="m-4 rounded-md border border-status-danger/40 bg-status-danger/10 px-3 py-2 text-sm text-status-danger">
           {error}
@@ -1885,6 +2028,7 @@ function TrashView({
                 key={i.id}
                 className="border-b border-border/40 hover:bg-surface-2"
                 data-testid="fx-trash-row"
+                onContextMenu={(e) => menu.open(e, i)}
               >
                 <td className="truncate px-4 py-1.5">
                   <span className="flex items-center gap-2" title={i.path}>
@@ -1932,6 +2076,37 @@ function TrashView({
           </div>
         )}
       </div>
+      {menu.menu && (
+        <ContextMenu x={menu.menu.x} y={menu.menu.y} onClose={menu.close} testId="fx-trash-menu">
+          {menu.menu.item ? (
+            (() => {
+              const i = menu.menu.item;
+              return (
+                <>
+                  <MenuItem onSelect={pick(menu, () => onRestore(i.id))}>
+                    {t("fx.restore")}
+                  </MenuItem>
+                  <MenuItem onSelect={pick(menu, () => void copyText(i.path))}>
+                    {t("fx.copyPath")}
+                  </MenuItem>
+                  <MenuSeparator />
+                  <MenuItem danger onSelect={pick(menu, () => onPurge(i.id))}>
+                    {t("fx.purge")}
+                  </MenuItem>
+                </>
+              );
+            })()
+          ) : (
+            <>
+              <MenuItem onSelect={pick(menu, onRefresh)}>{t("fx.refresh")}</MenuItem>
+              <MenuSeparator />
+              <MenuItem danger disabled={!items.length} onSelect={pick(menu, () => onPurge("all"))}>
+                {t("fx.emptyTrash")}
+              </MenuItem>
+            </>
+          )}
+        </ContextMenu>
+      )}
     </div>
   );
 }
diff --git a/client/src/components/lanes/__tests__/FileExplorer.test.tsx b/client/src/components/lanes/__tests__/FileExplorer.test.tsx
index 6c4f1de9..6327b409 100644
--- a/client/src/components/lanes/__tests__/FileExplorer.test.tsx
+++ b/client/src/components/lanes/__tests__/FileExplorer.test.tsx
@@ -297,6 +297,91 @@ describe("FileExplorer", () => {
     expect(await screen.findAllByTestId("fx-trash-folder")).toHaveLength(2);
   });
 
+  it("right-clicks a Trash folder to empty it, and a Trash row to restore it", async () => {
+    vi.mocked(api.files.allTrash).mockResolvedValue({
+      items: [
+        {
+          id: "bob12345",
+          name: "old",
+          laneId: null,
+          path: "old",
+          isDir: true,
+          deletedAt: "2026-10-15T08:00:00.000Z",
+          store: "host",
+          home: "bob",
+          owner: "Bob",
+        },
+      ],
+      errors: [],
+    });
+    vi.mocked(api.files.trash).mockResolvedValue({
+      items: [
+        {
+          id: "bob12345",
+          name: "old",
+          laneId: null,
+          path: "old",
+          isDir: true,
+          deletedAt: "2026-10-15T08:00:00.000Z",
+          store: "host",
+        },
+      ],
+    });
+    vi.mocked(api.files.restore).mockResolvedValue({ path: "old", laneId: null });
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("a.txt");
+    await user.click(
+      within(screen.getByTestId("fx-trashes")).getByRole("button", { name: "Trash" })
+    );
+    const folders = await screen.findAllByTestId("fx-trash-folder");
+    // My Trash is empty: its Empty Trash is disabled.
+    fireEvent.contextMenu(folders[0]!);
+    expect(
+      within(screen.getByTestId("fx-trash-root-menu")).getByRole("menuitem", {
+        name: "Empty Trash",
+      })
+    ).toHaveProperty("disabled", true);
+    fireEvent.keyDown(document, { key: "Escape" });
+    fireEvent.contextMenu(folders[1]!);
+    vi.mocked(confirmDialog).mockResolvedValueOnce(true);
+    await user.click(
+      within(screen.getByTestId("fx-trash-root-menu")).getByRole("menuitem", {
+        name: "Empty Trash",
+      })
+    );
+    await waitFor(() => expect(api.files.purge).toHaveBeenCalledWith({ home: "bob" }, "all"));
+    expect(screen.queryByTestId("fx-trash-root-menu")).toBeNull();
+
+    fireEvent.contextMenu((await screen.findAllByTestId("fx-trash-folder"))[1]!);
+    await user.click(
+      within(screen.getByTestId("fx-trash-root-menu")).getByRole("menuitem", { name: "Open" })
+    );
+    fireEvent.contextMenu(await screen.findByTestId("fx-trash-row"));
+    await user.click(
+      within(screen.getByTestId("fx-trash-menu")).getByRole("menuitem", { name: "Restore" })
+    );
+    await waitFor(() =>
+      expect(api.files.restore).toHaveBeenCalledWith({ home: "bob" }, "bob12345", "host")
+    );
+  });
+
+  it("right-clicks a sidebar workspace and a path crumb", async () => {
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("a.txt");
+    fireEvent.contextMenu(screen.getByRole("button", { name: "two" }));
+    await user.click(
+      within(screen.getByTestId("fx-place-menu")).getByRole("menuitem", { name: "Open" })
+    );
+    await waitFor(() => expect(api.files.list).toHaveBeenLastCalledWith(2, ""));
+    fireEvent.contextMenu(screen.getByRole("button", { name: "Home" }));
+    await user.click(
+      within(screen.getByTestId("fx-place-menu")).getByRole("menuitem", { name: "Open Trash" })
+    );
+    await waitFor(() => expect(api.files.trash).toHaveBeenLastCalledWith({ home: "me" }));
+  });
+
   it("shows why a Trash could not be read instead of an empty one", async () => {
     vi.mocked(api.files.trash).mockRejectedValue(new Error("ENOENT: no such folder"));
     const user = userEvent.setup();
diff --git a/client/src/components/settings/GitIdentitySettings.tsx b/client/src/components/settings/GitIdentitySettings.tsx
index a05809ee..c4d13a69 100644
--- a/client/src/components/settings/GitIdentitySettings.tsx
+++ b/client/src/components/settings/GitIdentitySettings.tsx
@@ -10,7 +10,10 @@
  * it, and whether git typed in the account's own terminal uses it too (a
  * switch over `core.sshCommand` in its `~/.gitconfig`, issue #82), the SSH
  * login name per host (AWS CodeCommit's SSH key ID, a `url.<…>.insteadOf` in
- * that same file, so a plain `ssh://git-codecommit…` URL works) — and, for
+ * that same file, so a plain `ssh://git-codecommit…` URL works), and for
+ * SEVERAL accounts (two AWS accounts, a second GitHub user) named keys made
+ * beside the default ones plus a login per account NAME (`ssh://<name>/…`),
+ * each tied to the one key it uses — and, for
  * a user with their own Linux account (S3), their own HTTPS
  * logins. The host account's HTTPS logins are the shared Git credentials
  * table above it, so this lists them only for a member. The private key and
@@ -206,9 +209,36 @@ export function GitIdentitySettings() {
 
   // ed25519 suits GitHub/GitLab/Gitea; AWS IAM (CodeCommit) accepts only RSA.
   // An account may hold one of each; an older server answers `ssh` only.
-  const keys = id ? (id.sshKeys ?? (id.ssh ? [id.ssh] : [])) : [];
+  const keys: Key[] = id ? (id.sshKeys ?? (id.ssh ? [id.ssh] : [])) : [];
   const terminal = id?.sshTerminal ?? id?.ssh?.terminal ?? null;
-  const keyOf = (type: "ed25519" | "rsa") => keys.find((k) => (k.type ?? "ed25519") === type);
+  // The default key of a type (a named key sits beside it).
+  const keyOf = (type: "ed25519" | "rsa") =>
+    keys.find((k) => (k.type ?? "ed25519") === type && !k.name);
+  const named = keys.filter((k) => k.name);
+  const keyLabel = (keyId: string | null | undefined) => {
+    const k = keyId ? keys.find((x) => x.id === keyId) : undefined;
+    if (!k) return t("gitIdentity.anyKey");
+    return k.name ?? (k.type === "rsa" ? t("gitIdentity.defaultRsa") : t("gitIdentity.defaultEd"));
+  };
+  const [newKey, setNewKey] = useState<{ name: string; type: "ed25519" | "rsa" } | null>(null);
+  const makeNamed = async () => {
+    if (!newKey) return;
+    const ok = await run(
+      () => api.gitIdentity.generateKey(false, newKey.type, newKey.name.trim().toLowerCase()),
+      t("gitIdentity.keyMade")
+    );
+    if (ok) setNewKey(null);
+  };
+  const removeNamed = async (keyId: string) => {
+    if (
+      !(await confirmDialog({
+        title: t("gitIdentity.removeKeyConfirm"),
+        confirmLabel: t("gitIdentity.remove"),
+      }))
+    )
+      return;
+    await run(() => api.gitIdentity.removeKeyById(keyId));
+  };
   const generate = async (type: "ed25519" | "rsa") => {
     const taken = !!keyOf(type);
     if (
@@ -260,7 +290,7 @@ export function GitIdentitySettings() {
     return m ? [{ ...r, region: m[1] ?? "" }] : [];
   });
   const otherRows = sshUsers.filter((r) => !CODECOMMIT_RE.test(r.host));
-  const [aws, setAws] = useState({ keyId: "", region: "ap-southeast-1" });
+  const [aws, setAws] = useState({ keyId: "", region: "ap-southeast-1", alias: "", key: "" });
   const saveAws = async () => {
     let user = aws.keyId.trim();
     let host = `git-codecommit.${aws.region}.amazonaws.com`;
@@ -270,23 +300,55 @@ export function GitIdentitySettings() {
       user = m[1];
       host = m[2].toLowerCase();
     }
+    const alias = aws.alias.trim().toLowerCase();
     const ok = await run(
-      () => api.gitIdentity.setSshUser({ host, user }),
-      t("gitIdentity.awsSaved", { region: CODECOMMIT_RE.exec(host)?.[1] ?? host })
+      () =>
+        api.gitIdentity.setSshUser({
+          host,
+          user,
+          ...(alias ? { alias } : {}),
+          ...(aws.key ? { key: aws.key } : {}),
+        }),
+      t("gitIdentity.awsSaved", { region: alias || (CODECOMMIT_RE.exec(host)?.[1] ?? host) })
     );
-    if (ok) setAws({ ...aws, keyId: "" });
+    if (ok) setAws({ ...aws, keyId: "", alias: "" });
   };
-  const [other, setOther] = useState({ host: "", user: "" });
+  const [other, setOther] = useState({ host: "", user: "", alias: "", key: "" });
   const saveOther = async () => {
     let host = other.host.trim();
     const m = /^ssh:\/\/(?:[^@/]+@)?([^/]+)/i.exec(host);
     if (m?.[1]) host = m[1];
+    const alias = other.alias.trim().toLowerCase();
     const ok = await run(
-      () => api.gitIdentity.setSshUser({ host, user: other.user.trim() }),
-      t("gitIdentity.otherSaved", { host })
+      () =>
+        api.gitIdentity.setSshUser({
+          host,
+          user: other.user.trim(),
+          ...(alias ? { alias } : {}),
+          ...(other.key ? { key: other.key } : {}),
+        }),
+      t("gitIdentity.otherSaved", { host: alias || host })
     );
-    if (ok) setOther({ host: "", user: "" });
+    if (ok) setOther({ host: "", user: "", alias: "", key: "" });
   };
+  /** The key picker of a login form: every key, or one. */
+  const keySelect = (value: string, onChange: (v: string) => void, only?: "rsa") => (
+    <select
+      aria-label={t("gitIdentity.loginKey")}
+      value={value}
+      onChange={(e) => onChange(e.target.value)}
+      className="select !py-1 !text-xs"
+    >
+      <option value="">{t("gitIdentity.anyKey")}</option>
+      {keys
+        .filter((k) => k.id && (!only || k.type === only))
+        .map((k) => (
+          <option key={k.id} value={k.id}>
+            {keyLabel(k.id)}
+          </option>
+        ))}
+    </select>
+  );
 
   const removeLogin = async (host: string) => {
     if (
@@ -423,17 +485,20 @@ export function GitIdentitySettings() {
             {id.sshUsers === undefined ? null : (
               <>
                 {awsRows.map((r) => (
-                  <div key={r.host} className="mt-1 flex items-center gap-2">
+                  <div key={r.alias ?? r.host} className="mt-1 flex items-center gap-2">
                     <span className="min-w-0 flex-1 truncate font-mono text-[11px] text-fg-secondary">
-                      {r.region} · {r.user}
+                      {r.alias ? `${r.alias} · ` : ""}
+                      {r.region} · {r.user} · {keyLabel(r.key)}
                     </span>
                     {id.writable && (
                       <button
                         type="button"
                         className={`${BTN} hover:text-status-danger`}
                         disabled={busy}
-                        aria-label={`${t("gitIdentity.remove")} ${r.host}`}
-                        onClick={() => void run(() => api.gitIdentity.removeSshUser(r.host))}
+                        aria-label={`${t("gitIdentity.remove")} ${r.alias ?? r.host}`}
+                        onClick={() =>
+                          void run(() => api.gitIdentity.removeSshUser(r.alias ?? r.host))
+                        }
                       >
                         <Trash2 className="h-3.5 w-3.5" />
                       </button>
@@ -442,7 +507,7 @@ export function GitIdentitySettings() {
                 ))}
                 {id.writable && (
                   <form
-                    className="mt-1 grid gap-2 sm:grid-cols-[2fr_1fr_auto]"
+                    className="mt-1 grid gap-2 sm:grid-cols-[2fr_1fr_1fr_1fr_auto]"
                     onSubmit={(e) => {
                       e.preventDefault();
                       void saveAws();
@@ -468,11 +533,22 @@ export function GitIdentitySettings() {
                         </option>
                       ))}
                     </select>
+                    <input
+                      aria-label={t("gitIdentity.alias")}
+                      title={t("gitIdentity.aliasHint")}
+                      placeholder={t("gitIdentity.aliasPlaceholder")}
+                      autoComplete="off"
+                      value={aws.alias}
+                      onChange={(e) => setAws({ ...aws, alias: e.target.value })}
+                      className={`${INPUT} font-mono`}
+                    />
+                    {keySelect(aws.key, (key) => setAws({ ...aws, key }), "rsa")}
                     <button type="submit" className={BTN} disabled={busy || !aws.keyId.trim()}>
                       {t("gitIdentity.awsSave")}
                     </button>
                   </form>
                 )}
+                <div className="mt-1 text-[10px] text-fg-muted">{t("gitIdentity.awsMany")}</div>
               </>
             )}
           </Step>
@@ -480,12 +556,119 @@ export function GitIdentitySettings() {
             <div className="rounded border border-status-success/40 bg-status-success/10 p-2 text-[11px] text-fg-primary">
               {t("gitIdentity.awsReady")}
               {awsRows.map((r) => (
-                <Code key={r.host}>git clone ssh://{r.host}/v1/repos/&lt;repo&gt;</Code>
+                <Code key={r.alias ?? r.host}>
+                  git clone ssh://{r.alias ?? r.host}/v1/repos/&lt;repo&gt;
+                </Code>
               ))}
             </div>
           )}
         </KeyCard>
 
+        {(named.length > 0 || id.writable) && (
+          <section
+            aria-label={t("gitIdentity.moreKeysTitle")}
+            className="space-y-2 rounded border border-border p-2.5"
+          >
+            <div className="flex flex-wrap items-center gap-2">
+              <div className="min-w-0 flex-1">
+                <div className="text-xs font-medium text-fg-primary">
+                  {t("gitIdentity.moreKeysTitle")}
+                </div>
+                <div className="text-[10px] text-fg-muted">{t("gitIdentity.moreKeysSub")}</div>
+              </div>
+              {id.writable && !newKey && (
+                <button
+                  type="button"
+                  className={BTN}
+                  disabled={busy}
+                  onClick={() => setNewKey({ name: "", type: "rsa" })}
+                >
+                  <Plus className="h-3.5 w-3.5" />
+                  {t("gitIdentity.newKey")}
+                </button>
+              )}
+            </div>
+            {newKey && (
+              <form
+                className="grid gap-2 sm:grid-cols-[2fr_1fr_auto_auto]"
+                onSubmit={(e) => {
+                  e.preventDefault();
+                  void makeNamed();
+                }}
+              >
+                <input
+                  aria-label={t("gitIdentity.keyName")}
+                  placeholder={t("gitIdentity.keyNamePlaceholder")}
+                  autoComplete="off"
+                  autoFocus
+                  value={newKey.name}
+                  onChange={(e) => setNewKey({ ...newKey, name: e.target.value })}
+                  className={`${INPUT} font-mono`}
+                />
+                <select
+                  aria-label={t("gitIdentity.keyType")}
+                  value={newKey.type}
+                  onChange={(e) =>
+                    setNewKey({ ...newKey, type: e.target.value === "rsa" ? "rsa" : "ed25519" })
+                  }
+                  className="select !py-1 !text-xs"
+                >
+                  <option value="rsa">RSA 4096 (AWS)</option>
+                  <option value="ed25519">ED25519</option>
+                </select>
+                <button type="submit" className={BTN} disabled={busy || !newKey.name.trim()}>
+                  {t("gitIdentity.generate")}
+                </button>
+                <button type="button" className={BTN} onClick={() => setNewKey(null)}>
+                  {t("gitCreds.cancel")}
+                </button>
+              </form>
+            )}
+            {named.map((k) => (
+              <div
+                key={k.id}
+                className="space-y-1 rounded border border-border-light p-2"
+                data-testid="git-named-key"
+              >
+                <div className="flex flex-wrap items-center gap-2">
+                  <span className="font-mono text-[11px] font-medium text-fg-primary">
+                    {k.name}
+                  </span>
+                  <span className="rounded bg-surface-3 px-1.5 py-0.5 text-[10px] text-fg-secondary">
+                    {k.type === "rsa" ? "RSA" : "ED25519"}
+                  </span>
+                  <span className="min-w-0 flex-1 truncate font-mono text-[10px] text-fg-muted">
+                    {k.fingerprint}
+                  </span>
+                  <button type="button" className={BTN} onClick={() => void copyText(k.publicKey)}>
+                    <Copy className="h-3.5 w-3.5" />
+                    {t("gitIdentity.copy")}
+                  </button>
+                  {id.writable && (
+                    <button
+                      type="button"
+                      className={`${BTN} hover:text-status-danger`}
+                      disabled={busy}
+                      aria-label={`${t("gitIdentity.remove")} ${k.name}`}
+                      onClick={() => void removeNamed(k.id!)}
+                    >
+                      <Trash2 className="h-3.5 w-3.5" />
+                    </button>
+                  )}
+                </div>
+                <textarea
+                  readOnly
+                  aria-label={`${t("gitIdentity.publicKey")} ${k.name}`}
+                  value={k.publicKey}
+                  rows={2}
+                  onFocus={(e) => e.currentTarget.select()}
+                  className={`${INPUT} resize-none break-all font-mono text-[10px]`}
+                />
+              </div>
+            ))}
+          </section>
+        )}
+
         {terminal && (
           <div className="flex items-start gap-2 rounded border border-border p-2">
             <div className="min-w-0 flex-1">
@@ -513,17 +696,20 @@ export function GitIdentitySettings() {
             <div className="mt-1.5 space-y-1.5">
               <div className="text-[10px] text-fg-muted">{t("gitIdentity.otherHint")}</div>
               {otherRows.map((r) => (
-                <div key={r.host} className="flex items-center gap-2">
+                <div key={r.alias ?? r.host} className="flex items-center gap-2">
                   <span className="min-w-0 flex-1 truncate font-mono text-[11px] text-fg-secondary">
-                    {r.user}@{r.host}
+                    {r.alias ? `ssh://${r.alias}/ → ` : ""}
+                    {r.user}@{r.host} · {keyLabel(r.key)}
                   </span>
                   {id.writable && (
                     <button
                       type="button"
                       className={`${BTN} hover:text-status-danger`}
                       disabled={busy}
-                      aria-label={`${t("gitIdentity.remove")} ${r.host}`}
-                      onClick={() => void run(() => api.gitIdentity.removeSshUser(r.host))}
+                      aria-label={`${t("gitIdentity.remove")} ${r.alias ?? r.host}`}
+                      onClick={() =>
+                        void run(() => api.gitIdentity.removeSshUser(r.alias ?? r.host))
+                      }
                     >
                       <Trash2 className="h-3.5 w-3.5" />
                     </button>
@@ -532,7 +718,7 @@ export function GitIdentitySettings() {
               ))}
               {id.writable && (
                 <form
-                  className="grid gap-2 sm:grid-cols-[2fr_1fr_auto]"
+                  className="grid gap-2 sm:grid-cols-[2fr_1fr_1fr_1fr_auto]"
                   onSubmit={(e) => {
                     e.preventDefault();
                     void saveOther();
@@ -553,6 +739,16 @@ export function GitIdentitySettings() {
                     onChange={(e) => setOther({ ...other, user: e.target.value })}
                     className={`${INPUT} font-mono`}
                   />
+                  <input
+                    aria-label={t("gitIdentity.alias")}
+                    title={t("gitIdentity.aliasHint")}
+                    placeholder={t("gitIdentity.aliasPlaceholder")}
+                    autoComplete="off"
+                    value={other.alias}
+                    onChange={(e) => setOther({ ...other, alias: e.target.value })}
+                    className={`${INPUT} font-mono`}
+                  />
+                  {keySelect(other.key, (key) => setOther({ ...other, key }))}
                   <button
                     type="submit"
                     className={BTN}
diff --git a/client/src/components/settings/__tests__/GitIdentitySettings.test.tsx b/client/src/components/settings/__tests__/GitIdentitySettings.test.tsx
index 625b24ee..06c4d688 100644
--- a/client/src/components/settings/__tests__/GitIdentitySettings.test.tsx
+++ b/client/src/components/settings/__tests__/GitIdentitySettings.test.tsx
@@ -4,7 +4,9 @@
  * first, and a member (S3) adds an HTTPS login of their own while the host's
  * view leaves HTTPS to the shared Git credentials table, and an SSH user per
  * host is saved — AWS CodeCommit's key ID inside its own RSA section, any
- * other host under "Other SSH hosts" — so the sections never mix.
+ * other host under "Other SSH hosts" — so the sections never mix; a named key
+ * is made beside the default ones, and a second AWS account is saved under
+ * its own name with the one key it uses.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import { describe, it, expect, vi, beforeEach } from "vitest";
@@ -21,6 +23,7 @@ vi.mock("../../../lib/api", () => ({
       get: vi.fn(),
       generateKey: vi.fn(),
       removeKey: vi.fn(),
+      removeKeyById: vi.fn(),
       setTerminalSsh: vi.fn(),
       setSshUser: vi.fn(),
       removeSshUser: vi.fn(),
@@ -143,7 +146,7 @@ describe("GitIdentitySettings", () => {
     await userEvent.selectOptions(within(aws).getByLabelText("Region"), "eu-west-1");
     await userEvent.click(within(aws).getByRole("button", { name: "Save" }));
     expect(api.gitIdentity.setSshUser).toHaveBeenCalledWith({ host: H, user: "APKA1" });
-    expect(await within(aws).findByText("eu-west-1 · APKA1")).toBeInTheDocument();
+    expect(await within(aws).findByText("eu-west-1 · APKA1 · Any key")).toBeInTheDocument();
     expect(within(aws).getByText(`git clone ssh://${H}/v1/repos/<repo>`)).toBeInTheDocument();
     // A CodeCommit host never shows up again under "other hosts".
     expect(screen.queryByText(`APKA1@${H}`)).toBeNull();
@@ -166,7 +169,7 @@ describe("GitIdentitySettings", () => {
       host: "git.example.com",
       user: "deploy",
     });
-    expect(await screen.findByText("deploy@git.example.com")).toBeInTheDocument();
+    expect(await screen.findByText("deploy@git.example.com · Any key")).toBeInTheDocument();
   });
 
   it("warns while the commit author is unset and saves it", async () => {
@@ -194,4 +197,63 @@ describe("GitIdentitySettings", () => {
     expect(screen.queryByRole("button", { name: "Replace key" })).toBeNull();
     expect(screen.queryByRole("button", { name: "Add login" })).toBeNull();
   });
+
+  it("makes a named key and saves a second AWS account under its name with that key", async () => {
+    const RSA = {
+      id: "id_rsa",
+      type: "rsa" as const,
+      name: null,
+      publicKey: "ssh-rsa A x",
+      fingerprint: "SHA256:r",
+    };
+    const PROD = {
+      id: "id_rsa_aws-prod",
+      type: "rsa" as const,
+      name: "aws-prod",
+      publicKey: "ssh-rsa B prod",
+      fingerprint: "SHA256:p",
+    };
+    const H = "git-codecommit.ap-southeast-1.amazonaws.com";
+    vi.mocked(api.gitIdentity.get).mockResolvedValue(view({ sshKeys: [RSA], sshUsers: [] }));
+    vi.mocked(api.gitIdentity.generateKey).mockResolvedValue(
+      view({ sshKeys: [RSA, PROD], sshUsers: [] })
+    );
+    vi.mocked(api.gitIdentity.setSshUser).mockResolvedValue(
+      view({
+        sshKeys: [RSA, PROD],
+        sshUsers: [{ host: H, user: "APKA2", alias: "aws-prod", key: "id_rsa_aws-prod" }],
+      })
+    );
+    vi.mocked(api.gitIdentity.removeKeyById).mockResolvedValue(
+      view({ sshKeys: [RSA], sshUsers: [] })
+    );
+    render(<GitIdentitySettings />);
+    const more = await screen.findByRole("region", { name: "More SSH keys" });
+    await userEvent.click(within(more).getByRole("button", { name: "New key" }));
+    await userEvent.type(within(more).getByLabelText("Key name"), "AWS-Prod");
+    await userEvent.click(within(more).getByRole("button", { name: "Generate key" }));
+    expect(api.gitIdentity.generateKey).toHaveBeenCalledWith(false, "rsa", "aws-prod");
+    expect(await within(more).findByLabelText("Public key aws-prod")).toHaveValue("ssh-rsa B prod");
+
+    const aws = screen.getByRole("region", { name: "AWS CodeCommit" });
+    await userEvent.type(within(aws).getByLabelText("SSH key ID"), "APKA2");
+    await userEvent.type(within(aws).getByLabelText("Account name"), "aws-prod");
+    await userEvent.selectOptions(within(aws).getByLabelText("Key"), "id_rsa_aws-prod");
+    await userEvent.click(within(aws).getByRole("button", { name: "Save" }));
+    expect(api.gitIdentity.setSshUser).toHaveBeenCalledWith({
+      host: H,
+      user: "APKA2",
+      alias: "aws-prod",
+      key: "id_rsa_aws-prod",
+    });
+    expect(
+      await within(aws).findByText("aws-prod · ap-southeast-1 · APKA2 · aws-prod")
+    ).toBeInTheDocument();
+    expect(within(aws).getByText("git clone ssh://aws-prod/v1/repos/<repo>")).toBeInTheDocument();
+
+    await userEvent.click(within(more).getByRole("button", { name: "Delete aws-prod" }));
+    await waitFor(() =>
+      expect(api.gitIdentity.removeKeyById).toHaveBeenCalledWith("id_rsa_aws-prod")
+    );
+  });
 });
diff --git a/client/src/i18n/locales/en/artifacts.json b/client/src/i18n/locales/en/artifacts.json
index 518e9cab..aafe25fe 100644
--- a/client/src/i18n/locales/en/artifacts.json
+++ b/client/src/i18n/locales/en/artifacts.json
@@ -29,6 +29,7 @@
   "shareDone": "Shared to the Hub",
   "unshareDone": "Removed from the Hub",
   "open": "Open",
+  "copyLink": "Copy link",
   "preview": "Preview",
   "download": "Download",
   "install": "Install",
diff --git a/client/src/i18n/locales/en/lanes.json b/client/src/i18n/locales/en/lanes.json
index 673df395..b9c34d0e 100644
--- a/client/src/i18n/locales/en/lanes.json
+++ b/client/src/i18n/locales/en/lanes.json
@@ -596,6 +596,7 @@
   "fx.trashAt": "Trash ({{name}})",
   "fx.trashFoldersHint": "Each folder is one user's Trash — open it to restore or delete forever.",
   "fx.trashFolderEmpty": "Empty",
+  "fx.openTrash": "Open Trash",
   "fx.purged": "Deleted forever.",
   "fx.emptyTrashTitle": "Empty the Trash?",
   "fx.emptyTrashBody": "All {{count}} items in {{where}} will be deleted forever. This cannot be undone.",
diff --git a/client/src/i18n/locales/en/settings.json b/client/src/i18n/locales/en/settings.json
index f1752d6a..657fb698 100644
--- a/client/src/i18n/locales/en/settings.json
+++ b/client/src/i18n/locales/en/settings.json
@@ -937,7 +937,21 @@
     "otherHost": "Host",
     "otherUser": "User name",
     "otherSaved": "SSH user saved for {{host}}",
-    "privateNote": "Only the public key is ever shown; the private key never leaves the server."
+    "privateNote": "Only the public key is ever shown; the private key never leaves the server.",
+    "anyKey": "Any key",
+    "defaultEd": "ED25519 (default)",
+    "defaultRsa": "RSA (default)",
+    "loginKey": "Key",
+    "alias": "Account name",
+    "aliasPlaceholder": "name (optional)",
+    "aliasHint": "Leave empty for the default account of this host. Give a name (e.g. aws-prod, lowercase, no dot) for one more account: clone it as ssh://<name>/…",
+    "awsMany": "Several AWS accounts? Make one more RSA key below for each, upload it to that account, then save its SSH key ID here with an account name and that key. Clone each with ssh://<account name>/v1/repos/<repo>.",
+    "moreKeysTitle": "More SSH keys",
+    "moreKeysSub": "One per extra account — another AWS account, a second GitHub user. A login that names its key uses only that key.",
+    "newKey": "New key",
+    "keyName": "Key name",
+    "keyNamePlaceholder": "e.g. aws-prod",
+    "keyType": "Key type"
   },
   "gitCreds": {
     "title": "Git credentials",
diff --git a/client/src/i18n/locales/en/users.json b/client/src/i18n/locales/en/users.json
index 9aa4ed3b..249b59c7 100644
--- a/client/src/i18n/locales/en/users.json
+++ b/client/src/i18n/locales/en/users.json
@@ -234,5 +234,10 @@
     "errors": {
       "ETMUXSTUCK": "The server did not stop. Run the `sudo kill -9` command shown, as root, on the server."
     }
+  },
+  "rowMenu": {
+    "openHome": "Open home in Files",
+    "copyUsername": "Copy username",
+    "copyEmail": "Copy email"
   }
 }
diff --git a/client/src/i18n/locales/vi/artifacts.json b/client/src/i18n/locales/vi/artifacts.json
index 9b4a9171..d9824424 100644
--- a/client/src/i18n/locales/vi/artifacts.json
+++ b/client/src/i18n/locales/vi/artifacts.json
@@ -29,6 +29,7 @@
   "shareDone": "Đã chia sẻ lên Hub",
   "unshareDone": "Đã gỡ khỏi Hub",
   "open": "Mở",
+  "copyLink": "Sao chép link",
   "preview": "Xem",
   "download": "Tải về",
   "install": "Cài",
diff --git a/client/src/i18n/locales/vi/lanes.json b/client/src/i18n/locales/vi/lanes.json
index f83b4b7e..0536f7ca 100644
--- a/client/src/i18n/locales/vi/lanes.json
+++ b/client/src/i18n/locales/vi/lanes.json
@@ -596,6 +596,7 @@
   "fx.trashAt": "Thùng rác ({{name}})",
   "fx.trashFoldersHint": "Mỗi thư mục là Thùng rác của một user — mở ra để khôi phục hoặc xoá vĩnh viễn.",
   "fx.trashFolderEmpty": "Trống",
+  "fx.openTrash": "Mở Thùng rác",
   "fx.purged": "Đã xoá vĩnh viễn.",
   "fx.emptyTrashTitle": "Dọn sạch Thùng rác?",
   "fx.emptyTrashBody": "Toàn bộ {{count}} mục trong {{where}} sẽ bị xoá vĩnh viễn, không khôi phục được.",
diff --git a/client/src/i18n/locales/vi/settings.json b/client/src/i18n/locales/vi/settings.json
index 823b28e6..5c71e704 100644
--- a/client/src/i18n/locales/vi/settings.json
+++ b/client/src/i18n/locales/vi/settings.json
@@ -937,7 +937,21 @@
     "otherHost": "Host",
     "otherUser": "Tên user",
     "otherSaved": "Đã lưu SSH user cho {{host}}",
-    "privateNote": "Chỉ public key được hiển thị; private key không bao giờ rời khỏi server."
+    "privateNote": "Chỉ public key được hiển thị; private key không bao giờ rời khỏi server.",
+    "anyKey": "Mọi key",
+    "defaultEd": "ED25519 (mặc định)",
+    "defaultRsa": "RSA (mặc định)",
+    "loginKey": "Key",
+    "alias": "Tên tài khoản",
+    "aliasPlaceholder": "tên (tuỳ chọn)",
+    "aliasHint": "Để trống cho tài khoản mặc định của host này. Đặt tên (vd aws-prod, chữ thường, không dấu chấm) cho thêm một tài khoản: clone bằng ssh://<tên>/…",
+    "awsMany": "Nhiều tài khoản AWS? Tạo thêm một RSA key bên dưới cho mỗi tài khoản, upload lên tài khoản đó, rồi lưu SSH key ID ở đây kèm tên tài khoản và key đó. Clone từng cái bằng ssh://<tên tài khoản>/v1/repos/<repo>.",
+    "moreKeysTitle": "Thêm SSH key",
+    "moreKeysSub": "Mỗi key cho một tài khoản phụ — tài khoản AWS khác, user GitHub thứ hai. Tài khoản nào gắn key thì chỉ dùng đúng key đó.",
+    "newKey": "Key mới",
+    "keyName": "Tên key",
+    "keyNamePlaceholder": "vd aws-prod",
+    "keyType": "Loại key"
   },
   "gitCreds": {
     "title": "Git credentials",
diff --git a/client/src/i18n/locales/vi/users.json b/client/src/i18n/locales/vi/users.json
index 18d09622..3d35e9d4 100644
--- a/client/src/i18n/locales/vi/users.json
+++ b/client/src/i18n/locales/vi/users.json
@@ -234,5 +234,10 @@
     "errors": {
       "ETMUXSTUCK": "Server không dừng. Chạy lệnh `sudo kill -9` được nêu, bằng quyền root, trên máy server."
     }
+  },
+  "rowMenu": {
+    "openHome": "Mở home trong Files",
+    "copyUsername": "Sao chép username",
+    "copyEmail": "Sao chép email"
   }
 }
diff --git a/client/src/lib/api.ts b/client/src/lib/api.ts
index 5eba8680..7e00e3d4 100644
--- a/client/src/lib/api.ts
+++ b/client/src/lib/api.ts
@@ -2720,22 +2720,30 @@ export const api = {
      * Make the SSH key; `replace` swaps an existing one for a new pair.
      * `type`: ed25519 (default) or rsa (RSA 4096 — AWS CodeCommit takes only RSA).
      */
-    generateKey: (replace = false, type: "ed25519" | "rsa" = "ed25519") =>
+    generateKey: (replace = false, type: "ed25519" | "rsa" = "ed25519", name?: string) =>
       request<GitIdentity>("/me/git/ssh-key", {
         method: "POST",
-        body: JSON.stringify({ replace, type }),
+        body: JSON.stringify(name ? { replace, type, name } : { replace, type }),
       }),
-    /** DELETE /api/me/git/ssh-key — the key of `type`, or every key. */
+    /** DELETE /api/me/git/ssh-key — the default key of `type`, or every key. */
     removeKey: (type?: "ed25519" | "rsa") =>
       request<GitIdentity>(`/me/git/ssh-key${type ? `?type=${type}` : ""}`, { method: "DELETE" }),
+    /** DELETE /api/me/git/ssh-key?id= — one key by its id (a named one). */
+    removeKeyById: (id: string) =>
+      request<GitIdentity>(`/me/git/ssh-key?id=${encodeURIComponent(id)}`, { method: "DELETE" }),
     /** PUT /api/me/git/ssh-terminal — use the key for git typed in the account's terminal. */
     setTerminalSsh: (on: boolean) =>
       request<GitIdentity>("/me/git/ssh-terminal", { method: "PUT", body: JSON.stringify({ on }) }),
-    /** PUT /api/me/git/ssh-user — the SSH login name for a host (CodeCommit: the SSH key ID). */
-    setSshUser: (body: { host: string; user: string }) =>
+    /**
+     * PUT /api/me/git/ssh-user — an SSH login (CodeCommit: the SSH key ID as
+     * the user): for the host itself, or with `alias` one more account on it
+     * (`ssh://<alias>/…`); `key` = the only key it uses.
+     */
+    setSshUser: (body: { host: string; user: string; alias?: string; key?: string }) =>
       request<GitIdentity>("/me/git/ssh-user", { method: "PUT", body: JSON.stringify(body) }),
-    removeSshUser: (host: string) =>
-      request<GitIdentity>(`/me/git/ssh-user/${encodeURIComponent(host)}`, { method: "DELETE" }),
+    /** DELETE a login by its host (the host's own rule) or its alias. */
+    removeSshUser: (from: string) =>
+      request<GitIdentity>(`/me/git/ssh-user/${encodeURIComponent(from)}`, { method: "DELETE" }),
     saveHttps: (body: { host: string; username: string; password: string }) =>
       request<GitIdentity>("/me/git/https", { method: "POST", body: JSON.stringify(body) }),
     removeHttps: (host: string) =>
@@ -4266,12 +4274,25 @@ export interface GitIdentity {
     /** Whether a plain `git` in the account's terminal uses the key (`~/.gitconfig` core.sshCommand); `foreign` = the user set their own. */
     terminal?: "on" | "off" | "foreign";
   } | null;
-  /** Every key the account holds (ED25519 first); absent from an older server. */
-  sshKeys?: { type?: "ed25519" | "rsa"; publicKey: string; fingerprint: string }[];
+  /**
+   * Every key the account holds: the default ED25519 and RSA first, then the
+   * named ones (`name`; `id` = its file name); absent from an older server.
+   */
+  sshKeys?: {
+    id?: string;
+    type?: "ed25519" | "rsa";
+    name?: string | null;
+    publicKey: string;
+    fingerprint: string;
+  }[];
   /** The terminal switch (shared by both keys); null without a key. */
   sshTerminal?: "on" | "off" | "foreign" | null;
-  /** SSH login name per host (`url.<…>.insteadOf` in `~/.gitconfig`); absent from an older server. */
-  sshUsers?: { host: string; user: string }[];
+  /**
+   * SSH logins (`url.<…>.insteadOf` in `~/.gitconfig`): `alias` null = the
+   * host's own (`ssh://<host>/`), else `ssh://<alias>/`; `key` = the one key
+   * it uses, null = every key. Absent from an older server.
+   */
+  sshUsers?: { host: string; user: string; alias?: string | null; key?: string | null }[];
   /** The account's commit author (`git config --global`); null fields = unset. */
   author: { name: string | null; email: string | null };
   /** The suggested email while none is set: `<username>@smartgift.vn`. */
diff --git a/client/src/pages/Artifacts.tsx b/client/src/pages/Artifacts.tsx
index f8731f92..7a5560e3 100644
--- a/client/src/pages/Artifacts.tsx
+++ b/client/src/pages/Artifacts.tsx
@@ -11,7 +11,8 @@
  * admin's switch in Settings → AI tools (`ArtifactsHubSettings`) turns Hub
  * installs off for everyone. Previews of a file are
  * the server's sandboxed `raw` route in a sandboxed iframe, so nothing a
- * shared HTML file carries runs on the dashboard's origin.
+ * shared HTML file carries runs on the dashboard's origin. Right-clicking a
+ * card offers the same actions as its buttons, plus copying a page's link.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -43,6 +44,8 @@ import { eventBus } from "../lib/eventBus";
 import { toast } from "../lib/toast";
 import { confirmDialog } from "../lib/confirm";
 import { useDialog } from "../hooks/useDialog";
+import { copyText } from "../lib/clipboard";
+import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../components/ContextMenu";
 import {
   FileUploadPanel,
   PluginAddPanel,
@@ -325,12 +328,20 @@ function ArtifactCard({
 }) {
   const { t } = useTranslation("artifacts");
   const Icon = KIND_ICON[a.kind];
+  const menu = useContextMenu<null>();
+  const pick = (fn: () => void) => () => {
+    menu.close();
+    fn();
+  };
+  const previewPath = a.kind === "skill" ? "SKILL.md" : (a.files[0]?.path ?? "");
+  const canPreview = (a.kind === "file" || a.kind === "skill") && a.files.length > 0;
   const btn =
     "flex items-center gap-1 rounded px-1.5 py-0.5 text-[11px] text-fg-secondary hover:bg-surface-3 hover:text-fg-primary";
   return (
     <li
       className="flex flex-col gap-2 rounded-lg border border-border bg-surface-1 p-3"
       data-testid={`artifact-${a.id}`}
+      onContextMenu={(e) => menu.open(e, null)}
     >
       <div className="flex items-start gap-2">
         <Icon className="mt-0.5 h-4 w-4 shrink-0 text-fg-muted" />
@@ -363,12 +374,8 @@ function ArtifactCard({
             {t("open")}
           </a>
         )}
-        {(a.kind === "file" || a.kind === "skill") && a.files.length > 0 && (
-          <button
-            type="button"
-            className={btn}
-            onClick={() => onPreview(a.kind === "skill" ? "SKILL.md" : (a.files[0]?.path ?? ""))}
-          >
+        {canPreview && (
+          <button type="button" className={btn} onClick={() => onPreview(previewPath)}>
             <Eye className="h-3 w-3" />
             {t("preview")}
           </button>
@@ -410,6 +417,47 @@ function ArtifactCard({
           )}
         </span>
       </div>
+      {menu.menu && (
+        <ContextMenu x={menu.menu.x} y={menu.menu.y} onClose={menu.close} testId="artifact-menu">
+          {a.kind === "page" && a.url && (
+            <>
+              <MenuItem onSelect={pick(() => window.open(a.url!, "_blank", "noopener,noreferrer"))}>
+                {t("open")}
+              </MenuItem>
+              <MenuItem onSelect={pick(() => void copyText(a.url!))}>{t("copyLink")}</MenuItem>
+            </>
+          )}
+          {canPreview && (
+            <MenuItem onSelect={pick(() => onPreview(previewPath))}>{t("preview")}</MenuItem>
+          )}
+          {a.kind === "file" && a.files.length > 0 && (
+            <MenuItem
+              onSelect={pick(() => {
+                window.location.href = api.artifacts.rawUrl(a.id, a.files[0]?.path, true);
+              })}
+            >
+              {t("download")}
+            </MenuItem>
+          )}
+          {(a.kind === "skill" || a.kind === "plugin") && (
+            <MenuItem disabled={!canInstall} onSelect={pick(onInstall)}>
+              {t("install")}
+            </MenuItem>
+          )}
+          {a.canChange && (
+            <>
+              <MenuSeparator />
+              {server && (
+                <MenuItem onSelect={pick(onShare)}>{t(a.shared ? "unshare" : "share")}</MenuItem>
+              )}
+              <MenuItem onSelect={pick(onRename)}>{t("rename")}</MenuItem>
+              <MenuItem danger onSelect={pick(onDelete)}>
+                {t("delete")}
+              </MenuItem>
+            </>
+          )}
+        </ContextMenu>
+      )}
     </li>
   );
 }
diff --git a/client/src/pages/Users.tsx b/client/src/pages/Users.tsx
index d8300271..c27d3b19 100644
--- a/client/src/pages/Users.tsx
+++ b/client/src/pages/Users.tsx
@@ -13,14 +13,15 @@
  * tmux server beside the installed version, restartable by an admin
  * (`MemberTmuxCard`). Every change asks for the admin's OWN password again (the
  * server refuses without it); an analyst only reads. A row shows the display
- * name and email under the username when set.
+ * name and email under the username when set; right-clicking a row offers
+ * Edit, Open home (in /files), and copying the username or email.
  * Laid out like the other list pages: icon header, a row of totals
  * (`StatCard`), the accounts in a `card` table, the audit log in a card.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
 import { useCallback, useEffect, useState, type KeyboardEvent, type ReactNode } from "react";
-import { Navigate } from "react-router-dom";
+import { Navigate, useNavigate } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import {
   AlertCircle,
@@ -52,6 +53,8 @@ import { ROLE_BADGE, UserEditDialog } from "../components/users/UserEditDialog";
 import { AccountPoolCard } from "../components/users/AccountPoolCard";
 import { MemberTmuxCard } from "../components/users/MemberTmuxCard";
 import { TableRowSkeleton } from "../components/Skeleton";
+import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../components/ContextMenu";
+import { copyText } from "../lib/clipboard";
 
 type Role = AuthUser["role"];
 const ROLES: Role[] = ["admin", "analyst", "developer"];
@@ -67,6 +70,8 @@ export function Users() {
   const [error, setError] = useState<string | null>(null);
   const [adding, setAdding] = useState(false);
   const [editing, setEditing] = useState<ServerUserUsage | null>(null);
+  const rowMenu = useContextMenu<ServerUserUsage>();
+  const navigate = useNavigate();
   const [storage, setStorage] = useState<Record<string, UserStorage> | null>(null);
   const [measuring, setMeasuring] = useState(false);
 
@@ -231,6 +236,7 @@ export function Users() {
               return (
                 <tr
                   key={u.id}
+                  onContextMenu={(e) => rowMenu.open(e, u)}
                   className={`hover:bg-surface-4/40 transition-colors ${u.disabled ? "opacity-60" : ""}`}
                 >
                   <td className="px-5 py-3">
@@ -298,6 +304,47 @@ export function Users() {
         </table>
       </div>
 
+      {rowMenu.menu &&
+        (() => {
+          const u = rowMenu.menu.item;
+          const pick = (fn: () => void) => () => {
+            rowMenu.close();
+            fn();
+          };
+          return (
+            <ContextMenu
+              x={rowMenu.menu.x}
+              y={rowMenu.menu.y}
+              onClose={rowMenu.close}
+              testId="users-row-menu"
+            >
+              {isAdmin && (
+                <MenuItem onSelect={pick(() => setEditing(u))}>{t("edit.button")}</MenuItem>
+              )}
+              {isAdmin && !u.disabled && (
+                <MenuItem
+                  onSelect={pick(() =>
+                    navigate(
+                      `/files?home=${encodeURIComponent(u.id === me.id ? "me" : u.username)}`
+                    )
+                  )}
+                >
+                  {t("rowMenu.openHome")}
+                </MenuItem>
+              )}
+              {isAdmin && <MenuSeparator />}
+              <MenuItem onSelect={pick(() => void copyText(u.username))}>
+                {t("rowMenu.copyUsername")}
+              </MenuItem>
+              {u.email && (
+                <MenuItem onSelect={pick(() => void copyText(u.email!))}>
+                  {t("rowMenu.copyEmail")}
+                </MenuItem>
+              )}
+            </ContextMenu>
+          );
+        })()}
+
       <AccountPoolCard isAdmin={isAdmin} />
       <MemberTmuxCard isAdmin={isAdmin} />
 
diff --git a/client/src/pages/__tests__/Artifacts.test.tsx b/client/src/pages/__tests__/Artifacts.test.tsx
index e88500e0..178fddde 100644
--- a/client/src/pages/__tests__/Artifacts.test.tsx
+++ b/client/src/pages/__tests__/Artifacts.test.tsx
@@ -6,10 +6,11 @@
  * a plugin is picked from the list its marketplace link answers (a link the
  * server cannot read opens the by-hand form), a skill is uploaded from one
  * Markdown file under the name the user types, or written in the dialog.
+ * A card's right-click menu runs the same actions (Preview, Delete).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, waitFor, within } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { MemoryRouter } from "react-router-dom";
 import { Artifacts } from "../Artifacts";
@@ -81,7 +82,13 @@ beforeEach(() => {
   vi.mocked(api.artifacts.list).mockResolvedValue({
     items: [
       item({}),
-      item({ id: 2, kind: "skill", title: "deploy", source: "deploy", files: [{ path: "SKILL.md", size: 3 }] }),
+      item({
+        id: 2,
+        kind: "skill",
+        title: "deploy",
+        source: "deploy",
+        files: [{ path: "SKILL.md", size: 3 }],
+      }),
     ],
   });
   vi.mocked(confirmDialog).mockReset();
@@ -145,7 +152,9 @@ describe("Adding", () => {
     await addMenu(user, "Skill");
     const md = new File(["# Steps"], "notes.md", { type: "text/markdown" });
     await user.upload(screen.getByTestId("skill-files"), md);
-    expect(await screen.findByTestId("skill-shape")).toHaveTextContent("becomes the skill's SKILL.md");
+    expect(await screen.findByTestId("skill-shape")).toHaveTextContent(
+      "becomes the skill's SKILL.md"
+    );
     const name = screen.getByLabelText(/Skill name/);
     await waitFor(() => expect(name).toHaveValue("notes"));
     await user.clear(name);
@@ -229,4 +238,19 @@ describe("Artifacts", () => {
     expect(frame.getAttribute("sandbox")).toBe("");
     expect(frame.getAttribute("src")).toBe("/api/artifacts/1/raw?path=report.html");
   });
+
+  it("opens a card's actions on right-click", async () => {
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("report.html");
+    fireEvent.contextMenu(screen.getByTestId("artifact-1"));
+    const menu = screen.getByTestId("artifact-menu");
+    expect(within(menu).getByRole("menuitem", { name: "Delete" })).toBeInTheDocument();
+    expect(within(menu).queryByRole("menuitem", { name: "Install" })).toBeNull();
+    await user.click(within(menu).getByRole("menuitem", { name: "Preview" }));
+    expect(screen.queryByTestId("artifact-menu")).toBeNull();
+    expect((await screen.findByTestId("artifact-preview")).getAttribute("src")).toBe(
+      "/api/artifacts/1/raw?path=report.html"
+    );
+  });
 });
diff --git a/client/src/pages/__tests__/Users.test.tsx b/client/src/pages/__tests__/Users.test.tsx
index 02a1b331..ac0b9c25 100644
--- a/client/src/pages/__tests__/Users.test.tsx
+++ b/client/src/pages/__tests__/Users.test.tsx
@@ -5,14 +5,15 @@
  * with their own password typed (the confirm stays disabled until then), sees
  * a wrong password reported in the edit dialog, opens ONE Edit per row (no
  * separate role/password/workspace/disable buttons any more), and sees the
- * display name and email under a username.
+ * display name and email under a username; right-clicking a row opens that
+ * user's home in Files (an admin) — an analyst's menu only copies.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { MemoryRouter, Route, Routes } from "react-router-dom";
+import { MemoryRouter, Route, Routes, useLocation } from "react-router-dom";
 import type { AuthState, ServerUserUsage } from "../../lib/api";
 
 let authState: AuthState = { mode: "local" };
@@ -60,12 +61,17 @@ vi.mock("../../lib/api", async (importOriginal) => {
 
 import { Users } from "../Users";
 
+function FilesProbe() {
+  return <div data-testid="files">{useLocation().search}</div>;
+}
+
 function renderPage() {
   return render(
     <MemoryRouter initialEntries={["/users"]}>
       <Routes>
         <Route path="/users" element={<Users />} />
         <Route path="/" element={<div data-testid="home" />} />
+        <Route path="/files" element={<FilesProbe />} />
       </Routes>
     </MemoryRouter>
   );
@@ -192,4 +198,23 @@ describe("Users page", () => {
     expect(screen.getByText("@mia")).toBeTruthy();
     expect(screen.getByText("mia@x.vn")).toBeTruthy();
   });
+
+  it("opens a row's menu on right-click: Open home for an admin, copy only for an analyst", async () => {
+    authState = { mode: "server", user: { id: 1, username: "boss", role: "admin" } };
+    renderPage();
+    fireEvent.contextMenu((await screen.findByText("mia")).closest("tr")!);
+    const menu = screen.getByTestId("users-row-menu");
+    expect(within(menu).getByRole("menuitem", { name: "Copy username" })).toBeTruthy();
+    fireEvent.click(within(menu).getByRole("menuitem", { name: "Open home in Files" }));
+    expect((await screen.findByTestId("files")).textContent).toBe("?home=mia");
+  });
+
+  it("gives an analyst's row menu no admin actions", async () => {
+    authState = { mode: "server", user: { id: 3, username: "ana", role: "analyst" } };
+    renderPage();
+    fireEvent.contextMenu((await screen.findByText("mia")).closest("tr")!);
+    const menu = screen.getByTestId("users-row-menu");
+    expect(within(menu).queryByRole("menuitem", { name: "Open home in Files" })).toBeNull();
+    expect(within(menu).queryByRole("menuitem", { name: "Edit" })).toBeNull();
+  });
 });
diff --git a/docs/API.md b/docs/API.md
index 23eecab2..21278378 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -1067,12 +1067,12 @@ cannot collide on `index.lock`.
 #### Your git identity
 
 ```
-GET    /api/me/git                 { account: "member"|"host", writable, ssh: { type, publicKey, fingerprint, terminal: "on"|"off"|"foreign" } | null (the first key), sshKeys: [{ type, publicKey, fingerprint }] (ed25519 first), sshTerminal, https: [{ protocol, host, username, hasToken }], author: { name, email }, defaultEmail }
-POST   /api/me/git/ssh-key         Make the SSH key of `type` — Body: { replace?, type?: "ed25519" | "rsa" } (409 EEXISTS when that TYPE exists, without replace; the other type is kept — an account may hold one of each, and every ssh git offers both) → 201, same shape
-DELETE /api/me/git/ssh-key         Delete the key of `?type=ed25519|rsa`, or every key without it (404 ENOTFOUND, 400 EBADKEYTYPE) — also removes our terminal `core.sshCommand`
-PUT    /api/me/git/ssh-terminal    Use the key for git typed in the account's own terminal — Body: { on } — sets/unsets `core.sshCommand` in its `~/.gitconfig` (ours first, then `~/.ssh/id_*`); on by default when a member makes a key; 409 EFOREIGNSSH over one the user wrote, which is never touched
-PUT    /api/me/git/ssh-user        The SSH login name for one host — Body: { host, user } — writes `url."ssh://<user>@<host>/".insteadOf "ssh://<host>/"` to the account's `~/.gitconfig` (replacing ours for that host), so a plain `ssh://<host>/…` URL logs in as `user` (AWS CodeCommit: the IAM SSH key ID `APKA…`); 400 EBADHOST / EBADSSHUSER. Listed as `sshUsers: [{host, user}]` in GET /api/me/git
-DELETE /api/me/git/ssh-user/:host  Drop that rule (404 ENOTFOUND); any other `insteadOf` the user wrote is never touched
+GET    /api/me/git                 { account: "member"|"host", writable, ssh: { type, publicKey, fingerprint, terminal: "on"|"off"|"foreign" } | null (the first key), sshKeys: [{ id, type, name, publicKey, fingerprint }] (default ed25519, default rsa, then named keys by name; `name` null for a default key, `id` = its file name), sshTerminal, sshUsers: [{ host, user, alias, key }], https: [{ protocol, host, username, hasToken }], author: { name, email }, defaultEmail }
+POST   /api/me/git/ssh-key         Make an SSH key — Body: { replace?, type?: "ed25519" | "rsa", name? } — without `name` the DEFAULT key of that type (`id_ed25519`/`id_rsa`), with `name` (lowercase letters, digits, `-`, ≤ 32; 400 EBADKEYNAME) one more beside it, `id_<type>_<name>` — for another AWS account or a second GitHub user. 409 EEXISTS when that key exists without replace, or the name is taken by a key of the other type; 409 ETOOMANYKEYS past 10 keys → 201, same shape
+DELETE /api/me/git/ssh-key         Delete one key — `?id=<key id>` (400 EBADKEYNAME for a malformed id), or the default key of `?type=ed25519|rsa` — or every key without either (404 ENOTFOUND, 400 EBADKEYTYPE). A login naming a deleted key goes back to every key; our terminal `core.sshCommand` follows the keys and goes with the last one
+PUT    /api/me/git/ssh-terminal    Use the keys for git typed in the account's own terminal — Body: { on } — sets/unsets `core.sshCommand` in its `~/.gitconfig` (every AgentHub key first, then `~/.ssh/id_*`; rewritten as keys are made or deleted while on); on by default when a member makes a key; 409 EFOREIGNSSH over one the user wrote, which is never touched
+PUT    /api/me/git/ssh-user        An SSH login — Body: { host, user, alias?, key? } — writes `url."ssh://<user>@<host>/".insteadOf "ssh://<from>/"` to the account's `~/.gitconfig`, `<from>` = `alias` or the host itself (replacing ours for that host/alias), so `ssh://<from>/…` logs in as `user` (AWS CodeCommit: the IAM SSH key ID `APKA…`). `alias` (lowercase letters, digits, `-`, NO dot — 400 EBADALIAS) is one more account on the same host: two AWS accounts clone as `ssh://aws-prod/v1/repos/x` and `ssh://aws-dev/v1/repos/x`. `key` (a key id, 400 ENOKEY) is stored as `agenthub.<from>.sshKey` there: a clone of a `ssh://<from>/…` URL then offers ONLY that key (`IdentitiesOnly`) and persists it into the clone's config; without it every key is offered. 400 EBADHOST / EBADSSHUSER
+DELETE /api/me/git/ssh-user/:from  Drop the rule of that host or alias and its key link (404 ENOTFOUND); any other `insteadOf` the user wrote is never touched
 POST   /api/me/git/https           Save an https login — Body: { host, username, password }
 DELETE /api/me/git/https/:host     Delete one (404 ENOTFOUND)
 PUT    /api/me/git/author          Commit author — Body: { name, email } (400 EBADAUTHOR) — `git config --global user.name/email` as the account. A new SSH key is labelled with that email, else `defaultEmail` (`<username>@smartgift.vn`; `AGENTHUB_EMAIL_DOMAIN` overrides the domain), also returned by GET /api/me/git as the email form's suggestion
diff --git a/docs/LANES.md b/docs/LANES.md
index 85593085..d441a9b4 100644
--- a/docs/LANES.md
+++ b/docs/LANES.md
@@ -395,7 +395,7 @@ The dashboard web UI merges workspaces and runs into a single **Workspace** page
 - **A workspace's sessions** — the chevron expands the row to the sessions the workspace OWNS and has not archived (`WorkspaceSessionList.tsx`: `GET /api/sessions?lane=<id>&archived=0&pinned_first=1`, the newest 20 — pinned sessions on top in pin order, then the ones with a live pane, then the ended ones — re-read when the workspace's status or session moves; which rows are expanded is kept in `agenthub.sidebar.projects` → `expanded`). A live AI tab whose session has no row yet — a tab opened bare from `+`, before its first prompt — is listed at the top as **New session** straight from the run (its session id is known from the start), so a new tab shows in its workspace at once; the row becomes the real session when its first hook lands. The sidebar's live panes follow the Workspace page's own run-list poll (`LIVE_RUNS_EVENT`), since a session in slots 1–9 moves no workspace column. A workspace owns a session its pane held — `bindRunSession` stamps `sessions.lane_id` from the pane's run, first writer wins, a nested `claude -p` excluded — and lists nothing else: a `claude` typed into a terminal in the same folder, or history from before the workspace existed, belongs to no workspace and is found on the Sessions page. Sessions older than this ownership column are not guessed: only those `dashboard_runs` still named were backfilled. A session started by a tool with no hooks (Codex without its hooks, any catalog tool) is never stamped. A row's dot is the session's state (`sessionDot`: amber waiting for you, red failed, green a live pane, hollow at rest); double-click renames it (`PATCH {name}`), its hover buttons **pin** it to the top of the list (`PATCH {pinned: true}` — `sessions.pinned_at`, order only; a pinned row shows a pin icon, and the same button, or **Pin**/**Unpin** in the row's right-click menu, takes it back) and **archive** it (`PATCH {archived: true}` — hidden from the workspace, nothing deleted; the home lists the archived ones folded with **Unarchive**). A filled dot marks a session that still has a live pane (a `GET /api/run` handle carrying its session id — every pane the dashboard starts carries `AGENTHUB_RUN_ID=<its tmux name>`, the hook handler forwards it as `run_id`, and `bindRunSession` in `server/routes/hooks.js` records the hook's session on that run: the first session always, afterwards — for a Claude pane — only a `SessionStart` that is not a fresh `startup` (`/clear`, `/resume`), so a `claude -p` the agent runs inside the pane never takes it over; the rule is Claude-only, and a Codex or Antigravity pane follows every new session): clicking it opens `/workspace?lane=<id>&run=<runId>`, which ATTACHES to that tmux session (`attachRequest` on `LaneConsolePane`) — it starts nothing and resumes nothing. The session opens on its own tab (the tab of its tmux slot): in the pane already showing it (focused), else in the focused pane; **Ctrl/Cmd+click** opens it in a split in the tab on screen (see **Split panes** below). Any other session opens in its workspace the way Claude Desktop opens an old one: `/workspace?lane=<id>&session=<id>` shows its conversation, read-only (`SessionReplay.tsx`, the console hidden — never unmounted — behind it), with a prompt box under it. Opening it resumes nothing; **sending** a message resumes it (`POST /api/lanes/:id/start {slot, resumeSessionId, prompt}` in the first free pane slot, on the tool the session ran on) and opens that pane — a resume re-reads the whole transcript into context, so it waits for that explicit send. The session's analysis page (`/sessions/<id>`: agents, events, cost, transcript) is the **Analyst** button in the session view's right panel, beside Files and Changes (disabled while the pane's run has reported no session yet).
 - **Row menu** — right-click a row, or its `⋯` button: Rename, the Model (AI Proxy) select, New workspace here…, Copy path, Reset worktree… (managed only) and Delete workspace…, each the call the rest of the UI already makes. Delete is record-only exactly as before (see "Removing a workspace").
 - **Stop archives, Sleep keeps** — every UI path that ends a live pane goes through `endRuns` (`client/src/lib/stopSession.ts`). **Stop** — a tab's **×**, a pane header's **×**, **Close tab** in a right-click menu — kills the pane AND archives the session it held (`DELETE /api/run/:id?archive=1`, which sets `sessions.archived_at` server-side and broadcasts `session_updated`), so a session the user closed leaves the workspace's list (the home's archived fold brings it back with **Unarchive**). It only hides: a session worktree is NOT removed here, unlike the row's own Archive button. **Sleep** — the moon left of each × (AI panes only), and **Sleep** in the tab, pane and session right-click menus — kills the pane but keeps the session listed, so it can be opened and resumed later by sending it a message. Both ask first for an AI pane (it may be mid-turn); a shell closes at once. A pane that dies on its own (exit, crash, reboot) is not archived, and the CLI's `DELETE` without `archive` keeps its old behaviour.
-- **Right-click menus** — every item that has actions opens them on a right-click too, in one shell (`client/src/components/ContextMenu.tsx`: placed at the pointer, kept inside the viewport, closed by Escape, a click outside or an item). The buttons stay; the menu repeats what they do and nothing more. A session row — in the sidebar, the home's Recents and the archived fold (`lanes/SessionMenu.tsx`) — offers Open, Open in split (live), Rename and Archive (sidebar), Unarchive (archived), Session details, Copy session ID, Sleep and Close tab (live); the sidebar's **New session** row Open, Open in split, Sleep and Close tab. A console tab offers Open, Open in split, Session details, Copy session ID, Sleep and Close tab; a pane header (split view) Show <session> here, Split right/down with a new terminal, Close pane, Sleep and Stop session. Sleep is offered only for an AI pane (a shell holds no session). In the Changes panel a changed file (overview row or review header) offers Open, Stage/Unstage, Discard — two clicks, as on its trash button — or the conflict's Keep mine / Take theirs / Mark resolved, and Copy relative path; a Files tree entry Open and Copy relative path; a History commit View commit, Copy commit SHA and Copy commit message. The home's title opens the row menu, and a Context file or extra folder offers Copy path and Remove. Outside the workspace the same shell serves the Sessions table, the Dashboard's agent cards and recent events, the Activity feed and Workflow runs (`components/SessionRowMenu.tsx`: Open session details, Open in its workspace when it has one, Copy session ID, Copy folder path), an attached prompt image (View / Remove), the managed workspace card (Reset), every Settings list (Git credentials, AI Proxy, Pricing, alert rules, webhooks, remote sources, AI tools) and every Claude Code / Codex config list (skills, agents, commands, output styles and memory files via `FileItemMenu` in `components/config/MdItemList.tsx`; plugins, MCP servers, marketplaces, auth profiles). A delete or remove there takes the button's own confirm — a modal, or two clicks. Text areas (the terminal, a conversation, a diff) keep the browser's own menu. The shell stops the menu's clicks from reaching the card it was opened from.
+- **Right-click menus** — every item that has actions opens them on a right-click too, in one shell (`client/src/components/ContextMenu.tsx`: placed at the pointer, kept inside the viewport, closed by Escape, a click outside or an item). The buttons stay; the menu repeats what they do and nothing more. A session row — in the sidebar, the home's Recents and the archived fold (`lanes/SessionMenu.tsx`) — offers Open, Open in split (live), Rename and Archive (sidebar), Unarchive (archived), Session details, Copy session ID, Sleep and Close tab (live); the sidebar's **New session** row Open, Open in split, Sleep and Close tab. A console tab offers Open, Open in split, Session details, Copy session ID, Sleep and Close tab; a pane header (split view) Show <session> here, Split right/down with a new terminal, Close pane, Sleep and Stop session. Sleep is offered only for an AI pane (a shell holds no session). In the Changes panel a changed file (overview row or review header) offers Open, Stage/Unstage, Discard — two clicks, as on its trash button — or the conflict's Keep mine / Take theirs / Mark resolved, and Copy relative path; a Files tree entry Open and Copy relative path; a History commit View commit, Copy commit SHA and Copy commit message. The home's title opens the row menu, and a Context file or extra folder offers Copy path and Remove. Outside the workspace the same shell serves the Sessions table, the Dashboard's agent cards and recent events, the Activity feed and Workflow runs (`components/SessionRowMenu.tsx`: Open session details, Open in its workspace when it has one, Copy session ID, Copy folder path), an attached prompt image (View / Remove), the managed workspace card (Reset), every Settings list (Git credentials, AI Proxy, Pricing, alert rules, webhooks, remote sources, AI tools) and every Claude Code / Codex config list (skills, agents, commands, output styles and memory files via `FileItemMenu` in `components/config/MdItemList.tsx`; plugins, MCP servers, marketplaces, auth profiles), an Artifacts card (its buttons' actions, plus Copy link for a page) and a Users row (Edit and Open home in Files for an admin, Copy username / email). In the File Explorer (`FileExplorer.tsx`), besides an item and the empty area: a sidebar workspace (Open, Copy path) or home (Open, Open Trash), a path-bar crumb (Open, Download as zip, Paste into this folder, Copy path), a Trash row (Restore, Copy path, Delete forever), the Trash's empty area (Refresh, Empty Trash) and an admin's per-user Trash folder (Open, Empty Trash — asked first, off for an empty one). A delete or remove there takes the button's own confirm — a modal, or two clicks. Text areas (the terminal, a conversation, a diff) keep the browser's own menu. The shell stops the menu's clicks from reaching the card it was opened from.
 - **Chat view of a live pane** — each Claude or Codex SESSION shows either a chat or its terminal, its own choice: the chat/terminal button left of the pane's split buttons (`ChatToggle` in `client/src/components/run/PaneGrid.tsx`) switches it, and the choice is kept in this browser's localStorage by session id (`agenthub.chatUi.sessions`, the newest 200; `useSessionChat` in `client/src/lib/chatUi.ts`). **Settings → Appearance → Chat UI** (`ChatUiSettings.tsx`, saved per ACCOUNT on the server: `GET/PUT /api/me/prefs`, key `agenthub.chatUi`) is only the default — written onto a session the first time it is shown, so changing it later leaves every session already seen as it is. The chat needs the session id, so a pane shows it only once its session is known (`client/src/components/run/LaneConsolePane.tsx`). Chat (`client/src/components/run/PaneChat.tsx`) shows the session's conversation the way Claude Desktop does — the shared `ConversationView` in its `fill` layout: one centred column, your messages as bubbles, the reply as plain prose, every run of tool calls folded into one line named by what it did, in Claude Desktop's fixed order ("Ran 3 commands, edited a file, used a tool ›", `workLabel`) — a thinking block that carries text is the model's narration (Claude Code ≥ 2.1.280 stores real thinking empty) and reads as prose between those lines, as Claude Desktop shows it — that opens onto a framed list of its steps — each titled by its own description, the call in a capped scroll box, its output one click further — and a round ↓ back to the end — above a prompt box that grows with its text up to 40% of the screen, then scrolls. The conversation stays at its end while you are there: a new line, the running step, an image loading or the pane shown again after being hidden keeps the newest in sight (a `ResizeObserver` in `ConversationView`), until you scroll up; sending a message takes it back to the end. It lies OVER the terminal, which stays mounted and attached (the console never unmounts a terminal); a message is sent through that terminal as a bracketed paste and Enter (`submitToRun` in `client/src/lib/panePaste.ts`), exactly as if typed, so no new route or server write exists for it. On a Windows dashboard (psmux) the attach (`server/lib/pty-attach.js`) holds any input that follows a paste until 700 ms after it (`PASTE_HOLD_MS`): psmux delays a paste ~350 ms and wrote an Enter sent meanwhile INSIDE it (psmux#766), so the prompt sat in Claude's composer as `[Pasted text #1]` instead of being sent. While the session's main agent is `working` (its `UserPromptSubmit` hook seen, no `Stop` yet — `GET /api/agents?session_id=&status=working`, re-read on `agent_updated`), an empty box shows **Stop** in Send's place, like Claude Desktop: it presses Esc in the pane (`interruptRun` in the same file), the key `claude` and `codex` stop a turn with; typing a message brings Send back (Claude Code queues it). Stop also ends the conversation's live line (`stopped` on `ConversationView`/`MessageList`) until the transcript gains a newer line: an Esc before the model wrote anything puts the prompt back in Claude Code's input box and writes no `[Request interrupted by user]` line, so the transcript still ends on the prompt and would read as **Thinking…** for 15 minutes (issue #74). An Esc pressed in the terminal itself is not seen by the chat. A Codex pane without AgentHub's hooks never shows it. An image attached in the box reaches the transcript as its saved path; the user's turn shows the image itself (`GET /api/run/drop/:name`) — any other attached file as a chip (name · EXT) that opens its preview like an output — and opens it full size over the whole page (`ImageLightbox`, rendered into `document.body`, so nothing stacked over a pane covers it). The box carries Claude Desktop's controls: a `+` menu (`ChatAddMenu.tsx`, also in the workspace home's prompt box) — Upload or add files; what already exists, attached like an upload (a chip, its path sent with the prompt): **Project files** (a search of the box's folder, folders too — `GET /api/run/files?dirs=1` — sent as `@path`), **Context files** (the workspace's own, `GET /api/lanes/:id/sources`, sent as `@<stored path>`) and **Recent uploads** (files uploaded through a prompt box in the last day, kept in this browser's localStorage `agenthub.prompt.recentUploads` — the server prunes an upload after a day); a file or folder dragged onto anywhere in a prompt box (not only its text area) attaches the same way — from the Changes panel's Files tree, its search, a Changes-list row, or a workspace's Context files and Folder list; a row from an extra folder's section (`data-drag-root`) and a context file or folder carry their absolute path, since they lie outside the pane's folder (`client/src/lib/promptAttach.ts`); Skills (yours and the project's), Plugins → a plugin → the skills and commands it ships, each put at the front of the message as `/<name>` / `/<plugin>:<name>`, and Manage links to the Claude config page — and, for a Claude pane, the Model/Effort chip, a change typed into the pane as `/model <id>` / `/effort <level>`, and the permission mode beside `+` in the box. A menu opened in a split pane (a `Select`, the Model chip) flips up or down by the room inside ITS pane (`data-menu-bounds` on the pane, `menuRoom` in `client/src/components/Select.tsx`), never the window's — a menu running past the pane's edge is painted over by the pane below. A running session changes mode only by Shift+Tab, so the server steps it and reads each step back off the pane (`POST /api/run/:id/permission-mode`, `server/lib/pane-mode.js`): it lands on exactly the mode picked, presses nothing while a menu hides the mode line, and returns to where it began when the mode is not in that session's cycle (Bypass only when the session was started with it). The mode belongs to that session only. A menu the CLI asks with — AskUserQuestion (one question or several, multiSelect too), a permission or trust prompt, Codex's approval, a first-start login menu — is answered from the chat: it is read off the terminal underneath every 700 ms while the pane is on screen (`parsePaneMenu`/`readRunMenu` in `client/src/lib/panePaste.ts`: two numbered rows or more from 1, the `❯`/`›` cursor on one of them, no `─` rule right above the first — a reply's numbered list has no cursor, a list typed into Claude's input box sits under its rule) and shown in the prompt box's place as a card of buttons (`PaneMenuCard` in `PaneChat.tsx`, with each option's description and a multiSelect box's state; the box is hidden with CSS, never unmounted, so its draft survives the question); a pick presses its digit in the pane (which picks it, or ticks its box), Claude's unnumbered **Submit** row is reached with the arrows and Enter, **Cancel (Esc)** presses Esc, and the **Type something** row opens a field inside the card whose text, on Enter, is typed there as the answer (`answerRunMenu`: the arrows to that row, Ctrl+U over any text already in it, the text as a bracketed paste, Enter — none in a multiSelect, where Submit is still to pick). That row presses no key: a second press of its digit would type the digit into the CLI's own field. Once text is typed in that row its label is the text, so it is found as the last numbered row above **Chat about this**. Like Send, it only presses keys in the pane, so no new route exists for it. A menu with no numbers (the first-start theme picker) still needs the terminal. A live pane's chat ends, until its turn is over, with what the model is doing now and — like the terminal's status line — how long the turn has run since your prompt and the output tokens it has made so far, e.g. `Thinking… (2m 8s · ↑ 3.5K tokens)` (`workingOn` and `turnStats` in `MessageList.tsx`; Claude Code repeats a call's usage on each of its lines, so consecutive lines with the same prompt size count once), the words lit by a shimmer that sweeps a few times and rests (`.text-shimmer`, stopped under reduced motion) and the token count rolling up rather than jumping. It names every call of the turn still waiting for its result — the oldest first and **+N more** for the rest, a click listing them all, since Claude Code writes parallel calls on separate lines and their results arrive in any order — by its description (Claude Code's Bash `description`) or tool and target, with that call's own time once it has run 30 s; else **Thinking…**. A line with no new transcript line for 3 minutes turns amber (the step may be stuck). While the CLI asks you something — the main agent awaiting input on a `Notification` hook (a permission prompt; `awaiting_reason = 'notification'`, read with the Stop button's agent poll) — it reads **Waiting for your approval: <step>** in amber with an **Open terminal** button (`showTerminal` in `PaneGrid.tsx`, the chat/terminal toggle's own switch: the unsent prompt goes into the CLI's input box); the menu card above answers it from the chat. AskUserQuestion fires no `Notification`, so a menu read off the pane counts as waiting too — for this line and the hidden tab's **● Waiting**. Before the session has started — no session row yet, because Claude Code runs no hook until its folder is trusted — the chat says so instead of the empty-transcript text, with the same **Open terminal** button (`notStarted` in `ConversationView.tsx`), and Send and every control typed into the pane (`/model`, `/effort`) ask first (`confirmDialog`, **Send anyway**): an Enter there would answer the trust prompt, whose preselected choice is **No, exit** (issue #73). It asks rather than refuses because the row appears only with the session's first hook, and a hard lock would strand the chat if none came right after the answer. A turn that ended (`end_turn`) closes with **✓ Done in 2m 8s · ↑ 3.5K tokens** — no cost: pricing one turn would need a second cost formula. The prompt box shows how full the context is (`ContextMeter` in `PaneChat.tsx`): the newest reply's prompt size (input + cache) against the model's window — 200K for Claude's 4.5 line and older, 1M for every model since (`contextWindow`, from LiteLLM's list; none for another vendor) — amber from 75 %, red from 90 %, the numbers on hover. While the browser tab is hidden its title is marked **● Waiting** while a chat pane's session waits on you and **✓ Done** once a turn ended (`client/src/lib/tabBadge.ts`); showing the tab drops the Done mark. Thinking is shown (after your prompt, after a tool result, or after narration whose `stop_reason` is `tool_use`). The transcript route passes each assistant line's `stop_reason`; `end_turn` ends the turn, so does an interrupt, and a turn with no new line for 15 minutes and no call running is treated as dead. The chat re-reads the transcript every 3 s while the page is visible and the pane is on screen (`useOnScreen` in `client/src/hooks/useOnScreen.ts`: a pane of another workspace or tab stays mounted but `display:none`, and polls nothing until it is shown again, then catches up once), and on a `new_event` of its session at most every 1.5 s (`EVENT_FETCH_MS`). The tail read (`?after=`) skips the lines the chat already has before parsing them. While the chat covers the terminal, the terminal is moved out of the viewport with a transform (`covered` on `TerminalView`), which stops xterm drawing without changing its size — the menu reading below still works. Each message's hover line shows ↓ the whole prompt it was answered from (input + cache read + cache write; the split on hover) and ↑ its output. An AskUserQuestion is not folded into the collapsed work line: it is its own card (`AskCard`) showing each question with the option the user picked or what they typed — the `answers` the transcript route reads off Claude Code's `toolUseResult` —, "declined" when they refused it. Each assistant turn that changed files ends, like Claude Desktop's, with an **Edited N files** card (`EditedFiles` in `client/src/components/conversation/MessageList.tsx`): one row per file with the lines it added and removed over the turn — the `diff` the transcript route reads off Claude Code's `structuredPatch` — and, in a live pane's chat, a click on a row opens that file in the workspace's Changes panel when it lies in the pane's folder, else its preview (beside the chat, or over it when the pane is narrow). It has no Undo: reverting a file is a write the dashboard does not take from a click. The conversation column and the prompt box are `max(48rem, 70%)` of the pane wide — never narrower than Claude's fixed 48rem, wider on a large screen. Every chat pane, split or not, has Claude Desktop's activity panel (`client/src/components/run/ChatOutline.tsx`, `GET /api/sessions/:id/outline`, re-read every 5 s while the tab is visible and the pane is on screen; the server keeps the last answer per session until its events change). It starts open in a pane that spans the grid's full width or height (`spanning` in `ConsoleArea`, `client/src/pages/Workspace.tsx`, from `layoutRects`) once the session has an output, and otherwise — no output yet, or a quarter-sized pane (e.g. four panes at once) — collapsed into a file button with the number of outputs at the chat's top right. The user's own open or close is kept per session for the browser tab (`sessionStorage` `agenthub.chat.panel.<sessionId>`), so switching the pane to its terminal and back keeps it; a split or a close that changes the pane's shape drops it and brings the default back. Whether it sits beside the conversation or floats over it is decided by the PANE's width, not the window's (a CSS container query on `PaneChat`'s root, 40rem): beside it, a splitter on its left edge (`Divider` from `PaneGrid.tsx`, arrow keys too) drags the panel — and a file preview in its place — between 20% and 70% of the pane, remembered per browser (`localStorage` `agenthub.chat.panelWidth`, one fraction for every pane). Open, it shows **Progress** — the session's `TaskCreate`/`TaskUpdate` (or `TodoWrite`) plan, only when there is one: how many steps are done of how many (`3/7`) over a bar, done items struck through and the step in progress highlighted; **Outputs** — files it wrote or edited (`Write`/`Edit`/`MultiEdit`/`NotebookEdit`), newest first, each with its extension tag (a file made by a Bash command is not listed); and **Used in this session** — **Uploads** (files attached through the box), **Files read**, **Memory** (Claude Code memory files), **Skills** and **Connectors** (MCP servers). A file path in a reply or your message is a link — absolute, or relative with a folder and an extension (`server/lib/x.js`, resolved against the pane's folder by `resolveIn` in `client/src/lib/resolvePath.ts`), a `:line` suffix included, bare, in inline code or as a markdown link's target (`[x](src/x.ts#L12)`; `MarkdownContent.tsx`) — and opens like an Edited-files row: in the Changes panel when it lies in the workspace's folder, else in the preview. A click on an output opens its preview in the panel's place (`FilePreview` in `client/src/components/run/ChatFilePreview.tsx`: name · EXT, Copy path, Close back to the panel); Uploads, Files read and Memory open their list with a preview beside it (`FileListModal`), and Skills opens the same dialog over the session's skills, each previewed from its SKILL.md (`SkillListModal`: a plugin's `plugin:name` from `GET /api/cc-config/plugins`, else the user's or the project's skill; a built-in skill has no file and shows by name); Connectors opens the Claude config page. Every row but Connectors also drags onto the prompt box (`dragAttachments`/`dragSkill` in `client/src/lib/promptAttach.ts`): an output, or a whole Uploads/Files read/Memory group, attaches its files like the `+` menu does (an upload by its bare path, anything else as `@<absolute path>`); a skill becomes the message's leading `/<name>` — the Skills row only when the session used one skill (a prompt takes one command), else drag it from its list. A row dragged out of one of those list dialogs closes the dialog, so the box is reachable. A preview reads only through routes that already guard it — a file under the pane's folder through `GET /api/lanes/:id/git/file` (an image through `/git/raw`), a memory file under `~/.claude` through `GET /api/cc-config/file`, an attached image or text file (`.txt`, `.md`, `.csv`, `.log`, `.json`… — a long paste is one) through `GET /api/run/drop/:name` — and shows just the path for anything else (an attached spreadsheet, a file outside the workspace, one since deleted). A Windows path (`C:\…\.claude\…`) is matched like a POSIX one. The ended-session replay and the Analyst page's conversation use the same layout. The chat's unsent prompt and its attachments are kept per session in this browser (`agenthub.chat.draft.<sessionId>`, `client/src/lib/chatDraft.ts`), so switching the pane to its terminal and back, or reloading the page, leaves them as typed — an attached image keeps its path, not its preview; a send clears it. Switching carries the unsent prompt across: to the terminal, the draft (its files as paths) is pasted into the CLI's input box without Enter and the draft is cleared; to the chat, the text in the CLI's input box is read off the screen (`parsePromptInput` in `client/src/lib/panePaste.ts`: Claude's `❯` box between its `─` rules, Codex's last `›` row up to its footer; a soft-wrapped row is joined back) into the draft and deleted there with Delete/Backspace — never Ctrl+C or Esc, which would stop a working turn. A box holding `[Pasted text #N]` or `[Image #N]` is left as it is, since the screen does not show what it stands for. A row of a turn's **Edited N files** card drags into the prompt box as an `@path` attachment (its header drags every file in the card); dropped elsewhere it is the plain path.
 - **The workspace home** — `/workspace?lane=<id>` opens on the workspace's home (`client/src/components/lanes/WorkspaceHome.tsx`), shaped like a Claude Desktop project page: the name (rename from its `⋯` menu, which is the sidebar row menu) with the repository it belongs to under it (root, the main worktree's branch, the worktree count, from `GET /api/projects` — the facts Settings → Projects used to show), a prompt box — the one place a session starts WITH a prompt (a pane has no run form; the session view's tab bar `+` only starts a bare CLI or a shell) — whose fields run in order **AI** (the session's own tool: every installed, enabled one, the workspace's by default), **AI Proxy** (Native or a saved profile; Native alone, disabled, for a tool that cannot use one), **Model** (the tool's own list, or on a router that router's models), **Permission** (Claude's permission mode; Codex's sandbox and approval; a catalog tool's per-session bypass switch) and **Effort** (Claude and Codex), whose half-typed text is kept per workspace in `agenthub.workspace.draft.<lane id>` (localStorage, so it survives leaving the page or switching workspace; cleared once sent — attached images are not kept), and whose **Start** opens a NEW session in the first slot with no live run (0–9, `POST /api/lanes/:id/start {slot}`; all ten busy is refused) and then shows it in a tab of its own, and **Recents** — the workspace's own sessions (`?lane=<id>`) with their cost and time, a live one opening its pane and any other its conversation (`&session=`), exactly like the sidebar. The transcript page (`/sessions/<id>`) of a Claude session started in a workspace's own folder carries an explicit **Resume** (`client/src/components/lanes/SessionResumeButton.tsx`, the one place that resumes) and beside it **Fork**, which resumes the history into a NEW session id (`{forkSession: true}` → `--fork-session`, the original untouched, offered even while the original has a live pane): it warns that a resume re-reads the whole transcript into context, re-reads the live panes, then starts it in the workspace's first free pane (`POST /api/lanes/:id/start {slot, resumeSessionId}`) and opens it. A session from a SUBFOLDER gets no Resume — the pane starts in the workspace's folder and Claude finds a session by the folder it ran in — and a session that still has a live pane shows **Open pane** instead. On the right sit the workspace's own context: **Instructions** (appended to every new session's system prompt, after the workspace owner's own **My agent instructions** from Settings → AI tools — one markdown text per account (typed, or read from a local `.md`/`.txt` with **Choose file**, saved only on Save), shared by every workspace they own), **Memory** (read-only: the folder's CLAUDE.md / AGENTS.md family and Claude's auto memory), **Context** (uploaded files, ≤ 10 MB each, stored by AgentHub) and **Folder** (the workspace's own folder plus extra ones, with the repo's untracked worktrees suggested). Only Claude and Codex panes can take them (`--add-dir`, `--append-system-prompt-file=` / `-c developer_instructions=`); for any other tool the page says so and its panes start without them. See `docs/API.md` → Workspace context. Each extra folder is also its own repo in the **Changes** panel, stacked under the workspace folder's like VS Code's Source Control: once the workspace has one, every repo is a section with a foldable header, each a whole panel — Changes, Files, Review, History, commit and push — on its own folder (every git route with `?source=<id>`, resolved from the `lane_sources` row; `ENOSOURCE` otherwise, never the workspace folder); the open sections share the height, and a folded one stays mounted. A chat's request to open a file unfolds the workspace folder's section. Right-clicking a section header offers **Close repository** (extra folders only — the workspace folder never closes) and **Close other repositories**; closing REMOVES the folder from the workspace (`DELETE /api/lanes/:id/sources/:sourceId`, the folder stays on disk), asking first only if that section holds an unsaved edit. The panel's bottom fold, **Workspace context** (folded by default, kept in `agenthub.workspace.contextOpen`), is the home's context column made compact (`client/src/components/lanes/WorkspaceContext.tsx`, the same component): Instructions, Memory, Context files and Folders are edited from the session view without going back to the home, and a folder added or removed there joins or leaves the stack above at once. A plain-text paste over 5,000 characters into any prompt box (the home, a chat, a finished session's reply) is attached as `pasted-text.txt` like a pasted file (`PASTE_AS_FILE_CHARS` in `client/src/components/run/RunSetup.tsx`): the prompt carries its path, never the text (#68). The home HIDES the session view with CSS — the console never unmounts behind it.
 - **A session in its own worktree** — Claude Desktop's worktree toggle: the row under the home's prompt box has a **Local / New worktree** select (Claude workspaces in a git repo). Claude Code itself makes a worktree only when started with `--worktree` or when asked mid-session — and a worktree it enters mid-session is invisible to AgentHub, which reads a session's folder once, at its start, and the new session's pane runs `claude --worktree=<name>`, so CLAUDE CODE makes `<repo>/.claude/worktrees/<name>` on branch `worktree-<name>`, copies `.worktreeinclude`, runs your `WorktreeCreate` hook, and on exit removes a worktree with no changes (or asks). AgentHub adds `/.claude/worktrees/` to the repo's `info/exclude` (Claude does not, and the main repo would list it). The session stays this workspace's own — listed with a branch icon and the worktree's name — and the session view's Changes panel works in ITS worktree (every git route with `?session=`, resolved from the session row: owned by the workspace, registered by `git worktree list`; `ENOWORKTREE` otherwise, never the main folder). Resume and Fork start in that worktree. **Archive** of a worktree session with no live pane asks first and removes the worktree like Claude Desktop — `git worktree remove` without force (git refuses unsaved work, and then nothing is archived) and `git branch -d` (unmerged work keeps its branch); a lock held by a live process refuses, a stale one is cleared. The workspace's own folder is never removed.
diff --git a/openapi.yaml b/openapi.yaml
index bc751192..3d91562c 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
   title: Agent Dashboard for Claude Code API
-  version: 2.7.7
+  version: 2.8.5
   description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
   contact:
     name: Nguyễn Ngọc Trí Vĩ
@@ -3952,6 +3952,10 @@ components:
           enum:
             - true
           example: true
+        archived:
+          type: string
+          nullable: true
+          description: 'Only with `?archive=1`: the id of the session the pane held, now archived, or null when the pane had no known session (a shell).'
     LaneWorktreeCreateRequest:
       type: object
       required:
@@ -4819,6 +4823,10 @@ components:
         email:
           type: string
           nullable: true
+        avatarAt:
+          type: string
+          nullable: true
+          description: When the avatar was last set (null = none)
         createdAt:
           type: string
           nullable: true
@@ -11205,6 +11213,14 @@ paths:
             format: uuid
           description: Run id (RunHandle.id).
           example: 3f2c9a1e-7b4d-4e21-9b6a-1d2e3f4a5b6c
+        - name: archive
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - '1'
+          description: '`1` (the UI''s Stop) also archives the session the pane held, so it leaves its workspace''s lists. Omitted (the UI''s Sleep, the CLI) the session stays listed, to be resumed later.'
       responses:
         '200':
           description: Kill issued (or run already terminated).
@@ -14282,6 +14298,94 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/ErrorResponse'
+  /api/me/avatar:
+    get:
+      tags:
+        - Auth
+      operationId: getMyAvatar
+      summary: The account's own picture (nosniff, sandbox CSP)
+      responses:
+        '200':
+          description: The image (PNG, JPEG, GIF or WebP)
+        '401':
+          description: EAUTH
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '404':
+          description: ENOAVATAR
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+    put:
+      tags:
+        - Auth
+      operationId: setMyAvatar
+      summary: Set the account's picture from the raw image bytes (PNG/JPEG/GIF/WebP, at most 1 MB). Login cookie only, audited
+      requestBody:
+        required: true
+        content:
+          application/octet-stream:
+            schema:
+              type: string
+              format: binary
+      responses:
+        '200':
+          description: Set
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MyAccount'
+        '400':
+          description: EBADIMAGE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '401':
+          description: EAUTH — no login cookie (a pane token is refused)
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '403':
+          description: ELOCALMODE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '413':
+          description: ETOOBIG
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+    delete:
+      tags:
+        - Auth
+      operationId: removeMyAvatar
+      summary: Remove the account's picture
+      responses:
+        '200':
+          description: Removed
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MyAccount'
+        '401':
+          description: EAUTH — no login cookie (a pane token is refused)
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '403':
+          description: ELOCALMODE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
   /api/users:
     get:
       tags:
@@ -14391,6 +14495,118 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/ErrorResponse'
+  /api/users/tmux:
+    get:
+      tags:
+        - Auth
+      operationId: listMemberTmux
+      summary: 'Each member''s own tmux server (one Linux user per account): its version beside the installed one, sessions, agents working (admin/analyst)'
+      responses:
+        '200':
+          description: '{available, installed, matched, users: [{id, username, running, stuck?, version, pid, startedAt, sessions, busy, outdated}]} — available false without S3'
+        '403':
+          description: EADMIN — a developer
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+  /api/users/{id}/tmux-restart:
+    post:
+      tags:
+        - Auth
+      operationId: restartMemberTmux
+      summary: End one member's tmux server — every pane of theirs closes; the next start runs the installed tmux (admin, own password again, audited)
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - currentPassword
+              properties:
+                currentPassword:
+                  type: string
+      responses:
+        '200':
+          description: '{user}'
+        '403':
+          description: EREAUTH (own password wrong) / EADMIN / ELOCALMODE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '404':
+          description: ENOUSER
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '409':
+          description: ETMUXSTUCK — the server did not stop (the message names the pid for root) / ENOS3
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+  /api/users/tmux-restart-idle:
+    post:
+      tags:
+        - Auth
+      operationId: restartIdleMemberTmux
+      summary: Restart every member server older than the installed tmux while no agent of theirs works (admin, own password again, audited per member)
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - currentPassword
+              properties:
+                currentPassword:
+                  type: string
+      responses:
+        '200':
+          description: '{restarted: [username], skipped: [username — an agent working], failed: [{username, message}]}'
+        '403':
+          description: EREAUTH / EADMIN / ELOCALMODE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+  /api/users/{id}/avatar:
+    get:
+      tags:
+        - Auth
+      operationId: getUserAvatar
+      summary: One account's picture, for the sidebar's owner groups (admin/analyst)
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      responses:
+        '200':
+          description: The image (PNG, JPEG, GIF or WebP)
+        '403':
+          description: EADMIN — a developer
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '404':
+          description: ENOAVATAR
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
   /api/users/{id}:
     get:
       tags:
@@ -14741,6 +14957,10 @@ paths:
                           type: number
                         spend7d:
                           type: number
+                        tokens5h:
+                          type: integer
+                        tokens7d:
+                          type: integer
                         quota:
                           type: object
                           nullable: true
@@ -14770,6 +14990,10 @@ paths:
                           type: number
                         spend7d:
                           type: number
+                        tokens5h:
+                          type: integer
+                        tokens7d:
+                          type: integer
                         quota:
                           type: object
                           nullable: true
@@ -15761,12 +15985,12 @@ paths:
       operationId: getGitIdentity
       responses:
         '200':
-          description: '{account, writable, ssh: {publicKey, fingerprint} | null, https: [...], author: {name, email}}'
+          description: '{account, writable, ssh: {type, publicKey, fingerprint, terminal} | null, https: [...], author: {name, email}}'
   /api/me/git/ssh-key:
     post:
       tags:
         - Git identity
-      summary: Make (or with `replace`, replace) the SSH key
+      summary: Make (or with `replace`, replace) the default SSH key of `type`, or with `name` one more beside it
       operationId: generateSshKey
       requestBody:
         required: true
@@ -15778,17 +16002,112 @@ paths:
               properties:
                 replace:
                   type: boolean
+                type:
+                  type: string
+                  enum:
+                    - ed25519
+                    - rsa
+                name:
+                  type: string
+                  pattern: ^[a-z0-9][a-z0-9-]{0,31}$
       responses:
         '201':
           description: The identity.
+        '400':
+          description: EBADKEYNAME
+        '409':
+          description: EEXISTS (without replace, or the name is taken) / ETOOMANYKEYS
     delete:
       tags:
         - Git identity
-      summary: Delete the SSH key
+      summary: Delete one SSH key (?id=, or the default of ?type=ed25519|rsa), or every key
       operationId: deleteSshKey
+      parameters:
+        - name: type
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - ed25519
+              - rsa
+        - name: id
+          in: query
+          required: false
+          schema:
+            type: string
       responses:
         '200':
           description: The identity.
+  /api/me/git/ssh-terminal:
+    put:
+      tags:
+        - Git identity
+      summary: Use the SSH key for git in the account's own terminal (core.sshCommand)
+      operationId: setTerminalSsh
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - 'on'
+              properties:
+                'on':
+                  type: boolean
+      responses:
+        '200':
+          description: The identity; `ssh.terminal` is on, off or foreign.
+        '409':
+          description: EFOREIGNSSH — ~/.gitconfig already sets its own core.sshCommand.
+  /api/me/git/ssh-user:
+    put:
+      tags:
+        - Git identity
+      summary: 'An SSH login: url.<ssh://user@host/>.insteadOf ssh://<alias or host>/, optionally tied to one key'
+      operationId: setSshUser
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - host
+                - user
+              properties:
+                host:
+                  type: string
+                user:
+                  type: string
+                alias:
+                  type: string
+                  pattern: ^[a-z0-9][a-z0-9-]{0,62}$
+                key:
+                  type: string
+      responses:
+        '200':
+          description: 'The identity; `sshUsers: [{host, user, alias, key}]`.'
+        '400':
+          description: EBADHOST / EBADSSHUSER / EBADALIAS / ENOKEY
+  /api/me/git/ssh-user/{from}:
+    delete:
+      tags:
+        - Git identity
+      summary: Drop the SSH login of a host or alias (and its key link)
+      operationId: deleteSshUser
+      parameters:
+        - name: from
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: The identity.
+        '404':
+          description: ENOTFOUND
   /api/me/git/https:
     post:
       tags:
diff --git a/server/__tests__/git-clone.test.js b/server/__tests__/git-clone.test.js
index 2d7d01ec..cbd1e6f4 100644
--- a/server/__tests__/git-clone.test.js
+++ b/server/__tests__/git-clone.test.js
@@ -3,7 +3,9 @@
  * `POST /api/lanes/clone` (URL allowlist, name/parent checks, a clone that
  * becomes a workspace, the SSH key persisted into the clone, 409
  * ECREDENTIALS for a remote wanting a login), `/api/me/git` (key made once,
- * only the public half returned, 0600 on disk), and the member (S3) path of
+ * only the public half returned, 0600 on disk; named keys beside the default
+ * ones, SSH logins per alias tied to one key, which a clone then offers
+ * alone), and the member (S3) path of
  * `server/lib/git-identity.js` with run-as and git stubbed — what reaches
  * git's argv, and that a login typed without "remember" leaves the member's
  * store as it was.
@@ -411,7 +413,9 @@ describe("/api/me/git/ssh-user (CodeCommit SSH key ID)", () => {
       user: "APKAEXAMPLE1",
     });
     assert.equal(r.status, 200);
-    assert.deepEqual(r.body.sshUsers, [{ host: HOST, user: "APKAEXAMPLE1" }]);
+    assert.deepEqual(r.body.sshUsers, [
+      { host: HOST, user: "APKAEXAMPLE1", alias: null, key: null },
+    ]);
     assert.equal(getUrl(`ssh://${HOST}/v1/repos/x`), `ssh://APKAEXAMPLE1@${HOST}/v1/repos/x`);
     assert.equal(getUrl("ssh://other.test/x"), "ssh://other.test/x");
     // A second save replaces, never stacks a second rewrite.
@@ -419,7 +423,9 @@ describe("/api/me/git/ssh-user (CodeCommit SSH key ID)", () => {
       host: HOST,
       user: "APKAEXAMPLE2",
     });
-    assert.deepEqual(again.body.sshUsers, [{ host: HOST, user: "APKAEXAMPLE2" }]);
+    assert.deepEqual(again.body.sshUsers, [
+      { host: HOST, user: "APKAEXAMPLE2", alias: null, key: null },
+    ]);
     assert.equal(getUrl(`ssh://${HOST}/v1/repos/x`), `ssh://APKAEXAMPLE2@${HOST}/v1/repos/x`);
     const del = await request("DELETE", `/api/me/git/ssh-user/${HOST}`);
     assert.deepEqual(del.body.sshUsers, []);
@@ -441,7 +447,9 @@ describe("/api/me/git/ssh-user (CodeCommit SSH key ID)", () => {
       assert.equal(bad.body.error.code, "EBADSSHUSER");
       // Ours lists only our shape; a rule the user wrote for another host is kept.
       const r = await request("GET", "/api/me/git");
-      assert.deepEqual(r.body.sshUsers, [{ host: "mine.test", user: "me" }]);
+      assert.deepEqual(r.body.sshUsers, [
+        { host: "mine.test", user: "me", alias: null, key: null },
+      ]);
       assert.equal((await request("DELETE", "/api/me/git/ssh-user/other.test")).status, 404);
       assert.equal(getUrl("ssh://mine.test/x"), "ssh://me@mine.test/x");
     } finally {
@@ -450,6 +458,122 @@ describe("/api/me/git/ssh-user (CodeCommit SSH key ID)", () => {
   });
 });
 
+describe("several accounts: named keys and SSH logins per alias", () => {
+  const getUrl = (url) =>
+    execFileSync("git", ["ls-remote", "--get-url", url], { encoding: "utf8" }).trim();
+  const HOST = "git-codecommit.us-east-1.amazonaws.com";
+
+  it("keeps named keys beside the default ones, and deletes one by id", async () => {
+    await request("DELETE", "/api/me/git/ssh-key");
+    const a = await request("POST", "/api/me/git/ssh-key", { type: "rsa", name: "AWS-Prod" });
+    assert.equal(a.status, 201, JSON.stringify(a.body));
+    const b = await request("POST", "/api/me/git/ssh-key", { type: "rsa", name: "aws-dev" });
+    const d = await request("POST", "/api/me/git/ssh-key", {});
+    assert.deepEqual(
+      d.body.sshKeys.map((k) => [k.id, k.type, k.name]),
+      [
+        ["id_ed25519", "ed25519", null],
+        ["id_rsa_aws-dev", "rsa", "aws-dev"],
+        ["id_rsa_aws-prod", "rsa", "aws-prod"],
+      ]
+    );
+    assert.notEqual(b.body.sshKeys[0].publicKey, a.body.sshKeys[0].publicKey);
+    const dir = path.join(ROOT, ".claude", "agenthub-ssh");
+    assert.equal(fs.statSync(path.join(dir, "id_rsa_aws-prod")).mode & 0o777, 0o600);
+    // One name per key, whatever its type; a bad name is refused.
+    const dup = await request("POST", "/api/me/git/ssh-key", { name: "aws-dev" });
+    assert.equal(dup.status, 409);
+    const bad = await request("POST", "/api/me/git/ssh-key", { name: "../x" });
+    assert.equal(bad.body.error.code, "EBADKEYNAME");
+    const gone = await request("DELETE", "/api/me/git/ssh-key?id=id_rsa_aws-dev");
+    assert.deepEqual(
+      gone.body.sshKeys.map((k) => k.id),
+      ["id_ed25519", "id_rsa_aws-prod"]
+    );
+    assert.equal((await request("DELETE", "/api/me/git/ssh-key?id=id_rsa_aws-dev")).status, 404);
+    assert.equal((await request("DELETE", "/api/me/git/ssh-key?id=../x")).status, 400);
+    // The terminal command names every key once switched on, and follows them.
+    await request("PUT", "/api/me/git/ssh-terminal", { on: true });
+    const cmd = () =>
+      execFileSync("git", ["config", "--global", "core.sshCommand"], { encoding: "utf8" });
+    assert.match(cmd(), /id_rsa_aws-prod'/);
+    const again = await request("POST", "/api/me/git/ssh-key", { type: "rsa", name: "aws-dev" });
+    assert.equal(again.body.sshTerminal, "on");
+    assert.match(cmd(), /id_rsa_aws-dev'/);
+    await request("PUT", "/api/me/git/ssh-terminal", { on: false });
+  });
+
+  it("logs each alias in as its own user, and a clone of it uses that key alone", async () => {
+    const prod = await request("PUT", "/api/me/git/ssh-user", {
+      host: HOST,
+      user: "APKAPROD",
+      alias: "AWS-Prod",
+      key: "id_rsa_aws-prod",
+    });
+    assert.equal(prod.status, 200, JSON.stringify(prod.body));
+    await request("PUT", "/api/me/git/ssh-user", { host: HOST, user: "APKADEV", alias: "aws-dev" });
+    await request("PUT", "/api/me/git/ssh-user", { host: HOST, user: "APKADEFAULT" });
+    const rows = (await request("GET", "/api/me/git")).body.sshUsers;
+    assert.deepEqual(
+      rows.map((r) => [r.alias, r.user, r.key]).sort(),
+      [
+        ["aws-dev", "APKADEV", null],
+        ["aws-prod", "APKAPROD", "id_rsa_aws-prod"],
+        [null, "APKADEFAULT", null],
+      ].sort()
+    );
+    assert.equal(getUrl("ssh://aws-prod/v1/repos/x"), `ssh://APKAPROD@${HOST}/v1/repos/x`);
+    assert.equal(getUrl("ssh://aws-dev/v1/repos/x"), `ssh://APKADEV@${HOST}/v1/repos/x`);
+    assert.equal(getUrl(`ssh://${HOST}/v1/repos/x`), `ssh://APKADEFAULT@${HOST}/v1/repos/x`);
+    // Refused: an alias with a dot (it could shadow a real host), a key that is not there.
+    const dot = await request("PUT", "/api/me/git/ssh-user", {
+      host: HOST,
+      user: "A",
+      alias: "a.b",
+    });
+    assert.equal(dot.body.error.code, "EBADALIAS");
+    const nokey = await request("PUT", "/api/me/git/ssh-user", {
+      host: HOST,
+      user: "A",
+      alias: "x",
+      key: "id_rsa_nope",
+    });
+    assert.equal(nokey.body.error.code, "ENOKEY");
+
+    // The test forge stands in for CodeCommit: a longer insteadOf wins.
+    const bare = path.join(ROOT, "bare.git");
+    execFileSync("git", [
+      "config",
+      "--global",
+      "--add",
+      `url.file://${bare}.insteadOf`,
+      "ssh://aws-prod/v1/repos/r",
+    ]);
+    const r = await request("POST", "/api/lanes/clone", {
+      url: "ssh://aws-prod/v1/repos/r",
+      parent: WORK,
+      name: "via-alias",
+    });
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    const cmd = execFileSync(
+      "git",
+      ["-C", path.join(WORK, "via-alias"), "config", "core.sshCommand"],
+      { encoding: "utf8" }
+    ).trim();
+    assert.match(cmd, /^ssh -o IdentityFile='.*\/id_rsa_aws-prod' -o IdentitiesOnly=yes$/);
+
+    // Deleting the key unties the login; deleting the login drops the rule.
+    const unkeyed = await request("DELETE", "/api/me/git/ssh-key?id=id_rsa_aws-prod");
+    assert.equal(unkeyed.body.sshUsers.find((x) => x.alias === "aws-prod").key, null);
+    for (const f of ["aws-prod", "aws-dev", HOST]) {
+      assert.equal((await request("DELETE", `/api/me/git/ssh-user/${f}`)).status, 200);
+    }
+    assert.deepEqual((await request("GET", "/api/me/git")).body.sshUsers, []);
+    assert.equal(getUrl("ssh://aws-dev/v1/repos/x"), "ssh://aws-dev/v1/repos/x");
+    await request("DELETE", "/api/me/git/ssh-key");
+  });
+});
+
 describe("git-identity, member account (S3, stubbed)", () => {
   const runAs = require("../lib/run-as");
   const worktree = require("../lib/worktree");
diff --git a/server/lib/git-identity.js b/server/lib/git-identity.js
index 233f9417..a768886a 100644
--- a/server/lib/git-identity.js
+++ b/server/lib/git-identity.js
@@ -23,8 +23,14 @@
  * A plain `git` typed in a terminal reads none of that, so the account's own
  * `~/.gitconfig` may also carry our `core.sshCommand` (`setTerminalSsh`: on
  * by default for a member, a switch for the host; a user's own is never
- * overwritten), plus a per-host SSH login name (`setSshUser`: AWS CodeCommit
- * wants the IAM SSH key ID as the user) as a `url.<…>.insteadOf` rule there.
+ * overwritten), plus SSH logins (`setSshUser`: AWS CodeCommit wants the IAM
+ * SSH key ID as the user) as `url.<…>.insteadOf` rules there — one per host,
+ * or one per ALIAS (`ssh://aws-prod/…`), so several accounts on one host
+ * (two AWS accounts, two GitHub users) each log in as themselves. Besides
+ * the default key of each type, an account may hold named keys
+ * (`ssh/id_<type>_<name>`), and a login may name the key it uses
+ * (`agenthub.<from>.sshKey` in the same file): a clone of that login's URL
+ * offers ONLY that key and keeps it in the clone's config.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -74,6 +80,12 @@ function accountForRequest(req) {
  */
 const KEY_FILES = { ed25519: "id_ed25519", rsa: "id_rsa" };
 const KEY_PREFIX = { ed25519: "ssh-ed25519", rsa: "ssh-rsa" };
+/** A named key's name, and every key's id (= its file name in `sshDir`). */
+const KEY_NAME_RE = /^[a-z0-9][a-z0-9-]{0,31}$/;
+const KEY_ID_RE = /^id_(ed25519|rsa)(?:_([a-z0-9][a-z0-9-]{0,31}))?$/;
+/** ssh offers every key in turn and servers stop after ~6 tries. */
+const MAX_KEYS = 10;
+const keyIdFor = (type, name) => (name ? `${KEY_FILES[type]}_${name}` : KEY_FILES[type]);
 
 function paths(account) {
   if (account.kind === "member") {
@@ -214,17 +226,32 @@ function fingerprint(publicKey) {
   return `SHA256:${crypto.createHash("sha256").update(blob).digest("base64").replace(/=+$/, "")}`;
 }
 
-/** `[{type, file, publicKey}]` of the account's keys, ed25519 first. */
+/**
+ * `[{id, type, name, file, publicKey}]` of the account's keys: the default
+ * ed25519 and rsa ones first (`name` null), then the named ones by name.
+ */
 function currentKeys(account) {
   const { sshDir } = paths(account);
+  let ids;
+  try {
+    ids = fs.readdirSync(sshDir).filter((n) => KEY_ID_RE.test(n));
+  } catch {
+    return [];
+  }
+  const rank = (id) => {
+    const i = Object.values(KEY_FILES).indexOf(id);
+    return i < 0 ? Object.keys(KEY_FILES).length : i;
+  };
+  ids.sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
   const keys = [];
-  for (const type of Object.keys(KEY_FILES)) {
-    const file = path.join(sshDir, KEY_FILES[type]);
+  for (const id of ids) {
+    const [, type, name = null] = KEY_ID_RE.exec(id);
+    const file = path.join(sshDir, id);
     const publicKey = readText(account, `${file}.pub`);
     if (!publicKey || !publicKey.startsWith(`${KEY_PREFIX[type]} `)) continue;
     // The private half is only looked at, never read into this process.
     if (!isOwnFile(account, file)) continue;
-    keys.push({ type, file, publicKey: publicKey.trim() });
+    keys.push({ id, type, name, file, publicKey: publicKey.trim() });
   }
   return keys;
 }
@@ -235,10 +262,12 @@ const keyFiles = (account) => currentKeys(account).map((k) => k.file);
 /** ssh options naming `files` — `-i` each, in order. */
 const identityArgs = (files) => files.map((f) => ` -i ${shq(f)}`).join("");
 
-/** `[{type, publicKey, fingerprint}]` of the account's keys — never a private half. */
+/** `[{id, type, name, publicKey, fingerprint}]` of the account's keys — never a private half. */
 function sshKeysInfo(account) {
   return currentKeys(account).map((k) => ({
+    id: k.id,
     type: k.type,
+    name: k.name,
     publicKey: k.publicKey,
     fingerprint: fingerprint(k.publicKey),
   }));
@@ -248,14 +277,30 @@ function sshKeysInfo(account) {
 const sshKeyInfo = (account) => sshKeysInfo(account)[0] ?? null;
 
 /**
- * Make the account's key of `type` (ed25519, the default, or rsa); an
- * existing one OF THAT TYPE is replaced only with `replace`. A key of the
- * other type is left alone — a host refusing one type keeps the other.
+ * Make the account's key of `type` (ed25519, the default, or rsa) — the
+ * default one of that type, or with `name` one more beside it (another AWS
+ * account, another GitHub user). An existing key of that id is replaced only
+ * with `replace`; every other key is left alone.
  */
-async function generateSshKey(account, { replace = false, comment, type = "ed25519" } = {}) {
+async function generateSshKey(
+  account,
+  { replace = false, comment, type = "ed25519", name = null } = {}
+) {
   if (!KEY_FILES[type]) throw err("EBADKEYTYPE", "key type: ed25519 or rsa");
-  if (currentKeys(account).some((k) => k.type === type) && !replace) {
-    throw err("EEXISTS", `an ${type} SSH key already exists — replace it explicitly`);
+  const keyName = name == null || name === "" ? null : String(name).trim().toLowerCase();
+  if (keyName !== null && !KEY_NAME_RE.test(keyName)) {
+    throw err("EBADKEYNAME", "a key name of lowercase letters, digits and -, up to 32");
+  }
+  const id = keyIdFor(type, keyName);
+  const keys = currentKeys(account);
+  if (keys.some((k) => k.id === id) && !replace) {
+    throw err("EEXISTS", `the SSH key ${keyName ?? type} already exists — replace it explicitly`);
+  }
+  if (keyName !== null && keys.some((k) => k.name === keyName && k.id !== id)) {
+    throw err("EEXISTS", `a key named ${keyName} already exists`);
+  }
+  if (!keys.some((k) => k.id === id) && keys.length >= MAX_KEYS) {
+    throw err("ETOOMANYKEYS", `at most ${MAX_KEYS} SSH keys`);
   }
   const label =
     String(comment || "agenthub")
@@ -264,29 +309,44 @@ async function generateSshKey(account, { replace = false, comment, type = "ed255
   const { privateKey, publicKey } =
     type === "rsa" ? await makeRsaKeyPair(label) : makeKeyPair(label);
   const { sshDir } = paths(account);
-  const file = path.join(sshDir, KEY_FILES[type]);
+  const file = path.join(sshDir, id);
   writeText(account, file, privateKey, { secret: true });
   writeText(account, `${file}.pub`, publicKey, { secret: false });
   // A member's home is AgentHub's to set up: their terminal git uses the key
   // too, unless they wrote a core.sshCommand of their own. The host's is
-  // its admin's choice (the Settings switch).
-  if (account.kind === "member") await setTerminalSsh(account, true).catch(() => {});
-  return sshKeysInfo(account).find((k) => k.type === type) ?? null;
+  // its admin's choice (the Settings switch) — once on, it follows the keys.
+  if (account.kind === "member" || (await terminalSshState(account)) === "on") {
+    await setTerminalSsh(account, true).catch(() => {});
+  }
+  return sshKeysInfo(account).find((k) => k.id === id) ?? null;
 }
 
 /**
- * Delete the account's key of `type`, or every key when `type` is omitted;
- * false when there was none. The terminal sshCommand goes with the last key.
+ * Delete one key — `{id}`, or the DEFAULT key of `{type}` — or every key when
+ * neither is given; false when there was none. A login naming a deleted key
+ * goes back to offering every key; the terminal sshCommand follows the keys
+ * and goes with the last one.
  */
-async function removeSshKey(account, type) {
+async function removeSshKey(account, which) {
+  const { type, id } = typeof which === "string" ? { type: which } : which || {};
   if (type != null && !KEY_FILES[type]) throw err("EBADKEYTYPE", "key type: ed25519 or rsa");
-  const gone = currentKeys(account).filter((k) => type == null || k.type === type);
+  if (id != null && !KEY_ID_RE.test(id)) throw err("EBADKEYNAME", "no such key id");
+  const gone = currentKeys(account).filter((k) =>
+    id != null ? k.id === id : type != null ? k.id === KEY_FILES[type] : true
+  );
   if (!gone.length) return false;
   for (const k of gone) {
     removeFile(account, k.file);
     removeFile(account, `${k.file}.pub`);
   }
+  const ids = new Set(gone.map((k) => k.id));
+  for (const [from, key] of await keyLinks(account)) {
+    if (ids.has(key)) await unlinkKey(account, from);
+  }
   if (!currentKeys(account).length) await setTerminalSsh(account, false).catch(() => {});
+  else if ((await terminalSshState(account)) === "on") {
+    await setTerminalSsh(account, true).catch(() => {});
+  }
   return true;
 }
 
@@ -427,11 +487,28 @@ async function setAuthor(account, { name, email }) {
  */
 function terminalSshCommand(account) {
   const { sshDir } = paths(account);
-  const ours = Object.values(KEY_FILES).map((f) => `-o IdentityFile=${shq(path.join(sshDir, f))}`);
+  const files = new Set([
+    ...Object.values(KEY_FILES).map((f) => path.join(sshDir, f)),
+    ...currentKeys(account).map((k) => k.file),
+  ]);
+  const ours = [...files].map((f) => `-o IdentityFile=${shq(f)}`);
   const defaults = ["id_ed25519", "id_rsa", "id_ecdsa"].map((f) => `-o IdentityFile=~/.ssh/${f}`);
   return ["ssh", ...ours, ...defaults].join(" ");
 }
 
+/**
+ * Whether `cmd` is a terminal sshCommand WE wrote — of our shape, naming
+ * key files in this account's AgentHub folder (any set of them: it follows
+ * the keys as they are made and deleted) and nothing else but the defaults.
+ */
+function isOurTerminal(account, cmd) {
+  const m = /^ssh((?: -o IdentityFile=(?:'[^']*'|~\/\.ssh\/id_[a-z0-9]+))+)$/.exec(cmd || "");
+  if (!m) return false;
+  const files = [...m[1].matchAll(/IdentityFile='([^']*)'/g)].map((x) => x[1]);
+  const { sshDir } = paths(account);
+  return files.length > 0 && files.every((f) => path.dirname(f) === sshDir);
+}
+
 /** The account's global `core.sshCommand`, or "" when unset. */
 async function globalSshCommand(account) {
   const { git } = require("./worktree");
@@ -449,7 +526,7 @@ async function globalSshCommand(account) {
 async function terminalSshState(account) {
   const cmd = await globalSshCommand(account);
   if (!cmd) return "off";
-  return cmd === terminalSshCommand(account) ? "on" : "foreign";
+  return isOurTerminal(account, cmd) ? "on" : "foreign";
 }
 
 /**
@@ -464,7 +541,8 @@ async function setTerminalSsh(account, on) {
     if (state === "foreign") {
       throw err("EFOREIGNSSH", "your ~/.gitconfig already sets core.sshCommand — left as it is");
     }
-    if (state === "off") {
+    // Off, or ours naming another set of keys than the account holds now.
+    if (state === "off" || (await globalSshCommand(account)) !== terminalSshCommand(account)) {
       await git(homeOf(account), [
         "config",
         "--global",
@@ -487,9 +565,47 @@ async function setTerminalSsh(account, on) {
 // Clone dialog's and the git bar's — without touching `~/.ssh/config`. The
 // user name is no secret (an ID, not a key), so it may cross sudo's argv.
 const SSH_USER_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,63}$/;
+// An alias has no dot, so it can never shadow a real host name.
+const ALIAS_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
 const insteadOfBase = (host, user) => `ssh://${user}@${host}/`;
 
-/** `[{host, user}]` — only the rules of exactly our shape; any other insteadOf is the user's. */
+/** `Map<from, key id>`: the key each login names (`agenthub.<from>.sshKey`). */
+async function keyLinks(account) {
+  const { git } = require("./worktree");
+  const out = await git(homeOf(account), [
+    "config",
+    "--global",
+    "--get-regexp",
+    "^agenthub\\..*\\.sshkey$",
+  ]).then(
+    (r) => r.stdout,
+    () => ""
+  );
+  const links = new Map();
+  for (const line of String(out).split("\n")) {
+    const m = /^agenthub\.(.+)\.sshkey (\S+)$/.exec(line);
+    if (m && KEY_ID_RE.test(m[2])) links.set(m[1], m[2]);
+  }
+  return links;
+}
+
+async function unlinkKey(account, from) {
+  const { git } = require("./worktree");
+  await git(homeOf(account), [
+    "config",
+    "--global",
+    "--unset-all",
+    `agenthub.${from}.sshKey`,
+  ]).catch(() => {});
+}
+
+/**
+ * `[{host, user, alias, key}]` — only the rules of exactly our shape; any
+ * other insteadOf is the user's. `alias` is null for the host's own rule
+ * (`ssh://<host>/` logs in as `user`), else the name standing for that
+ * user@host (`ssh://<alias>/`); `key` is the key id the login uses, or null
+ * for every key.
+ */
 async function listSshUsers(account) {
   const { git } = require("./worktree");
   const out = await git(homeOf(account), [
@@ -501,21 +617,35 @@ async function listSshUsers(account) {
     (r) => r.stdout,
     () => ""
   );
+  const links = await keyLinks(account);
   const rows = [];
   for (const line of out.split("\n")) {
     const m = /^url\.ssh:\/\/([^@/\s]+)@([^/\s]+)\/\.insteadof ssh:\/\/([^/\s]+)\/$/.exec(line);
-    if (m && m[2] === m[3] && SSH_USER_RE.test(m[1]) && HOST_RE.test(m[2])) {
-      rows.push({ host: m[2], user: m[1] });
+    if (
+      m &&
+      (m[2] === m[3] || ALIAS_RE.test(m[3])) &&
+      SSH_USER_RE.test(m[1]) &&
+      HOST_RE.test(m[2])
+    ) {
+      rows.push({
+        host: m[2],
+        user: m[1],
+        alias: m[2] === m[3] ? null : m[3],
+        key: links.get(m[3]) ?? null,
+      });
     }
   }
   return rows;
 }
 
-/** Drop our rule for `host` (whatever its user); false when there was none. */
-async function removeSshUser(account, host) {
+/**
+ * Drop our rule for `from` — a host's own rule, or an alias's — and the key
+ * it names; false when there was none.
+ */
+async function removeSshUser(account, from) {
   const { git } = require("./worktree");
-  const h = String(host || "").toLowerCase();
-  const rows = (await listSshUsers(account)).filter((r) => r.host === h);
+  const f = String(from || "").toLowerCase();
+  const rows = (await listSshUsers(account)).filter((r) => (r.alias ?? r.host) === f);
   for (const r of rows) {
     await git(homeOf(account), [
       "config",
@@ -523,34 +653,68 @@ async function removeSshUser(account, host) {
       "--fixed-value",
       "--unset-all",
       `url.${insteadOfBase(r.host, r.user)}.insteadOf`,
-      `ssh://${r.host}/`,
+      `ssh://${f}/`,
     ]);
   }
+  if (rows.length) await unlinkKey(account, f);
   return rows.length > 0;
 }
 
-/** Log in to `host` over SSH as `user` (replaces our earlier rule for that host). */
-async function setSshUser(account, { host, user } = {}) {
+/**
+ * Log in to `host` over SSH as `user` — for `ssh://<host>/` itself, or, with
+ * `alias`, for `ssh://<alias>/` (one more account on the same host) — with
+ * the key `key` only, or every key when it is null. Replaces our earlier rule
+ * for that host or alias.
+ */
+async function setSshUser(account, { host, user, alias = null, key = null } = {}) {
   const h = String(host || "")
     .trim()
     .toLowerCase();
   const u = String(user || "").trim();
+  const a = alias == null || alias === "" ? null : String(alias).trim().toLowerCase();
   if (!HOST_RE.test(h)) {
     throw err("EBADHOST", "a host name like git-codecommit.us-east-1.amazonaws.com");
   }
   if (!SSH_USER_RE.test(u)) throw err("EBADSSHUSER", "a user name of letters, digits, . _ -");
-  await removeSshUser(account, h);
+  if (a !== null && !ALIAS_RE.test(a)) {
+    throw err("EBADALIAS", "an account name of lowercase letters, digits and - (no dot)");
+  }
+  if (key != null && key !== "" && !currentKeys(account).some((k) => k.id === key)) {
+    throw err("ENOKEY", "no such SSH key");
+  }
+  const from = a ?? h;
+  await removeSshUser(account, from);
   const { git } = require("./worktree");
   await git(homeOf(account), [
     "config",
     "--global",
     "--add",
     `url.${insteadOfBase(h, u)}.insteadOf`,
-    `ssh://${h}/`,
+    `ssh://${from}/`,
   ]);
+  if (key) await git(homeOf(account), ["config", "--global", `agenthub.${from}.sshKey`, key]);
   return listSshUsers(account);
 }
 
+/**
+ * The key file a clone of `url` must use: the one its login names, when the
+ * URL is `ssh://<host or alias>/…` with no user of its own (the only shape
+ * our insteadOf rules rewrite). Null: offer every key.
+ */
+async function linkedKeyFile(account, url) {
+  if (!url.startsWith("ssh://")) return null;
+  let from;
+  try {
+    const u = new URL(url);
+    if (u.username) return null;
+    from = u.host.toLowerCase();
+  } catch {
+    return null;
+  }
+  const row = (await listSshUsers(account)).find((r) => (r.alias ?? r.host) === from && r.key);
+  return row ? (currentKeys(account).find((k) => k.id === row.key)?.file ?? null) : null;
+}
+
 // ── Network commands in an existing repo (git bar fetch/pull/push) ─────────
 
 /**
@@ -582,7 +746,7 @@ async function sshConfigFor(dir) {
   }
   // Our own terminal sshCommand (global) is not the repo's choice: it has no
   // BatchMode, so it would leave a dashboard fetch waiting on a prompt.
-  if (own && own !== terminalSshCommand(account)) return [];
+  if (own && !isOurTerminal(account, own)) return [];
   return [
     "-c",
     `core.sshCommand=ssh${identityArgs(keyFiles(account))} -o BatchMode=yes -o StrictHostKeyChecking=accept-new`,
@@ -692,18 +856,23 @@ async function cloneRepo({ url, parent, name, once = null }) {
 
   if (remote.scheme === "ssh") {
     if (once) throw err("EBADCRED", "a typed login is for https only — SSH uses your key");
-    const keys = keyFiles(account);
+    // A login naming its key (another AWS account, a second GitHub user)
+    // offers that key ONLY — another key could log in as the wrong account.
+    const linked = await linkedKeyFile(account, url);
+    const keys = linked ? [linked] : keyFiles(account);
     const base = keys.length ? `ssh${identityArgs(keys)} -o IdentitiesOnly=yes` : "ssh";
     // BatchMode: no terminal to answer a prompt; accept-new: first contact
     // records the host key, a CHANGED one still fails.
     pre.push("-c", `core.sshCommand=${base} -o BatchMode=yes -o StrictHostKeyChecking=accept-new`);
     if (keys.length) {
-      // Persisted by FILE name, both types: a key made later is offered too
-      // (ssh skips a missing IdentityFile silently, where `-i` would warn).
+      // Persisted by FILE name — both default types plus every named key:
+      // a default key made later is offered too (ssh skips a missing
+      // IdentityFile silently, where `-i` would warn). A linked key alone.
       const { sshDir } = paths(account);
-      const all = Object.values(KEY_FILES)
-        .map((f) => ` -o IdentityFile=${shq(path.join(sshDir, f))}`)
-        .join("");
+      const files = linked
+        ? [linked]
+        : [...new Set([...Object.values(KEY_FILES).map((f) => path.join(sshDir, f)), ...keys])];
+      const all = files.map((f) => ` -o IdentityFile=${shq(f)}`).join("");
       persist.push("-c", `core.sshCommand=ssh${all} -o IdentitiesOnly=yes`);
     }
   } else if (account.kind === "member") {
diff --git a/server/openapi-extra/files.js b/server/openapi-extra/files.js
index 5fb1efee..6ed28002 100644
--- a/server/openapi-extra/files.js
+++ b/server/openapi-extra/files.js
@@ -276,17 +276,23 @@ const paths = {
   "/api/me/git/ssh-key": {
     post: {
       tags: ["Git identity"],
-      summary: "Make (or with `replace`, replace) the SSH key of `type`; the other type is kept",
+      summary:
+        "Make (or with `replace`, replace) the default SSH key of `type`, or with `name` one more beside it",
       operationId: "generateSshKey",
       requestBody: json({
         replace: { type: "boolean" },
         type: { type: "string", enum: ["ed25519", "rsa"] },
+        name: { type: "string", pattern: "^[a-z0-9][a-z0-9-]{0,31}$" },
       }),
-      responses: { 201: { description: "The identity." } },
+      responses: {
+        201: { description: "The identity." },
+        400: { description: "EBADKEYNAME" },
+        409: { description: "EEXISTS (without replace, or the name is taken) / ETOOMANYKEYS" },
+      },
     },
     delete: {
       tags: ["Git identity"],
-      summary: "Delete the SSH key of ?type=ed25519|rsa, or every key",
+      summary: "Delete one SSH key (?id=, or the default of ?type=ed25519|rsa), or every key",
       operationId: "deleteSshKey",
       parameters: [
         {
@@ -295,6 +301,7 @@ const paths = {
           required: false,
           schema: { type: "string", enum: ["ed25519", "rsa"] },
         },
+        { name: "id", in: "query", required: false, schema: { type: "string" } },
       ],
       responses: { 200: { description: "The identity." } },
     },
@@ -311,6 +318,36 @@ const paths = {
       },
     },
   },
+  "/api/me/git/ssh-user": {
+    put: {
+      tags: ["Git identity"],
+      summary:
+        "An SSH login: url.<ssh://user@host/>.insteadOf ssh://<alias or host>/, optionally tied to one key",
+      operationId: "setSshUser",
+      requestBody: json(
+        {
+          host: { type: "string" },
+          user: { type: "string" },
+          alias: { type: "string", pattern: "^[a-z0-9][a-z0-9-]{0,62}$" },
+          key: { type: "string" },
+        },
+        ["host", "user"]
+      ),
+      responses: {
+        200: { description: "The identity; `sshUsers: [{host, user, alias, key}]`." },
+        400: { description: "EBADHOST / EBADSSHUSER / EBADALIAS / ENOKEY" },
+      },
+    },
+  },
+  "/api/me/git/ssh-user/{from}": {
+    delete: {
+      tags: ["Git identity"],
+      summary: "Drop the SSH login of a host or alias (and its key link)",
+      operationId: "deleteSshUser",
+      parameters: [{ name: "from", in: "path", required: true, schema: { type: "string" } }],
+      responses: { 200: { description: "The identity." }, 404: { description: "ENOTFOUND" } },
+    },
+  },
   "/api/me/git/https": {
     post: {
       tags: ["Git identity"],
diff --git a/server/routes/git-identity.js b/server/routes/git-identity.js
index e5beffc5..c8c6a21b 100644
--- a/server/routes/git-identity.js
+++ b/server/routes/git-identity.js
@@ -1,10 +1,12 @@
 /**
  * @file HTTP surface for a user's OWN git identity (`server/lib/git-identity.js`),
- * mounted at `/api/me/git`: the SSH keys a clone uses — ed25519 and/or rsa (make, replace, delete —
- * only the PUBLIC key is ever returned) and the HTTPS logins (save, delete —
- * `hasToken` only, never a password), whether the account's own terminal
- * git uses that key (`core.sshCommand`), the SSH login name per host
- * (`url.<…>.insteadOf` — AWS CodeCommit's SSH key ID), and the commit author (`user.name` /
+ * mounted at `/api/me/git`: the SSH keys a clone uses — a default ed25519
+ * and/or rsa one plus named ones (`name`, deleted by `?id=`) for more
+ * accounts (make, replace, delete — only the PUBLIC key is ever returned) and
+ * the HTTPS logins (save, delete — `hasToken` only, never a password),
+ * whether the account's own terminal git uses the keys (`core.sshCommand`),
+ * the SSH logins per host or alias (`url.<…>.insteadOf` — AWS CodeCommit's
+ * SSH key ID — each optionally tied to one key), and the commit author (`user.name` /
  * `user.email` of the account's global git config — a member's commits fail
  * without one; a new SSH key is labelled with that email, else
  * `<username>@smartgift.vn`). The account is the signed-in user's
@@ -33,6 +35,10 @@ const STATUS = {
   EBADKEYTYPE: 400,
   EFOREIGNSSH: 409,
   EBADSSHUSER: 400,
+  EBADKEYNAME: 400,
+  ETOOMANYKEYS: 409,
+  EBADALIAS: 400,
+  ENOKEY: 400,
 };
 
 function fail(res, e) {
@@ -87,9 +93,10 @@ router.post("/ssh-key", sameOriginGuard, async (req, res) => {
     await identity.generateSshKey(account, {
       replace: req.body?.replace === true,
       type: req.body?.type === "rsa" ? "rsa" : "ed25519",
+      // A named key sits beside the default one of its type.
+      name: typeof req.body?.name === "string" ? req.body.name : null,
       // The key is labelled with the commit author's email, else the default one.
-      comment:
-        (await identity.getAuthor(account)).email || identity.defaultEmail(usernameOf(req)),
+      comment: (await identity.getAuthor(account)).email || identity.defaultEmail(usernameOf(req)),
     });
     res.status(201).json(await view(account, usernameOf(req)));
   } catch (e) {
@@ -101,7 +108,8 @@ router.delete("/ssh-key", sameOriginGuard, async (req, res) => {
   try {
     const account = accountOf(req, { write: true });
     const type = req.query.type === undefined ? undefined : String(req.query.type);
-    if (!(await identity.removeSshKey(account, type))) {
+    const id = req.query.id === undefined ? undefined : String(req.query.id);
+    if (!(await identity.removeSshKey(account, { type, id }))) {
       return res.status(404).json({ error: { code: "ENOTFOUND", message: "no SSH key" } });
     }
     res.json(await view(account, usernameOf(req)));
@@ -128,8 +136,10 @@ router.put("/ssh-terminal", sameOriginGuard, async (req, res) => {
 });
 
 /**
- * The SSH user name for one host (`{host, user}`) — e.g. AWS CodeCommit's SSH
- * key ID, so a plain `ssh://git-codecommit…/` URL logs in. DELETE drops it.
+ * An SSH login (`{host, user, alias?, key?}`) — e.g. AWS CodeCommit's SSH key
+ * ID, so a plain `ssh://git-codecommit…/` URL logs in; with `alias`, one more
+ * account on that host (`ssh://<alias>/…`); with `key`, the only key it uses.
+ * DELETE `/ssh-user/<host or alias>` drops it.
  */
 router.put("/ssh-user", sameOriginGuard, async (req, res) => {
   try {