diff --git a/app/src/main/java/io/xpipe/app/beacon/AppBeaconCache.java b/app/src/main/java/io/xpipe/app/beacon/AppBeaconCache.java
index 9452e6c72..025c4e1e1 100644
--- a/app/src/main/java/io/xpipe/app/beacon/AppBeaconCache.java
+++ b/app/src/main/java/io/xpipe/app/beacon/AppBeaconCache.java
@@ -36,12 +36,6 @@ public class AppBeaconCache {
         control.setNonInteractive();
         control.start();
 
-        var d = control.getShellDialect().getDumbMode();
-        if (!d.supportsAnyPossibleInteraction()) {
-            control.close();
-            d.throwIfUnsupported();
-        }
-
         if (existing.isEmpty()) {
             AppBeaconServer.get().getCache().getShellSessions().add(new BeaconShellSession(ref.get(), control));
         }
diff --git a/app/src/main/java/io/xpipe/app/beacon/AppBeaconServer.java b/app/src/main/java/io/xpipe/app/beacon/AppBeaconServer.java
index dd40d92e9..96120c07d 100644
--- a/app/src/main/java/io/xpipe/app/beacon/AppBeaconServer.java
+++ b/app/src/main/java/io/xpipe/app/beacon/AppBeaconServer.java
@@ -31,9 +31,6 @@ public class AppBeaconServer {
     @Getter
     private final int port;
 
-    @Getter
-    private final boolean propertyPort;
-
     @Getter
     private final Set<BeaconSession> sessions = new HashSet<>();
 
@@ -47,22 +44,13 @@ public class AppBeaconServer {
     @Getter
     private String localAuthSecret;
 
-    private AppBeaconServer(int port, boolean propertyPort) {
+    private AppBeaconServer(int port) {
         this.port = port;
-        this.propertyPort = propertyPort;
     }
 
     public static void setupPort() {
-        int port;
-        boolean propertyPort;
-        if (System.getProperty(BeaconConfig.BEACON_PORT_PROP) != null) {
-            port = BeaconConfig.getUsedPort();
-            propertyPort = true;
-        } else {
-            port = BeaconConfig.getDefaultBeaconPort();
-            propertyPort = false;
-        }
-        INSTANCE = new AppBeaconServer(port, propertyPort);
+        int port = BeaconConfig.getUsedPort();
+        INSTANCE = new AppBeaconServer(port);
     }
 
     public static void init() {
diff --git a/app/src/main/java/io/xpipe/app/beacon/impl/FsReadExchangeImpl.java b/app/src/main/java/io/xpipe/app/beacon/impl/FsReadExchangeImpl.java
index 93eff4052..b3db97e8b 100644
--- a/app/src/main/java/io/xpipe/app/beacon/impl/FsReadExchangeImpl.java
+++ b/app/src/main/java/io/xpipe/app/beacon/impl/FsReadExchangeImpl.java
@@ -31,8 +31,7 @@ public class FsReadExchangeImpl extends FsReadExchange {
             var file = BlobManager.get().newBlobFile();
             try (var in = fs.openInput(msg.getPath())) {
                 var fixedIn = new FixedSizeInputStream(new BufferedInputStream(in), size);
-                try (var fileOut =
-                        Files.newOutputStream(file.resolve(msg.getPath().getFileName()))) {
+                try (var fileOut = Files.newOutputStream(file)) {
                     fixedIn.transferTo(fileOut);
                 }
                 in.transferTo(OutputStream.nullOutputStream());
diff --git a/app/src/main/java/io/xpipe/app/beacon/mcp/AppMcpServer.java b/app/src/main/java/io/xpipe/app/beacon/mcp/AppMcpServer.java
index 8b225909d..32d44c1ee 100644
--- a/app/src/main/java/io/xpipe/app/beacon/mcp/AppMcpServer.java
+++ b/app/src/main/java/io/xpipe/app/beacon/mcp/AppMcpServer.java
@@ -49,11 +49,11 @@ public class AppMcpServer {
         McpSyncServer syncServer = io.modelcontextprotocol.server.McpServer.sync(transportProvider)
                 .serverInfo(AppNames.ofCurrent().getName(), AppProperties.get().getVersion())
                 .capabilities(McpSchema.ServerCapabilities.builder()
-                        .resources(true, true)
+                        .resources(false, false)
                         .tools(true)
                         .prompts(false)
-                        .completions()
                         .build())
+                .instructions(AppPrefs.get().mcpAdditionalContext().getValue())
                 .build();
 
         var readOnlyTools = new ArrayList<McpServerFeatures.SyncToolSpecification>();
@@ -65,13 +65,13 @@ public class AppMcpServer {
         readOnlyTools.add(McpTools.getFileInfo());
 
         var mutationTools = new ArrayList<McpServerFeatures.SyncToolSpecification>();
+        mutationTools.add(McpTools.openTerminal());
+        mutationTools.add(McpTools.openTerminalInline());
         mutationTools.add(McpTools.createFile());
         mutationTools.add(McpTools.writeFile());
         mutationTools.add(McpTools.createDirectory());
         mutationTools.add(McpTools.runCommand());
         mutationTools.add(McpTools.runScript());
-        mutationTools.add(McpTools.openTerminal());
-        mutationTools.add(McpTools.openTerminalInline());
         mutationTools.add(McpTools.toggleState());
 
         for (McpServerFeatures.SyncToolSpecification readOnlyTool : readOnlyTools) {
diff --git a/app/src/main/java/io/xpipe/app/beacon/mcp/McpToolHandler.java b/app/src/main/java/io/xpipe/app/beacon/mcp/McpToolHandler.java
index f4d9ff768..b838c1e06 100644
--- a/app/src/main/java/io/xpipe/app/beacon/mcp/McpToolHandler.java
+++ b/app/src/main/java/io/xpipe/app/beacon/mcp/McpToolHandler.java
@@ -37,7 +37,7 @@ public interface McpToolHandler
                     .isError(true)
                     .build();
         } catch (Throwable e) {
-            ErrorEventFactory.fromThrowable(e).handle();
+            ErrorEventFactory.fromThrowable(e).omit().handle();
             return McpSchema.CallToolResult.builder()
                     .addTextContent(e.getMessage())
                     .isError(true)
@@ -137,7 +137,7 @@ public interface McpToolHandler
             return e.ref();
         }
 
-        public DataStoreEntryRef<ShellStore> getShellStoreRef(String name) throws BeaconClientException {
+        public DataStoreEntryRef<ShellStore> getShellStoreRef(String name, boolean mutation) throws BeaconClientException {
             var ref = getDataStoreRef(name);
             var isShell = ref.getStore() instanceof ShellStore;
             if (!isShell) {
@@ -145,6 +145,12 @@ public interface McpToolHandler
                         + DataStorage.get().getStorePath(ref.get()).toString() + " is not a shell connection");
             }
 
+            var disableMutation = DataStorage.get().getEffectiveCategoryConfig(ref.get()).getDontAllowScripts();
+            if (mutation && disableMutation != null && disableMutation) {
+                throw new BeaconClientException("Modifications to connection "
+                        + DataStorage.get().getStorePath(ref.get()).toString() + " is disabled by the category setting");
+            }
+
             return ref.asNeeded();
         }
     }
diff --git a/app/src/main/java/io/xpipe/app/beacon/mcp/McpTools.java b/app/src/main/java/io/xpipe/app/beacon/mcp/McpTools.java
index 79e7c027f..bb4772c17 100644
--- a/app/src/main/java/io/xpipe/app/beacon/mcp/McpTools.java
+++ b/app/src/main/java/io/xpipe/app/beacon/mcp/McpTools.java
@@ -3,10 +3,8 @@ package io.xpipe.app.beacon.mcp;
 import io.xpipe.app.beacon.AppBeaconServer;
 import io.xpipe.app.core.AppExtensionManager;
 import io.xpipe.app.core.AppNames;
-import io.xpipe.app.ext.ConnectionFileSystem;
-import io.xpipe.app.ext.FileEntry;
-import io.xpipe.app.ext.FileInfo;
-import io.xpipe.app.ext.SingletonSessionStore;
+import io.xpipe.app.ext.*;
+import io.xpipe.app.hub.comp.StoreViewState;
 import io.xpipe.app.process.ScriptHelper;
 import io.xpipe.app.process.ShellControl;
 import io.xpipe.app.process.TerminalInitScriptConfig;
@@ -85,6 +83,10 @@ public final class McpTools {
 
         @NonNull
         String path;
+
+        String information;
+
+        String notes;
     }
 
     public static McpServerFeatures.SyncToolSpecification listSystems() throws IOException {
@@ -107,9 +109,14 @@ public final class McpTools {
                             continue;
                         }
 
+                        var section = StoreViewState.get().getSectionForWrapper(StoreViewState.get().getEntryWrapper(e));
+                        var info = section.isPresent() ? e.getProvider().informationString(section.get()).getValue() : null;
+
                         var r = ConnectionResource.builder()
                                 .name(e.getName())
                                 .path(DataStorage.get().getStorePath(e).toString())
+                                .information(info)
+                                .notes(e.getNotes())
                                 .build();
                         list.add(r);
                     }
@@ -138,7 +145,7 @@ public final class McpTools {
                 .callHandler(McpToolHandler.of((req) -> {
                     var path = req.getFilePath("path");
                     var system = req.getStringArgument("system");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, false);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
                     var fs = new ConnectionFileSystem(shellSession.getControl());
 
@@ -165,7 +172,7 @@ public final class McpTools {
                     var path = req.getFilePath("path");
                     var system = req.getStringArgument("system");
                     var recursive = req.getOptionalBooleanArgument("recursive").orElse(false);
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, false);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
                     var fs = new ConnectionFileSystem(shellSession.getControl());
 
@@ -194,7 +201,7 @@ public final class McpTools {
                     var system = req.getStringArgument("system");
                     var recursive = req.getOptionalBooleanArgument("recursive").orElse(false);
                     var pattern = req.getStringArgument("name");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, false);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
                     var fs = new ConnectionFileSystem(shellSession.getControl());
 
@@ -226,7 +233,7 @@ public final class McpTools {
                 .callHandler(McpToolHandler.of((req) -> {
                     var path = req.getFilePath("path");
                     var system = req.getStringArgument("system");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, false);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
                     var fs = new ConnectionFileSystem(shellSession.getControl());
 
@@ -267,7 +274,7 @@ public final class McpTools {
                 .callHandler(McpToolHandler.of((req) -> {
                     var path = req.getFilePath("path");
                     var system = req.getStringArgument("system");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, true);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
                     var fs = new ConnectionFileSystem(shellSession.getControl());
 
@@ -300,7 +307,7 @@ public final class McpTools {
                     var path = req.getFilePath("path");
                     var system = req.getStringArgument("system");
                     var content = req.getStringArgument("content");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, true);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
                     var fs = new ConnectionFileSystem(shellSession.getControl());
 
@@ -323,7 +330,7 @@ public final class McpTools {
                 .callHandler(McpToolHandler.of((req) -> {
                     var path = req.getFilePath("path");
                     var system = req.getStringArgument("system");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, true);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
                     var fs = new ConnectionFileSystem(shellSession.getControl());
 
@@ -347,10 +354,10 @@ public final class McpTools {
                 .callHandler(McpToolHandler.of((req) -> {
                     var command = req.getStringArgument("command");
                     var system = req.getStringArgument("system");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, true);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
 
-                    var out = shellSession.getControl().command(command).readStdoutOrThrow();
+                    var out = ProcessControlProvider.get().executeMcpCommand(shellSession.getControl(), command);
                     var formatted = CommandDialog.formatOutput(out);
 
                     return McpSchema.CallToolResult.builder()
@@ -370,7 +377,7 @@ public final class McpTools {
                     var directory = req.getFilePath("directory");
                     var arguments = req.getStringArgument("arguments");
 
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, true);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
 
                     var clazz = Class.forName(
@@ -407,7 +414,7 @@ public final class McpTools {
                 .callHandler(McpToolHandler.of((req) -> {
                     var system = req.getStringArgument("system");
                     var directory = req.getOptionalStringArgument("directory");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, true);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
 
                     TerminalLaunch.builder()
@@ -430,7 +437,7 @@ public final class McpTools {
                 .callHandler(McpToolHandler.of((req) -> {
                     var system = req.getStringArgument("system");
                     var directory = req.getOptionalStringArgument("directory");
-                    var shellStore = req.getShellStoreRef(system);
+                    var shellStore = req.getShellStoreRef(system, true);
                     var shellSession = AppBeaconServer.get().getCache().getOrStart(shellStore);
 
                     var script = shellSession
diff --git a/app/src/main/java/io/xpipe/app/browser/file/BrowserTerminalDockTabModel.java b/app/src/main/java/io/xpipe/app/browser/file/BrowserTerminalDockTabModel.java
index 5ee01ed93..d7db04dd3 100644
--- a/app/src/main/java/io/xpipe/app/browser/file/BrowserTerminalDockTabModel.java
+++ b/app/src/main/java/io/xpipe/app/browser/file/BrowserTerminalDockTabModel.java
@@ -14,6 +14,7 @@ import io.xpipe.app.terminal.TerminalDockBrowserComp;
 import io.xpipe.app.terminal.TerminalDockView;
 import io.xpipe.app.terminal.TerminalView;
 import io.xpipe.app.terminal.WindowsTerminalType;
+import io.xpipe.app.util.GlobalTimer;
 import io.xpipe.app.util.ThreadHelper;
 
 import javafx.application.Platform;
@@ -25,6 +26,7 @@ import javafx.beans.value.ObservableValue;
 import javafx.collections.ListChangeListener;
 import javafx.collections.ObservableList;
 
+import java.time.Duration;
 import java.util.UUID;
 import java.util.function.UnaryOperator;
 
@@ -36,6 +38,7 @@ public final class BrowserTerminalDockTabModel extends BrowserSessionTab {
     private final BooleanProperty opened = new SimpleBooleanProperty();
     private TerminalView.Listener listener;
     private ObservableBooleanValue viewActive;
+    private boolean closed;
 
     public BrowserTerminalDockTabModel(
             BrowserAbstractSessionModel<?> browserModel,
@@ -147,6 +150,14 @@ public final class BrowserTerminalDockTabModel extends BrowserSessionTab {
                 }
             }
         });
+
+        GlobalTimer.scheduleUntil(Duration.ofMillis(300), false, () -> {
+            if (viewActive.get()) {
+                dockModel.clearDeadTerminals();
+                dockModel.updateCustomBounds();
+            }
+            return closed;
+        });
     }
 
     @Override
@@ -155,6 +166,7 @@ public final class BrowserTerminalDockTabModel extends BrowserSessionTab {
             TerminalView.get().removeListener(listener);
         }
         dockModel.onClose();
+        closed = true;
     }
 
     @Override
diff --git a/app/src/main/java/io/xpipe/app/browser/icon/BrowserIconManager.java b/app/src/main/java/io/xpipe/app/browser/icon/BrowserIconManager.java
index 39a505384..7a558dc6e 100644
--- a/app/src/main/java/io/xpipe/app/browser/icon/BrowserIconManager.java
+++ b/app/src/main/java/io/xpipe/app/browser/icon/BrowserIconManager.java
@@ -19,7 +19,7 @@ public class BrowserIconManager {
     }
 
     public static void loadIfNecessary(String s) {
-        var res = AppDisplayScale.hasDefaultDisplayScale() ? "24" : "40";
+        var res = AppDisplayScale.hasOnlyDefaultDisplayScale() ? "24" : "40";
         var key = "browser/" + FilenameUtils.getBaseName(s) + "-" + res + ".png";
         if (AppImages.hasImage(key)) {
             return;
diff --git a/app/src/main/java/io/xpipe/app/comp/base/AppLayoutComp.java b/app/src/main/java/io/xpipe/app/comp/base/AppLayoutComp.java
index e40046bcf..70f64c7a8 100644
--- a/app/src/main/java/io/xpipe/app/comp/base/AppLayoutComp.java
+++ b/app/src/main/java/io/xpipe/app/comp/base/AppLayoutComp.java
@@ -4,11 +4,14 @@ import io.xpipe.app.comp.BaseRegionBuilder;
 import io.xpipe.app.comp.RegionStructure;
 import io.xpipe.app.comp.RegionStructureBuilder;
 import io.xpipe.app.core.AppLayoutModel;
+import io.xpipe.app.core.AppRestart;
+import io.xpipe.app.core.window.AppDialog;
 import io.xpipe.app.hub.comp.StoreViewState;
 import io.xpipe.app.platform.PlatformThread;
 import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.storage.DataStorage;
 
+import io.xpipe.app.util.GlobalTimer;
 import javafx.beans.binding.Bindings;
 import javafx.beans.value.ObservableValue;
 import javafx.scene.Node;
@@ -19,7 +22,9 @@ import javafx.scene.input.KeyEvent;
 import javafx.scene.layout.BorderPane;
 import javafx.scene.layout.Region;
 import javafx.scene.layout.StackPane;
+import org.bouncycastle.math.raw.Mod;
 
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -61,6 +66,15 @@ public class AppLayoutComp extends RegionStructureBuilder<BorderPane, AppLayoutC
                 if (storage != null) {
                     storage.saveAsync();
                 }
+
+                if (AppPrefs.get() != null && AppPrefs.get().getRequiresRestart().get()) {
+                    GlobalTimer.delay(() -> {
+                        var modal = ModalOverlay.of("prefsRestartTitle", AppDialog.dialogTextKey("prefsRestartContent"));
+                        modal.addButton(ModalButton.cancel());
+                        modal.addButton(new ModalButton("restart", () -> AppRestart.restart(), true, true));
+                        modal.show();
+                    }, Duration.ofSeconds(1));
+                }
             }
 
             if (o != null && o.equals(model.getEntries().get(0))) {
diff --git a/app/src/main/java/io/xpipe/app/comp/base/DialogComp.java b/app/src/main/java/io/xpipe/app/comp/base/DialogComp.java
deleted file mode 100644
index 604402bc4..000000000
--- a/app/src/main/java/io/xpipe/app/comp/base/DialogComp.java
+++ /dev/null
@@ -1,88 +0,0 @@
-package io.xpipe.app.comp.base;
-
-import io.xpipe.app.comp.RegionBuilder;
-import io.xpipe.app.core.AppI18n;
-
-import javafx.geometry.Pos;
-import javafx.scene.control.ScrollPane;
-import javafx.scene.layout.HBox;
-import javafx.scene.layout.Priority;
-import javafx.scene.layout.Region;
-import javafx.scene.layout.VBox;
-
-import atlantafx.base.theme.Styles;
-import org.int4.fx.builders.common.AbstractRegionBuilder;
-
-import java.util.List;
-
-public abstract class DialogComp extends RegionBuilder<Region> {
-
-    protected Region createNavigation() {
-        HBox buttons = new HBox();
-        buttons.setFillHeight(true);
-        var customButton = bottom();
-        if (customButton != null) {
-            var c = customButton.build();
-            buttons.getChildren().add(c);
-            HBox.setHgrow(c, Priority.ALWAYS);
-        }
-        var spacer = new Region();
-        HBox.setHgrow(spacer, Priority.SOMETIMES);
-        buttons.getChildren().add(spacer);
-        buttons.getStyleClass().add("buttons");
-        buttons.setSpacing(5);
-        buttons.setAlignment(Pos.CENTER_RIGHT);
-
-        buttons.getChildren()
-                .addAll(customButtons().stream()
-                        .map(buttonComp -> buttonComp.build())
-                        .toList());
-        var nextButton = finishButton();
-        buttons.getChildren().add(nextButton.build());
-        return buttons;
-    }
-
-    protected AbstractRegionBuilder<?, ?> finishButton() {
-        return new ButtonComp(AppI18n.observable(finishKey()), this::finish)
-                .style(Styles.ACCENT)
-                .style("next");
-    }
-
-    protected String finishKey() {
-        return "finishStep";
-    }
-
-    protected List<AbstractRegionBuilder<?, ?>> customButtons() {
-        return List.of();
-    }
-
-    @Override
-    public Region createSimple() {
-        var sp = pane(content()).style("dialog-content").build();
-        VBox vbox = new VBox();
-        vbox.getChildren().addAll(sp, createNavigation());
-        vbox.getStyleClass().add("dialog-comp");
-        vbox.setFillWidth(true);
-        VBox.setVgrow(sp, Priority.ALWAYS);
-        return vbox;
-    }
-
-    protected abstract void finish();
-
-    public abstract AbstractRegionBuilder<?, ?> content();
-
-    protected AbstractRegionBuilder<?, ?> pane(AbstractRegionBuilder<?, ?> content) {
-        var entry = content;
-        return RegionBuilder.of(() -> {
-            var entryR = entry.build();
-            var sp = new ScrollPane(entryR);
-            sp.setFitToWidth(true);
-            entryR.minHeightProperty().bind(sp.heightProperty());
-            return sp;
-        });
-    }
-
-    public AbstractRegionBuilder<?, ?> bottom() {
-        return null;
-    }
-}
diff --git a/app/src/main/java/io/xpipe/app/comp/base/IntegratedTextAreaComp.java b/app/src/main/java/io/xpipe/app/comp/base/IntegratedTextAreaComp.java
index bb76a4671..e2b2c969c 100644
--- a/app/src/main/java/io/xpipe/app/comp/base/IntegratedTextAreaComp.java
+++ b/app/src/main/java/io/xpipe/app/comp/base/IntegratedTextAreaComp.java
@@ -89,13 +89,19 @@ public class IntegratedTextAreaComp extends RegionStructureBuilder<AnchorPane, I
                     .bind(Bindings.createIntegerBinding(
                             () -> {
                                 var val = value.getValue() != null ? value.getValue() : "";
-                                var count = (int) val.lines().count() + (val.endsWith("\n") ? 1 : 0);
+                                var valCount = (int) val.lines().count() + (val.endsWith("\n") ? 1 : 0);
+
+                                var promptVal = struc.getTextArea().getPromptText() != null ? struc.getTextArea().getPromptText() : "";
+                                var promptValCount = (int) promptVal.lines().count() + (promptVal.endsWith("\n") ? 1 : 0);
+
+                                var count = Math.max(valCount, promptValCount);
                                 // Somehow the handling of trailing newlines is weird
                                 // This makes the handling better for JavaFX text areas
                                 count++;
                                 return Math.max(1, count);
                             },
-                            value));
+                            value,
+                            struc.getTextArea().promptTextProperty()));
         });
         var textAreaStruc = textArea.buildStructure();
         var copyButton = createOpenButton();
diff --git a/app/src/main/java/io/xpipe/app/comp/base/ListBoxViewComp.java b/app/src/main/java/io/xpipe/app/comp/base/ListBoxViewComp.java
index e23ca4a83..0d63b1a59 100644
--- a/app/src/main/java/io/xpipe/app/comp/base/ListBoxViewComp.java
+++ b/app/src/main/java/io/xpipe/app/comp/base/ListBoxViewComp.java
@@ -62,13 +62,13 @@ public class ListBoxViewComp<T> extends RegionBuilder<ScrollPane> {
         vbox.setFocusTraversable(false);
         var scroll = new ScrollPane(vbox);
 
-        refresh(scroll, vbox, shown, all, cache, false);
+        refresh(vbox, shown, all, cache);
 
         var hadScene = new AtomicBoolean(false);
         scroll.sceneProperty().subscribe(scene -> {
             if (scene != null) {
                 hadScene.set(true);
-                refresh(scroll, vbox, shown, all, cache, true);
+                refresh(vbox, shown, all, cache);
             }
         });
 
@@ -78,7 +78,7 @@ public class ListBoxViewComp<T> extends RegionBuilder<ScrollPane> {
                     return;
                 }
 
-                refresh(scroll, vbox, c.getList(), all, cache, true);
+                refresh(vbox, c.getList(), all, cache);
             });
         });
 
@@ -118,12 +118,21 @@ public class ListBoxViewComp<T> extends RegionBuilder<ScrollPane> {
 
         var dirty = new SimpleBooleanProperty();
         var animationTimer = new AnimationTimer() {
+
+            private long delayThresholdCrossed;
+
             @Override
             public void handle(long now) {
                 if (!dirty.get()) {
                     return;
                 }
 
+                var ms = now / 1_000_000;
+                if (ms < delayThresholdCrossed + (super.hashCode() % 100)) {
+                    return;
+                }
+                delayThresholdCrossed = ms;
+
                 updateVisibilities(scroll, vbox);
                 dirty.set(false);
             }
@@ -146,6 +155,9 @@ public class ListBoxViewComp<T> extends RegionBuilder<ScrollPane> {
         vbox.heightProperty().addListener((observable, oldValue, newValue) -> {
             dirty.set(true);
         });
+        vbox.getChildren().addListener((ListChangeListener<? super Node>) (change) -> {
+            dirty.set(true);
+        });
 
         // We can't directly listen to any parent element changing visibility, so this is a compromise
         if (AppLayoutModel.get() != null) {
@@ -297,12 +309,10 @@ public class ListBoxViewComp<T> extends RegionBuilder<ScrollPane> {
     }
 
     private void refresh(
-            ScrollPane scroll,
             VBox listView,
             List<? extends T> shown,
             List<? extends T> all,
-            Map<T, Region> cache,
-            boolean refreshVisibilities) {
+            Map<T, Region> cache) {
         Runnable update = () -> {
             if (!Platform.isFxApplicationThread()) {
                 throw new IllegalStateException("Not in FxApplication thread");
@@ -358,9 +368,6 @@ public class ListBoxViewComp<T> extends RegionBuilder<ScrollPane> {
 
             var d = DerivedObservableList.wrap(listView.getChildren(), true);
             d.setContent(newShown);
-            if (refreshVisibilities) {
-                updateVisibilities(scroll, listView);
-            }
         };
         update.run();
     }
diff --git a/app/src/main/java/io/xpipe/app/comp/base/MarkdownComp.java b/app/src/main/java/io/xpipe/app/comp/base/MarkdownComp.java
index 0ccf1cdbc..ce7ea411d 100644
--- a/app/src/main/java/io/xpipe/app/comp/base/MarkdownComp.java
+++ b/app/src/main/java/io/xpipe/app/comp/base/MarkdownComp.java
@@ -100,7 +100,7 @@ public class MarkdownComp extends RegionBuilder<StackPane> {
         var url = AppResources.getResourceURL(AppResources.MAIN_MODULE, theme).orElseThrow();
         wv.getEngine().setUserStyleSheetLocation(url.toString());
 
-        PlatformThread.sync(markdown).subscribe(val -> {
+        markdown.subscribe(val -> {
             PlatformThread.runLaterIfNeeded(() -> {
                 var file = getHtmlFile(val);
                 if (file != null) {
diff --git a/app/src/main/java/io/xpipe/app/comp/base/SideMenuBarComp.java b/app/src/main/java/io/xpipe/app/comp/base/SideMenuBarComp.java
index 64fae5e7d..612f39020 100644
--- a/app/src/main/java/io/xpipe/app/comp/base/SideMenuBarComp.java
+++ b/app/src/main/java/io/xpipe/app/comp/base/SideMenuBarComp.java
@@ -49,10 +49,11 @@ public class SideMenuBarComp extends RegionBuilder<VBox> {
 
                 if (e.action() != null) {
                     e.action().run();
-                    return;
                 }
 
-                value.setValue(e);
+                if (e.comp() != null) {
+                    value.setValue(e);
+                }
             });
             b.describe(d -> d.name(e.name()));
 
diff --git a/app/src/main/java/io/xpipe/app/comp/base/ToggleSwitchComp.java b/app/src/main/java/io/xpipe/app/comp/base/ToggleSwitchComp.java
index 237b3df03..d4140128c 100644
--- a/app/src/main/java/io/xpipe/app/comp/base/ToggleSwitchComp.java
+++ b/app/src/main/java/io/xpipe/app/comp/base/ToggleSwitchComp.java
@@ -70,6 +70,7 @@ public class ToggleSwitchComp extends RegionBuilder<ToggleSwitch> {
                     s.setGraphic(value.createGraphicNode());
                 });
             });
+            s.setAlignment(Pos.CENTER);
             s.pseudoClassStateChanged(PseudoClass.getPseudoClass("has-graphic"), true);
         }
 
diff --git a/app/src/main/java/io/xpipe/app/core/AppConfigurationDialog.java b/app/src/main/java/io/xpipe/app/core/AppConfigurationDialog.java
index ed45d854b..c3c1a50d8 100644
--- a/app/src/main/java/io/xpipe/app/core/AppConfigurationDialog.java
+++ b/app/src/main/java/io/xpipe/app/core/AppConfigurationDialog.java
@@ -6,6 +6,7 @@ import io.xpipe.app.comp.base.ScrollComp;
 import io.xpipe.app.core.window.AppDialog;
 import io.xpipe.app.platform.OptionsBuilder;
 import io.xpipe.app.prefs.EditorCategory;
+import io.xpipe.app.prefs.PasswordManagerCategory;
 import io.xpipe.app.prefs.PersonalizationCategory;
 import io.xpipe.app.prefs.TerminalCategory;
 import io.xpipe.app.util.DocumentationLink;
@@ -24,6 +25,7 @@ public class AppConfigurationDialog {
                 .sub(PersonalizationCategory.themeChoice())
                 .sub(TerminalCategory.terminalChoice(false))
                 .sub(EditorCategory.editorChoice())
+                .sub(PasswordManagerCategory.passwordManagerChoice())
                 .buildComp();
         options.style("initial-setup");
         options.style("prefs-container");
diff --git a/app/src/main/java/io/xpipe/app/core/AppDisplayScale.java b/app/src/main/java/io/xpipe/app/core/AppDisplayScale.java
index cbb7f432b..8da1fb35d 100644
--- a/app/src/main/java/io/xpipe/app/core/AppDisplayScale.java
+++ b/app/src/main/java/io/xpipe/app/core/AppDisplayScale.java
@@ -8,6 +8,7 @@ import javafx.stage.Screen;
 public class AppDisplayScale {
 
     private static Double screenOutputScale;
+    private static Boolean defaultDisplayScale;
 
     public static void init() {
         try {
@@ -15,13 +16,23 @@ public class AppDisplayScale {
             if (primary != null) {
                 screenOutputScale = primary.getOutputScaleX();
             }
+
+            var s = AppPrefs.get().uiScale().getValue();
+            if (s != null && s == 100) {
+                defaultDisplayScale = true;
+            }
+
+            var allScreensDefault = Screen.getScreens().stream().allMatch(screen -> screen.getOutputScaleX() == 1.0);
+            if (allScreensDefault) {
+                defaultDisplayScale = true;
+            }
         } catch (Exception e) {
             ErrorEventFactory.fromThrowable(e).omit().expected().handle();
         }
     }
 
-    public static boolean hasDefaultDisplayScale() {
-        return getEffectiveDisplayScale() == 1.0;
+    public static boolean hasOnlyDefaultDisplayScale() {
+        return defaultDisplayScale != null ? defaultDisplayScale : false;
     }
 
     public static double getEffectiveDisplayScale() {
diff --git a/app/src/main/java/io/xpipe/app/core/AppFontSizes.java b/app/src/main/java/io/xpipe/app/core/AppFontSizes.java
index 5206b3b60..3cb7b6af7 100644
--- a/app/src/main/java/io/xpipe/app/core/AppFontSizes.java
+++ b/app/src/main/java/io/xpipe/app/core/AppFontSizes.java
@@ -8,6 +8,7 @@ import javafx.scene.Node;
 import lombok.AllArgsConstructor;
 import lombok.Value;
 
+import java.lang.ref.WeakReference;
 import java.util.function.Function;
 import java.util.regex.Pattern;
 
@@ -75,16 +76,21 @@ public class AppFontSizes {
             return;
         }
 
+        var ref = new WeakReference<>(node);
         AppPrefs.get().theme().subscribe((newValue) -> {
-            var effective = newValue != null ? newValue.getFontSizes().get() : getDefault();
-            setFont(node, function.apply(effective));
+            var refNode = ref.get();
+            if (refNode != null) {
+                var effective = newValue != null ? newValue.getFontSizes().get() : getDefault();
+                setFont(refNode, function.apply(effective));
+            }
         });
 
         AppPrefs.get().useSystemFont().addListener((ignored, ignored2, newValue) -> {
-            var effective = AppPrefs.get().theme().getValue() != null
-                    ? AppPrefs.get().theme().getValue().getFontSizes().get()
-                    : getDefault();
-            setFont(node, function.apply(effective));
+            var refNode = ref.get();
+            if (refNode != null) {
+                var effective = AppPrefs.get().theme().getValue() != null ? AppPrefs.get().theme().getValue().getFontSizes().get() : getDefault();
+                setFont(refNode, function.apply(effective));
+            }
         });
     }
 
diff --git a/app/src/main/java/io/xpipe/app/core/AppImages.java b/app/src/main/java/io/xpipe/app/core/AppImages.java
index ba10e3324..6e391ba80 100644
--- a/app/src/main/java/io/xpipe/app/core/AppImages.java
+++ b/app/src/main/java/io/xpipe/app/core/AppImages.java
@@ -44,7 +44,7 @@ public class AppImages {
                     return;
                 }
 
-                var skipLarge = AppDisplayScale.hasDefaultDisplayScale();
+                var skipLarge = AppDisplayScale.hasOnlyDefaultDisplayScale();
                 Files.walkFileTree(basePath, new SimpleFileVisitor<>() {
                     @Override
                     public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) {
@@ -63,7 +63,7 @@ public class AppImages {
 
     private static void loadOsIcons() {
         AppResources.with(AppResources.MAIN_MODULE, "os", basePath -> {
-            var skipLarge = AppDisplayScale.hasDefaultDisplayScale();
+            var skipLarge = AppDisplayScale.hasOnlyDefaultDisplayScale();
             Files.walkFileTree(basePath, new SimpleFileVisitor<>() {
                 @Override
                 public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) {
@@ -81,7 +81,7 @@ public class AppImages {
 
     private static void loadWelcomeImages() {
         AppResources.with(AppResources.MAIN_MODULE, "welcome", basePath -> {
-            var skipLarge = AppDisplayScale.hasDefaultDisplayScale();
+            var skipLarge = AppDisplayScale.hasOnlyDefaultDisplayScale();
             Files.walkFileTree(basePath, new SimpleFileVisitor<>() {
                 @Override
                 public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) {
diff --git a/app/src/main/java/io/xpipe/app/core/AppLayoutModel.java b/app/src/main/java/io/xpipe/app/core/AppLayoutModel.java
index a360a0bfb..06e0915c5 100644
--- a/app/src/main/java/io/xpipe/app/core/AppLayoutModel.java
+++ b/app/src/main/java/io/xpipe/app/core/AppLayoutModel.java
@@ -7,6 +7,7 @@ import io.xpipe.app.hub.comp.StoreLayoutComp;
 import io.xpipe.app.platform.LabelGraphic;
 import io.xpipe.app.platform.PlatformThread;
 import io.xpipe.app.prefs.AppPrefsComp;
+import io.xpipe.app.terminal.TerminalDockHubManager;
 import io.xpipe.app.update.AppDistributionType;
 import io.xpipe.app.util.*;
 
@@ -117,7 +118,9 @@ public class AppLayoutModel {
                         AppI18n.observable("connections"),
                         new LabelGraphic.IconGraphic("mdi2c-connection"),
                         new StoreLayoutComp(),
-                        null,
+                        () -> {
+                            TerminalDockHubManager.get().hideDock();
+                        },
                         new KeyCodeCombination(KeyCode.DIGIT1, KeyCombination.SHORTCUT_DOWN)),
                 new Entry(
                         AppI18n.observable("browser"),
diff --git a/app/src/main/java/io/xpipe/app/core/AppSystemInfo.java b/app/src/main/java/io/xpipe/app/core/AppSystemInfo.java
index 72b1d9d8c..ace49c39e 100644
--- a/app/src/main/java/io/xpipe/app/core/AppSystemInfo.java
+++ b/app/src/main/java/io/xpipe/app/core/AppSystemInfo.java
@@ -260,6 +260,7 @@ public abstract class AppSystemInfo {
 
         private Path downloads;
         private Path desktop;
+        private Path config;
         private Boolean vm;
 
         public boolean isDebianBased() {
@@ -356,6 +357,20 @@ public abstract class AppSystemInfo {
             return (desktop = fallback);
         }
 
+        public Path getConfigDir() {
+            if (config != null) {
+                return config;
+            }
+
+            if (System.getenv("XDG_CONFIG_HOME") != null) {
+                return (config = Path.of(System.getenv("XDG_CONFIG_HOME")));
+            } else {
+                return (config = AppSystemInfo.ofLinux()
+                        .getUserHome()
+                        .resolve(".config"));
+            }
+        }
+
         @Override
         public Path getTemp() {
             return Path.of(System.getProperty("java.io.tmpdir"));
diff --git a/app/src/main/java/io/xpipe/app/core/AppTheme.java b/app/src/main/java/io/xpipe/app/core/AppTheme.java
index 12cf48cf9..24d75dece 100644
--- a/app/src/main/java/io/xpipe/app/core/AppTheme.java
+++ b/app/src/main/java/io/xpipe/app/core/AppTheme.java
@@ -251,41 +251,8 @@ public class AppTheme {
 
             TrackEvent.debug("Setting theme " + newTheme.getId() + " for scene");
 
-            // Don't animate transition in performance mode
-            if (AppPrefs.get() == null || AppPrefs.get().performanceMode().get()) {
-                newTheme.apply();
-                return;
-            }
-
-            var stage = window.getStage();
-            var scene = stage.getScene();
-            Pane root = (Pane) scene.getRoot();
-            Image snapshot = null;
-            try {
-                scene.snapshot(null);
-            } catch (Exception ex) {
-                // This can fail if there is no window / screen I guess?
-                ErrorEventFactory.fromThrowable(ex).expected().omit().handle();
-                return;
-            }
-            ImageView imageView = new ImageView(snapshot);
-            root.getChildren().add(imageView);
+            // Don't animate anything for performance reasons
             newTheme.apply();
-
-            Platform.runLater(() -> {
-                // Animate!
-                var transition = new Timeline(
-                        new KeyFrame(
-                                Duration.millis(0),
-                                new KeyValue(imageView.opacityProperty(), 1, Interpolator.EASE_OUT)),
-                        new KeyFrame(
-                                Duration.millis(600),
-                                new KeyValue(imageView.opacityProperty(), 0, Interpolator.EASE_OUT)));
-                transition.setOnFinished(e -> {
-                    root.getChildren().remove(imageView);
-                });
-                transition.play();
-            });
         });
     }
 
diff --git a/app/src/main/java/io/xpipe/app/core/mode/AppBaseMode.java b/app/src/main/java/io/xpipe/app/core/mode/AppBaseMode.java
index e1fbf2245..56dc2e6c8 100644
--- a/app/src/main/java/io/xpipe/app/core/mode/AppBaseMode.java
+++ b/app/src/main/java/io/xpipe/app/core/mode/AppBaseMode.java
@@ -16,6 +16,7 @@ import io.xpipe.app.core.window.AppWindowTitle;
 import io.xpipe.app.ext.DataStoreProviders;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.ext.StartOnInitStore;
+import io.xpipe.app.hub.comp.StoreQuickConnect;
 import io.xpipe.app.hub.comp.StoreViewState;
 import io.xpipe.app.icon.SystemIconManager;
 import io.xpipe.app.issue.TrackEvent;
@@ -130,6 +131,7 @@ public class AppBaseMode extends AppOperationMode {
                     AppMcpServer.init();
                     iconsInit.await();
                     StoreViewState.init();
+                    StoreQuickConnect.init();
                     AppMainWindow.loadingText("loadingSettings");
                     TrackEvent.info("Connection storage initialization thread completed");
                 },
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/CustomAgentStrategy.java b/app/src/main/java/io/xpipe/app/cred/CustomAgentStrategy.java
similarity index 66%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/CustomAgentStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/CustomAgentStrategy.java
index 9e01db070..4b0940011 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/CustomAgentStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/CustomAgentStrategy.java
@@ -1,18 +1,19 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.comp.base.ButtonComp;
 import io.xpipe.app.comp.base.HorizontalComp;
 import io.xpipe.app.comp.base.TextFieldComp;
 import io.xpipe.app.core.AppI18n;
-import io.xpipe.app.platform.BindingsHelper;
 import io.xpipe.app.platform.OptionsBuilder;
 import io.xpipe.app.platform.Validator;
 import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.ShellControl;
+import io.xpipe.core.FilePath;
 import io.xpipe.core.KeyValue;
 import io.xpipe.core.OsType;
 
+import javafx.beans.binding.Bindings;
 import javafx.beans.property.Property;
 import javafx.beans.property.SimpleBooleanProperty;
 import javafx.beans.property.SimpleStringProperty;
@@ -31,7 +32,7 @@ import java.util.List;
 @Value
 @Jacksonized
 @Builder
-public class CustomAgentStrategy implements SshIdentityStrategy {
+public class CustomAgentStrategy implements SshIdentityAgentStrategy {
 
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(
@@ -41,10 +42,13 @@ public class CustomAgentStrategy implements SshIdentityStrategy {
         var publicKey =
                 new SimpleStringProperty(p.getValue() != null ? p.getValue().getPublicKey() : null);
 
-        var socket = AppPrefs.get().sshAgentSocket();
-        var socketBinding = BindingsHelper.map(socket, s -> {
-            return s != null ? s.toString() : AppI18n.get("agentSocketNotConfigured");
-        });
+        var socketBinding = Bindings.createObjectBinding(() -> {
+            var agent = AppPrefs.get().sshAgentSocket().getValue();
+            if (agent == null) {
+                agent = AppPrefs.get().defaultSshAgentSocket().getValue();
+            }
+            return agent != null ? agent.toString() : AppI18n.get("agentSocketNotConfigured");
+        }, AppPrefs.get().defaultSshAgentSocket(), AppPrefs.get().sshAgentSocket());
         var socketProp = new SimpleStringProperty();
         socketProp.bind(socketBinding);
         var socketDisplay = new HorizontalComp(List.of(
@@ -62,21 +66,22 @@ public class CustomAgentStrategy implements SshIdentityStrategy {
                 .addComp(socketDisplay)
                 .check(val -> Validator.create(
                         val,
-                        AppI18n.observable("agentSocketNotConfigured"),
-                        AppPrefs.get().sshAgentSocket(),
+                        AppI18n.observable("agentSocketNotConfigured"), Bindings.createObjectBinding(() -> {
+                            var agent = AppPrefs.get().sshAgentSocket().getValue();
+                            if (agent == null) {
+                                agent = AppPrefs.get().defaultSshAgentSocket().getValue();
+                            }
+                            return agent;
+                        }, AppPrefs.get().sshAgentSocket(), AppPrefs.get().defaultSshAgentSocket()),
                         i -> {
                             return i != null;
                         }))
+                .nameAndDescription("publicKey")
+                .addComp(new SshAgentKeyListComp(config.getFileSystem(), p, publicKey, false), publicKey)
                 .nameAndDescription("forwardAgent")
                 .addToggle(forward)
                 .nonNull()
                 .hide(!config.isAllowAgentForward())
-                .nameAndDescription("publicKey")
-                .addComp(
-                        new TextFieldComp(publicKey)
-                                .apply(struc -> struc.setPromptText(
-                                        "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP...== Your Comment")),
-                        publicKey)
                 .bind(
                         () -> {
                             return new CustomAgentStrategy(forward.get(), publicKey.get());
@@ -90,29 +95,37 @@ public class CustomAgentStrategy implements SshIdentityStrategy {
     @Override
     public void prepareParent(ShellControl parent) throws Exception {
         if (parent.isLocal()) {
+            var agent = AppPrefs.get().sshAgentSocket().getValue();
+            if (agent == null) {
+                agent = AppPrefs.get().defaultSshAgentSocket().getValue();
+            }
             SshIdentityStateManager.prepareLocalCustomAgent(
-                    parent, AppPrefs.get().sshAgentSocket().getValue());
+                    parent, agent);
         }
     }
 
     @Override
-    public void buildCommand(CommandBuilder builder) {}
-
-    private String getIdentityAgent(ShellControl sc) throws Exception {
+    public FilePath determinetAgentSocketLocation(ShellControl sc) throws Exception {
         if (!sc.isLocal() || sc.getOsType() == OsType.WINDOWS) {
             return null;
         }
 
         if (AppPrefs.get() != null) {
-            var socket = AppPrefs.get().sshAgentSocket().getValue();
-            if (socket != null) {
-                return socket.resolveTildeHome(sc.view().userHome()).toString();
+            var agent = AppPrefs.get().sshAgentSocket().getValue();
+            if (agent == null) {
+                agent = AppPrefs.get().defaultSshAgentSocket().getValue();
+            }
+            if (agent != null) {
+                return agent.resolveTildeHome(sc.view().userHome());
             }
         }
 
         return null;
     }
 
+    @Override
+    public void buildCommand(CommandBuilder builder) {}
+
     @Override
     public List<KeyValue> configOptions(ShellControl sc) throws Exception {
         var file = SshIdentityStrategy.getPublicKeyPath(sc, publicKey);
@@ -122,11 +135,15 @@ public class CustomAgentStrategy implements SshIdentityStrategy {
                 new KeyValue("IdentityFile", file.isPresent() ? file.get().toString() : "none"),
                 new KeyValue("PKCS11Provider", "none")));
 
-        var agent = getIdentityAgent(sc);
+        var agent = determinetAgentSocketLocation(sc);
         if (agent != null) {
             l.add(new KeyValue("IdentityAgent", "\"" + agent + "\""));
         }
 
         return l;
     }
+
+    public PublicKeyStrategy getPublicKeyStrategy() {
+        return PublicKeyStrategy.Fixed.of(publicKey);
+    }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/CustomPkcs11LibraryStrategy.java b/app/src/main/java/io/xpipe/app/cred/CustomPkcs11LibraryStrategy.java
similarity index 97%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/CustomPkcs11LibraryStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/CustomPkcs11LibraryStrategy.java
index b60d78e19..d51faa689 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/CustomPkcs11LibraryStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/CustomPkcs11LibraryStrategy.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.comp.base.ContextualFileReferenceChoiceComp;
 import io.xpipe.app.ext.ValidationException;
@@ -116,8 +116,7 @@ public class CustomPkcs11LibraryStrategy implements SshIdentityStrategy {
                 new KeyValue("IdentityAgent", "none"));
     }
 
-    @Override
-    public String getPublicKey() {
+    public PublicKeyStrategy getPublicKeyStrategy() {
         return null;
     }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/GpgAgentStrategy.java b/app/src/main/java/io/xpipe/app/cred/GpgAgentStrategy.java
similarity index 85%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/GpgAgentStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/GpgAgentStrategy.java
index e5d4b437e..59b797ede 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/GpgAgentStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/GpgAgentStrategy.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.comp.base.TextFieldComp;
 import io.xpipe.app.core.AppSystemInfo;
@@ -7,6 +7,7 @@ import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.LocalShell;
 import io.xpipe.app.process.ShellControl;
 import io.xpipe.app.util.LicenseProvider;
+import io.xpipe.core.FilePath;
 import io.xpipe.core.KeyValue;
 import io.xpipe.core.OsType;
 
@@ -27,7 +28,7 @@ import java.util.List;
 @Jacksonized
 @Builder
 @JsonTypeName("gpgAgent")
-public class GpgAgentStrategy implements SshIdentityStrategy {
+public class GpgAgentStrategy implements SshIdentityAgentStrategy {
 
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(Property<GpgAgentStrategy> p, SshIdentityStrategyChoiceConfig config) {
@@ -36,11 +37,11 @@ public class GpgAgentStrategy implements SshIdentityStrategy {
         var publicKey =
                 new SimpleStringProperty(p.getValue() != null ? p.getValue().getPublicKey() : null);
         return new OptionsBuilder()
+                .nameAndDescription("publicKey")
+                .addComp(new SshAgentKeyListComp(config.getFileSystem(), p, publicKey, false), publicKey)
                 .nameAndDescription("forwardAgent")
                 .addToggle(forward)
                 .nonNull()
-                .hide(!config.isAllowAgentForward())
-                .nameAndDescription("publicKey")
                 .addComp(
                         new TextFieldComp(publicKey)
                                 .apply(struc -> struc.setPromptText(
@@ -60,18 +61,6 @@ public class GpgAgentStrategy implements SshIdentityStrategy {
             return supported;
         }
 
-        try {
-            var found = LocalShell.getShell()
-                    .view()
-                    .findProgram("gpg-connect-agent")
-                    .isPresent();
-            if (!found) {
-                return (supported = false);
-            }
-        } catch (Exception ex) {
-            return (supported = false);
-        }
-
         if (OsType.ofLocal() == OsType.WINDOWS) {
             var file = AppSystemInfo.ofWindows().getRoamingAppData().resolve("gnupg", "gpg-agent.conf");
             return (supported = Files.exists(file));
@@ -93,9 +82,7 @@ public class GpgAgentStrategy implements SshIdentityStrategy {
     }
 
     @Override
-    public void buildCommand(CommandBuilder builder) {}
-
-    private String getIdentityAgent(ShellControl sc) throws Exception {
+    public FilePath determinetAgentSocketLocation(ShellControl sc) throws Exception {
         if (sc.getOsType() == OsType.WINDOWS) {
             return null;
         }
@@ -105,9 +92,12 @@ public class GpgAgentStrategy implements SshIdentityStrategy {
             return null;
         }
 
-        return r;
+        return FilePath.of(r);
     }
 
+    @Override
+    public void buildCommand(CommandBuilder builder) {}
+
     @Override
     public List<KeyValue> configOptions(ShellControl sc) throws Exception {
         var file = SshIdentityStrategy.getPublicKeyPath(sc, publicKey);
@@ -117,11 +107,15 @@ public class GpgAgentStrategy implements SshIdentityStrategy {
                 new KeyValue("IdentityFile", file.isPresent() ? file.get().toString() : "none"),
                 new KeyValue("PKCS11Provider", "none")));
 
-        var agent = getIdentityAgent(sc);
+        var agent = determinetAgentSocketLocation(sc);
         if (agent != null) {
             l.add(new KeyValue("IdentityAgent", "\"" + agent + "\""));
         }
 
         return l;
     }
+
+    public PublicKeyStrategy getPublicKeyStrategy() {
+        return PublicKeyStrategy.Fixed.of(publicKey);
+    }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/InPlaceKeyStrategy.java b/app/src/main/java/io/xpipe/app/cred/InPlaceKeyStrategy.java
similarity index 98%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/InPlaceKeyStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/InPlaceKeyStrategy.java
index e69566632..383dce771 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/InPlaceKeyStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/InPlaceKeyStrategy.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.comp.base.ButtonComp;
 import io.xpipe.app.comp.base.InputGroupComp;
@@ -184,4 +184,8 @@ public class InPlaceKeyStrategy implements SshIdentityStrategy {
                         + Math.abs(Objects.hash(this, AppSystemInfo.ofCurrent().getUser())) + ".key");
         return temp;
     }
+
+    public PublicKeyStrategy getPublicKeyStrategy() {
+        return PublicKeyStrategy.Fixed.of(publicKey);
+    }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/KeyFileStrategy.java b/app/src/main/java/io/xpipe/app/cred/KeyFileStrategy.java
similarity index 98%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/KeyFileStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/KeyFileStrategy.java
index fc695f6a2..264cfa899 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/KeyFileStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/KeyFileStrategy.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.comp.base.*;
 import io.xpipe.app.core.AppI18n;
@@ -268,4 +268,8 @@ public class KeyFileStrategy implements SshIdentityStrategy {
         }
         return s;
     }
+
+    public PublicKeyStrategy getPublicKeyStrategy() {
+        return PublicKeyStrategy.Fixed.of(publicKey);
+    }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/NoIdentityStrategy.java b/app/src/main/java/io/xpipe/app/cred/NoIdentityStrategy.java
similarity index 92%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/NoIdentityStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/NoIdentityStrategy.java
index 2a34bc0f6..b856912c8 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/NoIdentityStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/NoIdentityStrategy.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.ShellControl;
@@ -30,7 +30,7 @@ public class NoIdentityStrategy implements SshIdentityStrategy {
     }
 
     @Override
-    public String getPublicKey() {
+    public PublicKeyStrategy getPublicKeyStrategy() {
         return null;
     }
 
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/OpenSshAgentStrategy.java b/app/src/main/java/io/xpipe/app/cred/OpenSshAgentStrategy.java
similarity index 84%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/OpenSshAgentStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/OpenSshAgentStrategy.java
index 5e4b9e973..8ae6d2cdd 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/OpenSshAgentStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/OpenSshAgentStrategy.java
@@ -1,11 +1,11 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
-import io.xpipe.app.comp.base.TextFieldComp;
 import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.platform.OptionsBuilder;
 import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.ShellControl;
+import io.xpipe.core.FilePath;
 import io.xpipe.core.KeyValue;
 import io.xpipe.core.OsType;
 
@@ -25,7 +25,7 @@ import java.util.List;
 @Value
 @Jacksonized
 @Builder
-public class OpenSshAgentStrategy implements SshIdentityStrategy {
+public class OpenSshAgentStrategy implements SshIdentityAgentStrategy {
 
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(
@@ -39,16 +39,12 @@ public class OpenSshAgentStrategy implements SshIdentityStrategy {
                 .nameAndDescription("agentSocket")
                 .addStaticString(socket != null ? socket : AppI18n.get("agentSocketNotFound"))
                 .hide(OsType.ofLocal() == OsType.WINDOWS)
+                .nameAndDescription("publicKey")
+                .addComp(new SshAgentKeyListComp(config.getFileSystem(), p, publicKey, false), publicKey)
                 .nameAndDescription("forwardAgent")
                 .addToggle(forward)
                 .nonNull()
                 .hide(!config.isAllowAgentForward())
-                .nameAndDescription("publicKey")
-                .addComp(
-                        new TextFieldComp(publicKey)
-                                .apply(struc -> struc.setPromptText(
-                                        "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP...== Your Comment")),
-                        publicKey)
                 .bind(
                         () -> {
                             return new OpenSshAgentStrategy(forward.get(), publicKey.get());
@@ -68,9 +64,7 @@ public class OpenSshAgentStrategy implements SshIdentityStrategy {
     }
 
     @Override
-    public void buildCommand(CommandBuilder builder) {}
-
-    private String getIdentityAgent(ShellControl sc) throws Exception {
+    public FilePath determinetAgentSocketLocation(ShellControl sc) throws Exception {
         if (sc.getOsType() == OsType.WINDOWS) {
             return null;
         }
@@ -78,13 +72,16 @@ public class OpenSshAgentStrategy implements SshIdentityStrategy {
         if (AppPrefs.get() != null) {
             var socket = AppPrefs.get().defaultSshAgentSocket().getValue();
             if (socket != null) {
-                return socket.resolveTildeHome(sc.view().userHome()).toString();
+                return socket.resolveTildeHome(sc.view().userHome());
             }
         }
 
         return null;
     }
 
+    @Override
+    public void buildCommand(CommandBuilder builder) {}
+
     @Override
     public List<KeyValue> configOptions(ShellControl sc) throws Exception {
         var file = SshIdentityStrategy.getPublicKeyPath(sc, publicKey);
@@ -94,11 +91,15 @@ public class OpenSshAgentStrategy implements SshIdentityStrategy {
                 new KeyValue("IdentityFile", file.isPresent() ? file.get().toString() : "none"),
                 new KeyValue("PKCS11Provider", "none")));
 
-        var agent = getIdentityAgent(sc);
+        var agent = determinetAgentSocketLocation(sc);
         if (agent != null) {
             l.add(new KeyValue("IdentityAgent", "\"" + agent + "\""));
         }
 
         return l;
     }
+
+    public PublicKeyStrategy getPublicKeyStrategy() {
+        return PublicKeyStrategy.Fixed.of(publicKey);
+    }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/OtherExternalAgentStrategy.java b/app/src/main/java/io/xpipe/app/cred/OtherExternalAgentStrategy.java
similarity index 78%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/OtherExternalAgentStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/OtherExternalAgentStrategy.java
index 8d2dff75e..a8b3203bc 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/OtherExternalAgentStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/OtherExternalAgentStrategy.java
@@ -1,9 +1,9 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
-import io.xpipe.app.comp.base.TextFieldComp;
 import io.xpipe.app.platform.OptionsBuilder;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.ShellControl;
+import io.xpipe.core.FilePath;
 import io.xpipe.core.KeyValue;
 
 import javafx.beans.property.Property;
@@ -21,7 +21,7 @@ import java.util.List;
 @Value
 @Jacksonized
 @Builder
-public class OtherExternalAgentStrategy implements SshIdentityStrategy {
+public class OtherExternalAgentStrategy implements SshIdentityAgentStrategy {
 
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(
@@ -31,16 +31,13 @@ public class OtherExternalAgentStrategy implements SshIdentityStrategy {
         var publicKey =
                 new SimpleStringProperty(p.getValue() != null ? p.getValue().getPublicKey() : null);
         return new OptionsBuilder()
+                .nameAndDescription("publicKey")
+                .addComp(new SshAgentKeyListComp(config.getFileSystem(), p, publicKey, false), publicKey)
                 .nameAndDescription("forwardAgent")
                 .addToggle(forward)
                 .nonNull()
                 .hide(!config.isAllowAgentForward())
                 .nameAndDescription("publicKey")
-                .addComp(
-                        new TextFieldComp(publicKey)
-                                .apply(struc -> struc.setPromptText(
-                                        "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP...== Your Comment")),
-                        publicKey)
                 .bind(
                         () -> {
                             return new OtherExternalAgentStrategy(forward.get(), publicKey.get());
@@ -54,10 +51,15 @@ public class OtherExternalAgentStrategy implements SshIdentityStrategy {
     @Override
     public void prepareParent(ShellControl parent) throws Exception {
         if (parent.isLocal()) {
-            SshIdentityStateManager.prepareLocalExternalAgent();
+            SshIdentityStateManager.prepareLocalExternalAgent(null);
         }
     }
 
+    @Override
+    public FilePath determinetAgentSocketLocation(ShellControl parent) throws Exception {
+        return null;
+    }
+
     @Override
     public void buildCommand(CommandBuilder builder) {}
 
@@ -70,4 +72,8 @@ public class OtherExternalAgentStrategy implements SshIdentityStrategy {
                 new KeyValue("IdentityFile", file.isPresent() ? file.get().toString() : "none"),
                 new KeyValue("PKCS11Provider", "none"));
     }
+
+    public PublicKeyStrategy getPublicKeyStrategy() {
+        return PublicKeyStrategy.Fixed.of(publicKey);
+    }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/PageantStrategy.java b/app/src/main/java/io/xpipe/app/cred/PageantStrategy.java
similarity index 84%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/PageantStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/PageantStrategy.java
index 100cc841c..5135e0e51 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/PageantStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/PageantStrategy.java
@@ -1,6 +1,5 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
-import io.xpipe.app.comp.base.TextFieldComp;
 import io.xpipe.app.core.AppSystemInfo;
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.platform.OptionsBuilder;
@@ -8,6 +7,8 @@ import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.LocalShell;
 import io.xpipe.app.process.ShellControl;
+import io.xpipe.app.util.LocalExec;
+import io.xpipe.core.FilePath;
 import io.xpipe.core.KeyValue;
 import io.xpipe.core.OsType;
 
@@ -30,7 +31,7 @@ import java.util.List;
 @Value
 @Jacksonized
 @Builder
-public class PageantStrategy implements SshIdentityStrategy {
+public class PageantStrategy implements SshIdentityAgentStrategy {
 
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(Property<PageantStrategy> p, SshIdentityStrategyChoiceConfig config) {
@@ -39,16 +40,12 @@ public class PageantStrategy implements SshIdentityStrategy {
         var publicKey =
                 new SimpleStringProperty(p.getValue() != null ? p.getValue().getPublicKey() : null);
         return new OptionsBuilder()
+                .nameAndDescription("publicKey")
+                .addComp(new SshAgentKeyListComp(config.getFileSystem(), p, publicKey, false), publicKey)
                 .nameAndDescription("forwardAgent")
                 .addToggle(forward)
                 .nonNull()
                 .hide(!config.isAllowAgentForward())
-                .nameAndDescription("publicKey")
-                .addComp(
-                        new TextFieldComp(publicKey)
-                                .apply(struc -> struc.setPromptText(
-                                        "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP...== Your Comment")),
-                        publicKey)
                 .bind(
                         () -> {
                             return new PageantStrategy(forward.get(), publicKey.get());
@@ -67,7 +64,7 @@ public class PageantStrategy implements SshIdentityStrategy {
             return true;
         } else {
             try {
-                var found = LocalShell.getShell().view().findProgram("pageant").isPresent();
+                var found = LocalExec.readStdoutIfPossible("which", "pageant").isPresent();
                 return (supported = found);
             } catch (Exception ex) {
                 return (supported = false);
@@ -92,20 +89,24 @@ public class PageantStrategy implements SshIdentityStrategy {
                 throw ErrorEventFactory.expected(new IllegalStateException(
                         "Pageant is not running as the primary agent via the $SSH_AUTH_SOCK variable."));
             }
+        } else if (parent.isLocal()) {
+            // Check if it exists
+            getPageantWindowsPipe();
         }
     }
 
     @Override
-    public void buildCommand(CommandBuilder builder) {}
-
-    private String getIdentityAgent(ShellControl sc) {
+    public FilePath determinetAgentSocketLocation(ShellControl sc) throws Exception {
         if (sc.isLocal() && sc.getOsType() == OsType.WINDOWS) {
-            return getPageantWindowsPipe();
+            return FilePath.of(getPageantWindowsPipe());
         }
 
         return null;
     }
 
+    @Override
+    public void buildCommand(CommandBuilder builder) {}
+
     @Override
     public List<KeyValue> configOptions(ShellControl sc) throws Exception {
         var file = SshIdentityStrategy.getPublicKeyPath(sc, publicKey);
@@ -115,7 +116,7 @@ public class PageantStrategy implements SshIdentityStrategy {
                 new KeyValue("IdentityFile", file.isPresent() ? file.get().toString() : "none"),
                 new KeyValue("PKCS11Provider", "none")));
 
-        var agent = getIdentityAgent(sc);
+        var agent = determinetAgentSocketLocation(sc);
         if (agent != null) {
             l.add(new KeyValue("IdentityAgent", "\"" + agent + "\""));
         }
@@ -136,4 +137,8 @@ public class PageantStrategy implements SshIdentityStrategy {
         var file = "\\\\.\\pipe\\" + fd.getFileName();
         return file;
     }
+
+    public PublicKeyStrategy getPublicKeyStrategy() {
+        return PublicKeyStrategy.Fixed.of(publicKey);
+    }
 }
diff --git a/app/src/main/java/io/xpipe/app/cred/PasswordManagerAgentStrategy.java b/app/src/main/java/io/xpipe/app/cred/PasswordManagerAgentStrategy.java
new file mode 100644
index 000000000..dd9571c9c
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/cred/PasswordManagerAgentStrategy.java
@@ -0,0 +1,156 @@
+package io.xpipe.app.cred;
+
+import com.fasterxml.jackson.annotation.JsonTypeName;
+import io.xpipe.app.comp.base.ButtonComp;
+import io.xpipe.app.comp.base.HorizontalComp;
+import io.xpipe.app.comp.base.LabelComp;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.ext.ValidationException;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.Validator;
+import io.xpipe.app.prefs.AppPrefs;
+import io.xpipe.app.process.CommandBuilder;
+import io.xpipe.app.process.ShellControl;
+import io.xpipe.app.pwman.PasswordManagerKeyConfiguration;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.util.Validators;
+import io.xpipe.core.FilePath;
+import io.xpipe.core.KeyValue;
+import javafx.beans.binding.Bindings;
+import javafx.beans.property.Property;
+import javafx.beans.property.ReadOnlyBooleanWrapper;
+import javafx.beans.property.SimpleBooleanProperty;
+import javafx.beans.property.SimpleStringProperty;
+import javafx.geometry.Insets;
+import javafx.geometry.Pos;
+import lombok.Builder;
+import lombok.Value;
+import lombok.extern.jackson.Jacksonized;
+import org.kordamp.ikonli.javafx.FontIcon;
+
+import java.util.List;
+
+@JsonTypeName("passwordManagerAgent")
+@Value
+@Jacksonized
+@Builder
+public class PasswordManagerAgentStrategy implements SshIdentityAgentStrategy {
+
+    @SuppressWarnings("unused")
+    public static OptionsBuilder createOptions(
+            Property<PasswordManagerAgentStrategy> p, SshIdentityStrategyChoiceConfig config) {
+        var identifier =
+                new SimpleStringProperty(p.getValue() != null ? p.getValue().getIdentifier() : null);
+
+        var pwmanBinding = Bindings.createObjectBinding(() -> {
+            var pwman = AppPrefs.get().passwordManager().getValue();
+            if (pwman == null) {
+                return AppI18n.get("passwordManagerEmpty");
+            }
+
+            if (!pwman.getKeyConfiguration().useAgent()) {
+                return AppI18n.get("passwordManagerNoAgentSupport");
+            }
+
+            return null;
+        }, AppPrefs.get().passwordManager(), AppI18n.activeLanguage());
+        var pwmanProp = new SimpleStringProperty();
+        pwmanProp.bind(pwmanBinding);
+        var pwmanDisplay = new HorizontalComp(List.of(
+                        new LabelComp(pwmanProp)
+                                .maxWidth(10000)
+                                .apply(label -> label.setAlignment(Pos.CENTER_LEFT))
+                                .hgrow(),
+                        new ButtonComp(null, new FontIcon("mdomz-settings"), () -> {
+                                    AppPrefs.get().selectCategory("passwordManager");
+                                })
+                                .padding(new Insets(7))))
+                .spacing(9);
+
+        return new OptionsBuilder()
+                .nameAndDescription("passwordManagerSshKeyConfig")
+                .addComp(pwmanDisplay)
+                .hide(pwmanProp.isNull())
+                .nameAndDescription(useKeyName() ? "agentKeyName" : "publicKey")
+                .addComp(new SshAgentKeyListComp(config.getFileSystem(), p, identifier, useKeyName()), identifier)
+                .nonNull()
+                .hide(!config.isAllowAgentForward())
+                .bind(
+                        () -> {
+                            return new PasswordManagerAgentStrategy(identifier.get());
+                        },
+                        p);
+    }
+
+    String identifier;
+
+    private static PasswordManagerKeyConfiguration getConfig() {
+        var pwman = AppPrefs.get().passwordManager().getValue();
+        return pwman != null && pwman.getKeyConfiguration() != null && pwman.getKeyConfiguration().useAgent() ? pwman.getKeyConfiguration() : null;
+    }
+
+    private static boolean useKeyName() {
+        var config = getConfig();
+        return config != null && config.supportsAgentKeyNames();
+    }
+
+    @Override
+    public void checkComplete() throws ValidationException {
+        Validators.nonNull(identifier);
+        var config = getConfig();
+        if (config == null) {
+            throw new ValidationException(AppI18n.get("passwordManagerSshKeysNotSupported"));
+        }
+    }
+
+    @Override
+    public void prepareParent(ShellControl parent) throws Exception {
+        var config = getConfig();
+        if (config != null) {
+            var strat = config.getSshIdentityStrategy(null, false);
+            strat.prepareParent(parent);
+        }
+    }
+
+    @Override
+    public FilePath determinetAgentSocketLocation(ShellControl parent) throws Exception {
+        var config = getConfig();
+        return config != null ? FilePath.of(config.getDefaultSocketLocation()) : null;
+    }
+
+    @Override
+    public void buildCommand(CommandBuilder builder) {
+        var config = getConfig();
+        if (config != null) {
+            var strat = config.getSshIdentityStrategy(null, false);
+            strat.buildCommand(builder);
+        }
+    }
+
+    @Override
+    public List<KeyValue> configOptions(ShellControl sc) throws Exception {
+        var config = getConfig();
+        if (config != null) {
+            var strat = config.getSshIdentityStrategy(getPublicKeyStrategy().retrievePublicKey(), false);
+            return strat.configOptions(sc);
+        } else {
+            return List.of();
+        }
+    }
+
+    @Override
+    public PublicKeyStrategy getPublicKeyStrategy() {
+        if (identifier == null) {
+            return null;
+        }
+
+        if (!useKeyName()) {
+            return PublicKeyStrategy.Fixed.of(identifier);
+        }
+
+        return new PublicKeyStrategy.Dynamic(() -> {
+            return SshAgentKeyList.findAgentIdentity(
+                    DataStorage.get().local().ref(), this, identifier).toString();
+        });
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/cred/PublicKeyStrategy.java b/app/src/main/java/io/xpipe/app/cred/PublicKeyStrategy.java
new file mode 100644
index 000000000..7cfd5922d
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/cred/PublicKeyStrategy.java
@@ -0,0 +1,78 @@
+package io.xpipe.app.cred;
+
+import io.xpipe.core.FailableSupplier;
+import lombok.EqualsAndHashCode;
+import lombok.ToString;
+
+import java.util.Optional;
+
+public interface PublicKeyStrategy {
+
+    Optional<String> getFixedPublicKey();
+
+    String retrievePublicKey() throws Exception;
+
+    @EqualsAndHashCode
+    @ToString
+    final class Fixed implements PublicKeyStrategy {
+
+        public static Fixed of(String publicKey) {
+            return publicKey != null ? new Fixed(publicKey) : null;
+        }
+
+        private final String publicKey;
+
+        public Fixed(String publicKey) {
+            this.publicKey = publicKey;
+        }
+
+        public String get() {
+            return publicKey;
+        }
+
+        @Override
+        public Optional<String> getFixedPublicKey() {
+            return Optional.ofNullable(publicKey);
+        }
+
+        @Override
+        public String retrievePublicKey() {
+            return getFixedPublicKey().orElseThrow();
+        }
+    }
+
+    final class Dynamic implements PublicKeyStrategy {
+
+        private final FailableSupplier<String> publicKey;
+
+        public Dynamic(FailableSupplier<String> publicKey) {
+            this.publicKey = publicKey;
+        }
+
+        @Override
+        public int hashCode() {
+            return getClass().hashCode();
+        }
+
+        @Override
+        public boolean equals(Object obj) {
+            return obj instanceof Dynamic;
+        }
+
+        @Override
+        public String toString() {
+            return "<dynamic>";
+        }
+
+        @Override
+        public Optional<String> getFixedPublicKey() {
+            return Optional.empty();
+        }
+
+        @Override
+        public String retrievePublicKey() throws Exception {
+            var r = publicKey.get();
+            return r;
+        }
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/cred/SshAgentKeyList.java b/app/src/main/java/io/xpipe/app/cred/SshAgentKeyList.java
new file mode 100644
index 000000000..f603b211d
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/cred/SshAgentKeyList.java
@@ -0,0 +1,73 @@
+package io.xpipe.app.cred;
+
+import io.xpipe.app.ext.ShellStore;
+import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.process.CommandBuilder;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.storage.DataStoreEntryRef;
+import lombok.Value;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+
+public class SshAgentKeyList {
+
+    @Value
+    public static class Entry {
+
+        String type;
+        String publicKey;
+        String name;
+
+        @Override
+        public String toString() {
+            return type + " " + publicKey + (name != null ? " " + name : "");
+        }
+    }
+
+    public static Entry findAgentIdentity(DataStoreEntryRef<ShellStore> ref, SshIdentityAgentStrategy strategy, String identifier) throws Exception {
+        var list = listAgentIdentities(ref, strategy).stream().filter(entry -> {
+            return (entry.getName() != null && entry.getName().equalsIgnoreCase(identifier)) || entry.getPublicKey().equalsIgnoreCase(identifier);
+        }).toList();
+
+        if (list.isEmpty()) {
+            throw ErrorEventFactory.expected(new IllegalArgumentException("No such agent identity: " + identifier));
+        }
+
+        if (list.size() > 1) {
+            throw ErrorEventFactory.expected(new IllegalArgumentException("Ambiguous agent identities: " + list.stream()
+                    .map(entry -> entry.getName() != null ? entry.getName() : entry.getPublicKey())
+                    .collect(Collectors.joining(", "))));
+        }
+
+        return list.getFirst();
+    }
+
+    public static List<Entry> listAgentIdentities(DataStoreEntryRef<ShellStore> ref, SshIdentityAgentStrategy strategy) throws Exception {
+        var session = ref.getStore().getOrStartSession();
+        strategy.prepareParent(session);
+
+        var socket = strategy.determinetAgentSocketLocation(session);
+        var out = session.command(CommandBuilder.of().add("ssh-add", "-L").fixedEnvironment("SSH_AUTH_SOCK", socket != null ? socket.toString() : null)).readStdoutOrThrow();
+        var pattern = Pattern.compile("([^ ]+) ([^ ]+)(?: (.+))?");
+        var lines = out.lines().toList();
+        var list = new ArrayList<Entry>();
+        for (String line : lines) {
+            var matcher = pattern.matcher(line);
+            if (!matcher.matches()) {
+                continue;
+            }
+
+            var type = matcher.group(1);
+            var publicKey = matcher.group(2);
+            var name = matcher.groupCount() > 3 ? matcher.group(3) : null;
+            list.add(new Entry(type, publicKey, name));
+        }
+        return list;
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/cred/SshAgentKeyListComp.java b/app/src/main/java/io/xpipe/app/cred/SshAgentKeyListComp.java
new file mode 100644
index 000000000..85e5249c4
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/cred/SshAgentKeyListComp.java
@@ -0,0 +1,99 @@
+package io.xpipe.app.cred;
+
+import atlantafx.base.controls.Popover;
+import atlantafx.base.theme.Styles;
+import io.xpipe.app.comp.SimpleRegionBuilder;
+import io.xpipe.app.comp.base.ButtonComp;
+import io.xpipe.app.comp.base.IconButtonComp;
+import io.xpipe.app.comp.base.InputGroupComp;
+import io.xpipe.app.comp.base.TextFieldComp;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.ext.ShellStore;
+import io.xpipe.app.platform.LabelGraphic;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.storage.DataStoreEntryRef;
+import io.xpipe.app.util.ThreadHelper;
+import javafx.application.Platform;
+import javafx.beans.property.Property;
+import javafx.beans.property.StringProperty;
+import javafx.beans.value.ObservableValue;
+import javafx.geometry.Insets;
+import javafx.geometry.Pos;
+import javafx.scene.control.Button;
+import javafx.scene.control.Label;
+import javafx.scene.layout.Region;
+import javafx.scene.layout.VBox;
+
+import java.util.List;
+
+public class SshAgentKeyListComp extends SimpleRegionBuilder {
+
+    private final ObservableValue<DataStoreEntryRef<ShellStore>> ref;
+    private final ObservableValue<? extends SshIdentityAgentStrategy> sshIdentityStrategy;
+    private final StringProperty value;
+    private final boolean useKeyNames;
+
+    public SshAgentKeyListComp(ObservableValue<DataStoreEntryRef<ShellStore>> ref, ObservableValue<? extends SshIdentityAgentStrategy> sshIdentityStrategy, StringProperty value,
+                               boolean useKeyNames
+    ) {
+        this.ref = ref;
+        this.sshIdentityStrategy = sshIdentityStrategy;
+        this.value = value;
+        this.useKeyNames = useKeyNames;
+    }
+
+    @Override
+    protected Region createSimple() {
+        var field = new TextFieldComp(value);
+        field.apply(struc -> struc.setPromptText(
+                useKeyNames ? "<name>" : "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP...== <key comment>"));
+        var button = new ButtonComp(null, new LabelGraphic.IconGraphic("mdi2m-magnify-scan"), null);
+        button.apply(struc -> {
+            struc.setOnAction(event -> {
+                DataStoreEntryRef<ShellStore> refToUse = ref.getValue() != null ? ref.getValue() : DataStorage.get().local().ref();
+                ThreadHelper.runFailableAsync(() -> {
+                    var list = SshAgentKeyList.listAgentIdentities(refToUse, sshIdentityStrategy.getValue());
+                    Platform.runLater(() -> {
+                        var popover = new Popover();
+                        popover.setArrowLocation(Popover.ArrowLocation.TOP_CENTER);
+
+                        if (list.size() > 0) {
+                            var content = new VBox();
+                            content.setPadding(new Insets(10));
+                            content.setFillWidth(true);
+                            var header = new Label(AppI18n.get("sshAgentHasKeys"));
+                            header.setPadding(new Insets(0, 0, 8, 8));
+                            content.getChildren().add(header);
+                            for (SshAgentKeyList.Entry entry : list) {
+                                var buttonName = entry.getType() + " " + (entry.getName() != null ? entry.getName() : entry.getPublicKey());
+                                var entryButton = new Button(buttonName);
+                                entryButton.setMaxWidth(400);
+                                entryButton.getStyleClass().add(Styles.FLAT);
+                                entryButton.setOnAction(e -> {
+                                    value.setValue(useKeyNames && entry.getName() != null ? entry.getName() : entry.toString());
+                                    popover.hide();
+                                    e.consume();
+                                });
+                                entryButton.setMinWidth(400);
+                                entryButton.setAlignment(Pos.CENTER_LEFT);
+                                content.getChildren().add(entryButton);
+                            }
+                            popover.setContentNode(content);
+                        } else {
+                            var content = new Label(AppI18n.get("sshAgentNoKeys"));
+                            content.setPadding(new Insets(10));
+                            popover.setContentNode(content);
+                        }
+
+                        var target = struc.getParent().getChildrenUnmodifiable().getFirst();
+                        popover.show(target);
+                    });
+                });
+                event.consume();
+            });
+        });
+        var inputGroup = new InputGroupComp(List.of(field, button));
+        inputGroup.setMainReference(field);
+        return inputGroup.build();
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/cred/SshAgentTestComp.java b/app/src/main/java/io/xpipe/app/cred/SshAgentTestComp.java
new file mode 100644
index 000000000..9137bc162
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/cred/SshAgentTestComp.java
@@ -0,0 +1,79 @@
+package io.xpipe.app.cred;
+
+import atlantafx.base.controls.Popover;
+import atlantafx.base.theme.Styles;
+import io.xpipe.app.comp.SimpleRegionBuilder;
+import io.xpipe.app.comp.base.ButtonComp;
+import io.xpipe.app.comp.base.InputGroupComp;
+import io.xpipe.app.comp.base.TextFieldComp;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.ext.ShellStore;
+import io.xpipe.app.platform.LabelGraphic;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.storage.DataStoreEntryRef;
+import io.xpipe.app.util.ThreadHelper;
+import javafx.application.Platform;
+import javafx.beans.property.StringProperty;
+import javafx.beans.value.ObservableValue;
+import javafx.geometry.Insets;
+import javafx.geometry.Pos;
+import javafx.scene.control.Button;
+import javafx.scene.control.Label;
+import javafx.scene.layout.Region;
+import javafx.scene.layout.VBox;
+import org.kordamp.ikonli.javafx.FontIcon;
+
+import java.util.List;
+
+public class SshAgentTestComp extends SimpleRegionBuilder {
+
+    private final ObservableValue<? extends SshIdentityAgentStrategy> sshIdentityStrategy;
+
+    public SshAgentTestComp(ObservableValue<? extends SshIdentityAgentStrategy> sshIdentityStrategy) {this.sshIdentityStrategy = sshIdentityStrategy;}
+
+    @Override
+    protected Region createSimple() {
+        var button = new ButtonComp(AppI18n.observable("test"), new LabelGraphic.IconGraphic("mdi2p-play"), null);
+        button.padding(new Insets(6, 9, 6, 9));
+        button.apply(struc -> {
+            struc.setOnAction(event -> {
+                DataStoreEntryRef<ShellStore> refToUse = DataStorage.get().local().ref();
+                ThreadHelper.runFailableAsync(() -> {
+                    var list = SshAgentKeyList.listAgentIdentities(refToUse, sshIdentityStrategy.getValue());
+                    Platform.runLater(() -> {
+                        var popover = new Popover();
+                        popover.setArrowLocation(Popover.ArrowLocation.LEFT_CENTER);
+
+                        if (list.size() > 0) {
+                            var content = new VBox();
+                            content.setPadding(new Insets(10));
+                            content.setFillWidth(true);
+                            var header = new Label(AppI18n.get("sshAgentHasKeys"));
+                            header.setPadding(new Insets(0, 0, 8, 8));
+                            content.getChildren().add(header);
+                            for (SshAgentKeyList.Entry entry : list) {
+                                var buttonName = entry.getType() + " " + (entry.getName() != null ? entry.getName() : entry.getPublicKey());
+                                var entryButton = new Button(buttonName);
+                                entryButton.setMaxWidth(400);
+                                entryButton.getStyleClass().add(Styles.FLAT);
+                                entryButton.setMinWidth(400);
+                                entryButton.setAlignment(Pos.CENTER_LEFT);
+                                content.getChildren().add(entryButton);
+                            }
+                            popover.setContentNode(content);
+                        } else {
+                            var content = new Label(AppI18n.get("sshAgentNoKeys"));
+                            content.setPadding(new Insets(10));
+                            popover.setContentNode(content);
+                        }
+
+                        var target = struc;
+                        popover.show(target);
+                    });
+                });
+                event.consume();
+            });
+        });
+        return button.build();
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/cred/SshIdentityAgentStrategy.java b/app/src/main/java/io/xpipe/app/cred/SshIdentityAgentStrategy.java
new file mode 100644
index 000000000..7aa992736
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/cred/SshIdentityAgentStrategy.java
@@ -0,0 +1,24 @@
+package io.xpipe.app.cred;
+
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import io.xpipe.app.ext.ValidationException;
+import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.process.CommandBuilder;
+import io.xpipe.app.process.OsFileSystem;
+import io.xpipe.app.process.ShellControl;
+import io.xpipe.app.secret.SecretNoneStrategy;
+import io.xpipe.app.secret.SecretRetrievalStrategy;
+import io.xpipe.core.FilePath;
+import io.xpipe.core.KeyValue;
+import io.xpipe.core.OsType;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+
+public interface SshIdentityAgentStrategy extends SshIdentityStrategy {
+
+    void prepareParent(ShellControl parent) throws Exception;
+
+    FilePath determinetAgentSocketLocation(ShellControl parent) throws Exception;
+}
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStateManager.java b/app/src/main/java/io/xpipe/app/cred/SshIdentityStateManager.java
similarity index 96%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStateManager.java
rename to app/src/main/java/io/xpipe/app/cred/SshIdentityStateManager.java
index 029372c36..4b09a4ec3 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStateManager.java
+++ b/app/src/main/java/io/xpipe/app/cred/SshIdentityStateManager.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.issue.ErrorAction;
 import io.xpipe.app.issue.ErrorEvent;
@@ -136,7 +136,7 @@ public class SshIdentityStateManager {
         }
     }
 
-    public static synchronized void prepareLocalExternalAgent() throws Exception {
+    public static synchronized void prepareLocalExternalAgent(FilePath socket) throws Exception {
         if (runningAgent == RunningAgent.EXTERNAL_AGENT) {
             return;
         }
@@ -149,12 +149,12 @@ public class SshIdentityStateManager {
             if (!pipeExists) {
                 // No agent is running
                 throw ErrorEventFactory.expected(new IllegalStateException(
-                        "An external password manager agent is set for this connection, but no external SSH agent is running. Make sure that the "
-                                + "agent is started in your password manager"));
+                        "An external agent is configured, but no external SSH agent is running. Make sure that the external "
+                                + "agent is started"));
             }
         }
 
-        checkLocalAgentIdentities(null);
+        checkLocalAgentIdentities(socket != null ? socket.toString() : null);
 
         runningAgent = RunningAgent.EXTERNAL_AGENT;
     }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStrategy.java b/app/src/main/java/io/xpipe/app/cred/SshIdentityStrategy.java
similarity index 77%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/SshIdentityStrategy.java
index 90daccb1a..d9c51256b 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/SshIdentityStrategy.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.ext.ValidationException;
 import io.xpipe.app.issue.ErrorEventFactory;
@@ -11,7 +11,6 @@ import io.xpipe.core.FilePath;
 import io.xpipe.core.KeyValue;
 import io.xpipe.core.OsType;
 
-import com.fasterxml.jackson.annotation.JsonSubTypes;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
 
 import java.util.ArrayList;
@@ -19,26 +18,15 @@ import java.util.List;
 import java.util.Optional;
 
 @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "type")
-@JsonSubTypes({
-    @JsonSubTypes.Type(value = NoIdentityStrategy.class),
-    @JsonSubTypes.Type(value = KeyFileStrategy.class),
-    @JsonSubTypes.Type(value = InPlaceKeyStrategy.class),
-    @JsonSubTypes.Type(value = OpenSshAgentStrategy.class),
-    @JsonSubTypes.Type(value = PageantStrategy.class),
-    @JsonSubTypes.Type(value = CustomAgentStrategy.class),
-    @JsonSubTypes.Type(value = GpgAgentStrategy.class),
-    @JsonSubTypes.Type(value = YubikeyPivStrategy.class),
-    @JsonSubTypes.Type(value = CustomPkcs11LibraryStrategy.class),
-    @JsonSubTypes.Type(value = OtherExternalAgentStrategy.class)
-})
 public interface SshIdentityStrategy {
 
-    static List<Class<?>> getSubclasses() {
+    static List<Class<?>> getClasses() {
         var l = new ArrayList<Class<?>>();
         l.add(NoIdentityStrategy.class);
         l.add(InPlaceKeyStrategy.class);
         l.add(KeyFileStrategy.class);
         l.add(OpenSshAgentStrategy.class);
+        l.add(PasswordManagerAgentStrategy.class);
         if (OsType.ofLocal() != OsType.WINDOWS) {
             l.add(CustomAgentStrategy.class);
         }
@@ -97,5 +85,5 @@ public interface SshIdentityStrategy {
         return new SecretNoneStrategy();
     }
 
-    String getPublicKey();
+    PublicKeyStrategy getPublicKeyStrategy();
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStrategyChoiceConfig.java b/app/src/main/java/io/xpipe/app/cred/SshIdentityStrategyChoiceConfig.java
similarity index 91%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStrategyChoiceConfig.java
rename to app/src/main/java/io/xpipe/app/cred/SshIdentityStrategyChoiceConfig.java
index ae8f74f1f..dead1746e 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/SshIdentityStrategyChoiceConfig.java
+++ b/app/src/main/java/io/xpipe/app/cred/SshIdentityStrategyChoiceConfig.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.ext.ShellStore;
 import io.xpipe.app.storage.DataStoreEntryRef;
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/UsernameStrategy.java b/app/src/main/java/io/xpipe/app/cred/UsernameStrategy.java
similarity index 98%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/UsernameStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/UsernameStrategy.java
index b898f369b..bbba93057 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/UsernameStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/UsernameStrategy.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity;
+package io.xpipe.app.cred;
 
 import io.xpipe.core.FailableSupplier;
 
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/YubikeyPivStrategy.java b/app/src/main/java/io/xpipe/app/cred/YubikeyPivStrategy.java
similarity index 97%
rename from ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/YubikeyPivStrategy.java
rename to app/src/main/java/io/xpipe/app/cred/YubikeyPivStrategy.java
index d91322226..86e98e9dd 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/ssh/YubikeyPivStrategy.java
+++ b/app/src/main/java/io/xpipe/app/cred/YubikeyPivStrategy.java
@@ -1,4 +1,4 @@
-package io.xpipe.ext.base.identity.ssh;
+package io.xpipe.app.cred;
 
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.process.CommandBuilder;
@@ -81,7 +81,7 @@ public class YubikeyPivStrategy implements SshIdentityStrategy {
     }
 
     @Override
-    public String getPublicKey() {
+    public PublicKeyStrategy getPublicKeyStrategy() {
         return null;
     }
 }
diff --git a/app/src/main/java/io/xpipe/app/ext/DataStoreProvider.java b/app/src/main/java/io/xpipe/app/ext/DataStoreProvider.java
index 26f4c4c0c..e1018adcf 100644
--- a/app/src/main/java/io/xpipe/app/ext/DataStoreProvider.java
+++ b/app/src/main/java/io/xpipe/app/ext/DataStoreProvider.java
@@ -27,6 +27,10 @@ import java.util.UUID;
 
 public interface DataStoreProvider {
 
+    default boolean allowCreation() {
+        return true;
+    }
+
     default boolean showIncompleteInfo() {
         return false;
     }
diff --git a/app/src/main/java/io/xpipe/app/ext/NetworkContainerStoreState.java b/app/src/main/java/io/xpipe/app/ext/NetworkContainerStoreState.java
new file mode 100644
index 000000000..b9cdc44c3
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/ext/NetworkContainerStoreState.java
@@ -0,0 +1,34 @@
+package io.xpipe.app.ext;
+
+import io.xpipe.app.process.ShellStoreState;
+import lombok.AccessLevel;
+import lombok.EqualsAndHashCode;
+import lombok.Getter;
+import lombok.experimental.FieldDefaults;
+import lombok.experimental.SuperBuilder;
+import lombok.extern.jackson.Jacksonized;
+
+@FieldDefaults(makeFinal = true, level = AccessLevel.PRIVATE)
+@Getter
+@EqualsAndHashCode(callSuper = true)
+@SuperBuilder(toBuilder = true)
+@Jacksonized
+public class NetworkContainerStoreState extends ContainerStoreState {
+
+    String ipv4;
+    String ipv6;
+
+    @Override
+    public DataStoreState mergeCopy(DataStoreState newer) {
+        var n = (NetworkContainerStoreState) newer;
+        var b = toBuilder();
+        mergeBuilder(n, b);
+        return b.build();
+    }
+
+    protected void mergeBuilder(NetworkContainerStoreState css, NetworkContainerStoreState.NetworkContainerStoreStateBuilder<?, ?> b) {
+        super.mergeBuilder(css, b);
+        b.ipv4 = css.ipv4;
+        b.ipv6 = css.ipv6;
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/ext/ProcessControlProvider.java b/app/src/main/java/io/xpipe/app/ext/ProcessControlProvider.java
index d9d3da1fc..80fae85d9 100644
--- a/app/src/main/java/io/xpipe/app/ext/ProcessControlProvider.java
+++ b/app/src/main/java/io/xpipe/app/ext/ProcessControlProvider.java
@@ -58,6 +58,8 @@ public abstract class ProcessControlProvider {
 
     public abstract ShellDialect getEffectiveLocalDialect();
 
+    public abstract String executeMcpCommand(ShellControl sc, String command) throws Exception;
+
     public ShellDialect getNextFallbackDialect() {
         var av = getAvailableLocalDialects();
         var index = av.indexOf(getEffectiveLocalDialect());
@@ -76,4 +78,7 @@ public abstract class ProcessControlProvider {
     public abstract void cloneRepository(String url, Path target) throws Exception;
 
     public abstract void pullRepository(Path target) throws Exception;
+
+    public abstract DataStore quickConnectStore(String user, String host, Integer port, DataStore existing);
+
 }
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreCategoryWrapper.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreCategoryWrapper.java
index 8241c82b6..b49e5ebbc 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreCategoryWrapper.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreCategoryWrapper.java
@@ -36,7 +36,6 @@ public class StoreCategoryWrapper {
     private final IntegerProperty allContainedEntriesCount = new SimpleIntegerProperty();
     private final BooleanProperty expanded = new SimpleBooleanProperty();
     private final Property<DataStoreColor> color = new SimpleObjectProperty<>();
-    private final BooleanProperty largeCategoryOptimizations = new SimpleBooleanProperty();
     private final Trigger<Void> renameTrigger = Trigger.of();
     private StoreCategoryWrapper cachedParent;
 
@@ -191,12 +190,6 @@ public class StoreCategoryWrapper {
                 .sum();
         allContainedEntriesCount.setValue(direct + sub);
 
-        var performanceCount =
-                AppPrefs.get().showChildCategoriesInParentCategory().get() ? allContainedEntriesCount.get() : direct;
-        if (performanceCount > 500) {
-            largeCategoryOptimizations.setValue(true);
-        }
-
         var directFiltered = directContainedEntries.getList().stream()
                 .filter(storeEntryWrapper -> {
                     var filter = StoreViewState.get().getFilterString().getValue();
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreComboChoiceComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreComboChoiceComp.java
index 70f2eb3cb..eac8b27cd 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreComboChoiceComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreComboChoiceComp.java
@@ -44,7 +44,6 @@ public class StoreComboChoiceComp<T extends DataStore> extends SimpleRegionBuild
     private final Property<ComboValue<T>> selected;
     private final Function<T, String> stringConverter;
     private final StoreChoicePopover<T> popover;
-    private final boolean requireComplete;
 
     public StoreComboChoiceComp(
             Function<T, String> stringConverter,
@@ -56,7 +55,6 @@ public class StoreComboChoiceComp<T extends DataStore> extends SimpleRegionBuild
             boolean requireComplete) {
         this.stringConverter = stringConverter;
         this.selected = selected;
-        this.requireComplete = requireComplete;
 
         var popoverProp = new SimpleObjectProperty<>(
                 selected.getValue() != null ? selected.getValue().getRef() : null);
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationComp.java
index f7981ad88..c99ecc85f 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationComp.java
@@ -58,8 +58,8 @@ public class StoreCreationComp extends ModalOverlayContentComp {
         var provider = model.getProvider().getValue() != null
                 ? model.getProvider().getValue()
                 : providerChoice.getProviders().getFirst();
-        var showProviders = (!model.isStaticDisplay() && provider.showProviderChoice())
-                || (model.isStaticDisplay() && provider.showProviderChoice());
+        var showProviders = !model.isQuickConnect() && ((!model.isStaticDisplay() && provider.showProviderChoice())
+                || (model.isStaticDisplay() && provider.showProviderChoice()));
         if (model.isStaticDisplay()) {
             providerChoice.apply(struc -> struc.setDisable(true));
         }
@@ -88,7 +88,6 @@ public class StoreCreationComp extends ModalOverlayContentComp {
                     });
                 }
 
-                var propOptions = createStoreProperties();
                 model.getInitialStore().setValue(model.getStore().getValue());
 
                 var valSp = new GraphicDecorationStackPane();
@@ -103,7 +102,11 @@ public class StoreCreationComp extends ModalOverlayContentComp {
                 }
 
                 full.sub(d.getOptions());
-                full.sub(propOptions);
+
+                if (!model.isQuickConnect()) {
+                    var propOptions = createStoreProperties();
+                    full.sub(propOptions);
+                }
 
                 var comp = full.buildComp();
                 var region = comp.style("store-creator-options").build();
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationDialog.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationDialog.java
index e5ef37475..c693830b2 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationDialog.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationDialog.java
@@ -26,17 +26,23 @@ import java.util.function.Predicate;
 
 public class StoreCreationDialog {
 
-    public static void showEdit(DataStoreEntry e) {
-        showEdit(e, dataStoreEntry -> {});
+    public static StoreCreationModel showEdit(DataStoreEntry e) {
+        return showEdit(e, dataStoreEntry -> {});
     }
 
-    public static void showEdit(DataStoreEntry e, Consumer<DataStoreEntry> c) {
-        showEdit(e, e.getStore(), c);
+    public static StoreCreationModel showEdit(DataStoreEntry e, Consumer<DataStoreEntry> c) {
+        return showEdit(e, e.getStore(), true, c);
     }
 
-    public static void showEdit(DataStoreEntry e, DataStore base, Consumer<DataStoreEntry> c) {
+    public static StoreCreationModel showEdit(DataStoreEntry e, DataStore base, boolean addToStorage, Consumer<DataStoreEntry> c) {
         StoreCreationConsumer consumer = (newE, validated) -> {
             ThreadHelper.runAsync(() -> {
+                if (!addToStorage) {
+                    DataStorage.get().updateEntry(e, newE);
+                    c.accept(e);
+                    return;
+                }
+
                 if (!DataStorage.get().getStoreEntries().contains(e)
                         || DataStorage.get().getEffectiveReadOnlyState(e)) {
                     DataStorage.get().addStoreEntryIfNotPresent(newE);
@@ -48,14 +54,12 @@ public class StoreCreationDialog {
                         var madeValid = !e.getValidity().isUsable()
                                 && newE.getValidity().isUsable();
                         DataStorage.get().updateEntry(e, newE);
-                        if (madeValid) {
-                            if (validated
-                                    && e.getProvider().shouldShowScan()
-                                    && AppPrefs.get()
-                                            .openConnectionSearchWindowOnConnectionCreation()
-                                            .get()) {
-                                ScanDialog.showSingleAsync(e);
-                            }
+                        if (madeValid && validated
+                                && e.getProvider().shouldShowScan()
+                                && AppPrefs.get()
+                                        .openConnectionSearchWindowOnConnectionCreation()
+                                        .get()) {
+                            ScanDialog.showSingleAsync(e);
                         }
                     }
                 }
@@ -72,11 +76,11 @@ public class StoreCreationDialog {
                 c.accept(e);
             });
         };
-        show(e.getName(), DataStoreProviders.byStore(base), base, v -> true, consumer, true, e);
+        return show(e.getName(), DataStoreProviders.byStore(base), base, v -> true, consumer, true, e);
     }
 
-    public static void showCreation(DataStoreProvider selected, DataStoreCreationCategory category) {
-        showCreation(
+    public static StoreCreationModel showCreation(DataStoreProvider selected, DataStoreCreationCategory category) {
+        return showCreation(
                 null,
                 selected != null ? selected.defaultStore(DataStorage.get().getSelectedCategory()) : null,
                 category,
@@ -84,7 +88,7 @@ public class StoreCreationDialog {
                 true);
     }
 
-    public static void showCreation(
+    public static StoreCreationModel showCreation(
             String name,
             DataStore base,
             DataStoreCreationCategory category,
@@ -118,18 +122,19 @@ public class StoreCreationDialog {
                 ErrorEventFactory.fromThrowable(ex).handle();
             }
         };
-        show(
+        return show(
                 name,
                 prov,
                 base,
-                dataStoreProvider -> (category != null && category.equals(dataStoreProvider.getCreationCategory()))
+                dataStoreProvider -> (category != null && dataStoreProvider.allowCreation() &&
+                        category.equals(dataStoreProvider.getCreationCategory()))
                         || dataStoreProvider.equals(prov),
                 consumer,
                 false,
                 null);
     }
 
-    private static void show(
+    private static StoreCreationModel show(
             String initialName,
             DataStoreProvider provider,
             DataStore s,
@@ -140,7 +145,7 @@ public class StoreCreationDialog {
         var ex = StoreCreationQueueEntry.findExisting(existingEntry);
         if (ex.isPresent()) {
             ex.get().execute();
-            return;
+            return null;
         }
 
         var prop = new SimpleObjectProperty<>(provider);
@@ -148,12 +153,13 @@ public class StoreCreationDialog {
         var model = new StoreCreationModel(prop, store, filter, initialName, existingEntry, staticDisplay, con);
         var modal = createModalOverlay(model);
         modal.show();
+        return model;
     }
 
     private static ModalOverlay createModalOverlay(StoreCreationModel model) {
         var comp = new StoreCreationComp(model);
         comp.prefWidth(650);
-        var nameKey = model.storeTypeNameKey() + "Add";
+        var nameKey = model.isQuickConnect() ? "quickConnect" : model.storeTypeNameKey() + "Add";
         var modal = ModalOverlay.of(nameKey, comp);
         var queueEntry = StoreCreationQueueEntry.of(model, modal);
         comp.apply(struc -> {
@@ -205,21 +211,18 @@ public class StoreCreationDialog {
                 .augment(button -> {
                     button.visibleProperty().bind(Bindings.not(model.canConnect()));
                 }));
-        modal.addButton(new ModalButton(
-                        "skip",
-                        () -> {
-                            model.commit(false);
-                            modal.close();
-                        },
-                        false,
-                        false))
-                .augment(button -> {
-                    button.visibleProperty().bind(model.getSkippable());
-                    button.disableProperty().bind(model.getBusy());
-                });
+        if (!model.isQuickConnect()) {
+            modal.addButton(new ModalButton("skip", () -> {
+                model.commit(false);
+                modal.close();
+            }, false, false)).augment(button -> {
+                button.visibleProperty().bind(model.getSkippable());
+                button.disableProperty().bind(model.getBusy());
+            });
+        }
 
         modal.addButton(new ModalButton(
-                        "finish",
+                        model.isQuickConnect() ? "connect" : "finish",
                         () -> {
                             model.finish();
                         },
@@ -239,7 +242,7 @@ public class StoreCreationDialog {
                     button.textProperty()
                             .bind(Bindings.createStringBinding(
                                     () -> {
-                                        return !model.getBusy().get() ? AppI18n.get("finish") : null;
+                                        return !model.getBusy().get() ? AppI18n.get(model.isQuickConnect() ? "connect" : "finish") : null;
                                     },
                                     PlatformThread.sync(model.getBusy()),
                                     AppI18n.activeLanguage()));
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationMenu.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationMenu.java
index abaf5d605..f2fda216f 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationMenu.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationMenu.java
@@ -153,7 +153,7 @@ public class StoreCreationMenu {
         });
 
         int lastOrder = providers.getFirst().getOrderPriority();
-        for (io.xpipe.app.ext.DataStoreProvider dataStoreProvider : providers) {
+        for (var dataStoreProvider : providers) {
             if (dataStoreProvider.getOrderPriority() != lastOrder) {
                 menu.getItems().add(new SeparatorMenuItem());
                 lastOrder = dataStoreProvider.getOrderPriority();
@@ -167,6 +167,7 @@ public class StoreCreationMenu {
                 StoreCreationDialog.showCreation(dataStoreProvider, category);
                 event.consume();
             });
+            item.setDisable(!dataStoreProvider.allowCreation());
             menu.getItems().add(item);
         }
         return menu;
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationModel.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationModel.java
index e978a471d..41db7608b 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationModel.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreCreationModel.java
@@ -167,6 +167,10 @@ public class StoreCreationModel {
                         store));
     }
 
+    boolean isQuickConnect() {
+        return existingEntry != null && existingEntry.getUuid().equals(StoreQuickConnect.STORE_ID);
+    }
+
     void connect() {
         var temp = entry.getValue() != null ? entry.getValue() : DataStoreEntry.createTempWrapper(store.getValue());
         var action = OpenHubMenuLeafProvider.Action.builder().ref(temp.ref()).build();
@@ -211,7 +215,7 @@ public class StoreCreationModel {
         }
 
         // We didn't change anything
-        if (store.getValue().isComplete() && !wasChanged()) {
+        if (store.getValue().isComplete() && !wasChanged() && !isQuickConnect()) {
             commit(false);
             return;
         }
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryBatchSelectComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryBatchSelectComp.java
index 38bdcb450..824be633a 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryBatchSelectComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryBatchSelectComp.java
@@ -1,6 +1,7 @@
 package io.xpipe.app.hub.comp;
 
 import io.xpipe.app.comp.SimpleRegionBuilder;
+import io.xpipe.app.storage.DataStoreEntry;
 import io.xpipe.app.util.BooleanScope;
 
 import javafx.application.Platform;
@@ -23,6 +24,7 @@ public class StoreEntryBatchSelectComp extends SimpleRegionBuilder {
     protected Region createSimple() {
         var selfUpdate = new SimpleBooleanProperty(false);
         var cb = new CheckBox();
+        externalUpdate(cb);
         cb.setAllowIndeterminate(true);
         cb.selectedProperty().addListener((observable, oldValue, newValue) -> {
             BooleanScope.executeExclusive(selfUpdate, () -> {
@@ -64,6 +66,13 @@ public class StoreEntryBatchSelectComp extends SimpleRegionBuilder {
     }
 
     private void externalUpdate(CheckBox checkBox) {
+        if (section.getWrapper() != null && section.getWrapper().getEntry().getValidity() == DataStoreEntry.Validity.LOAD_FAILED) {
+            checkBox.setSelected(false);
+            checkBox.setIndeterminate(false);
+            checkBox.setDisable(true);
+            return;
+        }
+
         var isSelected = section.getWrapper() == null
                 ? checkBox.isSelected()
                 : StoreViewState.get().isBatchModeSelected(section.getWrapper());
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryComp.java
index 1c63cc46c..5e8b720af 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryComp.java
@@ -459,10 +459,10 @@ public abstract class StoreEntryComp extends SimpleRegionBuilder {
 
                 var notes = new MenuItem(AppI18n.get("addNotes"), new FontIcon("mdi2c-comment-text-outline"));
                 notes.setOnAction(event -> {
-                    getWrapper().getNotes().setValue(new StoreNotes(null, getDefaultNotes()));
+                    StoreNotesComp.showDialog(getWrapper(), getDefaultNotes());
                     event.consume();
                 });
-                notes.visibleProperty().bind(BindingsHelper.map(getWrapper().getNotes(), s -> s.getCommited() == null));
+                notes.visibleProperty().bind(BindingsHelper.map(getWrapper().getNotes(), s -> s == null));
                 items.add(items.size(), notes);
 
                 var freeze = new MenuItem();
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryListOverviewComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryListOverviewComp.java
index c7f613d59..a5750070c 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryListOverviewComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryListOverviewComp.java
@@ -4,7 +4,6 @@ import io.xpipe.app.comp.BaseRegionBuilder;
 import io.xpipe.app.comp.RegionBuilder;
 import io.xpipe.app.comp.SimpleRegionBuilder;
 import io.xpipe.app.comp.base.CountComp;
-import io.xpipe.app.comp.base.FilterComp;
 import io.xpipe.app.comp.base.IconButtonComp;
 import io.xpipe.app.core.AppFontSizes;
 import io.xpipe.app.core.AppI18n;
@@ -14,7 +13,9 @@ import io.xpipe.app.platform.MenuHelper;
 import io.xpipe.app.util.ObservableSubscriber;
 import io.xpipe.core.OsType;
 
+import javafx.application.Platform;
 import javafx.beans.binding.Bindings;
+import javafx.beans.property.SimpleStringProperty;
 import javafx.css.PseudoClass;
 import javafx.geometry.Insets;
 import javafx.geometry.Orientation;
@@ -40,7 +41,7 @@ public class StoreEntryListOverviewComp extends SimpleRegionBuilder {
         this.filterTrigger = filterTrigger;
     }
 
-    private Region createGroupListHeader() {
+    private Region createHeaderBar() {
         var label = new Label();
         var name = BindingsHelper.flatMap(
                 StoreViewState.get().getActiveCategory(),
@@ -94,17 +95,10 @@ public class StoreEntryListOverviewComp extends SimpleRegionBuilder {
         return topBar;
     }
 
-    private Region createGroupListFilter() {
-        var filter = new FilterComp(StoreViewState.get().getFilterString()).build();
-        filterTrigger.subscribe(() -> {
-            filter.requestFocus();
-        });
+    private Region createAddBar() {
         var add = createAddButton();
         var batchMode = createBatchModeButton().build();
-        var hbox = new HBox(add, filter, batchMode);
-        filter.minHeightProperty().bind(add.heightProperty());
-        filter.prefHeightProperty().bind(add.heightProperty());
-        filter.maxHeightProperty().bind(add.heightProperty());
+        var hbox = new HBox(add, batchMode);
         batchMode.minHeightProperty().bind(add.heightProperty());
         batchMode.prefHeightProperty().bind(add.heightProperty());
         batchMode.maxHeightProperty().bind(add.heightProperty());
@@ -112,9 +106,25 @@ public class StoreEntryListOverviewComp extends SimpleRegionBuilder {
         batchMode.prefWidthProperty().bind(add.heightProperty());
         batchMode.maxWidthProperty().bind(add.heightProperty());
         hbox.setSpacing(8);
+        hbox.setAlignment(Pos.CENTER_LEFT);
+        return hbox;
+    }
+
+
+    private Region createFilterBar(Region addBar) {
+        var filter = new StoreFilterComp().build();
+        filterTrigger.subscribe(() -> {
+            filter.requestFocus();
+        });
+
+        filter.minHeightProperty().bind(addBar.heightProperty());
+        filter.prefHeightProperty().bind(addBar.heightProperty());
+        filter.maxHeightProperty().bind(addBar.heightProperty());
+
+        var hbox = new HBox(filter);
+        hbox.setSpacing(8);
         hbox.setAlignment(Pos.CENTER);
         HBox.setHgrow(filter, Priority.ALWAYS);
-
         filter.getStyleClass().add("filter-bar");
         return hbox;
     }
@@ -267,7 +277,8 @@ public class StoreEntryListOverviewComp extends SimpleRegionBuilder {
 
     @Override
     public Region createSimple() {
-        var bar = new VBox(createGroupListHeader(), createGroupListFilter());
+        var addBar = createAddBar();
+        var bar = new VBox(createHeaderBar(), addBar, createFilterBar(addBar));
         bar.setFillWidth(true);
         bar.getStyleClass().add("bar");
         bar.getStyleClass().add("store-header-bar");
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryWrapper.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryWrapper.java
index 61f6df75a..9d729e073 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryWrapper.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreEntryWrapper.java
@@ -58,7 +58,7 @@ public class StoreEntryWrapper {
     private final Property<DataStoreColor> color = new SimpleObjectProperty<>();
     private final Property<StoreCategoryWrapper> category = new SimpleObjectProperty<>();
     private final Property<String> summary = new SimpleObjectProperty<>();
-    private final Property<StoreNotes> notes;
+    private final ObjectProperty<String> notes;
     private final Property<String> customIcon = new SimpleObjectProperty<>();
     private final Property<String> iconFile = new SimpleObjectProperty<>();
     private final BooleanProperty sessionActive = new SimpleBooleanProperty();
@@ -69,7 +69,6 @@ public class StoreEntryWrapper {
     private final ObservableValue<String> shownSummary;
     private final ObservableValue<String> shownDescription;
     private final Property<String> shownInformation;
-    private final BooleanProperty largeCategoryOptimizations = new SimpleBooleanProperty();
     private final BooleanProperty readOnly = new SimpleBooleanProperty();
     private final BooleanProperty renaming = new SimpleBooleanProperty();
     private final BooleanProperty pinToTop = new SimpleBooleanProperty();
@@ -117,7 +116,7 @@ public class StoreEntryWrapper {
                 shownSummary,
                 AppI18n.activeLanguage());
         this.shownInformation = new SimpleObjectProperty<>();
-        this.notes = new SimpleObjectProperty<>(new StoreNotes(entry.getNotes(), entry.getNotes()));
+        this.notes = new SimpleObjectProperty<>(entry.getNotes());
 
         setupListeners();
     }
@@ -158,12 +157,6 @@ public class StoreEntryWrapper {
         entry.addListener(() -> PlatformThread.runLaterIfNeeded(() -> {
             update();
         }));
-
-        notes.addListener((observable, oldValue, newValue) -> {
-            if (newValue.isCommited()) {
-                entry.setNotes(newValue.getCurrent());
-            }
-        });
     }
 
     public void stopSession() {
@@ -211,7 +204,7 @@ public class StoreEntryWrapper {
         }
         orderIndex.setValue(entry.getOrderIndex());
         color.setValue(entry.getColor());
-        notes.setValue(new StoreNotes(entry.getNotes(), entry.getNotes()));
+        notes.setValue(entry.getNotes());
         customIcon.setValue(entry.getIcon());
         readOnly.setValue(entry.isFreeze());
         iconFile.setValue(entry.getEffectiveIconFile());
@@ -226,8 +219,6 @@ public class StoreEntryWrapper {
                         storeCategoryWrapper.getCategory().getUuid().equals(entry.getCategoryUuid()))
                 .findFirst()
                 .orElse(StoreViewState.get().getAllConnectionsCategory()));
-        largeCategoryOptimizations.setValue(
-                category.getValue().getLargeCategoryOptimizations().getValue());
         perUser.setValue(
                 !category.getValue().getRoot().equals(StoreViewState.get().getAllIdentitiesCategory())
                         && entry.isPerUserStore());
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreFilterComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreFilterComp.java
new file mode 100644
index 000000000..05beb9143
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreFilterComp.java
@@ -0,0 +1,92 @@
+package io.xpipe.app.hub.comp;
+
+import atlantafx.base.controls.CustomTextField;
+import io.xpipe.app.comp.RegionBuilder;
+import io.xpipe.app.comp.RegionDescriptor;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.core.AppOpenArguments;
+import io.xpipe.app.platform.PlatformThread;
+import javafx.application.Platform;
+import javafx.beans.binding.Bindings;
+import javafx.beans.property.Property;
+import javafx.beans.property.SimpleStringProperty;
+import javafx.scene.input.KeyCode;
+import javafx.scene.input.KeyCodeCombination;
+import javafx.scene.input.KeyEvent;
+import org.kordamp.ikonli.javafx.FontIcon;
+
+import java.util.List;
+import java.util.Objects;
+
+public class StoreFilterComp extends RegionBuilder<CustomTextField> {
+
+    private final Property<String> rawText = new SimpleStringProperty();
+
+    private boolean isQuickConnect() {
+        var v = rawText.getValue();
+        return v != null && (v.startsWith("ssh") || "ssh".startsWith(v));
+    }
+
+    private boolean isSearch() {
+        return rawText.getValue() != null && rawText.getValue().length() > 1 && !isQuickConnect();
+    }
+
+    @Override
+    public CustomTextField createSimple() {
+        var searchIcon = new FontIcon("mdi2m-magnify");
+        var launchIcon = new FontIcon("mdi2p-play");
+        var filter = new CustomTextField();
+        filter.setMinHeight(0);
+        filter.setMaxHeight(20000);
+        filter.getStyleClass().add("filter-comp");
+        filter.promptTextProperty().bind(AppI18n.observable("storeFilterPrompt"));
+        filter.rightProperty()
+                .bind(Bindings.createObjectBinding(
+                        () -> {
+                            return filter.isFocused() ? (isQuickConnect() ? launchIcon : isSearch() ? searchIcon : null) : null;
+                        },
+                        filter.focusedProperty(), rawText));
+        RegionDescriptor.builder().nameKey("search").build().apply(filter);
+
+        filter.addEventFilter(KeyEvent.KEY_PRESSED, event -> {
+            if (new KeyCodeCombination(KeyCode.ESCAPE).match(event)) {
+                filter.clear();
+                event.consume();
+            } else if (isQuickConnect() && new KeyCodeCombination(KeyCode.ENTER).match(event)) {
+                if (StoreQuickConnect.launchQuickConnect(filter.getText())) {
+                    filter.clear();
+                    event.consume();
+                }
+            }
+        });
+
+        rawText.subscribe(val -> {
+            PlatformThread.runLaterIfNeeded(() -> {
+                if (!Objects.equals(filter.getText(), val) && !(val == null && "".equals(filter.getText()))) {
+                    filter.setText(val);
+                }
+
+                Platform.runLater(() -> {
+                    if (val == null || isSearch()) {
+                        StoreViewState.get().getFilterString().setValue(val);
+                    } else {
+                        StoreViewState.get().getFilterString().setValue(null);
+                    }
+                });
+            });
+        });
+
+        filter.textProperty().addListener((observable, oldValue, n) -> {
+            // Handle pasted xpipe URLs
+            if (n != null && n.startsWith("xpipe://")) {
+                AppOpenArguments.handle(List.of(n));
+                filter.setText(null);
+                return;
+            }
+
+            rawText.setValue(n != null && n.length() > 0 ? n : null);
+        });
+
+        return filter;
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreIconChoiceComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreIconChoiceComp.java
index ab9133ac7..4e8ce4f30 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreIconChoiceComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreIconChoiceComp.java
@@ -8,6 +8,7 @@ import io.xpipe.app.icon.SystemIcon;
 import io.xpipe.app.icon.SystemIconManager;
 import io.xpipe.app.platform.LabelGraphic;
 import io.xpipe.app.platform.PlatformThread;
+import io.xpipe.app.storage.DataStoreEntry;
 import io.xpipe.app.util.BooleanScope;
 import io.xpipe.app.util.ThreadHelper;
 
@@ -22,8 +23,11 @@ import javafx.scene.text.TextAlignment;
 
 import atlantafx.base.theme.Styles;
 import atlantafx.base.theme.Tweaks;
+import lombok.Getter;
 
 import java.util.*;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import static atlantafx.base.theme.Styles.TEXT_SMALL;
 
@@ -35,6 +39,9 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
     private final int columns;
     private final SimpleStringProperty filter;
     private final Runnable doubleClick;
+    private final DataStoreEntry entry;
+
+    @Getter
     private final BooleanProperty busy = new SimpleBooleanProperty();
 
     public StoreIconChoiceComp(
@@ -43,13 +50,15 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
             Set<SystemIcon> icons,
             int columns,
             SimpleStringProperty filter,
-            Runnable doubleClick) {
+            Runnable doubleClick, DataStoreEntry entry
+    ) {
         this.reshow = reshow;
         this.selected = selected;
         this.icons = icons;
         this.columns = columns;
         this.filter = filter;
         this.doubleClick = doubleClick;
+        this.entry = entry;
     }
 
     @Override
@@ -58,7 +67,6 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
         if (modalOverlay != null) {
             ThreadHelper.runFailableAsync(() -> {
                 BooleanScope.executeExclusive(busy, () -> {
-                    SystemIconManager.reloadSourceHashes();
                     SystemIconManager.loadAllAvailableIconImages();
                 });
             });
@@ -68,7 +76,7 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
     @Override
     protected Region createSimple() {
         var table = new TableView<List<SystemIcon>>();
-        table.disableProperty().bind(PlatformThread.sync(busy));
+        table.visibleProperty().bind(PlatformThread.sync(busy.not()));
         initTable(table);
         filter.addListener((observable, oldValue, newValue) -> updateData(table, newValue));
         busy.addListener((observable, oldValue, newValue) -> {
@@ -77,17 +85,22 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
             }
         });
 
-        var loading = new LoadingIconComp(busy, AppFontSizes::title)
-                .prefWidth(60)
-                .hide(busy.not())
-                .build();
-        var refresh = createRefreshPane();
+        var loading = createLoadingPane();
         var stack = new StackPane();
-        stack.getChildren().addAll(table, refresh, loading);
+        stack.getChildren().addAll(table, loading);
 
         return stack;
     }
 
+    public void refresh() {
+        ThreadHelper.runFailableAsync(() -> {
+            BooleanScope.executeExclusive(busy, () -> {
+                SystemIconManager.rebuild();
+                reshow.run();
+            });
+        });
+    }
+
     private void initTable(TableView<List<SystemIcon>> table) {
         if (!SystemIconManager.isCacheOutdated()) {
             for (int i = 0; i < columns; i++) {
@@ -108,22 +121,28 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
         table.setColumnResizePolicy(TableView.CONSTRAINED_RESIZE_POLICY_ALL_COLUMNS);
         table.getSelectionModel().setCellSelectionEnabled(true);
         table.getStyleClass().add("icon-browser");
+        table.disableProperty().bind(PlatformThread.sync(busy));
     }
 
-    private Region createRefreshPane() {
-        var refreshing = new SimpleBooleanProperty(false);
+    private Region createLoadingPane() {
         var refreshButton = new ButtonComp(
                 AppI18n.observable("refreshIcons"),
                 new SimpleObjectProperty<>(new LabelGraphic.IconGraphic("mdi2r-refresh")),
                 () -> {
                     ThreadHelper.runFailableAsync(() -> {
-                        try (var ignored = new BooleanScope(refreshing).start()) {
+                        BooleanScope.executeExclusive(busy, () -> {
                             SystemIconManager.rebuild();
-                        }
+                        });
                         reshow.run();
                     });
                 });
-        refreshButton.disable(refreshing);
+        refreshButton.hide(Bindings.createBooleanBinding(
+                () -> {
+                    return SystemIconManager.hasLoadedAnyImages();
+                },
+                busy));
+        refreshButton.disable(busy);
+
         var text = new LabelComp(AppI18n.observable("refreshIconsDescription"));
         text.apply(struc -> {
             struc.setWrapText(true);
@@ -131,28 +150,17 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
             struc.setPrefWidth(300);
         });
         text.style(Styles.TEXT_SUBTLE);
-        text.visible(refreshing);
-        var vbox = new VerticalComp(List.of(refreshButton, text)).spacing(25);
-        vbox.hide(Bindings.createBooleanBinding(
-                () -> {
-                    if (busy.get()) {
-                        return true;
-                    }
+        text.visible(busy);
 
-                    var available = icons.stream()
-                            .filter(systemIcon -> AppImages.hasImage(
-                                    "icons/" + systemIcon.getSource().getId() + "/" + systemIcon.getId() + "-40.png"))
-                            .sorted(Comparator.comparing(systemIcon -> systemIcon.getId()))
-                            .toList();
-                    if (available.isEmpty()) {
-                        return false;
-                    }
+        var loading = new LoadingIconComp(busy, AppFontSizes::title);
+        loading.prefWidth(50);
+        loading.prefHeight(50);
 
-                    return true;
-                },
-                busy,
-                refreshing));
-        vbox.apply(struc -> struc.setAlignment(Pos.CENTER));
+        var vbox = new VerticalComp(List.of(text, loading, refreshButton)).spacing(25);
+        vbox.apply(struc -> {
+            struc.setAlignment(Pos.CENTER);
+            struc.setPickOnBounds(false);
+        });
         return vbox.build();
     }
 
@@ -166,24 +174,27 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
                 .filter(systemIcon -> AppImages.hasImage(
                         "icons/" + systemIcon.getSource().getId() + "/" + systemIcon.getId() + "-40.png"))
                 .sorted(Comparator.comparing(systemIcon -> systemIcon.getId()))
-                .toList();
-        var filtered = available;
-        if (filterString != null && !filterString.isBlank() && filterString.length() >= 2) {
-            filtered = available.stream()
-                    .filter(icon -> containsString(icon.getId(), filterString))
-                    .toList();
+                .collect(Collectors.toCollection(ArrayList::new));
+        available.addFirst(new SystemIcon(null, "default"));
+
+        List<SystemIcon> shown;
+        if (filterString != null && !filterString.isBlank() && filterString.strip().length() >= 2) {
+            shown = available.stream()
+                    .filter(icon -> containsString(icon.getId(), filterString.strip()))
+                    .collect(Collectors.toCollection(ArrayList::new));
+        } else {
+            shown = new ArrayList<>(available);
         }
-        var data = partitionList(filtered, columns);
+
+        var data = partitionList(shown, columns);
         table.getItems().setAll(data);
 
-        var selectMatch = filtered.size() == 1
-                || filtered.stream().anyMatch(systemIcon -> systemIcon.getId().equals(filterString));
+        var selectMatch = shown.size() == 1
+                || shown.stream().anyMatch(systemIcon -> systemIcon.getId().equals(filterString));
         // Table updates seem to not always be instant, sometimes the column is not there yet
         if (selectMatch && table.getColumns().size() > 0) {
             table.getSelectionModel().select(0, table.getColumns().getFirst());
-            selected.setValue(filtered.getFirst());
-        } else {
-            selected.setValue(null);
+            selected.setValue(shown.getFirst());
         }
     }
 
@@ -242,6 +253,13 @@ public class StoreIconChoiceComp extends ModalOverlayContentComp {
                 return;
             }
 
+            if (icon.getSource() == null) {
+                root.setText(AppI18n.get("default"));
+                image.setValue(entry.getProvider().getDisplayIconFileName(entry.getStore()));
+                setGraphic(root);
+                return;
+            }
+
             root.setText(icon.getId());
             image.set(SystemIconManager.getAndLoadIconFile(icon));
             setGraphic(root);
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreIconChoiceDialog.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreIconChoiceDialog.java
index 87fb57ac4..f98012d72 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreIconChoiceDialog.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreIconChoiceDialog.java
@@ -3,10 +3,12 @@ package io.xpipe.app.hub.comp;
 import io.xpipe.app.comp.base.*;
 import io.xpipe.app.icon.SystemIcon;
 import io.xpipe.app.icon.SystemIconManager;
+import io.xpipe.app.platform.PlatformThread;
 import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.storage.DataStoreEntry;
 
 import javafx.application.Platform;
+import javafx.beans.binding.Bindings;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.property.SimpleStringProperty;
@@ -47,49 +49,52 @@ public class StoreIconChoiceDialog {
                 }
             });
         });
+
+        var comp = new StoreIconChoiceComp(
+                () -> {
+                    var showing = overlay.isShowing();
+                    overlay.close();
+                    if (showing) {
+                        Platform.runLater(() -> overlay.show());
+                    }
+                },
+                selected,
+                SystemIconManager.getIcons(),
+                5,
+                filterText,
+                () -> {
+                    finish();
+                },
+                entry);
+        comp.prefWidth(600);
+
+        var modal = ModalOverlay.of(
+                "chooseCustomIcon",
+                comp);
+        var refresh = new ButtonComp(null, new FontIcon("mdi2r-refresh"), () -> {
+            comp.refresh();
+        }).maxHeight(100).disable(comp.getBusy());
         var settings = new ButtonComp(null, new FontIcon("mdomz-settings"), () -> {
                     overlay.close();
                     AppPrefs.get().selectCategory("icons");
                 })
+                .disable(comp.getBusy())
                 .maxHeight(100);
-        var modal = ModalOverlay.of(
-                "chooseCustomIcon",
-                new StoreIconChoiceComp(
-                                () -> {
-                                    var showing = overlay.isShowing();
-                                    overlay.close();
-                                    if (showing) {
-                                        Platform.runLater(() -> overlay.show());
-                                    }
-                                },
-                                selected,
-                                SystemIconManager.getIcons(),
-                                5,
-                                filterText,
-                                () -> {
-                                    finish();
-                                })
-                        .prefWidth(600));
         modal.addButtonBarComp(settings);
+        modal.addButtonBarComp(refresh);
         modal.addButtonBarComp(filter);
-        modal.addButton(new ModalButton(
-                "clear",
-                () -> {
-                    selected.setValue(null);
-                    finish();
-                },
-                true,
-                false));
         modal.addButton(ModalButton.ok(() -> {
                     finish();
                 }))
-                .augment(button -> button.disableProperty().bind(selected.isNull()));
+                .augment(button -> button.disableProperty().bind(Bindings.createBooleanBinding(() -> {
+                    return selected.get() == null || comp.getBusy().get();
+                }, selected, PlatformThread.sync(comp.getBusy()))));
         return modal;
     }
 
     private void finish() {
         entry.setIcon(
-                selected.get() != null
+                selected.get() != null && selected.getValue().getSource() != null
                         ? selected.getValue().getSource().getId() + "/"
                                 + selected.getValue().getId()
                         : null,
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreListChoiceComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreListChoiceComp.java
index c1c605911..40c92f5bd 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreListChoiceComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreListChoiceComp.java
@@ -4,6 +4,7 @@ import io.xpipe.app.comp.BaseRegionBuilder;
 import io.xpipe.app.comp.RegionBuilder;
 import io.xpipe.app.comp.SimpleRegionBuilder;
 import io.xpipe.app.comp.base.*;
+import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.ext.DataStore;
 import io.xpipe.app.storage.DataStoreEntryRef;
 
@@ -48,7 +49,7 @@ public class StoreListChoiceComp<T extends DataStore> extends SimpleRegionBuilde
         var listBox = new ListBoxViewComp<>(
                         selectedList,
                         selectedList,
-                        t -> {
+                t -> {
                             if (t == null) {
                                 return null;
                             }
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreNotes.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreNotes.java
deleted file mode 100644
index e14efe7da..000000000
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreNotes.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package io.xpipe.app.hub.comp;
-
-import lombok.Value;
-
-import java.util.Objects;
-
-@Value
-public class StoreNotes {
-
-    String commited;
-    String current;
-
-    public boolean isCommited() {
-        return Objects.equals(commited, current);
-    }
-}
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreNotesComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreNotesComp.java
index c0a42703f..cca7dcd4e 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreNotesComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreNotesComp.java
@@ -1,30 +1,43 @@
 package io.xpipe.app.hub.comp;
 
 import io.xpipe.app.comp.*;
-import io.xpipe.app.comp.base.ButtonComp;
-import io.xpipe.app.comp.base.DialogComp;
-import io.xpipe.app.comp.base.IconButtonComp;
-import io.xpipe.app.comp.base.MarkdownEditorComp;
+import io.xpipe.app.comp.base.*;
 import io.xpipe.app.core.AppFontSizes;
-import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.platform.BindingsHelper;
-import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.storage.DataStorage;
 
+import io.xpipe.app.util.FileOpener;
 import javafx.application.Platform;
 import javafx.beans.property.Property;
+import javafx.beans.property.ReadOnlyStringWrapper;
 import javafx.beans.property.SimpleStringProperty;
-import javafx.event.ActionEvent;
 import javafx.scene.control.Button;
-import javafx.scene.paint.Color;
+import javafx.scene.input.MouseButton;
 
-import atlantafx.base.controls.Popover;
-import org.int4.fx.builders.common.AbstractRegionBuilder;
+import java.util.UUID;
 
-import java.util.List;
-import java.util.concurrent.atomic.AtomicReference;
+public class StoreNotesComp extends RegionBuilder<Button> {
 
-public class StoreNotesComp extends RegionStructureBuilder<Button, StoreNotesComp.Structure> {
+    public static void showDialog(StoreEntryWrapper wrapper, String initial) {
+        var prop = new SimpleStringProperty(initial);
+        var md = new MarkdownEditorComp(prop, "notes-" + wrapper.getName().getValue())
+                .prefWidth(700)
+                .prefHeight(800);
+
+        var modal = ModalOverlay.of(new ReadOnlyStringWrapper(wrapper.getName().getValue()), md, null);
+        if (wrapper.getNotes().getValue() != null) {
+            modal.addButton(new ModalButton("delete", () -> {
+                wrapper.getEntry().setNotes(null);
+                DataStorage.get().saveAsync();
+            }, true, false));
+        }
+        modal.addButton(new ModalButton("cancel", () -> {}, true, false));
+        modal.addButton(new ModalButton("apply", () -> {
+            wrapper.getEntry().setNotes(prop.getValue());
+            DataStorage.get().saveAsync();
+        }, true, true));
+        modal.show();
+    }
 
     private final StoreEntryWrapper wrapper;
 
@@ -33,133 +46,30 @@ public class StoreNotesComp extends RegionStructureBuilder<Button, StoreNotesCom
     }
 
     @Override
-    public Structure createBase() {
+    protected Button createSimple() {
         var n = wrapper.getNotes();
         var button = new IconButtonComp("mdi2n-note-text-outline")
                 .apply(struc -> AppFontSizes.xs(struc))
                 .describe(d ->
                         d.nameKey("notes").focusTraversal(RegionDescriptor.FocusTraversal.ENABLED_FOR_ACCESSIBILITY))
                 .style("notes-button")
-                .hide(BindingsHelper.map(n, s -> s.getCommited() == null && s.getCurrent() == null))
+                .hide(n.isNull())
                 .build();
         button.setOpacity(0.85);
         button.prefWidthProperty().bind(button.heightProperty());
 
-        var prop = new SimpleStringProperty(n.getValue().getCurrent());
-
-        var popover = new AtomicReference<Popover>();
         button.setOnAction(e -> {
-            if (n.getValue().getCurrent() == null) {
-                return;
-            }
-
-            if (popover.get() != null && popover.get().isShowing()) {
-                e.consume();
-                return;
-            }
-
-            popover.set(createPopover(popover, prop));
-            popover.get().show(button);
+            showDialog(wrapper, wrapper.getNotes().getValue());
             e.consume();
         });
-        prop.addListener((observable, oldValue, newValue) -> {
-            n.setValue(new StoreNotes(n.getValue().getCommited(), newValue));
-        });
-        n.addListener((observable, oldValue, s) -> {
-            prop.set(s.getCurrent());
-            // Check for scene existence. If we exited the platform immediately after adding notes, this might throw an
-            // exception
-            if (s.getCurrent() != null
-                    && oldValue.getCommited() == null
-                    && oldValue.isCommited()
-                    && button.getScene() != null) {
-                Platform.runLater(() -> {
-                    popover.set(createPopover(popover, prop));
-                    popover.get().show(button);
-                });
+
+        var editKey = UUID.randomUUID().toString();
+        button.setOnMouseClicked(e -> {
+            if (e.getButton() == MouseButton.PRIMARY && e.isShiftDown()) {
+                FileOpener.openString("notes.md", editKey, wrapper.getNotes().getValue(), s -> wrapper.getEntry().setNotes(s));
+                e.consume();
             }
         });
-        return new Structure(popover.get(), button);
-    }
-
-    private Popover createPopover(AtomicReference<Popover> ref, Property<String> prop) {
-        var n = wrapper.getNotes();
-        var md = new MarkdownEditorComp(prop, "notes-" + wrapper.getName().getValue())
-                .prefWidth(600)
-                .prefHeight(600)
-                .buildStructure();
-        var dialog = new DialogComp() {
-
-            @Override
-            protected String finishKey() {
-                return "apply";
-            }
-
-            @Override
-            protected List<AbstractRegionBuilder<?, ?>> customButtons() {
-                return List.of(new ButtonComp(AppI18n.observable("cancel"), () -> {
-                    ref.get().hide();
-                }));
-            }
-
-            @Override
-            protected void finish() {
-                n.setValue(
-                        new StoreNotes(n.getValue().getCurrent(), n.getValue().getCurrent()));
-                ref.get().hide();
-            }
-
-            @Override
-            public BaseRegionBuilder<?, ?> content() {
-                return RegionBuilder.of(() -> md.get());
-            }
-
-            @Override
-            public BaseRegionBuilder<?, ?> bottom() {
-                return new ButtonComp(AppI18n.observable("delete"), () -> {
-                            n.setValue(new StoreNotes(null, null));
-                        })
-                        .hide(BindingsHelper.map(n, v -> v.getCommited() == null));
-            }
-        }.build();
-
-        var popover = new Popover(dialog);
-        popover.setAutoHide(!AppPrefs.get().limitedTouchscreenMode().get());
-        popover.getScene().setFill(Color.TRANSPARENT);
-        popover.setCloseButtonEnabled(true);
-        popover.setHeaderAlwaysVisible(true);
-        popover.setDetachable(true);
-        popover.setTitle(wrapper.getName().getValue());
-        popover.showingProperty().addListener((observable, oldValue, newValue) -> {
-            if (!newValue) {
-                n.setValue(
-                        new StoreNotes(n.getValue().getCommited(), n.getValue().getCommited()));
-                DataStorage.get().saveAsync();
-                ref.set(null);
-            }
-        });
-        AppFontSizes.xs(popover.getContentNode());
-
-        md.getEditButton().addEventFilter(ActionEvent.ANY, event -> {
-            if (!popover.isDetached()) {
-                popover.setDetached(true);
-                event.consume();
-                Platform.runLater(() -> {
-                    Platform.runLater(() -> {
-                        md.getEditButton().fire();
-                    });
-                });
-            }
-        });
-
-        return popover;
-    }
-
-    public record Structure(Popover popover, Button button) implements RegionStructure<Button> {
-
-        @Override
-        public Button get() {
-            return button;
-        }
+        return button;
     }
 }
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreQuickConnect.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreQuickConnect.java
new file mode 100644
index 000000000..285de97cf
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreQuickConnect.java
@@ -0,0 +1,110 @@
+package io.xpipe.app.hub.comp;
+
+import io.xpipe.app.core.AppCache;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.core.mode.AppOperationMode;
+import io.xpipe.app.ext.*;
+import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.DerivedObservableList;
+import io.xpipe.app.platform.PlatformThread;
+import io.xpipe.app.prefs.AppPrefs;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.storage.DataStoreCategory;
+import io.xpipe.app.storage.DataStoreEntry;
+import io.xpipe.app.storage.StorageListener;
+import io.xpipe.app.util.GlobalTimer;
+import io.xpipe.app.util.ThreadHelper;
+import javafx.application.Platform;
+import javafx.beans.Observable;
+import javafx.beans.binding.Bindings;
+import javafx.beans.property.*;
+import javafx.beans.value.ObservableIntegerValue;
+import javafx.beans.value.ObservableValue;
+import javafx.collections.FXCollections;
+import javafx.collections.ListChangeListener;
+import lombok.Getter;
+import org.apache.commons.lang3.StringUtils;
+
+import java.time.Duration;
+import java.util.*;
+import java.util.function.Predicate;
+import java.util.stream.Collectors;
+
+public class StoreQuickConnect {
+
+    public static final UUID STORE_ID = UUID.randomUUID();
+
+    private static DataStore quickConnectStore;
+    private static DataStoreEntry quickConnectEntry;
+
+    public static void init() {
+        quickConnectStore = AppCache.getNonNull("quickConnect", DataStore.class, () -> DataStoreProviders.byId("ssh").orElseThrow()
+                .defaultStore(StoreViewState.get().getActiveCategory().getValue()
+                .getCategory()));
+        quickConnectEntry = DataStoreEntry.createNew(STORE_ID, DataStorage.DEFAULT_CATEGORY_UUID, "quick-connect", quickConnectStore);
+        DataStorage.get().addStoreEntryInProgress(quickConnectEntry);
+    }
+
+    public static void update(DataStore store) {
+        quickConnectStore = store;
+        DataStorage.get().updateEntryStore(quickConnectEntry, store);
+        AppCache.update("quickConnect", store);
+    }
+
+    public static boolean launchQuickConnect(String s) {
+        if (s == null || s.isBlank() || !s.contains("@")) {
+            return false;
+        }
+
+        if (s.startsWith("ssh ")) {
+            s = s.substring(4);
+        }
+
+        var split = s.split("@", 2);
+        if (split.length != 2) {
+            return false;
+        }
+
+        var user = split[0];
+
+        var target = split[1];
+        String host = target;
+        Integer port = null;
+
+        if (StringUtils.countMatches(target, ":") == 1 || (target.contains("[") && target.contains("]"))) {
+            var index = target.lastIndexOf(":");
+            host = target.substring(0, index);
+            try {
+                port = Integer.parseInt(target.substring(index + 1));
+            } catch (NumberFormatException ignored) {
+            }
+        }
+
+        var newStore = ProcessControlProvider.get().quickConnectStore(user, host, port, quickConnectStore);
+        DataStorage.get().updateEntryStore(quickConnectEntry, newStore);
+
+        var model = StoreCreationDialog.showEdit(quickConnectEntry, newStore, false, finished -> {
+            update(finished.getStore());
+            ThreadHelper.runAsync(() -> {
+                try {
+                    DataStorage.get().addStoreEntryInProgress(quickConnectEntry);
+                    quickConnectEntry.getProvider().launch(quickConnectEntry).run();
+                } catch (Exception e) {
+                    ErrorEventFactory.fromThrowable(e).handle();
+                } finally {
+                    DataStorage.get().removeStoreEntryInProgress(quickConnectEntry);
+                }
+            });
+        });
+
+        var wasCached = AppCache.getNonNull("quickConnect", DataStore.class, () -> null) != null;
+        if (wasCached) {
+            GlobalTimer.delay(() -> {
+                Platform.runLater(() -> {
+                    model.finish();
+                });
+            }, Duration.ofMillis(100));
+        }
+        return true;
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreSection.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreSection.java
index 69d338b09..529377794 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreSection.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreSection.java
@@ -8,6 +8,7 @@ import io.xpipe.app.storage.DataStoreEntry;
 
 import javafx.beans.binding.Bindings;
 import javafx.beans.property.SimpleBooleanProperty;
+import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.value.ObservableBooleanValue;
 import javafx.beans.value.ObservableIntegerValue;
 import javafx.beans.value.ObservableValue;
@@ -17,6 +18,7 @@ import lombok.Getter;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Predicate;
 
 @Getter
@@ -101,18 +103,44 @@ public class StoreSection {
                 enabled,
                 category,
                 updateObservable);
-        var cached = topLevel.mapped(storeEntryWrapper -> create(
-                List.of(),
-                storeEntryWrapper,
-                1,
-                allEnabled,
-                selected,
-                entryFilter,
-                filterString,
-                category,
-                visibilityObservable,
-                updateObservable,
-                enabled));
+        Predicate<StoreSection> showTopLevel = section -> {
+            // matches filter
+            return (filterString == null || section.matchesFilter(filterString.getValue()))
+                    &&
+                    // matches selector
+                    (section.anyMatches(entryFilter))
+                    &&
+                    // same category
+                    (showInCategory(category.getValue(), section.getWrapper()));
+        };
+        var cached = topLevel.mapped(storeEntryWrapper -> {
+            var section = new SimpleObjectProperty<StoreSection>();
+            var sectionEnabled = Bindings.createBooleanBinding(() -> {
+                        if (!enabled.getValue()) {
+                            return false;
+                        }
+
+                        return section.get() != null && showTopLevel.test(section.get());
+                    },
+                    section,
+                    enabled,
+                    category,
+                    filterString,
+                    updateObservable);
+            section.set(create(
+                    List.of(),
+                    storeEntryWrapper,
+                    1,
+                    allEnabled,
+                    selected,
+                    entryFilter,
+                    filterString,
+                    category,
+                    visibilityObservable,
+                    updateObservable,
+                    sectionEnabled));
+            return section.get();
+        });
         var ordered = sorted(null, cached, updateObservable);
         var shown = ordered.filtered(
                 section -> {
@@ -120,14 +148,7 @@ public class StoreSection {
                         return false;
                     }
 
-                    // matches filter
-                    return (filterString == null || section.matchesFilter(filterString.getValue()))
-                            &&
-                            // matches selector
-                            (section.anyMatches(entryFilter))
-                            &&
-                            // same category
-                            (showInCategory(category.getValue(), section.getWrapper()));
+                    return showTopLevel.test(section);
                 },
                 enabled,
                 category,
@@ -175,75 +196,95 @@ public class StoreSection {
                 updateObservable);
         var l = new ArrayList<>(parents);
         l.add(e);
-        var cached = allChildren.mapped(c -> create(
-                l,
-                c,
-                depth + 1,
-                all,
-                selected,
-                entryFilter,
-                filterString,
-                category,
-                visibilityObservable,
-                updateObservable,
-                enabled));
-        var ordered = sorted(e, cached, updateObservable);
-        var filtered = ordered.filtered(
-                section -> {
-                    if (!enabled.getValue()) {
+        Predicate<StoreSection> showSection = section -> {
+                if (!enabled.getValue()) {
+                    return false;
+                }
+
+                var isBatchSelected = selected.contains(section.getWrapper());
+
+                var matchesFilter = filterString == null
+                        || section.matchesFilter(filterString.getValue())
+                        || l.stream().anyMatch(p -> p.matchesFilter(filterString.getValue()));
+                if (!isBatchSelected && !matchesFilter) {
+                    return false;
+                }
+
+                var hasFilter = filterString != null
+                        && filterString.getValue() != null
+                        && filterString.getValue().length() > 0;
+                if (!isBatchSelected && !hasFilter) {
+                    var showProvider = true;
+                    try {
+                        showProvider = section.getWrapper()
+                                .getEntry()
+                                .getProvider()
+                                .shouldShow(section.getWrapper());
+                    } catch (Exception ignored) {
+                    }
+                    if (!showProvider) {
                         return false;
                     }
+                }
 
-                    var isBatchSelected = selected.contains(section.getWrapper());
+                var matchesSelector = section.anyMatches(entryFilter);
+                if (!isBatchSelected && !matchesSelector) {
+                    return false;
+                }
 
-                    var matchesFilter = filterString == null
-                            || section.matchesFilter(filterString.getValue())
-                            || l.stream().anyMatch(p -> p.matchesFilter(filterString.getValue()));
-                    if (!isBatchSelected && !matchesFilter) {
-                        return false;
-                    }
+                // Prevent updates for children on category switching by checking depth
+                var showCategory = showInCategory(category.getValue(), section.getWrapper()) || depth > 0;
+                if (!showCategory) {
+                    return false;
+                }
 
-                    var hasFilter = filterString != null
-                            && filterString.getValue() != null
-                            && filterString.getValue().length() > 0;
-                    if (!isBatchSelected && !hasFilter) {
-                        var showProvider = true;
-                        try {
-                            showProvider = section.getWrapper()
-                                    .getEntry()
-                                    .getProvider()
-                                    .shouldShow(section.getWrapper());
-                        } catch (Exception ignored) {
-                        }
-                        if (!showProvider) {
+                // If this entry is already shown as root due to a different category than parent, don't
+                // show it
+                // again here
+                var notRoot = !DataStorage.get()
+                        .isRootEntry(
+                                section.getWrapper().getEntry(),
+                                category.getValue().getCategory());
+                if (!notRoot) {
+                    return false;
+                }
+
+                return true;
+        };
+
+        var cached = allChildren.mapped(c -> {
+            var section = new SimpleObjectProperty<StoreSection>();
+            var sectionEnabled = Bindings.createBooleanBinding(() -> {
+                        if (!enabled.getValue()) {
                             return false;
                         }
-                    }
 
-                    var matchesSelector = section.anyMatches(entryFilter);
-                    if (!isBatchSelected && !matchesSelector) {
-                        return false;
-                    }
-
-                    // Prevent updates for children on category switching by checking depth
-                    var showCategory = showInCategory(category.getValue(), section.getWrapper()) || depth > 0;
-                    if (!showCategory) {
-                        return false;
-                    }
-
-                    // If this entry is already shown as root due to a different category than parent, don't
-                    // show it
-                    // again here
-                    var notRoot = !DataStorage.get()
-                            .isRootEntry(
-                                    section.getWrapper().getEntry(),
-                                    category.getValue().getCategory());
-                    if (!notRoot) {
-                        return false;
-                    }
-
-                    return true;
-                },
+                        return section.get() != null && showSection.test(section.get());
+                    },
+                    section,
+                    enabled,
+                    category,
+                    filterString,
+                    e.getPersistentState(),
+                    e.getCache(),
+                    visibilityObservable,
+                    updateObservable);
+            section.set(create(
+                    l,
+                    c,
+                    depth + 1,
+                    all,
+                    selected,
+                    entryFilter,
+                    filterString,
+                    category,
+                    visibilityObservable,
+                    updateObservable,
+                    sectionEnabled));
+            return section.get();
+        });
+        var ordered = sorted(e, cached, updateObservable);
+        var filtered = ordered.filtered(showSection,
                 enabled,
                 category,
                 filterString,
diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreViewState.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreViewState.java
index 80eb0c2aa..0de017a1a 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreViewState.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreViewState.java
@@ -189,6 +189,9 @@ public class StoreViewState {
 
     public void selectBatchMode(StoreSection section) {
         var wrapper = section.getWrapper();
+        if (wrapper != null && wrapper.getEntry().getValidity() == DataStoreEntry.Validity.LOAD_FAILED) {
+            return;
+        }
         if (wrapper != null && !batchModeSelectionSet.contains(wrapper)) {
             batchModeSelection.getList().add(wrapper);
         }
@@ -199,6 +202,9 @@ public class StoreViewState {
 
     public void unselectBatchMode(StoreSection section) {
         var wrapper = section.getWrapper();
+        if (wrapper != null && wrapper.getEntry().getValidity() == DataStoreEntry.Validity.LOAD_FAILED) {
+            return;
+        }
         if (wrapper != null) {
             batchModeSelection.getList().remove(wrapper);
         }
diff --git a/app/src/main/java/io/xpipe/app/icon/SystemIconManager.java b/app/src/main/java/io/xpipe/app/icon/SystemIconManager.java
index d490411a2..fd031006b 100644
--- a/app/src/main/java/io/xpipe/app/icon/SystemIconManager.java
+++ b/app/src/main/java/io/xpipe/app/icon/SystemIconManager.java
@@ -22,6 +22,13 @@ public class SystemIconManager {
     private static int cacheSourceHash;
     private static int sourceHash;
 
+    public static boolean hasLoadedAnyImages() {
+        var available = getIcons().stream()
+                .anyMatch(systemIcon -> AppImages.hasImage(
+                        "icons/" + systemIcon.getSource().getId() + "/" + systemIcon.getId() + "-40.png"));
+        return available;
+    }
+
     public static boolean isCacheOutdated() {
         return cacheSourceHash == 0 || sourceHash != cacheSourceHash;
     }
@@ -72,7 +79,7 @@ public class SystemIconManager {
         }
 
         var dir = SystemIconCache.getDirectory(icon.getSource());
-        var res = AppDisplayScale.hasDefaultDisplayScale() ? List.of(16, 24, 40) : List.of(16, 24, 40, 80);
+        var res = AppDisplayScale.hasOnlyDefaultDisplayScale() ? List.of(16, 24, 40) : List.of(16, 24, 40, 80);
         var files = new ArrayList<Path>();
         for (Integer re : res) {
             files.add(dir.resolve(icon.getId() + "-" + re + ".png"));
diff --git a/app/src/main/java/io/xpipe/app/issue/ErrorEventFactory.java b/app/src/main/java/io/xpipe/app/issue/ErrorEventFactory.java
index 2a4a3dfb5..3cd488ec6 100644
--- a/app/src/main/java/io/xpipe/app/issue/ErrorEventFactory.java
+++ b/app/src/main/java/io/xpipe/app/issue/ErrorEventFactory.java
@@ -6,6 +6,7 @@ import io.xpipe.app.util.DocumentationLink;
 import io.xpipe.core.OsType;
 
 import java.nio.file.AccessDeniedException;
+import java.nio.file.NoSuchFileException;
 import java.util.Arrays;
 import java.util.IdentityHashMap;
 import java.util.Locale;
@@ -84,7 +85,18 @@ public class ErrorEventFactory {
             b.expected();
         }
 
-        if (t instanceof AccessDeniedException) {
+        if (OsType.ofLocal() == OsType.WINDOWS && t.getMessage() != null && t.getMessage().contains("The cloud file provider is not running")) {
+            b.description("The OneDrive cloud file provider is not running. Verify that your cloud storage is working and you are logged in.");
+            b.expected();
+        }
+
+        if (t instanceof AccessDeniedException ade) {
+            b.description("Access is denied: " + ade.getMessage());
+            b.expected();
+        }
+
+        if (t instanceof NoSuchFileException nsfe) {
+            b.description("No such file: " + nsfe.getMessage());
             b.expected();
         }
 
diff --git a/app/src/main/java/io/xpipe/app/platform/NativeWinWindowControl.java b/app/src/main/java/io/xpipe/app/platform/NativeWinWindowControl.java
index 14ace9539..baf1cf82b 100644
--- a/app/src/main/java/io/xpipe/app/platform/NativeWinWindowControl.java
+++ b/app/src/main/java/io/xpipe/app/platform/NativeWinWindowControl.java
@@ -73,28 +73,48 @@ public class NativeWinWindowControl {
     }
 
     public void removeBorders() {
+        var rect = getBounds();
+
         var style = User32.INSTANCE.GetWindowLong(windowHandle, User32.GWL_STYLE);
         var mod = style & ~(User32.WS_CAPTION | User32.WS_THICKFRAME | User32.WS_MAXIMIZEBOX);
         User32.INSTANCE.SetWindowLong(windowHandle, User32.GWL_STYLE, mod);
+
+        User32.INSTANCE.SetWindowPos(windowHandle, null, rect.getX(), rect.getY(), rect.getW() + 1, rect.getH(),
+                User32.SWP_NOACTIVATE | User32.SWP_NOMOVE | User32.SWP_NOZORDER);
+        User32.INSTANCE.SetWindowPos(windowHandle, null, rect.getX(), rect.getY(), rect.getW(), rect.getH(),
+                User32.SWP_NOACTIVATE | User32.SWP_NOMOVE | User32.SWP_NOZORDER);
     }
 
-    public void takeOwnership(WinDef.HWND owner) {
+    public void restoreBorders() {
+        var rect = getBounds();
+
+        var style = User32.INSTANCE.GetWindowLong(windowHandle, User32.GWL_STYLE);
+        var mod = style | User32.WS_CAPTION | User32.WS_THICKFRAME | User32.WS_MAXIMIZEBOX;
+        User32.INSTANCE.SetWindowLong(windowHandle, User32.GWL_STYLE, mod);
+
+        User32.INSTANCE.SetWindowPos(windowHandle, null, rect.getX(), rect.getY(), rect.getW() + 1, rect.getH(),
+                User32.SWP_NOACTIVATE | User32.SWP_NOMOVE | User32.SWP_NOZORDER);
+        User32.INSTANCE.SetWindowPos(windowHandle, null, rect.getX(), rect.getY(), rect.getW(), rect.getH(),
+                User32.SWP_NOACTIVATE | User32.SWP_NOMOVE | User32.SWP_NOZORDER);
+    }
+
+    public void removeIcon() {
         var style = User32.INSTANCE.GetWindowLong(windowHandle, User32.GWL_EXSTYLE);
         var mod = style & ~(WS_EX_APPWINDOW);
         User32.INSTANCE.SetWindowLong(windowHandle, User32.GWL_EXSTYLE, mod);
+    }
 
-        setWindowsTransitionsEnabled(false);
+    public void restoreIcon() {
+        var style = User32.INSTANCE.GetWindowLong(windowHandle, User32.GWL_EXSTYLE);
+        var mod = style | WS_EX_APPWINDOW;
+        User32.INSTANCE.SetWindowLong(windowHandle, User32.GWL_EXSTYLE, mod);
+    }
 
+    public void takeOwnership(WinDef.HWND owner) {
         User32Ex.INSTANCE.SetWindowLongPtr(getWindowHandle(), User32.GWL_HWNDPARENT, owner);
     }
 
     public void releaseOwnership() {
-        var style = User32.INSTANCE.GetWindowLong(windowHandle, User32.GWL_EXSTYLE);
-        var mod = style | WS_EX_APPWINDOW;
-        User32.INSTANCE.SetWindowLong(windowHandle, User32.GWL_EXSTYLE, mod);
-
-        setWindowsTransitionsEnabled(true);
-
         User32Ex.INSTANCE.SetWindowLongPtr(getWindowHandle(), User32.GWL_HWNDPARENT, (WinDef.HWND) null);
     }
 
diff --git a/app/src/main/java/io/xpipe/app/platform/OptionsBuilder.java b/app/src/main/java/io/xpipe/app/platform/OptionsBuilder.java
index de4f48c6b..c6a810ef9 100644
--- a/app/src/main/java/io/xpipe/app/platform/OptionsBuilder.java
+++ b/app/src/main/java/io/xpipe/app/platform/OptionsBuilder.java
@@ -75,6 +75,7 @@ public class OptionsBuilder {
     private BaseRegionBuilder<?, ?> lastCompHeadReference;
     private ObservableValue<String> lastNameReference;
     private boolean focusFirstIncomplete = true;
+    private boolean focusEnabled = true;
 
     private final BooleanProperty mappingUpdate = new SimpleBooleanProperty();
 
diff --git a/app/src/main/java/io/xpipe/app/platform/OptionsChoiceBuilder.java b/app/src/main/java/io/xpipe/app/platform/OptionsChoiceBuilder.java
index 04af4dfe7..eb187dc15 100644
--- a/app/src/main/java/io/xpipe/app/platform/OptionsChoiceBuilder.java
+++ b/app/src/main/java/io/xpipe/app/platform/OptionsChoiceBuilder.java
@@ -3,6 +3,7 @@ package io.xpipe.app.platform;
 import io.xpipe.app.comp.base.ChoicePaneComp;
 import io.xpipe.app.core.AppI18n;
 
+import io.xpipe.app.issue.ErrorEventFactory;
 import javafx.beans.property.Property;
 import javafx.beans.property.ReadOnlyObjectWrapper;
 import javafx.beans.property.SimpleIntegerProperty;
@@ -15,6 +16,7 @@ import com.fasterxml.jackson.annotation.JsonTypeName;
 import lombok.Builder;
 import lombok.SneakyThrows;
 
+import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -77,8 +79,9 @@ public class OptionsChoiceBuilder {
             if (r != null) {
                 return (OptionsBuilder) r;
             }
-        } catch (Exception ignored) {
-        }
+        } catch (InvocationTargetException e) {
+            ErrorEventFactory.fromThrowable(e).handle();
+        } catch (Exception ignored) {}
         return new OptionsBuilder();
     }
 
@@ -88,7 +91,9 @@ public class OptionsChoiceBuilder {
             cd.setAccessible(true);
             var defValue = cd.invoke(null);
             return defValue;
-        } catch (Exception ignored) {
+        } catch (InvocationTargetException e) {
+            ErrorEventFactory.fromThrowable(e).handle();
+        }  catch (Exception ignored) {
         }
 
         try {
@@ -99,7 +104,9 @@ public class OptionsChoiceBuilder {
             m.setAccessible(true);
             var defValue = c.cast(m.invoke(b));
             return defValue;
-        } catch (Exception ignored) {
+        } catch (InvocationTargetException e) {
+            ErrorEventFactory.fromThrowable(e).handle();
+        }  catch (Exception ignored) {
         }
 
         try {
diff --git a/app/src/main/java/io/xpipe/app/prefs/AppPrefs.java b/app/src/main/java/io/xpipe/app/prefs/AppPrefs.java
index 804b05403..0b6748f20 100644
--- a/app/src/main/java/io/xpipe/app/prefs/AppPrefs.java
+++ b/app/src/main/java/io/xpipe/app/prefs/AppPrefs.java
@@ -23,7 +23,6 @@ import io.xpipe.app.terminal.TerminalSplitStrategy;
 import io.xpipe.app.update.AppDistributionType;
 import io.xpipe.app.util.*;
 import io.xpipe.app.vnc.ExternalVncClient;
-import io.xpipe.app.vnc.InternalVncClient;
 import io.xpipe.app.vnc.VncCategory;
 import io.xpipe.core.FilePath;
 import io.xpipe.core.OsType;
@@ -39,10 +38,7 @@ import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.JavaType;
 import com.fasterxml.jackson.databind.type.SimpleType;
 import com.fasterxml.jackson.databind.type.TypeFactory;
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Getter;
-import lombok.Value;
+import lombok.*;
 
 import java.nio.file.Files;
 import java.util.*;
@@ -125,6 +121,12 @@ public final class AppPrefs {
             .key("enableMcpMutationTools")
             .valueClass(Boolean.class)
             .build());
+    final StringProperty mcpAdditionalContext = map(Mapping.builder()
+            .property(new GlobalStringProperty(null))
+            .key("mcpAdditionalContext")
+            .valueClass(String.class)
+            .requiresRestart(true)
+            .build());
     final BooleanProperty dontAutomaticallyStartVmSshServer =
             mapVaultShared(new GlobalBooleanProperty(false), "dontAutomaticallyStartVmSshServer", Boolean.class, false);
     final BooleanProperty dontAcceptNewHostKeys =
@@ -239,7 +241,7 @@ public final class AppPrefs {
     public final BooleanProperty dontCachePasswords =
             mapVaultShared(new GlobalBooleanProperty(false), "dontCachePasswords", Boolean.class, false);
     public final Property<ExternalVncClient> vncClient = map(Mapping.builder()
-            .property(new GlobalObjectProperty<>(InternalVncClient.builder().build()))
+            .property(new GlobalObjectProperty<>())
             .key("vncClient")
             .valueClass(ExternalVncClient.class)
             .documentationLink(DocumentationLink.VNC)
@@ -340,7 +342,6 @@ public final class AppPrefs {
             .property(new GlobalBooleanProperty(false))
             .key("enableTerminalLogging")
             .valueClass(Boolean.class)
-            .licenseFeatureId("logging")
             .documentationLink(DocumentationLink.TERMINAL_LOGGING)
             .build());
     final BooleanProperty enableTerminalStartupBell = map(Mapping.builder()
@@ -419,7 +420,6 @@ public final class AppPrefs {
             new SyncCategory(),
             new PasswordManagerCategory(),
             new TerminalCategory(),
-            new LoggingCategory(),
             new EditorCategory(),
             new RdpCategory(),
             new VncCategory(),
@@ -582,6 +582,10 @@ public final class AppPrefs {
         return enableMcpMutationTools;
     }
 
+    public ObservableValue<String> mcpAdditionalContext() {
+        return mcpAdditionalContext;
+    }
+
     public ObservableBooleanValue pinLocalMachineOnStartup() {
         return pinLocalMachineOnStartup;
     }
@@ -825,6 +829,7 @@ public final class AppPrefs {
         terminalType.set(ExternalTerminalType.determineDefault(terminalType.get()));
         rdpClientType.setValue(ExternalRdpClient.determineDefault(rdpClientType.get()));
         spiceClient.setValue(ExternalSpiceClient.determineDefault(spiceClient.getValue()));
+        vncClient.setValue(ExternalVncClient.determineDefault(vncClient.getValue()));
 
         PrefsProvider.getAll().forEach(prov -> prov.initDefaultValues());
     }
@@ -861,7 +866,16 @@ public final class AppPrefs {
             // as the one is set by default and might not be the right one
             // This happens for example with homebrew ssh
             var shellVariable = LocalShell.getShell().view().getEnvironmentVariable("SSH_AUTH_SOCK");
-            var socketEnvVariable = shellVariable.isEmpty() ? System.getenv("SSH_AUTH_SOCK") : shellVariable.get();
+            if (shellVariable.isPresent() && PasswordManager.isPasswordManagerSshAgent(shellVariable.get())) {
+                shellVariable = Optional.empty();
+            }
+
+            var envVariable = System.getenv("SSH_AUTH_SOCK");
+            if (envVariable != null && PasswordManager.isPasswordManagerSshAgent(envVariable)) {
+                envVariable = null;
+            }
+
+            var socketEnvVariable = shellVariable.isEmpty() ? envVariable : shellVariable.get();
             defaultSshAgentSocket.setValue(FilePath.parse(socketEnvVariable));
         }
 
diff --git a/app/src/main/java/io/xpipe/app/prefs/LoggingCategory.java b/app/src/main/java/io/xpipe/app/prefs/LoggingCategory.java
deleted file mode 100644
index 0e1ba01ab..000000000
--- a/app/src/main/java/io/xpipe/app/prefs/LoggingCategory.java
+++ /dev/null
@@ -1,49 +0,0 @@
-package io.xpipe.app.prefs;
-
-import io.xpipe.app.comp.BaseRegionBuilder;
-import io.xpipe.app.comp.base.*;
-import io.xpipe.app.core.AppI18n;
-import io.xpipe.app.core.AppProperties;
-import io.xpipe.app.issue.ErrorEventFactory;
-import io.xpipe.app.platform.LabelGraphic;
-import io.xpipe.app.platform.OptionsBuilder;
-import io.xpipe.app.util.*;
-
-import java.io.IOException;
-import java.nio.file.Files;
-
-public class LoggingCategory extends AppPrefsCategory {
-
-    @Override
-    protected String getId() {
-        return "logging";
-    }
-
-    @Override
-    protected LabelGraphic getIcon() {
-        return new LabelGraphic.IconGraphic("mdi2t-text-box-search-outline");
-    }
-
-    @Override
-    protected BaseRegionBuilder<?, ?> create() {
-        var prefs = AppPrefs.get();
-        return new OptionsBuilder()
-                .addTitle("sessionLogging")
-                .sub(new OptionsBuilder()
-                        .pref(prefs.enableTerminalLogging)
-                        .addToggle(prefs.enableTerminalLogging)
-                        .nameAndDescription("terminalLoggingDirectory")
-                        .documentationLink(DocumentationLink.TERMINAL_LOGGING_FILES)
-                        .addComp(new ButtonComp(AppI18n.observable("openSessionLogs"), () -> {
-                                    var dir = AppProperties.get().getDataDir().resolve("sessions");
-                                    try {
-                                        Files.createDirectories(dir);
-                                        DesktopHelper.browseFile(dir);
-                                    } catch (IOException e) {
-                                        ErrorEventFactory.fromThrowable(e).handle();
-                                    }
-                                })
-                                .disable(prefs.enableTerminalLogging.not())))
-                .buildComp();
-    }
-}
diff --git a/app/src/main/java/io/xpipe/app/prefs/McpCategory.java b/app/src/main/java/io/xpipe/app/prefs/McpCategory.java
index c6d4e09ee..d59ce98ad 100644
--- a/app/src/main/java/io/xpipe/app/prefs/McpCategory.java
+++ b/app/src/main/java/io/xpipe/app/prefs/McpCategory.java
@@ -1,14 +1,22 @@
 package io.xpipe.app.prefs;
 
+import atlantafx.base.theme.Styles;
 import io.xpipe.app.beacon.AppBeaconServer;
 import io.xpipe.app.comp.BaseRegionBuilder;
+import io.xpipe.app.comp.RegionBuilder;
+import io.xpipe.app.comp.base.IntegratedTextAreaComp;
 import io.xpipe.app.comp.base.TextAreaComp;
+import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.core.AppNames;
 import io.xpipe.app.platform.LabelGraphic;
 import io.xpipe.app.platform.OptionsBuilder;
 
 import javafx.beans.binding.Bindings;
 import javafx.beans.property.SimpleStringProperty;
+import javafx.beans.value.ObservableValue;
+import javafx.scene.control.Tab;
+import javafx.scene.control.TabPane;
+import javafx.scene.control.TextArea;
 
 public class McpCategory extends AppPrefsCategory {
 
@@ -22,26 +30,11 @@ public class McpCategory extends AppPrefsCategory {
         return new LabelGraphic.IconGraphic("mdi2c-chat-processing-outline");
     }
 
-    @Override
-    protected BaseRegionBuilder<?, ?> create() {
+    private ObservableValue<String> createMcpConfig(String format) {
         var prefs = AppPrefs.get();
-
-        var mcpConfig = Bindings.createStringBinding(
+        return Bindings.createStringBinding(
                 () -> {
-                    var template = """
-                           {
-                             "mcpServers": {
-                               "%s": {
-                                 "type": "streamable-http",
-                                 "url": "http://localhost:%s/mcp",
-                                 "headers": {
-                                   "Authorization": "Bearer %s"
-                                 }
-                               }
-                             }
-                           }
-                           """;
-                    return template.formatted(
+                    return format.formatted(
                                     AppNames.ofCurrent().getKebapName(),
                                     AppBeaconServer.get().getPort(),
                                     prefs.apiKey().get() != null
@@ -50,22 +43,110 @@ public class McpCategory extends AppPrefsCategory {
                             .strip();
                 },
                 prefs.apiKey());
-        var mcpConfigProp = new SimpleStringProperty();
-        mcpConfigProp.bind(mcpConfig);
+    }
+
+    @Override
+    protected BaseRegionBuilder<?, ?> create() {
+        var prefs = AppPrefs.get();
+
+        var vsCodeTemplate = createMcpConfig("""
+             {
+               "servers": {
+                 "%s": {
+                   "type": "http",
+                   "url": "http://localhost:%s/mcp",
+                   "headers": {
+                     "Authorization": "Bearer %s"
+                   }
+                 }
+               }
+             }
+             """);
+
+        var cursorTemplate = createMcpConfig("""
+               {
+                 "mcpServers": {
+                   "%s": {
+                     "type": "streamable-http",
+                     "url": "http://localhost:%s/mcp",
+                     "headers": {
+                       "Authorization": "Bearer %s"
+                     }
+                   }
+                 }
+               }
+               """);
+
+        var warpTemplate = createMcpConfig("""
+               {
+                 "%s": {
+                   "serverUrl": "http://localhost:%s/mcp",
+                   "headers": {
+                     "Authorization": "Bearer %s"
+                   }
+                 }
+               }
+               """);
+
+        var tabComp = RegionBuilder.of(() -> {
+            var vsCode = new TextArea();
+            vsCode.setEditable(false);
+            vsCode.textProperty().bind(vsCodeTemplate);
+            vsCode.setPrefRowCount(12);
+            var vsCodeTab = new Tab();
+            vsCodeTab.textProperty().bind(AppI18n.observable("vscode"));
+            vsCodeTab.setContent(vsCode);
+            vsCodeTab.setClosable(false);
+
+            var cursor = new TextArea();
+            cursor.setEditable(false);
+            cursor.textProperty().bind(cursorTemplate);
+            cursor.setPrefRowCount(12);
+            var cursorTab = new Tab();
+            cursorTab.textProperty().bind(AppI18n.observable("cursor"));
+            cursorTab.setContent(cursor);
+            cursorTab.setClosable(false);
+
+            var warp = new TextArea();
+            warp.setEditable(false);
+            warp.textProperty().bind(warpTemplate);
+            warp.setPrefRowCount(12);
+            var warpTab = new Tab();
+            warpTab.textProperty().bind(AppI18n.observable("warp"));
+            warpTab.setContent(warp);
+            warpTab.setClosable(false);
+
+            var claude = new TextArea();
+            claude.setEditable(false);
+            claude.textProperty().bind(vsCodeTemplate);
+            claude.setPrefRowCount(12);
+            var claudeTab = new Tab();
+            claudeTab.textProperty().bind(AppI18n.observable("claude"));
+            claudeTab.setContent(claude);
+            claudeTab.setClosable(false);
+
+            var tabPane = new TabPane();
+            tabPane.getTabs().addAll(vsCodeTab, cursorTab, warpTab, claudeTab);
+            return tabPane;
+        });
 
         return new OptionsBuilder()
                 .addTitle("mcpServer")
                 .sub(new OptionsBuilder()
                         .pref(prefs.enableMcpServer)
                         .addToggle(prefs.enableMcpServer)
+                        .nameAndDescription("mcpClientConfigurationDetails")
+                        .addComp(tabComp)
+                        .hide(prefs.enableMcpServer.not())
                         .pref(prefs.enableMcpMutationTools)
                         .addToggle(prefs.enableMcpMutationTools)
-                        .nameAndDescription("mcpClientConfigurationDetails")
-                        .addComp(new TextAreaComp(mcpConfigProp).applyStructure(struc -> {
-                            struc.getTextArea().setEditable(false);
-                            struc.getTextArea().setPrefRowCount(12);
+                        .hide(prefs.enableMcpServer.not())
+                        .pref(prefs.mcpAdditionalContext)
+                        .addComp(new IntegratedTextAreaComp(prefs.mcpAdditionalContext, false, "prompt", new SimpleStringProperty("txt")).applyStructure(structure -> {
+                            structure.getTextArea().promptTextProperty().bind(AppI18n.observable("mcpAdditionalContextSample"));
                         }))
-                        .hide(prefs.enableMcpServer.not()))
+                        .hide(prefs.enableMcpServer.not())
+                )
                 .buildComp();
     }
 }
diff --git a/app/src/main/java/io/xpipe/app/prefs/PasswordManagerCategory.java b/app/src/main/java/io/xpipe/app/prefs/PasswordManagerCategory.java
index 73687b066..4dd70ac99 100644
--- a/app/src/main/java/io/xpipe/app/prefs/PasswordManagerCategory.java
+++ b/app/src/main/java/io/xpipe/app/prefs/PasswordManagerCategory.java
@@ -20,20 +20,8 @@ import org.kordamp.ikonli.javafx.FontIcon;
 
 public class PasswordManagerCategory extends AppPrefsCategory {
 
-    @Override
-    protected String getId() {
-        return "passwordManager";
-    }
-
-    @Override
-    protected LabelGraphic getIcon() {
-        return new LabelGraphic.IconGraphic("mdomz-vpn_key");
-    }
-
-    @Override
-    protected BaseRegionBuilder<?, ?> create() {
+    public static OptionsBuilder passwordManagerChoice() {
         var prefs = AppPrefs.get();
-        var testPasswordManagerValue = new SimpleStringProperty();
 
         var choiceBuilder = OptionsChoiceBuilder.builder()
                 .property(prefs.passwordManager)
@@ -63,18 +51,26 @@ public class PasswordManagerCategory extends AppPrefsCategory {
                 .build();
         var choice = choiceBuilder.build().buildComp().maxWidth(600);
 
-        var testInput = new PasswordManagerTestComp(testPasswordManagerValue, true);
-        testInput.maxWidth(getCompWidth());
-        testInput.hgrow();
+        return new OptionsBuilder()
+                        .pref(prefs.passwordManager)
+                        .addComp(choice);
+    }
 
+    @Override
+    protected String getId() {
+        return "passwordManager";
+    }
+
+    @Override
+    protected LabelGraphic getIcon() {
+        return new LabelGraphic.IconGraphic("mdomz-vpn_key");
+    }
+
+    @Override
+    protected BaseRegionBuilder<?, ?> create() {
         return new OptionsBuilder()
                 .addTitle("passwordManager")
-                .sub(new OptionsBuilder()
-                        .pref(prefs.passwordManager)
-                        .addComp(choice)
-                        .nameAndDescription("passwordManagerCommandTest")
-                        .addComp(testInput)
-                        .hide(BindingsHelper.map(prefs.passwordManager, p -> p == null)))
+                .sub(passwordManagerChoice())
                 .buildComp();
     }
 }
diff --git a/app/src/main/java/io/xpipe/app/prefs/PasswordManagerTestComp.java b/app/src/main/java/io/xpipe/app/prefs/PasswordManagerTestComp.java
index a95760057..8358faf38 100644
--- a/app/src/main/java/io/xpipe/app/prefs/PasswordManagerTestComp.java
+++ b/app/src/main/java/io/xpipe/app/prefs/PasswordManagerTestComp.java
@@ -1,10 +1,7 @@
 package io.xpipe.app.prefs;
 
 import io.xpipe.app.comp.SimpleRegionBuilder;
-import io.xpipe.app.comp.base.ButtonComp;
-import io.xpipe.app.comp.base.HorizontalComp;
-import io.xpipe.app.comp.base.LabelComp;
-import io.xpipe.app.comp.base.TextFieldComp;
+import io.xpipe.app.comp.base.*;
 import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.util.GlobalTimer;
 import io.xpipe.app.util.ThreadHelper;
@@ -13,6 +10,7 @@ import javafx.application.Platform;
 import javafx.beans.binding.Bindings;
 import javafx.beans.property.SimpleStringProperty;
 import javafx.beans.property.StringProperty;
+import javafx.geometry.Insets;
 import javafx.geometry.Pos;
 import javafx.scene.input.KeyCode;
 import javafx.scene.layout.Region;
@@ -21,6 +19,7 @@ import atlantafx.base.theme.Styles;
 import org.kordamp.ikonli.javafx.FontIcon;
 
 import java.time.Duration;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.atomic.AtomicInteger;
 
@@ -30,6 +29,10 @@ public class PasswordManagerTestComp extends SimpleRegionBuilder {
     private final boolean handleEnter;
     private final AtomicInteger counter = new AtomicInteger(0);
 
+    public PasswordManagerTestComp(boolean handleEnter) {
+        this(new SimpleStringProperty(), handleEnter);
+    }
+
     public PasswordManagerTestComp(StringProperty value, boolean handleEnter) {
         this.value = value;
         this.handleEnter = handleEnter;
@@ -49,7 +52,6 @@ public class PasswordManagerTestComp extends SimpleRegionBuilder {
                                             : "?";
                                 },
                                 prefs.passwordManager)))
-                .style(Styles.LEFT_PILL)
                 .hgrow();
         if (handleEnter) {
             field.apply(struc -> struc.setOnKeyPressed(event -> {
@@ -60,28 +62,20 @@ public class PasswordManagerTestComp extends SimpleRegionBuilder {
             }));
         }
 
-        var button = new ButtonComp(null, new FontIcon("mdi2p-play"), () -> {
+        var button = new ButtonComp(AppI18n.observable("test"), new FontIcon("mdi2p-play"), () -> {
                     testPasswordManager(value.get(), testPasswordManagerResult);
-                })
-                .describe(d -> d.nameKey("test"))
-                .style(Styles.RIGHT_PILL);
+                });
+        button.padding(new Insets(6, 9, 6, 9));
+        button.disable(value.isNull());
 
-        var testInput = new HorizontalComp(List.of(field, button));
-        testInput.apply(struc -> {
-            struc.setFillHeight(true);
-            var first = ((Region) struc.getChildren().get(0));
-            var second = ((Region) struc.getChildren().get(1));
-            second.minHeightProperty().bind(first.heightProperty());
-            second.maxHeightProperty().bind(first.heightProperty());
-            second.prefHeightProperty().bind(first.heightProperty());
-        });
-        testInput.hgrow();
-
-        var testPasswordManager = new HorizontalComp(List.of(
-                        testInput, new LabelComp(testPasswordManagerResult).apply(struc -> struc.setOpacity(0.8))))
+        var testRow = new HorizontalComp(List.of(
+                        button, new LabelComp(testPasswordManagerResult).apply(struc -> struc.setOpacity(0.8))))
                 .apply(struc -> struc.setAlignment(Pos.CENTER_LEFT))
                 .apply(struc -> struc.setFillHeight(true));
-        return testPasswordManager.build();
+
+        var vbox = new VerticalComp(List.of(field, testRow));
+        vbox.spacing(6);
+        return vbox.build();
     }
 
     private void testPasswordManager(String key, StringProperty testPasswordManagerResult) {
@@ -96,18 +90,39 @@ public class PasswordManagerTestComp extends SimpleRegionBuilder {
                 testPasswordManagerResult.set("    " + AppI18n.get("querying"));
             });
 
-            var r = prefs.passwordManager.getValue().retrieveCredentials(key);
+            var r = prefs.passwordManager.getValue().query(key);
             if (r == null) {
                 Platform.runLater(() -> {
-                    testPasswordManagerResult.set(null);
+                    testPasswordManagerResult.set("    " + AppI18n.get("queryFailed"));
                 });
+                GlobalTimer.delay(
+                        () -> {
+                            Platform.runLater(() -> {
+                                if (counter.get() == currentIndex) {
+                                    testPasswordManagerResult.set(null);
+                                }
+                            });
+                        },
+                        Duration.ofSeconds(5));
                 return;
             }
 
-            var pass = r.getPassword() != null ? r.getPassword().getSecretValue() : "?";
-            var format = (r.getUsername() != null ? r.getUsername() + " [" + pass + "]" : pass);
+            List<String> elements = new ArrayList<>();
+            if (r.getCredentials() != null && r.getCredentials().getUsername() != null) {
+                elements.add(r.getCredentials().getUsername());
+            }
+
+            if (r.getCredentials() != null && r.getCredentials().getPassword() != null) {
+                elements.add("[" + r.getCredentials().getPassword().getSecretValue() + "]");
+            }
+
+            if (r.getSshKey() != null) {
+                elements.add("[" + AppI18n.get("sshKey") + "]");
+            }
+
+            var formatted = String.join(" ", elements);
             Platform.runLater(() -> {
-                testPasswordManagerResult.set("    " + AppI18n.get("retrievedPassword", format));
+                testPasswordManagerResult.set("    " + AppI18n.get("retrievedPassword", formatted));
             });
             GlobalTimer.delay(
                     () -> {
diff --git a/app/src/main/java/io/xpipe/app/prefs/SshCategory.java b/app/src/main/java/io/xpipe/app/prefs/SshCategory.java
index a224193b3..74eb7dac8 100644
--- a/app/src/main/java/io/xpipe/app/prefs/SshCategory.java
+++ b/app/src/main/java/io/xpipe/app/prefs/SshCategory.java
@@ -1,15 +1,34 @@
 package io.xpipe.app.prefs;
 
+import atlantafx.base.theme.Styles;
 import io.xpipe.app.comp.BaseRegionBuilder;
+import io.xpipe.app.comp.base.ButtonComp;
 import io.xpipe.app.comp.base.ContextualFileReferenceChoiceComp;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.cred.CustomAgentStrategy;
+import io.xpipe.app.cred.SshAgentTestComp;
+import io.xpipe.app.cred.SshIdentityStateManager;
+import io.xpipe.app.ext.ProcessControlProvider;
+import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.platform.LabelGraphic;
 import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.process.LocalShell;
+import io.xpipe.app.process.ShellScript;
 import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.terminal.TerminalLaunch;
+import io.xpipe.app.util.ThreadHelper;
 import io.xpipe.core.OsType;
 
+import javafx.application.Platform;
 import javafx.beans.property.ReadOnlyObjectWrapper;
+import javafx.beans.property.SimpleObjectProperty;
+import javafx.geometry.Insets;
+import javafx.geometry.Pos;
+import javafx.scene.layout.Region;
+import org.kordamp.ikonli.javafx.FontIcon;
 
 import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
 
 public class SshCategory extends AppPrefsCategory {
 
@@ -30,6 +49,8 @@ public class SshCategory extends AppPrefsCategory {
         if (OsType.ofLocal() == OsType.WINDOWS) {
             options.addComp(prefs.getCustomOptions("x11WslInstance").buildComp());
         }
+
+        var agentTest = new SshAgentTestComp(new SimpleObjectProperty<>(CustomAgentStrategy.builder().build()));
         if (OsType.ofLocal() != OsType.WINDOWS) {
             var choice = new ContextualFileReferenceChoiceComp(
                     new ReadOnlyObjectWrapper<>(DataStorage.get().local().ref()),
@@ -41,7 +62,7 @@ public class SshCategory extends AppPrefsCategory {
             choice.setPrompt(prefs.defaultSshAgentSocket);
             choice.maxWidth(600);
             options.sub(
-                    new OptionsBuilder().nameAndDescription("sshAgentSocket").addComp(choice, prefs.sshAgentSocket));
+                    new OptionsBuilder().nameAndDescription("sshAgentSocket").addComp(choice, prefs.sshAgentSocket).addComp(agentTest));
         }
         return options.buildComp();
     }
diff --git a/app/src/main/java/io/xpipe/app/prefs/TerminalCategory.java b/app/src/main/java/io/xpipe/app/prefs/TerminalCategory.java
index 13eb99a4f..f04be9b91 100644
--- a/app/src/main/java/io/xpipe/app/prefs/TerminalCategory.java
+++ b/app/src/main/java/io/xpipe/app/prefs/TerminalCategory.java
@@ -4,6 +4,7 @@ import io.xpipe.app.comp.BaseRegionBuilder;
 import io.xpipe.app.comp.RegionBuilder;
 import io.xpipe.app.comp.base.*;
 import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.core.AppProperties;
 import io.xpipe.app.ext.PrefsChoiceValue;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.ext.ShellStore;
@@ -33,6 +34,8 @@ import javafx.scene.layout.Region;
 
 import org.kordamp.ikonli.javafx.FontIcon;
 
+import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Arrays;
 import java.util.List;
 
@@ -151,20 +154,6 @@ public class TerminalCategory extends AppPrefsCategory {
     @Override
     protected BaseRegionBuilder<?, ?> create() {
         var prefs = AppPrefs.get();
-        prefs.enableTerminalLogging.addListener((observable, oldValue, newValue) -> {
-            var feature = LicenseProvider.get().getFeature("logging");
-            if (newValue && !feature.isSupported()) {
-                try {
-                    // Disable it again so people don't forget that they left it on
-                    Platform.runLater(() -> {
-                        prefs.enableTerminalLogging.set(false);
-                    });
-                    feature.throwIfUnsupported();
-                } catch (LicenseRequiredException ex) {
-                    ErrorEventFactory.fromThrowable(ex).handle();
-                }
-            }
-        });
 
         var tabsSettingSupported = Bindings.createBooleanBinding(
                 () -> {
@@ -182,6 +171,22 @@ public class TerminalCategory extends AppPrefsCategory {
                 .sub(terminalProxy())
                 .sub(terminalMultiplexer())
                 // .sub(terminalInitScript())
+                .addTitle("sessionLogging")
+                .sub(new OptionsBuilder()
+                        .pref(prefs.enableTerminalLogging)
+                        .addToggle(prefs.enableTerminalLogging)
+                        .nameAndDescription("terminalLoggingDirectory")
+                        .documentationLink(DocumentationLink.TERMINAL_LOGGING_FILES)
+                        .addComp(new ButtonComp(AppI18n.observable("openSessionLogs"), () -> {
+                            var dir = AppProperties.get().getDataDir().resolve("sessions");
+                            try {
+                                Files.createDirectories(dir);
+                                DesktopHelper.browseFile(dir);
+                            } catch (IOException e) {
+                                ErrorEventFactory.fromThrowable(e).handle();
+                            }
+                        })
+                                .disable(prefs.enableTerminalLogging.not())))
                 .addTitle("terminalBehaviour")
                 .sub(
                         new OptionsBuilder()
@@ -220,8 +225,6 @@ public class TerminalCategory extends AppPrefsCategory {
                                 .pref(prefs.enableTerminalStartupBell)
                                 .addToggle(prefs.enableTerminalStartupBell)
                                 .hide(OsType.ofLocal() == OsType.WINDOWS)
-                        //                        .pref(prefs.terminalPromptForRestart)
-                        //                        .addToggle(prefs.terminalPromptForRestart)
                         )
                 .buildComp();
     }
diff --git a/app/src/main/java/io/xpipe/app/process/ParentSystemAccess.java b/app/src/main/java/io/xpipe/app/process/ParentSystemAccess.java
index af11a8e79..a84417acb 100644
--- a/app/src/main/java/io/xpipe/app/process/ParentSystemAccess.java
+++ b/app/src/main/java/io/xpipe/app/process/ParentSystemAccess.java
@@ -6,6 +6,11 @@ public interface ParentSystemAccess {
 
     static ParentSystemAccess none() {
         return new ParentSystemAccess() {
+            @Override
+            public boolean samePermissions() {
+                return false;
+            }
+
             @Override
             public boolean supportsSameUsers() {
                 return false;
@@ -45,6 +50,11 @@ public interface ParentSystemAccess {
 
     static ParentSystemAccess identity() {
         return new ParentSystemAccess() {
+            @Override
+            public boolean samePermissions() {
+                return true;
+            }
+
             @Override
             public boolean supportsSameUsers() {
                 return true;
@@ -84,6 +94,11 @@ public interface ParentSystemAccess {
 
     static ParentSystemAccess combine(ParentSystemAccess a1, ParentSystemAccess a2) {
         return new ParentSystemAccess() {
+            @Override
+            public boolean samePermissions() {
+                return a1.samePermissions() && a2.samePermissions();
+            }
+
             @Override
             public boolean supportsSameUsers() {
                 return a1.supportsSameUsers() && a2.supportsSameUsers();
@@ -121,10 +136,56 @@ public interface ParentSystemAccess {
         };
     }
 
+    static ParentSystemAccess userChange() {
+        return new ParentSystemAccess() {
+            @Override
+            public boolean samePermissions() {
+                return false;
+            }
+
+            @Override
+            public boolean supportsSameUsers() {
+                return true;
+            }
+
+            @Override
+            public boolean supportsFileSystemAccess() {
+                return true;
+            }
+
+            @Override
+            public boolean supportsExecutables() {
+                return true;
+            }
+
+            @Override
+            public boolean supportsExecutableEnvironment() {
+                return true;
+            }
+
+            @Override
+            public FilePath translateFromLocalSystemPath(FilePath path) {
+                return path;
+            }
+
+            @Override
+            public FilePath translateToLocalSystemPath(FilePath path) {
+                return path;
+            }
+
+            @Override
+            public boolean isIdentity() {
+                return true;
+            }
+        };
+    }
+
     default boolean supportsAnyAccess() {
         return supportsFileSystemAccess();
     }
 
+    boolean samePermissions();
+
     boolean supportsSameUsers();
 
     boolean supportsFileSystemAccess();
diff --git a/app/src/main/java/io/xpipe/app/process/ShellView.java b/app/src/main/java/io/xpipe/app/process/ShellView.java
index c5e27db3c..b97d3e43e 100644
--- a/app/src/main/java/io/xpipe/app/process/ShellView.java
+++ b/app/src/main/java/io/xpipe/app/process/ShellView.java
@@ -125,6 +125,10 @@ public class ShellView {
         return userHome;
     }
 
+    public void moveFile(FilePath source, FilePath dest) throws Exception {
+        getDialect().getFileMoveCommand(shellControl, source.toString(), dest.toString()).execute();
+    }
+
     public boolean fileExists(FilePath path) throws Exception {
         return getDialect()
                 .createFileExistsCommand(shellControl, path.toString())
@@ -271,8 +275,8 @@ public class ShellView {
         } else if (ShellDialects.isPowershell(shellControl)) {
             administrator = shellControl
                     .command(String.format(
-                            "$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent());"
-                                    + "try {if (-not $($currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) {$host.ui"
+                            "try {$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent());"
+                                    + "if (-not $($currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) {$host.ui"
                                     + ".WriteErrorLine(\"%s\"); throw \"error\"}} catch {}",
                             "Not Administrator"))
                     .executeAndCheck();
diff --git a/app/src/main/java/io/xpipe/app/pwman/BitwardenPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/BitwardenPasswordManager.java
index cf51d02a8..97cd4b84e 100644
--- a/app/src/main/java/io/xpipe/app/pwman/BitwardenPasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/BitwardenPasswordManager.java
@@ -1,28 +1,46 @@
 package io.xpipe.app.pwman;
 
+import io.xpipe.app.comp.base.ButtonComp;
 import io.xpipe.app.core.AppCache;
+import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.core.AppSystemInfo;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.*;
 import io.xpipe.app.terminal.TerminalLaunch;
 import io.xpipe.app.util.*;
-import io.xpipe.core.InPlaceSecretValue;
 import io.xpipe.core.JacksonMapper;
 import io.xpipe.core.OsType;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
+import javafx.application.Platform;
+import javafx.beans.property.Property;
+import javafx.beans.property.SimpleObjectProperty;
+import javafx.geometry.Insets;
+import javafx.scene.layout.Region;
+import lombok.Builder;
+import lombok.extern.jackson.Jacksonized;
+import org.kordamp.ikonli.javafx.FontIcon;
 
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.StandardCopyOption;
+import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicReference;
 
 @JsonTypeName("bitwarden")
+@Builder
+@Jacksonized
 public class BitwardenPasswordManager implements PasswordManager {
 
     private static ShellControl SHELL;
     private static boolean copied;
+    private final PasswordManagerKeyStrategy keyStrategy;
 
     private static synchronized ShellControl getOrStartShell() throws Exception {
         if (SHELL == null) {
@@ -41,6 +59,54 @@ public class BitwardenPasswordManager implements PasswordManager {
         return SHELL;
     }
 
+    private static Path getSocketLocation() {
+        var socket = switch (OsType.ofLocal()) {
+            case OsType.Linux ignored -> AppSystemInfo.ofLinux().getUserHome().resolve(".bitwarden-ssh-agent.sock");
+            case OsType.MacOs macOs -> AppSystemInfo.ofMacOs().getUserHome().resolve("Library", "Containers", "com.bitwarden.desktop", "Data", ".bitwarden-ssh-agent.sock");
+            case OsType.Windows windows -> null;
+        };
+        return socket;
+    }
+
+    @SuppressWarnings("unused")
+    public static OptionsBuilder createOptions(Property<BitwardenPasswordManager> p) {
+        var keyStrategy = new SimpleObjectProperty<>(p.getValue().keyStrategy);
+
+        AtomicReference<Region> button = new AtomicReference<>();
+        var syncButton = new ButtonComp(AppI18n.observable("sync"), new FontIcon("mdi2r-refresh"), () -> {
+            button.get().setDisable(true);
+            ThreadHelper.runFailableAsync(() -> {
+                sync();
+                Platform.runLater(() -> {
+                    button.get().setDisable(false);
+                });
+            });
+        });
+        syncButton.apply(struc -> button.set(struc));
+        syncButton.padding(new Insets(6, 10, 6, 6));
+
+        var keyStrategyChoice = OptionsChoiceBuilder.builder()
+                .allowNull(true)
+                .available(List.of(PasswordManagerKeyStrategy.Agent.class))
+                .property(keyStrategy)
+                .customConfiguration(PasswordManagerKeyStrategy.OptionsConfig.builder()
+                        .defaultSocketLocation(getSocketLocation())
+                        .allowSocketChoice(false)
+                        .build())
+                .build();
+
+        return new OptionsBuilder()
+                .addComp(syncButton)
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
+                .nameAndDescription("passwordManagerKeyStrategy")
+                .sub(keyStrategyChoice.build(), keyStrategy)
+                .bind(() -> {
+                    return BitwardenPasswordManager.builder().keyStrategy(keyStrategy.getValue()).build();
+                }, p);
+    }
+
+
     private static boolean moveAppDir() throws Exception {
         var path = SHELL.view().findProgram("bw");
         return OsType.ofLocal() != OsType.LINUX
@@ -48,8 +114,79 @@ public class BitwardenPasswordManager implements PasswordManager {
                 || !path.get().toString().contains("snap");
     }
 
+    private static void sync() throws Exception {
+        // Copy existing file if possible to retain configuration. Only once per session
+        copyConfigIfNeeded();
+
+        if (!loginOrUnlock()) {
+            return;
+        }
+
+        getOrStartShell().command(CommandBuilder.of().add("bw", "sync")).execute();
+    }
+
+    private static void copyConfigIfNeeded() {
+        if (copied) {
+            return;
+        }
+
+        var cacheDataFile = AppCache.getBasePath().resolve("data.json");
+        var def = getDefaultConfigPath();
+        if (Files.exists(def)) {
+            try {
+                var defIsNewer = Files.getLastModifiedTime(def).compareTo(Files.getLastModifiedTime(cacheDataFile)) > 0;
+                if (defIsNewer) {
+                    Files.copy(def, cacheDataFile, StandardCopyOption.REPLACE_EXISTING);
+                }
+            } catch (IOException e) {
+                ErrorEventFactory.fromThrowable(e).handle();
+            }
+        }
+        copied = true;
+    }
+
+    private static boolean loginOrUnlock() throws Exception {
+        var sc = getOrStartShell();
+        var command = sc.command(CommandBuilder.of().add("bw", "get", "item", "xpipe-test", "--nointeraction"));
+        var r = command.readStdoutAndStderr();
+        if (r[1].contains("You are not logged in")) {
+            var script = ShellScript.lines(
+                    moveAppDir()
+                            ? LocalShell.getDialect()
+                            .getSetEnvironmentVariableCommand(
+                                    "BITWARDENCLI_APPDATA_DIR",
+                                    AppCache.getBasePath().toString())
+                            : null,
+                    sc.getShellDialect().getEchoCommand("Log in into your Bitwarden account from the CLI:", false),
+                    "bw login");
+            TerminalLaunch.builder()
+                    .title("Bitwarden login")
+                    .localScript(script)
+                    .logIfEnabled(false)
+                    .preferTabs(false)
+                    .pauseOnExit(true)
+                    .launch();
+            return false;
+        }
+
+        if (r[1].contains("Vault is locked")) {
+            var pw = AskpassAlert.queryRaw("Unlock vault with your Bitwarden master password", null, false);
+            if (pw.getSecret() == null) {
+                return false;
+            }
+            var cmd = sc.command(CommandBuilder.of()
+                    .add("bw", "unlock", "--raw", "--passwordenv", "BW_PASSWORD")
+                    .fixedEnvironment("BW_PASSWORD", pw.getSecret().getSecretValue()));
+            cmd.sensitive();
+            var out = cmd.readStdoutOrThrow();
+            sc.view().setSensitiveEnvironmentVariable("BW_SESSION", out);
+        }
+
+        return true;
+    }
+
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public synchronized Result query(String key) {
         try {
             CommandSupport.isInLocalPathOrThrow("Bitwarden CLI", "bw");
         } catch (Exception e) {
@@ -60,76 +197,48 @@ public class BitwardenPasswordManager implements PasswordManager {
         }
 
         // Copy existing file if possible to retain configuration. Only once per session
-        if (!copied) {
-            var cacheDataFile = AppCache.getBasePath().resolve("data.json");
-            var def = getDefaultConfigPath();
-            if (Files.exists(def)) {
-                try {
-                    Files.copy(def, cacheDataFile, StandardCopyOption.REPLACE_EXISTING);
-                } catch (IOException e) {
-                    ErrorEventFactory.fromThrowable(e).handle();
-                }
-                copied = true;
-            }
-        }
+        copyConfigIfNeeded();
 
         try {
-            var sc = getOrStartShell();
-            var command = sc.command(CommandBuilder.of().add("bw", "get", "item", "xpipe-test", "--nointeraction"));
-            var r = command.readStdoutAndStderr();
-            if (r[1].contains("You are not logged in")) {
-                var script = ShellScript.lines(
-                        moveAppDir()
-                                ? LocalShell.getDialect()
-                                        .getSetEnvironmentVariableCommand(
-                                                "BITWARDENCLI_APPDATA_DIR",
-                                                AppCache.getBasePath().toString())
-                                : null,
-                        sc.getShellDialect().getEchoCommand("Log in into your Bitwarden account from the CLI:", false),
-                        "bw login");
-                TerminalLaunch.builder()
-                        .title("Bitwarden login")
-                        .localScript(script)
-                        .logIfEnabled(false)
-                        .preferTabs(false)
-                        .pauseOnExit(true)
-                        .launch();
+            if (!loginOrUnlock()) {
                 return null;
             }
 
-            if (r[1].contains("Vault is locked")) {
-                var pw = AskpassAlert.queryRaw("Unlock vault with your Bitwarden master password", null, false);
-                if (pw.getSecret() == null) {
-                    return null;
-                }
-                var cmd = sc.command(CommandBuilder.of()
-                        .add("bw", "unlock", "--raw", "--passwordenv", "BW_PASSWORD")
-                        .fixedEnvironment("BW_PASSWORD", pw.getSecret().getSecretValue()));
-                cmd.sensitive();
-                var out = cmd.readStdoutOrThrow();
-                sc.view().setSensitiveEnvironmentVariable("BW_SESSION", out);
-            }
-
+            var sc = getOrStartShell();
             var cmd =
                     CommandBuilder.of().add("bw", "get", "item").addLiteral(key).add("--nointeraction");
             var json = JacksonMapper.getDefault()
                     .readTree(sc.command(cmd).sensitive().readStdoutOrThrow());
-            var login = json.get("login");
-            if (login == null) {
-                throw ErrorEventFactory.expected(
-                        new IllegalArgumentException("No usable login found for item name " + key));
+
+            SshKey credentialSshKey;
+            var sshKey = json.get("sshKey");
+            if (sshKey != null) {
+                var privateKey = Optional.ofNullable(sshKey.get("privateKey")).map(jsonNode -> jsonNode.textValue()).orElse(null);
+                var publicKey = Optional.ofNullable(sshKey.get("publicKey")).map(jsonNode -> jsonNode.textValue()).orElse(null);
+                var fingerprint = Optional.ofNullable(sshKey.get("fingerprint")).map(jsonNode -> jsonNode.textValue()).orElse(null);
+                credentialSshKey = SshKey.of(fingerprint, publicKey, privateKey);
+            } else {
+                credentialSshKey = null;
             }
 
-            var user = login.required("username");
-            var password = login.required("password");
-            return new CredentialResult(user.isNull() ? null : user.asText(), InPlaceSecretValue.of(password.asText()));
+            Credentials creds;
+            var login = json.get("login");
+            if (login != null) {
+                var username = Optional.ofNullable(login.get("username")).map(jsonNode -> jsonNode.textValue()).orElse(null);
+                var password = Optional.ofNullable(login.get("password")).map(jsonNode -> jsonNode.textValue()).orElse(null);
+                creds = Credentials.of(username, password);
+            } else {
+                creds = null;
+            }
+
+            return Result.of(creds, credentialSshKey);
         } catch (Exception ex) {
             ErrorEventFactory.fromThrowable(ex).expected().handle();
             return null;
         }
     }
 
-    private Path getDefaultConfigPath() {
+    private static Path getDefaultConfigPath() {
         return switch (OsType.ofLocal()) {
             case OsType.Linux ignored -> {
                 if (System.getenv("XDG_CONFIG_HOME") != null) {
@@ -163,4 +272,9 @@ public class BitwardenPasswordManager implements PasswordManager {
     public String getWebsite() {
         return "https://bitwarden.com/";
     }
+
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.of(true, false, true, keyStrategy, getSocketLocation());
+    }
 }
diff --git a/app/src/main/java/io/xpipe/app/pwman/DashlanePasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/DashlanePasswordManager.java
index 267bd2d31..99987a324 100644
--- a/app/src/main/java/io/xpipe/app/pwman/DashlanePasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/DashlanePasswordManager.java
@@ -1,22 +1,50 @@
 package io.xpipe.app.pwman;
 
+import com.fasterxml.jackson.databind.JsonNode;
+import io.xpipe.app.comp.base.ButtonComp;
+import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.CommandSupport;
 import io.xpipe.app.process.ShellControl;
 import io.xpipe.app.process.ShellScript;
 import io.xpipe.app.terminal.TerminalLaunch;
-import io.xpipe.core.InPlaceSecretValue;
+import io.xpipe.app.util.ThreadHelper;
 import io.xpipe.core.JacksonMapper;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
+import javafx.application.Platform;
+import javafx.beans.property.Property;
+import javafx.beans.property.SimpleObjectProperty;
+import javafx.geometry.Insets;
+import javafx.scene.layout.Region;
+import lombok.Builder;
+import lombok.extern.jackson.Jacksonized;
+import org.kordamp.ikonli.javafx.FontIcon;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicReference;
 
 @JsonTypeName("dashlane")
+@Builder
+@Jacksonized
 public class DashlanePasswordManager implements PasswordManager {
 
     private static ShellControl SHELL;
 
+
+    @SuppressWarnings("unused")
+    public static OptionsBuilder createOptions(Property<DashlanePasswordManager> p) {
+        return new OptionsBuilder()
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true));
+    }
+
     private static synchronized ShellControl getOrStartShell() throws Exception {
         if (SHELL == null) {
             SHELL = ProcessControlProvider.get().createLocalProcessControl(true);
@@ -26,7 +54,7 @@ public class DashlanePasswordManager implements PasswordManager {
     }
 
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public synchronized Result query(String key) {
         try {
             CommandSupport.isInLocalPathOrThrow("Dashlane CLI", "dcli");
         } catch (Exception e) {
@@ -58,11 +86,9 @@ public class DashlanePasswordManager implements PasswordManager {
                     .addLiteral(key));
             var out = cmd.sensitive().readStdoutOrThrow();
             var tree = JacksonMapper.getDefault().readTree(out);
-            var login = tree.get("login");
-            var password = tree.get("password");
-            return new CredentialResult(
-                    login != null ? login.asText() : null,
-                    password != null ? InPlaceSecretValue.of(password.asText()) : null);
+            var login = Optional.ofNullable(tree.get("login")).map(JsonNode::textValue).orElse(null);
+            var password = Optional.ofNullable(tree.get("password")).map(JsonNode::textValue).orElse(null);
+            return Result.of(Credentials.of(login, password), null);
         } catch (Exception ex) {
             ErrorEventFactory.fromThrowable(ex).handle();
             return null;
@@ -78,4 +104,9 @@ public class DashlanePasswordManager implements PasswordManager {
     public String getWebsite() {
         return "https://www.dashlane.com/";
     }
+
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.none();
+    }
 }
diff --git a/app/src/main/java/io/xpipe/app/pwman/EnpassPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/EnpassPasswordManager.java
index 13bdd1025..f7713173a 100644
--- a/app/src/main/java/io/xpipe/app/pwman/EnpassPasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/EnpassPasswordManager.java
@@ -1,10 +1,12 @@
 package io.xpipe.app.pwman;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import io.xpipe.app.comp.base.ContextualFileReferenceChoiceComp;
 import io.xpipe.app.core.AppSystemInfo;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.CommandSupport;
 import io.xpipe.app.process.ShellControl;
@@ -13,7 +15,6 @@ import io.xpipe.app.secret.SecretPromptStrategy;
 import io.xpipe.app.storage.DataStorage;
 import io.xpipe.app.util.*;
 import io.xpipe.core.FilePath;
-import io.xpipe.core.InPlaceSecretValue;
 import io.xpipe.core.JacksonMapper;
 
 import javafx.application.Platform;
@@ -30,6 +31,7 @@ import lombok.extern.jackson.Jacksonized;
 import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;
 import java.util.UUID;
 import java.util.stream.Collectors;
 
@@ -44,6 +46,11 @@ public class EnpassPasswordManager implements PasswordManager {
     private static ShellControl SHELL;
     private final FilePath vaultPath;
 
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.none();
+    }
+
     private static synchronized ShellControl getOrStartShell() throws Exception {
         if (SHELL == null) {
             SHELL = ProcessControlProvider.get().createLocalProcessControl(true);
@@ -81,6 +88,8 @@ public class EnpassPasswordManager implements PasswordManager {
         return new OptionsBuilder()
                 .nameAndDescription("enpassVaultFile")
                 .addComp(comp, prop)
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
                 .bind(
                         () -> {
                             return EnpassPasswordManager.builder()
@@ -91,7 +100,7 @@ public class EnpassPasswordManager implements PasswordManager {
     }
 
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public synchronized Result query(String key) {
         try {
             CommandSupport.isInLocalPathOrThrow("Enpass CLI", "enpass-cli");
         } catch (Exception e) {
@@ -159,10 +168,9 @@ public class EnpassPasswordManager implements PasswordManager {
                             "Ambiguous item name, multiple password entries match: " + String.join(", ", matches)));
                 }
 
-                var login = json.get(0).required("login").asText();
-                var secret = json.get(0).required("password").asText();
-                return new CredentialResult(
-                        !login.isEmpty() ? login : null, !secret.isEmpty() ? InPlaceSecretValue.of(secret) : null);
+                var login = Optional.ofNullable(json.get(0).get("login")).map(JsonNode::textValue).orElse(null);
+                var secret = Optional.ofNullable(json.get(0).get("password")).map(JsonNode::textValue).orElse(null);
+                return Result.of(Credentials.of(login, secret), null);
             }
         } catch (Exception ex) {
             ErrorEventFactory.fromThrowable(ex).handle();
diff --git a/app/src/main/java/io/xpipe/app/pwman/HashicorpVaultPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/HashicorpVaultPasswordManager.java
new file mode 100644
index 000000000..fb27933ec
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/pwman/HashicorpVaultPasswordManager.java
@@ -0,0 +1,350 @@
+package io.xpipe.app.pwman;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeName;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import io.xpipe.app.comp.base.SecretFieldComp;
+import io.xpipe.app.comp.base.TextFieldComp;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.ext.ProcessControlProvider;
+import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
+import io.xpipe.app.process.*;
+import io.xpipe.app.secret.SecretQueryState;
+import io.xpipe.app.terminal.TerminalLaunch;
+import io.xpipe.app.util.AskpassAlert;
+import io.xpipe.app.util.HttpHelper;
+import io.xpipe.core.*;
+import javafx.beans.property.Property;
+import javafx.beans.property.SimpleObjectProperty;
+import javafx.beans.property.SimpleStringProperty;
+import lombok.Builder;
+import lombok.Getter;
+import lombok.ToString;
+import lombok.Value;
+import lombok.experimental.NonFinal;
+import lombok.extern.jackson.Jacksonized;
+
+import java.io.IOException;
+import java.net.URI;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.util.*;
+
+@Getter
+@Builder
+@ToString
+@Jacksonized
+@JsonTypeName("hashicorpVault")
+public class HashicorpVaultPasswordManager implements PasswordManager {
+
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "type")
+    public interface VaultAuth {
+
+        static List<Class<?>> getClasses() {
+            var l = new ArrayList<Class<?>>();
+            l.add(Existing.class);
+            l.add(Token.class);
+            l.add(AppRole.class);
+            return l;
+        }
+
+        String retrieveToken(HashicorpVaultPasswordManager pwman) throws Exception;
+
+        @JsonTypeName("existing")
+        @Value
+        @Jacksonized
+        @Builder
+        class Existing implements VaultAuth {
+
+            @SuppressWarnings("unused")
+            public static String getOptionsNameKey() {
+                return "hashicorpVaultAuthExisting";
+            }
+
+            @Override
+            public String retrieveToken(HashicorpVaultPasswordManager pwman) throws Exception {
+                var sc = getOrStartShell();
+                var script = ShellScript.lines(
+                        sc.getShellDialect().getSetEnvironmentVariableCommand("VAULT_ADDR", pwman.getVaultAddress()),
+                        pwman.getVaultNamespace() != null ?
+                                sc.getShellDialect().getSetEnvironmentVariableCommand("VAULT_NAMESPACE", pwman.getVaultNamespace()) : null,
+                        sc.getShellDialect().getEchoCommand(
+                                "Your current vault login is expired. Please log in again with your currently selected auth method. The proper environment variables for your vault have already been configured in this session. The command syntax for this is:",
+                                false),
+                        sc.getShellDialect().getEchoCommand("", false),
+                        sc.getShellDialect().getEchoCommand("vault login --method=<auth_method> [optional auth method specific parameters]", false)
+                );
+                var scriptFile = ScriptHelper.createExecScript(sc, script.toString());
+                TerminalLaunch.builder().localScript(ShellScript.of(sc.getShellDialect().terminalInitCommand(sc, scriptFile.toString(), false))).
+                        title("Vault login").pauseOnExit(false).launch();
+                return null;
+            }
+        }
+
+        @JsonTypeName("token")
+        @Value
+        @Jacksonized
+        @Builder
+        class Token implements VaultAuth {
+
+            @SuppressWarnings("unused")
+            public static String getOptionsNameKey() {
+                return "hashicorpVaultAuthToken";
+            }
+
+            @SuppressWarnings("unused")
+            public static OptionsBuilder createOptions(Property<Token> p) {
+                var token = new SimpleObjectProperty<>(p.getValue().getToken());
+                return new OptionsBuilder()
+                        .nameAndDescription("hashicorpVaultToken")
+                        .addComp(new SecretFieldComp(token, true).maxWidth(600), token)
+                        .nonNull()
+                        .bind(() -> {
+                            return Token.builder().token(token.get()).build();
+                        }, p);
+            }
+
+            InPlaceSecretValue token;
+
+            @Override
+            public String retrieveToken(HashicorpVaultPasswordManager pwman) throws Exception {
+                if (token == null) {
+                    return null;
+                }
+
+                return token.getSecretValue();
+            }
+        }
+
+        @JsonTypeName("appRole")
+        @Value
+        @Jacksonized
+        @Builder
+        class AppRole implements VaultAuth {
+
+            @SuppressWarnings("unused")
+            public static String getOptionsNameKey() {
+                return "hashicorpVaultAuthAppRole";
+            }
+
+            @SuppressWarnings("unused")
+            public static OptionsBuilder createOptions(Property<AppRole> p) {
+                var roleId = new SimpleStringProperty(p.getValue().getRoleId());
+                var secretId = new SimpleObjectProperty<>(p.getValue().getSecretId());
+                return new OptionsBuilder()
+                        .nameAndDescription("hashicorpVaultRoleId")
+                        .addString(roleId)
+                        .nonNull()
+                        .nameAndDescription("hashicorpVaultSecretId")
+                        .addComp(new SecretFieldComp(secretId, true).maxWidth(600), secretId)
+                        .nonNull()
+                        .bind(
+                                () -> {
+                                    return AppRole.builder().roleId(roleId.get()).secretId(secretId.get()).build();
+                                },
+                                p);
+            }
+
+            String roleId;
+            InPlaceSecretValue secretId;
+
+            @Override
+            public String retrieveToken(HashicorpVaultPasswordManager pwman) throws Exception {
+                if (roleId == null || secretId == null) {
+                    return null;
+                }
+
+                var json = JsonNodeFactory.instance.objectNode();
+                json.put("role_id", roleId);
+                json.put("secret_id", secretId.getSecretValue());
+                var req = HttpRequest.newBuilder().uri(URI.create(pwman.getVaultAddress() + "/v1/auth/approle/login"));
+                req.POST(HttpRequest.BodyPublishers.ofString(json.toPrettyString()));
+                if (pwman.getVaultNamespace() != null) {
+                    req.header("X-Vault-Namespace", pwman.getVaultNamespace());
+                }
+
+                var res = HttpHelper.client().send(req.build(), HttpResponse.BodyHandlers.ofString());
+                if (res.statusCode() >= 400) {
+                    throw new IOException(res.body());
+                }
+
+                var resJson = JacksonMapper.getDefault().readTree(res.body());
+                if (!resJson.isObject()) {
+                    throw new IOException(res.body());
+                }
+
+                var auth = resJson.get("auth");
+                if (auth == null || auth.get("client_token") == null) {
+                    throw new IOException(res.body());
+                }
+
+                return auth.required("client_token").textValue();
+            }
+        }
+}
+
+        private static ShellControl SHELL;
+
+    private final String vaultAddress;
+    private final String vaultNamespace;
+    private final VaultAuth vaultAuth;
+
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.none();
+    }
+
+    @SuppressWarnings("unused")
+    public static OptionsBuilder createOptions(Property<HashicorpVaultPasswordManager> p) {
+        var vaultAddress = new SimpleStringProperty(p.getValue().getVaultAddress());
+        var vaultNamespace = new SimpleStringProperty(p.getValue().getVaultNamespace());
+        var vaultAuth = new SimpleObjectProperty<>(p.getValue().getVaultAuth() != null ? p.getValue().getVaultAuth() : new VaultAuth.Existing());
+
+        return new OptionsBuilder()
+                .nameAndDescription("hashicorpVaultAddress")
+                .addComp(
+                        new TextFieldComp(vaultAddress)
+                                .apply(struc -> {
+                                    struc.setPromptText("https://my.vault.example.com:8200");
+                                })
+                                .maxWidth(600),
+                        vaultAddress)
+                .nonNull()
+                .nameAndDescription("hashicorpVaultNamespace")
+                .addString(vaultNamespace)
+                .nameAndDescription("hashicorpVaultAuthType")
+                .sub(OptionsChoiceBuilder.builder().available(VaultAuth.getClasses()).property(vaultAuth).build().build(), vaultAuth)
+                .nonNull()
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
+                .bind(
+                        () -> {
+                            return HashicorpVaultPasswordManager.builder()
+                                    .vaultAddress(vaultAddress.get())
+                                    .vaultNamespace(vaultNamespace.get())
+                                    .vaultAuth(vaultAuth.get())
+                                    .build();
+                        },
+                        p);
+    }
+
+    private static synchronized ShellControl getOrStartShell() throws Exception {
+        if (SHELL == null) {
+            SHELL = ProcessControlProvider.get().createLocalProcessControl(true);
+        }
+        SHELL.start();
+        return SHELL;
+    }
+
+    private boolean isLoginValid() throws Exception {
+        var sc = getOrStartShell();
+        var b = CommandBuilder.of().add("vault", "token", "lookup", "-non-interactive", "--format=json");
+        if (getVaultNamespace() != null) {
+            b.fixedEnvironment("VAULT_NAMESPACE", getVaultNamespace());
+        }
+        b.fixedEnvironment("VAULT_ADDR", getVaultAddress());
+        var valid = sc.command(b).sensitive().executeAndCheck();
+        return valid;
+    }
+
+    private boolean login() throws Exception {
+        if (isLoginValid()) {
+            return true;
+        }
+
+        var token = vaultAuth.retrieveToken(HashicorpVaultPasswordManager.this);
+        if (token == null) {
+            return false;
+        }
+
+        var b = CommandBuilder.of().add("vault", "login", "-non-interactive");
+        if (vaultNamespace != null) {
+            b.fixedEnvironment("VAULT_NAMESPACE", vaultNamespace);
+        }
+        b.addLiteral(token);
+        b.fixedEnvironment("VAULT_ADDR", vaultAddress);
+        getOrStartShell().command(b).sensitive().execute();
+        return true;
+    }
+
+    @Override
+    public synchronized Result query(String key) {
+        if (vaultAddress == null || vaultAuth == null) {
+            return null;
+        }
+
+        try {
+            CommandSupport.isInLocalPathOrThrow("Hashicorp Vault CLI", "vault");
+        } catch (Exception e) {
+            ErrorEventFactory.fromThrowable(e)
+                    .expected()
+                    .link("https://developer.hashicorp.com/vault/docs/commands")
+                    .handle();
+            return null;
+        }
+
+        try {
+            if (!login()) {
+                return null;
+            }
+
+            var keySplit = key.split(":", 2);
+            if (keySplit.length != 2 || keySplit[0].isEmpty() || keySplit[1].isEmpty()) {
+                throw ErrorEventFactory.expected(new IllegalArgumentException("Invalid secret reference format"));
+            }
+
+            var secretPath = keySplit[0];
+            var keys = Arrays.stream(keySplit[1].split(",")).toList();
+
+            var b = CommandBuilder.of().add("vault", "read", "--format=json", "-non-interactive");
+            if (vaultNamespace != null) {
+                b.fixedEnvironment("VAULT_NAMESPACE", vaultNamespace);
+            }
+            b.addLiteral(secretPath);
+            b.fixedEnvironment("VAULT_ADDR", vaultAddress);
+
+            var out = getOrStartShell().command(b).sensitive().readStdoutOrThrow();
+            var json = JacksonMapper.getDefault().readTree(out);
+            var data = json.get("data");
+            if (data == null) {
+                return null;
+            }
+
+            var subData = data.get("data");
+            if (subData == null) {
+                return null;
+            }
+
+            if (keys.size() > 1) {
+                var username = Optional.ofNullable(subData.get(keys.getFirst())).map(JsonNode::textValue).orElse(null);
+                var password = Optional.ofNullable(subData.get(keys.get(1))).map(JsonNode::textValue).orElse(null);
+                var creds = Credentials.of(username, password);
+                return Result.of(creds, null);
+            } else {
+                var password = Optional.ofNullable(subData.get(keys.getFirst())).map(JsonNode::textValue).orElse(null);
+                var creds = Credentials.of(null, password);
+                return Result.of(creds, null);
+            }
+        } catch (Exception e) {
+            ErrorEventFactory.fromThrowable(e).handle();
+            return null;
+        }
+    }
+
+    @Override
+    public String getKeyPlaceholder() {
+        return AppI18n.get("hashicorpVaultPlaceholder");
+    }
+
+    @Override
+    public String getWebsite() {
+        return "https://www.hashicorp.com/en/products/vault";
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/pwman/KeePassXcPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/KeePassXcPasswordManager.java
index 54846c623..fb0ed7714 100644
--- a/app/src/main/java/io/xpipe/app/pwman/KeePassXcPasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/KeePassXcPasswordManager.java
@@ -6,7 +6,9 @@ import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.platform.DerivedObservableList;
 import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
 import io.xpipe.app.prefs.AppPrefs;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.LocalShell;
 import io.xpipe.app.util.*;
 import io.xpipe.core.OsType;
@@ -14,6 +16,7 @@ import io.xpipe.core.OsType;
 import javafx.application.Platform;
 import javafx.beans.binding.Bindings;
 import javafx.beans.property.Property;
+import javafx.beans.property.SimpleObjectProperty;
 import javafx.collections.FXCollections;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
@@ -38,9 +41,29 @@ public class KeePassXcPasswordManager implements PasswordManager {
     private static KeePassXcProxyClient client;
 
     private final List<KeePassXcAssociationKey> associationKeys;
+    private final PasswordManagerKeyStrategy keyStrategy;
+
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.of(false, false, false, keyStrategy, null);
+    }
 
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(Property<KeePassXcPasswordManager> p) {
+        List<Class<?>> strategyList = OsType.ofLocal() == OsType.WINDOWS ?
+                List.of(PasswordManagerKeyStrategy.KeePassXcOpenSshAgent.class, PasswordManagerKeyStrategy.KeePassXcPageant.class) :
+                List.of(PasswordManagerKeyStrategy.KeePassXcOpenSshAgent.class);
+        var keyStrategy = new SimpleObjectProperty<>(p.getValue().getKeyStrategy());
+        var keyStrategyChoice = OptionsChoiceBuilder.builder()
+                .allowNull(true)
+                .available(strategyList)
+                .property(keyStrategy)
+                .customConfiguration(PasswordManagerKeyStrategy.OptionsConfig.builder()
+                        .defaultSocketLocation(null)
+                        .allowSocketChoice(false)
+                        .build())
+                .build();
+
         var prop = FXCollections.<KeePassXcAssociationKey>observableArrayList();
         p.subscribe(keePassXcManager -> {
             DerivedObservableList.wrap(prop, true)
@@ -78,9 +101,13 @@ public class KeePassXcPasswordManager implements PasswordManager {
                 }))
                 .hide(Bindings.isEmpty(prop))
                 .addProperty(prop)
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
+                .nameAndDescription("passwordManagerKeyStrategy")
+                .sub(keyStrategyChoice.build(), keyStrategy)
                 .bind(
                         () -> {
-                            return new KeePassXcPasswordManager(prop);
+                            return new KeePassXcPasswordManager(prop, keyStrategy.getValue());
                         },
                         p);
     }
@@ -228,7 +255,7 @@ public class KeePassXcPasswordManager implements PasswordManager {
     }
 
     @Override
-    public CredentialResult retrieveCredentials(String key) {
+    public Result query(String key) {
         try {
             var hasScheme = Pattern.compile("^\\w+://").matcher(key).find();
             var fixedKey = hasScheme ? key : "https://" + key;
@@ -241,7 +268,7 @@ public class KeePassXcPasswordManager implements PasswordManager {
                             .getAssociationKeys()
                     : associationKeys;
             var credentials = client.getCredentials(effectiveKeys, fixedKey);
-            return credentials;
+            return Result.of(credentials, null);
         } catch (Exception e) {
             ErrorEventFactory.fromThrowable(e).handle();
             return null;
diff --git a/app/src/main/java/io/xpipe/app/pwman/KeePassXcProxyClient.java b/app/src/main/java/io/xpipe/app/pwman/KeePassXcProxyClient.java
index eb2ca92f8..195a853d4 100644
--- a/app/src/main/java/io/xpipe/app/pwman/KeePassXcProxyClient.java
+++ b/app/src/main/java/io/xpipe/app/pwman/KeePassXcProxyClient.java
@@ -275,7 +275,7 @@ public class KeePassXcProxyClient {
         throw new IllegalStateException("Login query failed for an unknown reason");
     }
 
-    public PasswordManager.CredentialResult getCredentials(List<KeePassXcAssociationKey> associationKeys, String key)
+    public PasswordManager.Credentials getCredentials(List<KeePassXcAssociationKey> associationKeys, String key)
             throws IOException {
         var message = getLoginsMessage(associationKeys, key);
         var tree = JacksonMapper.getDefault().readTree(message);
@@ -295,11 +295,9 @@ public class KeePassXcProxyClient {
         }
 
         var object = (ObjectNode) tree.required("entries").get(0);
-        var usernameField = object.required("login").asText();
-        var passwordField = object.required("password").asText();
-        return new PasswordManager.CredentialResult(
-                usernameField.isEmpty() ? null : usernameField,
-                passwordField.isEmpty() ? null : InPlaceSecretValue.of(passwordField));
+        var login = Optional.ofNullable(object.get("login")).map(JsonNode::textValue).orElse(null);
+        var secret = Optional.ofNullable(object.get("password")).map(JsonNode::textValue).orElse(null);
+        return PasswordManager.Credentials.of(login, secret);
     }
 
     /**
diff --git a/app/src/main/java/io/xpipe/app/pwman/KeeperPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/KeeperPasswordManager.java
index 814dba92d..96c5a9c64 100644
--- a/app/src/main/java/io/xpipe/app/pwman/KeeperPasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/KeeperPasswordManager.java
@@ -1,9 +1,13 @@
 package io.xpipe.app.pwman;
 
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.core.AppSystemInfo;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.*;
 import io.xpipe.app.secret.SecretManager;
 import io.xpipe.app.secret.SecretPromptStrategy;
@@ -13,7 +17,7 @@ import io.xpipe.app.util.AskpassAlert;
 import io.xpipe.core.*;
 
 import javafx.beans.property.Property;
-import javafx.beans.property.SimpleBooleanProperty;
+import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.property.SimpleStringProperty;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
@@ -23,12 +27,13 @@ import com.fasterxml.jackson.databind.JsonNode;
 import lombok.Builder;
 import lombok.Getter;
 import lombok.ToString;
+import lombok.Value;
 import lombok.extern.jackson.Jacksonized;
 
+import java.nio.file.Path;
 import java.time.Duration;
-import java.util.List;
-import java.util.Random;
-import java.util.UUID;
+import java.util.*;
+import java.util.stream.Collectors;
 
 @JsonTypeName("keeper")
 @Getter
@@ -37,11 +42,376 @@ import java.util.UUID;
 @Jacksonized
 public class KeeperPasswordManager implements PasswordManager {
 
+    private static Path getSocketLocation() {
+        var socket = switch (OsType.ofLocal()) {
+            case OsType.Linux ignored -> AppSystemInfo.ofLinux().getConfigDir().resolve("Keeper Password Manager", "keeper-ssh-agent.sock");
+            case OsType.MacOs macOs -> AppSystemInfo.ofMacOs().getUserHome().resolve("Library", "Application Support", "Keeper Password Manager", "keeper-ssh-agent.sock");
+            case OsType.Windows windows -> null;
+        };
+        return socket;
+    }
+
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        var socket = getSocketLocation();
+        return PasswordManagerKeyConfiguration.of(true, true, true, keyStrategy, socket);
+    }
+
+    private final PasswordManagerKeyStrategy keyStrategy;
+
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "type")
+    public interface KeeperAuth {
+
+        static List<Class<?>> getClasses() {
+            var l = new ArrayList<Class<?>>();
+            l.add(None.class);
+            l.add(Sms.class);
+            l.add(AuthenticatorApp.class);
+            l.add(SecurityKey.class);
+            l.add(Other.class);
+            return l;
+        }
+
+
+        default List<String> getTotpDurationValues() {
+            var values = List.of("login", "12_hours", "24_hours", "30_days", "forever");
+            return values;
+        }
+
+        String constructKeeperInput(KeeperPasswordManager passwordManager, SecretValue password) throws Exception;
+
+        Duration getCacheDuration();
+
+        Duration getCommandTimeout();
+
+        String cleanMessage(String output);
+
+        @JsonTypeName("sms")
+        @Value
+        @Jacksonized
+        @Builder
+        class Sms implements KeeperAuth {
+
+            @SuppressWarnings("unused")
+            public static OptionsBuilder createOptions(Property<Sms> p) {
+                var duration = new SimpleStringProperty(p.getValue().getTotpDuration());
+                return new OptionsBuilder()
+                        .name("keeperTotpDuration")
+                        .description(AppI18n.observable(
+                                "keeperTotpDurationDescription", "login | 12_hours | 24_hours | 30_days | forever"))
+                        .addString(duration)
+                        .bind(
+                                () -> {
+                                    return Sms.builder()
+                                            .totpDuration(duration.get())
+                                            .build();
+                                },
+                                p);
+            }
+
+            String totpDuration;
+
+            private int getTotpDurationIndex() {
+                var values = getTotpDurationValues();
+                var index = totpDuration != null ? values.indexOf(totpDuration) : -1;
+                return index;
+            }
+
+            private boolean sendInitialSms(SecretValue password) throws Exception {
+                var sc = getOrStartShell();
+                var b = CommandBuilder.of()
+                        .add(getExecutable(), "get")
+                        .addLiteral("xpipe-test")
+                        .add("--password")
+                        .addLiteral(password.getSecretValue());
+                var file = sc.getSystemTemporaryDirectory().join("keeper" + Math.abs(new Random().nextInt()) + ".txt");
+                var input = """
+                            
+                            1
+                            -
+                            q
+                            """;
+                sc.view().writeTextFile(file, input);
+
+                var fullB = CommandBuilder.of()
+                        .add(sc.getShellDialect() == ShellDialects.CMD ? "type" : "cat")
+                        .addFile(file)
+                        .add("|")
+                        .add(b);
+
+                var command = sc.command(fullB);
+                command.killOnTimeout(CountDown.of().start(30_000));
+                command.sensitive();
+                var success = command.executeAndCheck();
+                // A fail indicates the query went through but the entry was not found
+                if (!success) {
+                    return false;
+                } else {
+                    return true;
+                }
+            }
+
+            @Override
+            public String constructKeeperInput(KeeperPasswordManager passwordManager, SecretValue password) throws Exception {
+                var sent = sendInitialSms(password);
+
+                var index = getTotpDurationIndex();
+                if (!sent || (passwordManager.isHasCompletedRequestInSession() && index > 0)) {
+                    var input = """
+
+                          1
+
+                          """;
+                    return input;
+                } else {
+                    var totp = AskpassAlert.queryRaw("Enter Keeper Commander SMS Code", null, true);
+                    if (totp.getState() != SecretQueryState.NORMAL) {
+                        return null;
+                    }
+
+                    var input = """
+
+                                1%s
+                                %s
+
+                                """.formatted(
+                            index != -1 ? "\n" + getTotpDurationValues().get(index) : "",
+                            totp.getSecret().getSecretValue());
+                    return input;
+                }
+            }
+
+            @Override
+            public Duration getCacheDuration() {
+                return getTotpDurationIndex() < 1 ? Duration.ofDays(1) : Duration.ofSeconds(30);
+            }
+
+            @Override
+            public Duration getCommandTimeout() {
+                return Duration.ofSeconds(25);
+            }
+
+            @Override
+            public String cleanMessage(String output) {
+                return output
+                        .replaceFirst("""
+                             Select your 2FA method:
+                               1. Send SMS Code.+
+                               q. Cancel login
+                             """, "")
+                        .replace(" Invalid entry, additional factors of authentication shown may be configured if not currently enabled.", "")
+                        .replace("""
+                                2FA Code Duration: Require Every Login.
+                                To change duration: 2fa_duration=login|12_hours|24_hours|30_days|forever
+                                """, "");
+            }
+        }
+
+        @JsonTypeName("authenticatorApp")
+        @Value
+        @Jacksonized
+        @Builder
+        class AuthenticatorApp implements KeeperAuth {
+
+            @SuppressWarnings("unused")
+            public static OptionsBuilder createOptions(Property<AuthenticatorApp> p) {
+                var duration = new SimpleStringProperty(p.getValue().getTotpDuration());
+                return new OptionsBuilder()
+                        .name("keeperTotpDuration")
+                        .description(AppI18n.observable(
+                                "keeperTotpDurationDescription", "login | 12_hours | 24_hours | 30_days | forever"))
+                        .addString(duration)
+                        .bind(
+                                () -> {
+                                    return AuthenticatorApp.builder()
+                                            .totpDuration(duration.get())
+                                            .build();
+                                },
+                                p);
+            }
+
+            String totpDuration;
+
+            private int getTotpDurationIndex() {
+                var values = getTotpDurationValues();
+                var index = totpDuration != null ? values.indexOf(totpDuration) : -1;
+                return index;
+            }
+
+            @Override
+            public String constructKeeperInput(KeeperPasswordManager passwordManager, SecretValue password) {
+                var index = getTotpDurationIndex();
+                if (passwordManager.isHasCompletedRequestInSession() && index > 0) {
+                    var input = """
+
+                          1
+
+                          """;
+                    return input;
+                } else {
+                    var totp = AskpassAlert.queryRaw("Enter Keeper 2FA Code", null, true);
+                    if (totp.getState() != SecretQueryState.NORMAL) {
+                        return null;
+                    }
+
+                    var input = """
+
+                                1%s
+                                %s
+
+                                """.formatted(
+                            index != -1 ? "\n" + getTotpDurationValues().get(index) : "",
+                            totp.getSecret().getSecretValue());
+                    return input;
+                }
+            }
+
+            @Override
+            public Duration getCacheDuration() {
+                return getTotpDurationIndex() < 1 ? Duration.ofDays(1) : Duration.ofSeconds(30);
+            }
+
+            @Override
+            public Duration getCommandTimeout() {
+                return Duration.ofSeconds(25);
+            }
+
+            @Override
+            public String cleanMessage(String output) {
+                return output.replace("""
+                             Select your 2FA method:
+                               1. TOTP (Google and Microsoft Authenticator) \s
+                               q. Cancel login
+                             """, "")
+                        .replace(
+                        """
+                        Selection: Invalid entry, additional factors of authentication shown may be configured if not currently enabled.
+                        Selection:\s
+                        2FA Code Duration: Require Every Login.
+                        To change duration: 2fa_duration=login|12_hours|24_hours|30_days|forever
+                        """, "")
+                        .replace(
+                        """
+                        This account requires 2FA Authentication
+
+                          1. TOTP (Google and Microsoft Authenticator) \s
+                          q. Quit login attempt and return to Commander prompt
+                        """, "");
+            }
+
+        }
+
+        @JsonTypeName("securityKey")
+        @Value
+        @Jacksonized
+        @Builder
+        class SecurityKey implements KeeperAuth {
+
+            @Override
+            public String constructKeeperInput(KeeperPasswordManager passwordManager, SecretValue password) {
+                var input = """
+
+                          1
+
+                          """;
+                return input;
+            }
+
+            @Override
+            public Duration getCacheDuration() {
+                return Duration.ofDays(1);
+            }
+
+            @Override
+            public Duration getCommandTimeout() {
+                return null;
+            }
+
+            @Override
+            public String cleanMessage(String output) {
+                return output.replace("""
+                               Select your 2FA method:
+                                 1. WebAuthN (FIDO2 Security Key) \s
+                                 q. Cancel login
+                               """, "")
+                        .replace(" Invalid entry, additional factors of authentication shown may be configured if not currently enabled.", "");
+            }
+        }
+
+
+        @JsonTypeName("other")
+        @Value
+        @Jacksonized
+        @Builder
+        class Other implements KeeperAuth {
+
+            @SuppressWarnings("unused")
+            public static String getOptionsNameKey() {
+                return "keeperOtherAuth";
+            }
+
+            @Override
+            public Duration getCommandTimeout() {
+                return null;
+            }
+
+            @Override
+            public String cleanMessage(String output) {
+                return output;
+            }
+
+            @Override
+            public String constructKeeperInput(KeeperPasswordManager passwordManager, SecretValue password) {
+                var input = """
+
+                          1
+
+                          """;
+                return input;
+            }
+
+            @Override
+            public Duration getCacheDuration() {
+                return Duration.ofDays(1);
+            }
+        }
+
+        @JsonTypeName("none")
+        @Value
+        @Jacksonized
+        @Builder
+        class None implements KeeperAuth {
+
+            @Override
+            public Duration getCommandTimeout() {
+                return Duration.ofSeconds(25);
+            }
+
+            @Override
+            public String cleanMessage(String output) {
+                return output;
+            }
+
+            @Override
+            public String constructKeeperInput(KeeperPasswordManager passwordManager, SecretValue password) {
+                var input = """
+
+                          1
+
+                          """;
+                return input;
+            }
+
+            @Override
+            public Duration getCacheDuration() {
+                return Duration.ofSeconds(30);
+            }
+        }
+    }
+
     private static final UUID KEEPER_PASSWORD_ID = UUID.randomUUID();
     private static ShellControl SHELL;
-    private final Boolean mfa;
-    private final String totpDuration;
-
+    private final KeeperAuth twoFactorAuth;
     @JsonIgnore
     private boolean hasCompletedRequestInSession;
 
@@ -53,35 +423,50 @@ public class KeeperPasswordManager implements PasswordManager {
         return SHELL;
     }
 
-    private String getExecutable(ShellControl sc) {
+    private static String getExecutable() {
         return OsType.ofLocal() == OsType.WINDOWS ? "keeper-commander" : "keeper";
     }
 
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(Property<KeeperPasswordManager> p) {
-        var mfa = new SimpleBooleanProperty(
-                p.getValue().getMfa() != null ? p.getValue().getMfa() : false);
-        var duration = new SimpleStringProperty(p.getValue().getTotpDuration());
+        var keyStrategy = new SimpleObjectProperty<>(p.getValue().getKeyStrategy());
+        var mfa = new SimpleObjectProperty<>(p.getValue().getTwoFactorAuth() != null ? p.getValue().getTwoFactorAuth() : new KeeperAuth.None());
+
+        var choice = OptionsChoiceBuilder.builder()
+                .allowNull(false)
+                .available(KeeperAuth.getClasses())
+                .property(mfa)
+                .build();
+        var keyStrategyChoice = OptionsChoiceBuilder.builder()
+                .allowNull(true)
+                .available(List.of(PasswordManagerKeyStrategy.Agent.class, PasswordManagerKeyStrategy.Inline.class))
+                .property(keyStrategy)
+                .customConfiguration(PasswordManagerKeyStrategy.OptionsConfig.builder()
+                        .defaultSocketLocation(getSocketLocation())
+                        .allowSocketChoice(false)
+                        .build())
+                .build();
+
+
         return new OptionsBuilder()
-                .nameAndDescription("keeperUseMfa")
-                .addToggle(mfa)
-                .name("keeperTotpDuration")
-                .description(AppI18n.observable(
-                        "keeperTotpDurationDescription", "login | 12_hours | 24_hours | 30_days | forever"))
-                .addString(duration)
-                .hide(mfa.not())
+                .nameAndDescription("keeper2fa")
+                .sub(choice.build(), mfa)
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
+                .nameAndDescription("passwordManagerKeyStrategy")
+                .sub(keyStrategyChoice.build(), keyStrategy)
                 .bind(
                         () -> {
                             return KeeperPasswordManager.builder()
-                                    .mfa(mfa.get())
-                                    .totpDuration(duration.get())
+                                    .twoFactorAuth(mfa.get())
+                                    .keyStrategy(keyStrategy.get())
                                     .build();
                         },
                         p);
     }
 
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public synchronized Result query(String key) {
         // The copy UID button copies the whole URL in the Keeper UI. Why? ...
         key = key.replaceFirst("https://\\w+\\.\\w+/vault/#detail/", "");
 
@@ -100,7 +485,7 @@ public class KeeperPasswordManager implements PasswordManager {
             if (!sc.view().fileExists(config)) {
                 var script = ShellScript.lines(
                         sc.getShellDialect().getEchoCommand("Log in into your Keeper account from the CLI:", false),
-                        getExecutable(sc) + " login");
+                        getExecutable() + " login");
                 TerminalLaunch.builder()
                         .title("Keeper login")
                         .localScript(script)
@@ -128,41 +513,19 @@ public class KeeperPasswordManager implements PasswordManager {
             }
 
             var b = CommandBuilder.of()
-                    .add(getExecutable(sc), "get")
+                    .add(getExecutable(), "get")
                     .addLiteral(key)
                     .add("--format", "json", "--unmask")
                     .add("--password")
                     .addLiteral(r.getSecretValue());
             FilePath file = sc.getSystemTemporaryDirectory().join("keeper" + Math.abs(new Random().nextInt()) + ".txt");
-            if (mfa != null && mfa) {
-                var index = getTotpDurationIndex();
-                if (hasCompletedRequestInSession && index > 0) {
-                    var input = """
 
-                          1
-
-                          """;
-                    sc.view().writeTextFile(file, input);
-                } else {
-                    var totp = AskpassAlert.queryRaw("Enter Keeper 2FA Code", null, true);
-                    if (totp.getState() != SecretQueryState.NORMAL) {
-                        return null;
-                    }
-
-                    var input = """
-
-                                1%s
-                                %s
-
-                                """.formatted(
-                                    index != -1 ? "\n" + getTotpDurationValues().get(index) : "",
-                                    totp.getSecret().getSecretValue());
-                    sc.view().writeTextFile(file, input);
-                }
-            } else {
-                var input = "\n";
-                sc.view().writeTextFile(file, input);
+            var effectiveTwoFactor = twoFactorAuth != null ? twoFactorAuth : new KeeperAuth.None();
+            var input = effectiveTwoFactor.constructKeeperInput(this, r);
+            if (input == null) {
+                return null;
             }
+            sc.view().writeTextFile(file, input);
 
             var fullB = CommandBuilder.of()
                     .add(sc.getShellDialect() == ShellDialects.CMD ? "type" : "cat")
@@ -171,7 +534,11 @@ public class KeeperPasswordManager implements PasswordManager {
                     .add(b);
             var queryCommand = sc.command(fullB);
             queryCommand.sensitive();
-            queryCommand.killOnTimeout(CountDown.of().start(25_000));
+
+            if (effectiveTwoFactor.getCommandTimeout() != null) {
+                var timeout = effectiveTwoFactor.getCommandTimeout().toMillis();
+                queryCommand.killOnTimeout(CountDown.of().start(timeout));
+            }
 
             var result = queryCommand.readStdoutAndStderr();
             var exitCode = queryCommand.getExitCode();
@@ -179,26 +546,11 @@ public class KeeperPasswordManager implements PasswordManager {
             sc.view().deleteFileIfPossible(file);
 
             var out = result[0]
-                    .replace("\r\n", "\n")
-                    .replace("""
-                             Select your 2FA method:
-                               1. TOTP (Google and Microsoft Authenticator) \s
-                               q. Cancel login
-                             """, "")
-                    .replace("""
-                      Selection: Invalid entry, additional factors of authentication shown may be configured if not currently enabled.
-                      Selection:\s
-                      2FA Code Duration: Require Every Login.
-                      To change duration: 2fa_duration=login|12_hours|24_hours|30_days|forever
-                      """, "")
-                    .replace("""
-                             This account requires 2FA Authentication
-
-                               1. TOTP (Google and Microsoft Authenticator) \s
-                               q. Quit login attempt and return to Commander prompt
-                             """, "")
-                    .replace("Selection:", "")
+                    .replace("\r\n", "\n");
+            out = effectiveTwoFactor.cleanMessage(out);
+            out = out.replace("Selection:", "")
                     .strip();
+
             var err = result[1]
                     .replace("\r\n", "\n")
                     .replace("EOF when reading a line", "")
@@ -211,6 +563,8 @@ public class KeeperPasswordManager implements PasswordManager {
             }
 
             var outPrefix = jsonStart <= 0 ? out : out.substring(0, jsonStart);
+            outPrefix = outPrefix.lines().filter(s -> !s.isBlank()).map(s -> s.strip()).collect(Collectors.joining("\n"));
+
             var outJson = jsonStart <= 0
                     ? (jsonEnd != -1 ? out.substring(0, jsonEnd) : out)
                     : (jsonEnd != -1 ? out.substring(jsonStart, jsonEnd) : out.substring(jsonStart));
@@ -269,43 +623,44 @@ public class KeeperPasswordManager implements PasswordManager {
                     return null;
                 }
 
-                return new CredentialResult(login, password != null ? InPlaceSecretValue.of(password) : null);
+                var creds = Credentials.of(login, password);
+                return Result.of(creds, null);
             }
 
-            String login = null;
-            String password = null;
-            for (JsonNode field : fields) {
-                var type = field.required("type").asText();
-                if (type.equals("login")) {
-                    var v = field.required("value");
-                    if (v.size() > 0) {
-                        login = v.get(0).asText();
-                    }
-                }
-                if (type.equals("password")) {
-                    var v = field.required("value");
-                    if (v.size() > 0) {
-                        password = v.get(0).asText();
-                    }
-                }
+            var username = Optional.ofNullable(getValue(tree, "login")).map(n -> n.size() > 0 ? n.get(0).textValue() : null).orElse(null);
+            var password = Optional.ofNullable(getValue(tree, "password")).map(n -> n.size() > 0 ? n.get(0).textValue() : null).orElse(null);
+            var creds = Credentials.of(username, password);
+
+            var keyPairNode = getValue(tree, "keyPair");
+            SshKey sshKey = null;
+            if (keyPairNode != null && keyPairNode.size() > 0) {
+                var publicKey = Optional.ofNullable(keyPairNode.get(0).get("publicKey")).map(JsonNode::textValue).orElse(null);
+                var privateKey = Optional.ofNullable(keyPairNode.get(0).get("privateKey")).map(JsonNode::textValue).orElse(null);
+                sshKey = SshKey.of(null, publicKey, privateKey);
             }
 
-            return new CredentialResult(login, password != null ? InPlaceSecretValue.of(password) : null);
+            return Result.of(creds, sshKey);
         } catch (Exception ex) {
             ErrorEventFactory.fromThrowable(ex).handle();
             return null;
         }
     }
 
-    private List<String> getTotpDurationValues() {
-        var values = List.of("login", "12_hours", "24_hours", "30_days", "forever");
-        return values;
-    }
+    private JsonNode getValue(JsonNode node, String name) {
+        var fields = node.get("fields");
+        if (fields == null || !fields.isArray()) {
+            return null;
+        }
 
-    private int getTotpDurationIndex() {
-        var values = getTotpDurationValues();
-        var index = totpDuration != null ? values.indexOf(totpDuration) : -1;
-        return index;
+        for (JsonNode field : fields) {
+            var id = field.get("type");
+            if (id != null && id.textValue().equals(name)) {
+                var value = field.get("value");
+                return value;
+            }
+        }
+
+        return null;
     }
 
     @Override
@@ -320,6 +675,7 @@ public class KeeperPasswordManager implements PasswordManager {
 
     @Override
     public Duration getCacheDuration() {
-        return (mfa != null && mfa && getTotpDurationIndex() < 1) ? Duration.ofDays(10) : Duration.ofSeconds(30);
+        var effectiveTwoFactor = twoFactorAuth != null ? twoFactorAuth : new KeeperAuth.None();
+        return effectiveTwoFactor.getCacheDuration();
     }
 }
diff --git a/app/src/main/java/io/xpipe/app/pwman/LastpassPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/LastpassPasswordManager.java
index 7b4139fb0..57beb1f6d 100644
--- a/app/src/main/java/io/xpipe/app/pwman/LastpassPasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/LastpassPasswordManager.java
@@ -1,25 +1,47 @@
 package io.xpipe.app.pwman;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.CommandSupport;
 import io.xpipe.app.process.ShellControl;
 import io.xpipe.app.process.ShellScript;
 import io.xpipe.app.terminal.TerminalLaunch;
 import io.xpipe.app.util.*;
-import io.xpipe.core.InPlaceSecretValue;
 import io.xpipe.core.JacksonMapper;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
+import javafx.beans.property.Property;
+import lombok.Builder;
+import lombok.Getter;
+import lombok.extern.jackson.Jacksonized;
 
 import java.util.ArrayList;
+import java.util.Optional;
 
 @JsonTypeName("lastpass")
+@Builder
+@Jacksonized
+@Getter
 public class LastpassPasswordManager implements PasswordManager {
 
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.none();
+    }
+
     private static ShellControl SHELL;
 
+    @SuppressWarnings("unused")
+    public static OptionsBuilder createOptions(Property<LastpassPasswordManager> p) {
+        return new OptionsBuilder()
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true));
+    }
+
     private static synchronized ShellControl getOrStartShell() throws Exception {
         if (SHELL == null) {
             SHELL = ProcessControlProvider.get().createLocalProcessControl(true);
@@ -29,7 +51,7 @@ public class LastpassPasswordManager implements PasswordManager {
     }
 
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public synchronized Result query(String key) {
         try {
             CommandSupport.isInLocalPathOrThrow("LastPass CLI", "lpass");
         } catch (Exception e) {
@@ -80,11 +102,9 @@ public class LastpassPasswordManager implements PasswordManager {
                         "Ambiguous item name, multiple password entries match: " + String.join(", ", matches)));
             }
 
-            var username = tree.get(0).required("username").asText();
-            var password = tree.get(0).required("password").asText();
-            return new CredentialResult(
-                    !username.isEmpty() ? username : null,
-                    !password.isEmpty() ? InPlaceSecretValue.of(password) : null);
+            var login = Optional.ofNullable(tree.get(0).get("username")).map(JsonNode::textValue).orElse(null);
+            var secret = Optional.ofNullable(tree.get(0).get("password")).map(JsonNode::textValue).orElse(null);
+            return Result.of(Credentials.of(login, secret), null);
         } catch (Exception ex) {
             ErrorEventFactory.fromThrowable(ex).handle();
             return null;
diff --git a/app/src/main/java/io/xpipe/app/pwman/OnePasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/OnePasswordManager.java
index fce15a1a3..67b456493 100644
--- a/app/src/main/java/io/xpipe/app/pwman/OnePasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/OnePasswordManager.java
@@ -1,24 +1,86 @@
 package io.xpipe.app.pwman;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.core.AppSystemInfo;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.CommandSupport;
 import io.xpipe.app.process.ProcessOutputException;
 import io.xpipe.app.process.ShellControl;
 import io.xpipe.app.util.DocumentationLink;
-import io.xpipe.core.InPlaceSecretValue;
+import io.xpipe.app.util.ThreadHelper;
 import io.xpipe.core.JacksonMapper;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
+import io.xpipe.core.OsType;
+import javafx.beans.property.*;
+import javafx.collections.FXCollections;
+import lombok.Builder;
+import lombok.Getter;
+import lombok.extern.jackson.Jacksonized;
 
+import java.nio.file.Path;
+import java.util.*;
 import java.util.regex.Pattern;
 
 @JsonTypeName("onePassword")
+@Builder
+@Jacksonized
+@Getter
 public class OnePasswordManager implements PasswordManager {
 
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.of(true, false, true, keyStrategy, getSocketLocation());
+    }
+
     private static ShellControl SHELL;
+    private static final MapProperty<String, String> availableAccounts = new SimpleMapProperty<>(FXCollections.observableMap(new LinkedHashMap<>()));
+
+    private final String account;
+    private final PasswordManagerKeyStrategy keyStrategy;
+
+    private static Path getSocketLocation() {
+        var socket = switch (OsType.ofLocal()) {
+            case OsType.Linux ignored -> AppSystemInfo.ofLinux().getUserHome().resolve(".1password", "agent.sock");
+            case OsType.MacOs macOs -> AppSystemInfo.ofMacOs().getUserHome().resolve("Library", "Group Containers", "2BUA8C4S2C.com.1password", "t", "agent.sock");
+            case OsType.Windows windows -> null;
+        };
+        return socket;
+    }
+
+    @SuppressWarnings("unused")
+    public static OptionsBuilder createOptions(Property<OnePasswordManager> p) {
+        var account = new SimpleStringProperty(p.getValue().getAccount());
+        var keyStrategy = new SimpleObjectProperty<>(p.getValue().getKeyStrategy());
+
+        var keyStrategyChoice = OptionsChoiceBuilder.builder()
+                .allowNull(true)
+                .available(List.of(PasswordManagerKeyStrategy.Agent.class))
+                .property(keyStrategy)
+                .customConfiguration(PasswordManagerKeyStrategy.OptionsConfig.builder()
+                        .defaultSocketLocation(getSocketLocation())
+                        .allowSocketChoice(false)
+                        .build())
+                .build();
+
+        return new OptionsBuilder()
+                .nameAndDescription("onePasswordManagerAccount")
+                .addString(account)
+                .hide(account.isNull().and(availableAccounts.emptyProperty()))
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
+                .nameAndDescription("passwordManagerKeyStrategy")
+                .sub(keyStrategyChoice.build(), keyStrategy)
+                .bind(() -> {
+                    return OnePasswordManager.builder().keyStrategy(keyStrategy.getValue()).account(account.get()).build();
+                }, p);
+    }
 
     private static synchronized ShellControl getOrStartShell() throws Exception {
         if (SHELL == null) {
@@ -28,8 +90,63 @@ public class OnePasswordManager implements PasswordManager {
         return SHELL;
     }
 
+    private SequencedMap<String, String> listAccounts() throws Exception {
+        var out = getOrStartShell().command(CommandBuilder.of().add("op", "account", "list", "--format", "json")).sensitive().readStdoutOrThrow();
+        var json = JacksonMapper.getDefault().readTree(out);
+        if (!json.isArray()) {
+            return new LinkedHashMap<>();
+        }
+
+        var emails = new LinkedHashMap<String, String>();
+        for (JsonNode jsonNode : json) {
+            emails.put(jsonNode.required("email").textValue(), jsonNode.required("user_uuid").textValue());
+        }
+        return emails;
+    }
+
+    private String getActiveAccount() throws Exception {
+        if (!availableAccounts.isEmpty()) {
+            if (account != null) {
+                if (availableAccounts.get(account) == null) {
+                    throw ErrorEventFactory.expected(new IllegalArgumentException("Account " + account + " is not registered to the 1password CLI"));
+                }
+                return availableAccounts.get(account);
+            }
+
+            var first = availableAccounts.entrySet().iterator().next().getValue();
+            return first;
+        }
+
+        var accounts = listAccounts();
+        // Running commands instantly after each other breaks 1password
+        ThreadHelper.sleep(1500);
+        availableAccounts.clear();
+        availableAccounts.putAll(accounts);
+        if (availableAccounts.isEmpty()) {
+            throw ErrorEventFactory.expected(new IllegalStateException("No accounts are registered to the 1password CLI"));
+        }
+        return availableAccounts.entrySet().iterator().next().getValue();
+    }
+
+    private String getValue(JsonNode node, String name) {
+        var fields = node.get("fields");
+        if (fields == null || !fields.isArray()) {
+            return null;
+        }
+
+        for (JsonNode field : fields) {
+            var id = field.get("id");
+            if (id != null && id.textValue().equals(name)) {
+                var value = field.get("value");
+                return value != null ? value.textValue() : null;
+            }
+        }
+
+        return null;
+    }
+
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public synchronized Result query(String key) {
         try {
             CommandSupport.isInLocalPathOrThrow("1Password CLI", "op");
         } catch (Exception e) {
@@ -52,25 +169,30 @@ public class OnePasswordManager implements PasswordManager {
         }
 
         try {
+            var account = getActiveAccount();
             var b = CommandBuilder.of()
                     .add("op", "item", "get")
                     .addLiteral(name)
-                    .add("--format", "json", "--fields", "username,password");
+                    .add("--account").addLiteral(account)
+                    .add("--format", "json");
             if (vault != null) {
                 b.add("--vault").addLiteral(vault);
             }
 
             var r = getOrStartShell().command(b).sensitive().readStdoutOrThrow();
             var tree = JacksonMapper.getDefault().readTree(r);
-            if (!tree.isArray() || tree.size() != 2) {
-                return null;
-            }
 
-            var username = tree.get(0).get("value");
-            var password = tree.get(1).get("value");
-            return new CredentialResult(
-                    username != null ? username.asText() : null,
-                    password != null ? InPlaceSecretValue.of(password.asText()) : null);
+
+            var username = getValue(tree, "username");
+            var password = getValue(tree, "password");
+            var creds = Credentials.of(username, password);
+
+            var fingerprint = getValue(tree, "fingerprint");
+            var publicKey = getValue(tree, "public_key");
+            var privateKey = getValue(tree, "private_key");
+            var sshKey = SshKey.of(fingerprint, publicKey, privateKey);
+
+            return Result.of(creds, sshKey);
         } catch (Exception e) {
             var event = ErrorEventFactory.fromThrowable(e);
             if (!key.startsWith("op://")
diff --git a/app/src/main/java/io/xpipe/app/pwman/PassboltPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/PassboltPasswordManager.java
index 99bcd951a..220d32be0 100644
--- a/app/src/main/java/io/xpipe/app/pwman/PassboltPasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/PassboltPasswordManager.java
@@ -9,6 +9,7 @@ import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.platform.OptionsBuilder;
 import io.xpipe.app.prefs.AppPrefs;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.CommandSupport;
 import io.xpipe.app.process.ShellControl;
@@ -45,6 +46,11 @@ public class PassboltPasswordManager implements PasswordManager {
     private final InPlaceSecretValue passphrase;
     private final Path privateKey;
 
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.none();
+    }
+
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(Property<PassboltPasswordManager> p) {
         var serverUrl = new SimpleStringProperty(p.getValue().getServerUrl());
@@ -76,6 +82,8 @@ public class PassboltPasswordManager implements PasswordManager {
                 .nameAndDescription("passboltPrivateKey")
                 .addComp(chooser, privateKey)
                 .nonNull()
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
                 .bind(
                         () -> {
                             return PassboltPasswordManager.builder()
@@ -123,7 +131,11 @@ public class PassboltPasswordManager implements PasswordManager {
     private boolean mfaTotpInteractiveConfigured;
 
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public synchronized Result query(String key) {
+        if (serverUrl == null || passphrase == null || privateKey == null) {
+            return null;
+        }
+
         try {
             CommandSupport.isInLocalPathOrThrow("Passbolt CLI", "passbolt");
         } catch (Exception e) {
@@ -174,8 +186,7 @@ public class PassboltPasswordManager implements PasswordManager {
             var r = JacksonMapper.getDefault().readTree(cmd.readStdoutOrThrow());
             var username = r.required("username").asText();
             var password = r.required("password").asText();
-            return new CredentialResult(
-                    username.isEmpty() ? null : username, password.isEmpty() ? null : InPlaceSecretValue.of(password));
+            return Result.of(Credentials.of(username, password), null);
         } catch (Exception e) {
             ErrorEventFactory.fromThrowable(e).handle();
             return null;
diff --git a/app/src/main/java/io/xpipe/app/pwman/PasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/PasswordManager.java
index ab9ed29c2..69918610e 100644
--- a/app/src/main/java/io/xpipe/app/pwman/PasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/PasswordManager.java
@@ -1,10 +1,12 @@
 package io.xpipe.app.pwman;
 
+import io.xpipe.core.InPlaceSecretValue;
 import io.xpipe.core.OsType;
 import io.xpipe.core.SecretValue;
 
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import lombok.Value;
+import lombok.*;
+import lombok.experimental.FieldDefaults;
 
 import java.time.Duration;
 import java.util.ArrayList;
@@ -13,17 +15,37 @@ import java.util.List;
 @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "type")
 public interface PasswordManager {
 
+    @SneakyThrows
+    static boolean isPasswordManagerSshAgent(String s) {
+        for (Class<?> c : PasswordManager.getClasses()) {
+            var bm = c.getDeclaredMethod("builder");
+            bm.setAccessible(true);
+            var b = bm.invoke(null);
+
+            var m = b.getClass().getDeclaredMethod("build");
+            m.setAccessible(true);
+            var defValue = (PasswordManager) c.cast(m.invoke(b));
+            var config = defValue.getKeyConfiguration();
+            if (config.getDefaultSocketLocation() != null && config.getDefaultSocketLocation().toString().equals(s)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     static List<Class<?>> getClasses() {
         var l = new ArrayList<Class<?>>();
         l.add(OnePasswordManager.class);
         l.add(KeePassXcPasswordManager.class);
         l.add(BitwardenPasswordManager.class);
-        l.add(DashlanePasswordManager.class);
+        l.add(KeeperPasswordManager.class);
+        // l.add(ProtonPasswordManager.class);
+        l.add(HashicorpVaultPasswordManager.class);
         if (OsType.ofLocal() != OsType.WINDOWS) {
             l.add(LastpassPasswordManager.class);
             l.add(EnpassPasswordManager.class);
         }
-        l.add(KeeperPasswordManager.class);
+        l.add(DashlanePasswordManager.class);
         l.add(PsonoPasswordManager.class);
         l.add(PassboltPasswordManager.class);
         if (OsType.ofLocal() == OsType.WINDOWS) {
@@ -33,18 +55,65 @@ public interface PasswordManager {
         return l;
     }
 
-    CredentialResult retrieveCredentials(String key);
+    Result query(String key);
 
     String getKeyPlaceholder();
 
     String getWebsite();
 
+    PasswordManagerKeyConfiguration getKeyConfiguration();
+
     default Duration getCacheDuration() {
         return Duration.ofSeconds(30);
     }
 
-    @Value
-    class CredentialResult {
+    @Getter
+    @FieldDefaults(level = AccessLevel.PRIVATE)
+    @AllArgsConstructor(access = AccessLevel.PRIVATE)
+    class Result {
+
+        public static Result of(Credentials creds, SshKey sshKey) {
+            if (creds == null && sshKey == null) {
+                return null;
+            }
+            return new Result(creds, sshKey);
+        }
+
+        Credentials credentials;
+        SshKey sshKey;
+    }
+
+    @Getter
+    @FieldDefaults(level = AccessLevel.PRIVATE)
+    @AllArgsConstructor(access = AccessLevel.PRIVATE)
+    class SshKey {
+
+        public static SshKey of(String fingerprint, String publicKey, String privateKey) {
+            if (fingerprint == null && publicKey == null && privateKey == null) {
+                return null;
+            }
+
+            return new SshKey(fingerprint, publicKey, privateKey != null ? InPlaceSecretValue.of(privateKey) : null);
+        }
+
+        String fingerprint;
+        String publicKey;
+        SecretValue privateKey;
+    }
+
+    @Getter
+    @FieldDefaults(level = AccessLevel.PRIVATE)
+    @AllArgsConstructor(access = AccessLevel.PRIVATE)
+    class Credentials {
+
+        public static Credentials of(String username, String password) {
+            if (username == null && password == null) {
+                return null;
+            }
+
+            return new Credentials(username != null && !username.isEmpty() ? username : null,
+                    password != null && !password.isEmpty() ? InPlaceSecretValue.of(password) : null);
+        }
 
         String username;
         SecretValue password;
diff --git a/app/src/main/java/io/xpipe/app/pwman/PasswordManagerCommand.java b/app/src/main/java/io/xpipe/app/pwman/PasswordManagerCommand.java
index 894e60e09..c62280eb3 100644
--- a/app/src/main/java/io/xpipe/app/pwman/PasswordManagerCommand.java
+++ b/app/src/main/java/io/xpipe/app/pwman/PasswordManagerCommand.java
@@ -13,8 +13,6 @@ import io.xpipe.app.prefs.ExternalApplicationHelper;
 import io.xpipe.app.process.ShellControl;
 import io.xpipe.app.process.ShellScript;
 import io.xpipe.app.storage.DataStorage;
-import io.xpipe.core.InPlaceSecretValue;
-import io.xpipe.core.SecretValue;
 
 import javafx.beans.property.Property;
 import javafx.beans.property.SimpleObjectProperty;
@@ -34,6 +32,11 @@ public class PasswordManagerCommand implements PasswordManager {
     private static ShellControl SHELL;
     ShellScript script;
 
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.none();
+    }
+
     @SuppressWarnings("unused")
     static OptionsBuilder createOptions(Property<PasswordManagerCommand> property) {
         var template = new SimpleObjectProperty<PasswordManagerCommandTemplate>();
@@ -77,7 +80,7 @@ public class PasswordManagerCommand implements PasswordManager {
         return SHELL;
     }
 
-    public static SecretValue retrieveWithCommand(String cmd) {
+    public static String retrieveWithCommand(String cmd) {
         try (var cc = getOrStartShell().command(cmd).start()) {
             var out = cc.readStdoutOrThrow();
 
@@ -89,7 +92,7 @@ public class PasswordManagerCommand implements PasswordManager {
                         .orElse("");
             }
 
-            return InPlaceSecretValue.of(out);
+            return out;
         } catch (Exception ex) {
             ErrorEventFactory.fromThrowable("Unable to retrieve password with command " + cmd, ex)
                     .expected()
@@ -99,14 +102,14 @@ public class PasswordManagerCommand implements PasswordManager {
     }
 
     @Override
-    public CredentialResult retrieveCredentials(String key) {
+    public Result query(String key) {
         if (script == null || script.getValue().isBlank()) {
             return null;
         }
 
         var cmd = ExternalApplicationHelper.replaceVariableArgument(script.getValue(), "KEY", key);
         var secret = retrieveWithCommand(cmd);
-        return new CredentialResult(null, secret);
+        return Result.of(Credentials.of(null, secret), null);
     }
 
     @Override
diff --git a/app/src/main/java/io/xpipe/app/pwman/PasswordManagerKeyConfiguration.java b/app/src/main/java/io/xpipe/app/pwman/PasswordManagerKeyConfiguration.java
new file mode 100644
index 000000000..96c6ebb4c
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/pwman/PasswordManagerKeyConfiguration.java
@@ -0,0 +1,79 @@
+package io.xpipe.app.pwman;
+
+import io.xpipe.app.cred.SshIdentityAgentStrategy;
+
+import java.nio.file.Path;
+
+public interface PasswordManagerKeyConfiguration {
+
+    static PasswordManagerKeyConfiguration of(boolean inline, boolean joined, boolean supportsAgentKeyNames, PasswordManagerKeyStrategy strategy, Path socket) {
+        return new PasswordManagerKeyConfiguration() {
+            @Override
+            public boolean useInline() {
+                return (strategy == null || !strategy.useAgent()) && inline && joined;
+            }
+
+            @Override
+            public boolean useAgent() {
+                return strategy != null && strategy.useAgent();
+            }
+
+            @Override
+            public boolean supportsAgentKeyNames() {
+                return supportsAgentKeyNames;
+            }
+
+            @Override
+            public SshIdentityAgentStrategy getSshIdentityStrategy(String publicKey, boolean forward) {
+                return strategy.getSshIdentityStrategy(publicKey, forward);
+            }
+
+            @Override
+            public Path getDefaultSocketLocation() {
+                return socket;
+            }
+
+        };
+    }
+
+    static PasswordManagerKeyConfiguration none() {
+        return new PasswordManagerKeyConfiguration() {
+            @Override
+            public boolean useInline() {
+                return false;
+            }
+
+            @Override
+            public boolean useAgent() {
+                return false;
+            }
+
+            @Override
+            public boolean supportsAgentKeyNames() {
+                return false;
+            }
+
+            @Override
+            public SshIdentityAgentStrategy getSshIdentityStrategy(String publicKey, boolean forward) {
+                return null;
+            }
+
+            @Override
+            public Path getDefaultSocketLocation() {
+                return null;
+            }
+
+        };
+    }
+
+    boolean useInline();
+
+    boolean useAgent();
+
+    boolean supportsAgentKeyNames();
+
+    SshIdentityAgentStrategy getSshIdentityStrategy(String publicKey, boolean forward);
+
+    Path getDefaultSocketLocation();
+
+}
diff --git a/app/src/main/java/io/xpipe/app/pwman/PasswordManagerKeyStrategy.java b/app/src/main/java/io/xpipe/app/pwman/PasswordManagerKeyStrategy.java
new file mode 100644
index 000000000..cd649aa57
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/pwman/PasswordManagerKeyStrategy.java
@@ -0,0 +1,223 @@
+package io.xpipe.app.pwman;
+
+import io.xpipe.app.comp.base.ContextualFileReferenceChoiceComp;
+import io.xpipe.app.cred.*;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.process.CommandBuilder;
+import io.xpipe.app.process.ShellControl;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.core.FilePath;
+import io.xpipe.core.KeyValue;
+
+import javafx.beans.binding.Bindings;
+import javafx.beans.property.Property;
+import javafx.beans.property.ReadOnlyObjectWrapper;
+import javafx.beans.property.SimpleObjectProperty;
+
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeName;
+import lombok.Builder;
+import lombok.Value;
+import lombok.extern.jackson.Jacksonized;
+
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+
+@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "type")
+public interface PasswordManagerKeyStrategy {
+
+    @Value
+    @Builder
+    public class OptionsConfig {
+
+        boolean allowSocketChoice;
+        Path defaultSocketLocation;
+    }
+
+    @JsonTypeName("inline")
+    @Value
+    @Jacksonized
+    @Builder
+    class Inline implements PasswordManagerKeyStrategy {
+
+        @SuppressWarnings("unused")
+        public static String getOptionsNameKey() {
+            return "inlineKey";
+        }
+
+        @Override
+        public boolean useAgent() {
+            return false;
+        }
+
+        @Override
+        public SshIdentityAgentStrategy getSshIdentityStrategy(String publicKey, boolean forward) {
+            return null;
+        }
+    }
+
+    @JsonTypeName("agent")
+    @Value
+    @Jacksonized
+    @Builder
+    class Agent implements PasswordManagerKeyStrategy {
+
+        FilePath socket;
+
+        @Override
+        public boolean useAgent() {
+            return true;
+        }
+
+        @SuppressWarnings("unused")
+        public static String getOptionsNameKey() {
+            return "keyAgent";
+        }
+
+        @SuppressWarnings("unused")
+        static OptionsBuilder createOptions(Property<Agent> property, OptionsConfig config) {
+            var customSocket = new SimpleObjectProperty<>(property.getValue().getSocket());
+            if (config.getDefaultSocketLocation() != null && customSocket.get() == null) {
+                customSocket.set(FilePath.of(config.getDefaultSocketLocation()));
+            }
+
+            var choice = new ContextualFileReferenceChoiceComp(
+                    new ReadOnlyObjectWrapper<>(DataStorage.get().local().ref()),
+                    customSocket,
+                    null,
+                    List.of(),
+                    e -> e.equals(DataStorage.get().local()),
+                    false);
+            if (config.getDefaultSocketLocation() != null) {
+                choice.setPrompt(new ReadOnlyObjectWrapper<>(FilePath.of(config.getDefaultSocketLocation())));
+            }
+            if (!config.isAllowSocketChoice()) {
+                choice.disable();
+            }
+            choice.style("agent-socket-choice");
+
+            return new OptionsBuilder()
+                    .addComp(new SshAgentTestComp(Bindings.createObjectBinding(() -> {
+                        return property.getValue().getSshIdentityStrategy(null, false);
+                    }, property)))
+                    .nameAndDescription("passwordManagerSshAgentSocket")
+                    .addComp(choice, customSocket)
+                    .hide(!config.isAllowSocketChoice() && config.getDefaultSocketLocation() == null)
+                    .bind(
+                            () -> Agent.builder()
+                                    .socket(customSocket.get())
+                                    .build(),
+                            property);
+        }
+
+        @Override
+        public SshIdentityAgentStrategy getSshIdentityStrategy(String publicKey, boolean forward) {
+            return new SshIdentityAgentStrategy() {
+                @Override
+                public void prepareParent(ShellControl parent) throws Exception {
+                    if (parent.isLocal()) {
+                        SshIdentityStateManager.prepareLocalExternalAgent(socket);
+                    }
+                }
+
+                @Override
+                public FilePath determinetAgentSocketLocation(ShellControl parent) throws Exception {
+                    return socket != null ? socket.resolveTildeHome(parent.view().userHome()) : null;
+                }
+
+                @Override
+                public void buildCommand(CommandBuilder builder) {}
+
+                @Override
+                public List<KeyValue> configOptions(ShellControl sc) throws Exception {
+                    var file = SshIdentityStrategy.getPublicKeyPath(sc, publicKey);
+                    var l = new ArrayList<>(List.of(
+                            new KeyValue("IdentitiesOnly", file.isPresent() ? "yes" : "no"),
+                            new KeyValue("ForwardAgent", forward ? "yes" : "no"),
+                            new KeyValue("IdentityFile", file.isPresent() ? file.get().toString() : "none"),
+                            new KeyValue("PKCS11Provider", "none")));
+                    if (socket != null) {
+                        l.add(new KeyValue("IdentityAgent", "\"" + socket + "\""));
+                    }
+                    return l;
+                }
+
+                @Override
+                public PublicKeyStrategy getPublicKeyStrategy() {
+                    return PublicKeyStrategy.Fixed.of(publicKey);
+                }
+            };
+        }
+    }
+
+
+    @JsonTypeName("keePassXcOpenSshAgent")
+    @Value
+    @Jacksonized
+    @Builder
+    class KeePassXcOpenSshAgent implements PasswordManagerKeyStrategy {
+
+        @SuppressWarnings("unused")
+        static OptionsBuilder createOptions(Property<KeePassXcOpenSshAgent> property) {
+            return new OptionsBuilder()
+                    .addComp(new SshAgentTestComp(Bindings.createObjectBinding(() -> {
+                        return property.getValue().getSshIdentityStrategy(null, false);
+                    }, property)))
+                    .bind(
+                            () -> KeePassXcOpenSshAgent.builder().build(),
+                            property);
+        }
+
+        @Override
+        public boolean useAgent() {
+            return true;
+        }
+
+        @Override
+        public SshIdentityAgentStrategy getSshIdentityStrategy(String publicKey, boolean forward) {
+            return OpenSshAgentStrategy.builder().build();
+        }
+    }
+
+    @JsonTypeName("keePassXcPageant")
+    @Value
+    @Jacksonized
+    @Builder
+    class KeePassXcPageant implements PasswordManagerKeyStrategy {
+
+        @SuppressWarnings("unused")
+        static OptionsBuilder createOptions(Property<KeePassXcPageant> property) {
+            return new OptionsBuilder()
+                    .addComp(new SshAgentTestComp(Bindings.createObjectBinding(() -> {
+                        return property.getValue().getSshIdentityStrategy(null, false);
+                    }, property)))
+                    .bind(
+                            () -> KeePassXcPageant.builder().build(),
+                            property);
+        }
+
+        @Override
+        public boolean useAgent() {
+            return true;
+        }
+
+        @Override
+        public SshIdentityAgentStrategy getSshIdentityStrategy(String publicKey, boolean forward) {
+            return PageantStrategy.builder().build();
+        }
+    }
+
+    boolean useAgent();
+
+    SshIdentityAgentStrategy  getSshIdentityStrategy(String publicKey, boolean forward);
+
+    static List<Class<?>> getClasses() {
+        var l = new ArrayList<Class<?>>();
+        l.add(Agent.class);
+        l.add(KeePassXcOpenSshAgent.class);
+        l.add(KeePassXcPageant.class);
+        l.add(Inline.class);
+        return l;
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/pwman/ProtonPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/ProtonPasswordManager.java
new file mode 100644
index 000000000..37a548885
--- /dev/null
+++ b/app/src/main/java/io/xpipe/app/pwman/ProtonPasswordManager.java
@@ -0,0 +1,131 @@
+package io.xpipe.app.pwman;
+
+import com.fasterxml.jackson.annotation.JsonTypeName;
+import com.fasterxml.jackson.databind.JsonNode;
+import io.xpipe.app.core.AppCache;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.core.AppSystemInfo;
+import io.xpipe.app.ext.ProcessControlProvider;
+import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
+import io.xpipe.app.process.*;
+import io.xpipe.app.terminal.TerminalLaunch;
+import io.xpipe.app.util.DocumentationLink;
+import io.xpipe.app.util.ThreadHelper;
+import io.xpipe.core.JacksonMapper;
+import io.xpipe.core.OsType;
+import javafx.beans.property.*;
+import javafx.collections.FXCollections;
+import lombok.Builder;
+import lombok.Getter;
+import lombok.extern.jackson.Jacksonized;
+
+import java.nio.file.Path;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.SequencedMap;
+import java.util.regex.Pattern;
+
+@JsonTypeName("protonPass")
+@Builder
+@Jacksonized
+@Getter
+public class ProtonPasswordManager implements PasswordManager {
+
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.of(false, false, true, keyStrategy, getSocketLocation());
+    }
+
+    private static ShellControl SHELL;
+
+    private final PasswordManagerKeyStrategy keyStrategy;
+
+    private static Path getSocketLocation() {
+        var socket = switch (OsType.ofLocal()) {
+            case OsType.Linux ignored -> AppSystemInfo.ofLinux().getUserHome().resolve(".1password", "agent.sock");
+            case OsType.MacOs macOs -> AppSystemInfo.ofMacOs().getUserHome().resolve("Library", "Group Containers", "2BUA8C4S2C.com.1password", "t", "agent.sock");
+            case OsType.Windows windows -> null;
+        };
+        return socket;
+    }
+
+    @SuppressWarnings("unused")
+    public static OptionsBuilder createOptions(Property<ProtonPasswordManager> p) {
+        var keyStrategy = new SimpleObjectProperty<>(p.getValue().getKeyStrategy());
+
+        var keyStrategyChoice = OptionsChoiceBuilder.builder()
+                .allowNull(true)
+                .available(List.of(PasswordManagerKeyStrategy.Agent.class))
+                .property(keyStrategy)
+                .customConfiguration(PasswordManagerKeyStrategy.OptionsConfig.builder()
+                        .defaultSocketLocation(getSocketLocation())
+                        .allowSocketChoice(false)
+                        .build())
+                .build();
+
+        return new OptionsBuilder()
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
+                .nameAndDescription("passwordManagerKeyStrategy")
+                .sub(keyStrategyChoice.build(), keyStrategy)
+                .bind(() -> {
+                    return ProtonPasswordManager.builder().keyStrategy(keyStrategy.getValue()).build();
+                }, p);
+    }
+
+    private static synchronized ShellControl getOrStartShell() throws Exception {
+        if (SHELL == null) {
+            SHELL = ProcessControlProvider.get().createLocalProcessControl(true);
+        }
+        SHELL.start();
+        return SHELL;
+    }
+
+    @Override
+    public synchronized Result query(String key) {
+        try {
+            CommandSupport.isInLocalPathOrThrow("ProtonPass CLI", "pass-cli");
+        } catch (Exception e) {
+            ErrorEventFactory.fromThrowable(e)
+                    .expected()
+                    .link("https://proton.me/pass")
+                    .handle();
+            return null;
+        }
+
+        try {
+            var sc = getOrStartShell();
+            var loggedIn = sc.command(CommandBuilder.of().add("pass-cli", "info")).executeAndCheck();
+            if (!loggedIn) {
+                var script = ShellScript.lines(
+                        "pass-cli login");
+                TerminalLaunch.builder()
+                        .title("Proton Pass login")
+                        .localScript(script)
+                        .logIfEnabled(false)
+                        .preferTabs(false)
+                        .pauseOnExit(true)
+                        .launch();
+                return null;
+            }
+
+            return null;
+        } catch (Exception e) {
+            ErrorEventFactory.fromThrowable(e).handle();
+            return null;
+        }
+    }
+
+    @Override
+    public String getKeyPlaceholder() {
+        return AppI18n.get("protonPassPasswordPlaceholder");
+    }
+
+    @Override
+    public String getWebsite() {
+        return "https://proton.me/pass";
+    }
+}
diff --git a/app/src/main/java/io/xpipe/app/pwman/PsonoPasswordManager.java b/app/src/main/java/io/xpipe/app/pwman/PsonoPasswordManager.java
index fa6891981..4ae4bb091 100644
--- a/app/src/main/java/io/xpipe/app/pwman/PsonoPasswordManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/PsonoPasswordManager.java
@@ -1,11 +1,13 @@
 package io.xpipe.app.pwman;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import io.xpipe.app.comp.base.SecretFieldComp;
 import io.xpipe.app.comp.base.TextFieldComp;
 import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.ext.ProcessControlProvider;
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.CommandBuilder;
 import io.xpipe.app.process.CommandSupport;
 import io.xpipe.app.process.ShellControl;
@@ -22,6 +24,8 @@ import lombok.Getter;
 import lombok.ToString;
 import lombok.extern.jackson.Jacksonized;
 
+import java.util.Optional;
+
 @Getter
 @Builder
 @ToString
@@ -34,6 +38,11 @@ public class PsonoPasswordManager implements PasswordManager {
     private final InPlaceSecretValue apiSecretKey;
     private final String serverUrl;
 
+    @Override
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.none();
+    }
+
     @SuppressWarnings("unused")
     public static OptionsBuilder createOptions(Property<PsonoPasswordManager> p) {
         var apiKey = new SimpleObjectProperty<>(p.getValue().getApiKey());
@@ -52,6 +61,8 @@ public class PsonoPasswordManager implements PasswordManager {
                 .addComp(new SecretFieldComp(apiKey, false).maxWidth(600), apiKey)
                 .nameAndDescription("psonoApiSecretKey")
                 .addComp(new SecretFieldComp(apiSecretKey, false).maxWidth(600), apiSecretKey)
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true))
                 .bind(
                         () -> {
                             return PsonoPasswordManager.builder()
@@ -72,7 +83,7 @@ public class PsonoPasswordManager implements PasswordManager {
     }
 
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public synchronized Result query(String key) {
         if (serverUrl == null || apiKey == null || apiSecretKey == null) {
             return null;
         }
@@ -102,11 +113,9 @@ public class PsonoPasswordManager implements PasswordManager {
                             .add("json"))
                     .sensitive();
             var r = JacksonMapper.getDefault().readTree(cmd.readStdoutOrThrow());
-            var username = r.required("username");
-            var password = r.required("password");
-            return new CredentialResult(
-                    username.isNull() ? null : username.asText(),
-                    password.isNull() ? null : InPlaceSecretValue.of(password.asText()));
+            var username = Optional.of(r.required("username")).filter(n -> !n.isNull()).map(JsonNode::textValue).orElse(null);
+            var password = Optional.of(r.required("password")).filter(n -> !n.isNull()).map(JsonNode::textValue).orElse(null);;
+            return Result.of(Credentials.of(username, password), null);
         } catch (Exception e) {
             ErrorEventFactory.fromThrowable(e).handle();
             return null;
diff --git a/app/src/main/java/io/xpipe/app/pwman/WindowsCredentialManager.java b/app/src/main/java/io/xpipe/app/pwman/WindowsCredentialManager.java
index 854b546a7..676f17c9d 100644
--- a/app/src/main/java/io/xpipe/app/pwman/WindowsCredentialManager.java
+++ b/app/src/main/java/io/xpipe/app/pwman/WindowsCredentialManager.java
@@ -1,20 +1,38 @@
 package io.xpipe.app.pwman;
 
 import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.prefs.PasswordManagerTestComp;
 import io.xpipe.app.process.LocalShell;
-import io.xpipe.core.InPlaceSecretValue;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
+import javafx.beans.property.Property;
+import lombok.Builder;
+import lombok.Getter;
 import lombok.Value;
+import lombok.extern.jackson.Jacksonized;
 
 @JsonTypeName("windowsCredentialManager")
-@Value
+@Builder
+@Jacksonized
 public class WindowsCredentialManager implements PasswordManager {
 
     private static boolean loaded = false;
 
     @Override
-    public synchronized CredentialResult retrieveCredentials(String key) {
+    public PasswordManagerKeyConfiguration getKeyConfiguration() {
+        return PasswordManagerKeyConfiguration.none();
+    }
+
+    @SuppressWarnings("unused")
+    public static OptionsBuilder createOptions(Property<WindowsCredentialManager> p) {
+        return new OptionsBuilder()
+                .nameAndDescription("passwordManagerTest")
+                .addComp(new PasswordManagerTestComp(true));
+    }
+
+    @Override
+    public synchronized Result query(String key) {
         try {
             if (!loaded) {
                 loaded = true;
@@ -106,7 +124,7 @@ public class WindowsCredentialManager implements PasswordManager {
                     .command("[CredManager.Credential]::GetUserPassword(\"" + key.replaceAll("\"", "`\"") + "\")")
                     .sensitive()
                     .readStdoutOrThrow();
-            return new CredentialResult(username, password.isEmpty() ? null : InPlaceSecretValue.of(password));
+            return Result.of(Credentials.of(username, password), null);
         } catch (Exception ex) {
             ErrorEventFactory.fromThrowable(ex).expected().handle();
             return null;
diff --git a/app/src/main/java/io/xpipe/app/secret/SecretPasswordManagerStrategy.java b/app/src/main/java/io/xpipe/app/secret/SecretPasswordManagerStrategy.java
index 092b3ff54..c21b9ac30 100644
--- a/app/src/main/java/io/xpipe/app/secret/SecretPasswordManagerStrategy.java
+++ b/app/src/main/java/io/xpipe/app/secret/SecretPasswordManagerStrategy.java
@@ -80,12 +80,12 @@ public class SecretPasswordManagerStrategy implements SecretRetrievalStrategy {
                     return new SecretQueryResult(null, SecretQueryState.RETRIEVAL_FAILURE);
                 }
 
-                var r = pm.retrieveCredentials(key);
-                if (r == null || r.getPassword() == null) {
+                var r = pm.query(key);
+                if (r == null || r.getCredentials() == null || r.getCredentials().getPassword() == null) {
                     return new SecretQueryResult(null, SecretQueryState.RETRIEVAL_FAILURE);
                 }
 
-                r.getPassword().withSecretValue(chars -> {
+                r.getCredentials().getPassword().withSecretValue(chars -> {
                     var seq = CharBuffer.wrap(chars);
                     var newline = seq.chars().anyMatch(value -> value == 10);
                     if (seq.length() == 0 || newline) {
@@ -98,7 +98,7 @@ public class SecretPasswordManagerStrategy implements SecretRetrievalStrategy {
                                         + " you will have to change the command and/or password key."));
                     }
                 });
-                return new SecretQueryResult(r.getPassword(), SecretQueryState.NORMAL);
+                return new SecretQueryResult(r.getCredentials().getPassword(), SecretQueryState.NORMAL);
             }
 
             @Override
diff --git a/app/src/main/java/io/xpipe/app/storage/DataStorage.java b/app/src/main/java/io/xpipe/app/storage/DataStorage.java
index 29371cd46..c13115021 100644
--- a/app/src/main/java/io/xpipe/app/storage/DataStorage.java
+++ b/app/src/main/java/io/xpipe/app/storage/DataStorage.java
@@ -381,8 +381,7 @@ public abstract class DataStorage {
         var categoryChanged = !entry.getCategoryUuid().equals(newEntry.getCategoryUuid());
 
         if (entry.getStore() != null
-                && newEntry.getStore() != null
-                && !entry.getStore().equals(newEntry.getStore())) {
+                && newEntry.getStore() != null) {
             synchronized (storeMoveCache) {
                 storeMoveCache.put(entry.getStore(), newEntry.getStore());
             }
diff --git a/app/src/main/java/io/xpipe/app/storage/DataStorageQuery.java b/app/src/main/java/io/xpipe/app/storage/DataStorageQuery.java
index e8b32a382..35cd20c7d 100644
--- a/app/src/main/java/io/xpipe/app/storage/DataStorageQuery.java
+++ b/app/src/main/java/io/xpipe/app/storage/DataStorageQuery.java
@@ -12,7 +12,7 @@ public class DataStorageQuery {
             var narrow = found.stream()
                     .filter(dataStoreEntry -> dataStoreEntry.getName().equalsIgnoreCase(connection))
                     .toList();
-            if (narrow.size() == 1) {
+            if (narrow.size() >= 1) {
                 return narrow;
             }
         }
diff --git a/app/src/main/java/io/xpipe/app/terminal/ControllableTerminalSession.java b/app/src/main/java/io/xpipe/app/terminal/ControllableTerminalSession.java
index d8670bbeb..b5efba1a8 100644
--- a/app/src/main/java/io/xpipe/app/terminal/ControllableTerminalSession.java
+++ b/app/src/main/java/io/xpipe/app/terminal/ControllableTerminalSession.java
@@ -10,15 +10,21 @@ public abstract class ControllableTerminalSession extends TerminalView.TerminalS
     protected Rect lastBounds;
     protected boolean customBounds;
 
-    protected ControllableTerminalSession(ProcessHandle terminalProcess) {
-        super(terminalProcess);
+    protected ControllableTerminalSession(ProcessHandle terminalProcess, ExternalTerminalType terminalType) {
+        super(terminalProcess, terminalType);
     }
 
     public abstract void own();
 
     public abstract void disown();
 
-    public abstract void removeBorders();
+    public abstract void removeIcon();
+
+    public abstract void restoreIcon();
+
+    public abstract void removeStyle();
+
+    public abstract void restoreStyle();
 
     public abstract void show();
 
diff --git a/app/src/main/java/io/xpipe/app/terminal/PtyxisTerminalType.java b/app/src/main/java/io/xpipe/app/terminal/PtyxisTerminalType.java
index 5f5df526d..b6ba873e1 100644
--- a/app/src/main/java/io/xpipe/app/terminal/PtyxisTerminalType.java
+++ b/app/src/main/java/io/xpipe/app/terminal/PtyxisTerminalType.java
@@ -31,6 +31,8 @@ public class PtyxisTerminalType implements ExternalApplicationType.LinuxApplicat
         var toExecute = CommandBuilder.of()
                 .addIf(configuration.isPreferTabs(), "--tab")
                 .addIf(!configuration.isPreferTabs(), "--new-window")
+                .add("--title")
+                .addQuoted(configuration.getColoredTitle())
                 .add("--")
                 .add(configuration.single().getDialectLaunchCommand());
         launch(toExecute);
diff --git a/app/src/main/java/io/xpipe/app/terminal/TerminalDockBrowserComp.java b/app/src/main/java/io/xpipe/app/terminal/TerminalDockBrowserComp.java
index 2211c87fd..6e628a62a 100644
--- a/app/src/main/java/io/xpipe/app/terminal/TerminalDockBrowserComp.java
+++ b/app/src/main/java/io/xpipe/app/terminal/TerminalDockBrowserComp.java
@@ -10,6 +10,7 @@ import io.xpipe.app.platform.PlatformThread;
 import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.util.GlobalTimer;
 
+import javafx.application.Platform;
 import javafx.beans.property.SimpleBooleanProperty;
 import javafx.beans.value.ChangeListener;
 import javafx.beans.value.ObservableBooleanValue;
@@ -108,7 +109,11 @@ public class TerminalDockBrowserComp extends SimpleRegionBuilder {
         var show = new EventHandler<WindowEvent>() {
             @Override
             public void handle(WindowEvent event) {
-                update(stack);
+                GlobalTimer.delay(() -> {
+                    Platform.runLater(() -> {
+                        update(stack);
+                    });
+                }, Duration.ofMillis(100));
             }
         };
         var hide = new EventHandler<WindowEvent>() {
@@ -117,6 +122,16 @@ public class TerminalDockBrowserComp extends SimpleRegionBuilder {
                 model.onClose();
             }
         };
+        var scale = new ChangeListener<Number>() {
+            @Override
+            public void changed(ObservableValue<? extends Number> observable, Number oldValue, Number newValue) {
+                GlobalTimer.delay(() -> {
+                    Platform.runLater(() -> {
+                        update(stack);
+                    });
+                }, Duration.ofMillis(500));
+            }
+        };
 
         var parent = new AtomicReference<Parent>();
         stack.sceneProperty().subscribe(scene -> {
@@ -128,6 +143,7 @@ public class TerminalDockBrowserComp extends SimpleRegionBuilder {
                 s.iconifiedProperty().removeListener(iconified);
                 s.removeEventFilter(WindowEvent.WINDOW_SHOWN, show);
                 s.removeEventFilter(WindowEvent.WINDOW_HIDING, hide);
+                s.outputScaleXProperty().addListener(scale);
                 if (parent.get() != null) {
                     parent.get().boundsInParentProperty().removeListener(bounds);
                     parent.set(null);
@@ -140,6 +156,7 @@ public class TerminalDockBrowserComp extends SimpleRegionBuilder {
                 s.iconifiedProperty().addListener(iconified);
                 s.addEventFilter(WindowEvent.WINDOW_SHOWN, show);
                 s.addEventFilter(WindowEvent.WINDOW_HIDING, hide);
+                s.outputScaleXProperty().removeListener(scale);
                 // As in practice this node is wrapped in another stack pane
                 // We have to listen to the parent bounds to actually receive bounds changes
                 stack.getParent().boundsInParentProperty().addListener(bounds);
@@ -150,7 +167,7 @@ public class TerminalDockBrowserComp extends SimpleRegionBuilder {
     }
 
     private void update(Region region) {
-        if (region.getScene() == null || region.getScene().getWindow() == null) {
+        if (region.getScene() == null || region.getScene().getWindow() == null || NativeWinWindowControl.MAIN_WINDOW == null) {
             return;
         }
 
@@ -161,11 +178,26 @@ public class TerminalDockBrowserComp extends SimpleRegionBuilder {
 
         var scene =  region.getScene();
         var windowRect = NativeWinWindowControl.MAIN_WINDOW.getBounds();
-        var x = windowRect.getX() + ((bounds.getMinX() + p.getLeft() + scene.getX()) * sx);
-        var y = windowRect.getY() + ((bounds.getMinY() + p.getTop() + scene.getY()) * sy);
+        if (windowRect.getX() == 0.0 && windowRect.getY() == 0.0 && windowRect.getW() == 0 && windowRect.getH() == 0) {
+            return;
+        }
+
+        var xPadding = ((bounds.getMinX() + p.getLeft() + scene.getX()) * sx);
+        var yPadding = ((bounds.getMinY() + p.getTop() + scene.getY()) * sy);
+        var x = windowRect.getX() + xPadding;
+        var y = windowRect.getY() + yPadding;
         var w = (bounds.getWidth() * sx) - p.getRight() - p.getLeft();
         var h = (bounds.getHeight() * sy) - p.getBottom() - p.getTop();
 
+        if (x + w > windowRect.getX() + windowRect.getW()) {
+            x = windowRect.getX() + 10;
+            w = windowRect.getW() - 20;
+        }
+        if (y + h > windowRect.getY() + windowRect.getH()) {
+            y = windowRect.getY() + 10;
+            h = windowRect.getH() - 20;
+        }
+
         model.resizeView(
                 (int) Math.round(x),
                 (int) Math.round(y),
diff --git a/app/src/main/java/io/xpipe/app/terminal/TerminalDockHubComp.java b/app/src/main/java/io/xpipe/app/terminal/TerminalDockHubComp.java
index f416f7e8e..5ef0e5870 100644
--- a/app/src/main/java/io/xpipe/app/terminal/TerminalDockHubComp.java
+++ b/app/src/main/java/io/xpipe/app/terminal/TerminalDockHubComp.java
@@ -143,11 +143,22 @@ public class TerminalDockHubComp extends SimpleRegionBuilder {
             return;
         }
 
-        var x = windowRect.getX() + ((bounds.getMinX() + p.getLeft() + scene.getX()) * sx);
-        var y = windowRect.getY() + ((bounds.getMinY() + p.getTop() + scene.getY()) * sy);
+        var xPadding = ((bounds.getMinX() + p.getLeft() + scene.getX()) * sx);
+        var yPadding = ((bounds.getMinY() + p.getTop() + scene.getY()) * sy);
+        var x = windowRect.getX() + xPadding;
+        var y = windowRect.getY() + yPadding;
         var w = (bounds.getWidth() * sx) - p.getRight() - p.getLeft();
         var h = (bounds.getHeight() * sy) - p.getBottom() - p.getTop();
 
+        if (x + w > windowRect.getX() + windowRect.getW()) {
+            x = windowRect.getX() + 10;
+            w = windowRect.getW() - 20;
+        }
+        if (y + h > windowRect.getY() + windowRect.getH()) {
+            y = windowRect.getY() + 10;
+            h = windowRect.getH() - 20;
+        }
+
         model.resizeView(
                 (int) Math.round(x),
                 (int) Math.round(y),
diff --git a/app/src/main/java/io/xpipe/app/terminal/TerminalDockHubManager.java b/app/src/main/java/io/xpipe/app/terminal/TerminalDockHubManager.java
index 011c5a36f..8a9f4da45 100644
--- a/app/src/main/java/io/xpipe/app/terminal/TerminalDockHubManager.java
+++ b/app/src/main/java/io/xpipe/app/terminal/TerminalDockHubManager.java
@@ -3,6 +3,7 @@ package io.xpipe.app.terminal;
 import io.xpipe.app.comp.base.ModalOverlay;
 import io.xpipe.app.core.AppI18n;
 import io.xpipe.app.core.AppLayoutModel;
+import io.xpipe.app.core.mode.AppOperationMode;
 import io.xpipe.app.core.window.AppDialog;
 import io.xpipe.app.core.window.AppMainWindow;
 import io.xpipe.app.platform.LabelGraphic;
@@ -67,6 +68,14 @@ public class TerminalDockHubManager {
             return false;
         }
 
+        if (AppOperationMode.get() != AppOperationMode.GUI) {
+            return false;
+        }
+
+        if (AppMainWindow.get() == null || !AppMainWindow.get().getStage().isShowing() || AppMainWindow.get().getStage().isIconified()) {
+            return false;
+        }
+
         return true;
     }
 
@@ -110,9 +119,9 @@ public class TerminalDockHubManager {
     private final AppLayoutModel.QueueEntry queueEntry = new AppLayoutModel.QueueEntry(
             AppI18n.observable("toggleTerminalDock"), new LabelGraphic.NodeGraphic(() -> {
                 var inner = new FontIcon();
-                inner.iconCodeProperty().bind(Bindings.createObjectBinding(() -> {
-                    return detached.get() || minimized.get() ? MaterialDesignC.CONSOLE_LINE : MaterialDesignC.CONSOLE;
-                }, detached, minimized));
+                inner.iconCodeProperty().bind(PlatformThread.sync(Bindings.createObjectBinding(() -> {
+                    return detached.get() || minimized.get() || !showing.get() ? MaterialDesignC.CONSOLE_LINE : MaterialDesignC.CONSOLE;
+                }, detached, minimized, showing)));
                 inner.getStyleClass().add("graphic");
                 inner.getStyleClass().add("terminal-dock-button");
                 return inner;
@@ -186,15 +195,11 @@ public class TerminalDockHubManager {
                     return;
                 }
 
-                var term = AppPrefs.get().terminalType().getValue();
+                var term = controllable.get().getTerminalType();
                 if (term instanceof TrackableTerminalType t) {
                     if (t.getDockMode() == TerminalDockMode.UNSUPPORTED) {
                         return;
                     }
-
-                    if (t.getDockMode() == TerminalDockMode.BORDERLESS) {
-                        controllable.get().removeBorders();
-                    }
                 }
 
                 var dock = !detached.get();
diff --git a/app/src/main/java/io/xpipe/app/terminal/TerminalDockView.java b/app/src/main/java/io/xpipe/app/terminal/TerminalDockView.java
index e2904aeb8..95f69c101 100644
--- a/app/src/main/java/io/xpipe/app/terminal/TerminalDockView.java
+++ b/app/src/main/java/io/xpipe/app/terminal/TerminalDockView.java
@@ -6,11 +6,11 @@ import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.util.GlobalTimer;
 import io.xpipe.app.util.Rect;
 
+import io.xpipe.app.util.ThreadHelper;
 import lombok.Getter;
 
 import java.time.Duration;
 import java.util.HashSet;
-import java.util.Optional;
 import java.util.Set;
 import java.util.UUID;
 import java.util.function.UnaryOperator;
@@ -51,7 +51,7 @@ public class TerminalDockView {
             var wasCustom = terminal.isCustomBounds();
             terminal.updateBoundsState();
 
-            if (wasCustom && viewBounds != null) {
+            if (wasCustom && viewBounds != null && viewActive) {
                 var currentBounds = terminal.getLastBounds();
                 var targetBounds = windowBoundsFunction.apply(viewBounds);
                 var sum = Math.abs(targetBounds.getX() - currentBounds.getX()) +
@@ -59,28 +59,36 @@ public class TerminalDockView {
                         Math.abs(targetBounds.getW() - currentBounds.getW()) +
                         Math.abs(targetBounds.getH() - currentBounds.getH());
                 if (sum < 30) {
+                    ThreadHelper.sleep(300);
                     trackTerminal(terminal, true);
                     return;
                 }
             }
 
-            if (terminal.isCustomBounds()) {
+            if (!wasCustom && terminal.isCustomBounds()) {
                 terminal.disown();
+                terminal.restoreIcon();
+                terminal.restoreStyle();
             }
         });
     }
 
     public synchronized void trackTerminal(ControllableTerminalSession terminal, boolean dock) {
-        if (viewActive && dock && viewBounds != null) {
-            terminal.own();
-
+        if (viewActive && dock && viewBounds != null && NativeWinWindowControl.MAIN_WINDOW.isVisible() && !NativeWinWindowControl.MAIN_WINDOW.isIconified()) {
             // Bring main window to foreground since initial launch
             NativeWinWindowControl.MAIN_WINDOW.activate();
 
+            terminal.removeIcon();
+            terminal.own();
+            terminal.removeStyle();
+
             // The window might be minimized
             // We always want to show the terminal though
             terminal.show();
 
+            // Move input focus to terminal
+            terminal.focus();
+
             terminal.updatePosition(windowBoundsFunction.apply(viewBounds));
             updateCustomBounds();
         }
@@ -118,6 +126,11 @@ public class TerminalDockView {
             return;
         }
 
+        // Reset style in case close is blocked by terminal
+        terminal.disown();
+        terminal.restoreIcon();
+        terminal.restoreStyle();
+
         terminal.close();
         terminalInstances.remove(terminal);
     }
@@ -139,7 +152,9 @@ public class TerminalDockView {
                 return;
             }
 
+            terminalInstance.removeIcon();
             terminalInstance.own();
+            terminalInstance.removeStyle();
             terminalInstance.focus();
         });
         updatePositions();
@@ -173,10 +188,13 @@ public class TerminalDockView {
 
             terminalInstance.show();
             if (viewActive) {
+                terminalInstance.removeIcon();
                 terminalInstance.own();
+                terminalInstance.removeStyle();
                 terminalInstance.focus();
             } else {
                 terminalInstance.disown();
+                terminalInstance.restoreIcon();
                 terminalInstance.backOfMainWindow();
             }
         });
@@ -228,7 +246,7 @@ public class TerminalDockView {
         });
     }
 
-    public void resizeView(int x, int y, int w, int h) {
+    public synchronized void resizeView(int x, int y, int w, int h) {
         if (w < 100 || h < 100) {
             return;
         }
@@ -243,7 +261,9 @@ public class TerminalDockView {
         terminalInstances.forEach(terminalInstance -> {
             terminalInstance.show();
             terminalInstance.updatePosition(windowBoundsFunction.apply(viewBounds));
+            terminalInstance.removeIcon();
             terminalInstance.own();
+            terminalInstance.removeStyle();
             terminalInstance.focus();
         });
     }
diff --git a/app/src/main/java/io/xpipe/app/terminal/TerminalPaneConfiguration.java b/app/src/main/java/io/xpipe/app/terminal/TerminalPaneConfiguration.java
index 64a228836..646b12499 100644
--- a/app/src/main/java/io/xpipe/app/terminal/TerminalPaneConfiguration.java
+++ b/app/src/main/java/io/xpipe/app/terminal/TerminalPaneConfiguration.java
@@ -72,12 +72,6 @@ public class TerminalPaneConfiguration {
             return config;
         }
 
-        var feature = LicenseProvider.get().getFeature("logging");
-        var supported = feature.isSupported();
-        if (!supported) {
-            throw new LicenseRequiredException(feature);
-        }
-
         var log = getLogFile(paneIndex, entry);
         var sc = TerminalProxyManager.getProxy().orElse(LocalShell.getShell()).start();
         var logFile = sc.getLocalSystemAccess().translateFromLocalSystemPath(FilePath.of(log));
diff --git a/app/src/main/java/io/xpipe/app/terminal/TerminalView.java b/app/src/main/java/io/xpipe/app/terminal/TerminalView.java
index 5e7ea9209..54ba1ad6f 100644
--- a/app/src/main/java/io/xpipe/app/terminal/TerminalView.java
+++ b/app/src/main/java/io/xpipe/app/terminal/TerminalView.java
@@ -144,9 +144,10 @@ public class TerminalView {
     }
 
     private Optional<TerminalSession> createTerminalSession(ProcessHandle terminalProcess) {
+        var type = AppPrefs.get().terminalType().getValue();
         return switch (OsType.ofLocal()) {
-            case OsType.Linux ignored -> Optional.of(new TerminalSession(terminalProcess));
-            case OsType.MacOs ignored -> Optional.of(new TerminalSession(terminalProcess));
+            case OsType.Linux ignored -> Optional.of(new TerminalSession(terminalProcess, type));
+            case OsType.MacOs ignored -> Optional.of(new TerminalSession(terminalProcess, type));
             case OsType.Windows ignored -> {
                 var controls = NativeWinWindowControl.byPid(terminalProcess.pid());
                 if (controls.isEmpty()) {
@@ -158,7 +159,7 @@ public class TerminalView {
                     }
                 }
 
-                yield Optional.of(new WindowsTerminalSession(terminalProcess, controls.getFirst()));
+                yield Optional.of(new WindowsTerminalSession(terminalProcess, type, controls.getFirst()));
             }
         };
     }
@@ -239,9 +240,11 @@ public class TerminalView {
     public static class TerminalSession {
 
         protected final ProcessHandle terminalProcess;
+        protected final ExternalTerminalType terminalType;
 
-        protected TerminalSession(ProcessHandle terminalProcess) {
+        protected TerminalSession(ProcessHandle terminalProcess, ExternalTerminalType terminalType) {
             this.terminalProcess = terminalProcess;
+            this.terminalType = terminalType;
         }
 
         public boolean isRunning() {
diff --git a/app/src/main/java/io/xpipe/app/terminal/TermiusTerminalType.java b/app/src/main/java/io/xpipe/app/terminal/TermiusTerminalType.java
index 3d93fa843..82a2a171f 100644
--- a/app/src/main/java/io/xpipe/app/terminal/TermiusTerminalType.java
+++ b/app/src/main/java/io/xpipe/app/terminal/TermiusTerminalType.java
@@ -54,7 +54,7 @@ public class TermiusTerminalType implements ExternalTerminalType {
         var port = b.getPort();
         var user = URLEncoder.encode(b.getUser(), StandardCharsets.UTF_8);
         var name = b.getName();
-        Hyperlinks.open("termius://app/host-sharing#label=" + name + "&ip=" + host + "&port=" + port + "&username="
+        DesktopHelper.openAssociatedApplication("termius://app/host-sharing#label=" + name + "&ip=" + host + "&port=" + port + "&username="
                 + user + "&os=undefined");
     }
 
diff --git a/app/src/main/java/io/xpipe/app/terminal/WindowsTerminalSession.java b/app/src/main/java/io/xpipe/app/terminal/WindowsTerminalSession.java
index 5f4596f7a..4237bee42 100644
--- a/app/src/main/java/io/xpipe/app/terminal/WindowsTerminalSession.java
+++ b/app/src/main/java/io/xpipe/app/terminal/WindowsTerminalSession.java
@@ -1,10 +1,8 @@
 package io.xpipe.app.terminal;
 
-import com.sun.jna.platform.win32.User32;
 import io.xpipe.app.platform.NativeWinWindowControl;
 import io.xpipe.app.util.Rect;
 
-import io.xpipe.app.util.User32Ex;
 import lombok.AccessLevel;
 import lombok.Getter;
 import lombok.experimental.FieldDefaults;
@@ -17,8 +15,8 @@ public final class WindowsTerminalSession extends ControllableTerminalSession {
 
     NativeWinWindowControl control;
 
-    public WindowsTerminalSession(ProcessHandle terminal, NativeWinWindowControl control) {
-        super(terminal);
+    public WindowsTerminalSession(ProcessHandle terminal, ExternalTerminalType terminalType, NativeWinWindowControl control) {
+        super(terminal, terminalType);
         this.control = control;
     }
 
@@ -54,8 +52,29 @@ public final class WindowsTerminalSession extends ControllableTerminalSession {
     }
 
     @Override
-    public void removeBorders() {
-        control.removeBorders();
+    public void removeIcon() {
+        control.removeIcon();
+    }
+
+    @Override
+    public void restoreIcon() {
+        control.restoreIcon();
+    }
+
+    @Override
+    public void removeStyle() {
+        control.setWindowsTransitionsEnabled(false);
+        if (terminalType != null && terminalType instanceof TrackableTerminalType t && t.getDockMode() == TerminalDockMode.BORDERLESS) {
+            control.removeBorders();
+        }
+    }
+
+    @Override
+    public void restoreStyle() {
+        control.setWindowsTransitionsEnabled(true);
+        if (terminalType != null && terminalType instanceof TrackableTerminalType t && t.getDockMode() == TerminalDockMode.BORDERLESS) {
+            control.restoreBorders();
+        }
     }
 
     @Override
diff --git a/app/src/main/java/io/xpipe/app/util/AppJacksonModule.java b/app/src/main/java/io/xpipe/app/util/AppJacksonModule.java
index 7748ea455..21fdb587c 100644
--- a/app/src/main/java/io/xpipe/app/util/AppJacksonModule.java
+++ b/app/src/main/java/io/xpipe/app/util/AppJacksonModule.java
@@ -1,12 +1,11 @@
 package io.xpipe.app.util;
 
+import io.xpipe.app.cred.SshIdentityStrategy;
 import io.xpipe.app.ext.HostAddress;
 import io.xpipe.app.process.ShellDialect;
 import io.xpipe.app.process.ShellDialects;
 import io.xpipe.app.process.ShellScript;
-import io.xpipe.app.pwman.KeePassXcAssociationKey;
-import io.xpipe.app.pwman.KeePassXcPasswordManager;
-import io.xpipe.app.pwman.PasswordManager;
+import io.xpipe.app.pwman.*;
 import io.xpipe.app.rdp.ExternalRdpClient;
 import io.xpipe.app.secret.*;
 import io.xpipe.app.spice.ExternalSpiceClient;
@@ -79,6 +78,8 @@ public class AppJacksonModule extends SimpleModule {
             context.registerSubtypes(new NamedType(t.getClass()));
         }
 
+        context.registerSubtypes(SshIdentityStrategy.getClasses());
+        context.registerSubtypes(PasswordManagerKeyStrategy.getClasses());
         context.registerSubtypes(PasswordManager.getClasses());
         context.registerSubtypes(TerminalMultiplexer.getClasses());
         context.registerSubtypes(TerminalPrompt.getClasses());
@@ -87,6 +88,8 @@ public class AppJacksonModule extends SimpleModule {
         context.registerSubtypes(ExternalSpiceClient.getClasses());
         context.registerSubtypes(SecretRetrievalStrategy.getClasses());
         context.registerSubtypes(DataStorageGroupStrategy.getClasses());
+        context.registerSubtypes(KeeperPasswordManager.KeeperAuth.getClasses());
+        context.registerSubtypes(HashicorpVaultPasswordManager.VaultAuth.getClasses());
 
         super.setupModule(context);
     }
@@ -105,6 +108,7 @@ public class AppJacksonModule extends SimpleModule {
             var object = JsonNodeFactory.instance.objectNode();
             object.put("type", "keePassXc");
             object.set("associationKeys", tree);
+            object.set("keyStrategy", JacksonMapper.getDefault().valueToTree(value.getKeyStrategy()));
             jgen.writeTree(object);
         }
 
@@ -129,10 +133,14 @@ public class AppJacksonModule extends SimpleModule {
                 return null;
             }
 
+            var keyStrategyNode = tree.get("keyStrategy");
+            var keyStrategy = keyStrategyNode != null ? JacksonMapper.getDefault().treeToValue(keyStrategyNode, PasswordManagerKeyStrategy.class) : null;
+
             if (tree.has("associationKey")) {
                 var parsed = JacksonMapper.getDefault()
                         .treeToValue(tree.required("associationKey"), KeePassXcAssociationKey.class);
                 return KeePassXcPasswordManager.builder()
+                        .keyStrategy(keyStrategy)
                         .associationKeys(parsed != null ? List.of(parsed) : List.of())
                         .build();
             } else {
@@ -142,6 +150,7 @@ public class AppJacksonModule extends SimpleModule {
                 var parsed = (List<KeePassXcAssociationKey>)
                         JacksonMapper.getDefault().treeToValue(tree.required("associationKeys"), javaType);
                 return KeePassXcPasswordManager.builder()
+                        .keyStrategy(keyStrategy)
                         .associationKeys(parsed)
                         .build();
             }
diff --git a/app/src/main/java/io/xpipe/app/util/LocalFileTracker.java b/app/src/main/java/io/xpipe/app/util/LocalFileTracker.java
index 3a197df21..1c0f55963 100644
--- a/app/src/main/java/io/xpipe/app/util/LocalFileTracker.java
+++ b/app/src/main/java/io/xpipe/app/util/LocalFileTracker.java
@@ -3,6 +3,7 @@ package io.xpipe.app.util;
 import org.apache.commons.io.FileUtils;
 
 import java.nio.file.Path;
+import java.time.Duration;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -14,6 +15,18 @@ public class LocalFileTracker {
         synchronized (localFiles) {
             localFiles.add(file);
         }
+
+        GlobalTimer.scheduleUntil(Duration.ofHours(1), false, () -> {
+            synchronized (localFiles) {
+                var copy = new HashSet<>(localFiles);
+                GlobalTimer.delay(() -> {
+                    for (Path localFile : copy) {
+                        FileUtils.deleteQuietly(localFile.toFile());
+                    }
+                }, Duration.ofMinutes(1));
+            }
+            return false;
+        });
     }
 
     public static void reset() {
diff --git a/app/src/main/java/io/xpipe/app/vnc/ExternalVncClient.java b/app/src/main/java/io/xpipe/app/vnc/ExternalVncClient.java
index 9c7c73c9d..171aa6715 100644
--- a/app/src/main/java/io/xpipe/app/vnc/ExternalVncClient.java
+++ b/app/src/main/java/io/xpipe/app/vnc/ExternalVncClient.java
@@ -1,7 +1,9 @@
 package io.xpipe.app.vnc;
 
+import io.xpipe.app.ext.PrefsValue;
 import io.xpipe.app.platform.ClipboardHelper;
 import io.xpipe.app.prefs.AppPrefs;
+import io.xpipe.app.rdp.*;
 import io.xpipe.core.OsType;
 
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
@@ -10,7 +12,7 @@ import java.util.ArrayList;
 import java.util.List;
 
 @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "type")
-public interface ExternalVncClient {
+public interface ExternalVncClient extends PrefsValue {
 
     static void launchClient(VncLaunchConfig configuration) throws Exception {
         var client = AppPrefs.get().vncClient.getValue();
@@ -55,6 +57,34 @@ public interface ExternalVncClient {
         return l;
     }
 
+
+    static ExternalVncClient determineDefault(ExternalVncClient existing) {
+        // Verify that our selection is still valid
+        if (existing != null && existing.isAvailable()) {
+            return existing;
+        }
+
+        var l = new ArrayList<ExternalVncClient>();
+        switch (OsType.ofLocal()) {
+            case OsType.Linux ignored -> {
+                l.add(new TigerVncClient.Linux());
+                l.add(new RealVncClient.Linux());
+            }
+            case OsType.MacOs ignored -> {}
+            case OsType.Windows ignored -> {
+                l.add(new TightVncClient());
+            }
+        }
+
+        var found = l.stream().filter(externalVncClient -> externalVncClient.isAvailable()).findFirst();
+        if (found.isPresent()) {
+            return found.get();
+        }
+
+        return new InternalVncClient();
+    }
+
+
     void launch(VncLaunchConfig configuration) throws Exception;
 
     boolean supportsPasswords();
diff --git a/app/src/main/java/module-info.java b/app/src/main/java/module-info.java
index d1ecd7c85..58cc75c12 100644
--- a/app/src/main/java/module-info.java
+++ b/app/src/main/java/module-info.java
@@ -59,6 +59,7 @@ open module io.xpipe.app {
     exports io.xpipe.app.secret;
     exports io.xpipe.app.platform;
     exports io.xpipe.app.spice;
+    exports io.xpipe.app.cred;
 
     requires com.sun.jna;
     requires com.sun.jna.platform;
diff --git a/app/src/main/resources/io/xpipe/app/resources/mcp/list_systems.json b/app/src/main/resources/io/xpipe/app/resources/mcp/list_systems.json
index 12dec8c3e..dfa6c7b3b 100644
--- a/app/src/main/resources/io/xpipe/app/resources/mcp/list_systems.json
+++ b/app/src/main/resources/io/xpipe/app/resources/mcp/list_systems.json
@@ -27,6 +27,14 @@
             "path": {
               "type": "string",
               "description": "The full path of the system"
+            },
+            "information": {
+              "type": "string",
+              "description": "Summary of the known system information"
+            },
+            "notes": {
+              "type": "string",
+              "description": "User-supplied notes for the individual system"
             }
           },
           "required": [
diff --git a/app/src/main/resources/io/xpipe/app/resources/style/browser.css b/app/src/main/resources/io/xpipe/app/resources/style/browser.css
index 9edc5a91e..e7649fea6 100644
--- a/app/src/main/resources/io/xpipe/app/resources/style/browser.css
+++ b/app/src/main/resources/io/xpipe/app/resources/style/browser.css
@@ -77,7 +77,7 @@
 }
 
 .browser .terminal-dock-comp {
-    -fx-padding: 7 0 7 3;
+    -fx-padding: 7 7 7 3;
 }
 
 .browser .terminal-dock-comp:empty {
diff --git a/app/src/main/resources/io/xpipe/app/resources/style/header-bars.css b/app/src/main/resources/io/xpipe/app/resources/style/header-bars.css
index 8cc228f9b..5b2d33256 100644
--- a/app/src/main/resources/io/xpipe/app/resources/style/header-bars.css
+++ b/app/src/main/resources/io/xpipe/app/resources/style/header-bars.css
@@ -26,7 +26,7 @@
 }
 
 .bar .filter-bar .text-field {
-    -fx-padding: 0.35em;
+    -fx-padding: 0.25em;
     -fx-text-fill: -color-fg-default;
 }
 
diff --git a/app/src/main/resources/io/xpipe/app/resources/style/style.css b/app/src/main/resources/io/xpipe/app/resources/style/style.css
index bae055af8..65e73eed0 100644
--- a/app/src/main/resources/io/xpipe/app/resources/style/style.css
+++ b/app/src/main/resources/io/xpipe/app/resources/style/style.css
@@ -26,10 +26,6 @@
     -fx-border-color: -color-neutral-emphasis;
 }
 
-.edit-button.icon-button-comp:hover, .root:key-navigation .edit-button.icon-button-comp:focused {
-    -fx-background-color: -color-accent-muted;
-}
-
 .scan-list {
     -fx-background-radius: 4px;
     -fx-border-width: 1;
@@ -174,6 +170,10 @@
     -fx-fill: rgb(30, 180, 30, 0.7);
 }
 
+.store-active-comp:hover {
+    -fx-opacity: 0.8;
+}
+
 .toggle-group-comp .toggle-button {
     -fx-padding: 3 10;
 }
@@ -238,3 +238,11 @@
 .ikonli-font-icon.graphic.terminal-dock-button {
     -fx-icon-color: -color-accent-fg;
 }
+
+.text-field:focused {
+    -fx-prompt-text-fill: -color-fg-subtle;
+}
+
+.agent-socket-choice:disabled .text-field {
+    -fx-opacity: 1.0;
+}
diff --git a/beacon/src/main/java/io/xpipe/beacon/BeaconConfig.java b/beacon/src/main/java/io/xpipe/beacon/BeaconConfig.java
index 204b11292..917955f92 100644
--- a/beacon/src/main/java/io/xpipe/beacon/BeaconConfig.java
+++ b/beacon/src/main/java/io/xpipe/beacon/BeaconConfig.java
@@ -63,7 +63,7 @@ public class BeaconConfig {
         } else {
             var path = Path.of(System.getProperty("java.io.tmpdir"), staging ? "xpipe-ptb" : "xpipe", "beacon-auth");
             if (path.startsWith(Path.of("C:\\Windows"))) {
-                path = Path.of(System.getenv("LOCALAPPDATA")).resolve("TEMP");
+                path = Path.of(System.getenv("LOCALAPPDATA")).resolve("Temp", staging ? "xpipe-ptb" : "xpipe", "beacon-auth");
             }
             return path;
         }
diff --git a/build.gradle b/build.gradle
index aa47d3683..22c8cb4b8 100644
--- a/build.gradle
+++ b/build.gradle
@@ -23,12 +23,6 @@ allprojects { subproject ->
         preserveFileTimestamps = true
         useFileSystemPermissions()
     }
-
-    repositories {
-        maven {
-            url = uri("https://central.sonatype.com/repository/maven-snapshots")
-        }
-    }
 }
 
 subprojects {subproject ->
diff --git a/dist/changelog/21.2.1.md b/dist/changelog/21.2.1.md
new file mode 100644
index 000000000..61b7c22b5
--- /dev/null
+++ b/dist/changelog/21.2.1.md
@@ -0,0 +1,8 @@
+- Fix Pageant and custom SSH agents on Windows not working
+- Fix Pageant integration using wrong named pipe when multiple users were logged in on Windows
+- Fix plain directory sync not working for OneDrive directories
+- Fix terminal docking not working after window had been minimized to system tray
+- Fix Windows vault lock and hibernation lock not working after window had been minimized to system tray
+- Fix NullPointer when launching docked terminal via a desktop shortcut when XPipe was not running yet
+- Fix desktop shortcuts for actions not applying any custom workspace directories
+- Fix various other NullPointers
diff --git a/dist/changelog/21.2.md b/dist/changelog/21.2.md
index 8cca86f48..dcbf17c0d 100644
--- a/dist/changelog/21.2.md
+++ b/dist/changelog/21.2.md
@@ -1,5 +1,9 @@
+- Fix various SSH agents not working if the socket path contained spaces
 - Fix terminal docking not working properly on multiple displays with different scale factor
-- Fix terminal docking not automatically reattaching windows that were moved back to the dock
-- Fix automatic updater not pausing terminal session when update failed
+- Fix terminal docking sometimes not automatically reattaching windows that were moved back to the dock
+- The terminal dock indicator icon will now show a different icon to indicate when the terminal is detached 
 - Automatically delete corrupted git index file when detected
-- 
+- Fix terminal test button not showing for the terminal selection in the settings menu
+- Fix network switch ports being included in total connection count
+- Fix various NullPointers
+- Fix some broken documentation links
diff --git a/dist/changelog/21.3.md b/dist/changelog/21.3.md
index 73ce0ebe9..3f2940562 100644
--- a/dist/changelog/21.3.md
+++ b/dist/changelog/21.3.md
@@ -1 +1,45 @@
+## Terminal docking
+
+- Restore proper window borders once a terminal is undocked
+- Fix terminals randomly undocking
+- Fix docked terminals in background sometimes being larger than main window
+- The connection hub button will now always hide the terminal when clicked
+- Fix file browser docking tabbing being inconsistent
+- Fix dock being broken after application window has been hidden once
+
+## Shell detection
+
+Add new experimental heuristic for detecting custom shells of limited/embedded systems. Now, even if XPipe does not know the shell type and can't communicate with it, it will use heuristics to determine whether the shell is responding properly or the connection timeouted.
+
+This should make the process of adding connections to custom systems that don't run a common operating system much easier. 
+
+## MCP
+
+The MCP server integration has been improved. The connection query by name for agents has been improved to reduce ambiguous results. Furthermore, the MCP instructions haven been augmented for various popular clients:
+
+![](https://xpipe.io/assets/images/BlogPage/mcp-instructions.png)
+
+There is now also the option to pass additional context to any agent to apply consistent rules and information:
+
+![](https://xpipe.io/assets/images/BlogPage/mcp-context.png)
+
+The MCP integration can also now be used to manage cisco switches via the new integration:
+
+![](https://xpipe.io/assets/images/BlogPage/mcp-switch.png)
+
+## Other
+
+- Add support for all other Keeper password manager 2FA methods (you have to reconfigure this in the settings menu if you already use Keeper with 2FA)
+- Fix vault sync for plain directories failing in OneDrive directories
+- Fix vault sync for plain directories not working well with immediate sync mode
+- Improve rendering performance on Windows
 - Add support for neovim editor (Thanks to @leycm)
+- Fix WezTerm not using tabs on Linux (Thanks to @leycm)
+- Fix WezTerm tab titles not being overridden (Thanks to @leycm)
+- Add browser context menu action for gradlew files to run tasks (Thanks to @leycm)
+- Fix AUR update failing if git core.autocrlf was set to true (Thanks to @leycm)
+- Fix SSH config update for VsCode integration creating connection duplicates
+- Fix various terminal updaters instantly closing when update failed
+- Fix VsCode not launching in Webtop due to sandbox restrictions
+- Add custom theming to Webtop
+- Fix various NullPointers
diff --git a/dist/changelog/21.4.md b/dist/changelog/21.4.md
new file mode 100644
index 000000000..99f6eec63
--- /dev/null
+++ b/dist/changelog/21.4.md
@@ -0,0 +1,16 @@
+- Sign all auxiliary libraries on Windows to make AVs happy
+- Fix docked terminals not being properly restored when XPipe is closed
+- Fix Windows codesign timestamps not being set for signed execuables
+- Fix auxiliary DLLs not being codesigned on Windows
+- Fix PowerShell Remote session handling on non-Windows systems
+- Fix startup issues when system temp dir variable was not properly set on Windows
+- Fix blurry images when multiple screens had different display scale
+- Fix docked terminals not being properly hidden when minimized
+- Fix ptyxis terminal tabs not having titles (Thanks to @ Ehsan-U)
+- Fix AUR package not including desktop icons in all resolutions and sometimes not showing icons
+- Fix Termius integration launching browser instead
+- Fix sudo shell environments not properly handling permissions for local machine in file browser
+- Fix custom icon choice dialog being slow
+- Fix Proxmox LXC integration failing to determine IP if container had multiple IPs assigned
+- Add button to test custom SSH agent socket in settings
+- Add support for Cisco IOS-XE devices for cisco integration
diff --git a/dist/changelog/22.0.md b/dist/changelog/22.0.md
new file mode 100644
index 000000000..2afefeb6d
--- /dev/null
+++ b/dist/changelog/22.0.md
@@ -0,0 +1,27 @@
+## Password manager SSH agents
+
+This release comes with a much improved integration for password managers that offer SSH agent support. This current includes 1Password, Bitwarden, KeePassXC, and Keeper:
+
+![Agent Setting](https://xpipe.io/assets/images/BlogPage/pwman-agent.png)
+
+For all other types of identities, there is also now a new option to use the password manager agent:
+
+![Agent Key](https://xpipe.io/assets/images/BlogPage/pwman-sshkey.png)
+
+This option will automatically handle the password manager agent and also accepts key names (if the password manager supports that) to accommodate for changing keys. The password manager option is a simpler replacement for the previous custom SSH agent setting, which still exists for other types of agents.
+
+## SSH agent list
+
+Previously, one would have to specify the exact matching public key for any agent-based key to make the agent only use that one key. This was quite tedious, so there is now a new helper menu to choose the right key from a menu:
+
+![Agent Choice](https://xpipe.io/assets/images/BlogPage/agent-choice.png)
+
+Selecting an entry from the list will automatically fill in the public key.
+
+## Multi identities
+
+In a team vault environment, different users might want to use different local identities to connect to the same system. Or you maybe just want to be able to quickly switch between different logins for a system. With multi identities, you can do this now:
+
+![Multi Identity](https://xpipe.io/assets/images/BlogPage/multi-identity.png)
+
+These identities allow you to choose which available identity should be used. For team vaults, it will automatically choose an available local identity when other referenced identities are not available to the current user, allowing each user to use their own local identity without issues.
\ No newline at end of file
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/host/CopyIpActionProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/host/CopyIpActionProvider.java
new file mode 100644
index 000000000..0bdb232a5
--- /dev/null
+++ b/ext/base/src/main/java/io/xpipe/ext/base/host/CopyIpActionProvider.java
@@ -0,0 +1,59 @@
+package io.xpipe.ext.base.host;
+
+import io.xpipe.app.action.AbstractAction;
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.ext.HostAddress;
+import io.xpipe.app.hub.action.HubLeafProvider;
+import io.xpipe.app.hub.action.StoreAction;
+import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.platform.ClipboardHelper;
+import io.xpipe.app.platform.LabelGraphic;
+import io.xpipe.app.storage.DataStoreEntryRef;
+
+import javafx.beans.value.ObservableValue;
+
+import lombok.experimental.SuperBuilder;
+import lombok.extern.jackson.Jacksonized;
+
+public class CopyIpActionProvider implements HubLeafProvider<HostAddressStore> {
+
+    @Override
+    public AbstractAction createAction(DataStoreEntryRef<HostAddressStore> ref) {
+        return Action.builder().ref(ref).build();
+    }
+
+    @Override
+    public ObservableValue<String> getName(DataStoreEntryRef<HostAddressStore> store) {
+        return AppI18n.observable("copyIp");
+    }
+
+    @Override
+    public LabelGraphic getIcon(DataStoreEntryRef<HostAddressStore> store) {
+        return new LabelGraphic.IconGraphic("mdi2c-clipboard-list-outline");
+    }
+
+    @Override
+    public Class<?> getApplicableClass() {
+        return HostAddressStore.class;
+    }
+
+    @Override
+    public String getId() {
+        return "copyIp";
+    }
+
+    @Jacksonized
+    @SuperBuilder
+    public static class Action extends StoreAction<HostAddressStore> {
+
+        @Override
+        public void executeImpl() {
+            var addr = ref.getStore().getHostAddress();
+            if (addr == null || addr.equals(HostAddress.empty())) {
+                throw ErrorEventFactory.expected(new IllegalStateException("System does not have a last known IP"));
+            } else {
+                ClipboardHelper.copyText(addr.get());
+            }
+        }
+    }
+}
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityApplyDialog.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityApplyDialog.java
index 4c4bba4cc..f36885d54 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityApplyDialog.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityApplyDialog.java
@@ -60,7 +60,7 @@ public class IdentityApplyDialog {
             var hasPassword =
                     identity.getPassword() != null && identity.getPassword().expectsQuery();
             var hasIdentity = identity.getSshIdentity() != null
-                    && identity.getSshIdentity().getPublicKey() != null;
+                    && identity.getSshIdentity().getPublicKeyStrategy() != null;
 
             configFile = getSystemConfigPath(sc);
             authorizedKeysFile = getAuthorizedKeysFile(sc);
@@ -81,9 +81,9 @@ public class IdentityApplyDialog {
             if (hasIdentity) {
                 var authorizedKeysContent = getAuthorizedKeysContent(sc);
 
-                var publicKey = identity.getSshIdentity().getPublicKey();
+                var publicKey = identity.getSshIdentity().getPublicKeyStrategy().retrievePublicKey();
                 var split = publicKey.split("\\s+");
-                var basePublicKey = split[0] + " " + split[1];
+                var basePublicKey = split.length > 1 ? split[0] + " " + split[1] : split[0];
 
                 inAuthorizedKeys = authorizedKeysContent.toLowerCase().contains(basePublicKey.toLowerCase());
             } else {
@@ -237,7 +237,7 @@ public class IdentityApplyDialog {
                             addPublicKey(
                                     systemState.get(),
                                     sc,
-                                    identity.getSshIdentity().getPublicKey());
+                                    identity.getSshIdentity().getPublicKeyStrategy().retrievePublicKey());
                             systemState.setValue(SystemState.of(sc, identity));
                         });
                     });
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityApplyHubLeafProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityApplyHubLeafProvider.java
index d51906990..f1c0f369f 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityApplyHubLeafProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityApplyHubLeafProvider.java
@@ -11,7 +11,7 @@ import io.xpipe.app.platform.LabelGraphic;
 import io.xpipe.app.process.ShellTtyState;
 import io.xpipe.app.process.SystemState;
 import io.xpipe.app.storage.DataStoreEntryRef;
-import io.xpipe.ext.base.identity.ssh.NoIdentityStrategy;
+import io.xpipe.app.cred.NoIdentityStrategy;
 
 import javafx.beans.value.ObservableValue;
 
@@ -75,7 +75,7 @@ public class IdentityApplyHubLeafProvider implements HubLeafProvider<IdentitySto
         public void executeImpl() {
             if (ref.getStore().getSshIdentity() != null
                     && !(ref.getStore().getSshIdentity() instanceof NoIdentityStrategy)
-                    && ref.getStore().getSshIdentity().getPublicKey() == null) {
+                    && ref.getStore().getSshIdentity().getPublicKeyStrategy() == null) {
                 AppDialog.confirm("identityApplyMissingPublicKey");
                 StoreCreationDialog.showEdit(ref.get());
                 return;
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityChoiceBuilder.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityChoiceBuilder.java
index 899f11c68..246b68cc6 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityChoiceBuilder.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityChoiceBuilder.java
@@ -16,8 +16,8 @@ import io.xpipe.app.storage.DataStorage;
 import io.xpipe.app.storage.DataStorageUserHandler;
 import io.xpipe.app.storage.DataStoreEntryRef;
 import io.xpipe.app.util.*;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategyChoiceConfig;
+import io.xpipe.app.cred.SshIdentityStrategy;
+import io.xpipe.app.cred.SshIdentityStrategyChoiceConfig;
 
 import javafx.beans.binding.Bindings;
 import javafx.beans.property.*;
@@ -85,7 +85,7 @@ public class IdentityChoiceBuilder {
                 .allowNull(false)
                 .property(identity)
                 .customConfiguration(config)
-                .available(SshIdentityStrategy.getSubclasses())
+                .available(SshIdentityStrategy.getClasses())
                 .transformer(entryComboBox -> {
                     var button = new ButtonComp(null, new LabelGraphic.IconGraphic("mdi2k-key-plus"), () -> {
                         ProcessControlProvider.get().showSshKeygenDialog(null, identity);
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentitySelectComp.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentitySelectComp.java
index ea0ac3248..e9886f148 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentitySelectComp.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentitySelectComp.java
@@ -17,8 +17,8 @@ import io.xpipe.app.secret.SecretRetrievalStrategy;
 import io.xpipe.app.storage.DataStorage;
 import io.xpipe.app.storage.DataStoreEntry;
 import io.xpipe.app.storage.DataStoreEntryRef;
-import io.xpipe.ext.base.identity.ssh.NoIdentityStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategy;
+import io.xpipe.app.cred.NoIdentityStrategy;
+import io.xpipe.app.cred.SshIdentityStrategy;
 
 import javafx.application.Platform;
 import javafx.beans.binding.Bindings;
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityStore.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityStore.java
index 1d9d7bd76..46282c45c 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityStore.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityStore.java
@@ -1,16 +1,17 @@
 package io.xpipe.ext.base.identity;
 
+import io.xpipe.app.cred.UsernameStrategy;
 import io.xpipe.app.ext.DataStore;
 import io.xpipe.app.ext.SelfReferentialStore;
 import io.xpipe.app.secret.SecretRetrievalStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategy;
+import io.xpipe.app.cred.SshIdentityStrategy;
 
 import lombok.EqualsAndHashCode;
 import lombok.Getter;
 import lombok.ToString;
 import lombok.experimental.SuperBuilder;
 
-@SuperBuilder
+@SuperBuilder(toBuilder = true)
 @EqualsAndHashCode
 @ToString
 @Getter
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityStoreProvider.java
index 137fc0381..8f637ac1e 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityStoreProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityStoreProvider.java
@@ -6,6 +6,7 @@ import io.xpipe.app.hub.comp.StoreEntryWrapper;
 import io.xpipe.app.hub.comp.StoreSection;
 import io.xpipe.app.hub.comp.SystemStateComp;
 
+import javafx.beans.binding.Bindings;
 import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.property.SimpleStringProperty;
 import javafx.beans.value.ObservableValue;
@@ -38,7 +39,9 @@ public abstract class IdentityStoreProvider implements DataStoreProvider {
 
     @Override
     public ObservableValue<String> informationString(StoreSection section) {
-        var st = (IdentityStore) section.getWrapper().getStore().getValue();
-        return new SimpleStringProperty(IdentitySummary.createSummary(st));
+        return Bindings.createStringBinding(() -> {
+            var st = (IdentityStore) section.getWrapper().getStore().getValue();
+            return IdentitySummary.createSummary(st);
+        }, section.getWrapper().getPersistentState());
     }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentitySummary.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentitySummary.java
index 14072f6ab..f86ad6660 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentitySummary.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentitySummary.java
@@ -1,11 +1,26 @@
 package io.xpipe.ext.base.identity;
 
 import io.xpipe.app.secret.SecretNoneStrategy;
-import io.xpipe.ext.base.identity.ssh.NoIdentityStrategy;
+import io.xpipe.app.cred.NoIdentityStrategy;
 
 public class IdentitySummary {
 
     public static String createSummary(IdentityStore st) {
+        if (st instanceof MultiIdentityStore mis) {
+            var selected = mis.getSelected();
+            if (selected.isPresent()) {
+                return createSummary(selected.get().getStore());
+            }
+        }
+
+        if (st instanceof PasswordManagerIdentityStore pmis) {
+            var s = "Credentials " + pmis.getKey();
+            if (pmis.getSshIdentity() != null && !(pmis.getSshIdentity() instanceof NoIdentityStrategy)) {
+                s += " + agent key";
+            }
+            return s;
+        }
+
         var user = st.getUsername().hasUser()
                 ? st.getUsername().getFixedUsername().map(s -> "User " + s).orElse("User")
                 : "Anonymous user";
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityValue.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityValue.java
index 72c67fea5..a724cb171 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityValue.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityValue.java
@@ -9,8 +9,8 @@ import io.xpipe.app.storage.DataStoreCategory;
 import io.xpipe.app.storage.DataStoreEntry;
 import io.xpipe.app.storage.DataStoreEntryRef;
 import io.xpipe.app.util.Validators;
-import io.xpipe.ext.base.identity.ssh.NoIdentityStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategy;
+import io.xpipe.app.cred.NoIdentityStrategy;
+import io.xpipe.app.cred.SshIdentityStrategy;
 
 import com.fasterxml.jackson.annotation.JsonSubTypes;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityConvertHubLeafProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityConvertHubLeafProvider.java
index 043075862..476d88993 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityConvertHubLeafProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityConvertHubLeafProvider.java
@@ -74,7 +74,7 @@ public class LocalIdentityConvertHubLeafProvider implements HubLeafProvider<Loca
                     .sshIdentity(EncryptedValue.VaultKey.of(st.getSshIdentity()))
                     .perUser(false)
                     .build();
-            StoreCreationDialog.showEdit(ref.get(), synced, ignored -> {});
+            StoreCreationDialog.showEdit(ref.get(), synced, true, ignored -> {});
 
             // Ugly solution to sync key file if needed
             Platform.runLater(() -> {
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStore.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStore.java
index bb8093fdd..b793a40a5 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStore.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStore.java
@@ -1,8 +1,9 @@
 package io.xpipe.ext.base.identity;
 
+import io.xpipe.app.cred.UsernameStrategy;
 import io.xpipe.app.secret.EncryptedValue;
 import io.xpipe.app.secret.SecretRetrievalStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategy;
+import io.xpipe.app.cred.SshIdentityStrategy;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
 import lombok.EqualsAndHashCode;
@@ -11,7 +12,7 @@ import lombok.Value;
 import lombok.experimental.SuperBuilder;
 import lombok.extern.jackson.Jacksonized;
 
-@SuperBuilder
+@SuperBuilder(toBuilder = true)
 @JsonTypeName("localIdentity")
 @Jacksonized
 @Value
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStoreProvider.java
index bf46b3b14..2bd1c5d96 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStoreProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStoreProvider.java
@@ -10,8 +10,8 @@ import io.xpipe.app.secret.SecretRetrievalStrategy;
 import io.xpipe.app.secret.SecretStrategyChoiceConfig;
 import io.xpipe.app.storage.*;
 import io.xpipe.app.util.*;
-import io.xpipe.ext.base.identity.ssh.NoIdentityStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategyChoiceConfig;
+import io.xpipe.app.cred.NoIdentityStrategy;
+import io.xpipe.app.cred.SshIdentityStrategyChoiceConfig;
 
 import javafx.beans.property.Property;
 import javafx.beans.property.SimpleObjectProperty;
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStore.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStore.java
new file mode 100644
index 000000000..4877a3a12
--- /dev/null
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStore.java
@@ -0,0 +1,99 @@
+package io.xpipe.ext.base.identity;
+
+import com.fasterxml.jackson.annotation.JsonTypeName;
+import io.xpipe.app.core.AppCache;
+import io.xpipe.app.cred.SshIdentityStrategy;
+import io.xpipe.app.cred.UsernameStrategy;
+import io.xpipe.app.ext.InternalCacheDataStore;
+import io.xpipe.app.ext.StatefulDataStore;
+import io.xpipe.app.ext.ValidationException;
+import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.secret.EncryptedValue;
+import io.xpipe.app.secret.SecretRetrievalStrategy;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.storage.DataStoreEntry;
+import io.xpipe.app.storage.DataStoreEntryRef;
+import io.xpipe.app.util.Validators;
+import lombok.EqualsAndHashCode;
+import lombok.ToString;
+import lombok.Value;
+import lombok.experimental.SuperBuilder;
+import lombok.extern.jackson.Jacksonized;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+
+@SuperBuilder
+@JsonTypeName("multiIdentity")
+@Jacksonized
+@Value
+@EqualsAndHashCode(callSuper = true)
+@ToString(callSuper = true)
+public class MultiIdentityStore extends IdentityStore implements StatefulDataStore<MultiIdentityStoreState> {
+
+    List<UUID> identities;
+
+    public List<DataStoreEntryRef<IdentityStore>> getAvailableIdentities() {
+        return identities.stream().map(uuid -> DataStorage.get().getStoreEntryIfPresent(uuid)).flatMap(Optional::stream)
+                .map(e -> e.<IdentityStore>ref())
+                .filter(ref -> ref != null && ref.get().getValidity().isUsable()).toList();
+    }
+
+    public Optional<DataStoreEntryRef<IdentityStore>> getSelected() {
+        var cached = getState().getSelected();
+        if (cached != null) {
+            var entry = DataStorage.get().getStoreEntryIfPresent(cached);
+            if (entry.isPresent() && entry.get().getValidity().isUsable() && getAvailableIdentities().contains(entry.get().ref())) {
+                return Optional.of(entry.get().ref());
+            }
+        }
+
+        var fallback = getAvailableIdentities().stream().findFirst();
+        if (fallback.isPresent()) {
+            return fallback;
+        }
+
+        return Optional.empty();
+    }
+
+    public void select(DataStoreEntryRef<IdentityStore> entry) {
+        if (!getAvailableIdentities().contains(entry)) {
+            return;
+        }
+
+        setState(MultiIdentityStoreState.builder().selected(entry.get().getUuid()).build());
+    }
+
+    private DataStoreEntryRef<IdentityStore> getSelectedOrThrow() {
+        var found = getSelected();
+        if (found.isPresent()) {
+            return found.get();
+        }
+        throw ErrorEventFactory.expected(new IllegalStateException("No available identity for multi identity " + getSelfEntry().getName()));
+    }
+
+    @Override
+    public void checkComplete() throws Throwable {
+        getSelectedOrThrow();
+    }
+
+    public UsernameStrategy getUsername() {
+        return getSelectedOrThrow().getStore().getUsername();
+    }
+
+    @Override
+    public SecretRetrievalStrategy getPassword() {
+        return getSelectedOrThrow().getStore().getPassword();
+    }
+
+    @Override
+    public SshIdentityStrategy getSshIdentity() {
+        return getSelectedOrThrow().getStore().getSshIdentity();
+    }
+
+    @Override
+    public Class<MultiIdentityStoreState> getStateClass() {
+        return MultiIdentityStoreState.class;
+    }
+}
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStoreProvider.java
new file mode 100644
index 000000000..b724efb50
--- /dev/null
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStoreProvider.java
@@ -0,0 +1,76 @@
+package io.xpipe.ext.base.identity;
+
+import io.xpipe.app.cred.NoIdentityStrategy;
+import io.xpipe.app.cred.SshIdentityStrategyChoiceConfig;
+import io.xpipe.app.ext.DataStore;
+import io.xpipe.app.ext.GuiDialog;
+import io.xpipe.app.hub.comp.StoreListChoiceComp;
+import io.xpipe.app.hub.comp.StoreViewState;
+import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
+import io.xpipe.app.secret.EncryptedValue;
+import io.xpipe.app.secret.SecretNoneStrategy;
+import io.xpipe.app.secret.SecretRetrievalStrategy;
+import io.xpipe.app.secret.SecretStrategyChoiceConfig;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.storage.DataStoreCategory;
+import io.xpipe.app.storage.DataStoreEntry;
+import io.xpipe.app.storage.DataStoreEntryRef;
+import io.xpipe.app.util.DocumentationLink;
+import javafx.beans.property.Property;
+import javafx.beans.property.SimpleListProperty;
+import javafx.beans.property.SimpleObjectProperty;
+import javafx.beans.property.SimpleStringProperty;
+import javafx.collections.FXCollections;
+
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.UUID;
+
+public class MultiIdentityStoreProvider extends IdentityStoreProvider {
+
+    @Override
+    public GuiDialog guiDialog(DataStoreEntry entry, Property<DataStore> store) {
+        MultiIdentityStore st = (MultiIdentityStore) store.getValue();
+
+        var identities = new SimpleListProperty<>(FXCollections.observableArrayList(st.getAvailableIdentities()));
+
+        return new OptionsBuilder()
+                .nameAndDescription("multiIdentityList")
+                .addComp(new StoreListChoiceComp<>(identities, IdentityStore.class,
+                        ref -> !(ref.getStore() instanceof MultiIdentityStore) && !identities.contains(ref),
+                        StoreViewState.get().getAllIdentitiesCategory()), identities)
+                .bind(
+                        () -> {
+                            var uuids = new LinkedHashSet<UUID>();
+                            for (DataStoreEntryRef<IdentityStore> identity : identities) {
+                                uuids.add(identity.get().getUuid());
+                            }
+                            uuids.addAll(st.getIdentities());
+
+                            return MultiIdentityStore.builder()
+                                    .identities(new ArrayList<>(uuids))
+                                    .build();
+                        },
+                        store)
+                .buildDialog();
+    }
+
+    @Override
+    public DataStore defaultStore(DataStoreCategory category) {
+        return MultiIdentityStore.builder()
+                .identities(new ArrayList<>())
+                .build();
+    }
+
+    @Override
+    public String getId() {
+        return "multiIdentity";
+    }
+
+    @Override
+    public List<Class<?>> getStoreClasses() {
+        return List.of(MultiIdentityStore.class);
+    }
+}
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStoreState.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStoreState.java
new file mode 100644
index 000000000..faffce2d4
--- /dev/null
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentityStoreState.java
@@ -0,0 +1,28 @@
+package io.xpipe.ext.base.identity;
+
+import io.xpipe.app.ext.DataStoreState;
+import io.xpipe.app.process.ShellStoreState;
+import lombok.EqualsAndHashCode;
+import lombok.Value;
+import lombok.experimental.SuperBuilder;
+import lombok.extern.jackson.Jacksonized;
+
+import java.util.UUID;
+
+@Value
+@EqualsAndHashCode(callSuper = true)
+@SuperBuilder(toBuilder = true)
+@Jacksonized
+public class MultiIdentityStoreState extends ShellStoreState {
+
+    UUID selected;
+
+    @Override
+    public DataStoreState mergeCopy(DataStoreState newer) {
+        var n = (MultiIdentityStoreState) newer;
+        var b = toBuilder();
+        mergeBuilder(n, b);
+        return b.selected(useNewer(selected, n.selected))
+                .build();
+    }
+}
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentitySwitchBranchProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentitySwitchBranchProvider.java
new file mode 100644
index 000000000..721068a58
--- /dev/null
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/MultiIdentitySwitchBranchProvider.java
@@ -0,0 +1,89 @@
+package io.xpipe.ext.base.identity;
+
+import io.xpipe.app.core.AppI18n;
+import io.xpipe.app.hub.action.HubBranchProvider;
+import io.xpipe.app.hub.action.HubLeafProvider;
+import io.xpipe.app.hub.action.HubMenuItemProvider;
+import io.xpipe.app.hub.action.StoreActionCategory;
+import io.xpipe.app.platform.LabelGraphic;
+import io.xpipe.app.storage.DataStorage;
+import io.xpipe.app.storage.DataStoreEntryRef;
+import javafx.beans.property.ReadOnlyStringWrapper;
+import javafx.beans.value.ObservableValue;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+public class MultiIdentitySwitchBranchProvider implements HubBranchProvider<MultiIdentityStore> {
+
+    @Override
+    public boolean isMajor() {
+        return true;
+    }
+
+    @Override
+    public List<HubMenuItemProvider<?>> getChildren(DataStoreEntryRef<MultiIdentityStore> store) {
+        var selected = store.getStore().getSelected();
+        return store.getStore().getAvailableIdentities().stream()
+                .map(is -> {
+                    return new IdentityProvider(is, selected.map(ref -> ref.equals(is)).orElse(false));
+                })
+                .collect(Collectors.toList());
+    }
+
+    @Override
+    public StoreActionCategory getCategory() {
+        return StoreActionCategory.CONFIGURATION;
+    }
+
+    @Override
+    public boolean isApplicable(DataStoreEntryRef<MultiIdentityStore> o) {
+        return o.getStore().getAvailableIdentities().size() > 1;
+    }
+
+    @Override
+    public ObservableValue<String> getName(DataStoreEntryRef<MultiIdentityStore> store) {
+        return AppI18n.observable("switchIdentity");
+    }
+
+    @Override
+    public LabelGraphic getIcon(DataStoreEntryRef<MultiIdentityStore> store) {
+        return new LabelGraphic.IconGraphic("mdi2f-format-list-group");
+    }
+
+    @Override
+    public Class<MultiIdentityStore> getApplicableClass() {
+        return MultiIdentityStore.class;
+    }
+
+    private static class IdentityProvider implements HubLeafProvider<MultiIdentityStore> {
+
+        private final DataStoreEntryRef<IdentityStore> identity;
+        private final boolean active;
+
+        private IdentityProvider(DataStoreEntryRef<IdentityStore> identity, boolean active) {
+            this.identity = identity;
+            this.active = active;
+        }
+
+        @Override
+        public void execute(DataStoreEntryRef<MultiIdentityStore> ref) {
+            ref.getStore().select(identity);
+        }
+
+        @Override
+        public ObservableValue<String> getName(DataStoreEntryRef<MultiIdentityStore> store) {
+            return new ReadOnlyStringWrapper((active ? "> " : "") + identity.get().getName());
+        }
+
+        @Override
+        public LabelGraphic getIcon(DataStoreEntryRef<MultiIdentityStore> store) {
+            return new LabelGraphic.ImageGraphic(identity.get().getEffectiveIconFile(), 16);
+        }
+
+        @Override
+        public Class<MultiIdentityStore> getApplicableClass() {
+            return MultiIdentityStore.class;
+        }
+    }
+}
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/PasswordManagerIdentityStore.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/PasswordManagerIdentityStore.java
index 0843baa5c..d7a555c5a 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/PasswordManagerIdentityStore.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/PasswordManagerIdentityStore.java
@@ -1,21 +1,22 @@
 package io.xpipe.ext.base.identity;
 
+import io.xpipe.app.cred.*;
 import io.xpipe.app.ext.InternalCacheDataStore;
 import io.xpipe.app.ext.UserScopeStore;
 import io.xpipe.app.ext.ValidatableStore;
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.prefs.AppPrefs;
+import io.xpipe.app.process.CommandBuilder;
+import io.xpipe.app.process.ShellControl;
 import io.xpipe.app.pwman.PasswordManager;
-import io.xpipe.app.secret.SecretQuery;
-import io.xpipe.app.secret.SecretQueryResult;
-import io.xpipe.app.secret.SecretQueryState;
-import io.xpipe.app.secret.SecretRetrievalStrategy;
+import io.xpipe.app.secret.*;
+import io.xpipe.app.storage.DataStorage;
 import io.xpipe.app.util.*;
-import io.xpipe.ext.base.identity.ssh.NoIdentityStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategy;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
+import io.xpipe.core.KeyValue;
 import lombok.EqualsAndHashCode;
+import lombok.SneakyThrows;
 import lombok.ToString;
 import lombok.Value;
 import lombok.experimental.SuperBuilder;
@@ -23,6 +24,7 @@ import lombok.extern.jackson.Jacksonized;
 
 import java.time.Duration;
 import java.time.Instant;
+import java.util.List;
 
 @SuperBuilder
 @JsonTypeName("passwordManagerIdentity")
@@ -34,6 +36,7 @@ public class PasswordManagerIdentityStore extends IdentityStore
         implements InternalCacheDataStore, ValidatableStore, UserScopeStore {
 
     String key;
+    PasswordManagerAgentStrategy sshKey;
     boolean perUser;
 
     private boolean checkOutdatedOrRefresh() {
@@ -50,11 +53,12 @@ public class PasswordManagerIdentityStore extends IdentityStore
         return true;
     }
 
-    private PasswordManager.CredentialResult retrieveCredentials() {
+    @SneakyThrows
+    private PasswordManager.Result retrieve() {
         if (!checkOutdatedOrRefresh()) {
-            var credential = getCache("credential", PasswordManager.CredentialResult.class, null);
-            if (credential != null) {
-                return credential;
+            var r = getCache("result", PasswordManager.Result.class, null);
+            if (r != null) {
+                return r;
             }
         }
 
@@ -62,32 +66,45 @@ public class PasswordManagerIdentityStore extends IdentityStore
             return null;
         }
 
-        var r = AppPrefs.get().passwordManager().getValue().retrieveCredentials(key);
+        var r = AppPrefs.get().passwordManager().getValue().query(key);
         if (r == null) {
             throw ErrorEventFactory.expected(
                     new UnsupportedOperationException("Credentials were requested but not supplied"));
         }
 
-        if (r.getUsername() == null) {
+        if (r.getCredentials() == null) {
+            throw ErrorEventFactory.expected(
+                    new UnsupportedOperationException("Identity " + key + " does not provide credentials"));
+        }
+
+        if (r.getCredentials().getUsername() == null) {
             throw ErrorEventFactory.expected(
                     new UnsupportedOperationException("Identity " + key + " does not provide a username"));
         }
 
-        if (r.getPassword() == null) {
-            throw ErrorEventFactory.expected(
-                    new UnsupportedOperationException("Identity " + key + " does not provide a password"));
+        if (sshKey != null) {
+            var pwman = AppPrefs.get().passwordManager().getValue();
+            if (pwman.getKeyConfiguration().useInline() && r.getSshKey() == null) {
+                throw ErrorEventFactory.expected(
+                        new UnsupportedOperationException("Identity " + key + " does not provide an SSH key"));
+            }
+
+            if (pwman.getKeyConfiguration().useAgent()) {
+                SshAgentKeyList.findAgentIdentity(DataStorage.get().local().ref(),
+                        pwman.getKeyConfiguration().getSshIdentityStrategy(null, false), sshKey.getIdentifier());
+            }
         }
 
         setCache("lastQueried", Instant.now());
-        setCache("credential", r);
+        setCache("result", r);
 
         return r;
     }
 
     public UsernameStrategy getUsername() {
         return new UsernameStrategy.Dynamic(() -> {
-            var r = retrieveCredentials();
-            var effective = r != null && r.getUsername() != null ? r.getUsername() : "unknown";
+            var r = retrieve();
+            var effective = r != null && r.getCredentials() != null && r.getCredentials().getUsername() != null ? r.getCredentials().getUsername() : "unknown";
             return effective;
         });
     }
@@ -101,12 +118,12 @@ public class PasswordManagerIdentityStore extends IdentityStore
                 return new SecretQuery() {
                     @Override
                     public SecretQueryResult query(String prompt) {
-                        var r = retrieveCredentials();
-                        if (r == null || r.getPassword() == null) {
+                        var r = retrieve();
+                        if (r == null || r.getCredentials() == null || r.getCredentials().getPassword() == null) {
                             return new SecretQueryResult(null, SecretQueryState.RETRIEVAL_FAILURE);
                         }
 
-                        return new SecretQueryResult(r.getPassword(), SecretQueryState.NORMAL);
+                        return new SecretQueryResult(r.getCredentials().getPassword(), SecretQueryState.NORMAL);
                     }
 
                     @Override
@@ -130,16 +147,81 @@ public class PasswordManagerIdentityStore extends IdentityStore
 
     @Override
     public SshIdentityStrategy getSshIdentity() {
+        var def = new NoIdentityStrategy();
+        var r = AppPrefs.get().passwordManager().getValue();
+        if (r == null) {
+            return def;
+        }
+
+        var strat = r.getKeyConfiguration();
+        if (strat == null || (!strat.useInline() && !strat.useAgent())) {
+            return def;
+        }
+
+        if (strat.useInline()) {
+            return new SshIdentityStrategy() {
+                @Override
+                public void prepareParent(ShellControl parent) throws Exception {
+                    var r = retrieve();
+                    if (r == null || r.getSshKey() == null || r.getSshKey().getPrivateKey() == null) {
+                        return;
+                    }
+
+                    var inPlace = new InPlaceKeyStrategy(r.getSshKey().getPrivateKey(), null, new SecretPromptStrategy());
+                    inPlace.prepareParent(parent);
+                }
+
+                @Override
+                public void buildCommand(CommandBuilder builder) {
+                    var r = retrieve();
+                    if (r == null || r.getSshKey() == null || r.getSshKey().getPrivateKey() == null) {
+                        return;
+                    }
+
+                    var inPlace = new InPlaceKeyStrategy(r.getSshKey().getPrivateKey(), null, new SecretPromptStrategy());
+                    inPlace.buildCommand(builder);
+                }
+
+                @Override
+                public List<KeyValue> configOptions(ShellControl sc) throws Exception {
+                    var r = retrieve();
+                    if (r == null || r.getSshKey() == null || r.getSshKey().getPrivateKey() == null) {
+                        return List.of();
+                    }
+
+                    var inPlace = new InPlaceKeyStrategy(r.getSshKey().getPrivateKey(), null, new SecretPromptStrategy());
+                    return inPlace.configOptions(sc);
+                }
+
+                @Override
+                public PublicKeyStrategy getPublicKeyStrategy() {
+                    var r = retrieve();
+                    if (r == null || r.getSshKey() == null || r.getSshKey().getPublicKey() == null) {
+                        return null;
+                    }
+
+                    return PublicKeyStrategy.Fixed.of(r.getSshKey().getPublicKey());
+                }
+            };
+        }
+
+        if (strat.useAgent() && sshKey != null) {
+            return sshKey;
+        }
+
         return new NoIdentityStrategy();
     }
 
     @Override
     public void checkComplete() throws Throwable {
         Validators.nonNull(key);
+        if (sshKey != null) {
+            sshKey.checkComplete();
+        }
     }
 
     @Override
     public void validate() {
-        retrieveCredentials();
+        retrieve();
     }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/PasswordManagerIdentityStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/PasswordManagerIdentityStoreProvider.java
index 42298679c..f45b172bf 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/PasswordManagerIdentityStoreProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/PasswordManagerIdentityStoreProvider.java
@@ -1,26 +1,45 @@
 package io.xpipe.ext.base.identity;
 
+import io.xpipe.app.cred.PasswordManagerAgentStrategy;
+import io.xpipe.app.cred.SshIdentityStrategyChoiceConfig;
 import io.xpipe.app.ext.DataStore;
-import io.xpipe.app.ext.DataStoreCreationCategory;
 import io.xpipe.app.ext.GuiDialog;
 import io.xpipe.app.platform.OptionsBuilder;
+import io.xpipe.app.platform.OptionsChoiceBuilder;
 import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.prefs.PasswordManagerTestComp;
+import io.xpipe.app.storage.DataStorage;
 import io.xpipe.app.storage.DataStorageUserHandler;
 import io.xpipe.app.storage.DataStoreCategory;
 import io.xpipe.app.storage.DataStoreEntry;
 
-import javafx.beans.property.Property;
-import javafx.beans.property.SimpleBooleanProperty;
-import javafx.beans.property.SimpleStringProperty;
+import javafx.beans.binding.Bindings;
+import javafx.beans.property.*;
 
 import java.util.List;
+import java.util.UUID;
 
 public class PasswordManagerIdentityStoreProvider extends IdentityStoreProvider {
 
+
+
     @Override
-    public DataStoreCreationCategory getCreationCategory() {
-        return AppPrefs.get().passwordManager().getValue() != null ? DataStoreCreationCategory.IDENTITY : null;
+    public UUID getTargetCategory(DataStore store, UUID target) {
+        PasswordManagerIdentityStore st = (PasswordManagerIdentityStore) store;
+        if (st == null || !st.isPerUser()) {
+            return target;
+        }
+
+        var cat = DataStorage.get().getStoreCategoryIfPresent(target).orElseThrow();
+        var inSynced = DataStorage.get().getCategoryParentHierarchy(cat).stream()
+                .anyMatch(dataStoreCategory ->
+                        dataStoreCategory.getUuid().equals(DataStorage.SYNCED_IDENTITIES_CATEGORY_UUID));
+        return inSynced ? target : DataStorage.SYNCED_IDENTITIES_CATEGORY_UUID;
+    }
+
+    @Override
+    public boolean allowCreation() {
+        return AppPrefs.get().passwordManager().getValue() != null;
     }
 
     @Override
@@ -28,13 +47,32 @@ public class PasswordManagerIdentityStoreProvider extends IdentityStoreProvider
         PasswordManagerIdentityStore st = (PasswordManagerIdentityStore) store.getValue();
 
         var key = new SimpleStringProperty(st.getKey());
+        var sshKey = new SimpleObjectProperty<>(st.getSshKey());
         var perUser = new SimpleBooleanProperty(st.isPerUser());
 
-        var comp = new PasswordManagerTestComp(key, false);
+        var sshIdentityChoiceConfig = SshIdentityStrategyChoiceConfig.builder()
+                .allowAgentForward(true)
+                .allowKeyFileSync(true)
+                .perUserKeyFileCheck(() -> false)
+                .fileSystem(new ReadOnlyObjectWrapper<>(DataStorage.get().local().ref()))
+                .build();
+        var sshKeyChoice = OptionsChoiceBuilder.builder().allowNull(true)
+                .customConfiguration(sshIdentityChoiceConfig)
+                .available(List.of(PasswordManagerAgentStrategy.class)).property(sshKey).build();
+        var hideSshKeyChoice = Bindings.createBooleanBinding(() -> {
+            var pwman = AppPrefs.get().passwordManager().getValue();
+            var strat = pwman.getKeyConfiguration();
+            return strat.useInline();
+        }, AppPrefs.get().passwordManager());
+
+        var testComp = new PasswordManagerTestComp(key, false);
         return new OptionsBuilder()
                 .nameAndDescription("passwordManagerKey")
-                .addComp(comp.hgrow(), key)
+                .addComp(testComp.hgrow(), key)
                 .nonNull()
+                .nameAndDescription("passwordManagerIdentityAgentKey")
+                .sub(sshKeyChoice.build(), sshKey)
+                .hide(hideSshKeyChoice)
                 .nameAndDescription(
                         DataStorageUserHandler.getInstance().getActiveUser() != null
                                 ? "identityPerUser"
@@ -45,6 +83,7 @@ public class PasswordManagerIdentityStoreProvider extends IdentityStoreProvider
                         () -> {
                             return PasswordManagerIdentityStore.builder()
                                     .key(key.get())
+                                    .sshKey(sshKey.get())
                                     .build();
                         },
                         store)
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStore.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStore.java
index 1ede508de..e8ed826a4 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStore.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStore.java
@@ -1,11 +1,12 @@
 package io.xpipe.ext.base.identity;
 
+import io.xpipe.app.cred.UsernameStrategy;
 import io.xpipe.app.ext.UserScopeStore;
 import io.xpipe.app.ext.ValidationException;
 import io.xpipe.app.secret.EncryptedValue;
 import io.xpipe.app.secret.SecretRetrievalStrategy;
-import io.xpipe.ext.base.identity.ssh.KeyFileStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategy;
+import io.xpipe.app.cred.KeyFileStrategy;
+import io.xpipe.app.cred.SshIdentityStrategy;
 
 import com.fasterxml.jackson.annotation.JsonTypeName;
 import lombok.EqualsAndHashCode;
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStoreProvider.java
index f654cd6b6..91613e41a 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStoreProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStoreProvider.java
@@ -8,6 +8,7 @@ import io.xpipe.app.hub.comp.StoreEntryWrapper;
 import io.xpipe.app.platform.OptionsBuilder;
 import io.xpipe.app.platform.OptionsChoiceBuilder;
 import io.xpipe.app.platform.Validator;
+import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.prefs.VaultAuthentication;
 import io.xpipe.app.secret.EncryptedValue;
 import io.xpipe.app.secret.SecretNoneStrategy;
@@ -15,9 +16,9 @@ import io.xpipe.app.secret.SecretRetrievalStrategy;
 import io.xpipe.app.secret.SecretStrategyChoiceConfig;
 import io.xpipe.app.storage.*;
 import io.xpipe.app.util.*;
-import io.xpipe.ext.base.identity.ssh.KeyFileStrategy;
-import io.xpipe.ext.base.identity.ssh.NoIdentityStrategy;
-import io.xpipe.ext.base.identity.ssh.SshIdentityStrategyChoiceConfig;
+import io.xpipe.app.cred.KeyFileStrategy;
+import io.xpipe.app.cred.NoIdentityStrategy;
+import io.xpipe.app.cred.SshIdentityStrategyChoiceConfig;
 
 import javafx.beans.property.*;
 
@@ -29,8 +30,8 @@ import java.util.UUID;
 public class SyncedIdentityStoreProvider extends IdentityStoreProvider {
 
     @Override
-    public DataStoreCreationCategory getCreationCategory() {
-        return DataStorage.get().supportsSync() ? DataStoreCreationCategory.IDENTITY : null;
+    public boolean allowCreation() {
+        return DataStorage.get().supportsSync();
     }
 
     @Override
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/script/RunFileScriptMenuProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/script/RunFileScriptMenuProvider.java
index 3a6d6ec0a..2cfe03d6a 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/script/RunFileScriptMenuProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/script/RunFileScriptMenuProvider.java
@@ -143,6 +143,10 @@ public class RunFileScriptMenuProvider implements BrowserMenuBranchProvider {
             protected List<CommandBuilder> createCommand(BrowserFileSystemTabModel model, List<BrowserEntry> entries) {
                 var sc = model.getFileSystem().getShell().orElseThrow();
                 var content = ref.getStore().assembleScriptChain(sc, true);
+                if (content == null) {
+                    return List.of();
+                }
+
                 var script = ScriptHelper.createExecScript(sc, content.getValue());
                 var builder = CommandBuilder.of().add(sc.getShellDialect().runScriptCommand(sc, script.toString()));
                 for (BrowserEntry entry : entries) {
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/script/RunHubBatchScriptActionProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/script/RunHubBatchScriptActionProvider.java
index fda0e5f7d..3f673f55b 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/script/RunHubBatchScriptActionProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/script/RunHubBatchScriptActionProvider.java
@@ -30,6 +30,10 @@ public class RunHubBatchScriptActionProvider implements ActionProvider {
             for (DataStoreEntryRef<ShellStore> ref : refs) {
                 var sc = ref.getStore().getOrStartSession();
                 var script = scriptStore.getStore().assembleScriptChain(sc, false);
+                if (script == null) {
+                    continue;
+                }
+
                 var cmd = sc.command(script);
                 list.add(new CommandDialog.CommandEntry(ref.get().getName(), cmd));
             }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/script/RunHubScriptActionProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/script/RunHubScriptActionProvider.java
index e394be1f2..77875bd5a 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/script/RunHubScriptActionProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/script/RunHubScriptActionProvider.java
@@ -26,8 +26,10 @@ public class RunHubScriptActionProvider implements ActionProvider {
         public void executeImpl() throws Exception {
             var sc = ref.getStore().getOrStartSession();
             var script = scriptStore.getStore().assembleScriptChain(sc, false);
-            var cmd = sc.command(script);
-            CommandDialog.runAndShow(cmd);
+            if (script != null) {
+                var cmd = sc.command(script);
+                CommandDialog.runAndShow(cmd);
+            }
         }
 
         @Override
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/script/ScriptTextSource.java b/ext/base/src/main/java/io/xpipe/ext/base/script/ScriptTextSource.java
index 9ecf99f44..19468221d 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/script/ScriptTextSource.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/script/ScriptTextSource.java
@@ -175,6 +175,7 @@ public interface ScriptTextSource {
                 throw ErrorEventFactory.expected(new IOException(r.body()));
             }
 
+            Files.createDirectories(path.getParent());
             Files.writeString(path, r.body());
         }
 
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/service/FixedServiceGroupStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/service/FixedServiceGroupStoreProvider.java
index c0177683a..51ee40615 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/service/FixedServiceGroupStoreProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/service/FixedServiceGroupStoreProvider.java
@@ -26,6 +26,6 @@ public class FixedServiceGroupStoreProvider extends AbstractServiceGroupStorePro
     @Override
     public DataStoreEntry getDisplayParent(DataStoreEntry store) {
         FixedServiceGroupStore s = store.getStore().asNeeded();
-        return s.getParent().get();
+        return s.getParent() != null ? s.getParent().get() : null;
     }
 }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/service/FixedServiceStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/service/FixedServiceStoreProvider.java
index 3c76f2cb6..371c8f348 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/service/FixedServiceStoreProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/service/FixedServiceStoreProvider.java
@@ -23,13 +23,13 @@ public class FixedServiceStoreProvider extends AbstractServiceStoreProvider {
     @Override
     public DataStoreEntry getSyntheticParent(DataStoreEntry store) {
         FixedServiceStore s = store.getStore().asNeeded();
-        return DataStorage.get()
+        return s.getDisplayParent() != null ? DataStorage.get()
                 .getOrCreateNewSyntheticEntry(
                         s.getDisplayParent().get(),
                         "Services",
                         FixedServiceGroupStore.builder()
                                 .parent(s.getDisplayParent().asNeeded())
-                                .build());
+                                .build()) : null;
     }
 
     @Override
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/service/ServiceAddressRotation.java b/ext/base/src/main/java/io/xpipe/ext/base/service/ServiceAddressRotation.java
index 3d5ba590a..623747369 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/service/ServiceAddressRotation.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/service/ServiceAddressRotation.java
@@ -9,7 +9,7 @@ public class ServiceAddressRotation {
     private static int counter = 0;
     private static final String[] aliases = new String[] {"localhost", "127.0.0.1"};
 
-    static String getRotatedLocalhost(String url) {
+    static synchronized String getRotatedLocalhost(String url) {
         if (!url.startsWith("localhost")) {
             return url;
         }
diff --git a/ext/base/src/main/java/module-info.java b/ext/base/src/main/java/module-info.java
index 76eb685f4..5aaf3044b 100644
--- a/ext/base/src/main/java/module-info.java
+++ b/ext/base/src/main/java/module-info.java
@@ -4,6 +4,7 @@ import io.xpipe.app.ext.DataStoreProvider;
 import io.xpipe.ext.base.desktop.DesktopApplicationStoreProvider;
 import io.xpipe.ext.base.host.AbstractHostCreationActionProvider;
 import io.xpipe.ext.base.host.AbstractHostStoreProvider;
+import io.xpipe.ext.base.host.CopyIpActionProvider;
 import io.xpipe.ext.base.host.HostAddressSwitchBranchProvider;
 import io.xpipe.ext.base.identity.*;
 import io.xpipe.ext.base.script.*;
@@ -16,7 +17,6 @@ open module io.xpipe.ext.base {
     exports io.xpipe.ext.base.desktop;
     exports io.xpipe.ext.base.service;
     exports io.xpipe.ext.base.identity;
-    exports io.xpipe.ext.base.identity.ssh;
     exports io.xpipe.ext.base.host;
 
     requires java.desktop;
@@ -36,10 +36,12 @@ open module io.xpipe.ext.base {
     requires javafx.graphics;
 
     provides ActionProvider with
+            CopyIpActionProvider,
             IdentityApplyHubLeafProvider,
             AbstractHostCreationActionProvider,
             HostAddressSwitchBranchProvider,
             LocalIdentityConvertHubLeafProvider,
+            MultiIdentitySwitchBranchProvider,
             RunBackgroundScriptActionProvider,
             RunHubBatchScriptActionProvider,
             RunHubScriptActionProvider,
@@ -69,6 +71,7 @@ open module io.xpipe.ext.base {
             LocalIdentityStoreProvider,
             SyncedIdentityStoreProvider,
             PasswordManagerIdentityStoreProvider,
+            MultiIdentityStoreProvider,
             AbstractHostStoreProvider;
     provides DataStorageExtensionProvider with
             ScriptDataStorageProvider;
diff --git a/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-16-dark.png b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-16-dark.png
new file mode 100644
index 000000000..a4bd2d65b
Binary files /dev/null and b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-16-dark.png differ
diff --git a/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-16.png b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-16.png
new file mode 100644
index 000000000..2b5a8bcbd
Binary files /dev/null and b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-16.png differ
diff --git a/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-24-dark.png b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-24-dark.png
new file mode 100644
index 000000000..4fe98d444
Binary files /dev/null and b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-24-dark.png differ
diff --git a/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-24.png b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-24.png
new file mode 100644
index 000000000..4deb2ad94
Binary files /dev/null and b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-24.png differ
diff --git a/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-40-dark.png b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-40-dark.png
new file mode 100644
index 000000000..32d9b9964
Binary files /dev/null and b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-40-dark.png differ
diff --git a/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-40.png b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-40.png
new file mode 100644
index 000000000..582504ef3
Binary files /dev/null and b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-40.png differ
diff --git a/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-80-dark.png b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-80-dark.png
new file mode 100644
index 000000000..8bc62c144
Binary files /dev/null and b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-80-dark.png differ
diff --git a/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-80.png b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-80.png
new file mode 100644
index 000000000..c14c846ea
Binary files /dev/null and b/ext/base/src/main/resources/io/xpipe/ext/base/resources/img/multiIdentity_icon-80.png differ
diff --git a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusCommandView.java b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusCommandView.java
index 80f20deb2..aa802aaea 100644
--- a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusCommandView.java
+++ b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusCommandView.java
@@ -1,13 +1,18 @@
 package io.xpipe.ext.system.incus;
 
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
 import io.xpipe.app.ext.ContainerStoreState;
+import io.xpipe.app.ext.NetworkContainerStoreState;
 import io.xpipe.app.issue.ErrorEventFactory;
 import io.xpipe.app.process.*;
 import io.xpipe.app.storage.DataStoreEntry;
 import io.xpipe.app.storage.DataStoreEntryRef;
+import io.xpipe.core.JacksonMapper;
 import io.xpipe.ext.base.identity.IdentityValue;
 
 import lombok.NonNull;
+import lombok.Value;
 
 import java.util.*;
 import java.util.function.Consumer;
@@ -84,18 +89,18 @@ public class IncusCommandView extends CommandViewBase {
         return build(commandBuilder -> commandBuilder.add("version")).readStdoutOrThrow();
     }
 
-    public void start(String containerName) throws Exception {
-        build(commandBuilder -> commandBuilder.add("start").addQuoted(containerName))
+    public void start(String projectName, String containerName) throws Exception {
+        build(commandBuilder -> commandBuilder.add("start").addQuoted(containerName).add("--project").addQuoted(projectName))
                 .execute();
     }
 
-    public void stop(String containerName) throws Exception {
-        build(commandBuilder -> commandBuilder.add("stop").addQuoted(containerName))
+    public void stop(String projectName, String containerName) throws Exception {
+        build(commandBuilder -> commandBuilder.add("stop").addQuoted(containerName).add("--project").addQuoted(projectName))
                 .execute();
     }
 
-    public void pause(String containerName) throws Exception {
-        build(commandBuilder -> commandBuilder.add("pause").addQuoted(containerName))
+    public void pause(String projectName, String containerName) throws Exception {
+        build(commandBuilder -> commandBuilder.add("pause").addQuoted(containerName).add("--project").addQuoted(projectName))
                 .execute();
     }
 
@@ -109,14 +114,16 @@ public class IncusCommandView extends CommandViewBase {
 
     public List<DataStoreEntryRef<IncusContainerStore>> listContainers(DataStoreEntryRef<IncusInstallStore> store)
             throws Exception {
-        return listContainersAndStates().entrySet().stream()
+        return listContainers().stream()
                 .map(s -> {
-                    boolean running = s.getValue().toLowerCase(Locale.ROOT).equals("running");
-                    var c = new IncusContainerStore(store, s.getKey(), IdentityValue.ofBreakout(store.get()));
+                    boolean running = s.getState().toLowerCase(Locale.ROOT).equals("running");
+                    var c = new IncusContainerStore(store, s.getProject(), s.getName(), IdentityValue.ofBreakout(store.get()));
                     var entry = DataStoreEntry.createNew(c.getContainerName(), c);
-                    entry.setStorePersistentState(ContainerStoreState.builder()
-                            .containerState(s.getValue())
+                    entry.setStorePersistentState(NetworkContainerStoreState.builder()
+                            .containerState(s.getState())
                             .running(running)
+                            .ipv4(s.getIpv4Address())
+                            .ipv6(s.getIpv6Address())
                             .build());
                     return Optional.of(entry.<IncusContainerStore>ref());
                 })
@@ -124,37 +131,84 @@ public class IncusCommandView extends CommandViewBase {
                 .toList();
     }
 
-    public String queryContainerState(String containerName) throws Exception {
-        var states = listContainersAndStates();
-        return states.getOrDefault(containerName, "?");
+    public Optional<ContainerEntry> queryContainerState(String projectName, String containerName) throws Exception {
+        var l = listContainers();
+        var found = l.stream().filter(containerEntry -> (containerEntry.getProject().equals(projectName) ||
+                projectName == null && containerEntry.getProject().equals("default")) &&
+                containerEntry.getName().equals(containerName)).findFirst();
+        return found;
     }
 
-    private Map<String, String> listContainersAndStates() throws Exception {
-        try (var c = build(commandBuilder -> commandBuilder.add("list", "-f", "csv", "-c", "ns"))
+    @Value
+    public static class ContainerEntry {
+        String project;
+        String name;
+        String state;
+        String ipv4Address;
+        String ipv6Address;
+    }
+
+    private List<ContainerEntry> listContainers() throws Exception {
+        try (var c = build(commandBuilder -> commandBuilder.add("list", "--all-projects", "-f", "json"))
                 .start()) {
             var output = c.readStdoutOrThrow();
-            return output.lines()
-                    .collect(Collectors.toMap(
-                            s -> s.strip().split(",")[0],
-                            s -> s.strip().split(",")[1],
-                            (x, y) -> y,
-                            LinkedHashMap::new));
+            var json = JacksonMapper.getDefault().readTree(output);
+            var l = new ArrayList<ContainerEntry>();
+            for (JsonNode jsonNode : json) {
+                var status = jsonNode.required("status").textValue();
+                var project = jsonNode.required("project").textValue();
+                var name = jsonNode.required("name").textValue();
+                var state = jsonNode.required("state");
+                var network = state.get("network");
+                String ipv4 = null;
+                String ipv6 = null;
+                if (network != null) {
+                    var eth0 = network.get("eth0");
+                    if (eth0 == null && network.size() > 0) {
+                        for (var it = network.fieldNames();it.hasNext();) {
+                            var field = it.next();
+                            if (!field.equals("lo")) {
+                                eth0 = network.required(field);
+                                break;
+                            }
+                        }
+                    }
+
+                    if (eth0 != null) {
+                        var addresses = eth0.required("addresses");
+                        for (JsonNode address : addresses) {
+                            if (!address.required("scope").textValue().equals("global")) {
+                                continue;
+                            }
+
+                            var family = address.required("family").textValue();
+                            if (family.equals("inet")) {
+                                ipv4 = address.required("address").textValue();
+                            } else if (family.equals("inet6")) {
+                                ipv6 = address.required("address").textValue();
+                            }
+                        }
+                    }
+                }
+                l.add(new ContainerEntry(project, name, status, ipv4, ipv6));
+            }
+            return l;
         }
     }
 
-    public ShellControl exec(String container, String user, Supplier<Boolean> busybox) {
+    public ShellControl exec(String projectName, String container, String user, Supplier<Boolean> busybox) {
         var sub = shellControl.subShell();
-        sub.setDumbOpen(createOpenFunction(container, user, false, busybox));
-        sub.setTerminalOpen(createOpenFunction(container, user, true, busybox));
+        sub.setDumbOpen(createOpenFunction(projectName, container, user, false, busybox));
+        sub.setTerminalOpen(createOpenFunction(projectName, container, user, true, busybox));
         return sub.withExceptionConverter(IncusCommandView::convertException).elevated(requiresElevation());
     }
 
     private ShellOpenFunction createOpenFunction(
-            String containerName, String user, boolean terminal, Supplier<Boolean> busybox) {
+            String projectName, String containerName, String user, boolean terminal, Supplier<Boolean> busybox) {
         return new ShellOpenFunction() {
             @Override
             public CommandBuilder prepareWithoutInitCommand() {
-                var b = execCommand(containerName, terminal).add("su", "-l");
+                var b = execCommand(projectName, containerName, terminal).add("su", "-l");
                 if (user != null) {
                     b.addQuoted(user);
                 }
@@ -163,7 +217,7 @@ public class IncusCommandView extends CommandViewBase {
 
             @Override
             public CommandBuilder prepareWithInitCommand(@NonNull String command) {
-                var b = execCommand(containerName, terminal).add("su", "-l");
+                var b = execCommand(projectName, containerName, terminal).add("su", "-l");
                 if (user != null) {
                     b.addQuoted(user);
                 }
@@ -180,8 +234,8 @@ public class IncusCommandView extends CommandViewBase {
         };
     }
 
-    public CommandBuilder execCommand(String containerName, boolean terminal) {
+    public CommandBuilder execCommand(String projectName, String containerName, boolean terminal) {
         var c = CommandBuilder.of().add("incus", "exec", terminal ? "-t" : "-T");
-        return c.addQuoted(containerName).add("--");
+        return c.addQuoted(containerName).add("--project").addQuoted(projectName).add("--");
     }
 }
diff --git a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerActionProviderMenu.java b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerActionProviderMenu.java
index 446ef0395..da5ec3eae 100644
--- a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerActionProviderMenu.java
+++ b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerActionProviderMenu.java
@@ -5,6 +5,7 @@ import io.xpipe.app.hub.action.HubBranchProvider;
 import io.xpipe.app.hub.action.HubMenuItemProvider;
 import io.xpipe.app.platform.LabelGraphic;
 import io.xpipe.app.storage.DataStoreEntryRef;
+import io.xpipe.ext.base.host.CopyIpActionProvider;
 import io.xpipe.ext.base.store.StorePauseActionProvider;
 import io.xpipe.ext.base.store.StoreRestartActionProvider;
 import io.xpipe.ext.base.store.StoreStartActionProvider;
@@ -43,6 +44,7 @@ public class IncusContainerActionProviderMenu implements HubBranchProvider<Incus
                 new StoreStopActionProvider(),
                 new StorePauseActionProvider(),
                 new StoreRestartActionProvider(),
+                new CopyIpActionProvider(),
                 new IncusContainerConsoleActionProvider(),
                 new IncusContainerEditConfigActionProvider(),
                 new IncusContainerEditRunConfigActionProvider());
diff --git a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerStore.java b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerStore.java
index b840e4198..dfcec5212 100644
--- a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerStore.java
+++ b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerStore.java
@@ -5,6 +5,7 @@ import io.xpipe.app.process.BaseElevationHandler;
 import io.xpipe.app.process.ShellControl;
 import io.xpipe.app.storage.DataStoreEntryRef;
 import io.xpipe.app.util.*;
+import io.xpipe.ext.base.host.HostAddressGatewayStore;
 import io.xpipe.ext.base.identity.IdentityValue;
 import io.xpipe.ext.base.store.PauseableStore;
 import io.xpipe.ext.base.store.StartableStore;
@@ -17,6 +18,8 @@ import lombok.Value;
 import lombok.experimental.SuperBuilder;
 import lombok.extern.jackson.Jacksonized;
 
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Objects;
 import java.util.OptionalInt;
 
@@ -29,19 +32,21 @@ import java.util.OptionalInt;
 public class IncusContainerStore
         implements ShellStore,
                 FixedChildStore,
-                StatefulDataStore<ContainerStoreState>,
+                StatefulDataStore<NetworkContainerStoreState>,
                 StartableStore,
                 StoppableStore,
                 PauseableStore,
-                NameableStore {
+                NameableStore,
+                   HostAddressGatewayStore {
 
     DataStoreEntryRef<IncusInstallStore> install;
+    String projectName;
     String containerName;
     IdentityValue identity;
 
     @Override
-    public Class<ContainerStoreState> getStateClass() {
-        return ContainerStoreState.class;
+    public Class<NetworkContainerStoreState> getStateClass() {
+        return NetworkContainerStoreState.class;
     }
 
     @Override
@@ -57,13 +62,17 @@ public class IncusContainerStore
 
     @Override
     public OptionalInt getFixedId() {
-        return OptionalInt.of(Objects.hash(containerName));
+        if (projectName != null) {
+            return OptionalInt.of(Objects.hash(projectName, containerName));
+        } else {
+            return OptionalInt.of(Objects.hash(containerName));
+        }
     }
 
     @Override
     public FixedChildStore merge(FixedChildStore other) {
         var o = (IncusContainerStore) other;
-        return toBuilder().identity(identity != null ? identity : o.identity).build();
+        return toBuilder().identity(identity != null ? identity : o.identity).projectName(o.projectName).build();
     }
 
     @Override
@@ -76,7 +85,7 @@ public class IncusContainerStore
                         getInstall().getStore().getHost().getStore().getOrStartSession());
 
                 var user = identity != null ? identity.unwrap().getUsername().retrieveUsername() : null;
-                var sc = new IncusCommandView(parent).exec(containerName, user, () -> {
+                var sc = new IncusCommandView(parent).exec(projectName, containerName, user, () -> {
                     var state = getState();
                     var alpine = state.getOsName() != null
                             && state.getOsName().toLowerCase().contains("alpine");
@@ -114,10 +123,15 @@ public class IncusContainerStore
     private void refreshContainerState(ShellControl sc) throws Exception {
         var state = getState();
         var view = new IncusCommandView(sc);
-        var displayState = view.queryContainerState(containerName);
-        var running = "RUNNING".equals(displayState);
+        var displayState = view.queryContainerState(projectName, containerName);
+        if (displayState.isEmpty()) {
+            return;
+        }
+
+        var running = "RUNNING".equals(displayState.get().getState());
         var newState =
-                state.toBuilder().containerState(displayState).running(running).build();
+                state.toBuilder().containerState(displayState.get().getState()).running(running)
+                        .ipv4(displayState.get().getIpv4Address()).ipv6(displayState.get().getIpv6Address()).build();
         setState(newState);
     }
 
@@ -125,7 +139,7 @@ public class IncusContainerStore
     public void start() throws Exception {
         var sc = getInstall().getStore().getHost().getStore().getOrStartSession();
         var view = new IncusCommandView(sc);
-        view.start(containerName);
+        view.start(projectName, containerName);
         refreshContainerState(sc);
     }
 
@@ -133,7 +147,7 @@ public class IncusContainerStore
     public void stop() throws Exception {
         var sc = getInstall().getStore().getHost().getStore().getOrStartSession();
         var view = new IncusCommandView(sc);
-        view.stop(containerName);
+        view.stop(projectName, containerName);
         refreshContainerState(sc);
     }
 
@@ -141,7 +155,7 @@ public class IncusContainerStore
     public void pause() throws Exception {
         var sc = getInstall().getStore().getHost().getStore().getOrStartSession();
         var view = new IncusCommandView(sc);
-        view.pause(containerName);
+        view.pause(projectName, containerName);
         refreshContainerState(sc);
     }
 
@@ -149,4 +163,28 @@ public class IncusContainerStore
     public String getName() {
         return containerName;
     }
+
+    @Override
+    public DataStoreEntryRef<NetworkTunnelStore> getTunnelGateway() {
+        var host = getInstall().getStore().getHost();
+        return host.getStore() instanceof NetworkTunnelStore ? host.asNeeded() : null;
+    }
+
+    @Override
+    public void refreshHostAddressOrThrow() throws Exception {
+        refreshContainerState(getInstall().getStore().getHost().getStore().getOrStartSession());
+    }
+
+    @Override
+    public HostAddress getHostAddress() {
+        var l = new ArrayList<String >();
+        var state = getState();
+        if (state.getIpv4() != null) {
+            l.add(state.getIpv4());
+        }
+        if (state.getIpv6() != null) {
+            l.add(state.getIpv6());
+        }
+        return !l.isEmpty() ? HostAddress.of(l) : HostAddress.empty();
+    }
 }
diff --git a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerStoreProvider.java b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerStoreProvider.java
index 5aa79d731..3791a3d5b 100644
--- a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerStoreProvider.java
+++ b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusContainerStoreProvider.java
@@ -76,18 +76,9 @@ public class IncusContainerStoreProvider implements ShellStoreProvider {
         var identity = new SimpleObjectProperty<>(st.getIdentity());
 
         var q = new OptionsBuilder()
-                .name("host")
-                .description("lxdHostDescription")
-                .addComp(new StoreChoiceComp<>(
-                        entry,
-                        new ReadOnlyObjectWrapper<>(st.getInstall().getStore().getHost()),
-                        ShellStore.class,
-                        null,
-                        StoreViewState.get().getAllConnectionsCategory()))
-                .disable()
                 .name("container")
-                .description("lxdContainerDescription")
-                .addStaticString(st.getContainerName())
+                .description("containerDescription")
+                .addStaticString((st.getProjectName() != null ? st.getProjectName() + "/" : "") + st.getContainerName())
                 .sub(IdentityChoiceBuilder.container(identity), identity)
                 .bind(
                         () -> {
diff --git a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusInstallStoreProvider.java b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusInstallStoreProvider.java
index 8635e2eec..f0fe0e70c 100644
--- a/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusInstallStoreProvider.java
+++ b/ext/system/src/main/java/io/xpipe/ext/system/incus/IncusInstallStoreProvider.java
@@ -52,7 +52,7 @@ public class IncusInstallStoreProvider implements DataStoreProvider {
     @Override
     public DataStoreEntry getDisplayParent(DataStoreEntry store) {
         IncusInstallStore s = store.getStore().asNeeded();
-        return s.getHost().get();
+        return s.getHost() != null ? s.getHost().get() : null;
     }
 
     @Override
diff --git a/ext/system/src/main/java/io/xpipe/ext/system/lxd/LxdCmdStoreProvider.java b/ext/system/src/main/java/io/xpipe/ext/system/lxd/LxdCmdStoreProvider.java
index e9f8a9fff..f23f81dfb 100644
--- a/ext/system/src/main/java/io/xpipe/ext/system/lxd/LxdCmdStoreProvider.java
+++ b/ext/system/src/main/java/io/xpipe/ext/system/lxd/LxdCmdStoreProvider.java
@@ -52,7 +52,7 @@ public class LxdCmdStoreProvider implements DataStoreProvider {
     @Override
     public DataStoreEntry getDisplayParent(DataStoreEntry store) {
         LxdCmdStore s = store.getStore().asNeeded();
-        return s.getHost().get();
+        return s.getHost() != null ? s.getHost().get() : null;
     }
 
     @Override
diff --git a/ext/system/src/main/java/io/xpipe/ext/system/podman/PodmanCmdStoreProvider.java b/ext/system/src/main/java/io/xpipe/ext/system/podman/PodmanCmdStoreProvider.java
index 6d88f6922..64fbb19ee 100644
--- a/ext/system/src/main/java/io/xpipe/ext/system/podman/PodmanCmdStoreProvider.java
+++ b/ext/system/src/main/java/io/xpipe/ext/system/podman/PodmanCmdStoreProvider.java
@@ -52,7 +52,7 @@ public class PodmanCmdStoreProvider implements DataStoreProvider {
     @Override
     public DataStoreEntry getDisplayParent(DataStoreEntry store) {
         PodmanCmdStore s = store.getStore().asNeeded();
-        return s.getHost().get();
+        return s.getHost() != null ? s.getHost().get() : null;
     }
 
     @Override
diff --git a/img/base/multiIdentity_icon-dark.svg b/img/base/multiIdentity_icon-dark.svg
new file mode 100644
index 000000000..a56297322
--- /dev/null
+++ b/img/base/multiIdentity_icon-dark.svg
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   id="Layer_1"
+   data-name="Layer 1"
+   viewBox="0 0 204.59 204.59"
+   version="1.1"
+   sodipodi:docname="multiIdentity_icon-dark.svg"
+   inkscape:version="1.4 (86a8ad7, 2024-10-11)"
+   xml:space="preserve"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:dc="http://purl.org/dc/elements/1.1/"><path
+     style="fill:#e98325;fill-opacity:1;stroke-width:0.647549"
+     d="m 137.49341,134.48676 -18.02556,-19.08771 -0.002,12.28612 h -16.44943 -0.3122 -9.677136 v 13.60523 h 9.678366 v 0 h 16.75995 l 0.002,12.28747 z"
+     id="path1-4" /><sodipodi:namedview
+     id="namedview1"
+     pagecolor="#000000"
+     bordercolor="#000000"
+     borderopacity="0.25"
+     inkscape:showpageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1"
+     inkscape:zoom="2.7891646"
+     inkscape:cx="127.99531"
+     inkscape:cy="122.79663"
+     inkscape:window-width="1920"
+     inkscape:window-height="1009"
+     inkscape:window-x="-8"
+     inkscape:window-y="-8"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="Layer_1" /><defs
+     id="defs856"><style
+       id="style854">.cls-1{fill:#ac55ff;}</style><style
+       id="style2411">.cls-1{fill:#606161;}</style></defs><title
+     id="title858">identity</title><path
+     class="cls-1"
+     d="M332.32,153.7H179.68a26,26,0,0,0-26,26V332.32a26,26,0,0,0,26,26H332.32a26,26,0,0,0,26-26V179.68A26,26,0,0,0,332.32,153.7Zm14,178.62a14,14,0,0,1-14,14H179.68a14,14,0,0,1-14-14V179.68a14,14,0,0,1,14-14H332.32a14,14,0,0,1,14,14Z"
+     id="path860"
+     style="fill:#d9d9d9;fill-opacity:1"
+     transform="translate(-153.7 -153.7)" /><metadata
+     id="metadata932"><rdf:RDF><cc:Work
+         rdf:about=""><dc:title>identity</dc:title></cc:Work></rdf:RDF></metadata><path
+     d="M 154.40997,126.10572 A 53.816715,53.816715 0 0 0 142.81203,108.91027 54.051264,54.051264 0 0 0 125.61659,97.312331 c -0.0576,-0.0288 -0.11512,-0.0432 -0.17268,-0.072 8.96466,-6.47527 14.7924,-17.02277 14.7924,-28.92289 0,-19.71361 -15.97234,-35.68595 -35.68595,-35.68595 -19.713613,0 -35.685953,15.97234 -35.685953,35.68595 0,11.90012 5.82775,22.44762 14.79241,28.93728 -0.0576,0.0288 -0.11512,0.0432 -0.17268,0.072 -6.44649,2.719609 -12.23107,6.619159 -17.19545,11.597939 a 54.051264,54.051264 0 0 0 -11.59793,17.19545 53.485756,53.485756 0 0 0 -4.2449,19.87189 1.1511597,1.1511597 0 0 0 1.15116,1.17994 h 8.6337 c 0.63313,0 1.13677,-0.50363 1.15116,-1.12238 0.28779,-11.10869 4.74853,-21.5123 12.63397,-29.39774 8.15885,-8.15884 18.99414,-12.64838 30.534513,-12.64838 11.54038,0 22.37567,4.48954 30.53451,12.64838 7.88545,7.88544 12.34619,18.28905 12.63398,29.39774 0.0144,0.63314 0.51802,1.12238 1.15116,1.12238 h 8.6337 a 1.1511597,1.1511597 0 0 0 1.15116,-1.17994 c -0.1439,-6.87818 -1.56846,-13.56929 -4.2449,-19.88628 z M 104.55036,93.067431 c -6.604773,0 -12.821043,-2.57572 -17.497623,-7.25231 -4.67659,-4.67659 -7.25231,-10.89285 -7.25231,-17.49763 0,-6.60478 2.57572,-12.82104 7.25231,-17.49762 4.67658,-4.67659 10.89285,-7.25231 17.497623,-7.25231 6.60478,0 12.82104,2.57572 17.49763,7.25231 4.67659,4.67658 7.25231,10.89284 7.25231,17.49762 0,6.60478 -2.57572,12.82104 -7.25231,17.49763 -4.67659,4.67659 -10.89285,7.25231 -17.49763,7.25231 z"
+     id="path1"
+     style="fill:#e98325;fill-opacity:1;stroke-width:0.143895" /><path
+     style="fill:#e98325;fill-opacity:1;stroke-width:0.653351"
+     d="m 66.172124,153.93532 18.350031,-19.08837 0.0012,12.28609 h 16.745855 0.31783 9.29408 v 13.60524 h -9.29529 v 0 H 84.523412 l -0.0012,12.28747 z"
+     id="path2" /></svg>
diff --git a/img/base/multiIdentity_icon.svg b/img/base/multiIdentity_icon.svg
new file mode 100644
index 000000000..820ecf43b
--- /dev/null
+++ b/img/base/multiIdentity_icon.svg
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   id="Layer_1"
+   data-name="Layer 1"
+   viewBox="0 0 204.59 204.59"
+   version="1.1"
+   sodipodi:docname="multiIdentity_icon.svg"
+   inkscape:version="1.4 (86a8ad7, 2024-10-11)"
+   xml:space="preserve"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:dc="http://purl.org/dc/elements/1.1/"><path
+     style="fill:#d96700;fill-opacity:1;stroke-width:0.647549"
+     d="m 137.49341,134.48676 -18.02556,-19.08771 -0.002,12.28612 h -16.44943 -0.3122 -9.677136 v 13.60523 h 9.678366 v 0 h 16.75995 l 0.002,12.28747 z"
+     id="path1-4" /><sodipodi:namedview
+     id="namedview1"
+     pagecolor="#ffffff"
+     bordercolor="#000000"
+     borderopacity="0.25"
+     inkscape:showpageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1"
+     inkscape:zoom="1.9722372"
+     inkscape:cx="146.5341"
+     inkscape:cy="133.60462"
+     inkscape:window-width="1920"
+     inkscape:window-height="1009"
+     inkscape:window-x="-8"
+     inkscape:window-y="-8"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="Layer_1" /><defs
+     id="defs856"><style
+       id="style854">.cls-1{fill:#ac55ff;}</style><style
+       id="style2411">.cls-1{fill:#606161;}</style></defs><title
+     id="title858">identity</title><path
+     class="cls-1"
+     d="M332.32,153.7H179.68a26,26,0,0,0-26,26V332.32a26,26,0,0,0,26,26H332.32a26,26,0,0,0,26-26V179.68A26,26,0,0,0,332.32,153.7Zm14,178.62a14,14,0,0,1-14,14H179.68a14,14,0,0,1-14-14V179.68a14,14,0,0,1,14-14H332.32a14,14,0,0,1,14,14Z"
+     id="path860"
+     style="fill:#212121;fill-opacity:1"
+     transform="translate(-153.7 -153.7)" /><metadata
+     id="metadata932"><rdf:RDF><cc:Work
+         rdf:about=""><dc:title>identity</dc:title></cc:Work></rdf:RDF></metadata><path
+     d="M 154.40997,126.10572 A 53.816715,53.816715 0 0 0 142.81203,108.91027 54.051264,54.051264 0 0 0 125.61659,97.312331 c -0.0576,-0.0288 -0.11512,-0.0432 -0.17268,-0.072 8.96466,-6.47527 14.7924,-17.02277 14.7924,-28.92289 0,-19.71361 -15.97234,-35.68595 -35.68595,-35.68595 -19.713613,0 -35.685953,15.97234 -35.685953,35.68595 0,11.90012 5.82775,22.44762 14.79241,28.93728 -0.0576,0.0288 -0.11512,0.0432 -0.17268,0.072 -6.44649,2.719609 -12.23107,6.619159 -17.19545,11.597939 a 54.051264,54.051264 0 0 0 -11.59793,17.19545 53.485756,53.485756 0 0 0 -4.2449,19.87189 1.1511597,1.1511597 0 0 0 1.15116,1.17994 h 8.6337 c 0.63313,0 1.13677,-0.50363 1.15116,-1.12238 0.28779,-11.10869 4.74853,-21.5123 12.63397,-29.39774 8.15885,-8.15884 18.99414,-12.64838 30.534513,-12.64838 11.54038,0 22.37567,4.48954 30.53451,12.64838 7.88545,7.88544 12.34619,18.28905 12.63398,29.39774 0.0144,0.63314 0.51802,1.12238 1.15116,1.12238 h 8.6337 a 1.1511597,1.1511597 0 0 0 1.15116,-1.17994 c -0.1439,-6.87818 -1.56846,-13.56929 -4.2449,-19.88628 z M 104.55036,93.067431 c -6.604773,0 -12.821043,-2.57572 -17.497623,-7.25231 -4.67659,-4.67659 -7.25231,-10.89285 -7.25231,-17.49763 0,-6.60478 2.57572,-12.82104 7.25231,-17.49762 4.67658,-4.67659 10.89285,-7.25231 17.497623,-7.25231 6.60478,0 12.82104,2.57572 17.49763,7.25231 4.67659,4.67658 7.25231,10.89284 7.25231,17.49762 0,6.60478 -2.57572,12.82104 -7.25231,17.49763 -4.67659,4.67659 -10.89285,7.25231 -17.49763,7.25231 z"
+     id="path1"
+     style="fill:#d96700;fill-opacity:1;stroke-width:0.143895" /><path
+     style="fill:#d96700;fill-opacity:1;stroke-width:0.653351"
+     d="m 66.172124,153.93532 18.350031,-19.08837 0.0012,12.28609 h 16.745855 0.31783 9.29408 v 13.60524 h -9.29529 v 0 H 84.523412 l -0.0012,12.28747 z"
+     id="path2" /></svg>
diff --git a/lang/strings/fixed_en.properties b/lang/strings/fixed_en.properties
index 2ebde94df..8edf12226 100644
--- a/lang/strings/fixed_en.properties
+++ b/lang/strings/fixed_en.properties
@@ -12,6 +12,7 @@ elementaryTerminal=Elementary Terminal
 macosTerminal=Terminal.app
 iterm2=iTerm2
 warp=Warp
+claude=Claude
 wave=Wave
 tabby=Tabby
 alacritty=Alacritty
@@ -160,3 +161,9 @@ yakuake=Yakuake
 remoteViewer=Virt viewer
 cosmicEdit=Cosmic Editor
 neovim=Neovim
+sms=SMS
+hashicorpVaultPlaceholder=/path/to/secret:field[,field2]
+hashicorpVault=Hashicorp Vault
+protonPassPasswordPlaceholder=Item ID
+protonPass=Proton Pass
+
diff --git a/lang/strings/translations_da.properties b/lang/strings/translations_da.properties
index 573a565c1..80d407b2f 100644
--- a/lang/strings/translations_da.properties
+++ b/lang/strings/translations_da.properties
@@ -1385,7 +1385,7 @@ commandOutput=Kommando-output
 iconSourceDeletionTitle=Kilde til slette-ikon
 iconSourceDeletionContent=Vil du slette denne ikonkilde og alle tilknyttede ikoner?
 refreshIcons=Opdater ikoner
-refreshIconsDescription=Hentning, rendering og caching af alle tilgængelige 1000+ ikoner til .png-filer. Det kan tage et stykke tid ...
+refreshIconsDescription=Hentning, rendering og caching af alle tilgængelige 1000+ ikoner fra eksterne kilder til .png-filer. Det kan tage et stykke tid ...
 vaultUserLegacy=Vault-bruger (begrænset legacy-kompatibilitetstilstand)
 upgradeInstructions=Instruktioner til opgradering
 externalActionTitle=Anmodning om ekstern handling
@@ -1447,8 +1447,8 @@ categoryColorDescription=Den standardfarve, der skal bruges til forbindelser ind
 categorySync=Synkroniser med git-arkiv
 categorySyncDescription=Synkroniser automatisk alle forbindelser med git-repository. Alle lokale ændringer af forbindelser vil blive skubbet til fjernlageret.
 categorySyncSpecial=Synkroniser med git-arkiv\n(Kan ikke konfigureres for specialkategorien "$NAME$")
-categoryDontAllowScripts=Deaktivering af scripts
-categoryDontAllowScriptsDescription=Deaktiver oprettelse af scripts på systemer i denne kategori for at forhindre ændringer i filsystemet. Dette vil deaktivere al scripting-funktionalitet, shell-miljøkommandoer, prompter med mere.
+categoryDontAllowScripts=Deaktiver alle ændringer
+categoryDontAllowScriptsDescription=Deaktiver enhver kommandoafvikling og andre operationer på systemer i denne kategori for at forhindre ændringer. Dette vil deaktivere al scripting-funktionalitet, shell-miljøkommandoer, prompter og meget mere.
 categoryConfirmAllModifications=Bekræft alle ændringer
 categoryConfirmAllModificationsDescription=Bekræft først enhver form for ændring af en forbindelse eller et filsystem. Det kan forhindre utilsigtede handlinger på vigtige systemer.
 categoryDefaultIdentity=Standard-identitet
@@ -1877,10 +1877,11 @@ testingConnection=Test af forbindelse ...
 openManagementConsole=Åben administrationskonsol
 openLxcTerminal=Åbn LXC-terminalen
 openContainerConsole=Åbn seriel konsol
-keeperUseMfa=Brug 2FA-godkendelsesapp
-keeperUseMfaDescription=Aktivér dette, hvis din Keeper-konto kræver en 2FA TOTP for at få adgang til adgangskoder.
+keeper2fa=2FA-metode
+keeper2faDescription=Den primære to-faktor-godkendelsesmetode, der er konfigureret til din konto. Aktivér denne, hvis din Keeper-konto kræver to-faktor-autentificering for at få adgang til adgangskoder.
 keeperTotpDuration=Varighed af brugerdefineret 2FA-kode
 keeperTotpDurationDescription=Tilsidesæt standardvarigheden for, hvor længe en 2FA-kode er gyldig. Gælder kun, hvis din organisations politik tillader ændring af varigheden.\n\nMulige værdier er: $VALUES$
+keeperOtherAuth=Andet (RSA SecurID, Duo Security, Keeper DNA osv.)
 extractReusableIdentities=Udtræk af genanvendelige identiteter
 identitiesAdded=Identiteter tilføjet
 syncMode=Synkroniseringstilstand
@@ -1932,10 +1933,10 @@ syncToPlainDirectoryDescription=Når du synkroniserer til en lokal mappe, kan du
 openSpiceSession=Åbn SPICE-session
 terminalBehaviour=Terminalens adfærd
 noScanPossible=Der blev ikke fundet nogen understøttede forbindelser
-networkSwitchPorts=Porte til netværksswitch
-nswitchGroup.displayName=Porte til netværksswitch
-nswitchGroup.displayDescription=Liste over tilgængelige porte på en netværksswitch-enhed
-nswitchPort.displayName=Port til netværksswitch
+networkSwitchPorts=Netværksporte
+nswitchGroup.displayName=Netværksporte
+nswitchGroup.displayDescription=Liste over tilgængelige porte på en netværksenhed
+nswitchPort.displayName=Netværksport
 nswitchPort.displayDescription=Styr en individuel port på en netværksswitch-enhed
 enablePort=Aktiver port
 shutdownPort=Lukker porten ned
@@ -1947,3 +1948,10 @@ showStatus=Vis status
 showAllPorts=Vis alle porte
 activeLicense=Licens
 activeLicenseDescription=Aktiver en XPipe-licensnøgle
+authenticatorApp=Autentificerings-app
+securityKey=Sikkerhedsnøgle
+mcpAdditionalContext=Yderligere MCP-kontekst
+mcpAdditionalContextDescription=Yderligere instruktioner, der skal sendes til MCP-klienten. Brug dette til at styre agentens adfærd og give yderligere kontekst til din individuelle opsætning.
+mcpAdditionalContextSample=- Genstart ikke tjenester og dæmoner automatisk uden at bekræfte det først\n- Når du konfigurerer en netværksgrænseflade, skal du altid bruge 192.168.1.1/24 som gateway
+prefsRestartTitle=Genstart påkrævet
+prefsRestartContent=Nogle af de indstillinger, du har ændret, kræver en genstart af programmet for at blive anvendt. Vil du genstarte XPipe nu?
diff --git a/lang/strings/translations_de.properties b/lang/strings/translations_de.properties
index 7c10377e4..412eb5f8c 100644
--- a/lang/strings/translations_de.properties
+++ b/lang/strings/translations_de.properties
@@ -1376,7 +1376,7 @@ commandOutput=Befehlsausgabe
 iconSourceDeletionTitle=Symbolquelle löschen
 iconSourceDeletionContent=Möchtest du diese Icon-Quelle und alle damit verbundenen Icons löschen?
 refreshIcons=Aktualisieren von Symbolen
-refreshIconsDescription=Abrufen, Rendern und Zwischenspeichern aller über 1000 verfügbaren Icons in .png-Dateien. Das kann eine Weile dauern ...
+refreshIconsDescription=Abrufen, Rendern und Zwischenspeichern aller über 1000 verfügbaren Icons aus externen Quellen in .png-Dateien. Das kann eine Weile dauern ...
 vaultUserLegacy=Tresor-Benutzer (eingeschränkter Legacy-Kompatibilitätsmodus)
 upgradeInstructions=Upgrade-Anweisungen
 externalActionTitle=Externe Aktionsanfrage
@@ -1439,8 +1439,8 @@ categoryColorDescription=Die Standardfarbe, die für Verbindungen innerhalb dies
 categorySync=Mit Git-Repository synchronisieren
 categorySyncDescription=Synchronisiere alle Verbindungen automatisch mit dem git repository. Alle lokalen Änderungen an den Verbindungen werden in das Remote-Repository übertragen.
 categorySyncSpecial=Mit Git-Repository synchronisieren\n(Nicht konfigurierbar für die spezielle Kategorie "$NAME$")
-categoryDontAllowScripts=Skripte deaktivieren
-categoryDontAllowScriptsDescription=Deaktiviere die Skripterstellung auf Systemen dieser Kategorie, um Änderungen am Dateisystem zu verhindern. Dadurch werden alle Skriptfunktionen, Shell-Umgebungsbefehle, Eingabeaufforderungen und mehr deaktiviert.
+categoryDontAllowScripts=Alle Änderungen deaktivieren
+categoryDontAllowScriptsDescription=Deaktiviere die Ausführung von Befehlen und anderen Operationen auf Systemen in dieser Kategorie, um Änderungen zu verhindern. Dadurch werden alle Skriptfunktionen, Shell-Umgebungsbefehle, Eingabeaufforderungen und mehr deaktiviert.
 categoryConfirmAllModifications=Bestätige alle Änderungen
 categoryConfirmAllModificationsDescription=Bestätige jede Art von Änderung an einer Verbindung oder einem Dateisystem zuerst. Dies kann versehentliche Eingriffe in wichtige Systeme verhindern.
 categoryDefaultIdentity=Standard-Identität
@@ -1872,10 +1872,11 @@ testingConnection=Verbindung testen ...
 openManagementConsole=Verwaltungskonsole öffnen
 openLxcTerminal=LXC-Terminal öffnen
 openContainerConsole=Serielle Konsole öffnen
-keeperUseMfa=2FA-Authentifikator-App verwenden
-keeperUseMfaDescription=Aktiviere dies, wenn dein Keeper-Konto ein 2FA TOTP erfordert, um auf Passwörter zuzugreifen.
+keeper2fa=2FA-Methode
+keeper2faDescription=Die primäre Zwei-Faktor-Authentifizierungsmethode, die für dein Konto konfiguriert ist. Aktiviere dies, wenn dein Keeper-Konto eine Zwei-Faktor-Authentifizierung für den Zugriff auf Passwörter erfordert.
 keeperTotpDuration=Dauer des benutzerdefinierten 2FA-Codes
 keeperTotpDurationDescription=Überschreibe die Standarddauer, wie lange ein 2FA-Code gültig ist. Gilt nur, wenn deine Unternehmensrichtlinie das Ändern der Dauer erlaubt.\n\nMögliche Werte sind: $VALUES$
+keeperOtherAuth=Andere (RSA SecurID, Duo Security, Keeper DNA, etc.)
 extractReusableIdentities=Wiederverwendbare Identitäten extrahieren
 identitiesAdded=Hinzugefügte Identitäten
 syncMode=Sync-Modus
@@ -1927,10 +1928,10 @@ syncToPlainDirectoryDescription=Wenn du ein lokales Verzeichnis synchronisierst,
 openSpiceSession=SPICE-Sitzung öffnen
 terminalBehaviour=Verhalten des Terminals
 noScanPossible=Es wurden keine unterstützten Verbindungen gefunden
-networkSwitchPorts=Netzwerk-Switch-Ports
-nswitchGroup.displayName=Netzwerk-Switch-Ports
-nswitchGroup.displayDescription=Verfügbare Ports an einem Netzwerk-Switch auflisten
-nswitchPort.displayName=Netzwerk-Switchport
+networkSwitchPorts=Netzwerk-Ports
+nswitchGroup.displayName=Netzwerk-Ports
+nswitchGroup.displayDescription=Verfügbare Ports auf einem Netzwerkgerät auflisten
+nswitchPort.displayName=Netzwerkanschluss
 nswitchPort.displayDescription=Einen einzelnen Port eines Netzwerk-Switch-Geräts steuern
 enablePort=Port freigeben
 shutdownPort=Port abschalten
@@ -1942,3 +1943,10 @@ showStatus=Status anzeigen
 showAllPorts=Alle Ports anzeigen
 activeLicense=Lizenz
 activeLicenseDescription=Aktivieren eines XPipe-Lizenzschlüssels
+authenticatorApp=Authenticator-App
+securityKey=Sicherheitsschlüssel
+mcpAdditionalContext=Zusätzlicher MCP-Kontext
+mcpAdditionalContextDescription=Zusätzliche Anweisungen, die an den MCP-Client weitergegeben werden. Damit kannst du das Verhalten des Agenten steuern und zusätzlichen Kontext für dein individuelles Setup liefern.
+mcpAdditionalContextSample=- Starten Sie keine Dienste und Daemons automatisch neu, ohne dies vorher zu bestätigen\n- Wenn du eine Netzwerkschnittstelle konfigurierst, verwende immer 192.168.1.1/24 als Gateway
+prefsRestartTitle=Neustart erforderlich
+prefsRestartContent=Einige Optionen, die du geändert hast, erfordern einen Neustart der Anwendung, um angewendet zu werden. Willst du XPipe jetzt neu starten?
diff --git a/lang/strings/translations_en.properties b/lang/strings/translations_en.properties
index 98596270d..728accc1b 100644
--- a/lang/strings/translations_en.properties
+++ b/lang/strings/translations_en.properties
@@ -103,6 +103,7 @@ null=$VALUE$ must be not null
 roots=Roots
 scripts=Scripts
 searchFilter=Search ...
+storeFilterPrompt=Find a host or ssh user@host
 #context: last used
 recent=Recent
 shortcut=Shortcut
@@ -358,9 +359,10 @@ editor=Editor
 custom=Custom
 passwordManager=Password manager
 externalPasswordManager=External password manager
-passwordManagerDescription=The locally installed password manager to integrate with.\n\nIf you have a password manager installed, you can configure XPipe to retrieve passwords from it so that XPipe doesn't have to store the passwords itself. When enabled, any password field for a connection can be then configured to use the password manager.
-passwordManagerCommandTest=Test password manager
-passwordManagerCommandTestDescription=You can test here whether the output looks correct if you have set up a password manager.
+#force
+passwordManagerDescription=The locally installed password manager to integrate with.\n\nIf you have a password manager installed, you can configure XPipe to retrieve secrets from it so that XPipe doesn't have to manage the secrets itself.
+passwordManagerTest=Test password manager
+passwordManagerTestDescription=Check if the password manager integration is working correctly. Make sure to use the correct identifier format to reference an entry in the password manager.
 preferTerminalTabs=Prefer to open new tabs
 preferTerminalTabsDescription=Controls whether XPipe will try to open new tabs in your chosen terminal instead of new windows. Not every terminal supports tabs.
 customRdpClientCommand=Custom command
@@ -478,6 +480,7 @@ closeRightTabs=Close tabs to the right
 #context: Serial computer connection
 addSerial=Serial ...
 connect=Connect
+quickConnect=Quick connect
 workspaces=Workspaces
 manageWorkspaces=Manage workspaces
 addWorkspace=Add workspace ...
@@ -1268,6 +1271,7 @@ podmanContainers=Podman containers
 lxdContainers=LXD containers
 incusContainers=Incus containers
 container=Container
+containerDescription=The identifier of the container
 host=Host
 containerActions=Container actions
 serialConsole=Serial console
@@ -1402,7 +1406,7 @@ commandOutput=Command output
 iconSourceDeletionTitle=Delete icon source
 iconSourceDeletionContent=Do you want to delete this icon source and all associated icons with it?
 refreshIcons=Refresh icons
-refreshIconsDescription=Retrieving, rendering, and caching all available 1000+ icons to .png files. This may take a while ...
+refreshIconsDescription=Retrieving, rendering, and caching all available 1000+ icons from external sources to .png files. This may take a while ...
 vaultUserLegacy=Vault user (Limited legacy compatibility mode)
 upgradeInstructions=Upgrade instructions
 externalActionTitle=External action request
@@ -1443,6 +1447,8 @@ terminalAlwaysPauseOnExit=Always pause on exit
 terminalAlwaysPauseOnExitDescription=When enabled, exiting a terminal session will always prompt you to either restart or close the session. If disabled, XPipe will only do so for failed connections that exit with an error.
 #context: verb, database query
 querying=Querying ...
+#context: verb, database query
+queryFailed=Query returned no usable secrets
 #context: result display of database query
 retrievedPassword=Obtained: $PASSWORD$
 refreshOpenpubkey=Refresh openpubkey identity
@@ -1454,7 +1460,8 @@ terminalPromptConfiguration=Terminal prompt configuration
 terminalPromptConfig=Config file
 terminalPromptConfigDescription=The custom config file to apply to the prompt. This config will be automatically set up on the target system when the terminal is initialized and used as the default prompt config.\n\nIf you want to use the existing default config file on each system, you can leave this field empty.
 passwordManagerKey=Password manager key
-passwordManagerKeyDescription=The password manager identifier of the secret
+#force
+passwordManagerKeyDescription=The password manager identifier of the credentials entry
 passwordManagerAgent=Password manager agent
 dockerComposeProject.displayName=Docker compose project
 dockerComposeProject.displayDescription=Group containers of a compose project together
@@ -1467,8 +1474,10 @@ categoryColorDescription=The default color to use for connections within this ca
 categorySync=Sync with git repository
 categorySyncDescription=Sync all connections automatically with git repository. All local changes to connections will be pushed to the remote.
 categorySyncSpecial=Sync with git repository\n(Not configurable for special category "$NAME$")
-categoryDontAllowScripts=Disable scripts
-categoryDontAllowScriptsDescription=Disable script creation on systems within this category to prevent any file system modifications. This will disable all scripting functionality, shell environment commands, prompts, and more.
+#force
+categoryDontAllowScripts=Disable all modifications
+#force
+categoryDontAllowScriptsDescription=Disable any command execution and other operations on systems within this category to prevent any modifications. This will disable all scripting functionality, shell environment commands, prompts, and more.
 categoryConfirmAllModifications=Confirm all modifications
 categoryConfirmAllModificationsDescription=Confirm any kind of modification for a connection or a file system first. This can prevent accidental operations on important systems.
 categoryDefaultIdentity=Default identity
@@ -1530,7 +1539,8 @@ customVncCommandDescription=The custom command to execute to launch VNC sessions
 vncConnections=VNC connections
 passwordManagerIdentity=Password manager identity
 passwordManagerIdentity.displayName=Password manager identity
-passwordManagerIdentity.displayDescription=Retrieve username and password of an identity from your password manager
+#force
+passwordManagerIdentity.displayDescription=Retrieve credentials of an identity from your password manager
 passwordCopied=Connection password copied to clipboard
 errorOccurred=Error occurred
 actionMacro.displayName=Action macro
@@ -1625,8 +1635,11 @@ pkcs11Library=PKCS#11 library
 pkcs11LibraryDescription=The path of the dynamically linked library file
 sshAgentSocket=Custom SSH agent socket
 sshAgentSocketDescription=The custom socket to use to communicate with the SSH agent. This custom agent can be used for a connection by selecting the custom agent option for it.
-publicKey=Public key identifier
+#force
+publicKey=Key selector
 publicKeyDescription=The optional public key to force the agent to only offer the matching private key
+agentKeyName=Key selector
+agentKeyNameDescription=The name of the key entry in the password manager
 actions=Actions
 hcloudServer.displayName=Hetzner cloud server
 hcloudServer.displayDescription=Access a server hosted on Hetzner cloud via SSH
@@ -1907,10 +1920,12 @@ testingConnection=Testing connection ...
 openManagementConsole=Open management console
 openLxcTerminal=Open LXC terminal
 openContainerConsole=Open serial console
-keeperUseMfa=Use 2FA authenticator app
-keeperUseMfaDescription=Enable this if your Keeper account requires an 2FA TOTP to access passwords.
+keeper2fa=2FA method
+keeper2faDescription=The primary two-factor authentication method that is configured for your account. Enable this if your Keeper account requires two-factor auth to access passwords.
 keeperTotpDuration=Custom 2FA code duration
 keeperTotpDurationDescription=Override the default duration on how long a 2FA code is valid. Only applies if your organization policy allows changing the duration.\n\nPossible values are: $VALUES$
+#context: Brand and product names
+keeperOtherAuth=Other (RSA SecurID, Duo Security, Keeper DNA, etc.)
 extractReusableIdentities=Extract reusable identities
 identitiesAdded=Identities added
 syncMode=Sync mode
@@ -1962,10 +1977,15 @@ syncToPlainDirectoryDescription=When syncing to a local directory, you can eithe
 openSpiceSession=Open SPICE session
 terminalBehaviour=Terminal behaviour
 noScanPossible=No supported connections were found
-networkSwitchPorts=Network switch ports
-nswitchGroup.displayName=Network switch ports
-nswitchGroup.displayDescription=List available ports on a network switch device
-nswitchPort.displayName=Network switch port
+#force
+networkSwitchPorts=Network ports
+#force
+nswitchGroup.displayName=Network ports
+#force
+nswitchGroup.displayDescription=List available ports on a network device
+#force
+nswitchPort.displayName=Network port
+#force
 nswitchPort.displayDescription=Control an individual port on a network switch device
 enablePort=Enable port
 shutdownPort=Shut down port
@@ -1977,3 +1997,50 @@ showStatus=Show status
 showAllPorts=Show all ports
 activeLicense=License
 activeLicenseDescription=Activate an XPipe license key
+authenticatorApp=Authenticator app
+securityKey=Security key
+mcpAdditionalContext=Additional MCP context
+mcpAdditionalContextDescription=Additional instructions to pass to the MCP client. Use this to control the agent behaviour and supply additional context for your individual setup.
+mcpAdditionalContextSample=- Do not restart any services and daemons automatically without confirming first\n- When configuring a network interface, always use 192.168.1.1/24 as the gateway
+prefsRestartTitle=Restart required
+prefsRestartContent=Some options you changed require an application restart to apply. Do you want to restart XPipe now?
+sshKey=SSH key
+inlineKey=Retrieve directly from CLI
+keyAgent=Use agent integration
+passwordManagerKeyStrategy=SSH key retrieval method
+passwordManagerKeyStrategyDescription=How to retrieve SSH keys stored in the password manager. When disabled, no keys can be retrieved. When an SSH agent is configured, the agent must be properly started in the password manager.
+sshAgentNoKeys=The agent does not have any keys at the moment
+sshAgentHasKeys=The agent currently offers the following keys:
+passwordManagerNoAgentSupport=Password manager does not support retrieving SSH keys
+passwordManagerEmpty=No password manager is configured
+passwordManagerSshKeyConfig=Password manager configuration
+passwordManagerSshKeyConfigDescription=Check the status of the password manager
+keePassXcOpenSshAgent=Use OpenSSH agent
+keePassXcPageant=Use Pageant
+passwordManagerSshAgentSocket=SSH agent socket
+passwordManagerSshAgentSocketDescription=The socket that should be used to communicate with the agent.
+passwordManagerSshKeysNotSupported=The current password manager configuration does not support retrieving SSH keys
+passwordManagerIdentityAgentKey=Additional SSH key
+passwordManagerIdentityAgentKeyDescription=The SSH key to use from the password manager SSH agent
+multiIdentity.displayName=Multi identity
+multiIdentity.displayDescription=Choose from multiple different identities to connect to a system
+multiIdentityList=Identity list
+multiIdentityListDescription=The list of identities to switch between
+switchIdentity=Switch identity
+onePasswordManagerAccount=Account override
+onePasswordManagerAccountDescription=The explicit 1password account email address to use in case multiple accounts are registered. If not set, this will default to the first available account.
+hashicorpVaultAddress=Vault address
+hashicorpVaultAddressDescription=The URL to access your cluster at
+hashicorpVaultNamespace=Vault namespace
+hashicorpVaultNamespaceDescription=The namespace to use when accessing the vault. If left empty, no namespace information is passed.
+hashicorpVaultAuthType=Vault auth
+hashicorpVaultAuthTypeDescription=How to authenticate to the vault. The default setting to use the vault CLI auth is recommended, especially if you use auth methods that are not explicitly listed here.
+hashicorpVaultAuthAppRole=AppRole
+hashicorpVaultAuthToken=Token
+hashicorpVaultAuthExisting=Use vault CLI
+hashicorpVaultRoleId=RoleID
+hashicorpVaultRoleIdDescription=The UUID of the AppRole
+hashicorpVaultSecretId=SecretID
+hashicorpVaultSecretIdDescription=The matching secret of the AppRole
+hashicorpVaultToken=Token
+hashicorpVaultTokenDescription=The authentication token to use
diff --git a/lang/strings/translations_es.properties b/lang/strings/translations_es.properties
index f391c4179..7c6ea5b5b 100644
--- a/lang/strings/translations_es.properties
+++ b/lang/strings/translations_es.properties
@@ -1344,7 +1344,7 @@ commandOutput=Salida de comandos
 iconSourceDeletionTitle=Borrar fuente de iconos
 iconSourceDeletionContent=¿Quieres eliminar esta fuente de iconos y todos los iconos asociados a ella?
 refreshIcons=Iconos de actualización
-refreshIconsDescription=Recuperar, renderizar y almacenar en caché todos los más de 1000 iconos disponibles en archivos .png. Esto puede llevar un tiempo ...
+refreshIconsDescription=Recuperar, renderizar y almacenar en caché todos los más de 1000 iconos disponibles de fuentes externas en archivos .png. Esto puede llevar un tiempo ...
 vaultUserLegacy=Usuario de bóveda (modo de compatibilidad heredado limitado)
 upgradeInstructions=Instrucciones de actualización
 externalActionTitle=Solicitud de acción externa
@@ -1406,8 +1406,8 @@ categoryColorDescription=El color por defecto a utilizar para las conexiones den
 categorySync=Sincronizar con el repositorio git
 categorySyncDescription=Sincroniza todas las conexiones automáticamente con el repositorio git. Todos los cambios locales en las conexiones serán empujados al remoto.
 categorySyncSpecial=Sincronizar con repositorio git\n(No configurable para la categoría especial "$NAME$")
-categoryDontAllowScripts=Desactivar scripts
-categoryDontAllowScriptsDescription=Desactiva la creación de scripts en los sistemas de esta categoría para evitar cualquier modificación del sistema de archivos. Esto deshabilitará todas las funciones de creación de scripts, comandos del entorno shell, avisos, etc.
+categoryDontAllowScripts=Desactivar todas las modificaciones
+categoryDontAllowScriptsDescription=Desactiva la ejecución de comandos y otras operaciones en los sistemas de esta categoría para evitar cualquier modificación. Esto deshabilitará todas las funciones de scripting, comandos del entorno shell, avisos, etc.
 categoryConfirmAllModifications=Confirma todas las modificaciones
 categoryConfirmAllModificationsDescription=Confirma primero cualquier tipo de modificación de una conexión o de un sistema de archivos. Esto puede evitar operaciones accidentales en sistemas importantes.
 categoryDefaultIdentity=Identidad por defecto
@@ -1836,10 +1836,11 @@ testingConnection=Probar la conexión ...
 openManagementConsole=Consola de gestión abierta
 openLxcTerminal=Abrir terminal LXC
 openContainerConsole=Abrir consola serie
-keeperUseMfa=Utilizar la aplicación de autenticación 2FA
-keeperUseMfaDescription=Actívala si tu cuenta de Keeper requiere un TOTP 2FA para acceder a las contraseñas.
+keeper2fa=método 2FA
+keeper2faDescription=El método principal de autenticación de dos factores que está configurado para tu cuenta. Actívalo si tu cuenta de Keeper requiere autenticación de dos factores para acceder a las contraseñas.
 keeperTotpDuration=Duración del código 2FA personalizado
 keeperTotpDurationDescription=Anula la duración por defecto de la validez de un código 2FA. Sólo se aplica si la política de tu organización permite cambiar la duración.\n\nLos valores posibles son: $VALUES$
+keeperOtherAuth=Otros (RSA SecurID, Duo Security, Keeper DNA, etc.)
 extractReusableIdentities=Extraer identidades reutilizables
 identitiesAdded=Identidades añadidas
 syncMode=Modo de sincronización
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=Cuando sincronices con un directorio local, pued
 openSpiceSession=Abrir sesión SPICE
 terminalBehaviour=Comportamiento del terminal
 noScanPossible=No se han encontrado conexiones compatibles
-networkSwitchPorts=Puertos del conmutador de red
-nswitchGroup.displayName=Puertos del conmutador de red
-nswitchGroup.displayDescription=Enumerar los puertos disponibles en un dispositivo de conmutación de red
-nswitchPort.displayName=Puerto de conmutación de red
+networkSwitchPorts=Puertos de red
+nswitchGroup.displayName=Puertos de red
+nswitchGroup.displayDescription=Enumerar los puertos disponibles en un dispositivo de red
+nswitchPort.displayName=Puerto de red
 nswitchPort.displayDescription=Controlar un puerto individual en un dispositivo de conmutación de red
 enablePort=Habilitar puerto
 shutdownPort=Cerrar puerto
@@ -1906,3 +1907,10 @@ showStatus=Mostrar estado
 showAllPorts=Mostrar todos los puertos
 activeLicense=Licencia
 activeLicenseDescription=Activar una clave de licencia XPipe
+authenticatorApp=Aplicación Autenticador
+securityKey=Clave de seguridad
+mcpAdditionalContext=Contexto MCP adicional
+mcpAdditionalContextDescription=Instrucciones adicionales para pasar al cliente MCP. Utilízalo para controlar el comportamiento del agente y proporcionar contexto adicional para tu configuración individual.
+mcpAdditionalContextSample=- No reinicies ningún servicio o demonio automáticamente sin confirmarlo primero\n- Al configurar una interfaz de red, utiliza siempre 192.168.1.1/24 como puerta de enlace
+prefsRestartTitle=Reinicio necesario
+prefsRestartContent=Algunas opciones que has cambiado requieren reiniciar la aplicación para aplicarse. ¿Quieres reiniciar XPipe ahora?
diff --git a/lang/strings/translations_fr.properties b/lang/strings/translations_fr.properties
index bfedce179..921e2f254 100644
--- a/lang/strings/translations_fr.properties
+++ b/lang/strings/translations_fr.properties
@@ -1380,7 +1380,7 @@ commandOutput=Sortie de commande
 iconSourceDeletionTitle=Supprimer la source de l'icône
 iconSourceDeletionContent=Veux-tu supprimer cette source d'icônes et toutes les icônes qui y sont associées ?
 refreshIcons=Icônes de rafraîchissement
-refreshIconsDescription=Récupérer, rendre et mettre en cache toutes les icônes disponibles (plus de 1000) dans des fichiers .png. Cela peut prendre un certain temps...
+refreshIconsDescription=Récupérer, rendre et mettre en cache toutes les icônes disponibles (plus de 1000) à partir de sources externes dans des fichiers .png. Cela peut prendre un certain temps...
 #custom
 vaultUserLegacy=Utilisateur du coffre-fort (mode de compatibilité héritée limité)
 upgradeInstructions=Instructions de mise à niveau
@@ -1444,8 +1444,8 @@ categoryColorDescription=La couleur par défaut à utiliser pour les connexions
 categorySync=Synchronisation avec le dépôt git
 categorySyncDescription=Synchronise automatiquement toutes les connexions avec le dépôt git. Toutes les modifications locales apportées aux connexions seront poussées vers le dépôt distant.
 categorySyncSpecial=Synchronisation avec le dépôt git\n(Non configurable pour la catégorie spéciale "$NAME$")
-categoryDontAllowScripts=Désactiver les scripts
-categoryDontAllowScriptsDescription=Désactive la création de scripts sur les systèmes de cette catégorie pour empêcher toute modification du système de fichiers. Cela désactivera toutes les fonctionnalités de script, les commandes de l'environnement shell, les invites, etc.
+categoryDontAllowScripts=Désactive toutes les modifications
+categoryDontAllowScriptsDescription=Désactive toute exécution de commande et autres opérations sur les systèmes de cette catégorie pour empêcher toute modification. Cela désactivera toutes les fonctionnalités de script, les commandes de l'environnement shell, les invites, etc.
 categoryConfirmAllModifications=Confirme toutes les modifications
 categoryConfirmAllModificationsDescription=Confirme d'abord tout type de modification pour une connexion ou un système de fichiers. Cela peut éviter des opérations accidentelles sur des systèmes importants.
 categoryDefaultIdentity=Identité par défaut
@@ -1876,10 +1876,11 @@ testingConnection=Test de connexion ...
 openManagementConsole=Console de gestion ouverte
 openLxcTerminal=Ouvrir le terminal LXC
 openContainerConsole=Ouvrir une console série
-keeperUseMfa=Utilise l'application 2FA authenticator
-keeperUseMfaDescription=Active cette option si ton compte Keeper nécessite un TOTP 2FA pour accéder aux mots de passe.
+keeper2fa=méthode 2FA
+keeper2faDescription=La principale méthode d'authentification à deux facteurs qui est configurée pour ton compte. Active cette option si ton compte Keeper nécessite une authentification à deux facteurs pour accéder aux mots de passe.
 keeperTotpDuration=Durée du code 2FA personnalisé
 keeperTotpDurationDescription=Remplacer la durée par défaut de la validité d'un code 2FA. Ne s'applique que si la politique de ton organisation permet de modifier la durée.\n\nLes valeurs possibles sont : $VALUES$
+keeperOtherAuth=Autre (RSA SecurID, Duo Security, Keeper DNA, etc.)
 extractReusableIdentities=Extraire des identités réutilisables
 identitiesAdded=Identités ajoutées
 syncMode=Mode de synchronisation
@@ -1931,10 +1932,10 @@ syncToPlainDirectoryDescription=Lors de la synchronisation avec un répertoire l
 openSpiceSession=Ouvrir une session SPICE
 terminalBehaviour=Comportement du terminal
 noScanPossible=Aucune connexion prise en charge n'a été trouvée
-networkSwitchPorts=Ports de commutateur de réseau
-nswitchGroup.displayName=Ports de commutateur de réseau
-nswitchGroup.displayDescription=Liste des ports disponibles sur un commutateur de réseau
-nswitchPort.displayName=Port de commutateur de réseau
+networkSwitchPorts=Ports de réseau
+nswitchGroup.displayName=Ports de réseau
+nswitchGroup.displayDescription=Liste des ports disponibles sur un périphérique réseau
+nswitchPort.displayName=Port réseau
 nswitchPort.displayDescription=Contrôler un port individuel sur un commutateur de réseau
 enablePort=Activer le port
 shutdownPort=Ferme le port
@@ -1946,3 +1947,10 @@ showStatus=Afficher l'état
 showAllPorts=Afficher tous les ports
 activeLicense=Licence
 activeLicenseDescription=Activer une clé de licence XPipe
+authenticatorApp=Application Authenticator
+securityKey=Clé de sécurité
+mcpAdditionalContext=Contexte MCP supplémentaire
+mcpAdditionalContextDescription=Instructions supplémentaires à transmettre au client MCP. Sert à contrôler le comportement de l'agent et à fournir un contexte supplémentaire pour ta configuration individuelle.
+mcpAdditionalContextSample=- Ne redémarre pas automatiquement les services et les démons sans confirmer au préalable\n- Lors de la configuration d'une interface réseau, utilise toujours 192.168.1.1/24 comme passerelle
+prefsRestartTitle=Redémarrage nécessaire
+prefsRestartContent=Certaines options que tu as modifiées nécessitent un redémarrage de l'application pour être appliquées. Veux-tu redémarrer XPipe maintenant ?
diff --git a/lang/strings/translations_id.properties b/lang/strings/translations_id.properties
index e5f065eb1..ded7a9fc6 100644
--- a/lang/strings/translations_id.properties
+++ b/lang/strings/translations_id.properties
@@ -1344,7 +1344,7 @@ commandOutput=Keluaran perintah
 iconSourceDeletionTitle=Menghapus sumber ikon
 iconSourceDeletionContent=Apakah Anda ingin menghapus sumber ikon ini dan semua ikon yang terkait dengannya?
 refreshIcons=Menyegarkan ikon
-refreshIconsDescription=Mengambil, merender, dan menyimpan semua 1000+ ikon yang tersedia ke file .png. Ini mungkin membutuhkan waktu beberapa saat...
+refreshIconsDescription=Mengambil, merender, dan menyimpan semua 1000+ ikon yang tersedia dari sumber eksternal ke file .png. Ini mungkin memerlukan waktu beberapa saat...
 vaultUserLegacy=Pengguna lemari besi (Mode kompatibilitas lawas terbatas)
 upgradeInstructions=Petunjuk peningkatan
 externalActionTitle=Permintaan tindakan eksternal
@@ -1406,8 +1406,8 @@ categoryColorDescription=Warna default yang digunakan untuk koneksi dalam katego
 categorySync=Sinkronisasi dengan repositori git
 categorySyncDescription=Menyinkronkan semua koneksi secara otomatis dengan repositori git. Semua perubahan lokal pada koneksi akan didorong ke remote.
 categorySyncSpecial=Sinkronisasi dengan repositori git\n(Tidak dapat dikonfigurasi untuk kategori khusus "$NAME$")
-categoryDontAllowScripts=Menonaktifkan skrip
-categoryDontAllowScriptsDescription=Nonaktifkan pembuatan skrip pada sistem dalam kategori ini untuk mencegah modifikasi sistem file. Ini akan menonaktifkan semua fungsionalitas skrip, perintah lingkungan shell, prompt, dan lainnya.
+categoryDontAllowScripts=Menonaktifkan semua modifikasi
+categoryDontAllowScriptsDescription=Menonaktifkan eksekusi perintah dan operasi lain pada sistem dalam kategori ini untuk mencegah modifikasi. Ini akan menonaktifkan semua fungsionalitas skrip, perintah lingkungan shell, prompt, dan lainnya.
 categoryConfirmAllModifications=Mengonfirmasi semua modifikasi
 categoryConfirmAllModificationsDescription=Konfirmasikan terlebih dahulu segala jenis modifikasi untuk koneksi atau sistem file. Hal ini dapat mencegah operasi yang tidak disengaja pada sistem yang penting.
 categoryDefaultIdentity=Identitas default
@@ -1836,10 +1836,11 @@ testingConnection=Menguji koneksi ...
 openManagementConsole=Konsol manajemen terbuka
 openLxcTerminal=Membuka terminal LXC
 openContainerConsole=Membuka konsol serial
-keeperUseMfa=Menggunakan aplikasi pengautentikasi 2FA
-keeperUseMfaDescription=Aktifkan ini jika akun Keeper Anda memerlukan TOTP 2FA untuk mengakses kata sandi.
+keeper2fa=metode 2FA
+keeper2faDescription=Metode autentikasi dua faktor utama yang dikonfigurasikan untuk akun Anda. Aktifkan ini jika akun Keeper Anda memerlukan autentikasi dua faktor untuk mengakses kata sandi.
 keeperTotpDuration=Durasi kode 2FA khusus
 keeperTotpDurationDescription=Mengganti durasi default tentang berapa lama kode 2FA berlaku. Hanya berlaku jika kebijakan organisasi Anda mengizinkan pengubahan durasi.\n\nNilai yang mungkin adalah: $VALUES$
+keeperOtherAuth=Lainnya (RSA SecurID, Duo Security, Keeper DNA, dll.)
 extractReusableIdentities=Mengekstrak identitas yang dapat digunakan kembali
 identitiesAdded=Identitas ditambahkan
 syncMode=Mode sinkronisasi
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=Saat menyinkronkan ke direktori lokal, Anda dapa
 openSpiceSession=Membuka sesi SPICE
 terminalBehaviour=Perilaku terminal
 noScanPossible=Tidak ditemukan koneksi yang didukung
-networkSwitchPorts=Port sakelar jaringan
-nswitchGroup.displayName=Port sakelar jaringan
-nswitchGroup.displayDescription=Membuat daftar port yang tersedia pada perangkat sakelar jaringan
-nswitchPort.displayName=Port sakelar jaringan
+networkSwitchPorts=Port jaringan
+nswitchGroup.displayName=Port jaringan
+nswitchGroup.displayDescription=Membuat daftar port yang tersedia pada perangkat jaringan
+nswitchPort.displayName=Port jaringan
 nswitchPort.displayDescription=Mengontrol port individual pada perangkat sakelar jaringan
 enablePort=Mengaktifkan port
 shutdownPort=Mematikan port
@@ -1906,3 +1907,10 @@ showStatus=Menampilkan status
 showAllPorts=Menampilkan semua port
 activeLicense=Lisensi
 activeLicenseDescription=Mengaktifkan kunci lisensi XPipe
+authenticatorApp=Aplikasi autentikator
+securityKey=Kunci keamanan
+mcpAdditionalContext=Konteks MCP tambahan
+mcpAdditionalContextDescription=Instruksi tambahan untuk diteruskan ke klien MCP. Gunakan ini untuk mengontrol perilaku agen dan memberikan konteks tambahan untuk pengaturan individual Anda.
+mcpAdditionalContextSample=- Jangan memulai ulang layanan dan daemon apa pun secara otomatis tanpa mengonfirmasi terlebih dahulu\n- Saat mengonfigurasi antarmuka jaringan, selalu gunakan 192.168.1.1/24 sebagai gateway
+prefsRestartTitle=Diperlukan restart
+prefsRestartContent=Beberapa pilihan yang Anda ubah memerlukan aplikasi dimulai ulang untuk menerapkannya. Apakah Anda ingin memulai ulang XPipe sekarang?
diff --git a/lang/strings/translations_it.properties b/lang/strings/translations_it.properties
index 05755100f..c6f356538 100644
--- a/lang/strings/translations_it.properties
+++ b/lang/strings/translations_it.properties
@@ -1344,7 +1344,7 @@ commandOutput=Output del comando
 iconSourceDeletionTitle=Elimina l'icona sorgente
 iconSourceDeletionContent=Vuoi eliminare questa fonte di icone e tutte le icone ad essa associate?
 refreshIcons=Icone di aggiornamento
-refreshIconsDescription=Recuperare, renderizzare e memorizzare nella cache tutte le oltre 1000 icone disponibili in file .png. Potrebbe volerci un po' di tempo ...
+refreshIconsDescription=Recuperare, renderizzare e memorizzare nella cache tutte le oltre 1000 icone disponibili da fonti esterne in file .png. Questo potrebbe richiedere un po' di tempo ...
 vaultUserLegacy=Utente del Vault (modalità di compatibilità legacy limitata)
 upgradeInstructions=Istruzioni per l'aggiornamento
 externalActionTitle=Richiesta di azione esterna
@@ -1406,8 +1406,8 @@ categoryColorDescription=Il colore predefinito da utilizzare per le connessioni
 categorySync=Sincronizzazione con il repository git
 categorySyncDescription=Sincronizza automaticamente tutte le connessioni con il repository git. Tutte le modifiche locali alle connessioni saranno inviate al repository remoto.
 categorySyncSpecial=Sincronizzazione con il repository git\n(Non configurabile per la categoria speciale "$NAME$")
-categoryDontAllowScripts=Disabilita gli script
-categoryDontAllowScriptsDescription=Disabilita la creazione di script sui sistemi appartenenti a questa categoria per impedire qualsiasi modifica del file system. Questo disabilita tutte le funzionalità di scripting, i comandi dell'ambiente shell, i prompt e altro ancora.
+categoryDontAllowScripts=Disabilita tutte le modifiche
+categoryDontAllowScriptsDescription=Disabilita l'esecuzione di comandi e altre operazioni sui sistemi appartenenti a questa categoria per impedire qualsiasi modifica. In questo modo verranno disabilitate tutte le funzionalità di scripting, i comandi dell'ambiente shell, i prompt e altro ancora.
 categoryConfirmAllModifications=Conferma tutte le modifiche
 categoryConfirmAllModificationsDescription=Conferma prima qualsiasi tipo di modifica di una connessione o di un file system. In questo modo si possono evitare operazioni accidentali su sistemi importanti.
 categoryDefaultIdentity=Identità predefinita
@@ -1836,10 +1836,11 @@ testingConnection=Verifica della connessione ...
 openManagementConsole=Console di gestione aperta
 openLxcTerminal=Aprire il terminale LXC
 openContainerConsole=Aprire la console seriale
-keeperUseMfa=Usa l'applicazione autenticatore 2FA
-keeperUseMfaDescription=Abilita questa opzione se il tuo account Keeper richiede un 2FA TOTP per accedere alle password.
+keeper2fa=metodo 2FA
+keeper2faDescription=Il metodo principale di autenticazione a due fattori configurato per il tuo account. Abilita questa opzione se il tuo account Keeper richiede l'autenticazione a due fattori per accedere alle password.
 keeperTotpDuration=Durata del codice 2FA personalizzato
 keeperTotpDurationDescription=Annulla la durata predefinita della validità di un codice 2FA. Si applica solo se la politica dell'organizzazione consente di modificare la durata.\n\nI valori possibili sono: $VALUES$
+keeperOtherAuth=Altro (RSA SecurID, Duo Security, Keeper DNA, ecc.)
 extractReusableIdentities=Estrarre identità riutilizzabili
 identitiesAdded=Identità aggiunte
 syncMode=Modalità di sincronizzazione
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=Quando sincronizzi una directory locale, puoi tr
 openSpiceSession=Aprire una sessione SPICE
 terminalBehaviour=Comportamento del terminale
 noScanPossible=Non sono state trovate connessioni supportate
-networkSwitchPorts=Porte di switch di rete
-nswitchGroup.displayName=Porte di switch di rete
-nswitchGroup.displayDescription=Elenco delle porte disponibili su un dispositivo switch di rete
-nswitchPort.displayName=Porta dello switch di rete
+networkSwitchPorts=Porte di rete
+nswitchGroup.displayName=Porte di rete
+nswitchGroup.displayDescription=Elenco delle porte disponibili su un dispositivo di rete
+nswitchPort.displayName=Porta di rete
 nswitchPort.displayDescription=Controllare una singola porta di un dispositivo switch di rete
 enablePort=Abilita la porta
 shutdownPort=Arresto della porta
@@ -1906,3 +1907,10 @@ showStatus=Mostra stato
 showAllPorts=Mostra tutte le porte
 activeLicense=Licenza
 activeLicenseDescription=Attivare una chiave di licenza XPipe
+authenticatorApp=App Autenticatore
+securityKey=Chiave di sicurezza
+mcpAdditionalContext=Contesto MCP aggiuntivo
+mcpAdditionalContextDescription=Istruzioni aggiuntive da passare al client MCP. Utilizzale per controllare il comportamento dell'agente e fornire un contesto aggiuntivo per la tua configurazione individuale.
+mcpAdditionalContextSample=- Non riavviare automaticamente i servizi e i demoni senza averne prima avuto conferma\n- Quando configuri un'interfaccia di rete, usa sempre 192.168.1.1/24 come gateway
+prefsRestartTitle=Riavvio necessario
+prefsRestartContent=Alcune opzioni che hai modificato richiedono il riavvio dell'applicazione per essere applicate. Vuoi riavviare XPipe adesso?
diff --git a/lang/strings/translations_ja.properties b/lang/strings/translations_ja.properties
index edb01aaa4..3179aaf71 100644
--- a/lang/strings/translations_ja.properties
+++ b/lang/strings/translations_ja.properties
@@ -1344,7 +1344,7 @@ commandOutput=コマンド出力
 iconSourceDeletionTitle=アイコンのソースを削除する
 iconSourceDeletionContent=このアイコンソースとそれに関連するすべてのアイコンを削除するか？
 refreshIcons=リフレッシュアイコン
-refreshIconsDescription=利用可能な1000以上のアイコンをすべて.pngファイルに取得、レンダリング、キャッシュする。しばらく時間がかかるかもしれない．
+refreshIconsDescription=外部ソースから利用可能な1000以上のアイコンをすべて.pngファイルに取得し、レンダリングし、キャッシュする。これには時間がかかるかもしれない．
 vaultUserLegacy=Vaultユーザー（限定レガシー互換モード）
 upgradeInstructions=アップグレード手順
 externalActionTitle=外部アクション要求
@@ -1406,8 +1406,8 @@ categoryColorDescription=このカテゴリ内の接続に使用するデフォ
 categorySync=gitリポジトリと同期する
 categorySyncDescription=すべての接続をgitリポジトリと自動的に同期する。接続に対するローカルの変更はすべてリモートにプッシュされる。
 categorySyncSpecial=git リポジトリと同期する\n(特別なカテゴリ "$NAME$" では設定できない)
-categoryDontAllowScripts=スクリプトを無効にする
-categoryDontAllowScriptsDescription=このカテゴリ内のシステムでスクリプトの作成を無効にし、ファイルシステムの変更を防止する。これにより、すべてのスクリプト機能、シェル環境コマンド、プロンプトなどが無効になる。
+categoryDontAllowScripts=すべての変更を無効にする
+categoryDontAllowScriptsDescription=このカテゴリ内のシステムでコマンドの実行やその他の操作を無効にし、改ざんを防ぐ。これにより、すべてのスクリプト機能、シェル環境コマンド、プロンプトなどが無効になる。
 categoryConfirmAllModifications=すべての変更を確認する
 categoryConfirmAllModificationsDescription=接続やファイルシステムに対するいかなる変更も、最初に確認すること。これにより、重要なシステムに対する誤操作を防ぐことができる。
 categoryDefaultIdentity=デフォルトID
@@ -1836,10 +1836,11 @@ testingConnection=接続をテストする
 openManagementConsole=オープン管理コンソール
 openLxcTerminal=LXCターミナルを開く
 openContainerConsole=シリアルコンソールを開く
-keeperUseMfa=2FA認証アプリを使用する
-keeperUseMfaDescription=Keeperアカウントがパスワードにアクセスするために2FA TOTPを必要とする場合、これを有効にする。
+keeper2fa=2FA方式
+keeper2faDescription=アカウントに設定されているプライマリ2要素認証方法。Keeperアカウントがパスワードにアクセスするために2要素認証が必要な場合、これを有効にする。
 keeperTotpDuration=カスタム2FAコード期間
 keeperTotpDurationDescription=2FAコードの有効期間に関するデフォルトの期間をオーバーライドする。組織のポリシーで期間の変更が許可されている場合にのみ適用される。\n\n可能な値は以下の通り：$VALUES$
+keeperOtherAuth=その他（RSA SecurID、Duo Security、Keeper DNAなど）
 extractReusableIdentities=再利用可能なIDを抽出する
 identitiesAdded=IDが追加された
 syncMode=同期モード
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=ローカルディレクトリに同期する場
 openSpiceSession=SPICE セッションを開く
 terminalBehaviour=端末の動作
 noScanPossible=サポートされている接続が見つからなかった
-networkSwitchPorts=ネットワークスイッチポート
-nswitchGroup.displayName=ネットワークスイッチポート
-nswitchGroup.displayDescription=ネットワークスイッチデバイスの利用可能なポートをリストアップする
-nswitchPort.displayName=ネットワークスイッチポート
+networkSwitchPorts=ネットワークポート
+nswitchGroup.displayName=ネットワークポート
+nswitchGroup.displayDescription=ネットワークデバイスの利用可能なポートをリストアップする
+nswitchPort.displayName=ネットワークポート
 nswitchPort.displayDescription=ネットワーク・スイッチ・デバイスの個々のポートを制御する
 enablePort=ポートを有効にする
 shutdownPort=ポートをシャットダウンする
@@ -1906,3 +1907,10 @@ showStatus=ステータスを表示する
 showAllPorts=すべてのポートを表示する
 activeLicense=ライセンス
 activeLicenseDescription=XPipeライセンスキーをアクティベートする
+authenticatorApp=認証アプリ
+securityKey=セキュリティキー
+mcpAdditionalContext=追加のMCPコンテキスト
+mcpAdditionalContextDescription=MCP クライアントに渡す追加の指示。エージェントの動作を制御し、個々の設定に追加のコンテキストを提供するために使用する。
+mcpAdditionalContextSample=- 最初に確認することなく、自動的にサービスやデーモンを再起動しないこと\n- ネットワークインターフェイスを設定するときは、常に192.168.1.1/24をゲートウェイとして使用すること
+prefsRestartTitle=再起動が必要
+prefsRestartContent=変更したオプションの中には、適用するためにアプリケーションの再起動が必要なものがある。XPipeを再起動するか。
diff --git a/lang/strings/translations_ko.properties b/lang/strings/translations_ko.properties
index fcfc78baf..e431b741c 100644
--- a/lang/strings/translations_ko.properties
+++ b/lang/strings/translations_ko.properties
@@ -1378,7 +1378,7 @@ iconSourceDeletionTitle=아이콘 소스 삭제
 iconSourceDeletionContent=이 아이콘 소스 및 이와 관련된 모든 아이콘을 삭제하시겠습니까?
 #custom
 refreshIcons=새로고침 아이콘
-refreshIconsDescription=사용 가능한 모든 1000개 이상의 아이콘을 .png 파일로 검색, 렌더링 및 캐싱합니다. 시간이 좀 걸릴 수 있습니다...
+refreshIconsDescription=외부 소스에서 사용 가능한 모든 1000개 이상의 아이콘을 .png 파일로 검색, 렌더링 및 캐싱합니다. 시간이 좀 걸릴 수 있습니다...
 #custom
 vaultUserLegacy=Vault 사용자 (레거시 호환성 모드 제한)
 #custom
@@ -1446,8 +1446,8 @@ categoryColorDescription=이 카테고리 내의 연결에 사용할 기본 색
 categorySync=Git 리포지토리와 동기화
 categorySyncDescription=모든 연결을 git 리포지토리와 자동으로 동기화합니다. 연결에 대한 모든 로컬 변경사항이 원격으로 푸시됩니다.
 categorySyncSpecial=Git 리포지토리와 동기화\n(특수 카테고리 "$NAME$"에는 구성할 수 없음)
-categoryDontAllowScripts=스크립트 비활성화
-categoryDontAllowScriptsDescription=이 범주에 속하는 시스템에서 스크립트 생성을 비활성화하여 파일 시스템 수정을 방지합니다. 이렇게 하면 모든 스크립팅 기능, 셸 환경 명령, 프롬프트 등이 비활성화됩니다.
+categoryDontAllowScripts=모든 수정 사항 비활성화
+categoryDontAllowScriptsDescription=이 범주에 속하는 시스템에서 명령 실행 및 기타 작업을 비활성화하여 수정을 방지합니다. 이렇게 하면 모든 스크립팅 기능, 셸 환경 명령, 프롬프트 등이 비활성화됩니다.
 categoryConfirmAllModifications=모든 수정 사항 확인
 categoryConfirmAllModificationsDescription=연결 또는 파일 시스템에 대한 모든 종류의 수정 사항을 먼저 확인하세요. 이렇게 하면 중요한 시스템에서 실수로 작동하는 것을 방지할 수 있습니다.
 categoryDefaultIdentity=기본 ID
@@ -1889,10 +1889,11 @@ testingConnection=연결 테스트 중 ...
 openManagementConsole=관리 콘솔 열기
 openLxcTerminal=LXC 터미널 열기
 openContainerConsole=직렬 콘솔 열기
-keeperUseMfa=2FA 인증 앱 사용
-keeperUseMfaDescription=Keeper 계정에서 비밀번호에 액세스하기 위해 2FA TOTP가 필요한 경우 이 옵션을 사용 설정합니다.
+keeper2fa=2FA 방법
+keeper2faDescription=계정에 대해 구성된 기본 2단계 인증 방법입니다. Keeper 계정에서 비밀번호에 액세스하기 위해 2단계 인증이 필요한 경우 이 옵션을 사용 설정합니다.
 keeperTotpDuration=사용자 지정 2FA 코드 기간
 keeperTotpDurationDescription=2FA 코드의 유효 기간에 대한 기본 기간을 재정의합니다. 조직 정책에서 기간 변경을 허용하는 경우에만 적용됩니다.\n\n가능한 값은 다음과 같습니다: $VALUES$
+keeperOtherAuth=기타(RSA SecurID, Duo Security, Keeper DNA 등)
 extractReusableIdentities=재사용 가능한 ID 추출
 identitiesAdded=추가된 ID
 syncMode=동기화 모드
@@ -1944,10 +1945,10 @@ syncToPlainDirectoryDescription=로컬 디렉터리로 동기화할 때 이 디
 openSpiceSession=SPICE 세션 열기
 terminalBehaviour=터미널 동작
 noScanPossible=지원되는 연결을 찾을 수 없습니다
-networkSwitchPorts=네트워크 스위치 포트
-nswitchGroup.displayName=네트워크 스위치 포트
-nswitchGroup.displayDescription=네트워크 스위치 장치에서 사용 가능한 포트 목록
-nswitchPort.displayName=네트워크 스위치 포트
+networkSwitchPorts=네트워크 포트
+nswitchGroup.displayName=네트워크 포트
+nswitchGroup.displayDescription=네트워크 장치에서 사용 가능한 포트 목록
+nswitchPort.displayName=네트워크 포트
 nswitchPort.displayDescription=네트워크 스위치 장치의 개별 포트 제어
 enablePort=포트 사용
 shutdownPort=포트 종료
@@ -1959,3 +1960,10 @@ showStatus=상태 표시
 showAllPorts=모든 포트 표시
 activeLicense=라이선스
 activeLicenseDescription=XPipe 라이선스 키 활성화
+authenticatorApp=인증 앱
+securityKey=보안 키
+mcpAdditionalContext=추가 MCP 컨텍스트
+mcpAdditionalContextDescription=MCP 클라이언트에 전달할 추가 지침입니다. 이를 사용하여 상담원 동작을 제어하고 개별 설정에 대한 추가 컨텍스트를 제공할 수 있습니다.
+mcpAdditionalContextSample=- 먼저 확인하지 않고 서비스 및 데몬을 자동으로 다시 시작하지 마세요\n- 네트워크 인터페이스를 구성할 때는 항상 192.168.1.1/24를 게이트웨이로 사용하세요
+prefsRestartTitle=재시작 필요
+prefsRestartContent=변경한 일부 옵션을 적용하려면 애플리케이션을 다시 시작해야 합니다. 지금 XPipe를 다시 시작하시겠습니까?
diff --git a/lang/strings/translations_nl.properties b/lang/strings/translations_nl.properties
index 010271b48..480621c5f 100644
--- a/lang/strings/translations_nl.properties
+++ b/lang/strings/translations_nl.properties
@@ -1344,7 +1344,7 @@ commandOutput=Opdrachtuitvoer
 iconSourceDeletionTitle=Bron pictogram verwijderen
 iconSourceDeletionContent=Wil je deze pictogrambron en alle bijbehorende pictogrammen verwijderen?
 refreshIcons=Pictogrammen verversen
-refreshIconsDescription=Het ophalen, renderen en cachen van alle beschikbare 1000+ pictogrammen naar .png-bestanden. Dit kan even duren ...
+refreshIconsDescription=Het ophalen, renderen en cachen van alle beschikbare 1000+ pictogrammen van externe bronnen naar .png-bestanden. Dit kan even duren ...
 vaultUserLegacy=Kluisgebruiker (Beperkte oude compatibiliteitsmodus)
 upgradeInstructions=Upgrade-instructies
 externalActionTitle=Extern actieverzoek
@@ -1406,8 +1406,8 @@ categoryColorDescription=De standaard te gebruiken kleur voor verbindingen binne
 categorySync=Synchroniseren met git repository
 categorySyncDescription=Synchroniseer alle verbindingen automatisch met een git repository. Alle lokale wijzigingen aan verbindingen worden naar de remote gepushed.
 categorySyncSpecial=Synchroniseren met git repository\n(Niet configureerbaar voor speciale categorie "$NAME$")
-categoryDontAllowScripts=Scripts uitschakelen
-categoryDontAllowScriptsDescription=Schakel het maken van scripts uit op systemen binnen deze categorie om wijzigingen aan het bestandssysteem te voorkomen. Dit schakelt alle scriptfunctionaliteit, shell-omgevingsopdrachten, prompts en meer uit.
+categoryDontAllowScripts=Alle wijzigingen uitschakelen
+categoryDontAllowScriptsDescription=Schakel het uitvoeren van commando's en andere bewerkingen op systemen binnen deze categorie uit om wijzigingen te voorkomen. Dit schakelt alle scriptfunctionaliteit, shell-omgevingscommando's, prompts en meer uit.
 categoryConfirmAllModifications=Bevestig alle wijzigingen
 categoryConfirmAllModificationsDescription=Bevestig elke wijziging aan een verbinding of bestandssysteem eerst. Dit kan onbedoelde bewerkingen op belangrijke systemen voorkomen.
 categoryDefaultIdentity=Standaard identiteit
@@ -1836,10 +1836,11 @@ testingConnection=Verbinding testen ...
 openManagementConsole=Open beheerconsole
 openLxcTerminal=LXC-terminal openen
 openContainerConsole=Seriële console openen
-keeperUseMfa=Gebruik 2FA authenticator app
-keeperUseMfaDescription=Schakel dit in als je Keeper-account een 2FA TOTP vereist om toegang te krijgen tot wachtwoorden.
+keeper2fa=2FA methode
+keeper2faDescription=De primaire twee-factor authenticatiemethode die is geconfigureerd voor je account. Schakel dit in als je Keeper-account tweefactorauthenticatie vereist om toegang te krijgen tot wachtwoorden.
 keeperTotpDuration=Aangepaste 2FA code duur
 keeperTotpDurationDescription=Overschrijf de standaardduur van de geldigheid van een 2FA code. Alleen van toepassing als het beleid van je organisatie het wijzigen van de duur toestaat.\n\nMogelijke waarden zijn: $VALUES$
+keeperOtherAuth=Andere (RSA SecurID, Duo Security, Keeper DNA, etc.)
 extractReusableIdentities=Herbruikbare identiteiten extraheren
 identitiesAdded=Identiteiten toegevoegd
 syncMode=Synchronisatiemodus
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=Bij het synchroniseren naar een lokale map, kun
 openSpiceSession=Open SPICE-sessie
 terminalBehaviour=Gedrag van terminals
 noScanPossible=Er zijn geen ondersteunde verbindingen gevonden
-networkSwitchPorts=Netwerk switch poorten
-nswitchGroup.displayName=Netwerk switch poorten
-nswitchGroup.displayDescription=Lijst met beschikbare poorten op een netwerkswitch
-nswitchPort.displayName=Netwerk switch poort
+networkSwitchPorts=Netwerkpoorten
+nswitchGroup.displayName=Netwerkpoorten
+nswitchGroup.displayDescription=Lijst van beschikbare poorten op een netwerkapparaat
+nswitchPort.displayName=Netwerkpoort
 nswitchPort.displayDescription=Een individuele poort op een netwerkschakelaar besturen
 enablePort=Poort inschakelen
 shutdownPort=Poort afsluiten
@@ -1906,3 +1907,10 @@ showStatus=Status weergeven
 showAllPorts=Toon alle poorten
 activeLicense=Licentie
 activeLicenseDescription=Een XPipe-licentiesleutel activeren
+authenticatorApp=Authenticator app
+securityKey=Beveiligingssleutel
+mcpAdditionalContext=Extra MCP-context
+mcpAdditionalContextDescription=Extra instructies om door te geven aan de MCP-client. Gebruik dit om het gedrag van de agent te regelen en aanvullende context te leveren voor je individuele opstelling.
+mcpAdditionalContextSample=- Start geen services en daemons automatisch opnieuw op zonder dit eerst te bevestigen\n- Gebruik bij het configureren van een netwerkinterface altijd 192.168.1.1/24 als gateway
+prefsRestartTitle=Opnieuw opstarten vereist
+prefsRestartContent=Sommige opties die je hebt gewijzigd vereisen een herstart van de toepassing om te kunnen worden toegepast. Wil je XPipe nu opnieuw opstarten?
diff --git a/lang/strings/translations_pl.properties b/lang/strings/translations_pl.properties
index c10823a68..32168aba0 100644
--- a/lang/strings/translations_pl.properties
+++ b/lang/strings/translations_pl.properties
@@ -1345,7 +1345,7 @@ commandOutput=Wyjście polecenia
 iconSourceDeletionTitle=Usuń źródło ikony
 iconSourceDeletionContent=Czy chcesz usunąć to źródło ikon i wszystkie powiązane z nim ikony?
 refreshIcons=Ikony odświeżania
-refreshIconsDescription=Pobieranie, renderowanie i buforowanie wszystkich dostępnych ponad 1000 ikon do plików .png. Może to trochę potrwać ...
+refreshIconsDescription=Pobieranie, renderowanie i buforowanie wszystkich dostępnych ponad 1000 ikon z zewnętrznych źródeł do plików .png. Może to trochę potrwać ...
 vaultUserLegacy=Użytkownik Vault (ograniczony tryb zgodności ze starszymi wersjami)
 upgradeInstructions=Instrukcje aktualizacji
 externalActionTitle=Żądanie akcji zewnętrznej
@@ -1407,8 +1407,8 @@ categoryColorDescription=Domyślny kolor używany dla połączeń w tej kategori
 categorySync=Zsynchronizuj z repozytorium git
 categorySyncDescription=Synchronizuj wszystkie połączenia automatycznie z repozytorium git. Wszystkie lokalne zmiany w połączeniach zostaną przesłane do repozytorium zdalnego.
 categorySyncSpecial=Synchronizuj z repozytorium git\n(Nie konfigurowalne dla kategorii specjalnej "$NAME$")
-categoryDontAllowScripts=Wyłącz skrypty
-categoryDontAllowScriptsDescription=Wyłącz tworzenie skryptów w systemach należących do tej kategorii, aby zapobiec modyfikacjom systemu plików. Spowoduje to wyłączenie wszystkich funkcji skryptów, poleceń środowiska powłoki, monitów i innych.
+categoryDontAllowScripts=Wyłącz wszystkie modyfikacje
+categoryDontAllowScriptsDescription=Wyłącz wykonywanie poleceń i innych operacji w systemach należących do tej kategorii, aby zapobiec wszelkim modyfikacjom. Spowoduje to wyłączenie wszystkich funkcji skryptów, poleceń środowiska powłoki, monitów i innych.
 categoryConfirmAllModifications=Potwierdź wszystkie modyfikacje
 categoryConfirmAllModificationsDescription=Potwierdź najpierw każdy rodzaj modyfikacji połączenia lub systemu plików. Może to zapobiec przypadkowym operacjom na ważnych systemach.
 categoryDefaultIdentity=Tożsamość domyślna
@@ -1837,10 +1837,11 @@ testingConnection=Testowanie połączenia ...
 openManagementConsole=Otwarta konsola zarządzania
 openLxcTerminal=Otwórz terminal LXC
 openContainerConsole=Otwórz konsolę szeregową
-keeperUseMfa=Użyj aplikacji uwierzytelniającej 2FA
-keeperUseMfaDescription=Włącz tę opcję, jeśli Twoje konto Keeper wymaga TOTP 2FA, aby uzyskać dostęp do haseł.
+keeper2fa=metoda 2FA
+keeper2faDescription=Podstawowa metoda uwierzytelniania dwuskładnikowego skonfigurowana dla Twojego konta. Włącz tę opcję, jeśli Twoje konto Keeper wymaga uwierzytelniania dwuskładnikowego w celu uzyskania dostępu do haseł.
 keeperTotpDuration=Czas trwania niestandardowego kodu 2FA
 keeperTotpDurationDescription=Zastąp domyślny czas ważności kodu 2FA. Ma zastosowanie tylko wtedy, gdy zasady Twojej organizacji zezwalają na zmianę czasu trwania.\n\nMożliwe wartości to: $VALUES$
+keeperOtherAuth=Inne (RSA SecurID, Duo Security, Keeper DNA itp.)
 extractReusableIdentities=Wyodrębnij tożsamości wielokrotnego użytku
 identitiesAdded=Dodane tożsamości
 syncMode=Tryb synchronizacji
@@ -1892,10 +1893,10 @@ syncToPlainDirectoryDescription=Podczas synchronizacji z katalogiem lokalnym, mo
 openSpiceSession=Otwórz sesję SPICE
 terminalBehaviour=Zachowanie terminala
 noScanPossible=Nie znaleziono obsługiwanych połączeń
-networkSwitchPorts=Porty przełącznika sieciowego
-nswitchGroup.displayName=Porty przełącznika sieciowego
-nswitchGroup.displayDescription=Lista dostępnych portów na przełączniku sieciowym
-nswitchPort.displayName=Port przełącznika sieciowego
+networkSwitchPorts=Porty sieciowe
+nswitchGroup.displayName=Porty sieciowe
+nswitchGroup.displayDescription=Lista dostępnych portów na urządzeniu sieciowym
+nswitchPort.displayName=Port sieciowy
 nswitchPort.displayDescription=Kontroluj pojedynczy port na przełączniku sieciowym
 enablePort=Włącz port
 shutdownPort=Zamknij port
@@ -1907,3 +1908,10 @@ showStatus=Pokaż status
 showAllPorts=Pokaż wszystkie porty
 activeLicense=Licencja
 activeLicenseDescription=Aktywuj klucz licencyjny XPipe
+authenticatorApp=Aplikacja uwierzytelniająca
+securityKey=Klucz zabezpieczeń
+mcpAdditionalContext=Dodatkowy kontekst MCP
+mcpAdditionalContextDescription=Dodatkowe instrukcje do przekazania klientowi MCP. Użyj tego, aby kontrolować zachowanie agenta i zapewnić dodatkowy kontekst dla indywidualnej konfiguracji.
+mcpAdditionalContextSample=- Nie uruchamiaj ponownie żadnych usług i demonów automatycznie bez uprzedniego potwierdzenia\n- Podczas konfigurowania interfejsu sieciowego zawsze używaj 192.168.1.1/24 jako bramy
+prefsRestartTitle=Wymagany restart
+prefsRestartContent=Niektóre opcje, które zmieniłeś, wymagają ponownego uruchomienia aplikacji. Czy chcesz teraz ponownie uruchomić XPipe?
diff --git a/lang/strings/translations_pt.properties b/lang/strings/translations_pt.properties
index 062d33fec..fa0ac8ced 100644
--- a/lang/strings/translations_pt.properties
+++ b/lang/strings/translations_pt.properties
@@ -1344,7 +1344,7 @@ commandOutput=Saída de comando
 iconSourceDeletionTitle=Apaga o ícone de origem
 iconSourceDeletionContent=Queres apagar esta fonte de ícones e todos os ícones associados a ela?
 refreshIcons=Atualizar ícones
-refreshIconsDescription=Recuperar, renderizar e armazenar em cache todos os mais de 1000 ícones disponíveis em ficheiros .png. Isso pode demorar um pouco ...
+refreshIconsDescription=Recuperar, renderizar e armazenar em cache todos os mais de 1000 ícones disponíveis de fontes externas para arquivos .png. Isso pode demorar um pouco ...
 vaultUserLegacy=Utilizador do Vault (modo de compatibilidade legado limitado)
 upgradeInstructions=Instruções de atualização
 externalActionTitle=Pedido de ação externa
@@ -1406,8 +1406,8 @@ categoryColorDescription=A cor predefinida a utilizar para ligações dentro des
 categorySync=Sincroniza com o repositório git
 categorySyncDescription=Sincroniza todas as ligações automaticamente com o repositório git. Todas as alterações locais às ligações serão enviadas para o repositório remoto.
 categorySyncSpecial=Sincroniza com o repositório git\n(Não configurável para a categoria especial "$NAME$")
-categoryDontAllowScripts=Desativar scripts
-categoryDontAllowScriptsDescription=Desabilita a criação de scripts em sistemas dentro desta categoria para evitar qualquer modificação no sistema de arquivos. Isto irá desativar todas as funcionalidades de scripting, comandos de ambiente shell, prompts e muito mais.
+categoryDontAllowScripts=Desabilita todas as modificações
+categoryDontAllowScriptsDescription=Desabilita qualquer execução de comando e outras operações em sistemas dentro desta categoria para evitar quaisquer modificações. Isto irá desativar todas as funcionalidades de scripting, comandos de ambiente shell, prompts e muito mais.
 categoryConfirmAllModifications=Confirma todas as modificações
 categoryConfirmAllModificationsDescription=Confirma primeiro qualquer tipo de modificação de uma ligação ou de um sistema de ficheiros. Isto pode evitar operações acidentais em sistemas importantes.
 categoryDefaultIdentity=Identidade por defeito
@@ -1836,10 +1836,11 @@ testingConnection=Testar a ligação ...
 openManagementConsole=Abre a consola de gestão
 openLxcTerminal=Abre o terminal LXC
 openContainerConsole=Abre a consola de série
-keeperUseMfa=Utiliza a aplicação de autenticação 2FA
-keeperUseMfaDescription=Ative essa opção se a sua conta do Keeper exigir um TOTP 2FA para acessar senhas.
+keeper2fa=método 2FA
+keeper2faDescription=O método primário de autenticação de dois fatores que está configurado para a tua conta. Ative isso se sua conta do Keeper exigir autenticação de dois fatores para acessar senhas.
 keeperTotpDuration=Duração do código 2FA personalizado
 keeperTotpDurationDescription=Substitui a duração predefinida de quanto tempo um código 2FA é válido. Só se aplica se a política da tua organização permitir alterar a duração.\n\nOs valores possíveis são: $VALUES$
+keeperOtherAuth=Outros (RSA SecurID, Duo Security, Keeper DNA, etc.)
 extractReusableIdentities=Extrai identidades reutilizáveis
 identitiesAdded=Identificações adicionadas
 syncMode=Modo de sincronização
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=Ao sincronizar com um diretório local, podes tr
 openSpiceSession=Abre uma sessão SPICE
 terminalBehaviour=Comportamento do terminal
 noScanPossible=Não foram encontradas ligações suportadas
-networkSwitchPorts=Portas de comutação de rede
-nswitchGroup.displayName=Portas de comutação de rede
-nswitchGroup.displayDescription=Lista as portas disponíveis num dispositivo de comutação de rede
-nswitchPort.displayName=Porta de comutação de rede
+networkSwitchPorts=Portas de rede
+nswitchGroup.displayName=Portas de rede
+nswitchGroup.displayDescription=Lista as portas disponíveis num dispositivo de rede
+nswitchPort.displayName=Porta de rede
 nswitchPort.displayDescription=Controla uma porta individual num dispositivo de comutação de rede
 enablePort=Ativar porta
 shutdownPort=Fecha a porta
@@ -1906,3 +1907,10 @@ showStatus=Mostra o estado
 showAllPorts=Mostra todas as portas
 activeLicense=Licença
 activeLicenseDescription=Ativar uma chave de licença XPipe
+authenticatorApp=Aplicação de autenticação
+securityKey=Chave de segurança
+mcpAdditionalContext=Contexto adicional do MCP
+mcpAdditionalContextDescription=Instruções adicionais para passar para o cliente MCP. Utiliza isto para controlar o comportamento do agente e fornecer contexto adicional para a sua configuração individual.
+mcpAdditionalContextSample=- Não reinicies automaticamente quaisquer serviços e daemons sem confirmar primeiro\n- Ao configurar uma interface de rede, utiliza sempre 192.168.1.1/24 como gateway
+prefsRestartTitle=Reiniciar necessário
+prefsRestartContent=Algumas opções que alteraste requerem um reinício da aplicação para serem aplicadas. Queres reiniciar o XPipe agora?
diff --git a/lang/strings/translations_ru.properties b/lang/strings/translations_ru.properties
index 37a0a648d..c606040ea 100644
--- a/lang/strings/translations_ru.properties
+++ b/lang/strings/translations_ru.properties
@@ -1446,7 +1446,7 @@ commandOutput=Вывод команд
 iconSourceDeletionTitle=Удалить источник иконок
 iconSourceDeletionContent=Хочешь удалить этот источник иконок и все связанные с ним иконки?
 refreshIcons=Иконки обновления
-refreshIconsDescription=Получение, рендеринг и кэширование всех имеющихся 1000+ иконок в .png-файлы. Это может занять некоторое время...
+refreshIconsDescription=Получение, рендеринг и кэширование всех доступных 1000+ иконок из внешних источников в .png-файлы. Это может занять некоторое время...
 vaultUserLegacy=Пользователь хранилища (режим ограниченной совместимости с устаревшими версиями)
 upgradeInstructions=Инструкции по обновлению
 externalActionTitle=Запрос на внешнее действие
@@ -1509,8 +1509,8 @@ categoryColorDescription=Цвет по умолчанию, который буд
 categorySync=Синхронизация с git-репозиторием
 categorySyncDescription=Автоматически синхронизируй все соединения с git-репозиторием. Все локальные изменения в соединениях будут выгружаться в удаленный.
 categorySyncSpecial=Синхронизация с git-репозиторием\n(Не настраивается для специальной категории "$NAME$")
-categoryDontAllowScripts=Отключить скрипты
-categoryDontAllowScriptsDescription=Отключи создание скриптов в системах этой категории, чтобы предотвратить любые модификации файловой системы. Это отключит все функции скриптов, команды среды оболочки, подсказки и прочее.
+categoryDontAllowScripts=Отключить все модификации
+categoryDontAllowScriptsDescription=Отключи выполнение любых команд и других операций на системах из этой категории, чтобы предотвратить любые модификации. Это отключит все скриптовые функции, команды среды оболочки, подсказки и многое другое.
 categoryConfirmAllModifications=Подтверди все модификации
 categoryConfirmAllModificationsDescription=Любые изменения в соединении или файловой системе сначала подтверди. Это может предотвратить случайные операции с важными системами.
 categoryDefaultIdentity=Идентификация по умолчанию
@@ -1948,10 +1948,11 @@ testingConnection=Тестирование соединения ...
 openManagementConsole=Открытая консоль управления
 openLxcTerminal=Откройте терминал LXC
 openContainerConsole=Открыть последовательную консоль
-keeperUseMfa=Используйте приложение аутентификатора 2FA
-keeperUseMfaDescription=Включи эту опцию, если твой аккаунт Keeper требует 2FA TOTP для доступа к паролям.
+keeper2fa=метод 2FA
+keeper2faDescription=Основной метод двухфакторной аутентификации, который настроен для твоего аккаунта. Включи этот параметр, если твой аккаунт Keeper требует двухфакторной аутентификации для доступа к паролям.
 keeperTotpDuration=Продолжительность действия пользовательского кода 2FA
 keeperTotpDurationDescription=Переопредели стандартную продолжительность действия кода 2FA. Применяется только в том случае, если политика твоей организации позволяет изменять продолжительность.\n\nВозможные значения: $VALUES$
+keeperOtherAuth=Прочее (RSA SecurID, Duo Security, Keeper DNA и так далее)
 extractReusableIdentities=Извлечение многократно используемых идентификационных данных
 identitiesAdded=Добавлены идентификаторы
 syncMode=Режим синхронизации
@@ -2003,10 +2004,10 @@ syncToPlainDirectoryDescription=При синхронизации с локал
 openSpiceSession=Открыть сессию SPICE
 terminalBehaviour=Поведение терминала
 noScanPossible=Не найдено ни одного поддерживаемого соединения
-networkSwitchPorts=Порты сетевого коммутатора
-nswitchGroup.displayName=Порты сетевого коммутатора
-nswitchGroup.displayDescription=Список доступных портов на устройстве сетевого коммутатора
-nswitchPort.displayName=Порт сетевого коммутатора
+networkSwitchPorts=Сетевые порты
+nswitchGroup.displayName=Сетевые порты
+nswitchGroup.displayDescription=Список доступных портов на сетевом устройстве
+nswitchPort.displayName=Сетевой порт
 nswitchPort.displayDescription=Управление отдельным портом на устройстве сетевого коммутатора
 enablePort=Включить порт
 shutdownPort=Отключить порт
@@ -2018,3 +2019,10 @@ showStatus=Показать состояние
 showAllPorts=Показать все порты
 activeLicense=Лицензия
 activeLicenseDescription=Активировать лицензионный ключ XPipe
+authenticatorApp=Приложение-аутентификатор
+securityKey=Ключ безопасности
+mcpAdditionalContext=Дополнительный контекст MCP
+mcpAdditionalContextDescription=Дополнительные инструкции, которые нужно передать MCP-клиенту. Используй это, чтобы управлять поведением агента и предоставлять дополнительный контекст для твоей индивидуальной настройки.
+mcpAdditionalContextSample=- Не перезапускай службы и демоны автоматически без предварительного подтверждения\n- При настройке сетевого интерфейса всегда используй 192.168.1.1/24 в качестве шлюза
+prefsRestartTitle=Требуется перезагрузка
+prefsRestartContent=Некоторые параметры, которые ты изменил, требуют перезапуска приложения для применения. Хочешь ли ты перезапустить XPipe сейчас?
diff --git a/lang/strings/translations_sv.properties b/lang/strings/translations_sv.properties
index 56c91099f..797b549db 100644
--- a/lang/strings/translations_sv.properties
+++ b/lang/strings/translations_sv.properties
@@ -1344,7 +1344,7 @@ commandOutput=Kommandoutgång
 iconSourceDeletionTitle=Ta bort ikon källa
 iconSourceDeletionContent=Vill du ta bort den här ikonkällan och alla ikoner som är associerade med den?
 refreshIcons=Uppdatera ikoner
-refreshIconsDescription=Hämtar, renderar och cachar alla tillgängliga 1000+ ikoner till .png-filer. Detta kan ta ett tag ...
+refreshIconsDescription=Hämtar, renderar och cachar alla tillgängliga 1000+ ikoner från externa källor till .png-filer. Detta kan ta ett tag ...
 vaultUserLegacy=Vault-användare (begränsat äldre kompatibilitetsläge)
 upgradeInstructions=Instruktioner för uppgradering
 externalActionTitle=Begäran om extern åtgärd
@@ -1406,8 +1406,8 @@ categoryColorDescription=Standardfärgen som ska användas för anslutningar ino
 categorySync=Synkronisera med git-förvaret
 categorySyncDescription=Synkronisera alla anslutningar automatiskt med git-förvaret. Alla lokala ändringar av anslutningar kommer att skjutas till fjärrkontrollen.
 categorySyncSpecial=Synkronisera med git-förvaret\n(Ej konfigurerbar för specialkategori "$NAME$")
-categoryDontAllowScripts=Inaktivera skript
-categoryDontAllowScriptsDescription=Inaktivera skapandet av skript på system inom denna kategori för att förhindra ändringar i filsystemet. Detta inaktiverar all skriptfunktionalitet, kommandon i skalmiljön, uppmaningar med mera.
+categoryDontAllowScripts=Inaktivera alla modifieringar
+categoryDontAllowScriptsDescription=Inaktivera all kommandokörning och andra operationer på system inom denna kategori för att förhindra alla ändringar. Detta inaktiverar alla skriptfunktioner, kommandon i skalmiljön, uppmaningar med mera.
 categoryConfirmAllModifications=Bekräfta alla ändringar
 categoryConfirmAllModificationsDescription=Bekräfta först alla typer av ändringar av en anslutning eller ett filsystem. Detta kan förhindra oavsiktliga operationer på viktiga system.
 categoryDefaultIdentity=Standardidentitet
@@ -1836,10 +1836,11 @@ testingConnection=Testning av anslutning ...
 openManagementConsole=Öppen hanteringskonsol
 openLxcTerminal=Öppna LXC-terminalen
 openContainerConsole=Öppna seriell konsol
-keeperUseMfa=Använd 2FA-autentiseringsapp
-keeperUseMfaDescription=Aktivera detta om ditt Keeper-konto kräver en 2FA TOTP för att komma åt lösenord.
+keeper2fa=2FA-metod
+keeper2faDescription=Den primära tvåfaktorsautentiseringsmetoden som är konfigurerad för ditt konto. Aktivera detta om ditt Keeper-konto kräver tvåfaktorsautentisering för att komma åt lösenord.
 keeperTotpDuration=Anpassad 2FA-kods varaktighet
 keeperTotpDurationDescription=Åsidosätt standardtiden för hur länge en 2FA-kod är giltig. Gäller endast om organisationens policy tillåter ändring av giltighetstiden.\n\nMöjliga värden är: $VALUES$
+keeperOtherAuth=Annat (RSA SecurID, Duo Security, Keeper DNA, etc.)
 extractReusableIdentities=Extrahera återanvändbara identiteter
 identitiesAdded=Identiteter tillagda
 syncMode=Synkroniseringsläge
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=När du synkroniserar till en lokal katalog kan
 openSpiceSession=Öppna SPICE-session
 terminalBehaviour=Terminalens beteende
 noScanPossible=Inga anslutningar som stöds hittades
-networkSwitchPorts=Portar för nätverksswitch
-nswitchGroup.displayName=Portar för nätverksswitch
-nswitchGroup.displayDescription=Lista tillgängliga portar på en nätverksväxel
-nswitchPort.displayName=Port för nätverksswitch
+networkSwitchPorts=Nätverksportar
+nswitchGroup.displayName=Nätverksportar
+nswitchGroup.displayDescription=Lista tillgängliga portar på en nätverksenhet
+nswitchPort.displayName=Nätverksport
 nswitchPort.displayDescription=Styr en enskild port på en nätverksväxel
 enablePort=Aktivera port
 shutdownPort=Stäng ner port
@@ -1906,3 +1907,10 @@ showStatus=Visa status
 showAllPorts=Visa alla portar
 activeLicense=Licens
 activeLicenseDescription=Aktivera en XPipe-licensnyckel
+authenticatorApp=Autentiseringsapplikation
+securityKey=Säkerhetsnyckel
+mcpAdditionalContext=Ytterligare MCP-kontext
+mcpAdditionalContextDescription=Ytterligare instruktioner att vidarebefordra till MCP-klienten. Använd detta för att styra agentens beteende och ge ytterligare sammanhang för din individuella installation.
+mcpAdditionalContextSample=- Starta inte om några tjänster och daemons automatiskt utan att först bekräfta\n- När du konfigurerar ett nätverksgränssnitt ska du alltid använda 192.168.1.1/24 som gateway
+prefsRestartTitle=Omstart krävs
+prefsRestartContent=Vissa alternativ som du ändrade kräver en omstart av programmet för att gälla. Vill du starta om XPipe nu?
diff --git a/lang/strings/translations_tr.properties b/lang/strings/translations_tr.properties
index 8126a244b..e132cbed4 100644
--- a/lang/strings/translations_tr.properties
+++ b/lang/strings/translations_tr.properties
@@ -1344,7 +1344,7 @@ commandOutput=Komut çıktısı
 iconSourceDeletionTitle=Simge kaynağını sil
 iconSourceDeletionContent=Bu simge kaynağını ve onunla ilişkili tüm simgeleri silmek istiyor musunuz?
 refreshIcons=Yenileme simgeleri
-refreshIconsDescription=Mevcut tüm 1000'den fazla simgeyi .png dosyalarına alma, işleme ve önbelleğe alma. Bu biraz zaman alabilir ...
+refreshIconsDescription=Mevcut tüm 1000'den fazla simgeyi harici kaynaklardan .png dosyalarına alma, işleme ve önbelleğe alma. Bu biraz zaman alabilir ...
 vaultUserLegacy=Vault kullanıcısı (Sınırlı eski uyumluluk modu)
 upgradeInstructions=Yükseltme talimatları
 externalActionTitle=Harici eylem talebi
@@ -1406,8 +1406,8 @@ categoryColorDescription=Bu kategorideki bağlantılar için kullanılacak varsa
 categorySync=Git deposu ile senkronize et
 categorySyncDescription=Tüm bağlantıları git deposu ile otomatik olarak senkronize edin. Bağlantılardaki tüm yerel değişiklikler uzağa itilecektir.
 categorySyncSpecial=Git deposu ile senkronize et\n(Özel kategori "$NAME$" için yapılandırılamaz)
-categoryDontAllowScripts=Komut dosyalarını devre dışı bırak
-categoryDontAllowScriptsDescription=Herhangi bir dosya sistemi değişikliğini önlemek için bu kategorideki sistemlerde komut dosyası oluşturmayı devre dışı bırakın. Bu, tüm komut dosyası işlevlerini, kabuk ortamı komutlarını, istemleri ve daha fazlasını devre dışı bırakacaktır.
+categoryDontAllowScripts=Tüm değişiklikleri devre dışı bırak
+categoryDontAllowScriptsDescription=Herhangi bir değişikliği önlemek için bu kategorideki sistemlerde komut yürütmeyi ve diğer işlemleri devre dışı bırakın. Bu, tüm komut dosyası işlevlerini, kabuk ortamı komutlarını, istemleri ve daha fazlasını devre dışı bırakacaktır.
 categoryConfirmAllModifications=Tüm değişiklikleri onaylayın
 categoryConfirmAllModificationsDescription=Önce bir bağlantı veya dosya sistemi için her türlü değişikliği onaylayın. Bu, önemli sistemler üzerinde yanlışlıkla işlem yapılmasını önleyebilir.
 categoryDefaultIdentity=Varsayılan kimlik
@@ -1836,10 +1836,11 @@ testingConnection=Test bağlantısı ...
 openManagementConsole=Açık yönetim konsolu
 openLxcTerminal=LXC terminalini açın
 openContainerConsole=Seri konsolu açın
-keeperUseMfa=2FA kimlik doğrulayıcı uygulamasını kullanın
-keeperUseMfaDescription=Keeper hesabınız parolalara erişmek için bir 2FA TOTP gerektiriyorsa bunu etkinleştirin.
+keeper2fa=2FA yöntemi
+keeper2faDescription=Hesabınız için yapılandırılmış olan birincil iki faktörlü kimlik doğrulama yöntemi. Keeper hesabınız parolalara erişmek için iki faktörlü kimlik doğrulama gerektiriyorsa bunu etkinleştirin.
 keeperTotpDuration=Özel 2FA kodu süresi
 keeperTotpDurationDescription=Bir 2FA kodunun ne kadar süreyle geçerli olacağına ilişkin varsayılan süreyi geçersiz kılın. Yalnızca kuruluş politikanız sürenin değiştirilmesine izin veriyorsa geçerlidir.\n\nOlası değerler şunlardır: $VALUES$
+keeperOtherAuth=Diğer (RSA SecurID, Duo Security, Keeper DNA, vb.)
 extractReusableIdentities=Yeniden kullanılabilir kimlikleri ayıklayın
 identitiesAdded=Kimlikler eklendi
 syncMode=Senkronizasyon modu
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=Yerel bir dizinle senkronizasyon yaparken, bu di
 openSpiceSession=SPICE oturumunu açın
 terminalBehaviour=Terminal davranışı
 noScanPossible=Desteklenen bağlantı bulunamadı
-networkSwitchPorts=Ağ anahtarı bağlantı noktaları
-nswitchGroup.displayName=Ağ anahtarı bağlantı noktaları
-nswitchGroup.displayDescription=Bir ağ anahtarı cihazındaki kullanılabilir bağlantı noktalarını listeleme
-nswitchPort.displayName=Ağ anahtarı bağlantı noktası
+networkSwitchPorts=Ağ bağlantı noktaları
+nswitchGroup.displayName=Ağ bağlantı noktaları
+nswitchGroup.displayDescription=Bir ağ cihazındaki kullanılabilir bağlantı noktalarını listeleme
+nswitchPort.displayName=Ağ bağlantı noktası
 nswitchPort.displayDescription=Bir ağ anahtarı cihazındaki tek bir bağlantı noktasını kontrol etme
 enablePort=Bağlantı noktasını etkinleştir
 shutdownPort=Limanı kapatın
@@ -1906,3 +1907,10 @@ showStatus=Durumu göster
 showAllPorts=Tüm bağlantı noktalarını göster
 activeLicense=Lisans
 activeLicenseDescription=XPipe lisans anahtarını etkinleştirme
+authenticatorApp=Authenticator uygulaması
+securityKey=Güvenlik anahtarı
+mcpAdditionalContext=Ek MCP bağlamı
+mcpAdditionalContextDescription=MCP istemcisine iletilecek ek talimatlar. Aracı davranışını kontrol etmek ve bireysel kurulumunuz için ek bağlam sağlamak için bunu kullanın.
+mcpAdditionalContextSample=- Önce onaylamadan hiçbir hizmeti ve daemon'u otomatik olarak yeniden başlatmayın\n- Bir ağ arayüzünü yapılandırırken, ağ geçidi olarak her zaman 192.168.1.1/24 adresini kullanın
+prefsRestartTitle=Yeniden başlatma gerekli
+prefsRestartContent=Değiştirdiğiniz bazı seçeneklerin uygulanması için uygulamanın yeniden başlatılması gerekir. XPipe'ı şimdi yeniden başlatmak istiyor musunuz?
diff --git a/lang/strings/translations_vi.properties b/lang/strings/translations_vi.properties
index 9b809d1a1..7fbe2734d 100644
--- a/lang/strings/translations_vi.properties
+++ b/lang/strings/translations_vi.properties
@@ -1344,7 +1344,7 @@ commandOutput=Kết quả thực thi lệnh
 iconSourceDeletionTitle=Nguồn biểu tượng xóa
 iconSourceDeletionContent=Bạn có muốn xóa nguồn biểu tượng này và tất cả các biểu tượng liên quan đến nó không?
 refreshIcons=Làm mới biểu tượng
-refreshIconsDescription=Tải xuống, hiển thị và lưu vào bộ nhớ đệm tất cả hơn 1000 biểu tượng có sẵn dưới dạng tệp .png. Quá trình này có thể mất một chút thời gian ...
+refreshIconsDescription=Tải xuống, hiển thị và lưu trữ tất cả hơn 1000 biểu tượng có sẵn từ các nguồn bên ngoài dưới dạng tệp .png. Quá trình này có thể mất một chút thời gian ...
 vaultUserLegacy=Người dùng kho lưu trữ (Chế độ tương thích ngược giới hạn)
 upgradeInstructions=Hướng dẫn nâng cấp
 externalActionTitle=Yêu cầu thực hiện hành động bên ngoài
@@ -1406,8 +1406,8 @@ categoryColorDescription=Màu mặc định được sử dụng cho các kết
 categorySync=Đồng bộ hóa với kho lưu trữ Git
 categorySyncDescription=Tự động đồng bộ hóa tất cả kết nối với kho lưu trữ Git. Tất cả thay đổi cục bộ đối với kết nối sẽ được đẩy lên kho lưu trữ từ xa.
 categorySyncSpecial=Đồng bộ hóa với kho lưu trữ Git\n(Không thể cấu hình cho danh mục đặc biệt "$NAME$")
-categoryDontAllowScripts=Tắt các tập lệnh
-categoryDontAllowScriptsDescription=Vô hiệu hóa việc tạo kịch bản trên các hệ thống trong danh mục này để ngăn chặn bất kỳ thay đổi nào đối với hệ thống tệp. Điều này sẽ vô hiệu hóa tất cả các chức năng kịch bản, lệnh môi trường shell, lời nhắc và nhiều tính năng khác.
+categoryDontAllowScripts=Vô hiệu hóa tất cả các thay đổi
+categoryDontAllowScriptsDescription=Vô hiệu hóa việc thực thi lệnh và các thao tác khác trên các hệ thống thuộc danh mục này để ngăn chặn bất kỳ sự thay đổi nào. Điều này sẽ vô hiệu hóa toàn bộ chức năng kịch bản, lệnh môi trường shell, lời nhắc và nhiều tính năng khác.
 categoryConfirmAllModifications=Xác nhận tất cả các thay đổi
 categoryConfirmAllModificationsDescription=Xác nhận bất kỳ thay đổi nào đối với kết nối hoặc hệ thống tệp trước khi thực hiện. Điều này có thể ngăn chặn các thao tác vô ý trên các hệ thống quan trọng.
 categoryDefaultIdentity=Danh tính mặc định
@@ -1836,10 +1836,11 @@ testingConnection=Kiểm tra kết nối ...
 openManagementConsole=Mở bảng điều khiển quản lý
 openLxcTerminal=Mở cửa sổ terminal LXC
 openContainerConsole=Mở giao diện điều khiển serial
-keeperUseMfa=Sử dụng ứng dụng xác thực hai yếu tố (2FA)
-keeperUseMfaDescription=Bật tùy chọn này nếu tài khoản Keeper của cậu yêu cầu xác thực hai yếu tố (2FA) bằng mã TOTP để truy cập mật khẩu.
+keeper2fa=phương pháp xác thực hai yếu tố (2FA)
+keeper2faDescription=Phương thức xác thực hai yếu tố chính được cấu hình cho tài khoản của cậu. Bật tính năng này nếu tài khoản Keeper của cậu yêu cầu xác thực hai yếu tố để truy cập mật khẩu.
 keeperTotpDuration=Thời gian hiệu lực của mã 2FA tùy chỉnh
 keeperTotpDurationDescription=Thay đổi thời gian mặc định mà mã xác thực hai yếu tố (2FA) có hiệu lực. Tính năng này chỉ áp dụng nếu chính sách của tổ chức cho phép thay đổi thời gian.\n\nCác giá trị có thể là: $VALUES$
+keeperOtherAuth=Khác (RSA SecurID, Duo Security, Keeper DNA, v.v.)
 extractReusableIdentities=Trích xuất các danh tính có thể tái sử dụng
 identitiesAdded=Thêm danh tính
 syncMode=Chế độ đồng bộ hóa
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=Khi đồng bộ hóa với một thư mục c
 openSpiceSession=Mở phiên làm việc SPICE
 terminalBehaviour=Hành vi của thiết bị đầu cuối
 noScanPossible=Không tìm thấy kết nối nào được hỗ trợ
-networkSwitchPorts=Cổng chuyển mạch mạng
-nswitchGroup.displayName=Cổng chuyển mạch mạng
-nswitchGroup.displayDescription=Danh sách các cổng có sẵn trên thiết bị chuyển mạch mạng
-nswitchPort.displayName=Cổng chuyển mạch mạng
+networkSwitchPorts=Cổng mạng
+nswitchGroup.displayName=Cổng mạng
+nswitchGroup.displayDescription=Danh sách các cổng có sẵn trên thiết bị mạng
+nswitchPort.displayName=Cổng mạng
 nswitchPort.displayDescription=Kiểm soát một cổng riêng lẻ trên thiết bị chuyển mạch mạng
 enablePort=Kích hoạt cổng
 shutdownPort=Tắt cổng
@@ -1906,3 +1907,10 @@ showStatus=Hiển thị trạng thái
 showAllPorts=Hiển thị tất cả các cổng
 activeLicense=Giấy phép
 activeLicenseDescription=Kích hoạt khóa cấp phép XPipe
+authenticatorApp=Ứng dụng xác thực
+securityKey=Khóa bảo mật
+mcpAdditionalContext=Bối cảnh bổ sung của MCP
+mcpAdditionalContextDescription=Hướng dẫn bổ sung để truyền cho khách hàng MCP. Sử dụng điều này để kiểm soát hành vi của đại lý và cung cấp bối cảnh bổ sung cho cấu hình cá nhân của cậu.
+mcpAdditionalContextSample=- Không tự động khởi động lại bất kỳ dịch vụ hoặc daemon nào mà không xác nhận trước\n- Khi cấu hình giao diện mạng, luôn sử dụng 192.168.1.1/24 làm cổng mặc định
+prefsRestartTitle=Cần khởi động lại
+prefsRestartContent=Một số tùy chọn cậu đã thay đổi yêu cầu khởi động lại ứng dụng để áp dụng. Cậu có muốn khởi động lại XPipe ngay bây giờ không?
diff --git a/lang/strings/translations_zh-Hans.properties b/lang/strings/translations_zh-Hans.properties
index 46dfa5e9e..36da98e0d 100644
--- a/lang/strings/translations_zh-Hans.properties
+++ b/lang/strings/translations_zh-Hans.properties
@@ -1851,7 +1851,7 @@ commandOutput=命令输出
 iconSourceDeletionTitle=删除图标源
 iconSourceDeletionContent=您想删除此图标源及其所有相关图标吗？
 refreshIcons=刷新图标
-refreshIconsDescription=将所有可用的 1000 多个图标检索、渲染并缓存为 .png 文件。这可能需要一段时间...
+refreshIconsDescription=从外部资源检索、渲染和缓存所有可用的 1000 多个图标到 .png 文件。这可能需要一段时间...
 #custom
 vaultUserLegacy=Vault 用户（有限旧版兼容模式）
 upgradeInstructions=升级说明
@@ -1942,7 +1942,7 @@ categorySync=与 Git 仓库同步
 #custom
 categorySyncDescription=自动将该类别下的所有连接与 Git 仓库同步。本地更改会在保存时推送到远程。
 categorySyncSpecial=与 git 仓库同步\n(特殊类别 "$NAME$" 无法配置）
-categoryDontAllowScripts=禁用脚本
+categoryDontAllowScripts=禁用所有修改
 #custom
 categoryDontAllowScriptsDescription=禁止在此类别内的系统上创建脚本，以避免任何文件系统修改。此操作将禁用全部脚本功能、Shell 环境命令、提示符等。
 categoryConfirmAllModifications=确认所有修改
@@ -2461,10 +2461,11 @@ testingConnection=测试连接...
 openManagementConsole=开放式管理控制台
 openLxcTerminal=打开 LXC 终端
 openContainerConsole=打开串行控制台
-keeperUseMfa=使用 2FA 验证器应用程序
-keeperUseMfaDescription=如果 Keeper 帐户要求使用 2FA TOTP 访问密码，请启用此选项。
+keeper2fa=2FA 方法
+keeper2faDescription=为您的账户配置的主要双因素身份验证方法。如果您的 Keeper 帐户需要双因素身份验证才能访问密码，请启用此选项。
 keeperTotpDuration=自定义 2FA 代码持续时间
 keeperTotpDurationDescription=覆盖 2FA 验证码有效期的默认持续时间。仅适用于组织政策允许更改持续时间的情况。\n\n可能的值有$VALUES$
+keeperOtherAuth=其他（RSA SecurID、Duo Security、Keeper DNA 等）
 extractReusableIdentities=提取可重复使用的身份
 identitiesAdded=添加的身份信息
 syncMode=同步模式
@@ -2516,10 +2517,10 @@ syncToPlainDirectoryDescription=同步到本地目录时，可以把该目录当
 openSpiceSession=打开 SPICE 会话
 terminalBehaviour=终端行为
 noScanPossible=未找到支持的连接
-networkSwitchPorts=网络交换机端口
-nswitchGroup.displayName=网络交换机端口
-nswitchGroup.displayDescription=列出网络交换设备上的可用端口
-nswitchPort.displayName=网络交换端口
+networkSwitchPorts=网络端口
+nswitchGroup.displayName=网络端口
+nswitchGroup.displayDescription=列出网络设备上的可用端口
+nswitchPort.displayName=网络端口
 nswitchPort.displayDescription=控制网络交换设备上的单个端口
 enablePort=启用端口
 shutdownPort=关闭端口
@@ -2531,3 +2532,10 @@ showStatus=显示状态
 showAllPorts=显示所有端口
 activeLicense=许可证
 activeLicenseDescription=激活 XPipe 许可证密钥
+authenticatorApp=验证器应用程序
+securityKey=安全密钥
+mcpAdditionalContext=其他 MCP 上下文
+mcpAdditionalContextDescription=传递给 MCP 客户端的附加指令。用它来控制代理行为，并为您的个性化设置提供额外的上下文。
+mcpAdditionalContextSample=- 未经确认，请勿自动重启任何服务和守护进程\n- 配置网络接口时，始终使用 192.168.1.1/24 作为网关
+prefsRestartTitle=需要重新启动
+prefsRestartContent=您更改的某些选项需要重新启动应用程序才能应用。您现在要重新启动 XPipe 吗？
diff --git a/lang/strings/translations_zh-Hant.properties b/lang/strings/translations_zh-Hant.properties
index 3522269ba..440988acd 100644
--- a/lang/strings/translations_zh-Hant.properties
+++ b/lang/strings/translations_zh-Hant.properties
@@ -1344,7 +1344,7 @@ commandOutput=指令輸出
 iconSourceDeletionTitle=刪除圖示來源
 iconSourceDeletionContent=您要刪除此圖示來源及其所有相關圖示嗎？
 refreshIcons=刷新圖示
-refreshIconsDescription=將所有可用的 1000 多個圖示擷取、渲染並快取為 .png 檔案。這可能需要一段時間 ...
+refreshIconsDescription=從外部來源擷取、渲染和快取所有可用的 1000 多個圖示為 .png 檔案。這可能需要一段時間 ...
 vaultUserLegacy=保險庫使用者 (有限的傳統相容性模式)
 upgradeInstructions=升級說明
 externalActionTitle=外部動作請求
@@ -1406,8 +1406,8 @@ categoryColorDescription=此類別內連線使用的預設顏色
 categorySync=與 git 倉庫同步
 categorySyncDescription=自動將所有連線與 git 套件庫同步。所有本地連線的變更都會推送到遠端。
 categorySyncSpecial=與 git 儲存庫同步\n(特殊類別 "$NAME$" 不可設定)
-categoryDontAllowScripts=停用腳本
-categoryDontAllowScriptsDescription=在此類別的系統上停用指令碼建立功能，以防止任何檔案系統修改。這將停用所有指令碼功能、shell 環境指令、提示等。
+categoryDontAllowScripts=停用所有修改
+categoryDontAllowScriptsDescription=停用此類別內系統的任何指令執行和其他操作，以防止任何修改。這將停用所有指令碼功能、shell 環境指令、提示等。
 categoryConfirmAllModifications=確認所有修改
 categoryConfirmAllModificationsDescription=先確認對連線或檔案系統進行的任何類型的修改。這樣可以防止對重要系統進行意外操作。
 categoryDefaultIdentity=預設身分
@@ -1836,10 +1836,11 @@ testingConnection=測試連接 ...
 openManagementConsole=開放式管理主控台
 openLxcTerminal=開啟 LXC 終端機
 openContainerConsole=開啟序列控制台
-keeperUseMfa=使用 2FA 認證器應用程式
-keeperUseMfaDescription=如果您的 Keeper 帳戶需要 2FA TOTP 才能存取密碼，請啟用此項。
+keeper2fa=2FA 方法
+keeper2faDescription=為您帳戶設定的主要雙因素驗證方法。如果您的 Keeper 帳戶需要雙因素認證才能存取密碼，請啟用此項。
 keeperTotpDuration=自訂 2FA 碼持續時間
 keeperTotpDurationDescription=覆寫 2FA 密碼有效期的預設持續時間。僅適用於組織政策允許變更持續時間的情況。\n\n可能的值有$VALUES$
+keeperOtherAuth=其他 (RSA SecurID、Duo Security、Keeper DNA 等)
 extractReusableIdentities=擷取可重複使用的身分
 identitiesAdded=新增的身分
 syncMode=同步模式
@@ -1891,10 +1892,10 @@ syncToPlainDirectoryDescription=同步到本地目錄時，您可以將這個目
 openSpiceSession=開啟 SPICE 會話
 terminalBehaviour=終端行為
 noScanPossible=未找到支援的連線
-networkSwitchPorts=網路交換器連接埠
-nswitchGroup.displayName=網路交換器連接埠
-nswitchGroup.displayDescription=列出網路交換器裝置上的可用連接埠
-nswitchPort.displayName=網路交換器連接埠
+networkSwitchPorts=網路連接埠
+nswitchGroup.displayName=網路連接埠
+nswitchGroup.displayDescription=列出網路設備上的可用連接埠
+nswitchPort.displayName=網路連接埠
 nswitchPort.displayDescription=控制網路交換器裝置上的個別連接埠
 enablePort=啟用連接埠
 shutdownPort=關閉連接埠
@@ -1906,3 +1907,10 @@ showStatus=顯示狀態
 showAllPorts=顯示所有連接埠
 activeLicense=許可證
 activeLicenseDescription=啟動 XPipe 授權金鑰
+authenticatorApp=驗證器應用程式
+securityKey=安全金鑰
+mcpAdditionalContext=其他 MCP 上下文
+mcpAdditionalContextDescription=傳送給 MCP 用戶端的附加指示。使用此項可控制代理程式的行為，並為您的個別設定提供額外的上下文。
+mcpAdditionalContextSample=- 在未確認之前，請勿自動重新啟動任何服務和 daemons\n- 設定網路介面時，請務必使用 192.168.1.1/24 作為閘道
+prefsRestartTitle=需要重新啟動
+prefsRestartContent=您變更的某些選項需要重新啟動應用程式才能套用。您現在要重新啟動XPipe嗎？
diff --git a/version b/version
index 27040fe00..88d82da00 100644
--- a/version
+++ b/version
@@ -1 +1 @@
-21.3-3
+21.4-10