Merge branch 'main' into claude/vault-unlock-logout-autosync-a84c35

Four files needed a hand, and all four were two branches adding something in
the same place rather than either changing what the other did.

The shell's constructor now takes both new parameters: main's SFTP session
factory, which it must have because it builds the transfers view model, and
this branch's optional resume handler, which stays last so every existing test
that constructs a shell without one still gets a shell that can only be online
because somebody signed in during this run. App.axaml.cs, ShellFlowTests and
QuickConnectTests pass the pair; the layout suite keeps both of its new fields.

Signing out now detaches the transfers screen exactly as locking does, and the
confirmation says that an open transfer session survives it. That is the same
policy both sides already argue for their own case: signing out destroys this
machine's copy of the vault, not work that authenticated before it.

QuickConnectTests did not compile on main — the SFTP commit added a constructor
parameter and the quick-connect suite, merged from a parallel branch just
before it, was still calling the old one. Fixed here rather than worked around,
since the merged tree has to build.

dotnet build, dotnet test and dotnet format --verify-no-changes are all clean:
980 tests, including the end-to-end suite against real containers.

tests/DodoSSH.Client.App.Layout.Tests/QuickConnectTests.cs

@@ -0,0 +1,301 @@
+using Avalonia;
+using Avalonia.Controls;
+using Avalonia.Headless;
+using Avalonia.Input;
+using Avalonia.Threading;
+using Avalonia.VisualTree;
+using DodoSSH.Client.App.ViewModels;
+using DodoSSH.Client.App.Views;
+using DodoSSH.Client.Session;
+using DodoSSH.Client.Session.Tests;
+using DodoSSH.Client.Ssh;
+using DodoSSH.Client.Storage;
+using DodoSSH.Client.Terminal;
+using DodoSSH.Crypto;
+using NSubstitute;
+
+namespace DodoSSH.Client.App.Layout.Tests;
+
+/// <summary>
+/// How the quick-connect palette answers a keyboard and a pointer.
+/// </summary>
+/// <remarks>
+/// <para>
+/// This is the suite the palette shipped without, and the reason it shipped without one is that all of this
+/// used to live on <c>MainWindow</c> — which cannot be shown here at all, because attaching the terminal's
+/// WebView initialises WebView2 on a thread it refuses. See
+/// <see cref="LayoutHarnessTests.WhyTheWindowItselfIsNeverShown"/>. A <c>UserControl</c> hosts in a bare
+/// window, takes real key and pointer input, and can therefore be held to what it promises.
+/// </para>
+/// <para>
+/// Three things were wrong and each has a test here: nothing answered a press outside the palette, so the one
+/// gesture everybody tries first did nothing; the caret never reached the query box, because the window
+/// focused it from the view model's <c>PropertyChanged</c> — ahead of the binding that reveals the control,
+/// and focus on a collapsed control is a no-op; and the keys were answered only by a handler on the window,
+/// which anything on the route could have taken first.
+/// </para>
+/// <para>
+/// A real <see cref="MainWindowViewModel"/> over a real unlocked vault, for the same reason the layout suite
+/// uses one: compiled bindings resolve against the declared type, and the palette's list is populated by the
+/// vault's own hosts. Nothing here reaches a network — the connect the Enter test performs fails inside the
+/// vault's own error handling, which is fine, because what Enter promises is to take the highlighted result
+/// and close.
+/// </para>
+/// </remarks>
+public sealed class QuickConnectTests : IAsyncLifetime
+{
+    private const string Passphrase = "a sufficiently long passphrase";
+    private const string ServerUrl = "https://dodossh.example";
+
+    /// <remarks>Far below the shipped profile: nothing here attacks a wrap.</remarks>
+    private static readonly Argon2Profile CheapProfile =
+        Argon2Profile.FromStoredParameters(memoryKibibytes: 8 * 1024, passes: 1, parallelism: 1);
+
+    private readonly FakeAccountServer server = new();
+    private readonly StubKeyBinding keyBinding = new();
+    private readonly VaultKnownHostStore knownHosts = new();
+
+    private ClientCacheFactory caches = null!;
+    private TerminalWorkspace workspace = null!;
+    private VaultSession session = null!;
+    private VaultViewModel vault = null!;
+    private MainWindowViewModel shell = null!;
+
+    private static CancellationToken Token => TestContext.Current.CancellationToken;
+
+    /// <inheritdoc />
+    public async ValueTask InitializeAsync()
+    {
+        caches = ClientCacheFactory.ForMemory($"palette-{Guid.CreateVersion7():N}");
+        await caches.MigrateAsync(Token);
+
+        await new AccountProvisioner(server, keyBinding, caches, TimeProvider.System, CheapProfile)
+            .EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
+
+        var outcome = await new SessionOpener(caches, TimeProvider.System).UnlockAsync(Passphrase, Token);
+        outcome.IsUnlocked.ShouldBeTrue(outcome.Message);
+        session = outcome.Session!;
+
+        workspace = new TerminalWorkspace(
+            new InMemoryTerminalAssetProvider(new Dictionary<string, TerminalAsset>(StringComparer.Ordinal)),
+            Substitute.For<ISshConnectionFactory>(),
+            TimeProvider.System);
+
+        await knownHosts.OpenAsync(session, Token);
+
+        vault = new VaultViewModel(session, workspace, knownHosts, static () => null);
+
+        await SeedAsync();
+
+        shell = new MainWindowViewModel(
+            ClientPaths.Default,
+            caches,
+            workspace,
+            knownHosts,
+            Substitute.For<IDeviceKeyStore>(),
+            (_, _) => throw new NotSupportedException("nothing here signs in"),
+            TimeProvider.System,
+            // Never asked for a session: the palette searches the host list and connects through the
+            // vault's own command, and nothing on this screen transfers a file.
+            Substitute.For<ISftpSessionFactory>(),
+            CheapProfile)
+        {
+            // The state the palette is only ever open in. Assigned rather than reached through the unlock
+            // path, which would be a second enrollment and a second Argon2 pass for no extra coverage.
+            State = ShellState.Unlocked,
+            Vault = vault,
+        };
+    }
+
+    /// <inheritdoc />
+    public async ValueTask DisposeAsync()
+    {
+        await shell.DisposeAsync();
+        knownHosts.Close();
+        await workspace.DisposeAsync();
+        await session.DisposeAsync();
+        caches.Dispose();
+    }
+
+    /// <remarks>
+    /// The gesture everybody tries first, and the one that did nothing at all: the wash took no pointer input,
+    /// so the only ways out of the palette were a key and the button that opened it.
+    /// </remarks>
+    [Fact]
+    public async Task APressOnTheWashClosesThePalette()
+    {
+        await OnThePaletteAsync((_, window) =>
+        {
+            // The bottom-left corner: the card is 520 wide, centred, and starts 90 pixels down, so nothing
+            // here belongs to it.
+            window.MouseDown(new Point(12, 520), MouseButton.Left);
+
+            shell.IsSearching.ShouldBeFalse();
+        });
+    }
+
+    /// <remarks>
+    /// The other half of the same rule, and the one that makes it worth a handler rather than a press anywhere
+    /// closing: a press on the card bubbles through the wash on its way out, so a handler that did not check
+    /// where the press started would close the palette the moment somebody clicked into the box.
+    /// </remarks>
+    [Fact]
+    public async Task APressOnTheCardDoesNotClose()
+    {
+        await OnThePaletteAsync((palette, window) =>
+        {
+            window.MouseDown(Centre(palette.QueryBox, window), MouseButton.Left);
+
+            shell.IsSearching.ShouldBeTrue();
+        });
+    }
+
+    [Fact]
+    public async Task EscapeClosesThePalette()
+    {
+        await OnThePaletteAsync((palette, window) =>
+        {
+            palette.QueryBox.Focus().ShouldBeTrue();
+
+            window.KeyPressQwerty(PhysicalKey.Escape, RawInputModifiers.None);
+
+            shell.IsSearching.ShouldBeFalse();
+        });
+    }
+
+    /// <remarks>
+    /// The second assertion is the whole reason the selection is moved by hand rather than by letting the list
+    /// take focus: a palette whose arrow keys moved the caret out of the query box would stop receiving the
+    /// next character typed.
+    /// </remarks>
+    [Fact]
+    public async Task TheArrowsMoveTheSelectionAndLeaveTheKeyboardInTheBox()
+    {
+        await OnThePaletteAsync((palette, window) =>
+        {
+            palette.QueryBox.Focus().ShouldBeTrue();
+
+            shell.SearchResults.Count.ShouldBeGreaterThan(2, "an empty list would prove nothing");
+            shell.SelectedSearchResult.ShouldBe(shell.SearchResults[0]);
+
+            window.KeyPressQwerty(PhysicalKey.ArrowDown, RawInputModifiers.None);
+            shell.SelectedSearchResult.ShouldBe(shell.SearchResults[1]);
+
+            window.KeyPressQwerty(PhysicalKey.ArrowUp, RawInputModifiers.None);
+            shell.SelectedSearchResult.ShouldBe(shell.SearchResults[0]);
+
+            // Clamped rather than wrapped, which is the palette's own rule.
+            window.KeyPressQwerty(PhysicalKey.ArrowUp, RawInputModifiers.None);
+            shell.SelectedSearchResult.ShouldBe(shell.SearchResults[0]);
+
+            palette.QueryBox.IsFocused.ShouldBeTrue("the arrows must not move the caret out of the box");
+        });
+    }
+
+    /// <remarks>
+    /// What Enter promises is to take the highlighted row: the palette closes and the vault is pointed at that
+    /// host. The connection it then asks for fails in this suite — there is no server and no shell — and it
+    /// fails inside the vault's own handling, which is the point of connecting through the vault's command
+    /// rather than opening a session from the palette.
+    /// </remarks>
+    [Fact]
+    public async Task EnterTakesTheHighlightedResult()
+    {
+        await OnThePaletteAsync((palette, window) =>
+        {
+            palette.QueryBox.Focus().ShouldBeTrue();
+
+            window.KeyPressQwerty(PhysicalKey.ArrowDown, RawInputModifiers.None);
+            var highlighted = shell.SelectedSearchResult.ShouldNotBeNull();
+
+            window.KeyPressQwerty(PhysicalKey.Enter, RawInputModifiers.None);
+
+            shell.IsSearching.ShouldBeFalse();
+            vault.SelectedHost?.EntityId.ShouldBe(highlighted.EntityId);
+        });
+    }
+
+    /// <remarks>
+    /// The palette is a box somebody is expected to start typing into, and for a while it was not: the window
+    /// focused it from the view model's <c>PropertyChanged</c>, which runs before the binding that reveals the
+    /// control, and <c>Focus()</c> on a collapsed control is a no-op that is never replayed. Becoming visible
+    /// is the moment that cannot be too early, so that is where the palette takes the keyboard — and this is
+    /// the test that says so.
+    /// </remarks>
+    [Fact]
+    public async Task ThePaletteTakesTheKeyboardWhenItAppears()
+    {
+        await LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var elsewhere = new TextBox();
+                var palette = new QuickConnect { DataContext = shell, IsVisible = false };
+
+                var window = new Window { Content = new Panel { Children = { elsewhere, palette } } };
+                LayoutHarness.Settle(window, 900, 600);
+
+                try
+                {
+                    elsewhere.Focus().ShouldBeTrue();
+
+                    shell.ToggleSearchCommand.Execute(null);
+                    palette.IsVisible = true;
+
+                    // The layout pass the application's dispatcher would run anyway. Without it the query box
+                    // is not in the visual tree yet, which is the whole reason the palette defers this.
+                    Dispatcher.UIThread.RunJobs();
+
+                    palette.QueryBox.IsFocused.ShouldBeTrue();
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+    }
+
+    // ---- Helpers ----
+
+    /// <summary>Opens the palette in a window the size the application's is, and runs one body against it.</summary>
+    private Task OnThePaletteAsync(Action<QuickConnect, Window> body) =>
+        LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                shell.ToggleSearchCommand.Execute(null);
+                shell.IsSearching.ShouldBeTrue("every case here starts with the palette open");
+
+                var palette = new QuickConnect { DataContext = shell };
+                var window = new Window { Content = palette };
+                LayoutHarness.Settle(window, 900, 600);
+
+                try
+                {
+                    body(palette, window);
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+
+    private static Point Centre(Visual control, Visual window) =>
+        control.TranslatePoint(new Point(control.Bounds.Width / 2, control.Bounds.Height / 2), window)
+        ?? throw new InvalidOperationException("the control is not in this window's tree");
+
+    /// <remarks>Enough hosts that the arrow keys have somewhere to go.</remarks>
+    private async Task SeedAsync()
+    {
+        for (var i = 0; i < 6; i++)
+        {
+            vault.NewHostCommand.Execute(null);
+            vault.EditorLabel = $"host-{i}";
+            vault.EditorHostname = $"host-{i}.internal";
+            vault.EditorUsername = "deploy";
+            await vault.SaveHostCommand.ExecuteAsync(null);
+        }
+
+        await vault.LoadAsync(Token);
+    }
+}

tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs

@@ -8,6 +8,7 @@ using DodoSSH.Client.Session.Tests;
 using DodoSSH.Client.Ssh;
 using DodoSSH.Client.Storage;
 using DodoSSH.Client.Terminal;
+using DodoSSH.Client.Transfer;
 using DodoSSH.Crypto;
 using NSubstitute;
 
@@ -62,6 +63,14 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
     /// </remarks>
     private MainWindowViewModel shell = null!;
 
+    /// <remarks>
+    /// Over a substitute factory that is never asked for a session. Every shape measured here is one the
+    /// screen is in before a connection exists or after one has failed, which is deliberate: the two panes
+    /// are at their widest with the local one full and the remote one carrying its explanation, and a
+    /// connected pane is the same template with shorter names in it.
+    /// </remarks>
+    private TransfersViewModel transfers = null!;
+
     private static CancellationToken Token => TestContext.Current.CancellationToken;
 
     /// <inheritdoc />
@@ -98,15 +107,24 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
             new UnavailableDeviceKeyStore(),
             static (_, _) => throw new InvalidOperationException("A layout test has no network."),
             TimeProvider.System,
+            Substitute.For<ISftpSessionFactory>(),
             CheapProfile);
 
+        transfers = new TransfersViewModel(
+            Substitute.For<ISftpSessionFactory>(), TimeProvider.System);
+
         await SeedAsync();
+
+        // Attached after seeding, so the host picker has something in it and the local pane has listed this
+        // machine's home directory — which is what puts real names of real length into the row template.
+        transfers.Attach(vault, knownHosts);
     }
 
     /// <inheritdoc />
     public async ValueTask DisposeAsync()
     {
         await shell.DisposeAsync();
+        await transfers.DisposeAsync();
         await vault.DisposeAsync();
         knownHosts.Close();
         await workspace.DisposeAsync();
@@ -290,6 +308,73 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
         });
     }
 
+    // ---- The transfers screen ----
+
+    /// <remarks>
+    /// <para>
+    /// The widest thing in this window and the one with the least room to give: two file listings side by
+    /// side, each with four columns, and a queue underneath — all inside 826 pixels once the nav rail has
+    /// taken its column. The header row is the tight part, because it holds a host picker, a password box,
+    /// a button and a chip on one line.
+    /// </para>
+    /// <para>
+    /// Measured disconnected, which is the state the screen opens in and the one where the local pane is at
+    /// its fullest: it lists this machine's home directory, so the row template is exercised with real names
+    /// of real length rather than with fixtures chosen to fit.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task TheTransfersScreenFitsBeforeAnythingIsConnected()
+    {
+        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
+    }
+
+    /// <remarks>
+    /// <para>
+    /// The queue is the half of this screen that only exists once something has been asked for, so a shape
+    /// nothing puts a row into is a shape never laid out. Three rows, because the row template changes with
+    /// the state: a running one shows a bar and a STOP, a stopped one shows RESUME and DISCARD, and a failed
+    /// one carries the server's own sentence in the column the other two put a byte count in.
+    /// </para>
+    /// <para>
+    /// The rows are placed directly rather than driven through the queue. What is being measured is the
+    /// template at each state, and running a real transfer to reach those states would put a thread-pool
+    /// hand-off and a filesystem in the middle of a test about rectangles. What the queue does is measured in
+    /// <c>DodoSSH.Client.Transfer.Tests</c>.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task TheTransfersScreenFitsWithTransfersInTheQueue()
+    {
+        Enqueue(TransferDirection.Download, "artefact.tar.gz", 402_653_184, 149_000_000,
+            TransferState.Running, bytesPerSecond: 6_500_000);
+
+        Enqueue(TransferDirection.Upload, "site-backup-2026-07-30.sql.gz", 8_100_000_000, 3_200_000_000,
+            TransferState.Cancelled);
+
+        Enqueue(TransferDirection.Upload, "deploy.sh", 4_096, 0, TransferState.Failed,
+            failure: "deploy.sh is already in that directory on the host. Rename or remove it first — "
+                + "nothing here overwrites a file that is already there.");
+
+        transfers.Transfers.Count.ShouldBe(3);
+
+        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
+    }
+
+    /// <remarks>
+    /// The trust card covers the whole screen, and it is the one thing here a user cannot get past without
+    /// pressing something — so a button of its own that fell outside the window would leave the screen
+    /// permanently blocked.
+    /// </remarks>
+    [Fact]
+    public async Task TheTransfersScreenFitsWithTheHostKeyCardShowing()
+    {
+        transfers.PendingHostKey = new HostKeyPresentation(
+            "db.internal", 22, "ssh-ed25519", "SHA256:0123456789abcdefghijklmnopqrstuvwxyzABCDEFG");
+
+        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
+    }
+
     // ---- The chrome ----
 
     /// <remarks>
@@ -460,8 +545,10 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
     public async Task TheSignOutCardFitsTheCardItIsShownIn()
     {
         // Its tallest shape: a shell left running adds a disclosure box that an ordinary sign-out does not
-        // have, and a locked vault carries the longer of the two warnings.
+        // have, an open transfer session adds a line beneath it, and a locked vault carries the longer of
+        // the two warnings.
         shell.LiveSessionCount = 1;
+        shell.Transfers.IsConnected = true;
 
         await MeasureCardAsync(new SignOutCard());
     }
@@ -513,6 +600,48 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
             },
             Token);
 
+    /// <summary>Lays the transfers screen out at the width it gets beside the nav rail.</summary>
+    private Task MeasureTransfersAsync(Action<IReadOnlyList<string>> assert) =>
+        LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var screen = new TransfersScreen { DataContext = transfers };
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    screen, LayoutHarness.ScreenWidth, LayoutHarness.ScreenHeight);
+
+                try
+                {
+                    assert(LayoutHarness.Unreachable(window));
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+
+    /// <summary>Puts one transfer on the queue in a given state, without moving a byte.</summary>
+    private void Enqueue(
+        TransferDirection direction,
+        string name,
+        long length,
+        long transferred,
+        TransferState state,
+        double bytesPerSecond = 0,
+        string? failure = null) =>
+        transfers.Transfers.Add(new TransferRowViewModel(new TransferSnapshot(
+            Guid.CreateVersion7(),
+            direction,
+            name,
+            Path.Combine(Path.GetTempPath(), name),
+            SftpPath.Combine("/srv/releases", name),
+            length,
+            transferred,
+            state,
+            bytesPerSecond,
+            failure)));
+
     /// <summary>Lays the vault screen out at the width it gets once the nav rail has taken its column.</summary>
     private Task MeasureVaultAsync(Action<IReadOnlyList<string>> assert) =>
         OnTheVaultAsync((_, window) => assert(LayoutHarness.Unreachable(window)));

tests/DodoSSH.Client.App.Layout.Tests/packages.lock.json

@@ -487,7 +487,8 @@
           "CommunityToolkit.Mvvm": "[8.4.2, )",
           "DodoSSH.Client.Session": "[1.0.0, )",
           "DodoSSH.Client.Ssh": "[1.0.0, )",
-          "DodoSSH.Client.Terminal": "[1.0.0, )"
+          "DodoSSH.Client.Terminal": "[1.0.0, )",
+          "DodoSSH.Client.Transfer": "[1.0.0, )"
         }
       },
       "dodossh.client.auth": {
@@ -538,6 +539,12 @@
           "DodoSSH.Client.Ssh": "[1.0.0, )"
         }
       },
+      "dodossh.client.transfer": {
+        "type": "Project",
+        "dependencies": {
+          "DodoSSH.Client.Ssh": "[1.0.0, )"
+        }
+      },
       "dodossh.contracts": {
         "type": "Project"
       },