From de5aa0a35d21420f5e53cd107f75a16540048376 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Tue, 21 Jul 2026 22:46:41 +0530
Subject: [PATCH 01/39] feat(api-client): git-friendly folder-backed
 collections
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Open a folder as a collection: requests stored as YAML files
(NNN- prefix = order, dirs = folders, collection.yaml manifest),
so collections can be committed, diffed and PR-reviewed. Filesystem
is the store — mutations diff the serialized tree and write only
changed files; window focus re-reads external edits. Secrets stay
out of files ({{vault.*}} tokens pass through; environments never
serialized). Desktop only: tauri fs/dialog/persisted-scope plugins
plus a recursive fs-scope grant command for picked dirs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/desktop-ui/messages/af.json              |   2 +
 apps/desktop-ui/messages/ar.json              |   2 +
 apps/desktop-ui/messages/ca.json              |   2 +
 apps/desktop-ui/messages/cs.json              |   2 +
 apps/desktop-ui/messages/da.json              |   2 +
 apps/desktop-ui/messages/de.json              |   2 +
 apps/desktop-ui/messages/el.json              |   2 +
 apps/desktop-ui/messages/en.json              |   2 +
 apps/desktop-ui/messages/es.json              |   2 +
 apps/desktop-ui/messages/fa.json              |   2 +
 apps/desktop-ui/messages/fr.json              |   2 +
 apps/desktop-ui/messages/id.json              |   2 +
 apps/desktop-ui/messages/it.json              |   2 +
 apps/desktop-ui/messages/ja.json              |   2 +
 apps/desktop-ui/messages/ko.json              |   2 +
 apps/desktop-ui/messages/ms.json              |   2 +
 apps/desktop-ui/messages/nb.json              |   2 +
 apps/desktop-ui/messages/nl.json              |   2 +
 apps/desktop-ui/messages/pl.json              |   2 +
 apps/desktop-ui/messages/pt-BR.json           |   2 +
 apps/desktop-ui/messages/pt.json              |   2 +
 apps/desktop-ui/messages/ru.json              |   2 +
 apps/desktop-ui/messages/sv.json              |   2 +
 apps/desktop-ui/messages/tr.json              |   2 +
 apps/desktop-ui/messages/uk.json              |   2 +
 apps/desktop-ui/messages/vi.json              |   2 +
 apps/desktop-ui/messages/zh.json              |   2 +
 apps/desktop-ui/package.json                  |   2 +
 .../collections/collections-sidebar.tsx       |  24 +-
 .../api-client/collections/use-collections.ts | 276 +++++++++++-
 .../context/collections-context.tsx           |   6 +-
 .../src/components/api-client/types.ts        |   3 +
 .../api-client/__tests__/file-store.test.ts   | 185 ++++++++
 .../src/lib/api-client/file-store.ts          | 405 ++++++++++++++++++
 .../src/lib/desktop/collection-files.ts       |  88 ++++
 apps/desktop/src-tauri/Cargo.lock             |  94 ++++
 apps/desktop/src-tauri/Cargo.toml             |   3 +
 .../src-tauri/capabilities/default.json       |  17 +-
 apps/desktop/src-tauri/src/lib.rs             |  17 +
 39 files changed, 1150 insertions(+), 24 deletions(-)
 create mode 100644 apps/desktop-ui/src/lib/api-client/__tests__/file-store.test.ts
 create mode 100644 apps/desktop-ui/src/lib/api-client/file-store.ts
 create mode 100644 apps/desktop-ui/src/lib/desktop/collection-files.ts

diff --git a/apps/desktop-ui/messages/af.json b/apps/desktop-ui/messages/af.json
index 4973c624..7c361478 100644
--- a/apps/desktop-ui/messages/af.json
+++ b/apps/desktop-ui/messages/af.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "API-hulpbronne",
       "newCollection": "Nuwe versameling",
+      "openFolderCollection": "Maak vouer oop as versameling",
+      "folderCollection": "Vouerversameling",
       "tabCollections": "Versamelings",
       "tabHistory": "Geskiedenis",
       "noCollectionsTitle": "Geen versamelings",
diff --git a/apps/desktop-ui/messages/ar.json b/apps/desktop-ui/messages/ar.json
index 0d61ee09..dbd633ef 100644
--- a/apps/desktop-ui/messages/ar.json
+++ b/apps/desktop-ui/messages/ar.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "موارد API",
       "newCollection": "مجموعة جديدة",
+      "openFolderCollection": "فتح مجلد كمجموعة",
+      "folderCollection": "مجموعة مجلد",
       "tabCollections": "المجموعات",
       "tabHistory": "السجل",
       "noCollectionsTitle": "لا مجموعات",
diff --git a/apps/desktop-ui/messages/ca.json b/apps/desktop-ui/messages/ca.json
index 8db95bdf..6b316f56 100644
--- a/apps/desktop-ui/messages/ca.json
+++ b/apps/desktop-ui/messages/ca.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "Recursos API",
       "newCollection": "Col·lecció nova",
+      "openFolderCollection": "Obre una carpeta com a col·lecció",
+      "folderCollection": "Col·lecció de carpeta",
       "tabCollections": "Col·leccions",
       "tabHistory": "Historial",
       "noCollectionsTitle": "Sense col·leccions",
diff --git a/apps/desktop-ui/messages/cs.json b/apps/desktop-ui/messages/cs.json
index d2d63a26..ed9a80c2 100644
--- a/apps/desktop-ui/messages/cs.json
+++ b/apps/desktop-ui/messages/cs.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API zdroje",
       "newCollection": "Nová kolekce",
+      "openFolderCollection": "Otevřít složku jako kolekci",
+      "folderCollection": "Kolekce ze složky",
       "tabCollections": "Kolekce",
       "tabHistory": "Historie",
       "noCollectionsTitle": "Žádné kolekce",
diff --git a/apps/desktop-ui/messages/da.json b/apps/desktop-ui/messages/da.json
index d2020c77..f1b2c4d6 100644
--- a/apps/desktop-ui/messages/da.json
+++ b/apps/desktop-ui/messages/da.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API-ressourcer",
       "newCollection": "Ny kollektion",
+      "openFolderCollection": "Åbn mappe som samling",
+      "folderCollection": "Mappesamling",
       "tabCollections": "Samlinger",
       "tabHistory": "Historie",
       "noCollectionsTitle": "Ingen samlinger",
diff --git a/apps/desktop-ui/messages/de.json b/apps/desktop-ui/messages/de.json
index 6c29a90c..1770dd2e 100644
--- a/apps/desktop-ui/messages/de.json
+++ b/apps/desktop-ui/messages/de.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API-Ressourcen",
       "newCollection": "Neue Sammlung",
+      "openFolderCollection": "Ordner als Sammlung öffnen",
+      "folderCollection": "Ordner-Sammlung",
       "tabCollections": "Sammlungen",
       "tabHistory": "Verlauf",
       "noCollectionsTitle": "Keine Sammlungen",
diff --git a/apps/desktop-ui/messages/el.json b/apps/desktop-ui/messages/el.json
index 7c76d021..cad4cac6 100644
--- a/apps/desktop-ui/messages/el.json
+++ b/apps/desktop-ui/messages/el.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "Πόροι API",
       "newCollection": "Νέα συλλογή",
+      "openFolderCollection": "Άνοιγμα φακέλου ως συλλογή",
+      "folderCollection": "Συλλογή φακέλου",
       "tabCollections": "Συλλογές",
       "tabHistory": "Ιστορία",
       "noCollectionsTitle": "Χωρίς συλλογές",
diff --git a/apps/desktop-ui/messages/en.json b/apps/desktop-ui/messages/en.json
index e94e917f..624c1c32 100644
--- a/apps/desktop-ui/messages/en.json
+++ b/apps/desktop-ui/messages/en.json
@@ -1948,6 +1948,8 @@
     "collectionsSidebar": {
       "title": "API resources",
       "newCollection": "New collection",
+      "openFolderCollection": "Open folder as collection",
+      "folderCollection": "Folder collection",
       "tabCollections": "Collections",
       "tabHistory": "History",
       "noCollectionsTitle": "No collections",
diff --git a/apps/desktop-ui/messages/es.json b/apps/desktop-ui/messages/es.json
index a93bd0c0..a07d5274 100644
--- a/apps/desktop-ui/messages/es.json
+++ b/apps/desktop-ui/messages/es.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "Recursos API",
       "newCollection": "Nueva colección",
+      "openFolderCollection": "Abrir carpeta como colección",
+      "folderCollection": "Colección de carpeta",
       "tabCollections": "Colecciones",
       "tabHistory": "Historial",
       "noCollectionsTitle": "Sin colecciones",
diff --git a/apps/desktop-ui/messages/fa.json b/apps/desktop-ui/messages/fa.json
index 414e3619..2ec79c56 100644
--- a/apps/desktop-ui/messages/fa.json
+++ b/apps/desktop-ui/messages/fa.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "منابع API",
       "newCollection": "مجموعه جدید",
+      "openFolderCollection": "باز کردن پوشه به عنوان مجموعه",
+      "folderCollection": "مجموعه پوشه‌ای",
       "tabCollections": "مجموعه ها",
       "tabHistory": "تاریخچه",
       "noCollectionsTitle": "بدون مجموعه",
diff --git a/apps/desktop-ui/messages/fr.json b/apps/desktop-ui/messages/fr.json
index b1035452..b0a84b80 100644
--- a/apps/desktop-ui/messages/fr.json
+++ b/apps/desktop-ui/messages/fr.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "Ressources API",
       "newCollection": "Nouvelle collection",
+      "openFolderCollection": "Ouvrir un dossier comme collection",
+      "folderCollection": "Collection de dossier",
       "tabCollections": "Collections",
       "tabHistory": "Historique",
       "noCollectionsTitle": "Aucune collection",
diff --git a/apps/desktop-ui/messages/id.json b/apps/desktop-ui/messages/id.json
index 1f7c7675..c703e8ca 100644
--- a/apps/desktop-ui/messages/id.json
+++ b/apps/desktop-ui/messages/id.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API resources",
       "newCollection": "New collection",
+      "openFolderCollection": "Buka folder sebagai koleksi",
+      "folderCollection": "Koleksi folder",
       "tabCollections": "Collections",
       "tabHistory": "History",
       "noCollectionsTitle": "No collections",
diff --git a/apps/desktop-ui/messages/it.json b/apps/desktop-ui/messages/it.json
index cc6e30a0..fdbdb7ec 100644
--- a/apps/desktop-ui/messages/it.json
+++ b/apps/desktop-ui/messages/it.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "Risorse API",
       "newCollection": "Nuova collezione",
+      "openFolderCollection": "Apri cartella come raccolta",
+      "folderCollection": "Raccolta da cartella",
       "tabCollections": "Collezioni",
       "tabHistory": "Storia",
       "noCollectionsTitle": "Nessuna raccolta",
diff --git a/apps/desktop-ui/messages/ja.json b/apps/desktop-ui/messages/ja.json
index 471da4fe..31293c68 100644
--- a/apps/desktop-ui/messages/ja.json
+++ b/apps/desktop-ui/messages/ja.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "APIリソース",
       "newCollection": "新しいコレクション",
+      "openFolderCollection": "フォルダーをコレクションとして開く",
+      "folderCollection": "フォルダーコレクション",
       "tabCollections": "コレクション",
       "tabHistory": "履歴",
       "noCollectionsTitle": "コレクションなし",
diff --git a/apps/desktop-ui/messages/ko.json b/apps/desktop-ui/messages/ko.json
index 39581cf4..c30ff58e 100644
--- a/apps/desktop-ui/messages/ko.json
+++ b/apps/desktop-ui/messages/ko.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API 리소스",
       "newCollection": "새 컬렉션",
+      "openFolderCollection": "폴더를 컬렉션으로 열기",
+      "folderCollection": "폴더 컬렉션",
       "tabCollections": "컬렉션",
       "tabHistory": "기록",
       "noCollectionsTitle": "컬렉션 없음",
diff --git a/apps/desktop-ui/messages/ms.json b/apps/desktop-ui/messages/ms.json
index 15e1a393..a7b29e4a 100644
--- a/apps/desktop-ui/messages/ms.json
+++ b/apps/desktop-ui/messages/ms.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "Sumber API",
       "newCollection": "Koleksi baharu",
+      "openFolderCollection": "Buka folder sebagai koleksi",
+      "folderCollection": "Koleksi folder",
       "tabCollections": "Koleksi",
       "tabHistory": "Sejarah",
       "noCollectionsTitle": "Tiada koleksi",
diff --git a/apps/desktop-ui/messages/nb.json b/apps/desktop-ui/messages/nb.json
index db3c3c56..24828968 100644
--- a/apps/desktop-ui/messages/nb.json
+++ b/apps/desktop-ui/messages/nb.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API-ressurser",
       "newCollection": "Ny samling",
+      "openFolderCollection": "Åpne mappe som samling",
+      "folderCollection": "Mappesamling",
       "tabCollections": "Samlinger",
       "tabHistory": "Historikk",
       "noCollectionsTitle": "Ingen samlinger",
diff --git a/apps/desktop-ui/messages/nl.json b/apps/desktop-ui/messages/nl.json
index 8e3b0277..d2ef1e33 100644
--- a/apps/desktop-ui/messages/nl.json
+++ b/apps/desktop-ui/messages/nl.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API-bronnen",
       "newCollection": "Nieuwe collectie",
+      "openFolderCollection": "Map openen als collectie",
+      "folderCollection": "Mapcollectie",
       "tabCollections": "Collecties",
       "tabHistory": "Geschiedenis",
       "noCollectionsTitle": "Geen collecties",
diff --git a/apps/desktop-ui/messages/pl.json b/apps/desktop-ui/messages/pl.json
index 4cd12d26..7d7b981c 100644
--- a/apps/desktop-ui/messages/pl.json
+++ b/apps/desktop-ui/messages/pl.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API resources",
       "newCollection": "New collection",
+      "openFolderCollection": "Otwórz folder jako kolekcję",
+      "folderCollection": "Kolekcja z folderu",
       "tabCollections": "Collections",
       "tabHistory": "History",
       "noCollectionsTitle": "No collections",
diff --git a/apps/desktop-ui/messages/pt-BR.json b/apps/desktop-ui/messages/pt-BR.json
index 00f8e012..8c5787cc 100644
--- a/apps/desktop-ui/messages/pt-BR.json
+++ b/apps/desktop-ui/messages/pt-BR.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "Recursos API",
       "newCollection": "Nova coleção",
+      "openFolderCollection": "Abrir pasta como coleção",
+      "folderCollection": "Coleção de pasta",
       "tabCollections": "Coleções",
       "tabHistory": "Histórico",
       "noCollectionsTitle": "Sem coleções",
diff --git a/apps/desktop-ui/messages/pt.json b/apps/desktop-ui/messages/pt.json
index 8dc4365a..0b54e559 100644
--- a/apps/desktop-ui/messages/pt.json
+++ b/apps/desktop-ui/messages/pt.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "Recursos API",
       "newCollection": "Nova coleção",
+      "openFolderCollection": "Abrir pasta como coleção",
+      "folderCollection": "Coleção de pasta",
       "tabCollections": "Coleções",
       "tabHistory": "Histórico",
       "noCollectionsTitle": "Sem coleções",
diff --git a/apps/desktop-ui/messages/ru.json b/apps/desktop-ui/messages/ru.json
index 82592912..b2692b3e 100644
--- a/apps/desktop-ui/messages/ru.json
+++ b/apps/desktop-ui/messages/ru.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API-ресурсы",
       "newCollection": "Новая коллекция",
+      "openFolderCollection": "Открыть папку как коллекцию",
+      "folderCollection": "Коллекция из папки",
       "tabCollections": "Коллекции",
       "tabHistory": "История",
       "noCollectionsTitle": "Нет коллекций",
diff --git a/apps/desktop-ui/messages/sv.json b/apps/desktop-ui/messages/sv.json
index badc30d6..79a20744 100644
--- a/apps/desktop-ui/messages/sv.json
+++ b/apps/desktop-ui/messages/sv.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "API-resurser",
       "newCollection": "Ny samling",
+      "openFolderCollection": "Öppna mapp som samling",
+      "folderCollection": "Mappsamling",
       "tabCollections": "Samlingar",
       "tabHistory": "Historik",
       "noCollectionsTitle": "Inga samlingar",
diff --git a/apps/desktop-ui/messages/tr.json b/apps/desktop-ui/messages/tr.json
index eefca454..d5bce185 100644
--- a/apps/desktop-ui/messages/tr.json
+++ b/apps/desktop-ui/messages/tr.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "API kaynakları",
       "newCollection": "Yeni koleksiyon",
+      "openFolderCollection": "Klasörü koleksiyon olarak aç",
+      "folderCollection": "Klasör koleksiyonu",
       "tabCollections": "Koleksiyonlar",
       "tabHistory": "Geçmiş",
       "noCollectionsTitle": "Koleksiyon yok",
diff --git a/apps/desktop-ui/messages/uk.json b/apps/desktop-ui/messages/uk.json
index 51c34f08..a992e42d 100644
--- a/apps/desktop-ui/messages/uk.json
+++ b/apps/desktop-ui/messages/uk.json
@@ -1923,6 +1923,8 @@
     "collectionsSidebar": {
       "title": "API ресурси",
       "newCollection": "Нова колекція",
+      "openFolderCollection": "Відкрити папку як колекцію",
+      "folderCollection": "Колекція з папки",
       "tabCollections": "Колекції",
       "tabHistory": "Історія",
       "noCollectionsTitle": "Немає колекцій",
diff --git a/apps/desktop-ui/messages/vi.json b/apps/desktop-ui/messages/vi.json
index 7cc54820..32645338 100644
--- a/apps/desktop-ui/messages/vi.json
+++ b/apps/desktop-ui/messages/vi.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "Tài nguyên API",
       "newCollection": "Bộ sưu tập mới",
+      "openFolderCollection": "Mở thư mục dưới dạng bộ sưu tập",
+      "folderCollection": "Bộ sưu tập thư mục",
       "tabCollections": "Bộ sưu tập",
       "tabHistory": "Lịch sử",
       "noCollectionsTitle": "Chưa có bộ sưu tập",
diff --git a/apps/desktop-ui/messages/zh.json b/apps/desktop-ui/messages/zh.json
index 42b1770e..efe9096e 100644
--- a/apps/desktop-ui/messages/zh.json
+++ b/apps/desktop-ui/messages/zh.json
@@ -2008,6 +2008,8 @@
     "collectionsSidebar": {
       "title": "API 资源",
       "newCollection": "新建集合",
+      "openFolderCollection": "将文件夹作为集合打开",
+      "folderCollection": "文件夹集合",
       "tabCollections": "集合",
       "tabHistory": "历史",
       "noCollectionsTitle": "暂无集合",
diff --git a/apps/desktop-ui/package.json b/apps/desktop-ui/package.json
index 4a9b01e9..ba820e1c 100644
--- a/apps/desktop-ui/package.json
+++ b/apps/desktop-ui/package.json
@@ -55,6 +55,8 @@
     "@tanstack/react-virtual": "^3.14.3",
     "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-deep-link": "^2.4.9",
+    "@tauri-apps/plugin-dialog": "^2.4.0",
+    "@tauri-apps/plugin-fs": "^2.4.0",
     "@tauri-apps/plugin-opener": "^2.5.4",
     "@tauri-apps/plugin-process": "^2.3.1",
     "@tauri-apps/plugin-updater": "^2.10.1",
diff --git a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
index 686de5f2..26c03d12 100644
--- a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
+++ b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
@@ -6,7 +6,7 @@ import { Checkbox } from "@/components/ui/checkbox"
 import { ScrollArea } from "@/components/ui/scroll-area"
 import { Collection, CollectionRequest } from "../types"
 import { CollectionItem } from "./collection-item"
-import { FolderPlus, Trash2, Pencil, MoreHorizontal, Search, X, FileDown, Play, Server, Link2, Globe, PanelRightClose } from "lucide-react"
+import { FolderPlus, FolderGit2, Trash2, Pencil, MoreHorizontal, Search, X, FileDown, Play, Server, Link2, Globe, PanelRightClose } from "lucide-react"
 import { buildShareUrl } from "@/lib/share-link"
 import { backendFetch } from "@/lib/backend-auth"
 import { toast } from "sonner"
@@ -58,7 +58,11 @@ export function CollectionsSidebar({
     onCollapse,
 }: CollectionsSidebarProps) {
     const { collections, isLoading } = useCollectionsState()
-    const { addFolder: onAddFolder, deleteItem: onDelete, toggleFolder: onToggle, createCollection: onCreateCollection, renameCollection: onRenameCollection, renameFolder: onRenameFolder, patchFolder, deleteMultipleCollections: onDeleteMultiple } = useCollectionsActions()
+    const { addFolder: onAddFolder, deleteItem: onDelete, toggleFolder: onToggle, createCollection: onCreateCollection, renameCollection: onRenameCollection, renameFolder: onRenameFolder, patchFolder, deleteMultipleCollections: onDeleteMultiple, openFolderCollection } = useCollectionsActions()
+
+    // isDesktop() is false during SSR — gate behind a mounted flag to avoid hydration mismatch.
+    const [desktop, setDesktop] = React.useState(false)
+    React.useEffect(() => { setDesktop(isDesktop()) }, [])
     const { history, isLoading: isHistoryLoading } = useHistoryState()
     const { clearHistory: onClearHistory, deleteHistoryItem: onDeleteHistoryItem } = useHistoryActions()
     const t = useTranslations("ApiClient.collectionsSidebar")
@@ -215,6 +219,17 @@ export function CollectionsSidebar({
                             >
                                 <FolderPlus className="h-4 w-4" />
                             </Button>
+                            {desktop && (
+                                <Button
+                                    variant="ghost"
+                                    size="icon"
+                                    className="h-7 w-7 rounded-lg hover:bg-primary/10 hover:text-primary transition-colors"
+                                    onClick={() => void openFolderCollection()}
+                                    title={t("openFolderCollection")}
+                                >
+                                    <FolderGit2 className="h-4 w-4" />
+                                </Button>
+                            )}
                             {onCollapse && (
                                 <Button
                                     variant="ghost"
@@ -296,6 +311,11 @@ export function CollectionsSidebar({
                                                 <span className="text-[11px] font-bold text-muted-foreground uppercase tracking-wider truncate flex-1 px-1">
                                                     {collection.name}
                                                 </span>
+                                                {collection.source && (
+                                                    <span title={collection.source.path} aria-label={t("folderCollection")}>
+                                                        <FolderGit2 className="h-3 w-3 text-muted-foreground shrink-0" />
+                                                    </span>
+                                                )}
                                             </div>
                                             <div className="flex items-center opacity-0 group-hover:opacity-100 transition-opacity">
                                                 <Button
diff --git a/apps/desktop-ui/src/components/api-client/collections/use-collections.ts b/apps/desktop-ui/src/components/api-client/collections/use-collections.ts
index 8c3dc957..413a5d2d 100644
--- a/apps/desktop-ui/src/components/api-client/collections/use-collections.ts
+++ b/apps/desktop-ui/src/components/api-client/collections/use-collections.ts
@@ -7,18 +7,134 @@ import { auth } from "@/database/firebase"
 import { useAuthState } from "react-firebase-hooks/auth"
 import { backendFetch } from "@/lib/backend-auth"
 import { broadcastApiClientUpdate, useApiClientSyncListener } from "@/lib/api-client-sync"
+import { isDesktop } from "@/lib/desktop/is-desktop"
+import { diffFiles, newManifest, parseCollection, serializeCollection, MANIFEST_FILE } from "@/lib/api-client/file-store"
 
 const STORAGE_KEY = "api-client-collections"
+/** Registered folder-collection paths (desktop only — paths are machine-local). */
+const FILE_REGISTRY_KEY = "api-client-file-collections"
 
 function sortCollections(cols: Collection[]) {
     return [...cols].sort((a, b) => a.name.localeCompare(b.name))
 }
 
+function readFileRegistry(): string[] {
+    try {
+        const parsed = JSON.parse(localStorage.getItem(FILE_REGISTRY_KEY) ?? "[]")
+        return Array.isArray(parsed) ? parsed.filter((p): p is string => typeof p === "string") : []
+    } catch {
+        return []
+    }
+}
+
+function writeFileRegistry(paths: string[]) {
+    localStorage.setItem(FILE_REGISTRY_KEY, JSON.stringify(paths))
+}
+
+/** Carry UI-only open/closed state (stripped from disk) across reloads, by folder id. */
+function applyOpenState(prev: Collection | undefined, next: Collection): Collection {
+    if (!prev) return next
+    const openIds = new Set<string>()
+    const collect = (items: Collection["items"]) => {
+        for (const item of items) {
+            if ("type" in item && item.type === "folder") {
+                if (item.isOpen) openIds.add(item.id)
+                collect(item.items)
+            }
+        }
+    }
+    collect(prev.items)
+    const apply = (items: Collection["items"]): Collection["items"] =>
+        items.map((item) =>
+            "type" in item && item.type === "folder"
+                ? { ...item, isOpen: openIds.has(item.id), items: apply(item.items) }
+                : item
+        )
+    return { ...next, items: apply(next.items) }
+}
+
 export function useCollections() {
     const [user, loading] = useAuthState(auth)
     const [collections, setCollections] = React.useState<Collection[]>([])
+    const [fileCollections, setFileCollections] = React.useState<Collection[]>([])
     const [isLoading, setIsLoading] = React.useState(true)
     const migrationRanRef = React.useRef(false)
+    /** Paths already toasted about, so a failing folder doesn't re-toast on every window focus. */
+    const failedFilePathsRef = React.useRef(new Set<string>())
+
+    // DB collections + folder-backed collections, one list for consumers.
+    const allCollections = React.useMemo(
+        () => sortCollections([...collections, ...fileCollections]),
+        [collections, fileCollections]
+    )
+
+    /** (Re-)read every registered folder collection from disk. Desktop only. */
+    const reloadFileCollections = React.useCallback(async () => {
+        if (!isDesktop()) return
+        const paths = readFileRegistry()
+        if (paths.length === 0) {
+            setFileCollections((cur) => (cur.length === 0 ? cur : []))
+            return
+        }
+        const { readCollectionFiles, allowCollectionDir } = await import("@/lib/desktop/collection-files")
+        const loaded: Collection[] = []
+        for (const path of paths) {
+            try {
+                await allowCollectionDir(path)
+                const { collection, warnings } = parseCollection(await readCollectionFiles(path))
+                warnings.forEach((w) => console.warn(`[file-collection] ${path}: ${w}`))
+                loaded.push({ ...collection, source: { kind: "file", path } })
+                failedFilePathsRef.current.delete(path)
+            } catch (e) {
+                console.error(`Failed to read folder collection at ${path}`, e)
+                if (!failedFilePathsRef.current.has(path)) {
+                    failedFilePathsRef.current.add(path)
+                    toast.error(`Couldn't read folder collection: ${path}`)
+                }
+            }
+        }
+        setFileCollections((cur) => {
+            const next = loaded.map((col) => applyOpenState(cur.find((c) => c.id === col.id), col))
+            return JSON.stringify(next) === JSON.stringify(cur) ? cur : next
+        })
+    }, [])
+
+    // Load folder collections on mount and when the window regains focus
+    // (catches git pulls / external editor changes — no file watcher in v1).
+    React.useEffect(() => {
+        if (!isDesktop()) return
+        void reloadFileCollections()
+        const onFocus = () => void reloadFileCollections()
+        window.addEventListener("focus", onFocus)
+        return () => window.removeEventListener("focus", onFocus)
+    }, [reloadFileCollections])
+
+    /**
+     * Persist a mutated folder collection: swap state optimistically, then write
+     * only the changed files (deterministic serializer ⇒ no-op edits write nothing).
+     * On write failure the previous state is restored — never silently drop edits.
+     */
+    const mutateFileCollection = async (
+        target: Collection,
+        nextItems: Collection["items"],
+        patch?: Partial<Collection>
+    ): Promise<boolean> => {
+        const next = { ...target, ...patch, items: nextItems }
+        setFileCollections((cur) => cur.map((c) => (c.id === target.id ? next : c)))
+        try {
+            const { writes, deletes } = diffFiles(serializeCollection(target), serializeCollection(next))
+            if (writes.length > 0 || deletes.length > 0) {
+                const { writeCollectionFiles } = await import("@/lib/desktop/collection-files")
+                await writeCollectionFiles(target.source!.path, writes, deletes)
+            }
+            return true
+        } catch (e) {
+            setFileCollections((cur) => cur.map((c) => (c.id === target.id ? target : c)))
+            console.error("Error writing folder collection", e)
+            toast.error(`Failed to write collection files: ${e instanceof Error ? e.message : String(e)}`)
+            return false
+        }
+    }
 
     React.useEffect(() => {
         if (!user) migrationRanRef.current = false
@@ -146,8 +262,6 @@ export function useCollections() {
     )
 
     const addFolder = async (parentId: string, name: string) => {
-        if (!user) return
-
         const newFolder: CollectionFolder = {
             id: crypto.randomUUID(),
             name,
@@ -156,12 +270,22 @@ export function useCollections() {
             isOpen: true,
         }
 
-        const targetCollection = collections.find(c =>
+        const targetCollection = allCollections.find(c =>
             c.id === parentId || findItemInCollection(c.items, parentId)
         )
 
         if (!targetCollection) return
 
+        if (targetCollection.source) {
+            const nextItems = targetCollection.id === parentId
+                ? [...targetCollection.items, newFolder]
+                : addItemToParent(targetCollection.items, parentId, newFolder)
+            const ok = await mutateFileCollection(targetCollection, nextItems)
+            return ok ? newFolder.id : undefined
+        }
+
+        if (!user) return
+
         // Optimistic update
         const prev = collections
         const optimisticItems = targetCollection.id === parentId
@@ -188,13 +312,27 @@ export function useCollections() {
     }
 
     const deleteItem = async (itemId: string) => {
-        if (!user) return
-
         // Find collection containing item
-        const targetCollection = collections.find(c =>
+        const targetCollection = allCollections.find(c =>
             c.items.some(i => i.id === itemId) || findItemInCollection(c.items, itemId)
         )
 
+        if (targetCollection?.source) {
+            await mutateFileCollection(targetCollection, deleteFromItems(targetCollection.items, itemId))
+            return
+        }
+
+        // Deleting a folder collection = forget it, never touch the user's files.
+        const fileCol = fileCollections.find((c) => c.id === itemId)
+        if (fileCol?.source) {
+            writeFileRegistry(readFileRegistry().filter((p) => p !== fileCol.source!.path))
+            setFileCollections((cur) => cur.filter((c) => c.id !== itemId))
+            toast.success("Folder collection removed from list (files kept)")
+            return
+        }
+
+        if (!user) return
+
         // If not found in items, maybe it IS the collection?
         if (!targetCollection) {
             const colToDelete = collections.find(c => c.id === itemId)
@@ -237,14 +375,22 @@ export function useCollections() {
     }
 
     const saveRequest = async (parentId: string, request: CollectionRequest) => {
-        if (!user) return
-
-        const targetCollection = collections.find(c =>
+        const targetCollection = allCollections.find(c =>
             c.id === parentId || findItemInCollection(c.items, parentId)
         )
 
         if (!targetCollection) return
 
+        if (targetCollection.source) {
+            const nextItems = targetCollection.id === parentId
+                ? [...targetCollection.items, request]
+                : addItemToParent(targetCollection.items, parentId, request)
+            if (await mutateFileCollection(targetCollection, nextItems)) toast.success("Request saved")
+            return
+        }
+
+        if (!user) return
+
         // Optimistic update
         const prev = collections
         const optimisticItems = targetCollection.id === parentId
@@ -271,11 +417,19 @@ export function useCollections() {
     }
 
     const toggleFolder = async (folderId: string) => {
-        if (!user) return
-
-        const targetCollection = collections.find(c => findItemInCollection(c.items, folderId))
+        const targetCollection = allCollections.find(c => findItemInCollection(c.items, folderId))
         if (!targetCollection) return
 
+        if (targetCollection.source) {
+            // isOpen is UI-only and stripped from disk — pure state change.
+            setFileCollections((cur) =>
+                cur.map((c) => (c.id === targetCollection.id ? { ...c, items: toggleInItems(c.items, folderId) } : c))
+            )
+            return
+        }
+
+        if (!user) return
+
         // Optimistic update (toggle is purely local UX — we still persist to avoid drift)
         const prev = collections
         const optimisticItems = toggleInItems(targetCollection.items, folderId)
@@ -307,10 +461,8 @@ export function useCollections() {
      * Applies optimistically against state, reconciles from the delta result.
      */
     const patchFolder = async (folderId: string, patch: Partial<CollectionFolder>) => {
-        if (!user) return
-        const targetCollection = collections.find((c) => findItemInCollection(c.items, folderId))
+        const targetCollection = allCollections.find((c) => findItemInCollection(c.items, folderId))
         if (!targetCollection) return
-        const prev = collections
         const patchInItems = (items: (CollectionFolder | CollectionRequest)[]): (CollectionFolder | CollectionRequest)[] =>
             items.map((item) => {
                 if ("type" in item && item.type === "folder") {
@@ -319,6 +471,16 @@ export function useCollections() {
                 }
                 return item
             })
+
+        if (targetCollection.source) {
+            if (await mutateFileCollection(targetCollection, patchInItems(targetCollection.items))) {
+                toast.success("Folder defaults saved")
+            }
+            return
+        }
+
+        if (!user) return
+        const prev = collections
         setCollections((cur) =>
             sortCollections(cur.map((c) =>
                 c.id === targetCollection.id ? { ...c, items: patchInItems(c.items) } : c
@@ -339,11 +501,16 @@ export function useCollections() {
     }
 
     const renameFolder = async (folderId: string, name: string) => {
-        if (!user) return
-
-        const targetCollection = collections.find(c => findItemInCollection(c.items, folderId))
+        const targetCollection = allCollections.find(c => findItemInCollection(c.items, folderId))
         if (!targetCollection) return
 
+        if (targetCollection.source) {
+            await mutateFileCollection(targetCollection, renameFolderInItems(targetCollection.items, folderId, name))
+            return
+        }
+
+        if (!user) return
+
         // Optimistic update
         const prev = collections
         const optimisticItems = renameFolderInItems(targetCollection.items, folderId, name)
@@ -499,6 +666,14 @@ export function useCollections() {
     }
 
     const renameCollection = async (collectionId: string, name: string) => {
+        const fileCol = fileCollections.find((c) => c.id === collectionId)
+        if (fileCol) {
+            if (await mutateFileCollection(fileCol, fileCol.items, { name })) {
+                toast.success("Collection renamed")
+            }
+            return
+        }
+
         if (!user) return
         const prev = collections
         // Optimistic update
@@ -522,9 +697,25 @@ export function useCollections() {
     }
 
     const deleteMultipleCollections = async (ids: string[]) => {
-        if (!user) return
         if (ids.length === 0) return
 
+        // Folder collections: forget only, never delete the user's files.
+        const fileIds = new Set(fileCollections.filter((c) => ids.includes(c.id)).map((c) => c.id))
+        if (fileIds.size > 0) {
+            const removedPaths = new Set(
+                fileCollections.filter((c) => fileIds.has(c.id)).map((c) => c.source!.path)
+            )
+            writeFileRegistry(readFileRegistry().filter((p) => !removedPaths.has(p)))
+            setFileCollections((cur) => cur.filter((c) => !fileIds.has(c.id)))
+            ids = ids.filter((id) => !fileIds.has(id))
+            if (ids.length === 0) {
+                toast.success("Folder collections removed from list (files kept)")
+                return
+            }
+        }
+
+        if (!user) return
+
         try {
             // Use Promise.allSettled to handle partial failures gracefully
             const deleteResults = await Promise.allSettled(
@@ -582,8 +773,53 @@ export function useCollections() {
         }
     }
 
+    /**
+     * Pick a folder and open it as a file-backed collection. A folder with a
+     * `collection.yaml` is opened as-is; a folder without one is initialized
+     * (name = folder basename). Desktop only.
+     */
+    const openFolderCollection = async (): Promise<Collection | null> => {
+        if (!isDesktop()) return null
+        try {
+            const { pickFolder, readCollectionFiles, writeCollectionFiles } = await import(
+                "@/lib/desktop/collection-files"
+            )
+            const path = await pickFolder()
+            if (!path) return null
+
+            const registry = readFileRegistry()
+            if (registry.includes(path)) {
+                toast.info("This folder collection is already open")
+                return fileCollections.find((c) => c.source?.path === path) ?? null
+            }
+
+            let col: Collection
+            const entries = await readCollectionFiles(path)
+            if (entries.some((e) => e.relPath === MANIFEST_FILE)) {
+                const { collection, warnings } = parseCollection(entries)
+                warnings.forEach((w) => console.warn(`[file-collection] ${path}: ${w}`))
+                col = { ...collection, source: { kind: "file", path } }
+            } else {
+                const name = path.split(/[/\\]/).filter(Boolean).pop() || "Collection"
+                const manifest = newManifest(name)
+                await writeCollectionFiles(path, [{ relPath: MANIFEST_FILE, content: manifest.content }], [])
+                col = { id: manifest.id, name, items: [], source: { kind: "file", path } }
+            }
+
+            writeFileRegistry([...registry, path])
+            setFileCollections((cur) => [...cur.filter((c) => c.id !== col.id), col])
+            toast.success(`Opened folder collection "${col.name}"`)
+            return col
+        } catch (e) {
+            console.error("Error opening folder collection", e)
+            toast.error(`Couldn't open folder as collection: ${e instanceof Error ? e.message : String(e)}`)
+            return null
+        }
+    }
+
     return {
-        collections,
+        collections: allCollections,
+        openFolderCollection,
         addFolder,
         deleteItem,
         saveRequest,
diff --git a/apps/desktop-ui/src/components/api-client/context/collections-context.tsx b/apps/desktop-ui/src/components/api-client/context/collections-context.tsx
index 5003f54b..1522a203 100644
--- a/apps/desktop-ui/src/components/api-client/context/collections-context.tsx
+++ b/apps/desktop-ui/src/components/api-client/context/collections-context.tsx
@@ -22,6 +22,8 @@ type CollectionsActions = {
     patchFolder: (folderId: string, patch: Partial<import("../types").CollectionFolder>) => Promise<void>
     deleteMultipleCollections: (ids: string[]) => Promise<void>
     importCollection: (incoming: Collection) => Promise<Collection | null>
+    /** Desktop only: open (or initialize) a folder of YAML files as a git-friendly collection. */
+    openFolderCollection: () => Promise<Collection | null>
 }
 
 // ── Contexts ───────────────────────────────────────────────────────────────
@@ -45,6 +47,7 @@ export function CollectionsProvider({ children }: { children: React.ReactNode })
         patchFolder,
         deleteMultipleCollections,
         importCollection,
+        openFolderCollection,
     } = useCollections()
 
     const state = React.useMemo<CollectionsState>(
@@ -69,9 +72,10 @@ export function CollectionsProvider({ children }: { children: React.ReactNode })
             patchFolder,
             deleteMultipleCollections,
             importCollection,
+            openFolderCollection,
         }),
         // eslint-disable-next-line react-hooks/exhaustive-deps
-        [addFolder, deleteItem, saveRequest, toggleFolder, createCollection, renameCollection, renameFolder, patchFolder, deleteMultipleCollections, importCollection]
+        [addFolder, deleteItem, saveRequest, toggleFolder, createCollection, renameCollection, renameFolder, patchFolder, deleteMultipleCollections, importCollection, openFolderCollection]
     )
 
     return (
diff --git a/apps/desktop-ui/src/components/api-client/types.ts b/apps/desktop-ui/src/components/api-client/types.ts
index a0c1bf11..4d038f99 100644
--- a/apps/desktop-ui/src/components/api-client/types.ts
+++ b/apps/desktop-ui/src/components/api-client/types.ts
@@ -319,6 +319,9 @@ export interface Collection {
     items: (CollectionFolder | CollectionRequest)[]
     /** Free-form workspace label (e.g. "Personal", "Acme Prod"). Empty / undefined = default workspace. */
     workspace?: string
+    /** Desktop-only: set when this collection is backed by a folder of YAML files
+     *  (git-friendly). In-memory marker — never sent to the backend. */
+    source?: { kind: "file"; path: string }
 }
 
 export interface HistoryRequest extends CollectionRequest {
diff --git a/apps/desktop-ui/src/lib/api-client/__tests__/file-store.test.ts b/apps/desktop-ui/src/lib/api-client/__tests__/file-store.test.ts
new file mode 100644
index 00000000..07f8e0a9
--- /dev/null
+++ b/apps/desktop-ui/src/lib/api-client/__tests__/file-store.test.ts
@@ -0,0 +1,185 @@
+import {
+    diffFiles,
+    parseCollection,
+    serializeCollection,
+    slugify,
+    MANIFEST_FILE,
+} from "../file-store"
+import type {
+    Collection,
+    CollectionFolder,
+    CollectionRequest,
+} from "@/components/api-client/types"
+
+const kv = (key: string, value: string, active = true) => ({
+    id: `kv-${key}`,
+    key,
+    value,
+    active,
+})
+
+const request = (over: Partial<CollectionRequest> = {}): CollectionRequest => ({
+    id: "req-1",
+    name: "Login",
+    method: "POST",
+    url: "https://api.example.com/login",
+    params: [kv("verbose", "1")],
+    headers: [kv("X-Token", "{{vault.apiToken}}")],
+    body: { type: "json", content: '{"a":1}' },
+    auth: { type: "bearer", token: "{{vault.apiToken}}" },
+    preRequestScript: "console.log('pre')",
+    ...over,
+})
+
+const collection = (): Collection => {
+    const folder: CollectionFolder = {
+        id: "folder-1",
+        name: "Auth",
+        type: "folder",
+        isOpen: true,
+        items: [request(), request({ id: "req-2", name: "Refresh", url: "https://api.example.com/refresh" })],
+        defaultHeaders: [kv("X-Env", "staging")],
+        testScript: "pm.test('ok', () => {})",
+    }
+    return {
+        id: "col-1",
+        name: "My API",
+        items: [folder, request({ id: "req-3", name: "Health", method: "GET", url: "https://api.example.com/health" })],
+    }
+}
+
+/** Strip volatile fields the store legitimately drops/regenerates. */
+const canonical = (col: Collection) =>
+    JSON.parse(
+        JSON.stringify(col, (key, value) => {
+            if (key === "id" && typeof value === "string" && value.startsWith("kv-")) return undefined
+            if (key === "isOpen") return undefined
+            return value
+        })
+    )
+
+describe("file-store", () => {
+    test("round-trip preserves the tree (minus stripped fields)", () => {
+        const col = collection()
+        const { collection: parsed, warnings } = parseCollection(serializeCollection(col))
+        expect(warnings).toEqual([])
+        expect(canonicalTree(parsed)).toEqual(canonicalTree(col))
+    })
+
+    test("serialization is deterministic (byte-identical on repeat)", () => {
+        const a = serializeCollection(collection())
+        const b = serializeCollection(collection())
+        expect(b).toEqual(a)
+    })
+
+    test("stable ids survive the round-trip", () => {
+        const { collection: parsed } = parseCollection(serializeCollection(collection()))
+        const folder = parsed.items[0] as CollectionFolder
+        expect(parsed.id).toBe("col-1")
+        expect(folder.id).toBe("folder-1")
+        expect(folder.items.map((i) => i.id)).toEqual(["req-1", "req-2"])
+    })
+
+    test("secret tokens are written verbatim, never resolved", () => {
+        const files = serializeCollection(collection())
+        const all = files.map((f) => f.content).join("\n")
+        expect(all).toContain("{{vault.apiToken}}")
+    })
+
+    test("isOpen and KeyValueItem ids never reach disk", () => {
+        const all = serializeCollection(collection()).map((f) => f.content).join("\n")
+        expect(all).not.toContain("isOpen")
+        expect(all).not.toContain("kv-")
+    })
+
+    test("sibling order comes from filename prefix", () => {
+        const files = serializeCollection(collection())
+        const paths = files.map((f) => f.relPath)
+        expect(paths).toContain("001-auth/001-login.yaml")
+        expect(paths).toContain("001-auth/002-refresh.yaml")
+        expect(paths).toContain("002-health.yaml")
+        const { collection: parsed } = parseCollection(files)
+        expect(parsed.items.map((i) => i.name)).toEqual(["Auth", "Health"])
+        expect((parsed.items[0] as CollectionFolder).items.map((i) => i.name)).toEqual(["Login", "Refresh"])
+    })
+
+    test("duplicate names stay unique via the index prefix", () => {
+        const col: Collection = {
+            id: "c",
+            name: "c",
+            items: [
+                request({ id: "a", name: "Same" }),
+                request({ id: "b", name: "same" }),
+            ],
+        }
+        const paths = serializeCollection(col).map((f) => f.relPath)
+        expect(paths).toContain("001-same.yaml")
+        expect(paths).toContain("002-same.yaml")
+        expect(slugify("Héllo Wörld!")).toBe("hello-world")
+        expect(slugify("///")).toBe("item")
+    })
+
+    test("garbage files are skipped with warnings, not fatal", () => {
+        const files = serializeCollection(collection())
+        files.push({ relPath: "junk.yaml", content: "[not: a: mapping" })
+        const { collection: parsed, warnings } = parseCollection(files)
+        expect(warnings).toHaveLength(1)
+        expect(warnings[0]).toContain("junk.yaml")
+        expect(parsed.items).toHaveLength(2)
+    })
+
+    test("missing manifest throws", () => {
+        const files = serializeCollection(collection()).filter((f) => f.relPath !== MANIFEST_FILE)
+        expect(() => parseCollection(files)).toThrow("missing-manifest")
+    })
+
+    test("diffFiles: no-op mutation produces zero writes", () => {
+        const a = serializeCollection(collection())
+        const b = serializeCollection(collection())
+        expect(diffFiles(a, b)).toEqual({ writes: [], deletes: [] })
+    })
+
+    test("diffFiles: rename rewrites only the affected file", () => {
+        const before = serializeCollection(collection())
+        const col = collection()
+        ;(col.items[1] as CollectionRequest).name = "Healthcheck"
+        const after = serializeCollection(col)
+        const { writes, deletes } = diffFiles(before, after)
+        expect(deletes).toEqual(["002-health.yaml"])
+        expect(writes.map((w) => w.relPath)).toEqual(["002-healthcheck.yaml"])
+    })
+
+    test("diffFiles: delete removes the subtree files", () => {
+        const before = serializeCollection(collection())
+        const col = collection()
+        col.items = col.items.slice(1) // drop the Auth folder
+        const after = serializeCollection(col)
+        const { deletes, writes } = diffFiles(before, after)
+        expect(deletes.sort()).toEqual([
+            "001-auth/001-login.yaml",
+            "001-auth/002-refresh.yaml",
+            "001-auth/folder.yaml",
+            "002-health.yaml", // renumbered to 001-
+        ])
+        expect(writes.map((w) => w.relPath)).toEqual(["001-health.yaml"])
+    })
+})
+
+/** Comparable shape: drop generated KV ids and UI-only isOpen on both sides. */
+function canonicalTree(col: Collection) {
+    return JSON.parse(
+        JSON.stringify(col, function (this: Record<string, unknown>, key: string, value: unknown) {
+            if (key === "isOpen") return undefined
+            if (
+                key === "id" &&
+                typeof value === "string" &&
+                "key" in this &&
+                "value" in this &&
+                "active" in this
+            ) {
+                return undefined
+            }
+            return value
+        })
+    )
+}
diff --git a/apps/desktop-ui/src/lib/api-client/file-store.ts b/apps/desktop-ui/src/lib/api-client/file-store.ts
new file mode 100644
index 00000000..4e1275e8
--- /dev/null
+++ b/apps/desktop-ui/src/lib/api-client/file-store.ts
@@ -0,0 +1,405 @@
+/**
+ * Git-friendly file-backed collections: serialize a Collection tree to a folder
+ * of YAML files and back. Pure functions only — no fs access here (Tauri fs
+ * wrappers live in `@/lib/desktop/collection-files`), so everything is unit-testable.
+ *
+ * Layout:
+ *   collection.yaml        manifest {formatVersion, id, name}
+ *   001-login.yaml         request (NNN- prefix = sibling order)
+ *   002-users/             folder
+ *     folder.yaml          folder meta {id, name, defaults, scripts}
+ *     001-create.yaml
+ *
+ * Deterministic output (fixed key order, volatile fields stripped) is the
+ * contract: unchanged items must serialize byte-identical so diffs stay minimal
+ * and no-op mutations produce zero writes.
+ */
+
+import { dump, load } from "js-yaml"
+import type {
+    Collection,
+    CollectionFolder,
+    CollectionRequest,
+    KeyValueItem,
+} from "@/components/api-client/types"
+
+export const MANIFEST_FILE = "collection.yaml"
+export const FOLDER_META_FILE = "folder.yaml"
+export const FORMAT_VERSION = 1
+
+const MANIFEST_HEADER =
+    "# MyDevTools API collection — safe to commit.\n" +
+    "# Secrets are never stored here: {{vault.*}} / {{env.*}} tokens resolve\n" +
+    "# from the local encrypted vault at send time.\n"
+
+export interface FileEntry {
+    /** Forward-slash relative path inside the collection folder. */
+    relPath: string
+    content: string
+}
+
+// Fixed top-level key order; nested/unknown keys sort alphabetically after.
+const KEY_ORDER = [
+    "formatVersion", "id", "name", "kind", "method", "url",
+    "params", "headers", "body", "auth",
+    "defaultHeaders", "defaultAuth",
+    "timeoutMs", "useCookieJar",
+    "preRequestScript", "testScript",
+    "websocket", "grpc", "examples",
+]
+
+function dumpYaml(obj: object): string {
+    return dump(obj, {
+        noRefs: true,
+        lineWidth: -1,
+        sortKeys: (a: string, b: string) => {
+            const ia = KEY_ORDER.indexOf(a)
+            const ib = KEY_ORDER.indexOf(b)
+            if (ia !== -1 && ib !== -1) return ia - ib
+            if (ia !== -1) return -1
+            if (ib !== -1) return 1
+            return a.localeCompare(b)
+        },
+    })
+}
+
+function newId(): string {
+    if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+        return crypto.randomUUID()
+    }
+    return `id-${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`
+}
+
+/** Drop undefined/null and empty arrays/objects, recursively. */
+function prune<T>(value: T): T | undefined {
+    if (value === undefined || value === null) return undefined
+    if (Array.isArray(value)) {
+        return value.length === 0 ? undefined : (value.map((v) => prune(v)) as unknown as T)
+    }
+    if (typeof value === "object") {
+        const out: Record<string, unknown> = {}
+        for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+            const p = prune(v)
+            if (p !== undefined) out[k] = p
+        }
+        return Object.keys(out).length === 0 ? undefined : (out as T)
+    }
+    return value
+}
+
+/** KeyValueItem without the churn-only `id` (regenerated on load). */
+function stripKvIds(items: KeyValueItem[] | undefined) {
+    if (!items || items.length === 0) return undefined
+    return items.map(({ key, value, active }) => ({ key, value, active }))
+}
+
+function restoreKvIds(items: Array<Partial<KeyValueItem>> | undefined): KeyValueItem[] {
+    if (!Array.isArray(items)) return []
+    return items.map((i) => ({
+        id: newId(),
+        key: typeof i.key === "string" ? i.key : "",
+        value: typeof i.value === "string" ? i.value : "",
+        active: i.active !== false,
+    }))
+}
+
+export function slugify(name: string): string {
+    const slug = name
+        .toLowerCase()
+        .normalize("NFKD")
+        .replace(/[̀-ͯ]/g, "")
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 60)
+    return slug || "item"
+}
+
+function isFolder(item: CollectionFolder | CollectionRequest): item is CollectionFolder {
+    return "type" in item && item.type === "folder"
+}
+
+// ── Serialize ──────────────────────────────────────────────────────────────
+
+function serializeRequestObj(req: CollectionRequest): object {
+    const body = req.body
+        ? {
+              ...req.body,
+              formData: req.body.formData?.map(({ id: _id, ...rest }) => rest),
+              urlEncoded: req.body.urlEncoded
+                  ? stripKvIds(req.body.urlEncoded as KeyValueItem[])
+                  : undefined,
+          }
+        : undefined
+    const cleaned = {
+        id: req.id,
+        name: req.name,
+        kind: req.kind === "rest" ? undefined : req.kind,
+        method: req.method,
+        url: req.url,
+        params: stripKvIds(req.params),
+        headers: stripKvIds(req.headers),
+        body: body?.type === "none" ? undefined : body,
+        auth: req.auth?.type === "none" ? undefined : req.auth,
+        timeoutMs: req.timeoutMs,
+        useCookieJar: req.useCookieJar === false ? false : undefined,
+        preRequestScript: req.preRequestScript || undefined,
+        testScript: req.testScript || undefined,
+        // Runtime noise stripped from websocket/grpc; graphqlSchema (introspection
+        // cache) and comments (author/timestamps) are omitted entirely in v1.
+        websocket: req.websocket
+            ? { draft: req.websocket.draft || undefined, protocols: req.websocket.protocols || undefined }
+            : undefined,
+        grpc: req.grpc
+            ? {
+                  protoSource: req.grpc.protoSource || undefined,
+                  selectedPath: req.grpc.selectedPath,
+                  requestJson: req.grpc.requestJson || undefined,
+                  useTextFormat: req.grpc.useTextFormat || undefined,
+                  transport: req.grpc.transport,
+                  extraRequestMessages: req.grpc.extraRequestMessages,
+              }
+            : undefined,
+        examples: req.examples,
+    }
+    return prune(cleaned) ?? { id: req.id, name: req.name }
+}
+
+function serializeFolderMeta(folder: CollectionFolder): object {
+    const cleaned = {
+        id: folder.id,
+        name: folder.name,
+        defaultHeaders: stripKvIds(folder.defaultHeaders),
+        defaultAuth: folder.defaultAuth?.type === "none" ? undefined : folder.defaultAuth,
+        preRequestScript: folder.preRequestScript || undefined,
+        testScript: folder.testScript || undefined,
+    }
+    return prune(cleaned) ?? { id: folder.id, name: folder.name }
+}
+
+/** `NNN-slug` — the index prefix alone guarantees sibling uniqueness. */
+function childName(index: number, name: string): string {
+    return `${String(index + 1).padStart(3, "0")}-${slugify(name)}`
+}
+
+/** Full desired file set for a collection (manifest included). */
+export function serializeCollection(col: Collection): FileEntry[] {
+    const entries: FileEntry[] = [
+        {
+            relPath: MANIFEST_FILE,
+            content:
+                MANIFEST_HEADER +
+                dumpYaml({ formatVersion: FORMAT_VERSION, id: col.id, name: col.name }),
+        },
+    ]
+    const walk = (items: (CollectionFolder | CollectionRequest)[], dir: string) => {
+        items.forEach((item, i) => {
+            const name = childName(i, item.name)
+            if (isFolder(item)) {
+                const folderDir = dir ? `${dir}/${name}` : name
+                entries.push({
+                    relPath: `${folderDir}/${FOLDER_META_FILE}`,
+                    content: dumpYaml(serializeFolderMeta(item)),
+                })
+                walk(item.items, folderDir)
+            } else {
+                entries.push({
+                    relPath: dir ? `${dir}/${name}.yaml` : `${name}.yaml`,
+                    content: dumpYaml(serializeRequestObj(item)),
+                })
+            }
+        })
+    }
+    walk(col.items, "")
+    return entries
+}
+
+// ── Parse ──────────────────────────────────────────────────────────────────
+
+function loadYaml(entry: FileEntry, warnings: string[]): Record<string, unknown> | null {
+    try {
+        const doc = load(entry.content)
+        if (doc && typeof doc === "object" && !Array.isArray(doc)) {
+            return doc as Record<string, unknown>
+        }
+        warnings.push(`${entry.relPath}: not a YAML mapping — skipped`)
+        return null
+    } catch {
+        warnings.push(`${entry.relPath}: invalid YAML — skipped`)
+        return null
+    }
+}
+
+/** Strip the NNN- order prefix and .yaml suffix for name fallbacks. */
+function nameFromFileName(fileName: string): string {
+    return fileName.replace(/\.yaml$/, "").replace(/^\d+-/, "")
+}
+
+function parseRequest(
+    doc: Record<string, unknown>,
+    relPath: string,
+): CollectionRequest {
+    const body = (doc.body as CollectionRequest["body"] | undefined) ?? {
+        type: "none" as const,
+        content: "",
+    }
+    if (body.formData) {
+        body.formData = body.formData.map((f) => ({ ...f, id: newId() }))
+    }
+    if (body.urlEncoded) {
+        body.urlEncoded = restoreKvIds(body.urlEncoded)
+    }
+    return {
+        // Path-derived fallback id is deterministic so reloads don't churn React keys.
+        id: typeof doc.id === "string" ? doc.id : `path:${relPath}`,
+        name: typeof doc.name === "string" ? doc.name : nameFromFileName(relPath.split("/").pop() ?? relPath),
+        kind: doc.kind as CollectionRequest["kind"],
+        method: (doc.method as CollectionRequest["method"]) ?? "GET",
+        url: typeof doc.url === "string" ? doc.url : "",
+        params: restoreKvIds(doc.params as KeyValueItem[]),
+        headers: restoreKvIds(doc.headers as KeyValueItem[]),
+        body,
+        auth: (doc.auth as CollectionRequest["auth"]) ?? { type: "none" },
+        timeoutMs: doc.timeoutMs as number | undefined,
+        useCookieJar: doc.useCookieJar === false ? false : undefined,
+        preRequestScript: doc.preRequestScript as string | undefined,
+        testScript: doc.testScript as string | undefined,
+        websocket: doc.websocket
+            ? { status: "idle", messages: [], draft: "", ...(doc.websocket as object) }
+            : undefined,
+        grpc: doc.grpc
+            ? { protoSource: "", requestJson: "", ...(doc.grpc as object) }
+            : undefined,
+        examples: doc.examples as CollectionRequest["examples"],
+    }
+}
+
+interface DirNode {
+    folder: CollectionFolder
+    /** sibling sort key = source file/dir name (NNN- prefix orders it) */
+    children: Array<{ sortKey: string; item: CollectionFolder | CollectionRequest }>
+    childDirs: Map<string, DirNode>
+    hasMeta: boolean
+}
+
+export interface ParsedCollection {
+    collection: Collection
+    warnings: string[]
+}
+
+/**
+ * Rebuild a Collection from scanned files. Tolerant: garbage files are skipped
+ * with a warning, missing folder.yaml gets path-derived identity. Throws only
+ * when the manifest is missing/unreadable (not a collection folder).
+ */
+export function parseCollection(entries: FileEntry[]): ParsedCollection {
+    const warnings: string[] = []
+    const manifestEntry = entries.find((e) => e.relPath === MANIFEST_FILE)
+    if (!manifestEntry) throw new Error("missing-manifest")
+    const manifest = loadYaml(manifestEntry, warnings)
+    if (!manifest) throw new Error("missing-manifest")
+
+    const root: DirNode = {
+        folder: { id: "root", name: "", type: "folder", items: [] },
+        children: [],
+        childDirs: new Map(),
+        hasMeta: true,
+    }
+
+    const dirNode = (segments: string[]): DirNode => {
+        let node = root
+        let path = ""
+        for (const seg of segments) {
+            path = path ? `${path}/${seg}` : seg
+            let child = node.childDirs.get(seg)
+            if (!child) {
+                child = {
+                    folder: {
+                        id: `path:${path}`,
+                        name: nameFromFileName(seg),
+                        type: "folder",
+                        items: [],
+                        isOpen: false,
+                    },
+                    children: [],
+                    childDirs: new Map(),
+                    hasMeta: false,
+                }
+                node.childDirs.set(seg, child)
+                node.children.push({ sortKey: seg, item: child.folder })
+            }
+            node = child
+        }
+        return node
+    }
+
+    for (const entry of entries) {
+        if (entry.relPath === MANIFEST_FILE) continue
+        if (!entry.relPath.endsWith(".yaml")) continue
+        const segments = entry.relPath.split("/")
+        const fileName = segments.pop() as string
+        const node = dirNode(segments)
+        if (fileName === FOLDER_META_FILE) {
+            const doc = loadYaml(entry, warnings)
+            if (doc) {
+                node.hasMeta = true
+                const f = node.folder
+                if (typeof doc.id === "string") f.id = doc.id
+                if (typeof doc.name === "string") f.name = doc.name
+                if (Array.isArray(doc.defaultHeaders)) f.defaultHeaders = restoreKvIds(doc.defaultHeaders)
+                if (doc.defaultAuth) f.defaultAuth = doc.defaultAuth as CollectionFolder["defaultAuth"]
+                if (typeof doc.preRequestScript === "string") f.preRequestScript = doc.preRequestScript
+                if (typeof doc.testScript === "string") f.testScript = doc.testScript
+            }
+            continue
+        }
+        const doc = loadYaml(entry, warnings)
+        if (!doc) continue
+        node.children.push({
+            sortKey: fileName,
+            item: parseRequest(doc, entry.relPath),
+        })
+    }
+
+    const finalize = (node: DirNode): (CollectionFolder | CollectionRequest)[] => {
+        node.children.sort((a, b) => a.sortKey.localeCompare(b.sortKey, "en", { numeric: true }))
+        for (const dir of node.childDirs.values()) {
+            dir.folder.items = finalize(dir)
+        }
+        return node.children.map((c) => c.item)
+    }
+
+    return {
+        collection: {
+            id: typeof manifest.id === "string" ? manifest.id : `path:${MANIFEST_FILE}`,
+            name: typeof manifest.name === "string" ? manifest.name : "Untitled",
+            items: finalize(root),
+        },
+        warnings,
+    }
+}
+
+// ── Diff ───────────────────────────────────────────────────────────────────
+
+export interface FileDiff {
+    writes: FileEntry[]
+    deletes: string[]
+}
+
+/** Changed/new files to write, vanished paths to delete. */
+export function diffFiles(prev: FileEntry[], next: FileEntry[]): FileDiff {
+    const prevByPath = new Map(prev.map((e) => [e.relPath, e.content]))
+    const nextPaths = new Set(next.map((e) => e.relPath))
+    return {
+        writes: next.filter((e) => prevByPath.get(e.relPath) !== e.content),
+        deletes: prev.filter((e) => !nextPaths.has(e.relPath)).map((e) => e.relPath),
+    }
+}
+
+/** Manifest for a brand-new collection folder. */
+export function newManifest(name: string): { id: string; content: string } {
+    const id = newId()
+    return {
+        id,
+        content: MANIFEST_HEADER + dumpYaml({ formatVersion: FORMAT_VERSION, id, name }),
+    }
+}
diff --git a/apps/desktop-ui/src/lib/desktop/collection-files.ts b/apps/desktop-ui/src/lib/desktop/collection-files.ts
new file mode 100644
index 00000000..c4ae126b
--- /dev/null
+++ b/apps/desktop-ui/src/lib/desktop/collection-files.ts
@@ -0,0 +1,88 @@
+/**
+ * Tauri fs/dialog access for file-backed (git-friendly) API-client collections.
+ * Only ever called behind `isDesktop()`; plugins are imported dynamically so web
+ * bundles never pull them in (same pattern as bridge.ts).
+ */
+
+import type { FileEntry } from "@/lib/api-client/file-store"
+
+const MAX_DEPTH = 10
+const MAX_FILE_BYTES = 1024 * 1024
+
+function assertSafeRelPath(relPath: string): void {
+    if (relPath.startsWith("/") || relPath.split("/").some((s) => s === ".." || s === "")) {
+        throw new Error(`unsafe path: ${relPath}`)
+    }
+}
+
+/** Recursive fs-scope grant for a collection dir — required before any read/write in it. */
+export async function allowCollectionDir(absPath: string): Promise<void> {
+    const { invoke } = await import("@tauri-apps/api/core")
+    await invoke("fs_allow_collection_dir", { path: absPath })
+}
+
+/** Native folder picker. Resolves null when the user cancels. */
+export async function pickFolder(): Promise<string | null> {
+    const { open } = await import("@tauri-apps/plugin-dialog")
+    const picked = await open({ directory: true })
+    if (typeof picked !== "string") return null
+    await allowCollectionDir(picked)
+    return picked
+}
+
+/** All `*.yaml` files under `root` (skips dotfiles/dirs like `.git`). */
+export async function readCollectionFiles(root: string): Promise<FileEntry[]> {
+    const fs = await import("@tauri-apps/plugin-fs")
+    const entries: FileEntry[] = []
+    const walk = async (dirRel: string, depth: number): Promise<void> => {
+        if (depth > MAX_DEPTH) return
+        const dirAbs = dirRel ? `${root}/${dirRel}` : root
+        for (const entry of await fs.readDir(dirAbs)) {
+            if (entry.name.startsWith(".")) continue
+            const rel = dirRel ? `${dirRel}/${entry.name}` : entry.name
+            if (entry.isDirectory) {
+                await walk(rel, depth + 1)
+            } else if (entry.isFile && entry.name.endsWith(".yaml")) {
+                const content = await fs.readTextFile(`${root}/${rel}`)
+                if (content.length <= MAX_FILE_BYTES) entries.push({ relPath: rel, content })
+            }
+        }
+    }
+    await walk("", 0)
+    return entries
+}
+
+/** Apply a diff: write changed files (creating dirs), delete vanished ones, prune empty dirs. */
+export async function writeCollectionFiles(
+    root: string,
+    writes: FileEntry[],
+    deletes: string[],
+): Promise<void> {
+    const fs = await import("@tauri-apps/plugin-fs")
+    for (const w of writes) {
+        assertSafeRelPath(w.relPath)
+        const dir = w.relPath.split("/").slice(0, -1).join("/")
+        if (dir) await fs.mkdir(`${root}/${dir}`, { recursive: true })
+        await fs.writeTextFile(`${root}/${w.relPath}`, w.content)
+    }
+    const dirsToPrune = new Set<string>()
+    for (const relPath of deletes) {
+        assertSafeRelPath(relPath)
+        try {
+            await fs.remove(`${root}/${relPath}`)
+        } catch {
+            // Already gone (e.g. deleted externally) — the goal state holds.
+        }
+        for (let segs = relPath.split("/").slice(0, -1); segs.length > 0; segs.pop()) {
+            dirsToPrune.add(segs.join("/"))
+        }
+    }
+    // Deepest first; non-recursive remove fails on non-empty dirs, which is the point.
+    for (const dir of [...dirsToPrune].sort((a, b) => b.split("/").length - a.split("/").length)) {
+        try {
+            await fs.remove(`${root}/${dir}`)
+        } catch {
+            // Not empty (or already gone) — leave it.
+        }
+    }
+}
diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
index 3ffdac30..4e526406 100644
--- a/apps/desktop/src-tauri/Cargo.lock
+++ b/apps/desktop/src-tauri/Cargo.lock
@@ -274,6 +274,15 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -2914,7 +2923,10 @@ dependencies = [
  "tauri",
  "tauri-build",
  "tauri-plugin-deep-link",
+ "tauri-plugin-dialog",
+ "tauri-plugin-fs",
  "tauri-plugin-opener",
+ "tauri-plugin-persisted-scope",
  "tauri-plugin-process",
  "tauri-plugin-updater",
  "tauri-plugin-window-state",
@@ -4141,6 +4153,30 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
 
+[[package]]
+name = "rfd"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a15ad77d9e70a92437d8f74c35d99b4e4691128df018833e99f90bcd36152672"
+dependencies = [
+ "block2",
+ "dispatch2",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "js-sys",
+ "log",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "raw-window-handle",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -5188,6 +5224,48 @@ dependencies = [
  "windows-result 0.3.4",
 ]
 
+[[package]]
+name = "tauri-plugin-dialog"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2d3c1dbe38037e7f590cdf2492594d5ceebe031e7bc7e827509b22a999d2940"
+dependencies = [
+ "log",
+ "raw-window-handle",
+ "rfd",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-plugin-fs",
+ "thiserror 2.0.18",
+ "url",
+]
+
+[[package]]
+name = "tauri-plugin-fs"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7ecc274121aca0c036a2b42d1cbe83d368d348f54e0bb8a735c2b1548e8f371"
+dependencies = [
+ "anyhow",
+ "dunce",
+ "glob",
+ "log",
+ "objc2-foundation",
+ "percent-encoding",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "tauri",
+ "tauri-plugin",
+ "tauri-utils",
+ "thiserror 2.0.18",
+ "toml 1.1.2+spec-1.1.0",
+ "url",
+]
+
 [[package]]
 name = "tauri-plugin-opener"
 version = "2.5.4"
@@ -5210,6 +5288,22 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "tauri-plugin-persisted-scope"
+version = "2.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b560a5962bf975d38fb4ec98a0e64e52929992ec708acb812add9c1ab8d186d"
+dependencies = [
+ "aho-corasick",
+ "bincode",
+ "log",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin-fs",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "tauri-plugin-process"
 version = "2.3.1"
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index ecc2c2d1..fc1a91a5 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -26,7 +26,10 @@ base64 = "0.22"
 reqwest_cookie_store = "0.8"
 cookie_store = "0.21"
 tauri-plugin-deep-link = "2"
+tauri-plugin-dialog = "2"
+tauri-plugin-fs = "2"
 tauri-plugin-opener = "2"
+tauri-plugin-persisted-scope = "2"
 tauri-plugin-window-state = "2"
 tauri-plugin-updater = "2"
 tauri-plugin-process = "2"
diff --git a/apps/desktop/src-tauri/capabilities/default.json b/apps/desktop/src-tauri/capabilities/default.json
index d1318d7f..af249b6b 100644
--- a/apps/desktop/src-tauri/capabilities/default.json
+++ b/apps/desktop/src-tauri/capabilities/default.json
@@ -3,5 +3,20 @@
   "identifier": "default",
   "description": "Default capability for the main window",
   "windows": ["main"],
-  "permissions": ["core:default", "core:window:allow-start-dragging", "core:window:allow-is-fullscreen", "deep-link:default", "opener:default", "updater:default", "process:default"]
+  "permissions": [
+    "core:default",
+    "core:window:allow-start-dragging",
+    "core:window:allow-is-fullscreen",
+    "deep-link:default",
+    "opener:default",
+    "updater:default",
+    "process:default",
+    "dialog:allow-open",
+    "fs:allow-read-text-file",
+    "fs:allow-write-text-file",
+    "fs:allow-read-dir",
+    "fs:allow-mkdir",
+    "fs:allow-remove",
+    "fs:allow-exists"
+  ]
 }
diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs
index 4edf1cc8..d94e8fdf 100644
--- a/apps/desktop/src-tauri/src/lib.rs
+++ b/apps/desktop/src-tauri/src/lib.rs
@@ -70,6 +70,17 @@ async fn proxy_grpc(input: serde_json::Value) -> Result<serde_json::Value, Strin
     Ok(http::grpc::proxy_grpc(input).await)
 }
 
+/// Recursively allow a folder-collection dir in the fs scope. The dialog plugin
+/// only scopes the picked path itself; files inside it (and registered dirs on
+/// relaunch) need an explicit recursive grant.
+#[tauri::command]
+fn fs_allow_collection_dir(app: tauri::AppHandle, path: String) -> Result<(), String> {
+    use tauri_plugin_fs::FsExt;
+    app.fs_scope()
+        .allow_directory(std::path::Path::new(&path), true)
+        .map_err(|e| e.to_string())
+}
+
 #[tauri::command]
 async fn await_browser_auth(
     port_channel: tauri::ipc::Channel<serde_json::Value>,
@@ -80,6 +91,11 @@ async fn await_browser_auth(
 pub fn run() {
     tauri::Builder::default()
         .plugin(tauri_plugin_deep_link::init())
+        .plugin(tauri_plugin_dialog::init())
+        .plugin(tauri_plugin_fs::init())
+        // Folder-collection dirs picked via the dialog are added to the fs scope
+        // at runtime; persisted-scope keeps them allowed across restarts.
+        .plugin(tauri_plugin_persisted_scope::init())
         .plugin(tauri_plugin_opener::init())
         // Restore everything except SIZE. Sizes are saved in physical pixels, so
         // a size saved on a HiDPI (scale-2) display restores 2x too large on a
@@ -130,6 +146,7 @@ pub fn run() {
             http_request_stream_cancel,
             mock_server_start,
             proxy_grpc,
+            fs_allow_collection_dir,
             await_browser_auth
         ])
         .run(tauri::generate_context!())

From b407adc2a3c7f39c56da4914ee8aacc353fe4a52 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Wed, 22 Jul 2026 13:24:24 +0530
Subject: [PATCH 02/39] UI

---
 .../api-client/collections/use-collections.ts |  82 +++++++----
 .../api-client/__tests__/file-store.test.ts   |  76 ++++++++++
 .../__tests__/move-to-vault.test.ts           |  95 ++++++++++++
 .../src/lib/api-client/file-store.ts          |  78 +++++++++-
 .../src/lib/api-client/move-to-vault.ts       | 138 ++++++++++++++++++
 .../src/lib/desktop/collection-files.ts       |  39 +++++
 apps/desktop/src-tauri/src/lib.rs             |  25 ++++
 7 files changed, 506 insertions(+), 27 deletions(-)
 create mode 100644 apps/desktop-ui/src/lib/api-client/__tests__/move-to-vault.test.ts
 create mode 100644 apps/desktop-ui/src/lib/api-client/move-to-vault.ts

diff --git a/apps/desktop-ui/src/components/api-client/collections/use-collections.ts b/apps/desktop-ui/src/components/api-client/collections/use-collections.ts
index 413a5d2d..04eebc9b 100644
--- a/apps/desktop-ui/src/components/api-client/collections/use-collections.ts
+++ b/apps/desktop-ui/src/components/api-client/collections/use-collections.ts
@@ -8,29 +8,16 @@ import { useAuthState } from "react-firebase-hooks/auth"
 import { backendFetch } from "@/lib/backend-auth"
 import { broadcastApiClientUpdate, useApiClientSyncListener } from "@/lib/api-client-sync"
 import { isDesktop } from "@/lib/desktop/is-desktop"
-import { diffFiles, newManifest, parseCollection, serializeCollection, MANIFEST_FILE } from "@/lib/api-client/file-store"
+import { countLiteralAuthSecrets, diffFiles, newManifest, parseCollection, serializeCollection, MANIFEST_FILE } from "@/lib/api-client/file-store"
+import { moveCollectionSecretsToVault } from "@/lib/api-client/move-to-vault"
+import { useCipherKey } from "@/lib/use-cipher-key"
 
 const STORAGE_KEY = "api-client-collections"
-/** Registered folder-collection paths (desktop only — paths are machine-local). */
-const FILE_REGISTRY_KEY = "api-client-file-collections"
 
 function sortCollections(cols: Collection[]) {
     return [...cols].sort((a, b) => a.name.localeCompare(b.name))
 }
 
-function readFileRegistry(): string[] {
-    try {
-        const parsed = JSON.parse(localStorage.getItem(FILE_REGISTRY_KEY) ?? "[]")
-        return Array.isArray(parsed) ? parsed.filter((p): p is string => typeof p === "string") : []
-    } catch {
-        return []
-    }
-}
-
-function writeFileRegistry(paths: string[]) {
-    localStorage.setItem(FILE_REGISTRY_KEY, JSON.stringify(paths))
-}
-
 /** Carry UI-only open/closed state (stripped from disk) across reloads, by folder id. */
 function applyOpenState(prev: Collection | undefined, next: Collection): Collection {
     if (!prev) return next
@@ -61,6 +48,12 @@ export function useCollections() {
     const migrationRanRef = React.useRef(false)
     /** Paths already toasted about, so a failing folder doesn't re-toast on every window focus. */
     const failedFilePathsRef = React.useRef(new Set<string>())
+    /** Collections already warned about literal credentials — once per session is enough. */
+    const secretWarnedRef = React.useRef(new Set<string>())
+    const cipherKey = useCipherKey()
+    // Latest file collections for toast-action callbacks (they outlive the closing render).
+    const fileCollectionsRef = React.useRef(fileCollections)
+    fileCollectionsRef.current = fileCollections
 
     // DB collections + folder-backed collections, one list for consumers.
     const allCollections = React.useMemo(
@@ -71,12 +64,14 @@ export function useCollections() {
     /** (Re-)read every registered folder collection from disk. Desktop only. */
     const reloadFileCollections = React.useCallback(async () => {
         if (!isDesktop()) return
-        const paths = readFileRegistry()
+        const { readCollectionFiles, allowCollectionDir, loadCollectionRegistry } = await import(
+            "@/lib/desktop/collection-files"
+        )
+        const paths = await loadCollectionRegistry()
         if (paths.length === 0) {
             setFileCollections((cur) => (cur.length === 0 ? cur : []))
             return
         }
-        const { readCollectionFiles, allowCollectionDir } = await import("@/lib/desktop/collection-files")
         const loaded: Collection[] = []
         for (const path of paths) {
             try {
@@ -121,6 +116,22 @@ export function useCollections() {
     ): Promise<boolean> => {
         const next = { ...target, ...patch, items: nextItems }
         setFileCollections((cur) => cur.map((c) => (c.id === target.id ? next : c)))
+        // Literal credentials are redacted by the serializer (never written to git-able
+        // files) — tell the user once so a "missing" token isn't a mystery, and offer
+        // to move them into the encrypted vault (rewrites fields to {{vault.*}} tokens).
+        if (!secretWarnedRef.current.has(target.id) && countLiteralAuthSecrets(next) > 0) {
+            secretWarnedRef.current.add(target.id)
+            toast.warning(
+                "Credentials typed directly are not saved into collection files — keep them in the encrypted vault as {{vault.NAME}} tokens",
+                {
+                    duration: 10000,
+                    action: {
+                        label: "Move to vault",
+                        onClick: () => void moveFileCollectionSecrets(target.id),
+                    },
+                }
+            )
+        }
         try {
             const { writes, deletes } = diffFiles(serializeCollection(target), serializeCollection(next))
             if (writes.length > 0 || deletes.length > 0) {
@@ -136,6 +147,26 @@ export function useCollections() {
         }
     }
 
+    /** Toast action: move every literal credential in a folder collection into the vault. */
+    const moveFileCollectionSecrets = async (collectionId: string) => {
+        const target = fileCollectionsRef.current.find((c) => c.id === collectionId)
+        if (!target) return
+        try {
+            const { collection: moved, moved: count } = await moveCollectionSecretsToVault(target, cipherKey)
+            if (count === 0) return
+            if (await mutateFileCollection(target, moved.items)) {
+                toast.success(
+                    count === 1
+                        ? "1 credential moved to the vault"
+                        : `${count} credentials moved to the vault`
+                )
+            }
+        } catch (e) {
+            console.error("Error moving credentials to vault", e)
+            toast.error(e instanceof Error ? e.message : "Failed to move credentials to the vault")
+        }
+    }
+
     React.useEffect(() => {
         if (!user) migrationRanRef.current = false
     }, [user])
@@ -325,7 +356,8 @@ export function useCollections() {
         // Deleting a folder collection = forget it, never touch the user's files.
         const fileCol = fileCollections.find((c) => c.id === itemId)
         if (fileCol?.source) {
-            writeFileRegistry(readFileRegistry().filter((p) => p !== fileCol.source!.path))
+            const { loadCollectionRegistry, saveCollectionRegistry } = await import("@/lib/desktop/collection-files")
+            await saveCollectionRegistry((await loadCollectionRegistry()).filter((p) => p !== fileCol.source!.path))
             setFileCollections((cur) => cur.filter((c) => c.id !== itemId))
             toast.success("Folder collection removed from list (files kept)")
             return
@@ -705,7 +737,8 @@ export function useCollections() {
             const removedPaths = new Set(
                 fileCollections.filter((c) => fileIds.has(c.id)).map((c) => c.source!.path)
             )
-            writeFileRegistry(readFileRegistry().filter((p) => !removedPaths.has(p)))
+            const { loadCollectionRegistry, saveCollectionRegistry } = await import("@/lib/desktop/collection-files")
+            await saveCollectionRegistry((await loadCollectionRegistry()).filter((p) => !removedPaths.has(p)))
             setFileCollections((cur) => cur.filter((c) => !fileIds.has(c.id)))
             ids = ids.filter((id) => !fileIds.has(id))
             if (ids.length === 0) {
@@ -781,13 +814,12 @@ export function useCollections() {
     const openFolderCollection = async (): Promise<Collection | null> => {
         if (!isDesktop()) return null
         try {
-            const { pickFolder, readCollectionFiles, writeCollectionFiles } = await import(
-                "@/lib/desktop/collection-files"
-            )
+            const { pickFolder, readCollectionFiles, writeCollectionFiles, loadCollectionRegistry, saveCollectionRegistry } =
+                await import("@/lib/desktop/collection-files")
             const path = await pickFolder()
             if (!path) return null
 
-            const registry = readFileRegistry()
+            const registry = await loadCollectionRegistry()
             if (registry.includes(path)) {
                 toast.info("This folder collection is already open")
                 return fileCollections.find((c) => c.source?.path === path) ?? null
@@ -806,7 +838,7 @@ export function useCollections() {
                 col = { id: manifest.id, name, items: [], source: { kind: "file", path } }
             }
 
-            writeFileRegistry([...registry, path])
+            await saveCollectionRegistry([...registry, path])
             setFileCollections((cur) => [...cur.filter((c) => c.id !== col.id), col])
             toast.success(`Opened folder collection "${col.name}"`)
             return col
diff --git a/apps/desktop-ui/src/lib/api-client/__tests__/file-store.test.ts b/apps/desktop-ui/src/lib/api-client/__tests__/file-store.test.ts
index 07f8e0a9..f7d376ed 100644
--- a/apps/desktop-ui/src/lib/api-client/__tests__/file-store.test.ts
+++ b/apps/desktop-ui/src/lib/api-client/__tests__/file-store.test.ts
@@ -1,4 +1,5 @@
 import {
+    countLiteralAuthSecrets,
     diffFiles,
     parseCollection,
     serializeCollection,
@@ -86,6 +87,81 @@ describe("file-store", () => {
         expect(all).toContain("{{vault.apiToken}}")
     })
 
+    test("literal credentials are redacted; vault tokens and non-secret fields survive", () => {
+        const col: Collection = {
+            id: "c",
+            name: "c",
+            items: [
+                request({
+                    id: "r1",
+                    name: "AWS",
+                    auth: {
+                        type: "aws-sigv4",
+                        awsSigV4: {
+                            accessKeyId: "AKIA123",
+                            secretAccessKey: "SUPER-SECRET-LITERAL",
+                            region: "us-east-1",
+                            service: "s3",
+                        },
+                    },
+                }),
+                request({
+                    id: "r2",
+                    name: "Bearer literal",
+                    auth: { type: "bearer", token: "eyJhbGciOi-literal-jwt" },
+                }),
+                request({
+                    id: "r3",
+                    name: "Bearer vaulted",
+                    auth: { type: "bearer", token: "{{vault.apiToken}}" },
+                }),
+                request({
+                    id: "r4",
+                    name: "OAuth",
+                    auth: {
+                        type: "oauth2",
+                        oauth2: {
+                            grantType: "client_credentials",
+                            tokenUrl: "https://idp/token",
+                            clientId: "public-client-id",
+                            clientSecret: "literal-client-secret",
+                            accessToken: "cached-access-token",
+                        },
+                    },
+                }),
+            ],
+        }
+        const all = serializeCollection(col).map((f) => f.content).join("\n")
+        expect(all).not.toContain("SUPER-SECRET-LITERAL")
+        expect(all).not.toContain("eyJhbGciOi-literal-jwt")
+        expect(all).not.toContain("literal-client-secret")
+        expect(all).not.toContain("cached-access-token")
+        expect(all).toContain("AKIA123") // access key id is not the secret half
+        expect(all).toContain("public-client-id")
+        expect(all).toContain("{{vault.apiToken}}")
+        expect(countLiteralAuthSecrets(col)).toBe(3)
+    })
+
+    test("folder defaultAuth is redacted too", () => {
+        const col: Collection = {
+            id: "c",
+            name: "c",
+            items: [
+                {
+                    id: "f",
+                    name: "F",
+                    type: "folder",
+                    items: [],
+                    defaultAuth: { type: "basic", username: "bob", password: "hunter2" },
+                },
+            ],
+        }
+        const all = serializeCollection(col).map((f) => f.content).join("\n")
+        expect(all).not.toContain("hunter2")
+        expect(all).toContain("bob")
+        expect(countLiteralAuthSecrets(col)).toBe(1)
+    })
+
     test("isOpen and KeyValueItem ids never reach disk", () => {
         const all = serializeCollection(collection()).map((f) => f.content).join("\n")
         expect(all).not.toContain("isOpen")
diff --git a/apps/desktop-ui/src/lib/api-client/__tests__/move-to-vault.test.ts b/apps/desktop-ui/src/lib/api-client/__tests__/move-to-vault.test.ts
new file mode 100644
index 00000000..fd53400c
--- /dev/null
+++ b/apps/desktop-ui/src/lib/api-client/__tests__/move-to-vault.test.ts
@@ -0,0 +1,95 @@
+import { planVaultMoves } from "../move-to-vault"
+import type { Collection, CollectionFolder, CollectionRequest } from "@/components/api-client/types"
+
+const request = (over: Partial<CollectionRequest>): CollectionRequest => ({
+    id: "r",
+    name: "Req",
+    method: "GET",
+    url: "https://x",
+    params: [],
+    headers: [],
+    body: { type: "none", content: "" },
+    auth: { type: "none" },
+    ...over,
+})
+
+describe("planVaultMoves", () => {
+    test("rewrites literals to {{vault.*}} tokens and plans creates", () => {
+        const col: Collection = {
+            id: "c",
+            name: "c",
+            items: [
+                request({ id: "r1", name: "Login", auth: { type: "bearer", token: "literal-abc" } }),
+            ],
+        }
+        const plan = planVaultMoves(col, new Map())
+        expect(plan.moved).toBe(1)
+        expect(plan.creates).toEqual([{ name: "login-token", value: "literal-abc" }])
+        expect((plan.collection.items[0] as CollectionRequest).auth.token).toBe("{{vault.login-token}}")
+        // original untouched
+        expect((col.items[0] as CollectionRequest).auth.token).toBe("literal-abc")
+    })
+
+    test("reuses an existing vault entry holding the same value", () => {
+        const col: Collection = {
+            id: "c",
+            name: "c",
+            items: [request({ id: "r1", name: "Login", auth: { type: "bearer", token: "shared-secret" } })],
+        }
+        const plan = planVaultMoves(col, new Map([["prod-api-key", "shared-secret"]]))
+        expect(plan.creates).toEqual([])
+        expect(plan.moved).toBe(1)
+        expect((plan.collection.items[0] as CollectionRequest).auth.token).toBe("{{vault.prod-api-key}}")
+    })
+
+    test("suffixes when the name is taken by a different value; dedupes same value across requests", () => {
+        const col: Collection = {
+            id: "c",
+            name: "c",
+            items: [
+                request({ id: "r1", name: "Login", auth: { type: "bearer", token: "new-secret" } }),
+                request({ id: "r2", name: "Login", auth: { type: "bearer", token: "new-secret" } }),
+            ],
+        }
+        const plan = planVaultMoves(col, new Map([["login-token", "different-value"]]))
+        expect(plan.creates).toEqual([{ name: "login-token-2", value: "new-secret" }])
+        expect(plan.moved).toBe(2)
+        const tokens = plan.collection.items.map((i) => (i as CollectionRequest).auth.token)
+        expect(tokens).toEqual(["{{vault.login-token-2}}", "{{vault.login-token-2}}"])
+    })
+
+    test("covers folder defaultAuth and nested fields; leaves tokens alone", () => {
+        const folder: CollectionFolder = {
+            id: "f",
+            name: "AWS stuff",
+            type: "folder",
+            items: [
+                request({
+                    id: "r1",
+                    name: "S3",
+                    auth: {
+                        type: "aws-sigv4",
+                        awsSigV4: {
+                            accessKeyId: "AKIA1",
+                            secretAccessKey: "aws-literal",
+                            region: "us-east-1",
+                            service: "s3",
+                        },
+                    },
+                }),
+                request({ id: "r2", name: "Vaulted", auth: { type: "bearer", token: "{{vault.ok}}" } }),
+            ],
+            defaultAuth: { type: "basic", username: "bob", password: "hunter2" },
+        }
+        const col: Collection = { id: "c", name: "c", items: [folder] }
+        const plan = planVaultMoves(col, new Map())
+        expect(plan.creates.map((c) => c.name).sort()).toEqual(["aws-stuff-password", "s3-secretaccesskey"])
+        expect(plan.moved).toBe(2)
+        const outFolder = plan.collection.items[0] as CollectionFolder
+        expect(outFolder.defaultAuth?.password).toBe("{{vault.aws-stuff-password}}")
+        const s3 = outFolder.items[0] as CollectionRequest
+        expect(s3.auth.awsSigV4?.secretAccessKey).toBe("{{vault.s3-secretaccesskey}}")
+        expect(s3.auth.awsSigV4?.accessKeyId).toBe("AKIA1")
+        expect((outFolder.items[1] as CollectionRequest).auth.token).toBe("{{vault.ok}}")
+    })
+})
diff --git a/apps/desktop-ui/src/lib/api-client/file-store.ts b/apps/desktop-ui/src/lib/api-client/file-store.ts
index 4e1275e8..f5508bae 100644
--- a/apps/desktop-ui/src/lib/api-client/file-store.ts
+++ b/apps/desktop-ui/src/lib/api-client/file-store.ts
@@ -21,6 +21,7 @@ import type {
     CollectionFolder,
     CollectionRequest,
     KeyValueItem,
+    RequestAuth,
 } from "@/components/api-client/types"
 
 export const MANIFEST_FILE = "collection.yaml"
@@ -118,6 +119,79 @@ function isFolder(item: CollectionFolder | CollectionRequest): item is Collectio
     return "type" in item && item.type === "folder"
 }
 
+// ── Credential redaction ───────────────────────────────────────────────────
+// Files in a folder collection are meant for git. A `{{vault.*}}` / `{{env.*}}`
+// reference is safe to write (resolved from the encrypted vault at send time);
+// a literal credential is a leak. Literal values in the known-sensitive auth
+// fields below are therefore never serialized — structural, not advisory.
+
+/** `["awsSigV4", "secretAccessKey"]` = auth.awsSigV4.secretAccessKey. */
+export const SENSITIVE_AUTH_FIELDS: string[][] = [
+    ["token"],
+    ["password"],
+    ["apiKeyValue"],
+    ["awsSigV4", "secretAccessKey"],
+    ["awsSigV4", "sessionToken"],
+    ["hawk", "key"],
+    ["ntlm", "password"],
+    ["jwtBearer", "secret"],
+    ["jwtBearer", "privateKeyPem"],
+    ["digest", "password"],
+    ["spnego", "token"],
+    ["oauth2", "clientSecret"],
+    ["oauth2", "password"],
+]
+// OAuth2 token state is both secret and runtime — always stripped.
+const OAUTH2_TOKEN_STATE = ["accessToken", "refreshToken", "tokenType", "expiresAt"]
+
+/** A value referencing a vault/env variable is a pointer, not a secret. */
+export function isVariableReference(value: unknown): boolean {
+    return typeof value === "string" && value.includes("{{")
+}
+
+/** Copy of `auth` with literal credentials removed. Second value = how many were dropped. */
+function redactAuth(auth: RequestAuth | undefined): { auth: RequestAuth | undefined; redacted: number } {
+    if (!auth || auth.type === "none") return { auth, redacted: 0 }
+    const copy: Record<string, unknown> = JSON.parse(JSON.stringify(auth))
+    let redacted = 0
+    for (const path of SENSITIVE_AUTH_FIELDS) {
+        let parent = copy
+        for (const seg of path.slice(0, -1)) {
+            if (typeof parent[seg] !== "object" || parent[seg] === null) { parent = {}; break }
+            parent = parent[seg] as Record<string, unknown>
+        }
+        const leaf = path[path.length - 1]
+        const value = parent[leaf]
+        if (value !== undefined && value !== "" && !isVariableReference(value)) {
+            delete parent[leaf]
+            redacted++
+        }
+    }
+    if (typeof copy.oauth2 === "object" && copy.oauth2 !== null) {
+        for (const key of OAUTH2_TOKEN_STATE) {
+            delete (copy.oauth2 as Record<string, unknown>)[key]
+        }
+    }
+    return { auth: copy as unknown as RequestAuth, redacted }
+}
+
+/** Literal (non-`{{…}}`) credentials in the tree — what redaction WILL drop on write. */
+export function countLiteralAuthSecrets(col: Collection): number {
+    let count = 0
+    const visit = (items: (CollectionFolder | CollectionRequest)[]) => {
+        for (const item of items) {
+            if (isFolder(item)) {
+                count += redactAuth(item.defaultAuth).redacted
+                visit(item.items)
+            } else {
+                count += redactAuth(item.auth).redacted
+            }
+        }
+    }
+    visit(col.items)
+    return count
+}
+
 // ── Serialize ──────────────────────────────────────────────────────────────
 
 function serializeRequestObj(req: CollectionRequest): object {
@@ -139,7 +213,7 @@ function serializeRequestObj(req: CollectionRequest): object {
         params: stripKvIds(req.params),
         headers: stripKvIds(req.headers),
         body: body?.type === "none" ? undefined : body,
-        auth: req.auth?.type === "none" ? undefined : req.auth,
+        auth: req.auth?.type === "none" ? undefined : redactAuth(req.auth).auth,
         timeoutMs: req.timeoutMs,
         useCookieJar: req.useCookieJar === false ? false : undefined,
         preRequestScript: req.preRequestScript || undefined,
@@ -169,7 +243,7 @@ function serializeFolderMeta(folder: CollectionFolder): object {
         id: folder.id,
         name: folder.name,
         defaultHeaders: stripKvIds(folder.defaultHeaders),
-        defaultAuth: folder.defaultAuth?.type === "none" ? undefined : folder.defaultAuth,
+        defaultAuth: folder.defaultAuth?.type === "none" ? undefined : redactAuth(folder.defaultAuth).auth,
         preRequestScript: folder.preRequestScript || undefined,
         testScript: folder.testScript || undefined,
     }
diff --git a/apps/desktop-ui/src/lib/api-client/move-to-vault.ts b/apps/desktop-ui/src/lib/api-client/move-to-vault.ts
new file mode 100644
index 00000000..e6d8f84f
--- /dev/null
+++ b/apps/desktop-ui/src/lib/api-client/move-to-vault.ts
@@ -0,0 +1,138 @@
+/**
+ * "Move to vault": take literal credentials typed into request/folder auth
+ * fields of a folder collection and store them as API Key Vault entries,
+ * replacing each field value with a `{{vault.<name>}}` reference. The vault is
+ * E2E-encrypted; references are safe to serialize to git-able files (the
+ * serializer redacts literals, so moving is how a credential survives).
+ *
+ * `planVaultMoves` is pure (unit-testable); `moveCollectionSecretsToVault`
+ * wraps it with the encrypt/create IO.
+ */
+
+import type { Collection, CollectionFolder, CollectionRequest, RequestAuth } from "@/components/api-client/types"
+import { SENSITIVE_AUTH_FIELDS, isVariableReference, slugify } from "./file-store"
+
+export interface VaultMovePlan {
+    /** Entries to create: vault name → literal value. */
+    creates: Array<{ name: string; value: string }>
+    /** Tree with every moved field replaced by its `{{vault.<name>}}` token. */
+    collection: Collection
+    /** Total fields rewritten (creates + reuses of existing entries). */
+    moved: number
+}
+
+function getAt(obj: Record<string, unknown>, path: string[]): unknown {
+    let cur: unknown = obj
+    for (const seg of path) {
+        if (typeof cur !== "object" || cur === null) return undefined
+        cur = (cur as Record<string, unknown>)[seg]
+    }
+    return cur
+}
+
+function setAt(obj: Record<string, unknown>, path: string[], value: string): void {
+    let cur = obj
+    for (const seg of path.slice(0, -1)) {
+        cur = cur[seg] as Record<string, unknown>
+    }
+    cur[path[path.length - 1]] = value
+}
+
+/**
+ * Compute the moves. `existingByName` = already-decrypted vault entries
+ * (name → apiKey): an entry holding the same value is reused instead of
+ * duplicated; a taken name with a different value gets a `-2` suffix.
+ */
+export function planVaultMoves(
+    col: Collection,
+    existingByName: Map<string, string>,
+): VaultMovePlan {
+    const creates: Array<{ name: string; value: string }> = []
+    const plannedByName = new Map<string, string>()
+    let moved = 0
+
+    const vaultNameFor = (ownerName: string, field: string, value: string): string => {
+        // Same value already in the vault (or planned)? Reuse its name.
+        for (const [name, v] of existingByName) if (v === value) return name
+        for (const [name, v] of plannedByName) if (v === value) return name
+        const base = slugify(`${ownerName}-${field}`)
+        let candidate = base
+        for (let n = 2; existingByName.has(candidate) || plannedByName.has(candidate); n++) {
+            candidate = `${base}-${n}`
+        }
+        plannedByName.set(candidate, value)
+        creates.push({ name: candidate, value })
+        return candidate
+    }
+
+    const moveAuth = (auth: RequestAuth | undefined, ownerName: string): RequestAuth | undefined => {
+        if (!auth || auth.type === "none") return auth
+        const copy = JSON.parse(JSON.stringify(auth)) as Record<string, unknown>
+        let touched = false
+        for (const path of SENSITIVE_AUTH_FIELDS) {
+            const value = getAt(copy, path)
+            if (typeof value === "string" && value !== "" && !isVariableReference(value)) {
+                const name = vaultNameFor(ownerName, path[path.length - 1], value)
+                setAt(copy, path, `{{vault.${name}}}`)
+                touched = true
+                moved++
+            }
+        }
+        return touched ? (copy as unknown as RequestAuth) : auth
+    }
+
+    const visit = (items: (CollectionFolder | CollectionRequest)[]): (CollectionFolder | CollectionRequest)[] =>
+        items.map((item) => {
+            if ("type" in item && item.type === "folder") {
+                return { ...item, defaultAuth: moveAuth(item.defaultAuth, item.name), items: visit(item.items) }
+            }
+            const req = item as CollectionRequest
+            return { ...req, auth: moveAuth(req.auth, req.name) as CollectionRequest["auth"] }
+        })
+
+    return { creates, collection: { ...col, items: visit(col.items) }, moved }
+}
+
+/**
+ * Execute a move against the real vault. Reads existing entries (to reuse /
+ * avoid name collisions), creates the new ones, returns the rewritten tree.
+ * Throws with a user-facing message when the vault is locked.
+ */
+export async function moveCollectionSecretsToVault(
+    col: Collection,
+    cipherKey: CryptoKey | null,
+): Promise<{ collection: Collection; moved: number }> {
+    if (!cipherKey) {
+        throw new Error("Vault is locked — unlock your master password to move credentials.")
+    }
+    const [{ listApiKeyEntries, createApiKeyEntry }, { decryptData, encryptData }, { parseApiKeyPayload }] =
+        await Promise.all([
+            import("@/lib/api-key-vault-api"),
+            import("@/lib/encryption"),
+            import("@/lib/api-key-vault-utils"),
+        ])
+
+    const existingByName = new Map<string, string>()
+    for (const row of await listApiKeyEntries()) {
+        try {
+            const entry = parseApiKeyPayload(await decryptData(cipherKey, row.encryptedData, row.iv))
+            if (entry?.name) existingByName.set(entry.name, entry.apiKey)
+        } catch {
+            // Undecryptable row (other key / corrupt) — skip; worst case a name collision suffix.
+        }
+    }
+
+    const plan = planVaultMoves(col, existingByName)
+    for (const { name, value } of plan.creates) {
+        const payload = JSON.stringify({
+            name,
+            apiKey: value,
+            secret: "",
+            env: "development",
+            notes: "Moved from an API-client folder collection",
+        })
+        const { encrypted, iv } = await encryptData(cipherKey, payload)
+        await createApiKeyEntry({ encryptedData: encrypted, iv })
+    }
+    return { collection: plan.collection, moved: plan.moved }
+}
diff --git a/apps/desktop-ui/src/lib/desktop/collection-files.ts b/apps/desktop-ui/src/lib/desktop/collection-files.ts
index c4ae126b..32d1eb52 100644
--- a/apps/desktop-ui/src/lib/desktop/collection-files.ts
+++ b/apps/desktop-ui/src/lib/desktop/collection-files.ts
@@ -21,6 +21,45 @@ export async function allowCollectionDir(absPath: string): Promise<void> {
     await invoke("fs_allow_collection_dir", { path: absPath })
 }
 
+// Registry of opened collection dirs lives in the app data dir (Rust command),
+// NOT localStorage: localStorage is origin-scoped, and the dev server vs the
+// installed app are different origins — folders would silently "un-register".
+const LEGACY_REGISTRY_KEY = "api-client-file-collections"
+
+export async function loadCollectionRegistry(): Promise<string[]> {
+    const { invoke } = await import("@tauri-apps/api/core")
+    let paths: string[] = []
+    try {
+        const parsed = JSON.parse(await invoke<string>("file_collections_registry_load"))
+        if (Array.isArray(parsed)) paths = parsed.filter((p): p is string => typeof p === "string")
+    } catch {
+        // Corrupt registry file — start over rather than block the whole feature.
+    }
+    // One-time migration from the old localStorage registry of this origin.
+    try {
+        const legacy = localStorage.getItem(LEGACY_REGISTRY_KEY)
+        if (legacy) {
+            const old = JSON.parse(legacy)
+            if (Array.isArray(old)) {
+                const merged = [...new Set([...paths, ...old.filter((p) => typeof p === "string")])]
+                if (merged.length !== paths.length) {
+                    paths = merged
+                    await saveCollectionRegistry(paths)
+                }
+            }
+            localStorage.removeItem(LEGACY_REGISTRY_KEY)
+        }
+    } catch {
+        // Legacy value unreadable — nothing to migrate.
+    }
+    return paths
+}
+
+export async function saveCollectionRegistry(paths: string[]): Promise<void> {
+    const { invoke } = await import("@tauri-apps/api/core")
+    await invoke("file_collections_registry_save", { json: JSON.stringify(paths) })
+}
+
 /** Native folder picker. Resolves null when the user cancels. */
 export async function pickFolder(): Promise<string | null> {
     const { open } = await import("@tauri-apps/plugin-dialog")
diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs
index d94e8fdf..8a705c93 100644
--- a/apps/desktop/src-tauri/src/lib.rs
+++ b/apps/desktop/src-tauri/src/lib.rs
@@ -70,6 +70,29 @@ async fn proxy_grpc(input: serde_json::Value) -> Result<serde_json::Value, Strin
     Ok(http::grpc::proxy_grpc(input).await)
 }
 
+/// Registry of opened folder-collection dirs, stored as a JSON file in the app
+/// data dir. localStorage is origin-scoped (dev server vs installed app have
+/// different origins), so it silently "forgets" registered folders — this doesn't.
+fn file_collections_registry_path(app: &tauri::AppHandle) -> Result<std::path::PathBuf, String> {
+    let dir = app.path().app_data_dir().map_err(|e| e.to_string())?;
+    Ok(dir.join("file-collections.json"))
+}
+
+#[tauri::command]
+fn file_collections_registry_load(app: tauri::AppHandle) -> Result<String, String> {
+    let path = file_collections_registry_path(&app)?;
+    Ok(std::fs::read_to_string(&path).unwrap_or_else(|_| "[]".to_string()))
+}
+
+#[tauri::command]
+fn file_collections_registry_save(app: tauri::AppHandle, json: String) -> Result<(), String> {
+    let path = file_collections_registry_path(&app)?;
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent).map_err(|e| e.to_string())?;
+    }
+    std::fs::write(&path, json).map_err(|e| e.to_string())
+}
+
 /// Recursively allow a folder-collection dir in the fs scope. The dialog plugin
 /// only scopes the picked path itself; files inside it (and registered dirs on
 /// relaunch) need an explicit recursive grant.
@@ -147,6 +170,8 @@ pub fn run() {
             mock_server_start,
             proxy_grpc,
             fs_allow_collection_dir,
+            file_collections_registry_load,
+            file_collections_registry_save,
             await_browser_auth
         ])
         .run(tauri::generate_context!())

From c50bd6e72f58c685608a0f38216be482e2bb5b4a Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sat, 22 Aug 2026 11:39:36 +0530
Subject: [PATCH 03/39] =?UTF-8?q?fix(api-client):=20Phase=200=20trust=20bl?=
 =?UTF-8?q?ockers=20=E2=80=94=20offline=20Monaco,=20hangs,=20data=20loss?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Serve Monaco from the app bundle (scripts/copy-monaco.mjs → public/monaco/vs,
  loader.config in lib/monaco-loader.ts) instead of jsdelivr; every editor was
  stuck on "Loading editor..." offline. Bump monaco-editor to 0.55.1 — the
  0.53 AMD build throws in language/css/monaco.contribution.js.
- Drop the stale Firebase-key gate from build-tauri.mjs (auth was removed).
- Script runner: 5 s hard timeout with worker terminate + respawn; a top-level
  infinite loop no longer hangs the tab forever.
- Tabs persistence: strip refetchable graphqlSchema always; on quota overflow
  retry with example bodies + file bytes stripped instead of wiping all tabs.
- History: strip uploaded file bytes before POST; SQL ORDER BY/LIMIT instead of
  loading every row; clear/delete hard-delete rows (sync is gone, tombstones
  only accumulated).
- Rust proxy: pooled reqwest clients (TLS/keep-alive reuse) and a 50 MB
  response body cap with an error envelope instead of unbounded buffering.
- generate-code.ts: replace raw NUL byte in Go escaper regex with \0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .gitignore                                    |  6 +-
 apps/desktop-ui/package.json                  |  5 +-
 apps/desktop-ui/scripts/build-tauri.mjs       | 26 ++------
 apps/desktop-ui/scripts/copy-monaco.mjs       | 22 +++++++
 .../__tests__/tabs-context.test.tsx           | 31 +++++++++
 .../api-client/context/tabs-context.tsx       | 66 +++++++++++--------
 .../components/api-client/generate-code.ts    |  2 +-
 .../src/components/api-client/use-history.ts  |  4 +-
 .../api-client/workers/use-scripts-runner.ts  | 56 +++++++++++-----
 .../src/components/client-shell.tsx           |  1 +
 apps/desktop-ui/src/lib/monaco-loader.ts      |  6 ++
 apps/desktop/src-tauri/src/http/proxy.rs      | 45 ++++++++++++-
 .../src-tauri/src/router/api_client.rs        | 13 +---
 apps/desktop/src-tauri/src/router/entries.rs  | 32 +++++++++
 apps/desktop/src-tauri/src/router/mod.rs      |  2 +
 pnpm-lock.yaml                                | 66 +++++++++++--------
 16 files changed, 274 insertions(+), 109 deletions(-)
 create mode 100644 apps/desktop-ui/scripts/copy-monaco.mjs
 create mode 100644 apps/desktop-ui/src/lib/monaco-loader.ts

diff --git a/.gitignore b/.gitignore
index b174a5e0..f6860576 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,6 +31,8 @@ yarn.lock
 /out/
 apps/*/.next/
 apps/*/out/
+# Monaco AMD bundle copied from node_modules by apps/desktop-ui/scripts/copy-monaco.mjs
+apps/desktop-ui/public/monaco/
 apps/*/.agent
 # production
 /build
@@ -99,4 +101,6 @@ docs/superpowers/
 # graft's local graph cache — regenerable, not committed (run `graft build`).
 graft/
 # Local Linux build output (published to GitHub releases, never committed)
-dist-linux/
\ No newline at end of file
+dist-linux/# Regenerated by `next dev` (agentRules); not project instructions
+apps/desktop-ui/AGENTS.md
+apps/desktop-ui/CLAUDE.md
diff --git a/apps/desktop-ui/package.json b/apps/desktop-ui/package.json
index 2f02c1d5..2a7e29ad 100644
--- a/apps/desktop-ui/package.json
+++ b/apps/desktop-ui/package.json
@@ -6,12 +6,15 @@
     "node": ">=20.19.0"
   },
   "scripts": {
+    "predev": "node scripts/copy-monaco.mjs",
     "dev": "next dev",
+    "prebuild": "node scripts/copy-monaco.mjs",
     "build": "next build",
     "lint": "eslint .",
     "test": "jest",
     "test:watch": "jest --watch",
     "build:tauri": "node scripts/build-tauri.mjs",
+    "predev:tauri": "node scripts/copy-monaco.mjs",
     "dev:tauri": "NEXT_PUBLIC_TAURI=1 next dev"
   },
   "dependencies": {
@@ -91,7 +94,7 @@
     "lucide-react": "^0.552.0",
     "marked": "^18.0.10",
     "mime-types": "^3.0.2",
-    "monaco-editor": "^0.53.0",
+    "monaco-editor": "^0.55.1",
     "mongodb": "^7.5.0",
     "mysql2": "^3.23.4",
     "netmask": "^2.1.1",
diff --git a/apps/desktop-ui/scripts/build-tauri.mjs b/apps/desktop-ui/scripts/build-tauri.mjs
index 29b3534e..b3824afc 100644
--- a/apps/desktop-ui/scripts/build-tauri.mjs
+++ b/apps/desktop-ui/scripts/build-tauri.mjs
@@ -10,7 +10,6 @@
  * Output: apps/desktop-ui/out/
  */
 import { execSync, spawnSync } from "node:child_process";
-import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -26,26 +25,11 @@ if (major < 20 || (major === 20 && minor < 19)) {
   process.exit(1);
 }
 
-// Activation is mandatory: a desktop build without real Firebase credentials
-// produces an app nobody can activate. Hard-fail rather than ship it.
-// Next loads .env files itself; this check just guards CI/misconfigured shells.
-const hasFirebaseKey =
-  !!process.env.NEXT_PUBLIC_FIREBASE_API_KEY ||
-  [".env", ".env.local", ".env.production"].some((f) => {
-    try {
-      return fs.readFileSync(path.join(uiRoot, f), "utf8").includes("NEXT_PUBLIC_FIREBASE_API_KEY=");
-    } catch {
-      return false;
-    }
-  });
-if (!hasFirebaseKey) {
-  console.error(
-    "build-tauri: NEXT_PUBLIC_FIREBASE_API_KEY is not set (env or .env file). Desktop " +
-      "activation requires real Firebase credentials baked into the bundle — export the " +
-      "NEXT_PUBLIC_FIREBASE_* vars before building."
-  );
-  process.exit(1);
-}
+// Monaco must be served from the bundle, not jsdelivr (offline app).
+const copyMonaco = spawnSync(process.execPath, [path.join(uiRoot, "scripts", "copy-monaco.mjs")], {
+  stdio: "inherit",
+});
+if (copyMonaco.status !== 0) process.exit(copyMonaco.status ?? 1);
 
 const env = {
   ...process.env,
diff --git a/apps/desktop-ui/scripts/copy-monaco.mjs b/apps/desktop-ui/scripts/copy-monaco.mjs
new file mode 100644
index 00000000..3f044fa3
--- /dev/null
+++ b/apps/desktop-ui/scripts/copy-monaco.mjs
@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+/**
+ * Copy Monaco's prebuilt AMD bundle into public/ so the editor loads from the
+ * app itself instead of jsdelivr (the @monaco-editor/loader default). The
+ * desktop app is offline-first; a CDN fetch per cold launch broke every editor
+ * without network. Output is gitignored — runs from the pre* lifecycle hooks.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const uiRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const src = path.join(uiRoot, "node_modules", "monaco-editor", "min", "vs");
+const dest = path.join(uiRoot, "public", "monaco", "vs");
+
+if (!fs.existsSync(src)) {
+  console.error(`copy-monaco: ${src} missing — run pnpm install first`);
+  process.exit(1);
+}
+fs.rmSync(dest, { recursive: true, force: true });
+fs.cpSync(src, dest, { recursive: true });
+console.log("copy-monaco: public/monaco/vs refreshed");
diff --git a/apps/desktop-ui/src/components/api-client/__tests__/tabs-context.test.tsx b/apps/desktop-ui/src/components/api-client/__tests__/tabs-context.test.tsx
index bde4ceba..1d3dfe80 100644
--- a/apps/desktop-ui/src/components/api-client/__tests__/tabs-context.test.tsx
+++ b/apps/desktop-ui/src/components/api-client/__tests__/tabs-context.test.tsx
@@ -83,3 +83,34 @@ describe("guard functions are exported", () => {
         expect(typeof useTabsActions).toBe("function")
     })
 })
+
+describe("slimTabsForStorage", () => {
+    const { createNewTab, slimTabsForStorage } = require("../context/tabs-context")
+    const fat = () => {
+        const t = createNewTab()
+        t.response = { status: 200, statusText: "OK", headers: {}, body: "x".repeat(1000), time: 1, size: 1 }
+        t.isLoading = true
+        t.graphqlSchema = { types: [] }
+        t.examples = [{ id: "e", name: "ex", capturedAt: 1, request: { method: "GET", url: "u", headers: [], body: t.body }, response: { status: 200, statusText: "OK", headers: {}, body: "big" } }]
+        t.body.formData = [{ id: "f", key: "file", value: "", enabled: true, valueType: "file", fileName: "a.bin", fileContentBase64: "AAAA" }]
+        return t
+    }
+
+    it("always drops runtime + refetchable state, keeps examples and file bytes", () => {
+        const [s] = slimTabsForStorage([fat()])
+        expect(s.response).toBeUndefined()
+        expect(s.isLoading).toBeUndefined()
+        expect(s.websocket).toBeUndefined()
+        expect(s.graphqlSchema).toBeUndefined()
+        expect(s.examples[0].response.body).toBe("big")
+        expect(s.body.formData[0].fileContentBase64).toBe("AAAA")
+    })
+
+    it("aggressive mode also drops example bodies and file bytes but keeps metadata", () => {
+        const [s] = slimTabsForStorage([fat()], true)
+        expect(s.examples[0].name).toBe("ex")
+        expect(s.examples[0].response.body).toBe("")
+        expect(s.body.formData[0].fileName).toBe("a.bin")
+        expect(s.body.formData[0].fileContentBase64).toBe("")
+    })
+})
diff --git a/apps/desktop-ui/src/components/api-client/context/tabs-context.tsx b/apps/desktop-ui/src/components/api-client/context/tabs-context.tsx
index e1ecbbc9..4ccba53a 100644
--- a/apps/desktop-ui/src/components/api-client/context/tabs-context.tsx
+++ b/apps/desktop-ui/src/components/api-client/context/tabs-context.tsx
@@ -6,6 +6,40 @@ import { ApiRequestState, API_CLIENT_DEFAULT_TAB_NAME } from "../types"
 const TABS_STORAGE_KEY = "api-client-tabs"
 const ACTIVE_TAB_STORAGE_KEY = "api-client-active-tab"
 
+/**
+ * Shape a tab for localStorage. Always drops runtime state (response, loading,
+ * websocket transcript) and the re-fetchable GraphQL schema. With `aggressive`
+ * it also drops saved-example bodies and uploaded file bytes — used only as a
+ * fallback when the full copy overflows the ~5 MB quota, so one big example
+ * can't wipe every open tab.
+ */
+export function slimTabsForStorage(tabs: ApiRequestState[], aggressive = false): Partial<ApiRequestState>[] {
+    return tabs.map((t) => {
+        const { response: _r, isLoading: _l, websocket: _ws, graphqlSchema: _gs, ...rest } = t
+        if (!aggressive) return rest
+        return {
+            ...rest,
+            examples: rest.examples?.map((e) => ({ ...e, response: { ...e.response, body: "" } })),
+            body: {
+                ...rest.body,
+                formData: rest.body.formData?.map((f) =>
+                    f.fileContentBase64 ? { ...f, fileContentBase64: "" } : f),
+            },
+        }
+    })
+}
+
+function persistTabs(tabs: ApiRequestState[]) {
+    for (const aggressive of [false, true]) {
+        try {
+            localStorage.setItem(TABS_STORAGE_KEY, JSON.stringify(slimTabsForStorage(tabs, aggressive)))
+            return
+        } catch (e) {
+            console.warn(`api-client tabs: localStorage write failed (aggressive=${aggressive})`, e)
+        }
+    }
+}
+
 export const createNewTab = (kind: "rest" | "websocket" | "grpc" = "rest"): ApiRequestState => ({
     id: crypto.randomUUID(),
     name: kind === "websocket" ? "New WebSocket" : kind === "grpc" ? "New gRPC" : API_CLIENT_DEFAULT_TAB_NAME,
@@ -101,42 +135,18 @@ export function TabsProvider({ children }: { children: React.ReactNode }) {
         activeTabIdRef.current = activeTabId
     })
 
-    // Save tabs to localStorage — strip `response`/`isLoading` (responses can be MBs and
-    // would blow the per-origin localStorage quota). Writes are debounced to 500ms so rapid
-    // edits (e.g. typing in the URL input) don't saturate the storage layer.
+    // Save tabs to localStorage. Writes are debounced to 500ms so rapid edits
+    // (e.g. typing in the URL input) don't saturate the storage layer.
     React.useEffect(() => {
         if (!isInitialized) return
-        const timeoutId = setTimeout(() => {
-            const slim = tabsRef.current.map((t) => {
-                // Drop response (big) + isLoading + websocket runtime (transcript can be huge)
-                // before persisting. WS config (status/draft/protocols) is rebuilt fresh on reload.
-                const { response: _r, isLoading: _l, websocket: _ws, ...rest } = t
-                return rest
-            })
-            try {
-                localStorage.setItem(TABS_STORAGE_KEY, JSON.stringify(slim))
-            } catch (e) {
-                console.warn("api-client tabs: localStorage write failed, dropping persisted state", e)
-                try { localStorage.removeItem(TABS_STORAGE_KEY) } catch { /* noop */ }
-            }
-        }, 500)
+        const timeoutId = setTimeout(() => persistTabs(tabsRef.current), 500)
         return () => clearTimeout(timeoutId)
     }, [tabs, isInitialized])
 
     // Flush the latest tab state immediately on unmount so mid-debounce edits
     // are not lost when the user navigates away.
     React.useEffect(() => {
-        return () => {
-            const slim = tabsRef.current.map((t) => {
-                // Drop response (big) + isLoading + websocket runtime (transcript can be huge)
-                // before persisting. WS config (status/draft/protocols) is rebuilt fresh on reload.
-                const { response: _r, isLoading: _l, websocket: _ws, ...rest } = t
-                return rest
-            })
-            try {
-                localStorage.setItem(TABS_STORAGE_KEY, JSON.stringify(slim))
-            } catch { /* noop */ }
-        }
+        return () => { persistTabs(tabsRef.current) }
     }, [])
 
     // Save active tab id to localStorage
diff --git a/apps/desktop-ui/src/components/api-client/generate-code.ts b/apps/desktop-ui/src/components/api-client/generate-code.ts
index edad3894..513f2e69 100644
--- a/apps/desktop-ui/src/components/api-client/generate-code.ts
+++ b/apps/desktop-ui/src/components/api-client/generate-code.ts
@@ -256,7 +256,7 @@ function generateGo(method: string, url: string, headers: Record<string, string>
             .replace(/\t/g, "\\t")
             .replace(/\f/g, "\\f")
             .replace(/\v/g, "\\v")
-            .replace(//g, "\\x00")
+            .replace(/\0/g, "\\x00")
         code += `\n\tpayload := strings.NewReader("${escaped}")\n`
         code += `\n\treq, err := http.NewRequest("${method}", "${url}", payload)\n`
         code += `\tif err != nil {\n\t\tfmt.Println(err)\n\t\treturn\n\t}\n`
diff --git a/apps/desktop-ui/src/components/api-client/use-history.ts b/apps/desktop-ui/src/components/api-client/use-history.ts
index 209facec..05f0dd1e 100644
--- a/apps/desktop-ui/src/components/api-client/use-history.ts
+++ b/apps/desktop-ui/src/components/api-client/use-history.ts
@@ -211,8 +211,10 @@ export function useHistory() {
             status?: number
         ) => {
             const timestamp = Date.now()
+            // Same rule as localStorage: history keeps the request shape, never uploaded bytes.
+            const [slimRequest] = stripHistoryFileBytes([request as HistoryRequest])
             const payload = {
-                ...request,
+                ...slimRequest,
                 name,
                 timestamp,
                 status,
diff --git a/apps/desktop-ui/src/components/api-client/workers/use-scripts-runner.ts b/apps/desktop-ui/src/components/api-client/workers/use-scripts-runner.ts
index f561960f..1cccaf48 100644
--- a/apps/desktop-ui/src/components/api-client/workers/use-scripts-runner.ts
+++ b/apps/desktop-ui/src/components/api-client/workers/use-scripts-runner.ts
@@ -5,38 +5,64 @@ import type { ScriptContext, ScriptResult, ScriptsRunnerApi } from "./scripts-ru
 
 export type { ScriptContext, ScriptResult } from "./scripts-runner.worker"
 
+/**
+ * Hard wall-clock budget for one script run. The worker's own in-script check
+ * only fires inside `pm.test()`, so a top-level `while (true) {}` would hang
+ * the worker forever; this race terminates + respawns it instead.
+ */
+export const SCRIPT_HARD_TIMEOUT_MS = 5_000
+
 export function useScriptsRunner() {
     const workerRef = React.useRef<Worker | null>(null)
     const apiRef = React.useRef<Comlink.Remote<ScriptsRunnerApi> | null>(null)
 
-    React.useEffect(() => {
+    const spawn = React.useCallback(() => {
+        workerRef.current?.terminate()
         const w = new Worker(
             new URL("./scripts-runner.worker.ts", import.meta.url),
             { type: "module" },
         )
         workerRef.current = w
         apiRef.current = Comlink.wrap<ScriptsRunnerApi>(w)
+    }, [])
+
+    React.useEffect(() => {
+        spawn()
         return () => {
-            w.terminate()
+            workerRef.current?.terminate()
             workerRef.current = null
             apiRef.current = null
         }
-    }, [])
+    }, [spawn])
 
     const run = React.useCallback(async (script: string, ctx: ScriptContext): Promise<ScriptResult> => {
-        if (!apiRef.current) {
-            return {
-                ok: false,
-                error: "Script runner not ready",
-                tests: [],
-                logs: [],
-                environment: ctx.environment,
-                variables: ctx.variables,
-                request: ctx.request,
-            }
+        const api = apiRef.current
+        const failed = (error: string): ScriptResult => ({
+            ok: false,
+            error,
+            tests: [],
+            logs: [],
+            environment: ctx.environment,
+            variables: ctx.variables,
+            request: ctx.request,
+        })
+        if (!api) return failed("Script runner not ready")
+
+        let timer: ReturnType<typeof setTimeout> | undefined
+        const timeout = new Promise<ScriptResult>((resolve) => {
+            timer = setTimeout(() => {
+                // A stuck worker can't be interrupted — kill it and start a fresh one
+                // so the next send works.
+                spawn()
+                resolve(failed(`Script timed out after ${SCRIPT_HARD_TIMEOUT_MS}ms`))
+            }, SCRIPT_HARD_TIMEOUT_MS)
+        })
+        try {
+            return await Promise.race([api.run(script, ctx), timeout])
+        } finally {
+            clearTimeout(timer)
         }
-        return apiRef.current.run(script, ctx)
-    }, [])
+    }, [spawn])
 
     return { run }
 }
diff --git a/apps/desktop-ui/src/components/client-shell.tsx b/apps/desktop-ui/src/components/client-shell.tsx
index 1a7d05f4..467e31f0 100644
--- a/apps/desktop-ui/src/components/client-shell.tsx
+++ b/apps/desktop-ui/src/components/client-shell.tsx
@@ -5,6 +5,7 @@ import { Suspense, useEffect, type ReactNode } from "react"
 import { UserPreferencesSync } from "@/components/user-preferences-sync"
 import { PinnedToolsPreferencesSync } from "@/components/pinned-tools-preferences-sync"
 import { initTelemetry } from "@/lib/telemetry"
+import "@/lib/monaco-loader"
 
 const GlobalCommandPalette = dynamic(
   () => import('@/components/global-command-palette').then((m) => m.GlobalCommandPalette),
diff --git a/apps/desktop-ui/src/lib/monaco-loader.ts b/apps/desktop-ui/src/lib/monaco-loader.ts
new file mode 100644
index 00000000..48e679bd
--- /dev/null
+++ b/apps/desktop-ui/src/lib/monaco-loader.ts
@@ -0,0 +1,6 @@
+import { loader } from "@monaco-editor/react";
+
+// Serve Monaco from the app bundle (scripts/copy-monaco.mjs → public/monaco/vs)
+// instead of the loader's jsdelivr default. Must run before any <Editor> mounts;
+// imported once from the client shell for that reason.
+loader.config({ paths: { vs: "/monaco/vs" } });
diff --git a/apps/desktop/src-tauri/src/http/proxy.rs b/apps/desktop/src-tauri/src/http/proxy.rs
index 6e6580ee..bc727ae2 100644
--- a/apps/desktop/src-tauri/src/http/proxy.rs
+++ b/apps/desktop/src-tauri/src/http/proxy.rs
@@ -19,6 +19,10 @@ use tauri::ipc::Channel;
 const MAX_REDIRECTS: usize = 5;
 const DEFAULT_TIMEOUT_MS: u64 = 30_000;
 const MAX_TIMEOUT_MS: u64 = 600_000;
+/// Largest response body the non-streaming path will buffer. The body crosses
+/// the IPC boundary as one JSON string (base64 for binary), so an unbounded
+/// download would freeze or OOM the webview.
+const MAX_BODY_BYTES: usize = 50 * 1024 * 1024;
 
 const METADATA_HOSTS: &[&str] = &[
     "169.254.169.254",
@@ -92,14 +96,23 @@ fn is_textual_content_type(ct: &str) -> bool {
             .any(|t| l.contains(t))
 }
 
+// One pooled client per proxy mode so TLS sessions + keep-alive connections are
+// reused across sends; building a client per request cost a full handshake each time.
+static CLIENTS: [OnceLock<reqwest::Client>; 2] = [OnceLock::new(), OnceLock::new()];
+
 fn plain_client(bypass_proxy: bool) -> Result<reqwest::Client, String> {
+    let slot = &CLIENTS[bypass_proxy as usize];
+    if let Some(c) = slot.get() {
+        return Ok(c.clone());
+    }
     let mut builder = reqwest::Client::builder()
         .redirect(reqwest::redirect::Policy::none())
         .user_agent("mydevtools-desktop");
     if bypass_proxy {
         builder = builder.no_proxy();
     }
-    builder.build().map_err(|e| e.to_string())
+    let client = builder.build().map_err(|e| e.to_string())?;
+    Ok(slot.get_or_init(|| client).clone())
 }
 
 fn build_body(body: &Value) -> Result<Option<BodyKind>, String> {
@@ -228,6 +241,32 @@ async fn fetch_following_redirects(
     Err(format!("Too many redirects (>{MAX_REDIRECTS})"))
 }
 
+fn too_large(len: usize) -> String {
+    format!(
+        "Response body too large ({} MB, limit {} MB)",
+        len / (1024 * 1024),
+        MAX_BODY_BYTES / (1024 * 1024)
+    )
+}
+
+/// Buffer the body, refusing early on a declared oversize length and bailing
+/// mid-stream if an undeclared (chunked) body crosses `MAX_BODY_BYTES`.
+async fn read_body_capped(response: reqwest::Response, declared_len: u64) -> Result<Vec<u8>, String> {
+    if declared_len > MAX_BODY_BYTES as u64 {
+        return Err(too_large(declared_len as usize));
+    }
+    let mut bytes = Vec::with_capacity(declared_len as usize);
+    let mut stream = response.bytes_stream();
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk.map_err(|e| e.to_string())?;
+        if bytes.len() + chunk.len() > MAX_BODY_BYTES {
+            return Err(too_large(bytes.len() + chunk.len()));
+        }
+        bytes.extend_from_slice(&chunk);
+    }
+    Ok(bytes)
+}
+
 /// Non-streaming request. Returns the `/api/proxy` envelope as JSON.
 pub async fn http_request(input: Value) -> Value {
     let url = input["url"].as_str().unwrap_or("");
@@ -293,9 +332,9 @@ pub async fn http_request(input: Value) -> Value {
         .unwrap_or("")
         .to_string();
 
-    let bytes = match response.bytes().await {
+    let bytes = match read_body_capped(response, declared_len).await {
         Ok(b) => b,
-        Err(e) => return envelope_error(0, "Error", &e.to_string()),
+        Err(e) => return envelope_error(0, "Error", &e),
     };
     let (body_str, is_base64) = if is_textual_content_type(&content_type) {
         (String::from_utf8_lossy(&bytes).to_string(), false)
diff --git a/apps/desktop/src-tauri/src/router/api_client.rs b/apps/desktop/src-tauri/src/router/api_client.rs
index 0a2fb847..37a41f23 100644
--- a/apps/desktop/src-tauri/src/router/api_client.rs
+++ b/apps/desktop/src-tauri/src/router/api_client.rs
@@ -215,12 +215,9 @@ pub fn handle(
     if let Some(tail) = rest.strip_prefix("/history") {
         return match (method, tail) {
             ("GET", "") => {
-                let mut docs = list_docs(&db, HISTORY, &ws)?;
-                docs.sort_by_key(|d| -d["timestamp"].as_i64().unwrap_or(0));
                 let limit: usize =
                     query_param(query, "limit").and_then(|v| v.parse().ok()).unwrap_or(100);
-                docs.truncate(limit);
-                ApiResponse::ok(&docs)
+                ApiResponse::ok(&list_docs_recent(&db, HISTORY, &ws, limit)?)
             }
             ("POST", "") => {
                 let req = parse_body(body)?;
@@ -238,15 +235,11 @@ pub fn handle(
                 ApiResponse::ok(&doc)
             }
             ("DELETE", "/clear") => {
-                for doc in list_docs(&db, HISTORY, &ws)? {
-                    if let Some(id) = doc["id"].as_str() {
-                        tombstone(&db, HISTORY, &ws, id)?;
-                    }
-                }
+                hard_delete(&db, HISTORY, &ws, None)?;
                 Ok(ApiResponse::empty(204))
             }
             ("DELETE", _) if tail.starts_with('/') => {
-                tombstone(&db, HISTORY, &ws, &tail[1..])?;
+                hard_delete(&db, HISTORY, &ws, Some(&tail[1..]))?;
                 Ok(ApiResponse::empty(204))
             }
             _ => Ok(ApiResponse::detail(404, "Not found")),
diff --git a/apps/desktop/src-tauri/src/router/entries.rs b/apps/desktop/src-tauri/src/router/entries.rs
index e4de6a8f..e4a4029f 100644
--- a/apps/desktop/src-tauri/src/router/entries.rs
+++ b/apps/desktop/src-tauri/src/router/entries.rs
@@ -52,6 +52,38 @@ pub fn list_docs(db: &Connection, kind: &str, ws: &str) -> Result<Vec<Value>> {
     Ok(docs)
 }
 
+/// Newest `limit` docs by insert time — for append-only logs like history,
+/// where loading + sorting every row in Rust grows with lifetime usage.
+pub fn list_docs_recent(db: &Connection, kind: &str, ws: &str, limit: usize) -> Result<Vec<Value>> {
+    let mut stmt = db.prepare(
+        "SELECT meta_json FROM entries
+         WHERE tool_kind = ?1 AND workspace_id = ?2 AND deleted_at IS NULL
+         ORDER BY created_at DESC, rowid DESC LIMIT ?3",
+    )?;
+    let rows = stmt.query_map(params![kind, ws, limit as i64], |r| r.get::<_, String>(0))?;
+    let mut docs = Vec::new();
+    for row in rows {
+        docs.push(serde_json::from_str(&row?)?);
+    }
+    Ok(docs)
+}
+
+/// Physically delete docs of a kind (all, or one by id). Sync is gone, so
+/// tombstones only accumulate; logs that are cleared should actually go.
+pub fn hard_delete(db: &Connection, kind: &str, ws: &str, id: Option<&str>) -> Result<usize> {
+    let n = match id {
+        Some(id) => db.execute(
+            "DELETE FROM entries WHERE tool_kind = ?1 AND workspace_id = ?2 AND id = ?3",
+            params![kind, ws, id],
+        )?,
+        None => db.execute(
+            "DELETE FROM entries WHERE tool_kind = ?1 AND workspace_id = ?2",
+            params![kind, ws],
+        )?,
+    };
+    Ok(n)
+}
+
 pub fn get_doc(db: &Connection, kind: &str, ws: &str, id: &str) -> Result<Option<Value>> {
     let raw: Option<String> = db
         .query_row(
diff --git a/apps/desktop/src-tauri/src/router/mod.rs b/apps/desktop/src-tauri/src/router/mod.rs
index 404e6591..2c5dc18a 100644
--- a/apps/desktop/src-tauri/src/router/mod.rs
+++ b/apps/desktop/src-tauri/src/router/mod.rs
@@ -382,6 +382,8 @@ mod tests {
         assert_eq!(list[0]["url"], "https://x/2"); // newest first
         let r = route(&state, "DELETE", "/api/v1/api-client/history/clear", None).unwrap();
         assert_eq!(r.status, 204);
+        let r = route(&state, "GET", "/api/v1/api-client/history", None).unwrap();
+        assert_eq!(body_json(&r).as_array().unwrap().len(), 0);
     }
 
     #[test]
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6a1ae844..b2b64d75 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -43,7 +43,7 @@ importers:
         version: 7.21.3(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.9)(typescript@5.9.3)
       '@monaco-editor/react':
         specifier: ^4.7.0
-        version: 4.7.0(monaco-editor@0.53.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 4.7.0(monaco-editor@0.55.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@peculiar/x509':
         specifier: ^2.0.0
         version: 2.0.0
@@ -199,7 +199,7 @@ importers:
         version: 12.43.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       geist:
         specifier: ^1.7.2
-        version: 1.7.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
+        version: 1.7.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
       gpt-tokenizer:
         specifier: ^3.4.0
         version: 3.4.0
@@ -252,8 +252,8 @@ importers:
         specifier: ^3.0.2
         version: 3.0.2
       monaco-editor:
-        specifier: ^0.53.0
-        version: 0.53.0
+        specifier: ^0.55.1
+        version: 0.55.1
       mongodb:
         specifier: ^7.5.0
         version: 7.5.0
@@ -268,7 +268,7 @@ importers:
         version: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       next-intl:
         specifier: ^4.13.7
-        version: 4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
+        version: 4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
       next-themes:
         specifier: ^0.4.6
         version: 0.4.6(patch_hash=73478c20fb87207168b5c0fa9ccabf0c042408da2bc5a36131ed1c8bb57bf5a3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
@@ -425,7 +425,7 @@ importers:
         version: 1.0.2
       '@opennextjs/cloudflare':
         specifier: ^1.20.2
-        version: 1.20.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(wrangler@4.124.0)
+        version: 1.20.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(wrangler@4.124.0)
       '@radix-ui/react-collapsible':
         specifier: ^1.1.20
         version: 1.1.20(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
@@ -452,10 +452,10 @@ importers:
         version: 3.46.0(react@19.2.8)
       '@vercel/analytics':
         specifier: ^1.6.1
-        version: 1.6.1(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))
+        version: 1.6.1(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))
       '@vercel/speed-insights':
         specifier: ^1.3.1
-        version: 1.3.1(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))
+        version: 1.3.1(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))
       class-variance-authority:
         specifier: ^0.7.1
         version: 0.7.1
@@ -467,7 +467,7 @@ importers:
         version: 12.43.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       geist:
         specifier: ^1.7.2
-        version: 1.7.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
+        version: 1.7.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
       lucide-react:
         specifier: ^0.552.0
         version: 0.552.0(react@19.2.8)
@@ -476,7 +476,7 @@ importers:
         version: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       next-intl:
         specifier: ^4.13.7
-        version: 4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
+        version: 4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
       next-themes:
         specifier: ^0.4.6
         version: 0.4.6(patch_hash=73478c20fb87207168b5c0fa9ccabf0c042408da2bc5a36131ed1c8bb57bf5a3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
@@ -3512,9 +3512,6 @@ packages:
   '@types/stack-utils@2.0.3':
     resolution: {integrity: sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==}
 
-  '@types/trusted-types@1.0.6':
-    resolution: {integrity: sha512-230RC8sFeHoT6sSUlRO6a8cAnclO06eeiq1QDfiv2FGCLWFvvERWgwIQD4FWqD9A69BN7Lzee4OXwoMVnnsWDw==}
-
   '@types/trusted-types@2.0.7':
     resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==}
 
@@ -4476,6 +4473,9 @@ packages:
     resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==}
     engines: {node: '>= 4'}
 
+  dompurify@3.2.7:
+    resolution: {integrity: sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw==}
+
   dompurify@3.4.14:
     resolution: {integrity: sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==}
 
@@ -5676,6 +5676,11 @@ packages:
   markdown-table@3.0.4:
     resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
 
+  marked@14.0.0:
+    resolution: {integrity: sha512-uIj4+faQ+MgHgwUW1l2PsPglZLOLOT1uErt06dAPtx2kjteLAkbsd/0FiYg/MGS+i7ZKLb7w2WClxHkzOOuryQ==}
+    engines: {node: '>= 18'}
+    hasBin: true
+
   marked@18.0.10:
     resolution: {integrity: sha512-FJeH4bRpYoXiggcgriCGItKCSv3xkngJc4QCZ/rkQCogU3VYaLxYJoZl8Nw/b4+x7iij/pd+09mZ6A1dXzpL0A==}
     engines: {node: '>= 20'}
@@ -5900,8 +5905,8 @@ packages:
   mnemonist@0.38.3:
     resolution: {integrity: sha512-2K9QYubXx/NAjv4VLq1d1Ly8pWNC5L3BrixtdkyTegXWJIqY+zLNDhhX/A+ZwWt70tB1S8H4BE8FLYEFyNoOBw==}
 
-  monaco-editor@0.53.0:
-    resolution: {integrity: sha512-0WNThgC6CMWNXXBxTbaYYcunj08iB5rnx4/G56UOPeL9UVIUGGHA1GR0EWIh9Ebabj7NpCRawQ5b0hfN1jQmYQ==}
+  monaco-editor@0.55.1:
+    resolution: {integrity: sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A==}
 
   mongodb-connection-string-url@7.0.2:
     resolution: {integrity: sha512-ZoS07RoFqpKYQwAk59qmrx8+jJHNHU30UjlU96QktiGn1ltvDr+vCznLX5DiUBLEpMAHatHNWV1nM/74ul66kA==}
@@ -9769,10 +9774,10 @@ snapshots:
     dependencies:
       state-local: 1.0.7
 
-  '@monaco-editor/react@4.7.0(monaco-editor@0.53.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@monaco-editor/react@4.7.0(monaco-editor@0.55.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@monaco-editor/loader': 1.7.0
-      monaco-editor: 0.53.0
+      monaco-editor: 0.55.1
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
 
@@ -9868,7 +9873,7 @@ snapshots:
 
   '@ocavue/utils@1.7.0': {}
 
-  '@opennextjs/aws@4.1.0(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))':
+  '@opennextjs/aws@4.1.0(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))':
     dependencies:
       '@ast-grep/napi': 0.40.5
       '@aws-sdk/client-cloudfront': 3.984.0
@@ -9891,11 +9896,11 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@opennextjs/cloudflare@1.20.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(wrangler@4.124.0)':
+  '@opennextjs/cloudflare@1.20.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(wrangler@4.124.0)':
     dependencies:
       '@ast-grep/napi': 0.40.5
       '@dotenvx/dotenvx': 1.31.0
-      '@opennextjs/aws': 4.1.0(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
+      '@opennextjs/aws': 4.1.0(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
       ci-info: 4.4.0
       cloudflare: 4.5.0
       comment-json: 4.6.2
@@ -11177,8 +11182,6 @@ snapshots:
 
   '@types/stack-utils@2.0.3': {}
 
-  '@types/trusted-types@1.0.6': {}
-
   '@types/trusted-types@2.0.7': {}
 
   '@types/turndown@5.0.6': {}
@@ -11360,14 +11363,14 @@ snapshots:
   '@unrs/resolver-binding-win32-x64-msvc@1.12.2':
     optional: true
 
-  '@vercel/analytics@1.6.1(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))':
+  '@vercel/analytics@1.6.1(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))':
     optionalDependencies:
       next: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       react: 19.2.8
       svelte: 5.56.9(@typescript-eslint/types@8.67.0)
       vue: 3.5.41(typescript@5.9.3)
 
-  '@vercel/speed-insights@1.3.1(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))':
+  '@vercel/speed-insights@1.3.1(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))':
     optionalDependencies:
       next: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       react: 19.2.8
@@ -12113,6 +12116,10 @@ snapshots:
     dependencies:
       domelementtype: 2.3.0
 
+  dompurify@3.2.7:
+    optionalDependencies:
+      '@types/trusted-types': 2.0.7
+
   dompurify@3.4.14:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
@@ -12790,7 +12797,7 @@ snapshots:
 
   functions-have-names@1.2.3: {}
 
-  geist@1.7.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)):
+  geist@1.7.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)):
     dependencies:
       next: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
 
@@ -13720,6 +13727,8 @@ snapshots:
 
   markdown-table@3.0.4: {}
 
+  marked@14.0.0: {}
+
   marked@18.0.10: {}
 
   math-intrinsics@1.1.0: {}
@@ -14120,9 +14129,10 @@ snapshots:
     dependencies:
       obliterator: 1.6.1
 
-  monaco-editor@0.53.0:
+  monaco-editor@0.55.1:
     dependencies:
-      '@types/trusted-types': 1.0.6
+      dompurify: 3.2.7
+      marked: 14.0.0
 
   mongodb-connection-string-url@7.0.2:
     dependencies:
@@ -14201,7 +14211,7 @@ snapshots:
 
   next-intl-swc-plugin-extractor@4.13.7: {}
 
-  next-intl@4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
+  next-intl@4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
     dependencies:
       '@formatjs/intl-localematcher': 0.8.13
       '@parcel/watcher': 2.6.0

From 3304e67eef20b99f124014eaa9d78e2a6063f498 Mon Sep 17 00:00:00 2001
From: anuphilipp3 <anuphilipp3@gmail.com>
Date: Sat, 22 Aug 2026 13:13:21 +0530
Subject: [PATCH 04/39] feat(media-design): migrate all 10 Media & Design tools
 onto the shared kit

Phase 4 of the tool-consistency pass. Every Media & Design tool now renders
through ToolShell + IOPanel / kit-surface panels instead of hand-rolled Cards,
sharing one visual language with the rest of the app.

Migrated (logic + visuals preserved):
- color-picker, contrast-checker, css-gradient-builder, svg-optimizer,
  image-compressor, code-screenshot, exif-viewer, favicon-generator,
  keycode-inspector
- css-generators hub + box-shadow / border-radius / clamp sub-tabs

Verified intact: color swatches/pickers/eyedropper, WCAG contrast badges,
gradient live preview + PNG export, image-compressor canvas + before/after,
EXIF preview + metadata, favicon canvas render + ICO/ZIP export, code-screenshot
export node, keycode live capture + history, and all CSS live previews.

Also: IOPanel now omits its header row when a panel has neither label nor
actions (kept from the Converters phase).

0 type errors; all 10 pages render.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../code-screenshot-layout.tsx                | 320 +++++++++---------
 .../color-picker-tool-layout.tsx              |  32 +-
 .../contrast-checker-tool-layout.tsx          |  31 +-
 .../css-generators/border-radius-tab.tsx      |  25 +-
 .../css-generators/box-shadow-tab.tsx         |  17 +-
 .../components/css-generators/clamp-tab.tsx   |  21 +-
 .../css-generators/css-generators-layout.tsx  |  19 +-
 .../css-gradient-builder/gradient-layout.tsx  |  42 +--
 .../exif-viewer/exif-viewer-layout.tsx        | 217 ++++++------
 .../favicon-generator-layout.tsx              |  56 +--
 .../image-compressor-layout.tsx               | 239 +++++++------
 .../keycode-inspector-layout.tsx              | 281 +++++++--------
 .../svg-optimizer/svg-optimizer-layout.tsx    | 103 +++---
 13 files changed, 639 insertions(+), 764 deletions(-)

diff --git a/apps/desktop-ui/src/components/code-screenshot/code-screenshot-layout.tsx b/apps/desktop-ui/src/components/code-screenshot/code-screenshot-layout.tsx
index cfb35bec..4ee111a9 100644
--- a/apps/desktop-ui/src/components/code-screenshot/code-screenshot-layout.tsx
+++ b/apps/desktop-ui/src/components/code-screenshot/code-screenshot-layout.tsx
@@ -6,7 +6,6 @@ import { toBlob, toPng } from 'html-to-image'
 import { saveAs } from 'file-saver'
 import { toast } from 'sonner'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Slider } from '@/components/ui/slider'
@@ -21,9 +20,8 @@ import {
 import { ToggleGroup, ToggleGroupItem } from '@/components/ui/toggle-group'
 import { Check, Copy, FileCode, ImageDown, Trash2, Wand2 } from 'lucide-react'
 import { IconPhotoCode } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
+import { IOPanel, ToolTextArea } from '@/components/tools/io-panel'
 import { BACKGROUNDS, LANGUAGES, canFormat, formatCode, highlightCode } from '@/lib/code-screenshot'
 
 /**
@@ -156,166 +154,164 @@ export function CodeScreenshotLayout() {
     }
   }, [scale, t])
 
-  return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-      {/* Static stylesheet constant in this file. */}
-      {/* threatcrush-disable-next-line js-unescaped-html-sink */}
-      <style dangerouslySetInnerHTML={{ __html: SCOPED_HLJS_CSS }} />
-
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconPhotoCode}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        />
-      </RevealItem>
+  const toolbar = (
+    <div className="flex flex-wrap items-end gap-x-5 gap-y-4 rounded-lg border border-border bg-card p-4">
+      <div className="space-y-1.5">
+        <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+          {t('languageLabel')}
+        </Label>
+        <Select value={lang} onValueChange={setLang}>
+          <SelectTrigger className="w-[180px]">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="auto">{t('autoDetect')}</SelectItem>
+            {LANGUAGES.map((l) => (
+              <SelectItem key={l.value} value={l.value}>
+                {l.label}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      </div>
 
-      <Card className="flex flex-wrap items-end gap-x-5 gap-y-4 p-4">
-        <div className="space-y-1.5">
-          <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-            {t('languageLabel')}
-          </Label>
-          <Select value={lang} onValueChange={setLang}>
-            <SelectTrigger className="w-[180px]">
-              <SelectValue />
-            </SelectTrigger>
-            <SelectContent>
-              <SelectItem value="auto">{t('autoDetect')}</SelectItem>
-              {LANGUAGES.map((l) => (
-                <SelectItem key={l.value} value={l.value}>
-                  {l.label}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
-        </div>
+      <div className="space-y-1.5">
+        <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+          {t('backgroundLabel')}
+        </Label>
+        <Select value={backgroundId} onValueChange={setBackgroundId}>
+          <SelectTrigger className="w-[170px]">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            {BACKGROUNDS.map((b) => (
+              <SelectItem key={b.id} value={b.id}>
+                <span className="flex items-center gap-2">
+                  <span
+                    className="h-3.5 w-3.5 shrink-0 rounded-full ring-1 ring-inset ring-border"
+                    style={b.css ? { background: b.css } : CHECKERBOARD}
+                    aria-hidden
+                  />
+                  {t(`backgrounds.${b.id}`)}
+                </span>
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      </div>
 
-        <div className="space-y-1.5">
-          <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-            {t('backgroundLabel')}
-          </Label>
-          <Select value={backgroundId} onValueChange={setBackgroundId}>
-            <SelectTrigger className="w-[170px]">
-              <SelectValue />
-            </SelectTrigger>
-            <SelectContent>
-              {BACKGROUNDS.map((b) => (
-                <SelectItem key={b.id} value={b.id}>
-                  <span className="flex items-center gap-2">
-                    <span
-                      className="h-3.5 w-3.5 shrink-0 rounded-full ring-1 ring-inset ring-border"
-                      style={b.css ? { background: b.css } : CHECKERBOARD}
-                      aria-hidden
-                    />
-                    {t(`backgrounds.${b.id}`)}
-                  </span>
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
-        </div>
+      <div className="w-[150px] space-y-1.5">
+        <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+          {t('paddingLabel')} · {padding}px
+        </Label>
+        <Slider
+          value={[padding]}
+          min={16}
+          max={128}
+          step={4}
+          onValueChange={(v) => setPadding(v[0] ?? 48)}
+          className="py-2"
+        />
+      </div>
 
-        <div className="w-[150px] space-y-1.5">
-          <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-            {t('paddingLabel')} · {padding}px
-          </Label>
-          <Slider
-            value={[padding]}
-            min={16}
-            max={128}
-            step={4}
-            onValueChange={(v) => setPadding(v[0] ?? 48)}
-            className="py-2"
-          />
-        </div>
+      <div className="space-y-1.5">
+        <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+          {t('filenameLabel')}
+        </Label>
+        <Input
+          value={filename}
+          onChange={(e) => setFilename(e.target.value)}
+          placeholder={t('filenamePlaceholder')}
+          className="w-[170px]"
+        />
+      </div>
 
-        <div className="space-y-1.5">
-          <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-            {t('filenameLabel')}
-          </Label>
-          <Input
-            value={filename}
-            onChange={(e) => setFilename(e.target.value)}
-            placeholder={t('filenamePlaceholder')}
-            className="w-[170px]"
-          />
+      <div className="space-y-1.5">
+        <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+          {t('windowLabel')}
+        </Label>
+        <div className="flex h-9 items-center">
+          <Switch checked={windowControls} onCheckedChange={setWindowControls} />
         </div>
+      </div>
 
-        <div className="space-y-1.5">
-          <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-            {t('windowLabel')}
-          </Label>
-          <div className="flex h-9 items-center">
-            <Switch checked={windowControls} onCheckedChange={setWindowControls} />
-          </div>
-        </div>
+      <div className="space-y-1.5">
+        <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+          {t('themeLabel')}
+        </Label>
+        <ToggleGroup
+          type="single"
+          value={windowTheme}
+          onValueChange={(v) => v && setWindowTheme(v as 'dark' | 'light')}
+          className="justify-start"
+        >
+          <ToggleGroupItem value="dark" className="px-3 text-xs">
+            {t('themeDark')}
+          </ToggleGroupItem>
+          <ToggleGroupItem value="light" className="px-3 text-xs">
+            {t('themeLight')}
+          </ToggleGroupItem>
+        </ToggleGroup>
+      </div>
 
-        <div className="space-y-1.5">
-          <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-            {t('themeLabel')}
-          </Label>
-          <ToggleGroup
-            type="single"
-            value={windowTheme}
-            onValueChange={(v) => v && setWindowTheme(v as 'dark' | 'light')}
-            className="justify-start"
-          >
-            <ToggleGroupItem value="dark" className="px-3 text-xs">
-              {t('themeDark')}
+      <div className="space-y-1.5">
+        <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+          {t('scaleLabel')}
+        </Label>
+        <ToggleGroup
+          type="single"
+          value={String(scale)}
+          onValueChange={(v) => v && setScale(Number(v))}
+          className="justify-start"
+        >
+          {[1, 2, 3].map((s) => (
+            <ToggleGroupItem key={s} value={String(s)} className="px-3 text-xs">
+              {s}x
             </ToggleGroupItem>
-            <ToggleGroupItem value="light" className="px-3 text-xs">
-              {t('themeLight')}
-            </ToggleGroupItem>
-          </ToggleGroup>
-        </div>
+          ))}
+        </ToggleGroup>
+      </div>
 
-        <div className="space-y-1.5">
-          <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-            {t('scaleLabel')}
-          </Label>
-          <ToggleGroup
-            type="single"
-            value={String(scale)}
-            onValueChange={(v) => v && setScale(Number(v))}
-            className="justify-start"
-          >
-            {[1, 2, 3].map((s) => (
-              <ToggleGroupItem key={s} value={String(s)} className="px-3 text-xs">
-                {s}x
-              </ToggleGroupItem>
-            ))}
-          </ToggleGroup>
-        </div>
+      <div className="ml-auto flex items-end gap-2">
+        <Button size="sm" variant="secondary" onClick={copyImage} disabled={exporting || !code || !canCopyImage}>
+          {imageCopied ? <Check className="mr-1.5 h-4 w-4 text-emerald-600" /> : <Copy className="mr-1.5 h-4 w-4" />}
+          {imageCopied ? t('copied') : t('copyImage')}
+        </Button>
+        <Button size="sm" onClick={exportPng} disabled={exporting || !code}>
+          <ImageDown className="mr-1.5 h-4 w-4" />
+          {t('exportPng')}
+        </Button>
+      </div>
+    </div>
+  )
 
-        <div className="ml-auto flex items-end gap-2">
-          <Button size="sm" variant="secondary" onClick={copyImage} disabled={exporting || !code || !canCopyImage}>
-            {imageCopied ? <Check className="mr-1.5 h-4 w-4 text-emerald-600" /> : <Copy className="mr-1.5 h-4 w-4" />}
-            {imageCopied ? t('copied') : t('copyImage')}
-          </Button>
-          <Button size="sm" onClick={exportPng} disabled={exporting || !code}>
-            <ImageDown className="mr-1.5 h-4 w-4" />
-            {t('exportPng')}
-          </Button>
-        </div>
-      </Card>
+  return (
+    <ToolShell
+      icon={IconPhotoCode}
+      title={t('title')}
+      description={t('subtitle')}
+      toolbar={toolbar}
+    >
+      {/* Static stylesheet constant in this file. */}
+      {/* threatcrush-disable-next-line js-unescaped-html-sink */}
+      <style dangerouslySetInnerHTML={{ __html: SCOPED_HLJS_CSS }} />
 
       <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 lg:grid-cols-2">
-        <Card className="flex min-h-0 flex-col overflow-hidden">
-          <div className="flex items-center justify-between border-b border-border/50 bg-muted/30 px-4 py-2.5">
-            <div className="flex items-center gap-2">
-              <FileCode className="h-3.5 w-3.5 text-muted-foreground" />
-              <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                {t('inputLabel')}
-              </Label>
+        <IOPanel
+          bodyClassName="min-h-[160px]"
+          label={
+            <>
+              <FileCode className="h-3.5 w-3.5" aria-hidden />
+              {t('inputLabel')}
               {lang === 'auto' && code ? (
                 <span className="text-[11px] text-muted-foreground/70">
                   {t('detected', { language: highlighted.language })}
                 </span>
               ) : null}
-            </div>
-            <div className="flex items-center gap-1">
+            </>
+          }
+          actions={
+            <>
               <Button
                 variant="ghost"
                 size="sm"
@@ -337,21 +333,19 @@ export function CodeScreenshotLayout() {
               >
                 <Trash2 className="h-3.5 w-3.5" />
               </Button>
-            </div>
-          </div>
-          <div className="relative min-h-[160px] flex-1">
-            <textarea
-              value={code}
-              onChange={(e) => setCode(e.target.value)}
-              placeholder={t('placeholder')}
-              className="absolute inset-0 h-full w-full resize-none bg-transparent p-4 font-mono text-sm placeholder:text-muted-foreground/50 focus:outline-none"
-              spellCheck={false}
-              autoComplete="off"
-            />
-          </div>
-        </Card>
+            </>
+          }
+        >
+          <ToolTextArea
+            value={code}
+            onChange={(e) => setCode(e.target.value)}
+            placeholder={t('placeholder')}
+            autoComplete="off"
+            className="p-4"
+          />
+        </IOPanel>
 
-        <Card className="flex min-h-0 flex-col overflow-hidden">
+        <div className="flex min-h-0 flex-col overflow-hidden rounded-lg border border-border bg-card">
           <div className="flex items-center border-b border-border/50 bg-muted/30 px-4 py-2.5">
             <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
               {t('previewLabel')}
@@ -405,8 +399,8 @@ export function CodeScreenshotLayout() {
               </div>
             )}
           </div>
-        </Card>
+        </div>
       </div>
-    </div>
+    </ToolShell>
   )
 }
diff --git a/apps/desktop-ui/src/components/color-picker-tool/color-picker-tool-layout.tsx b/apps/desktop-ui/src/components/color-picker-tool/color-picker-tool-layout.tsx
index 42c6c8de..8da9382e 100644
--- a/apps/desktop-ui/src/components/color-picker-tool/color-picker-tool-layout.tsx
+++ b/apps/desktop-ui/src/components/color-picker-tool/color-picker-tool-layout.tsx
@@ -6,7 +6,6 @@ import { useCallback, useMemo, useState } from 'react';
 import { DEFAULT_HEX, channelsFromHex, parseHex, safeHue } from './color-helpers';
 import { useCopyFeedback } from '@/hooks/use-copy-feedback';
 import { Button } from '@/components/ui/button';
-import { Card } from '@/components/ui/card';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
@@ -15,9 +14,7 @@ import { PALETTE_GROUPS } from '@/lib/color-palettes';
 import { Check, Copy, Pipette } from 'lucide-react';
 import { IconPalette } from '@tabler/icons-react';
 import { useTranslations } from 'next-intl';
-import { ToolPageHeader } from '@/components/tools/tool-page-header';
-import { RevealItem } from '@/components/dashboard/dashboard-reveal';
-import { CATEGORY_ACCENT } from '@/components/dashboard/types';
+import { ToolShell } from '@/components/tools/tool-shell';
 
 
 type PaletteId = (typeof PALETTE_GROUPS)[number]['id'];
@@ -146,19 +143,14 @@ export function ColorPickerToolLayout() {
   );
 
   return (
-    <div className="flex flex-col h-full gap-4 min-h-0 overflow-auto">
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconPalette}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-          offline={false}
-        />
-      </RevealItem>
-
+    <ToolShell
+      icon={IconPalette}
+      title={t('title')}
+      description={t('subtitle')}
+      contentClassName="overflow-auto"
+    >
       <div className="grid grid-cols-1 xl:grid-cols-2 gap-4 shrink-0">
-        <Card className="p-4 space-y-4">
+        <div className="rounded-lg border border-border bg-card p-4 space-y-4">
           <div className="flex flex-wrap items-start gap-4">
             <div
               className="h-28 w-28 shrink-0 rounded-xl border border-border shadow-sm"
@@ -320,9 +312,9 @@ export function ColorPickerToolLayout() {
               <CopyRow id="css-hsl" label="hsl" value={hslCss} />
             </div>
           </div>
-        </Card>
+        </div>
 
-        <Card className="p-4 flex flex-col min-h-[280px]">
+        <div className="rounded-lg border border-border bg-card p-4 flex flex-col min-h-[280px]">
           <Label className="text-xs text-muted-foreground uppercase tracking-wider mb-3">
             {t('palettes')}
           </Label>
@@ -387,8 +379,8 @@ export function ColorPickerToolLayout() {
               );
             })}
           </Tabs>
-        </Card>
+        </div>
       </div>
-    </div>
+    </ToolShell>
   );
 }
diff --git a/apps/desktop-ui/src/components/contrast-checker-tool/contrast-checker-tool-layout.tsx b/apps/desktop-ui/src/components/contrast-checker-tool/contrast-checker-tool-layout.tsx
index a49f73fd..0a0a3635 100644
--- a/apps/desktop-ui/src/components/contrast-checker-tool/contrast-checker-tool-layout.tsx
+++ b/apps/desktop-ui/src/components/contrast-checker-tool/contrast-checker-tool-layout.tsx
@@ -4,7 +4,6 @@ import Color from 'color';
 import { useCallback, useMemo, useState } from 'react';
 import { useCopyFeedback } from '@/hooks/use-copy-feedback';
 import { Button } from '@/components/ui/button';
-import { Card } from '@/components/ui/card';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import { cn } from '@/lib/utils';
@@ -12,9 +11,7 @@ import { contrastRatio, meetsLevel, WCAG_THRESHOLDS } from '@/lib/wcag-contrast'
 import { Check, Copy, ArrowDownUp, Pipette } from 'lucide-react';
 import { IconContrast } from '@tabler/icons-react';
 import { useTranslations } from 'next-intl';
-import { ToolPageHeader } from '@/components/tools/tool-page-header';
-import { RevealItem } from '@/components/dashboard/dashboard-reveal';
-import { CATEGORY_ACCENT } from '@/components/dashboard/types';
+import { ToolShell } from '@/components/tools/tool-shell';
 
 const DEFAULT_FG = '#0f172a';
 const DEFAULT_BG = '#f8fafc';
@@ -138,18 +135,14 @@ export function ContrastCheckerToolLayout() {
   ];
 
   return (
-    <div className="flex flex-col h-full gap-4 min-h-0 overflow-auto">
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconContrast}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        />
-      </RevealItem>
-
+    <ToolShell
+      icon={IconContrast}
+      title={t('title')}
+      description={t('subtitle')}
+      contentClassName="overflow-auto"
+    >
       <div className="grid grid-cols-1 xl:grid-cols-2 gap-4 shrink-0">
-        <Card className="p-4 space-y-5">
+        <div className="rounded-lg border border-border bg-card p-4 space-y-5">
           <div className="flex flex-wrap items-center justify-between gap-2">
             <p className="text-sm text-muted-foreground">{t('ratio')}</p>
             <div className="flex items-center gap-2">
@@ -251,9 +244,9 @@ export function ContrastCheckerToolLayout() {
               })}
             </ul>
           </div>
-        </Card>
+        </div>
 
-        <Card className="p-4 flex flex-col gap-3 min-h-[220px]">
+        <div className="rounded-lg border border-border bg-card p-4 flex flex-col gap-3 min-h-[220px]">
           <Label className="text-xs text-muted-foreground uppercase tracking-wider">
             {t('previewHeading')}
           </Label>
@@ -264,9 +257,9 @@ export function ContrastCheckerToolLayout() {
             <p className="text-base leading-relaxed font-medium">{t('previewBody')}</p>
             <p className="mt-4 text-sm opacity-90">{t('previewCaption')}</p>
           </div>
-        </Card>
+        </div>
       </div>
-    </div>
+    </ToolShell>
   );
 }
 
diff --git a/apps/desktop-ui/src/components/css-generators/border-radius-tab.tsx b/apps/desktop-ui/src/components/css-generators/border-radius-tab.tsx
index 3e7e9f68..c63c7868 100644
--- a/apps/desktop-ui/src/components/css-generators/border-radius-tab.tsx
+++ b/apps/desktop-ui/src/components/css-generators/border-radius-tab.tsx
@@ -3,13 +3,13 @@
 import React, { useMemo, useState } from 'react'
 import { useTranslations } from 'next-intl'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
 import { Label } from '@/components/ui/label'
 import { Slider } from '@/components/ui/slider'
 import { Switch } from '@/components/ui/switch'
 import { ToggleGroup, ToggleGroupItem } from '@/components/ui/toggle-group'
 import { Link2, Shuffle, Unlink2 } from 'lucide-react'
 import { buildBorderRadius, randomBlob, type BorderRadiusState, type RadiusUnit } from '@/lib/css-generators'
+import { IOPanel } from '@/components/tools/io-panel'
 import { CssOutput } from './css-output'
 
 type Corner = 'tl' | 'tr' | 'br' | 'bl'
@@ -49,7 +49,7 @@ export function BorderRadiusTab() {
   return (
     <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 lg:grid-cols-2">
       <div className="flex min-h-0 flex-col gap-4 overflow-y-auto pr-1">
-        <Card className="flex flex-wrap items-center gap-4 p-4">
+        <div className="flex flex-wrap items-center gap-4 rounded-lg border border-border bg-card p-4">
           <div className="space-y-1.5">
             <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
               {t('borderRadius.modeLabel')}
@@ -103,10 +103,10 @@ export function BorderRadiusTab() {
               {t('borderRadius.randomize')}
             </Button>
           )}
-        </Card>
+        </div>
 
         {state.mode === 'simple' ? (
-          <Card className="space-y-3 p-4">
+          <div className="space-y-3 rounded-lg border border-border bg-card p-4">
             {CORNERS.map((corner) => (
               <div key={corner} className="grid grid-cols-[6.5rem_1fr_4rem] items-center gap-2">
                 <Label className="text-xs text-muted-foreground">{t(`borderRadius.corners.${corner}`)}</Label>
@@ -122,10 +122,10 @@ export function BorderRadiusTab() {
                 </span>
               </div>
             ))}
-          </Card>
+          </div>
         ) : (
           <>
-            <Card className="space-y-3 p-4">
+            <div className="space-y-3 rounded-lg border border-border bg-card p-4">
               <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
                 {t('borderRadius.horizontal')}
               </Label>
@@ -136,8 +136,8 @@ export function BorderRadiusTab() {
                   <span className="text-right font-mono text-xs text-muted-foreground">{state.h[i]}%</span>
                 </div>
               ))}
-            </Card>
-            <Card className="space-y-3 p-4">
+            </div>
+            <div className="space-y-3 rounded-lg border border-border bg-card p-4">
               <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
                 {t('borderRadius.vertical')}
               </Label>
@@ -148,23 +148,20 @@ export function BorderRadiusTab() {
                   <span className="text-right font-mono text-xs text-muted-foreground">{state.v[i]}%</span>
                 </div>
               ))}
-            </Card>
+            </div>
           </>
         )}
       </div>
 
       <div className="flex min-h-0 flex-col gap-4">
-        <Card className="flex flex-1 flex-col overflow-hidden">
-          <div className="border-b border-border/50 bg-muted/30 px-3 py-2">
-            <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">{t('preview')}</Label>
-          </div>
+        <IOPanel label={t('preview')} className="flex-1" bodyClassName="flex flex-col">
           <div className="flex min-h-[220px] flex-1 items-center justify-center p-8">
             <div
               className="h-48 w-48 border border-border/40 bg-gradient-to-br from-pink-500/70 to-violet-500/70"
               style={{ borderRadius: value }}
             />
           </div>
-        </Card>
+        </IOPanel>
         <CssOutput css={css} />
       </div>
     </div>
diff --git a/apps/desktop-ui/src/components/css-generators/box-shadow-tab.tsx b/apps/desktop-ui/src/components/css-generators/box-shadow-tab.tsx
index 4ab31d63..27758b92 100644
--- a/apps/desktop-ui/src/components/css-generators/box-shadow-tab.tsx
+++ b/apps/desktop-ui/src/components/css-generators/box-shadow-tab.tsx
@@ -3,13 +3,13 @@
 import React, { useMemo, useState } from 'react'
 import { useTranslations } from 'next-intl'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Slider } from '@/components/ui/slider'
 import { Switch } from '@/components/ui/switch'
 import { Plus, Trash2 } from 'lucide-react'
 import { buildBoxShadow, SHADOW_PRESETS, type ShadowLayer } from '@/lib/css-generators'
+import { IOPanel } from '@/components/tools/io-panel'
 import { CssOutput } from './css-output'
 
 const DEFAULT_LAYER: ShadowLayer = { x: 0, y: 4, blur: 12, spread: 0, color: '#000000', alpha: 0.25, inset: false }
@@ -60,7 +60,7 @@ export function BoxShadowTab() {
   return (
     <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 lg:grid-cols-2">
       <div className="flex min-h-0 flex-col gap-4 overflow-y-auto pr-1">
-        <Card className="space-y-2 p-4">
+        <div className="space-y-2 rounded-lg border border-border bg-card p-4">
           <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
             {t('boxShadow.presets')}
           </Label>
@@ -78,10 +78,10 @@ export function BoxShadowTab() {
               </Button>
             ))}
           </div>
-        </Card>
+        </div>
 
         {layers.map((layer, i) => (
-          <Card key={i} className="space-y-3 p-4">
+          <div key={i} className="space-y-3 rounded-lg border border-border bg-card p-4">
             <div className="flex items-center justify-between">
               <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
                 {t('boxShadow.layer')} {i + 1}
@@ -132,7 +132,7 @@ export function BoxShadowTab() {
                 <Label className="text-xs text-muted-foreground">{t('boxShadow.inset')}</Label>
               </div>
             </div>
-          </Card>
+          </div>
         ))}
 
         <Button type="button" variant="outline" size="sm" onClick={() => setLayers((prev) => [...prev, { ...DEFAULT_LAYER }])}>
@@ -142,10 +142,7 @@ export function BoxShadowTab() {
       </div>
 
       <div className="flex min-h-0 flex-col gap-4">
-        <Card className="flex flex-1 flex-col overflow-hidden">
-          <div className="border-b border-border/50 bg-muted/30 px-3 py-2">
-            <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">{t('preview')}</Label>
-          </div>
+        <IOPanel label={t('preview')} className="flex-1" bodyClassName="flex flex-col">
           <div
             className="flex min-h-[220px] flex-1 items-center justify-center p-8"
             style={{
@@ -159,7 +156,7 @@ export function BoxShadowTab() {
               style={{ boxShadow: shadowValue }}
             />
           </div>
-        </Card>
+        </IOPanel>
         <CssOutput css={css} />
       </div>
     </div>
diff --git a/apps/desktop-ui/src/components/css-generators/clamp-tab.tsx b/apps/desktop-ui/src/components/css-generators/clamp-tab.tsx
index 4f62749a..a5b82315 100644
--- a/apps/desktop-ui/src/components/css-generators/clamp-tab.tsx
+++ b/apps/desktop-ui/src/components/css-generators/clamp-tab.tsx
@@ -2,11 +2,11 @@
 
 import React, { useMemo, useState } from 'react'
 import { useTranslations } from 'next-intl'
-import { Card } from '@/components/ui/card'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Slider } from '@/components/ui/slider'
 import { buildClamp, clampSizeAtViewport, type ClampResult } from '@/lib/css-generators'
+import { IOPanel } from '@/components/tools/io-panel'
 import { CssOutput } from './css-output'
 
 interface NumberFieldProps {
@@ -61,15 +61,15 @@ export function ClampTab() {
   return (
     <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 lg:grid-cols-2">
       <div className="flex min-h-0 flex-col gap-4 overflow-y-auto pr-1">
-        <Card className="grid grid-cols-2 gap-3 p-4">
+        <div className="grid grid-cols-2 gap-3 rounded-lg border border-border bg-card p-4">
           <NumberField label={t('clamp.minFont')} value={minPx} onChange={setMinPx} min={1} />
           <NumberField label={t('clamp.maxFont')} value={maxPx} onChange={setMaxPx} min={1} />
           <NumberField label={t('clamp.minViewport')} value={minVw} onChange={setMinVw} min={1} />
           <NumberField label={t('clamp.maxViewport')} value={maxVw} onChange={setMaxVw} min={1} />
           <NumberField label={t('clamp.rootFont')} value={rootPx} onChange={setRootPx} min={1} />
-        </Card>
+        </div>
 
-        <Card className="space-y-3 p-4">
+        <div className="space-y-3 rounded-lg border border-border bg-card p-4">
           <div className="flex items-center justify-between">
             <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
               {t('clamp.viewportWidth')}
@@ -87,25 +87,22 @@ export function ClampTab() {
             {t('clamp.computedSize')}: <span className="font-mono text-foreground">{sizeAtSim}px</span>
             {' '}({(sizeAtSim / rootPx).toFixed(3)}rem)
           </p>
-        </Card>
+        </div>
 
         {result && (
-          <Card className="space-y-1 p-4 text-xs text-muted-foreground">
+          <div className="space-y-1 rounded-lg border border-border bg-card p-4 text-xs text-muted-foreground">
             <p>
               {t('clamp.slope')}: <span className="font-mono text-foreground">{result.slopeVw}vw</span>
             </p>
             <p>
               {t('clamp.intercept')}: <span className="font-mono text-foreground">{result.interceptRem}rem</span>
             </p>
-          </Card>
+          </div>
         )}
       </div>
 
       <div className="flex min-h-0 flex-col gap-4">
-        <Card className="flex flex-1 flex-col overflow-hidden">
-          <div className="border-b border-border/50 bg-muted/30 px-3 py-2">
-            <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">{t('preview')}</Label>
-          </div>
+        <IOPanel label={t('preview')} className="flex-1" bodyClassName="flex flex-col">
           <div className="flex min-h-[220px] flex-1 items-center justify-center overflow-hidden p-6">
             {result ? (
               <h2
@@ -118,7 +115,7 @@ export function ClampTab() {
               <p className="text-sm text-destructive">{t('clamp.invalid')}</p>
             )}
           </div>
-        </Card>
+        </IOPanel>
         {result && <CssOutput css={css} />}
       </div>
     </div>
diff --git a/apps/desktop-ui/src/components/css-generators/css-generators-layout.tsx b/apps/desktop-ui/src/components/css-generators/css-generators-layout.tsx
index fa82f85b..a80a6315 100644
--- a/apps/desktop-ui/src/components/css-generators/css-generators-layout.tsx
+++ b/apps/desktop-ui/src/components/css-generators/css-generators-layout.tsx
@@ -4,9 +4,7 @@ import React from 'react'
 import { useTranslations } from 'next-intl'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
 import { IconPalette } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
 import { BoxShadowTab } from './box-shadow-tab'
 import { BorderRadiusTab } from './border-radius-tab'
 import { ClampTab } from './clamp-tab'
@@ -15,18 +13,7 @@ export function CssGeneratorsLayout() {
   const t = useTranslations('CssGenerators')
 
   return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconPalette}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        />
-      </RevealItem>
-
+    <ToolShell icon={IconPalette} title={t('title')} description={t('subtitle')}>
       <Tabs defaultValue="boxShadow" className="flex min-h-0 flex-1 flex-col gap-4">
         <TabsList className="w-fit">
           <TabsTrigger value="boxShadow">{t('tabs.boxShadow')}</TabsTrigger>
@@ -43,6 +30,6 @@ export function CssGeneratorsLayout() {
           <ClampTab />
         </TabsContent>
       </Tabs>
-    </div>
+    </ToolShell>
   )
 }
diff --git a/apps/desktop-ui/src/components/css-gradient-builder/gradient-layout.tsx b/apps/desktop-ui/src/components/css-gradient-builder/gradient-layout.tsx
index 0b544e4b..2c316325 100644
--- a/apps/desktop-ui/src/components/css-gradient-builder/gradient-layout.tsx
+++ b/apps/desktop-ui/src/components/css-gradient-builder/gradient-layout.tsx
@@ -3,7 +3,6 @@
 import { useState, useMemo, useCallback } from 'react';
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard';
 import { useTranslations } from 'next-intl';
-import { Card } from '@/components/ui/card';
 import { Label } from '@/components/ui/label';
 import { Input } from '@/components/ui/input';
 import { Button } from '@/components/ui/button';
@@ -19,9 +18,7 @@ import { Check, Copy, Plus, Trash, Dices, ArrowLeftRight, Download, Wand2 } from
 import { IconColorSwatch } from '@tabler/icons-react';
 import { cn } from '@/lib/utils';
 import { ScrollArea, ScrollBar } from '@/components/ui/scroll-area';
-import { ToolPageHeader } from '@/components/tools/tool-page-header';
-import { RevealItem } from '@/components/dashboard/dashboard-reveal';
-import { CATEGORY_ACCENT } from '@/components/dashboard/types';
+import { ToolShell } from '@/components/tools/tool-shell';
 
 type GradientType = 'linear' | 'radial' | 'conic';
 
@@ -165,21 +162,18 @@ export function GradientLayout() {
   };
 
   return (
-    <div className="flex flex-col h-full gap-4 min-h-0 overflow-auto pb-4">
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconColorSwatch}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        />
-      </RevealItem>
+    <ToolShell
+      icon={IconColorSwatch}
+      title={t('title')}
+      description={t('subtitle')}
+      contentClassName="overflow-auto pb-4"
+    >
 
       <div className="grid grid-cols-1 xl:grid-cols-2 gap-4 shrink-0">
         
         {/* Left Column: Preview + Settings */}
         <div className="flex flex-col gap-4">
-          <Card className="p-4 flex flex-col items-center justify-center relative overflow-hidden group">
+          <div className="group relative flex flex-col items-center justify-center overflow-hidden rounded-lg border border-border bg-card p-4">
             <Label className="text-xs text-muted-foreground uppercase w-full text-left tracking-wider mb-3 z-10">
               {t('preview')}
             </Label>
@@ -187,9 +181,9 @@ export function GradientLayout() {
               className="w-full h-48 sm:h-72 rounded-xl border border-border shadow-inner transition-all duration-300 ease-out z-10"
               style={{ background: cssValue }}
             />
-          </Card>
+          </div>
 
-          <Card className="p-4 space-y-5">
+          <div className="space-y-5 rounded-lg border border-border bg-card p-4">
             <div className="flex items-center justify-between">
               <Label className="text-xs text-muted-foreground uppercase tracking-wider">
                 {t('settings')}
@@ -247,9 +241,9 @@ export function GradientLayout() {
                 </div>
               )}
             </div>
-          </Card>
+          </div>
 
-          <Card className="p-4 space-y-3">
+          <div className="space-y-3 rounded-lg border border-border bg-card p-4">
             <div className="flex items-center justify-between">
               <Label className="text-xs text-muted-foreground uppercase tracking-wider">
                 {t('output')}
@@ -277,12 +271,12 @@ export function GradientLayout() {
                 </Button>
               </div>
             </div>
-          </Card>
+          </div>
         </div>
 
         {/* Right Column: Stops & Presets */}
         <div className="flex flex-col gap-4">
-          <Card className="p-4 flex flex-col">
+          <div className="flex flex-col rounded-lg border border-border bg-card p-4">
              <div className="flex items-center justify-between mb-3">
               <Label className="text-xs text-muted-foreground uppercase tracking-wider">
                 {t('presets')}
@@ -317,9 +311,9 @@ export function GradientLayout() {
                </div>
                <ScrollBar orientation="horizontal" />
              </ScrollArea>
-          </Card>
+          </div>
 
-          <Card className="p-4 flex flex-col flex-1">
+          <div className="flex flex-1 flex-col rounded-lg border border-border bg-card p-4">
             <div className="flex items-center justify-between mb-4">
               <Label className="text-xs text-muted-foreground uppercase tracking-wider">
                 {t('stops')}
@@ -406,10 +400,10 @@ export function GradientLayout() {
               ))}
             </div>
             
-          </Card>
+          </div>
         </div>
 
       </div>
-    </div>
+    </ToolShell>
   );
 }
diff --git a/apps/desktop-ui/src/components/exif-viewer/exif-viewer-layout.tsx b/apps/desktop-ui/src/components/exif-viewer/exif-viewer-layout.tsx
index 07d8f35c..9511b994 100644
--- a/apps/desktop-ui/src/components/exif-viewer/exif-viewer-layout.tsx
+++ b/apps/desktop-ui/src/components/exif-viewer/exif-viewer-layout.tsx
@@ -8,9 +8,7 @@ import { toast } from 'sonner'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
 import { Badge } from '@/components/ui/badge'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
 import { Checkbox } from '@/components/ui/checkbox'
-import { Label } from '@/components/ui/label'
 import { ScrollArea } from '@/components/ui/scroll-area'
 import {
   Collapsible,
@@ -34,9 +32,8 @@ import {
   Wrench,
 } from 'lucide-react'
 import { IconPhotoSearch } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
+import { IOPanel } from '@/components/tools/io-panel'
 import {
   decimalToDms,
   formatBytes,
@@ -92,7 +89,7 @@ function MetadataCard({
 }) {
   if (entries.length === 0) return null
   return (
-    <Card className="p-4">
+    <div className="rounded-lg border border-border bg-card p-4">
       <div className="mb-2.5 flex items-center gap-2">
         {icon}
         <h3 className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">{title}</h3>
@@ -105,7 +102,7 @@ function MetadataCard({
           </div>
         ))}
       </dl>
-    </Card>
+    </div>
   )
 }
 
@@ -222,121 +219,113 @@ export function ExifViewerLayout() {
 
   if (!image) {
     return (
-      <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-        <div className="dash-ambient -z-10" aria-hidden />
-        <RevealItem index={0}>
-          <ToolPageHeader
-            icon={IconPhotoSearch}
-            title={t('title')}
-            description={t('subtitle')}
-            accent={CATEGORY_ACCENT['Media & Design']}
-          />
-        </RevealItem>
-        <Card
-          className={`flex flex-1 cursor-pointer flex-col items-center justify-center gap-3 border-2 border-dashed p-8 text-center transition-colors ${
-            dragOver ? 'border-primary bg-primary/5' : 'border-border/70'
-          }`}
-          onClick={() => inputRef.current?.click()}
+      <ToolShell icon={IconPhotoSearch} title={t('title')} description={t('subtitle')}>
+        <IOPanel
+          label={t('dropTitle')}
           onDragOver={(e) => {
             e.preventDefault()
             setDragOver(true)
           }}
           onDragLeave={() => setDragOver(false)}
           onDrop={onDrop}
-          role="button"
-          tabIndex={0}
-          onKeyDown={(e) => {
-            if (e.key === 'Enter' || e.key === ' ') inputRef.current?.click()
-          }}
+          className={`flex-1 transition-colors ${dragOver ? 'border-primary bg-primary/5' : ''}`}
         >
-          <span className="flex h-12 w-12 items-center justify-center rounded-2xl bg-pink-500/10 text-pink-600 dark:text-pink-400">
-            <Upload className="h-6 w-6" />
-          </span>
-          <div>
-            <p className="text-sm font-medium">{t('dropTitle')}</p>
-            <p className="mt-1 text-xs text-muted-foreground">{t('dropHint')}</p>
-          </div>
-          <Button size="sm" variant="secondary" type="button">
-            {t('browse')}
-          </Button>
-          <p className="text-[11px] text-muted-foreground/70">{t('formats')}</p>
-          <input
-            ref={inputRef}
-            type="file"
-            accept={ACCEPT}
-            className="hidden"
-            onChange={(e) => {
-              const file = e.target.files?.[0]
-              if (file) void loadFile(file)
-              e.target.value = ''
+          <div
+            className="absolute inset-0 flex cursor-pointer flex-col items-center justify-center gap-3 p-8 text-center"
+            onClick={() => inputRef.current?.click()}
+            role="button"
+            tabIndex={0}
+            onKeyDown={(e) => {
+              if (e.key === 'Enter' || e.key === ' ') inputRef.current?.click()
             }}
-          />
-        </Card>
-      </div>
+          >
+            <span className="flex h-12 w-12 items-center justify-center rounded-2xl bg-pink-500/10 text-pink-600 dark:text-pink-400">
+              <Upload className="h-6 w-6" />
+            </span>
+            <div>
+              <p className="text-sm font-medium">{t('dropTitle')}</p>
+              <p className="mt-1 text-xs text-muted-foreground">{t('dropHint')}</p>
+            </div>
+            <Button size="sm" variant="secondary" type="button">
+              {t('browse')}
+            </Button>
+            <p className="text-[11px] text-muted-foreground/70">{t('formats')}</p>
+            <input
+              ref={inputRef}
+              type="file"
+              accept={ACCEPT}
+              className="hidden"
+              onChange={(e) => {
+                const file = e.target.files?.[0]
+                if (file) void loadFile(file)
+                e.target.value = ''
+              }}
+            />
+          </div>
+        </IOPanel>
+      </ToolShell>
     )
   }
 
   return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconPhotoSearch}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        />
-      </RevealItem>
-
+    <ToolShell icon={IconPhotoSearch} title={t('title')} description={t('subtitle')}>
       <ScrollArea className="min-h-0 flex-1">
         <div className="flex flex-col gap-4 pr-3">
-          <Card className="flex flex-wrap items-center gap-4 p-4">
-            {/* eslint-disable-next-line @next/next/no-img-element */}
-            <img
-              src={image.url}
-              alt={image.file.name}
-              className="h-20 w-20 rounded-lg border border-border/60 object-cover"
-              onLoad={(e) => {
-                const el = e.currentTarget
-                if (el.naturalWidth) setDimensions({ w: el.naturalWidth, h: el.naturalHeight })
-              }}
-              onError={(e) => {
-                e.currentTarget.style.visibility = 'hidden'
-              }}
-            />
-            <dl className="grid flex-1 grid-cols-2 gap-x-6 gap-y-1.5 text-sm sm:grid-cols-4">
-              <div>
-                <dt className="text-xs text-muted-foreground">{t('facts.name')}</dt>
-                <dd className="break-all font-medium">{image.file.name}</dd>
-              </div>
-              <div>
-                <dt className="text-xs text-muted-foreground">{t('facts.type')}</dt>
-                <dd className="font-mono text-xs">{image.file.type || '—'}</dd>
-              </div>
-              <div>
-                <dt className="text-xs text-muted-foreground">{t('facts.dimensions')}</dt>
-                <dd className="font-mono text-xs">{dimensions ? `${dimensions.w} × ${dimensions.h}` : '—'}</dd>
-              </div>
-              <div>
-                <dt className="text-xs text-muted-foreground">{t('facts.size')}</dt>
-                <dd className="font-mono text-xs">{formatBytes(image.file.size)}</dd>
-              </div>
-            </dl>
-            <div className="flex items-center gap-2">
-              {gps && (
-                <Badge className="gap-1 border-amber-500/40 bg-amber-500/15 text-amber-700 dark:text-amber-400" variant="outline">
-                  <ShieldAlert className="h-3.5 w-3.5" />
-                  {t('gpsWarning')}
-                </Badge>
-              )}
-              <Button variant="ghost" size="icon" className="h-8 w-8" onClick={reset} title={t('clear')}>
-                <Trash2 className="h-4 w-4" />
-              </Button>
+          <IOPanel
+            label={image.file.name}
+            actions={
+              <>
+                {gps && (
+                  <Badge className="gap-1 border-amber-500/40 bg-amber-500/15 text-amber-700 dark:text-amber-400" variant="outline">
+                    <ShieldAlert className="h-3.5 w-3.5" />
+                    {t('gpsWarning')}
+                  </Badge>
+                )}
+                <Button variant="ghost" size="icon" className="h-8 w-8" onClick={reset} title={t('clear')}>
+                  <Trash2 className="h-4 w-4" />
+                </Button>
+              </>
+            }
+          >
+            <div className="flex flex-wrap items-center gap-4 p-4">
+              {/* eslint-disable-next-line @next/next/no-img-element */}
+              <img
+                src={image.url}
+                alt={image.file.name}
+                className="h-20 w-20 rounded-lg border border-border/60 object-cover"
+                onLoad={(e) => {
+                  const el = e.currentTarget
+                  if (el.naturalWidth) setDimensions({ w: el.naturalWidth, h: el.naturalHeight })
+                }}
+                onError={(e) => {
+                  e.currentTarget.style.visibility = 'hidden'
+                }}
+              />
+              <dl className="grid flex-1 grid-cols-2 gap-x-6 gap-y-1.5 text-sm sm:grid-cols-4">
+                <div>
+                  <dt className="text-xs text-muted-foreground">{t('facts.name')}</dt>
+                  <dd className="break-all font-medium">{image.file.name}</dd>
+                </div>
+                <div>
+                  <dt className="text-xs text-muted-foreground">{t('facts.type')}</dt>
+                  <dd className="font-mono text-xs">{image.file.type || '—'}</dd>
+                </div>
+                <div>
+                  <dt className="text-xs text-muted-foreground">{t('facts.dimensions')}</dt>
+                  <dd className="font-mono text-xs">{dimensions ? `${dimensions.w} × ${dimensions.h}` : '—'}</dd>
+                </div>
+                <div>
+                  <dt className="text-xs text-muted-foreground">{t('facts.size')}</dt>
+                  <dd className="font-mono text-xs">{formatBytes(image.file.size)}</dd>
+                </div>
+              </dl>
             </div>
-          </Card>
+          </IOPanel>
 
           {parsing ? (
-            <Card className="p-6 text-center text-sm text-muted-foreground">{t('parsing')}</Card>
+            <div className="rounded-lg border border-border bg-card p-6 text-center text-sm text-muted-foreground">
+              {t('parsing')}
+            </div>
           ) : hasMetadata && groups ? (
             <div className="grid grid-cols-1 gap-4 md:grid-cols-2 xl:grid-cols-3">
               <MetadataCard
@@ -355,7 +344,7 @@ export function ExifViewerLayout() {
                 entries={groups.timestamps}
               />
               {gps && (
-                <Card className="border-amber-500/30 p-4">
+                <div className="rounded-lg border border-amber-500/30 bg-card p-4">
                   <div className="mb-2.5 flex items-center gap-2">
                     <MapPin className="h-3.5 w-3.5 text-amber-600 dark:text-amber-400" />
                     <h3 className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">
@@ -391,7 +380,7 @@ export function ExifViewerLayout() {
                     <ExternalLink className="h-3.5 w-3.5" />
                     {t('openMap')}
                   </a>
-                </Card>
+                </div>
               )}
               <MetadataCard
                 title={t('groups.software')}
@@ -400,15 +389,15 @@ export function ExifViewerLayout() {
               />
             </div>
           ) : (
-            <Card className="flex items-center gap-3 p-6 text-sm text-muted-foreground">
+            <div className="flex items-center gap-3 rounded-lg border border-border bg-card p-6 text-sm text-muted-foreground">
               <Info className="h-4 w-4 shrink-0" />
               {t('noMetadata')}
-            </Card>
+            </div>
           )}
 
           {tags && hasMetadata && (
             <Collapsible open={rawOpen} onOpenChange={setRawOpen}>
-              <Card className="overflow-hidden">
+              <div className="overflow-hidden rounded-lg border border-border bg-card">
                 <div className="flex items-center justify-between px-4 py-2.5">
                   <CollapsibleTrigger asChild>
                     <button
@@ -450,11 +439,11 @@ export function ExifViewerLayout() {
                     </table>
                   </div>
                 </CollapsibleContent>
-              </Card>
+              </div>
             </Collapsible>
           )}
 
-          <Card className="p-4">
+          <div className="rounded-lg border border-border bg-card p-4">
             <h3 className="mb-1 text-xs font-semibold uppercase tracking-wider text-muted-foreground">
               {t('remove.title')}
             </h3>
@@ -499,9 +488,9 @@ export function ExifViewerLayout() {
                 </Button>
               </div>
             )}
-          </Card>
+          </div>
         </div>
       </ScrollArea>
-    </div>
+    </ToolShell>
   )
 }
diff --git a/apps/desktop-ui/src/components/favicon-generator/favicon-generator-layout.tsx b/apps/desktop-ui/src/components/favicon-generator/favicon-generator-layout.tsx
index 90a0e8f3..b6eb7286 100644
--- a/apps/desktop-ui/src/components/favicon-generator/favicon-generator-layout.tsx
+++ b/apps/desktop-ui/src/components/favicon-generator/favicon-generator-layout.tsx
@@ -7,7 +7,6 @@ import { saveAs } from 'file-saver'
 import { toast } from 'sonner'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Slider } from '@/components/ui/slider'
@@ -15,9 +14,7 @@ import { ScrollArea } from '@/components/ui/scroll-area'
 import { ToggleGroup, ToggleGroupItem } from '@/components/ui/toggle-group'
 import { Check, Copy, Download, Package, Trash2, Upload } from 'lucide-react'
 import { IconFavicon } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
 import {
   ICON_SIZES,
   ICO_SIZES,
@@ -196,19 +193,9 @@ export function FaviconGeneratorLayout() {
 
   if (!source) {
     return (
-      <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-        <div className="dash-ambient -z-10" aria-hidden />
-        <RevealItem index={0}>
-          <ToolPageHeader
-            icon={IconFavicon}
-            title={t('title')}
-            description={t('subtitle')}
-            accent={CATEGORY_ACCENT['Media & Design']}
-            offline={false}
-          />
-        </RevealItem>
-        <Card
-          className={`flex flex-1 cursor-pointer flex-col items-center justify-center gap-3 border-2 border-dashed p-8 text-center transition-colors ${
+      <ToolShell icon={IconFavicon} title={t('title')} description={t('subtitle')} offline={false}>
+        <div
+          className={`flex flex-1 cursor-pointer flex-col items-center justify-center gap-3 rounded-lg border-2 border-dashed p-8 text-center transition-colors ${
             dragOver ? 'border-primary bg-primary/5' : 'border-border/70'
           }`}
           onClick={() => inputRef.current?.click()}
@@ -245,26 +232,15 @@ export function FaviconGeneratorLayout() {
               e.target.value = ''
             }}
           />
-        </Card>
-      </div>
+        </div>
+      </ToolShell>
     )
   }
 
   return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconFavicon}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        offline={false}
-        />
-      </RevealItem>
-
+    <ToolShell icon={IconFavicon} title={t('title')} description={t('subtitle')} offline={false}>
       <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 lg:grid-cols-[300px_1fr]">
-        <Card className="flex flex-col gap-5 p-4">
+        <div className="flex flex-col gap-5 rounded-lg border border-border bg-card p-4">
           <div className="flex items-center justify-between">
             <span className="truncate text-sm font-medium" title={sourceName}>
               {sourceName}
@@ -351,11 +327,11 @@ export function FaviconGeneratorLayout() {
               {t('downloadZip')}
             </Button>
           </div>
-        </Card>
+        </div>
 
         <ScrollArea className="min-h-0">
           <div className="flex flex-col gap-4 pr-3">
-            <Card className="p-4">
+            <div className="rounded-lg border border-border bg-card p-4">
               <h3 className="mb-3 text-xs font-semibold uppercase tracking-wider text-muted-foreground">
                 {t('previewLabel')}
               </h3>
@@ -382,9 +358,9 @@ export function FaviconGeneratorLayout() {
                   </div>
                 ))}
               </div>
-            </Card>
+            </div>
 
-            <Card className="p-4">
+            <div className="rounded-lg border border-border bg-card p-4">
               <div className="mb-2 flex items-center justify-between">
                 <h3 className="font-mono text-xs font-semibold text-muted-foreground">site.webmanifest</h3>
                 <Button size="sm" variant="secondary" onClick={() => copySnippet('manifest', manifestSnippet)}>
@@ -397,9 +373,9 @@ export function FaviconGeneratorLayout() {
                 </Button>
               </div>
               <pre className="overflow-x-auto rounded-lg bg-muted/50 p-3 font-mono text-xs">{manifestSnippet}</pre>
-            </Card>
+            </div>
 
-            <Card className="p-4">
+            <div className="rounded-lg border border-border bg-card p-4">
               <div className="mb-2 flex items-center justify-between">
                 <h3 className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">
                   {t('headSnippet')}
@@ -414,10 +390,10 @@ export function FaviconGeneratorLayout() {
                 </Button>
               </div>
               <pre className="overflow-x-auto rounded-lg bg-muted/50 p-3 font-mono text-xs">{headSnippet}</pre>
-            </Card>
+            </div>
           </div>
         </ScrollArea>
       </div>
-    </div>
+    </ToolShell>
   )
 }
diff --git a/apps/desktop-ui/src/components/image-compressor/image-compressor-layout.tsx b/apps/desktop-ui/src/components/image-compressor/image-compressor-layout.tsx
index 17ec3551..266e41e7 100644
--- a/apps/desktop-ui/src/components/image-compressor/image-compressor-layout.tsx
+++ b/apps/desktop-ui/src/components/image-compressor/image-compressor-layout.tsx
@@ -12,7 +12,6 @@ import {
   Loader2,
 } from 'lucide-react';
 import { Button } from '@/components/ui/button';
-import { Card } from '@/components/ui/card';
 import { Label } from '@/components/ui/label';
 import { Slider } from '@/components/ui/slider';
 import {
@@ -25,9 +24,8 @@ import {
 import { IconArrowsDiagonalMinimize2 } from '@tabler/icons-react';
 import { cn } from '@/lib/utils';
 import { useDebouncedCallback } from 'use-debounce';
-import { ToolPageHeader } from '@/components/tools/tool-page-header';
-import { RevealItem } from '@/components/dashboard/dashboard-reveal';
-import { CATEGORY_ACCENT } from '@/components/dashboard/types';
+import { ToolShell } from '@/components/tools/tool-shell';
+import { ToolPanels, IOPanel } from '@/components/tools/io-panel';
 
 const MAX_FILE_BYTES = 20 * 1024 * 1024;
 const MAX_CANVAS_EDGE = 8192;
@@ -251,46 +249,43 @@ export function ImageCompressorLayout() {
       ? Math.round((1 - compressedBytes / originalBytes) * 1000) / 10
       : null;
 
-  return (
-    <div className="flex h-full min-h-0 flex-col gap-4">
-      <RevealItem index={0} className="shrink-0">
-        <div className="flex flex-col items-start justify-between gap-3 sm:flex-row sm:items-center">
-        <ToolPageHeader
-          icon={IconArrowsDiagonalMinimize2}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        />
-        <div className="flex items-center gap-2">
-          <Button
-            variant="outline"
-            size="sm"
-            className="gap-1.5 text-xs"
-            onClick={() => fileInputRef.current?.click()}
-          >
-            <Upload className="h-3.5 w-3.5" />
-            {t('upload')}
-          </Button>
-          <input
-            ref={fileInputRef}
-            type="file"
-            accept="image/jpeg,image/png,image/webp,image/gif,image/avif,image/bmp"
-            className="hidden"
-            onChange={(e) => {
-              const file = e.target.files?.[0];
-              if (file) loadFile(file);
-              e.target.value = '';
-            }}
-          />
-          <Button variant="outline" size="sm" className="gap-1.5 text-xs" onClick={handleClear}>
-            <Trash2 className="h-3.5 w-3.5" />
-            {t('clear')}
-          </Button>
-        </div>
-        </div>
-      </RevealItem>
+  const toolbar = (
+    <div className="flex shrink-0 items-center justify-end gap-2">
+      <Button
+        variant="outline"
+        size="sm"
+        className="gap-1.5 text-xs"
+        onClick={() => fileInputRef.current?.click()}
+      >
+        <Upload className="h-3.5 w-3.5" />
+        {t('upload')}
+      </Button>
+      <input
+        ref={fileInputRef}
+        type="file"
+        accept="image/jpeg,image/png,image/webp,image/gif,image/avif,image/bmp"
+        className="hidden"
+        onChange={(e) => {
+          const file = e.target.files?.[0];
+          if (file) loadFile(file);
+          e.target.value = '';
+        }}
+      />
+      <Button variant="outline" size="sm" className="gap-1.5 text-xs" onClick={handleClear}>
+        <Trash2 className="h-3.5 w-3.5" />
+        {t('clear')}
+      </Button>
+    </div>
+  );
 
-      <Card className="shrink-0 border-border/60 p-4">
+  return (
+    <ToolShell
+      icon={IconArrowsDiagonalMinimize2}
+      title={t('title')}
+      description={t('subtitle')}
+      toolbar={toolbar}
+    >
+      <div className="shrink-0 rounded-lg border border-border bg-card p-4">
         <div className="grid gap-4 sm:grid-cols-2">
           <div className="space-y-2">
             <Label className="text-xs font-medium text-muted-foreground">{t('outputFormat')}</Label>
@@ -344,7 +339,7 @@ export function ImageCompressorLayout() {
             )}
           </div>
         )}
-      </Card>
+      </div>
 
       {isMobile && (
         <div className="flex shrink-0 rounded-lg border bg-muted/40 p-1 gap-1">
@@ -365,85 +360,89 @@ export function ImageCompressorLayout() {
         </div>
       )}
 
-      <div className={`min-h-0 flex-1 ${isMobile ? 'flex flex-col' : 'grid grid-cols-2 gap-4'}`}>
-        {(!isMobile || mobileTab === 'original') && <Card
-          className={cn(
-            'relative flex min-h-[220px] flex-col overflow-hidden transition-colors flex-1',
-            isDragging && 'border-primary/50 bg-primary/5',
-            !sourceUrl && 'border-dashed'
-          )}
-          onDrop={handleDrop}
-          onDragOver={(e) => {
-            e.preventDefault();
-            setIsDragging(true);
-          }}
-          onDragLeave={() => setIsDragging(false)}
-        >
-          <div className="flex shrink-0 items-center justify-between border-b border-border/50 bg-muted/30 px-4 py-2.5">
-            <div className="flex items-center gap-2">
-              <ImageIcon className="h-3.5 w-3.5 text-muted-foreground" />
-              <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                {t('panels.original')}
-              </Label>
-            </div>
-            {sourceUrl && (
-              <Button variant="ghost" size="icon" className="h-6 w-6 -mr-2" onClick={handleClear}>
-                <Trash2 className="h-3.5 w-3.5" />
-              </Button>
+      <ToolPanels>
+        {(!isMobile || mobileTab === 'original') && (
+          <IOPanel
+            onDrop={handleDrop}
+            onDragOver={(e) => {
+              e.preventDefault();
+              setIsDragging(true);
+            }}
+            onDragLeave={() => setIsDragging(false)}
+            className={cn(
+              'min-h-[220px] flex-1 transition-colors',
+              isDragging && 'border-primary/50 bg-primary/5',
+              !sourceUrl && 'border-dashed'
             )}
-          </div>
-          <div
-            className="relative flex flex-1 cursor-pointer items-center justify-center p-4"
-            onClick={() => !sourceUrl && fileInputRef.current?.click()}
+            label={
+              <>
+                <ImageIcon className="h-3.5 w-3.5" aria-hidden />
+                {t('panels.original')}
+              </>
+            }
+            actions={
+              sourceUrl ? (
+                <Button variant="ghost" size="icon" className="h-6 w-6" onClick={handleClear}>
+                  <Trash2 className="h-3.5 w-3.5" />
+                </Button>
+              ) : null
+            }
+            bodyClassName="flex flex-col"
           >
-            {sourceUrl ? (
-              // eslint-disable-next-line @next/next/no-img-element
-              <img src={sourceUrl} alt="" decoding="async" className="max-h-[min(55vh,420px)] max-w-full object-contain" />
-            ) : (
-              <div className="flex flex-col items-center gap-3 text-center">
-                <div className="rounded-full bg-muted/50 p-4">
-                  <Upload className="h-8 w-8 text-muted-foreground" />
-                </div>
-                <div className="flex flex-col gap-1">
-                  <p className="text-sm font-medium">{t('dropHere')}</p>
-                  <p className="text-xs text-muted-foreground">{t('placeholders.uploadImage')}</p>
+            <div
+              className="relative flex flex-1 cursor-pointer items-center justify-center p-4"
+              onClick={() => !sourceUrl && fileInputRef.current?.click()}
+            >
+              {sourceUrl ? (
+                // eslint-disable-next-line @next/next/no-img-element
+                <img src={sourceUrl} alt="" decoding="async" className="max-h-[min(55vh,420px)] max-w-full object-contain" />
+              ) : (
+                <div className="flex flex-col items-center gap-3 text-center">
+                  <div className="rounded-full bg-muted/50 p-4">
+                    <Upload className="h-8 w-8 text-muted-foreground" />
+                  </div>
+                  <div className="flex flex-col gap-1">
+                    <p className="text-sm font-medium">{t('dropHere')}</p>
+                    <p className="text-xs text-muted-foreground">{t('placeholders.uploadImage')}</p>
+                  </div>
                 </div>
-              </div>
-            )}
-            {isDragging && (
-              <div className="absolute inset-0 z-10 flex items-center justify-center bg-background/80 backdrop-blur-sm">
-                <div className="flex flex-col items-center gap-2 text-primary">
-                  <Upload className="h-8 w-8 animate-bounce" />
-                  <span className="text-sm font-medium">{t('dropHere')}</span>
+              )}
+              {isDragging && (
+                <div className="absolute inset-0 z-10 flex items-center justify-center bg-background/80 backdrop-blur-sm">
+                  <div className="flex flex-col items-center gap-2 text-primary">
+                    <Upload className="h-8 w-8 animate-bounce" />
+                    <span className="text-sm font-medium">{t('dropHere')}</span>
+                  </div>
                 </div>
+              )}
+            </div>
+            {error && (
+              <div className="flex items-center gap-2 border-t border-destructive/20 bg-destructive/5 px-4 py-2 text-xs text-destructive">
+                <AlertCircle className="h-3.5 w-3.5 shrink-0" />
+                <span>{error}</span>
               </div>
             )}
-          </div>
-          {error && (
-            <div className="flex items-center gap-2 border-t border-destructive/20 bg-destructive/5 px-4 py-2 text-xs text-destructive">
-              <AlertCircle className="h-3.5 w-3.5 shrink-0" />
-              <span>{error}</span>
-            </div>
-          )}
-        </Card>}
+          </IOPanel>
+        )}
 
-        {(!isMobile || mobileTab === 'compressed') && <Card className="flex min-h-[220px] flex-col overflow-hidden flex-1">
-          <div className="flex shrink-0 items-center justify-between border-b border-border/50 bg-muted/30 px-4 py-2.5">
-            <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-              {t('panels.compressed')}
-            </Label>
-            <Button
-              variant="outline"
-              size="sm"
-              className="h-7 gap-1 text-xs"
-              disabled={!compressedBlob || processing}
-              onClick={handleDownload}
-            >
-              {processing ? <Loader2 className="h-3 w-3 animate-spin" /> : <Download className="h-3 w-3" />}
-              {t('download')}
-            </Button>
-          </div>
-          <div className="relative flex flex-1 items-center justify-center p-4">
+        {(!isMobile || mobileTab === 'compressed') && (
+          <IOPanel
+            className="min-h-[220px] flex-1"
+            label={t('panels.compressed')}
+            actions={
+              <Button
+                variant="outline"
+                size="sm"
+                className="h-7 gap-1 text-xs"
+                disabled={!compressedBlob || processing}
+                onClick={handleDownload}
+              >
+                {processing ? <Loader2 className="h-3 w-3 animate-spin" /> : <Download className="h-3 w-3" />}
+                {t('download')}
+              </Button>
+            }
+            bodyClassName="flex items-center justify-center p-4"
+          >
             {processing && !compressedUrl && (
               <div className="absolute inset-0 z-10 flex flex-col items-center justify-center gap-2 bg-background/70">
                 <Loader2 className="h-8 w-8 animate-spin text-primary" />
@@ -456,9 +455,9 @@ export function ImageCompressorLayout() {
             ) : !sourceUrl ? (
               <p className="text-center text-sm text-muted-foreground">{t('emptyCompressed')}</p>
             ) : null}
-          </div>
-        </Card>}
-      </div>
-    </div>
+          </IOPanel>
+        )}
+      </ToolPanels>
+    </ToolShell>
   );
 }
diff --git a/apps/desktop-ui/src/components/keycode-inspector/keycode-inspector-layout.tsx b/apps/desktop-ui/src/components/keycode-inspector/keycode-inspector-layout.tsx
index 1c192e84..e42f320f 100644
--- a/apps/desktop-ui/src/components/keycode-inspector/keycode-inspector-layout.tsx
+++ b/apps/desktop-ui/src/components/keycode-inspector/keycode-inspector-layout.tsx
@@ -5,13 +5,11 @@ import { useTranslations } from 'next-intl'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
 import { Badge } from '@/components/ui/badge'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
 import { Label } from '@/components/ui/label'
 import { Copy, Keyboard, Trash2 } from 'lucide-react'
 import { IconKeyboard } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
+import { IOPanel } from '@/components/tools/io-panel'
 import {
   KEY_HISTORY_LIMIT,
   isPreventable,
@@ -48,7 +46,7 @@ function FieldCard({
   deprecatedLabel?: string
 }) {
   return (
-    <Card className="flex min-w-0 flex-col gap-1 p-4">
+    <div className="flex min-w-0 flex-col gap-1 rounded-lg border border-border bg-card p-4">
       <div className="flex min-w-0 items-center justify-between gap-2">
         <Label className="min-w-0 truncate font-mono text-xs font-medium text-muted-foreground">{label}</Label>
         {deprecated && (
@@ -61,7 +59,7 @@ function FieldCard({
         )}
       </div>
       <div className="min-w-0 break-words font-mono text-xl font-semibold">{value}</div>
-    </Card>
+    </div>
   )
 }
 
@@ -93,156 +91,137 @@ export function KeycodeInspectorLayout() {
   }
 
   return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconKeyboard}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        />
-      </RevealItem>
-
-      <div className="min-h-0 flex-1 overflow-y-auto">
-        <div className="grid grid-cols-1 gap-4 lg:grid-cols-3">
-          <div className="flex flex-col gap-4 lg:col-span-2">
-            {/* Capture area / hero */}
-            <div
-              tabIndex={0}
-              role="textbox"
-              autoFocus
-              aria-label={t('capture.prompt')}
-              onKeyDown={onKeyDown}
-              onFocus={() => setFocused(true)}
-              onBlur={() => setFocused(false)}
-              className={`flex min-h-[220px] cursor-pointer flex-col items-center justify-center gap-3 rounded-xl border-2 border-dashed p-8 text-center outline-none transition-colors ${
-                focused ? 'border-primary/60 bg-primary/5' : 'border-border/60 bg-muted/20 hover:border-border'
-              }`}
-            >
-              {current ? (
-                <>
-                  <div className="max-w-full break-words font-mono text-5xl font-bold tracking-tight md:text-6xl">
-                    {displayKey(current.key, t('hero.spaceKey'))}
-                  </div>
-                  <div className="font-mono text-xs text-muted-foreground">{t('hero.keyLabel')}</div>
-                  <div className="flex flex-wrap items-center justify-center gap-2">
-                    {MODIFIERS.map((m) => (
-                      <Badge
-                        key={m.key}
-                        variant={current[m.key] ? 'default' : 'outline'}
-                        className={current[m.key] ? '' : 'text-muted-foreground/60'}
-                      >
-                        {m.label}
-                      </Badge>
-                    ))}
-                    {current.repeat && <Badge variant="secondary">{t('hero.repeat')}</Badge>}
-                  </div>
-                  <Button size="sm" variant="secondary" onClick={() => copyJson(current)}>
-                    <Copy className="mr-1.5 h-3.5 w-3.5" />
-                    {t('copyJson')}
-                  </Button>
-                </>
-              ) : (
-                <>
-                  <Keyboard className="h-10 w-10 text-muted-foreground/60" />
-                  <div className="text-xl font-semibold text-muted-foreground">{t('capture.prompt')}</div>
-                  <p className="text-sm text-muted-foreground/70">
-                    {focused ? t('capture.ready') : t('capture.clickToFocus')}
-                  </p>
-                </>
-              )}
-            </div>
-
-            {/* Field cards */}
-            {current && (
-              <div className="grid grid-cols-2 gap-3 md:grid-cols-4">
-                <FieldCard label={t('fields.code')} value={current.code || '—'} />
-                <FieldCard
-                  label={t('fields.keyCode')}
-                  value={current.keyCode}
-                  deprecated
-                  deprecatedLabel={t('deprecated')}
-                />
-                <FieldCard
-                  label={t('fields.which')}
-                  value={current.which}
-                  deprecated
-                  deprecatedLabel={t('deprecated')}
-                />
-                <FieldCard
-                  label={t('fields.location')}
-                  value={
-                    <span>
-                      {t(`location.${locationName(current.location)}`)}{' '}
-                      <span className="text-sm text-muted-foreground">({current.location})</span>
-                    </span>
-                  }
-                />
-              </div>
+    <ToolShell
+      icon={IconKeyboard}
+      title={t('title')}
+      description={t('subtitle')}
+      contentClassName="overflow-y-auto"
+    >
+      <div className="grid grid-cols-1 gap-4 lg:grid-cols-3">
+        <div className="flex flex-col gap-4 lg:col-span-2">
+          {/* Capture area / hero */}
+          <div
+            tabIndex={0}
+            role="textbox"
+            autoFocus
+            aria-label={t('capture.prompt')}
+            onKeyDown={onKeyDown}
+            onFocus={() => setFocused(true)}
+            onBlur={() => setFocused(false)}
+            className={`flex min-h-[220px] cursor-pointer flex-col items-center justify-center gap-3 rounded-xl border-2 border-dashed p-8 text-center outline-none transition-colors ${
+              focused ? 'border-primary/60 bg-primary/5' : 'border-border/60 bg-muted/20 hover:border-border'
+            }`}
+          >
+            {current ? (
+              <>
+                <div className="max-w-full break-words font-mono text-5xl font-bold tracking-tight md:text-6xl">
+                  {displayKey(current.key, t('hero.spaceKey'))}
+                </div>
+                <div className="font-mono text-xs text-muted-foreground">{t('hero.keyLabel')}</div>
+                <div className="flex flex-wrap items-center justify-center gap-2">
+                  {MODIFIERS.map((m) => (
+                    <Badge
+                      key={m.key}
+                      variant={current[m.key] ? 'default' : 'outline'}
+                      className={current[m.key] ? '' : 'text-muted-foreground/60'}
+                    >
+                      {m.label}
+                    </Badge>
+                  ))}
+                  {current.repeat && <Badge variant="secondary">{t('hero.repeat')}</Badge>}
+                </div>
+                <Button size="sm" variant="secondary" onClick={() => copyJson(current)}>
+                  <Copy className="mr-1.5 h-3.5 w-3.5" />
+                  {t('copyJson')}
+                </Button>
+              </>
+            ) : (
+              <>
+                <Keyboard className="h-10 w-10 text-muted-foreground/60" />
+                <div className="text-xl font-semibold text-muted-foreground">{t('capture.prompt')}</div>
+                <p className="text-sm text-muted-foreground/70">
+                  {focused ? t('capture.ready') : t('capture.clickToFocus')}
+                </p>
+              </>
             )}
           </div>
 
-          {/* History */}
-          <Card className="flex min-h-[280px] flex-col overflow-hidden">
-            <div className="flex items-center justify-between border-b border-border/50 bg-muted/30 px-4 py-2.5">
-              <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                {t('history.title')}
-              </Label>
-              <Button
-                variant="ghost"
-                size="icon"
-                className="h-7 w-7"
-                onClick={clear}
-                disabled={history.length === 0 && !current}
-                title={t('history.clear')}
-                aria-label={t('history.clear')}
-              >
-                <Trash2 className="h-3.5 w-3.5" />
-              </Button>
-            </div>
-            <div className="min-h-0 flex-1 overflow-y-auto">
-              {history.length === 0 ? (
-                <p className="p-4 text-sm text-muted-foreground/70">{t('history.empty')}</p>
-              ) : (
-                <ul className="divide-y divide-border/30">
-                  {history.map((entry) => (
-                    <li
-                      key={entry.id}
-                      onClick={() => setCurrent(entry.event)}
-                      className="flex cursor-pointer items-center justify-between gap-2 px-4 py-2 text-sm transition-colors hover:bg-muted/50"
-                    >
-                      <div className="flex min-w-0 items-center gap-2">
-                        <span className="truncate font-mono font-semibold">
-                          {displayKey(entry.event.key, t('hero.spaceKey'))}
-                        </span>
-                        <span className="truncate font-mono text-xs text-muted-foreground">{entry.event.code}</span>
-                      </div>
-                      <div className="flex shrink-0 items-center gap-1.5">
-                        <span className="font-mono text-xs text-muted-foreground">{entry.event.keyCode}</span>
-                        <Button
-                          variant="ghost"
-                          size="icon"
-                          className="h-6 w-6"
-                          onClick={(e) => {
-                            e.stopPropagation()
-                            copyJson(entry.event)
-                          }}
-                          title={t('copyJson')}
-                          aria-label={t('copyJson')}
-                        >
-                          <Copy className="h-3 w-3" />
-                        </Button>
-                      </div>
-                    </li>
-                  ))}
-                </ul>
-              )}
+          {/* Field cards */}
+          {current && (
+            <div className="grid grid-cols-2 gap-3 md:grid-cols-4">
+              <FieldCard label={t('fields.code')} value={current.code || '—'} />
+              <FieldCard label={t('fields.keyCode')} value={current.keyCode} deprecated deprecatedLabel={t('deprecated')} />
+              <FieldCard label={t('fields.which')} value={current.which} deprecated deprecatedLabel={t('deprecated')} />
+              <FieldCard
+                label={t('fields.location')}
+                value={
+                  <span>
+                    {t(`location.${locationName(current.location)}`)}{' '}
+                    <span className="text-sm text-muted-foreground">({current.location})</span>
+                  </span>
+                }
+              />
             </div>
-          </Card>
+          )}
         </div>
+
+        {/* History */}
+        <IOPanel
+          label={t('history.title')}
+          className="min-h-[280px]"
+          bodyClassName="overflow-y-auto"
+          actions={
+            <Button
+              variant="ghost"
+              size="icon"
+              className="h-7 w-7"
+              onClick={clear}
+              disabled={history.length === 0 && !current}
+              title={t('history.clear')}
+              aria-label={t('history.clear')}
+            >
+              <Trash2 className="h-3.5 w-3.5" />
+            </Button>
+          }
+        >
+          {history.length === 0 ? (
+            <p className="p-4 text-sm text-muted-foreground/70">{t('history.empty')}</p>
+          ) : (
+            <ul className="divide-y divide-border/30">
+              {history.map((entry) => (
+                <li
+                  key={entry.id}
+                  onClick={() => setCurrent(entry.event)}
+                  className="flex cursor-pointer items-center justify-between gap-2 px-4 py-2 text-sm transition-colors hover:bg-muted/50"
+                >
+                  <div className="flex min-w-0 items-center gap-2">
+                    <span className="truncate font-mono font-semibold">
+                      {displayKey(entry.event.key, t('hero.spaceKey'))}
+                    </span>
+                    <span className="truncate font-mono text-xs text-muted-foreground">{entry.event.code}</span>
+                  </div>
+                  <div className="flex shrink-0 items-center gap-1.5">
+                    <span className="font-mono text-xs text-muted-foreground">{entry.event.keyCode}</span>
+                    <Button
+                      variant="ghost"
+                      size="icon"
+                      className="h-6 w-6"
+                      onClick={(e) => {
+                        e.stopPropagation()
+                        copyJson(entry.event)
+                      }}
+                      title={t('copyJson')}
+                      aria-label={t('copyJson')}
+                    >
+                      <Copy className="h-3 w-3" />
+                    </Button>
+                  </div>
+                </li>
+              ))}
+            </ul>
+          )}
+        </IOPanel>
       </div>
-    </div>
+    </ToolShell>
   )
 }
diff --git a/apps/desktop-ui/src/components/svg-optimizer/svg-optimizer-layout.tsx b/apps/desktop-ui/src/components/svg-optimizer/svg-optimizer-layout.tsx
index e1fd007f..75e3b95a 100644
--- a/apps/desktop-ui/src/components/svg-optimizer/svg-optimizer-layout.tsx
+++ b/apps/desktop-ui/src/components/svg-optimizer/svg-optimizer-layout.tsx
@@ -4,17 +4,14 @@ import { useCallback, useEffect, useMemo, useState } from 'react'
 import { useTranslations } from 'next-intl'
 import { useDebouncedCallback } from 'use-debounce'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
-import { Card } from '@/components/ui/card'
 import { Label } from '@/components/ui/label'
 import { Button } from '@/components/ui/button'
-import { Textarea } from '@/components/ui/textarea'
 import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert'
 import { Check, Copy, Download, Trash2, Sparkles } from 'lucide-react'
 import { IconFileTypeSvg } from '@tabler/icons-react'
 import { cn } from '@/lib/utils'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
+import { ToolPanels, IOPanel, ToolTextArea } from '@/components/tools/io-panel'
 import { utf8ByteLength } from '@/lib/svg-optimize'
 import { useSvgOptimizeWorker } from '@/hooks/use-svg-optimize-worker'
 
@@ -86,36 +83,27 @@ export function SvgOptimizerLayout() {
   }
 
   return (
-    <div className="flex h-full min-h-0 w-full flex-col gap-4">
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconFileTypeSvg}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Media & Design']}
-        />
-      </RevealItem>
-
-      <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 xl:grid-cols-2">
-        <Card className="flex min-h-[220px] flex-col gap-3 p-4">
-          <div className="flex flex-wrap items-center justify-between gap-2">
-            <Label htmlFor="svg-input" className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-              {t('inputLabel')}
-            </Label>
-            <span className="text-xs text-muted-foreground">
+    <ToolShell icon={IconFileTypeSvg} title={t('title')} description={t('subtitle')}>
+      <ToolPanels className="xl:grid-cols-2">
+        <IOPanel
+          label={t('inputLabel')}
+          bodyClassName="flex flex-col"
+          actions={
+            <span className="text-[10px] tabular-nums text-muted-foreground">
               {t('chars', { count: input.length, bytes: beforeBytes })}
             </span>
+          }
+        >
+          <div className="relative min-h-0 flex-1">
+            <ToolTextArea
+              id="svg-input"
+              value={input}
+              onChange={(e) => setInput(e.target.value)}
+              placeholder={t('placeholder')}
+              autoComplete="off"
+            />
           </div>
-          <Textarea
-            id="svg-input"
-            value={input}
-            onChange={(e) => setInput(e.target.value)}
-            placeholder={t('placeholder')}
-            spellCheck={false}
-            className="min-h-[200px] flex-1 resize-y font-mono text-sm"
-            autoComplete="off"
-          />
-          <div className="flex flex-wrap gap-2">
+          <div className="flex flex-wrap gap-2 border-t border-border/50 p-2">
             <Button type="button" variant="secondary" size="sm" onClick={() => setInput('')}>
               <Trash2 className="mr-1.5 h-4 w-4" />
               {t('actions.clear')}
@@ -125,10 +113,10 @@ export function SvgOptimizerLayout() {
               {t('actions.sample')}
             </Button>
           </div>
-        </Card>
+        </IOPanel>
 
         <div className="flex min-h-0 flex-col gap-4">
-          <Card className="flex flex-col gap-3 p-4">
+          <div className="space-y-3 rounded-lg border border-border bg-card p-4">
             <div className="flex flex-wrap items-center justify-between gap-2">
               <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
                 {t('stats.title')}
@@ -155,15 +143,15 @@ export function SvgOptimizerLayout() {
                 <AlertDescription className="break-all font-mono text-xs">{error}</AlertDescription>
               </Alert>
             ) : null}
-          </Card>
+          </div>
 
-          <Card className="flex min-h-[180px] flex-1 flex-col gap-3 p-4">
-            <div className="flex flex-wrap items-center justify-between gap-2">
-              <Label htmlFor="svg-output" className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                {t('outputLabel')}
-              </Label>
-              <div className="flex flex-wrap gap-2">
-                <Button type="button" size="sm" variant="secondary" disabled={!output} onClick={handleCopy}>
+          <IOPanel
+            label={t('outputLabel')}
+            className="min-h-[180px] flex-1"
+            bodyClassName="flex flex-col"
+            actions={
+              <>
+                <Button type="button" size="sm" variant="secondary" className="h-7" disabled={!output} onClick={handleCopy}>
                   {copied ? (
                     <Check className="mr-1.5 h-4 w-4 text-emerald-600" />
                   ) : (
@@ -171,38 +159,31 @@ export function SvgOptimizerLayout() {
                   )}
                   {copied ? t('actions.copied') : t('actions.copy')}
                 </Button>
-                <Button type="button" size="sm" variant="outline" disabled={!output.trim()} onClick={handleDownload}>
+                <Button type="button" size="sm" variant="outline" className="h-7" disabled={!output.trim()} onClick={handleDownload}>
                   <Download className="mr-1.5 h-4 w-4" />
                   {t('actions.download')}
                 </Button>
-              </div>
+              </>
+            }
+          >
+            <div className="relative min-h-0 flex-1">
+              <ToolTextArea id="svg-output" readOnly value={output} placeholder={t('outputPlaceholder')} />
             </div>
-            <Textarea
-              id="svg-output"
-              readOnly
-              value={output}
-              placeholder={t('outputPlaceholder')}
-              className="min-h-[160px] flex-1 resize-y font-mono text-sm"
-            />
             {previewUrl ? (
-              <div className="space-y-2">
+              <div className="space-y-2 border-t border-border/50 p-3">
                 <p className="text-[10px] font-medium uppercase tracking-wide text-muted-foreground">{t('preview')}</p>
-                <div
-                  className={cn(
-                    'flex max-h-40 items-center justify-center overflow-hidden rounded-lg border bg-muted/20 p-4'
-                  )}
-                >
+                <div className={cn('flex max-h-40 items-center justify-center overflow-hidden rounded-lg border bg-muted/20 p-4')}>
                   {/* Dynamic data: URL cannot use next/image */}
                   {/* eslint-disable-next-line @next/next/no-img-element */}
                   <img src={previewUrl} alt="" loading="lazy" decoding="async" className="max-h-32 max-w-full object-contain" />
                 </div>
               </div>
             ) : null}
-          </Card>
+          </IOPanel>
         </div>
-      </div>
+      </ToolPanels>
 
-      <p className="text-center text-xs text-muted-foreground">{t('localNote')}</p>
-    </div>
+      <p className="shrink-0 text-center text-xs text-muted-foreground">{t('localNote')}</p>
+    </ToolShell>
   )
 }

From 26282f74a898b0c736e50615bc71523f960603d3 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sat, 22 Aug 2026 13:36:06 +0530
Subject: [PATCH 05/39] perf(api-client): stop whole-tree re-renders per
 keystroke, keep editors mounted
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- RequestTabs + ResponsePanel are React.memo; the nine inline
  `(v) => updateActiveTab({...})` setters become one memoized setter map,
  onSaveExample/onMount/onChange handlers are stable.
- handleSend/handleCopyCurl go through latest-value refs so RequestPanel's memo
  holds and the keydown listener stops re-registering on every edit;
  handleLoadRequest/handleCancel/handleCurlPaste/example handlers memoized.
- Response JSON parsed once (useMemo) instead of three times per render for
  the tree/table/geo views; those views cap at 200 children / 500 rows.
- Desktop layout keeps the request panel in one ResizablePanelGroup and adds
  the response panel conditionally (id/order) — Send no longer remounts Monaco.
  Body / pre-request / tests editor tabs are forceMount + hidden when inactive.
- History list row renderer memoized so VirtualHistoryList's memo holds;
  TabBar's layout effect keys on tab id/kind/method/name, not the tabs array.
- sendProxyRequest() returns the Rust envelope directly instead of
  stringify → fake Response → json(); typed ProxyEnvelope.
- Secret-variable scan covers params/headers/auth/body only, not the whole tab
  (previous response + example bodies).
- Scripts worker caches pm.response.json() per run.
- next/dynamic for GrpcPanel (protobufjs), WebSocketPanel, ImportDialog
  (js-yaml), CookieJarDialog, MetricsDialog, CollectionRunnerDialog; exporters
  are imported on click.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/components/api-client/api-client.tsx  | 202 +++++++++++-------
 .../collections/collections-sidebar.tsx       | 136 ++++++------
 .../api-client/json-visualisers.tsx           |  17 +-
 .../components/api-client/request-tabs.tsx    |  30 +--
 .../components/api-client/response-panel.tsx  |  18 +-
 .../src/components/api-client/tab-bar.tsx     |   6 +-
 .../workers/scripts-runner.worker.ts          |   9 +-
 apps/desktop-ui/src/lib/desktop/api-fetch.ts  |  34 +++
 8 files changed, 282 insertions(+), 170 deletions(-)

diff --git a/apps/desktop-ui/src/components/api-client/api-client.tsx b/apps/desktop-ui/src/components/api-client/api-client.tsx
index 943e9519..3a8b2e72 100644
--- a/apps/desktop-ui/src/components/api-client/api-client.tsx
+++ b/apps/desktop-ui/src/components/api-client/api-client.tsx
@@ -1,6 +1,6 @@
 "use client"
 
-import { apiFetch } from "@/lib/desktop/api-fetch";
+import { apiFetch, sendProxyRequest } from "@/lib/desktop/api-fetch";
 import * as React from "react"
 import { Card } from "@/components/ui/card"
 import { ResizablePanelGroup, ResizablePanel, ResizableHandle } from "@/components/ui/resizable"
@@ -9,13 +9,8 @@ import { RequestTabs } from "./request-tabs"
 import { ResponsePanel } from "./response-panel"
 import { TabBar } from "./tab-bar"
 import { ImportCurlDialog, type ImportCurlTarget } from "./import-curl-dialog"
-import { ImportDialog } from "./import-dialog"
-import { CookieJarDialog } from "./cookie-jar-dialog"
-import { WebSocketPanel } from "./websocket-panel"
-import { GrpcPanel } from "./grpc-panel"
 import { SaveExampleDialog } from "./save-example-dialog"
 import { loadPlugins, instantiatePlugin, applyBeforeSend, applyAfterResponse, type PluginInstance } from "@/lib/plugins/plugin-runtime"
-import { MetricsDialog } from "./metrics-dialog"
 import { recordMetric, recordLog } from "@/lib/observability/metrics"
 import { OfflineIndicator } from "./offline-indicator"
 import { putCachedResponse, getCachedResponse } from "@/lib/cache/response-cache"
@@ -40,6 +35,7 @@ import {
     API_CLIENT_ERROR_STATUS_TEXT,
     ScriptTestResult,
     ScriptLog,
+    type ApiResponse,
 } from "./types"
 import type { ScriptContext } from "./workers/scripts-runner.worker"
 import { useTranslations } from "next-intl"
@@ -78,6 +74,13 @@ const CodeGenerator = dynamic(
     () => import("./code-generator").then(m => ({ default: m.CodeGenerator })),
     { ssr: false, loading: () => null }
 )
+// Heavy or rarely-used surfaces stay out of the route's critical chunk:
+// gRPC pulls protobufjs, the importer pulls js-yaml + every importer.
+const GrpcPanel = dynamic(() => import("./grpc-panel").then(m => ({ default: m.GrpcPanel })), { ssr: false, loading: () => null })
+const WebSocketPanel = dynamic(() => import("./websocket-panel").then(m => ({ default: m.WebSocketPanel })), { ssr: false, loading: () => null })
+const ImportDialog = dynamic(() => import("./import-dialog").then(m => ({ default: m.ImportDialog })), { ssr: false, loading: () => null })
+const CookieJarDialog = dynamic(() => import("./cookie-jar-dialog").then(m => ({ default: m.CookieJarDialog })), { ssr: false, loading: () => null })
+const MetricsDialog = dynamic(() => import("./metrics-dialog").then(m => ({ default: m.MetricsDialog })), { ssr: false, loading: () => null })
 
 /**
  * Tag history entries with the HTTP method when falling back to URL, so the list
@@ -201,11 +204,11 @@ function ApiClientInner() {
         toast.success(`Saved example "${name}"`)
     }
 
-    const handleDeleteExample = (id: string) => {
-        updateActiveTab({ examples: (activeTab.examples ?? []).filter((e) => e.id !== id) })
-    }
+    const handleDeleteExample = React.useCallback((id: string) => {
+        updateActiveTab((tab) => ({ examples: (tab.examples ?? []).filter((e) => e.id !== id) }))
+    }, [updateActiveTab])
 
-    const handleLoadExample = (example: SavedExample) => {
+    const handleLoadExample = React.useCallback((example: SavedExample) => {
         updateActiveTab({
             response: {
                 status: example.response.status,
@@ -219,7 +222,25 @@ function ApiClientInner() {
             isLoading: false,
         })
         toast.success(`Loaded example "${example.name}"`)
-    }
+    }, [updateActiveTab])
+
+    // One stable setter per RequestTabs field. Inline `(v) => updateActiveTab({...})`
+    // props defeated RequestTabs' memo and re-rendered the whole editor per keystroke.
+    const setField = React.useMemo(() => {
+        const make = <K extends keyof ApiRequestState>(key: K) =>
+            (value: ApiRequestState[K]) => updateActiveTab({ [key]: value } as Partial<ApiRequestState>)
+        return {
+            params: make("params"),
+            headers: make("headers"),
+            body: make("body"),
+            auth: make("auth"),
+            preRequestScript: make("preRequestScript"),
+            testScript: make("testScript"),
+            graphqlSchema: make("graphqlSchema"),
+            comments: make("comments"),
+        }
+    }, [updateActiveTab])
+    const openSaveExample = React.useCallback(() => setSaveExampleOpen(true), [])
 
     // Scroll position memory for mobile panel toggle
     const scrollMemory = React.useRef<{ request: number; response: number }>({ request: 0, response: 0 })
@@ -302,12 +323,16 @@ function ApiClientInner() {
     }
 
     const { copyToClipboard } = useCopyToClipboard()
+    // Latest-value ref so callbacks handed to memoized children (RequestPanel)
+    // stay referentially stable across keystrokes.
+    const activeTabRef = React.useRef(activeTab)
+    React.useEffect(() => { activeTabRef.current = activeTab }, [activeTab])
     const handleCopyCurl = React.useCallback(() => {
-        void copyToClipboard(generateCode(activeTab, "curl"), {
+        void copyToClipboard(generateCode(activeTabRef.current, "curl"), {
             successMessage: t("toasts.curlCopied"),
             errorMessage: t("toasts.copyFailed"),
         })
-    }, [activeTab, copyToClipboard, t])
+    }, [copyToClipboard, t])
 
     const handleSaveRequest = (parentId: string, name: string) => {
         const requestToSave: CollectionRequest = {
@@ -324,7 +349,7 @@ function ApiClientInner() {
         updateActiveTab({ name })
     }
 
-    const handleLoadRequest = (request: CollectionRequest) => {
+    const handleLoadRequest = React.useCallback((request: CollectionRequest) => {
         // Locate the request inside any collection so we can fold ancestor folders'
         // defaults (headers / auth / scripts) into the materialised tab. A request
         // edited in a tab is a snapshot — later folder-default edits don't propagate.
@@ -344,15 +369,15 @@ function ApiClientInner() {
             isLoading: false,
         }
         appendTab(newTab)
-    }
+    }, [collections, appendTab])
 
-    const handleCancel = () => {
+    const handleCancel = React.useCallback(() => {
         abortControllerRef.current?.abort()
         abortControllerRef.current = null
         updateActiveTab({ isLoading: false })
-    }
+    }, [updateActiveTab])
 
-    const handleSend = React.useCallback(async () => {
+    const sendImpl = React.useCallback(async () => {
         if (!activeTab.url?.trim()) return
 
         abortControllerRef.current?.abort()
@@ -441,8 +466,19 @@ function ApiClientInner() {
             // Resolve cross-tool secrets referenced anywhere in the request
             // (scan the raw tab JSON so params/headers/auth/body are all covered).
             // Throws a user-facing message when the vault is locked → outer catch.
+            // Only the editable request parts — stringifying the whole tab dragged
+            // the previous response body and every saved example through the scan.
             secretVars = await resolveSecretVariables(
-                [workUrl, JSON.stringify(workHeaders), JSON.stringify(activeTab)],
+                [
+                    workUrl,
+                    JSON.stringify(workHeaders),
+                    JSON.stringify({
+                        params: activeTab.params,
+                        headers: activeTab.headers,
+                        auth: activeTab.auth,
+                        body: { ...activeTab.body, formData: activeTab.body.formData?.map((f) => ({ ...f, fileContentBase64: undefined })) },
+                    }),
+                ],
                 cipherKey,
             )
 
@@ -774,24 +810,23 @@ function ApiClientInner() {
             Object.assign(headersObj, beforeApplied.req.headers)
             const finalUrlFromPlugins = beforeApplied.req.url
 
-            // Send via Proxy
-            const res = await apiFetch("/api/proxy", {
-                method: "POST",
-                credentials: "include",
-                signal: controller.signal,
-                headers: {
-                    "Content-Type": "application/json",
-                },
-                body: JSON.stringify({
-                    url: finalUrlFromPlugins,
-                    method: beforeApplied.req.method,
-                    headers: headersObj,
-                    body: beforeApplied.req.body ?? bodyPayload ?? bodyContent,
-                    timeoutMs: activeTab.timeoutMs,
-                }),
-            })
-
-            const proxyData = await res.json()
+            // Send via Proxy (envelope returned directly — no fake Response round-trip)
+            const rawEnvelope = await sendProxyRequest({
+                url: finalUrlFromPlugins,
+                method: beforeApplied.req.method,
+                headers: headersObj,
+                body: beforeApplied.req.body ?? bodyPayload ?? bodyContent,
+                timeoutMs: activeTab.timeoutMs,
+            }, controller.signal)
+            const proxyData = {
+                ...rawEnvelope,
+                statusText: rawEnvelope.statusText ?? "",
+                headers: rawEnvelope.headers ?? {},
+                body: rawEnvelope.body ?? "",
+                time: rawEnvelope.time ?? 0,
+                size: rawEnvelope.size ?? 0,
+                redirectChain: rawEnvelope.redirectChain as ApiResponse["redirectChain"],
+            }
 
             // Plugins: onAfterResponse hook gets the live response.
             applyAfterResponse(pluginInstancesRef.current, {
@@ -862,10 +897,10 @@ function ApiClientInner() {
                     },
                     response: {
                         status: proxyData.status,
-                        statusText: proxyData.statusText,
-                        headers: proxyData.headers,
-                        body: proxyData.body,
-                        time: proxyData.time,
+                        statusText: proxyData.statusText ?? "",
+                        headers: proxyData.headers ?? {},
+                        body: proxyData.body ?? "",
+                        time: proxyData.time ?? 0,
                     },
                     environment: { ...activeEnvironmentVariables, ...scriptEnvOverlay },
                     variables: { ...sessionVarsRef.current },
@@ -911,15 +946,15 @@ function ApiClientInner() {
             updateActiveTab({
                 response: {
                     status: proxyData.status,
-                    statusText: proxyData.statusText,
-                    headers: proxyData.headers,
-                    body: formattedBody,
+                    statusText: proxyData.statusText ?? "",
+                    headers: proxyData.headers ?? {},
+                    body: formattedBody ?? "",
                     isBase64: proxyData.isBase64,
-                    time: proxyData.time,
-                    size: proxyData.size,
+                    time: proxyData.time ?? 0,
+                    size: proxyData.size ?? 0,
                     error: proxyData.error,
                     setCookies: proxyData.setCookies,
-                    redirectChain: proxyData.redirectChain,
+                    redirectChain: proxyData.redirectChain as ApiResponse["redirectChain"],
                 },
                 scriptResults: (scriptTests.length || scriptLogs.length || scriptErrors.length)
                     ? { tests: scriptTests, logs: scriptLogs, errors: scriptErrors }
@@ -1008,8 +1043,13 @@ function ApiClientInner() {
         cipherKey,
         t,
     ])
+    // `sendImpl` changes identity on every keystroke (it closes over activeTab);
+    // the stable wrapper keeps RequestPanel memoized and the keydown listener put.
+    const sendRef = React.useRef(sendImpl)
+    React.useEffect(() => { sendRef.current = sendImpl }, [sendImpl])
+    const handleSend = React.useCallback(() => sendRef.current(), [])
 
-    const handleCurlPaste = (curl: string) => {
+    const handleCurlPaste = React.useCallback((curl: string) => {
         try {
             const parsed = parseCurlCommand(curl)
             // No URL extracted → don't claim success and don't wipe the current URL.
@@ -1029,7 +1069,7 @@ function ApiClientInner() {
             console.error(error)
             toast.error(t("toasts.curlParseFailed"))
         }
-    }
+    }, [updateActiveTab, replaceUrlWithEnvBaseUrl, t])
 
     // Keyboard shortcuts.
     // Cmd/Ctrl+T and Cmd/Ctrl+W are hard-reserved by the browser (`preventDefault`
@@ -1053,7 +1093,6 @@ function ApiClientInner() {
         }
         window.addEventListener("keydown", handleKeyDown)
         return () => window.removeEventListener("keydown", handleKeyDown)
-    // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [addTab, closeTab, handleSend, activeTabId])
 
     // Desktop request column — reused whether it sits full-width (no response yet)
@@ -1077,25 +1116,25 @@ function ApiClientInner() {
             <div className="flex-1 min-h-0">
                 <RequestTabs
                     params={activeTab.params}
-                    setParams={(params) => updateActiveTab({ params })}
+                    setParams={setField.params}
                     headers={activeTab.headers}
-                    setHeaders={(headers) => updateActiveTab({ headers })}
+                    setHeaders={setField.headers}
                     body={activeTab.body}
-                    setBody={(body) => updateActiveTab({ body })}
+                    setBody={setField.body}
                     auth={activeTab.auth}
-                    setAuth={(auth) => updateActiveTab({ auth })}
+                    setAuth={setField.auth}
                     preRequestScript={activeTab.preRequestScript}
-                    setPreRequestScript={(s) => updateActiveTab({ preRequestScript: s })}
+                    setPreRequestScript={setField.preRequestScript}
                     testScript={activeTab.testScript}
-                    setTestScript={(s) => updateActiveTab({ testScript: s })}
+                    setTestScript={setField.testScript}
                     graphqlUrl={activeTab.url}
                     graphqlSchema={activeTab.graphqlSchema}
-                    setGraphqlSchema={(s) => updateActiveTab({ graphqlSchema: s })}
+                    setGraphqlSchema={setField.graphqlSchema}
                     examples={activeTab.examples}
                     onDeleteExample={handleDeleteExample}
                     onLoadExample={handleLoadExample}
                     comments={activeTab.comments}
-                    setComments={(next) => updateActiveTab({ comments: next })}
+                    setComments={setField.comments}
                 />
             </div>
         </div>
@@ -1378,25 +1417,25 @@ function ApiClientInner() {
                                         />
                                         <RequestTabs
                                             params={activeTab.params}
-                                            setParams={(params) => updateActiveTab({ params })}
+                                            setParams={setField.params}
                                             headers={activeTab.headers}
-                                            setHeaders={(headers) => updateActiveTab({ headers })}
+                                            setHeaders={setField.headers}
                                             body={activeTab.body}
-                                            setBody={(body) => updateActiveTab({ body })}
+                                            setBody={setField.body}
                                             auth={activeTab.auth}
-                                            setAuth={(auth) => updateActiveTab({ auth })}
+                                            setAuth={setField.auth}
                                             preRequestScript={activeTab.preRequestScript}
-                                            setPreRequestScript={(s) => updateActiveTab({ preRequestScript: s })}
+                                            setPreRequestScript={setField.preRequestScript}
                                             testScript={activeTab.testScript}
-                                            setTestScript={(s) => updateActiveTab({ testScript: s })}
+                                            setTestScript={setField.testScript}
                                             graphqlUrl={activeTab.url}
                                             graphqlSchema={activeTab.graphqlSchema}
-                                            setGraphqlSchema={(s) => updateActiveTab({ graphqlSchema: s })}
+                                            setGraphqlSchema={setField.graphqlSchema}
                                             examples={activeTab.examples}
                                             onDeleteExample={handleDeleteExample}
                                             onLoadExample={handleLoadExample}
                                             comments={activeTab.comments}
-                                            setComments={(next) => updateActiveTab({ comments: next })}
+                                            setComments={setField.comments}
                                         />
                                     </div>
                                 </div>
@@ -1406,29 +1445,28 @@ function ApiClientInner() {
                                     onScroll={(e) => { scrollMemory.current.response = (e.target as HTMLDivElement).scrollTop }}
                                 >
                                     <div className="p-4">
-                                        <ResponsePanel response={activeTab.response} isLoading={activeTab.isLoading} scriptResults={activeTab.scriptResults} onSaveExample={activeTab.response ? () => setSaveExampleOpen(true) : undefined} />
+                                        <ResponsePanel response={activeTab.response} isLoading={activeTab.isLoading} scriptResults={activeTab.scriptResults} onSaveExample={activeTab.response ? openSaveExample : undefined} />
                                     </div>
                                 </div>
                             </>
-                        ) : !activeTab.response && !activeTab.isLoading ? (
-                            /* Desktop: no response yet — request panel gets the full width */
-                            <div className="h-full flex flex-col">
-                                {desktopRequestContent}
-                            </div>
                         ) : (
-                            /* Desktop: side-by-side resizable panels once a response exists / is loading */
+                            /* Desktop: the request panel is always mounted in the same group; the
+                               response panel joins the split once a response exists / is loading.
+                               Swapping the whole layout on Send remounted every Monaco editor. */
                             <ResizablePanelGroup direction="horizontal" className="h-full w-full">
-                                <ResizablePanel defaultSize={50} minSize={30} className="flex flex-col h-full">
+                                <ResizablePanel id="request" order={1} defaultSize={50} minSize={30} className="flex flex-col h-full">
                                     {desktopRequestContent}
                                 </ResizablePanel>
-
-                                <ResizableHandle withHandle className="w-1.5 bg-border/40 hover:bg-primary/20 transition-colors" />
-
-                                <ResizablePanel defaultSize={50} minSize={30} className="flex flex-col h-full bg-muted/[0.02]">
-                                    <div className="p-4 md:p-6 lg:p-8 flex-1 overflow-y-auto min-h-0 custom-scrollbar">
-                                        <ResponsePanel response={activeTab.response} isLoading={activeTab.isLoading} scriptResults={activeTab.scriptResults} onSaveExample={activeTab.response ? () => setSaveExampleOpen(true) : undefined} />
-                                    </div>
-                                </ResizablePanel>
+                                {(activeTab.response || activeTab.isLoading) && (
+                                    <>
+                                        <ResizableHandle withHandle className="w-1.5 bg-border/40 hover:bg-primary/20 transition-colors" />
+                                        <ResizablePanel id="response" order={2} defaultSize={50} minSize={30} className="flex flex-col h-full bg-muted/[0.02]">
+                                            <div className="p-4 md:p-6 lg:p-8 flex-1 overflow-y-auto min-h-0 custom-scrollbar">
+                                                <ResponsePanel response={activeTab.response} isLoading={activeTab.isLoading} scriptResults={activeTab.scriptResults} onSaveExample={activeTab.response ? openSaveExample : undefined} />
+                                            </div>
+                                        </ResizablePanel>
+                                    </>
+                                )}
                             </ResizablePanelGroup>
                         )}
                     </div>
diff --git a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
index d4164ce7..2de46b40 100644
--- a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
+++ b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
@@ -10,11 +10,13 @@ import { FolderPlus, Trash2, Pencil, MoreHorizontal, Search, X, FileDown, Play,
 import { buildShareUrl } from "@/lib/share-link"
 import { apiFetch } from "@/lib/desktop/api-fetch"
 import { toast } from "sonner"
-import { downloadCollectionAsPostman } from "@/lib/export/postman"
-import { downloadCollectionAsOpenApi } from "@/lib/export/openapi"
-import { downloadCollectionAsHar } from "@/lib/export/har"
-import { downloadCollectionAsInsomnia } from "@/lib/export/insomnia"
-import { CollectionRunnerDialog } from "../collection-runner-dialog"
+import dynamic from "next/dynamic"
+import type { HistoryRequest } from "../types"
+// Runner (+ csv/junit libs) only loads when a run is opened.
+const CollectionRunnerDialog = dynamic(
+    () => import("../collection-runner-dialog").then((m) => ({ default: m.CollectionRunnerDialog })),
+    { ssr: false, loading: () => null },
+)
 import { useWorkspacesContext } from "../context/workspaces-context"
 import { WorkspacesDialog } from "../workspaces-dialog"
 import { Briefcase } from "lucide-react"
@@ -195,6 +197,65 @@ export function CollectionsSidebar({ onLoadRequest: loadRequest }: CollectionsSi
         setSelectedCollections(new Set())
     }
 
+    // Stable row renderer so VirtualHistoryList's memo holds while the request
+    // editor re-renders on every keystroke.
+    const renderHistoryRow = React.useCallback((item: HistoryRequest, style: React.CSSProperties) => (
+        <div key={item.id} style={style} className="px-2 py-0.5">
+            <div
+                className="group flex flex-col p-2.5 hover:bg-muted/60 rounded-lg cursor-pointer transition-all duration-200 text-sm h-full"
+                onClick={() => onLoadRequest(item)}
+            >
+                <div className="flex items-center justify-between mb-1.5">
+                    <div className="flex items-center gap-2 flex-1 min-w-0">
+                        <span
+                            className={cn(
+                                "text-[10px] uppercase font-bold px-1.5 py-0.5 rounded-sm tracking-wide shrink-0",
+                                item.method === "GET" && "bg-blue-500/10 text-blue-500",
+                                item.method === "POST" && "bg-green-500/10 text-green-500",
+                                item.method === "PUT" && "bg-orange-500/10 text-orange-500",
+                                item.method === "DELETE" && "bg-red-500/10 text-red-500",
+                                item.method === "PATCH" && "bg-yellow-500/10 text-yellow-600",
+                                (!["GET", "POST", "PUT", "DELETE", "PATCH"].includes(item.method)) && "bg-muted text-muted-foreground"
+                            )}
+                        >
+                            {item.method}
+                        </span>
+                        <span className="font-medium text-xs truncate max-w-[150px]">
+                            {item.name ? getApiClientRequestDisplayName(item.name, tRoot) : item.url}
+                        </span>
+                    </div>
+                    <Button
+                        variant="ghost"
+                        size="icon"
+                        className="h-6 w-6 text-muted-foreground hover:text-destructive hover:bg-destructive/10 rounded-md opacity-0 group-hover:opacity-100 transition-opacity shrink-0"
+                        onClick={(e) => {
+                            e.stopPropagation()
+                            onDeleteHistoryItem(item.id)
+                        }}
+                    >
+                        <Trash2 className="h-3.5 w-3.5" />
+                    </Button>
+                </div>
+                <div className="flex items-center justify-between text-[11px] text-muted-foreground/80 pl-1">
+                    <span className="truncate max-w-[160px]">{item.url}</span>
+                    <div className="flex items-center gap-2 shrink-0">
+                        <span>{new Date(item.timestamp).toLocaleTimeString([], {hour: '2-digit', minute:'2-digit'})}</span>
+                        {item.status && (
+                            <span className={cn(
+                                "font-medium",
+                                item.status >= 200 && item.status < 300 ? "text-green-500"
+                                    : item.status >= 300 && item.status < 400 ? "text-amber-500"
+                                    : "text-destructive"
+                            )}>
+                                {item.status}
+                            </span>
+                        )}
+                    </div>
+                </div>
+            </div>
+        </div>
+    ), [onLoadRequest, onDeleteHistoryItem, tRoot])
+
     return (
         // Header (icon, title, collapse) is owned by ToolSidebarLayout in
         // components/api-client/api-client.tsx — this renders the body only.
@@ -421,19 +482,19 @@ export function CollectionsSidebar({ onLoadRequest: loadRequest }: CollectionsSi
                                                             <Globe className="h-4 w-4 mr-2" />
                                                             Publish as public mock
                                                         </DropdownMenuItem>}
-                                                        <DropdownMenuItem onClick={() => downloadCollectionAsPostman(collection)}>
+                                                        <DropdownMenuItem onClick={() => void import("@/lib/export/postman").then((m) => m.downloadCollectionAsPostman(collection))}>
                                                             <FileDown className="h-4 w-4 mr-2" />
                                                             Export (Postman v2.1)
                                                         </DropdownMenuItem>
-                                                        <DropdownMenuItem onClick={() => downloadCollectionAsOpenApi(collection)}>
+                                                        <DropdownMenuItem onClick={() => void import("@/lib/export/openapi").then((m) => m.downloadCollectionAsOpenApi(collection))}>
                                                             <FileDown className="h-4 w-4 mr-2" />
                                                             Export (OpenAPI 3.0)
                                                         </DropdownMenuItem>
-                                                        <DropdownMenuItem onClick={() => downloadCollectionAsHar(collection)}>
+                                                        <DropdownMenuItem onClick={() => void import("@/lib/export/har").then((m) => m.downloadCollectionAsHar(collection))}>
                                                             <FileDown className="h-4 w-4 mr-2" />
                                                             Export (HAR 1.2)
                                                         </DropdownMenuItem>
-                                                        <DropdownMenuItem onClick={() => downloadCollectionAsInsomnia(collection)}>
+                                                        <DropdownMenuItem onClick={() => void import("@/lib/export/insomnia").then((m) => m.downloadCollectionAsInsomnia(collection))}>
                                                             <FileDown className="h-4 w-4 mr-2" />
                                                             Export (Insomnia v4)
                                                         </DropdownMenuItem>
@@ -523,62 +584,7 @@ export function CollectionsSidebar({ onLoadRequest: loadRequest }: CollectionsSi
                                 height={historyListHeight}
                                 onSelect={onLoadRequest}
                                 onDelete={onDeleteHistoryItem}
-                                renderRow={(item, style) => (
-                                    <div key={item.id} style={style} className="px-2 py-0.5">
-                                        <div
-                                            className="group flex flex-col p-2.5 hover:bg-muted/60 rounded-lg cursor-pointer transition-all duration-200 text-sm h-full"
-                                            onClick={() => onLoadRequest(item)}
-                                        >
-                                            <div className="flex items-center justify-between mb-1.5">
-                                                <div className="flex items-center gap-2 flex-1 min-w-0">
-                                                    <span
-                                                        className={cn(
-                                                            "text-[10px] uppercase font-bold px-1.5 py-0.5 rounded-sm tracking-wide shrink-0",
-                                                            item.method === "GET" && "bg-blue-500/10 text-blue-500",
-                                                            item.method === "POST" && "bg-green-500/10 text-green-500",
-                                                            item.method === "PUT" && "bg-orange-500/10 text-orange-500",
-                                                            item.method === "DELETE" && "bg-red-500/10 text-red-500",
-                                                            item.method === "PATCH" && "bg-yellow-500/10 text-yellow-600",
-                                                            (!["GET", "POST", "PUT", "DELETE", "PATCH"].includes(item.method)) && "bg-muted text-muted-foreground"
-                                                        )}
-                                                    >
-                                                        {item.method}
-                                                    </span>
-                                                    <span className="font-medium text-xs truncate max-w-[150px]">
-                                                        {item.name ? getApiClientRequestDisplayName(item.name, tRoot) : item.url}
-                                                    </span>
-                                                </div>
-                                                <Button
-                                                    variant="ghost"
-                                                    size="icon"
-                                                    className="h-6 w-6 text-muted-foreground hover:text-destructive hover:bg-destructive/10 rounded-md opacity-0 group-hover:opacity-100 transition-opacity shrink-0"
-                                                    onClick={(e) => {
-                                                        e.stopPropagation()
-                                                        onDeleteHistoryItem(item.id)
-                                                    }}
-                                                >
-                                                    <Trash2 className="h-3.5 w-3.5" />
-                                                </Button>
-                                            </div>
-                                            <div className="flex items-center justify-between text-[11px] text-muted-foreground/80 pl-1">
-                                                <span className="truncate max-w-[160px]">{item.url}</span>
-                                                <div className="flex items-center gap-2 shrink-0">
-                                                    <span>{new Date(item.timestamp).toLocaleTimeString([], {hour: '2-digit', minute:'2-digit'})}</span>
-                                                    {item.status && (
-                                                        <span className={cn(
-                                                            "font-medium",
-                                                            item.status >= 200 && item.status < 300 ? "text-green-500"
-                                                                : item.status >= 300 && item.status < 400 ? "text-amber-500"
-                                                                : "text-destructive"
-                                                        )}>
-                                                            {item.status}
-                                                        </span>
-                                                    )}
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                )}
+                                renderRow={renderHistoryRow}
                             />
                         )}
                     </div>
diff --git a/apps/desktop-ui/src/components/api-client/json-visualisers.tsx b/apps/desktop-ui/src/components/api-client/json-visualisers.tsx
index 697270be..e25b42b2 100644
--- a/apps/desktop-ui/src/components/api-client/json-visualisers.tsx
+++ b/apps/desktop-ui/src/components/api-client/json-visualisers.tsx
@@ -35,13 +35,21 @@ function TreeNode({ name, value, depth }: TreeNodeProps) {
                 <span className="font-bold">{name}</span>
                 <span className="text-muted-foreground">: {isArr ? "[" : "{"}{entries.length}{isArr ? "]" : "}"}</span>
             </button>
-            {open && entries.map(([k, v]) => (
+            {open && entries.slice(0, MAX_TREE_CHILDREN).map(([k, v]) => (
                 <TreeNode key={String(k)} name={k} value={v} depth={depth + 1} />
             ))}
+            {open && entries.length > MAX_TREE_CHILDREN && (
+                <Leaf name="…" text={`${entries.length - MAX_TREE_CHILDREN} more (download the body to see all)`} tone="text-muted-foreground" depth={depth + 1} />
+            )}
         </div>
     )
 }
 
+// Nothing is virtualised here; a 10k-element array would otherwise mount ~100k
+// DOM nodes when the Tree tab opens. Caps keep the views instant on big bodies.
+const MAX_TREE_CHILDREN = 200
+const MAX_TABLE_ROWS = 500
+
 function Leaf({ name, text, tone, depth }: { name: string | number; text: string; tone: string; depth: number }) {
     return (
         <div className="text-xs font-mono" style={{ paddingLeft: depth * 12 + 16 }}>
@@ -95,7 +103,7 @@ export function JsonTableView({ rows }: { rows: unknown }) {
                     </tr>
                 </thead>
                 <tbody>
-                    {rows.map((r, i) => (
+                    {rows.slice(0, MAX_TABLE_ROWS).map((r, i) => (
                         <tr key={i} className={cn(i % 2 === 0 ? "" : "bg-muted/20")}>
                             {cols.map((c) => {
                                 const v = (r && typeof r === "object" ? (r as Record<string, unknown>)[c] : undefined)
@@ -109,6 +117,11 @@ export function JsonTableView({ rows }: { rows: unknown }) {
                     ))}
                 </tbody>
             </table>
+            {rows.length > MAX_TABLE_ROWS && (
+                <div className="text-[10px] text-muted-foreground px-2 py-1">
+                    Showing {MAX_TABLE_ROWS} of {rows.length} rows
+                </div>
+            )}
         </div>
     )
 }
diff --git a/apps/desktop-ui/src/components/api-client/request-tabs.tsx b/apps/desktop-ui/src/components/api-client/request-tabs.tsx
index d12e2e4f..b1ece110 100644
--- a/apps/desktop-ui/src/components/api-client/request-tabs.tsx
+++ b/apps/desktop-ui/src/components/api-client/request-tabs.tsx
@@ -69,7 +69,7 @@ interface RequestTabsProps {
     setComments?: (next: import("./types").RequestComment[]) => void
 }
 
-export function RequestTabs({
+function RequestTabsImpl({
     params,
     setParams,
     headers,
@@ -105,9 +105,9 @@ export function RequestTabs({
         ],
     }), [body])
 
-    const updateBody = (updates: Partial<RequestBody>) => {
+    const updateBody = React.useCallback((updates: Partial<RequestBody>) => {
         setBody({ ...normalizedBody, ...updates })
-    }
+    }, [normalizedBody, setBody])
 
     const addFormDataItem = () => {
         updateBody({
@@ -157,10 +157,10 @@ export function RequestTabs({
 
     const handleBodyContentChange = React.useCallback(
         (v: string) => updateBody({ content: v }),
-        // updateBody closes over normalizedBody via its own capture; listing
-        // updateBody as the dep is sufficient and avoids re-creating the
-        // callback on every normalizedBody identity change.
-        // eslint-disable-next-line react-hooks/exhaustive-deps
+        [updateBody]
+    )
+    const handleGraphqlVariablesChange = React.useCallback(
+        (v: string) => updateBody({ graphqlVariables: v }),
         [updateBody]
     )
 
@@ -413,7 +413,9 @@ export function RequestTabs({
                 <TabsContent value="headers" className="mt-0 h-full overflow-auto custom-scrollbar">
                     <KeyValueEditor items={headers} onChange={setHeaders} />
                 </TabsContent>
-                <TabsContent value="body" className="mt-0 h-full flex flex-col gap-4 min-h-0">
+                {/* Editor tabs stay mounted (forceMount) so switching sub-tabs doesn't
+                    re-create a Monaco instance each time; `hidden` via data-state. */}
+                <TabsContent value="body" forceMount className="mt-0 h-full flex flex-col gap-4 min-h-0 data-[state=inactive]:hidden">
                     <div className="flex items-center gap-4 bg-muted/30 p-3 rounded-lg border">
                         <Label className="text-xs font-bold uppercase tracking-wider text-muted-foreground">{t("bodyType")}</Label>
                         <Select
@@ -612,7 +614,7 @@ export function RequestTabs({
                                     <div className="flex-1 border rounded-lg overflow-hidden min-h-0">
                                         <MemoCodeEditor
                                             value={normalizedBody.graphqlVariables ?? ""}
-                                            onChange={(v) => updateBody({ graphqlVariables: v })}
+                                            onChange={handleGraphqlVariablesChange}
                                             language="json"
                                         />
                                     </div>
@@ -1254,7 +1256,7 @@ export function RequestTabs({
                         )}
                     </div>
                 </TabsContent>
-                <TabsContent value="pre-request" className="mt-0 h-full flex flex-col gap-2 min-h-0">
+                <TabsContent value="pre-request" forceMount className="mt-0 h-full flex flex-col gap-2 min-h-0 data-[state=inactive]:hidden">
                     <p className="text-xs text-muted-foreground">
                         Runs in a sandbox before the request. Use{" "}
                         <code className="font-mono bg-muted/40 px-1 rounded">pm.environment.set</code>,{" "}
@@ -1263,12 +1265,12 @@ export function RequestTabs({
                     <div className="flex-1 border rounded-lg overflow-hidden min-h-0">
                         <MemoCodeEditor
                             value={preRequestScript}
-                            onChange={(v) => setPreRequestScript?.(v)}
+                            onChange={setPreRequestScript}
                             language="javascript"
                         />
                     </div>
                 </TabsContent>
-                <TabsContent value="tests" className="mt-0 h-full flex flex-col gap-2 min-h-0">
+                <TabsContent value="tests" forceMount className="mt-0 h-full flex flex-col gap-2 min-h-0 data-[state=inactive]:hidden">
                     <p className="text-xs text-muted-foreground">
                         Runs after the response arrives. Use{" "}
                         <code className="font-mono bg-muted/40 px-1 rounded">pm.test(name, fn)</code> with{" "}
@@ -1277,7 +1279,7 @@ export function RequestTabs({
                     <div className="flex-1 border rounded-lg overflow-hidden min-h-0">
                         <MemoCodeEditor
                             value={testScript}
-                            onChange={(v) => setTestScript?.(v)}
+                            onChange={setTestScript}
                             language="javascript"
                         />
                     </div>
@@ -1330,3 +1332,5 @@ export function RequestTabs({
         </Tabs>
     )
 }
+
+export const RequestTabs = React.memo(RequestTabsImpl)
diff --git a/apps/desktop-ui/src/components/api-client/response-panel.tsx b/apps/desktop-ui/src/components/api-client/response-panel.tsx
index 98c68c37..302407d3 100644
--- a/apps/desktop-ui/src/components/api-client/response-panel.tsx
+++ b/apps/desktop-ui/src/components/api-client/response-panel.tsx
@@ -121,7 +121,7 @@ interface ResponsePanelProps {
     onSaveExample?: () => void
 }
 
-export function ResponsePanel({ response, isLoading, scriptResults, onSaveExample }: ResponsePanelProps) {
+function ResponsePanelImpl({ response, isLoading, scriptResults, onSaveExample }: ResponsePanelProps) {
     const t = useTranslations("ApiClient.responsePanel")
     const tApi = useTranslations("ApiClient")
     const { copyToClipboard } = useCopyToClipboard()
@@ -140,6 +140,12 @@ export function ResponsePanel({ response, isLoading, scriptResults, onSaveExampl
         () => truncateBody(response?.body ?? "", MAX_INLINE_BYTES),
         [response?.body]
     )
+    // One parse per body for the tree/table/geo views — these used to parse
+    // inline in JSX, three times per render, on every parent re-render.
+    const parsedJson = React.useMemo(() => tryParseJson(response?.body), [response?.body])
+    const handleEditorMount = React.useCallback((ed: editor.IStandaloneCodeEditor) => {
+        bodyEditorRef.current = ed
+    }, [])
 
     if (isLoading && !response) {
         return <ResponsePanelSkeleton />
@@ -382,7 +388,7 @@ export function ResponsePanel({ response, isLoading, scriptResults, onSaveExampl
                                 value={response.isBase64 ? t("binaryRawView") : inlineBody}
                                 language={getLanguage()}
                                 readOnly
-                                onMount={(ed) => { bodyEditorRef.current = ed }}
+                                onMount={handleEditorMount}
                             />
                         </div>
                     </TabsContent>
@@ -392,13 +398,13 @@ export function ResponsePanel({ response, isLoading, scriptResults, onSaveExampl
                         </TabsContent>
                     )}
                     <TabsContent value="tree" className="mt-0 h-full absolute inset-0 overflow-auto">
-                        <JsonTreeView data={tryParseJson(response.body)} />
+                        <JsonTreeView data={parsedJson} />
                     </TabsContent>
                     <TabsContent value="table" className="mt-0 h-full absolute inset-0 overflow-auto">
-                        <JsonTableView rows={tryParseJson(response.body)} />
+                        <JsonTableView rows={parsedJson} />
                     </TabsContent>
                     <TabsContent value="geo" className="mt-0 h-full absolute inset-0 overflow-auto">
-                        <JsonGeoView data={tryParseJson(response.body)} />
+                        <JsonGeoView data={parsedJson} />
                     </TabsContent>
                     <TabsContent value="headers" className="mt-0 h-full absolute inset-0">
                         <ScrollArea className="h-full">
@@ -509,3 +515,5 @@ export function ResponsePanel({ response, isLoading, scriptResults, onSaveExampl
         </div>
     )
 }
+
+export const ResponsePanel = React.memo(ResponsePanelImpl)
diff --git a/apps/desktop-ui/src/components/api-client/tab-bar.tsx b/apps/desktop-ui/src/components/api-client/tab-bar.tsx
index d71748ff..b87749f3 100644
--- a/apps/desktop-ui/src/components/api-client/tab-bar.tsx
+++ b/apps/desktop-ui/src/components/api-client/tab-bar.tsx
@@ -63,6 +63,10 @@ export function TabBar({
     const tabRefs = React.useRef<Record<string, HTMLDivElement | null>>({})
     const [indicatorStyle, setIndicatorStyle] = React.useState<{ left: number; width: number } | null>(null)
 
+    // Only what changes a tab's width — not the whole tabs array, which is a new
+    // reference on every keystroke in any request field.
+    const tabsLayoutKey = tabs.map((t) => `${t.id}:${t.kind}:${t.method}:${t.name}`).join("|")
+
     // Measure the active tab and update the indicator synchronously before paint
     React.useLayoutEffect(() => {
         const activeEl = tabRefs.current[activeTabId]
@@ -77,7 +81,7 @@ export function TabBar({
             left: tabRect.left - listRect.left,
             width: tabRect.width,
         })
-    }, [activeTabId, tabs])
+    }, [activeTabId, tabsLayoutKey])
 
     const handleDoubleClick = (tab: ApiRequestState) => {
         if (!onTabRename) return
diff --git a/apps/desktop-ui/src/components/api-client/workers/scripts-runner.worker.ts b/apps/desktop-ui/src/components/api-client/workers/scripts-runner.worker.ts
index 3474ae7f..9d7e3ab3 100644
--- a/apps/desktop-ui/src/components/api-client/workers/scripts-runner.worker.ts
+++ b/apps/desktop-ui/src/components/api-client/workers/scripts-runner.worker.ts
@@ -121,11 +121,16 @@ function runScriptSync(script: string, ctx: ScriptContext): ScriptResult {
     }
 
     /** Build a JSON view of the response body — Postman's `pm.response.json()`. */
+    // Parsed once per run; scripts commonly call pm.response.json() several times.
+    let parsedResponse: { value: unknown } | null = null
     const responseJson = () => {
         if (!ctx.response) throw new Error("pm.response.json() called in pre-request script")
-        try { return JSON.parse(ctx.response.body) } catch (e) {
-            throw new Error(`Response body is not valid JSON: ${(e as Error).message}`)
+        if (!parsedResponse) {
+            try { parsedResponse = { value: JSON.parse(ctx.response.body) } } catch (e) {
+                throw new Error(`Response body is not valid JSON: ${(e as Error).message}`)
+            }
         }
+        return parsedResponse.value
     }
 
     const pm = {
diff --git a/apps/desktop-ui/src/lib/desktop/api-fetch.ts b/apps/desktop-ui/src/lib/desktop/api-fetch.ts
index 936b9606..b33a27ee 100644
--- a/apps/desktop-ui/src/lib/desktop/api-fetch.ts
+++ b/apps/desktop-ui/src/lib/desktop/api-fetch.ts
@@ -8,6 +8,40 @@ import { localApi, normalizeBackendPath, toResponse } from "./bridge";
  * `/api/backend/*` (and `/api/v1/*`) paths to the Rust local router.
  * Remote routing (shared workspaces / sync) is layered on in Phase 4.
  */
+/**
+ * Send an api-client request and return the `/api/proxy` envelope directly.
+ * On desktop this skips the stringify → Response → json() round-trip that
+ * `apiFetch("/api/proxy")` does purely to fake a fetch — two extra full passes
+ * over a multi-MB body on the UI thread.
+ */
+export interface ProxyEnvelope {
+  status: number;
+  statusText?: string;
+  headers?: Record<string, string>;
+  setCookies?: string[];
+  redirectChain?: unknown[];
+  body?: string;
+  isBase64?: boolean;
+  time?: number;
+  size?: number;
+  error?: string;
+}
+
+export async function sendProxyRequest(input: unknown, signal?: AbortSignal): Promise<ProxyEnvelope> {
+  if (isDesktop()) {
+    const { invoke } = await import("@tauri-apps/api/core");
+    return (await invoke("http_request", { input })) as ProxyEnvelope;
+  }
+  const res = await fetch("/api/proxy", {
+    method: "POST",
+    credentials: "include",
+    signal,
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input),
+  });
+  return res.json();
+}
+
 export async function apiFetch(path: string, init?: RequestInit): Promise<Response> {
   if (!isDesktop()) {
     return fetch(path, init);

From 58aaf5bc36112dbcc80db84559c9b3c033bf8a7e Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sat, 22 Aug 2026 13:42:26 +0530
Subject: [PATCH 06/39] web: API client comparison pages reflect what ships,
 add Bruno pages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Postman and Insomnia comparison pages stopped conceding mock servers,
collections, scripting and the runner — all shipped. They now list REST,
GraphQL, WebSocket, native gRPC, the local mock server, runner, vault-backed
secrets and import/export formats, and concede only team/cloud workspaces,
a CLI runner and Windows/Linux builds. New /compare/mydevtools-vs-bruno and
/compare/bruno-alternative pages; api-client metadata description/keywords
and the landing capability blurb describe the real scope.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 apps/web/src/app/page.tsx                |   2 +-
 apps/web/src/lib/metadata.ts             |   6 +-
 apps/web/src/lib/seo/comparison-pages.ts | 218 +++++++++++++++++------
 3 files changed, 168 insertions(+), 58 deletions(-)

diff --git a/apps/web/src/app/page.tsx b/apps/web/src/app/page.tsx
index 0bb25f3b..a61f69ff 100644
--- a/apps/web/src/app/page.tsx
+++ b/apps/web/src/app/page.tsx
@@ -168,7 +168,7 @@ const capabilities = [
   {
     title: "API & Networking",
     icon: Globe,
-    blurb: "Request collections, environments and sockets in one place.",
+    blurb: "REST, GraphQL, WebSocket and gRPC, with a mock server, runner and vault-backed secrets.",
     tools: [
       ["API Client", "api-client"],
       ["WebSocket Tester", "websocket-tester"],
diff --git a/apps/web/src/lib/metadata.ts b/apps/web/src/lib/metadata.ts
index 1667b955..16c92ff3 100644
--- a/apps/web/src/lib/metadata.ts
+++ b/apps/web/src/lib/metadata.ts
@@ -71,9 +71,9 @@ export const toolsMetadata: Record<string, ToolMetadataEntry> = {
     },
     'api-client': {
         title: 'API Client',
-        description: 'Test and debug HTTP requests with headers, body, and auth support. A lightweight Postman alternative for your desktop.',
-        keywords: ['api client', 'http client', 'rest api tester', 'debug api', 'postman alternative'],
-        aiSummary: 'Local REST client: send GET/POST/PUT/PATCH/DELETE with custom headers, auth, and body — a lightweight Postman alternative in the MyDevTools desktop app.',
+        description: 'Offline desktop API client for REST, GraphQL, WebSocket and gRPC with a mock server, collection runner, scripting and vault-backed secrets. Free, no account.',
+        keywords: ['api client', 'http client', 'rest api tester', 'graphql client', 'grpc client', 'websocket client', 'mock server', 'offline api client', 'postman alternative', 'insomnia alternative', 'bruno alternative'],
+        aiSummary: 'MyDevTools API Client is a free, offline desktop API client: REST, GraphQL with schema introspection, WebSocket and native gRPC, a local mock server built from saved examples, a collection runner with CSV/JSON data files and JUnit export, pre-request/test scripts (pm.* API), environments and response chaining, OAuth 2.0, AWS SigV4, Hawk, Digest and JWT auth, Postman/OpenAPI/HAR/cURL import, and secrets resolved from an encrypted local vault. No account — a Postman, Insomnia or Bruno alternative.',
     },
     'http-status-codes': {
         title: 'HTTP Status Codes Reference',
diff --git a/apps/web/src/lib/seo/comparison-pages.ts b/apps/web/src/lib/seo/comparison-pages.ts
index beb9ec7f..bc8a0824 100644
--- a/apps/web/src/lib/seo/comparison-pages.ts
+++ b/apps/web/src/lib/seo/comparison-pages.ts
@@ -291,13 +291,13 @@ export const comparisonPages: ComparisonPage[] = [
   },
   {
     slug: 'postman-alternative-online',
-    title: 'Postman Alternative — Lightweight Desktop API Client',
+    title: 'Postman Alternative — Free Offline Desktop API Client',
     description:
-      'Compare MyDevTools as a lightweight desktop Postman alternative for quick API testing alongside JSON, JWT, URL, encoding, and generator tools.',
+      'Compare MyDevTools as a free, offline Postman alternative: REST, GraphQL, WebSocket and gRPC, mock server, collection runner, scripting and vault-backed secrets.',
     eyebrow: 'Alternative',
-    heading: 'Postman alternative for quick, offline API testing',
+    heading: 'Postman alternative for offline, account-free API testing',
     intro:
-      'Postman is a full API platform. MyDevTools is a lightweight all-in-one desktop developer toolkit with an API client plus surrounding utilities developers often need during API debugging.',
+      'Postman is a cloud API platform built around team workspaces. MyDevTools is a free, open-source desktop API client that covers REST, GraphQL, WebSocket and gRPC, with a local mock server, collection runner, scripting and encrypted secrets — no account, no sync, and 80+ other developer tools in the same app.',
     competitor: 'Postman',
     toolSlug: 'api-client',
     primaryCta: { href: '/tools/api-client', label: 'Try API Client' },
@@ -305,42 +305,42 @@ export const comparisonPages: ComparisonPage[] = [
       {
         title: 'Choose Postman when',
         body:
-          'Postman is better for full API lifecycle management, team collaboration, mock servers, collections, and governance.',
+          'Postman is the better fit when API work is a team process that lives in the cloud.',
         bullets: [
-          'You need enterprise API collaboration.',
-          'You manage large shared API collections.',
-          'You rely on Postman-specific test automation and governance.',
+          'You need shared cloud workspaces, comments and role-based collaboration.',
+          'You run collections from CI with a command-line runner, or rely on monitors and hosted documentation.',
+          'You need API governance features, or Windows and Linux builds — MyDevTools ships macOS builds today.',
         ],
       },
       {
         title: 'Choose MyDevTools when',
         body:
-          'Sometimes you just need to send a request, inspect a response, decode a token, format JSON, and generate test data without opening a heavy platform.',
+          'MyDevTools covers the day-to-day API client feature set without a login, a plan, or a server in between.',
         bullets: [
-          'Use the API client for quick request testing.',
-          'Pair API testing with JSON, JWT, URL, Base64, timestamp, and mock data tools.',
-          'Use the desktop toolkit when speed and context switching matter more than enterprise API management.',
+          'REST, GraphQL with schema introspection, WebSocket, and native gRPC via server reflection or a pasted .proto, including unary and streaming calls.',
+          'Collections with saved examples, environments, response chaining and pre-request/test scripts using the familiar pm.* API — plus a runner with CSV/JSON data files and JUnit export, and a local mock server built from your saved examples.',
+          'Secrets resolved from the encrypted local vault at send time and never written into collections; import Postman v2.1, OpenAPI, HAR and cURL, export Postman, OpenAPI 3.0, HAR and Insomnia.',
         ],
       },
       {
         title: 'Verdict',
         body:
-          'Postman is stronger as a full API platform. MyDevTools is useful as a fast desktop toolkit around lightweight API debugging.',
+          'Postman remains the stronger choice for cloud team workflows and CI. MyDevTools is the stronger choice for a private, offline client where every feature is free.',
         bullets: [
-          'Best enterprise API platform: Postman.',
-          'Best quick desktop toolkit around API debugging: MyDevTools.',
-          'Best all-in-one desktop toolkit path: MyDevTools.',
+          'Best cloud team platform and CI runner: Postman.',
+          'Best free, offline, account-free API client: MyDevTools.',
+          'Best API client plus 80+ developer tools in one app: MyDevTools.',
         ],
       },
     ],
     faqs: [
       {
         q: 'Is MyDevTools a full Postman replacement?',
-        a: 'No. MyDevTools is better described as a lightweight API client inside a broader desktop developer toolkit.',
+        a: 'For individual API work, yes: REST, GraphQL, WebSocket, gRPC, collections, environments, scripting, a runner and a mock server are all included and free. It does not replace the Postman cloud workspaces, CLI runner, monitors or governance features.',
       },
       {
-        q: 'Why use MyDevTools for API debugging?',
-        a: 'It keeps API requests close to related tools like JSON formatter, JWT decoder, URL parser, timestamp converter, and mock data generator.',
+        q: 'Can I import my Postman collections?',
+        a: 'Yes. Import Postman v2.1 collections, OpenAPI 3 / Swagger 2, HAR and cURL. You can export back to Postman, OpenAPI 3.0, HAR 1.2 or Insomnia v4 at any time.',
       },
     ],
   },
@@ -348,11 +348,11 @@ export const comparisonPages: ComparisonPage[] = [
     slug: 'mydevtools-vs-postman',
     title: 'MyDevTools vs Postman',
     description:
-      'Compare MyDevTools with Postman for desktop API testing, developer utilities, JSON formatting, JWT decoding, and lightweight request debugging.',
+      'Compare MyDevTools with Postman: a free offline desktop API client with REST, GraphQL, WebSocket, gRPC, mock server, runner and scripting versus a cloud API platform.',
     eyebrow: 'Comparison',
-    heading: 'MyDevTools vs Postman: lightweight desktop API testing',
+    heading: 'MyDevTools vs Postman: offline desktop API client vs cloud platform',
     intro:
-      'Postman is a full API platform for teams, collections, environments, and API lifecycle workflows. MyDevTools is an all-in-one desktop developer toolkit with a lightweight API client plus JSON, JWT, URL, timestamp, mock data, and security tools for quick debugging sessions.',
+      'Postman is a cloud API platform for teams, with workspaces, monitors, governance and a CI runner. MyDevTools is a free, open-source desktop API client that runs fully offline: REST, GraphQL, WebSocket and gRPC, collections and environments, scripting, a collection runner, a local mock server and vault-backed secrets — alongside 80+ developer tools.',
     competitor: 'Postman',
     toolSlug: 'api-client',
     primaryCta: { href: '/tools/api-client', label: 'Try API Client' },
@@ -360,30 +360,30 @@ export const comparisonPages: ComparisonPage[] = [
       {
         title: 'Choose Postman when',
         body:
-          'Postman is strongest when API work is a team process with shared collections, governance, documentation, mock servers, and automated tests.',
+          'Postman is strongest when API work is a shared, cloud-hosted team process.',
         bullets: [
-          'You need a complete API lifecycle platform.',
-          'Your team collaborates on large shared request collections.',
-          'You rely on Postman-specific environments, monitors, and governance features.',
+          'Your team collaborates in shared cloud workspaces with comments and roles.',
+          'You run collections in CI with a command-line runner, or need monitors and hosted documentation.',
+          'You need API governance features, or Windows and Linux builds — MyDevTools ships macOS builds today.',
         ],
       },
       {
         title: 'Choose MyDevTools when',
         body:
-          'MyDevTools is better for quick local debugging where an API request is only one part of a larger utility workflow.',
+          'MyDevTools is better when you want the full client feature set on your own machine, with no account and nothing uploaded.',
         bullets: [
-          'Send a request, format the JSON response, decode a JWT, and parse URLs in the same toolkit.',
-          'Run a fast local workflow with everything in one app.',
-          'Keep requests and history saved locally as you work.',
+          'Test REST, GraphQL, WebSocket and native gRPC (server reflection or .proto, unary and streaming) from one client.',
+          'Use collections, saved examples, environments, response chaining, pre-request/test scripts (pm.* API), a runner with data files and JUnit export, and a local mock server.',
+          'Keep secrets in the encrypted local vault, store everything in an encrypted SQLCipher database, work in 27 UI languages — then format the JSON, decode the JWT or open the SQL client in the same app.',
         ],
       },
       {
         title: 'Verdict',
         body:
-          'Postman remains the better full API platform. MyDevTools is the better lightweight desktop alternative for quick API debugging plus surrounding developer utilities.',
+          'Postman wins on cloud collaboration, CI and governance. MyDevTools wins on privacy, price and scope: every feature is free, nothing leaves your device, and the rest of your toolkit is one click away.',
         bullets: [
-          'Best enterprise API platform: Postman.',
-          'Best quick local API workflow: MyDevTools.',
+          'Best cloud team platform and CI runner: Postman.',
+          'Best free, offline, account-free API client: MyDevTools.',
           'Best API client plus 80+ utility toolkit: MyDevTools.',
         ],
       },
@@ -391,11 +391,11 @@ export const comparisonPages: ComparisonPage[] = [
     faqs: [
       {
         q: 'Is MyDevTools a Postman replacement?',
-        a: 'Not for full enterprise API lifecycle management. MyDevTools is a lightweight desktop alternative when you need quick API requests plus related developer tools.',
+        a: 'For individual and local API work, yes. It covers REST, GraphQL, WebSocket, gRPC, collections, environments, scripting, a runner and a mock server, and imports Postman v2.1 collections. It is not a replacement for the Postman cloud workspaces, CLI runner, monitors or governance.',
       },
       {
         q: 'What makes MyDevTools useful for API debugging?',
-        a: 'API debugging often requires formatting JSON, decoding JWTs, parsing URLs, converting timestamps, and generating mock data. MyDevTools keeps those tools near the API client.',
+        a: 'Everything runs offline on your device with no account. Secrets come from the local encrypted vault, scripts run in a sandboxed worker, and the JSON formatter, JWT decoder, URL parser, timestamp converter and mock data generator sit next to the API client.',
       },
     ],
   },
@@ -888,13 +888,13 @@ export const comparisonPages: ComparisonPage[] = [
   },
   {
     slug: 'insomnia-alternative-online',
-    title: 'Insomnia Alternative for Lightweight API Debugging',
+    title: 'Insomnia Alternative — Free Offline Desktop API Client',
     description:
-      'Compare MyDevTools with Insomnia for lightweight desktop API testing and surrounding developer utilities.',
+      'Compare MyDevTools with Insomnia: a free, offline desktop API client with REST, GraphQL, WebSocket, gRPC, mock server, runner and vault-backed secrets, plus 80+ developer tools.',
     eyebrow: 'Alternative',
-    heading: 'Insomnia alternative for lightweight, offline API debugging',
+    heading: 'Insomnia alternative for offline, account-free API debugging',
     intro:
-      'Insomnia is a dedicated desktop API client. MyDevTools offers a lightweight API client alongside JSON, JWT, URL, timestamp, mock data, and security tools that are often needed during API debugging — all in one offline app.',
+      'Insomnia is a dedicated desktop API client from Kong with cloud and Git sync, a plugin ecosystem and a CLI. MyDevTools is a free, open-source desktop API client that runs fully offline and needs no account: REST, GraphQL, WebSocket and gRPC, collections, environments, scripting, a collection runner and a local mock server — next to 80+ other developer tools.',
     competitor: 'Insomnia',
     toolSlug: 'api-client',
     primaryCta: { href: '/tools/api-client', label: 'Try API Client' },
@@ -902,42 +902,152 @@ export const comparisonPages: ComparisonPage[] = [
       {
         title: 'Choose Insomnia when',
         body:
-          'Insomnia is better for dedicated API development with desktop collections, environments, plugins, and team workflows.',
+          'Insomnia is the better fit when you need its team and automation surface.',
         bullets: [
-          'You need a full desktop API client.',
-          'You manage complex request collections.',
-          'Your team already standardizes on Insomnia.',
+          'Your team shares collections through Kong cloud sync or Git sync.',
+          'You run collections in CI with the Insomnia CLI, or depend on its plugin ecosystem.',
+          'You need Windows or Linux builds — MyDevTools ships macOS builds today.',
         ],
       },
       {
         title: 'Choose MyDevTools when',
         body:
-          'MyDevTools is useful for quick API debugging, especially when the request workflow connects to common utility tasks.',
+          'MyDevTools gives you the full client feature set locally, with nothing to sign in to and nothing uploaded.',
         bullets: [
-          'Test API requests and then format JSON responses nearby.',
-          'Decode JWTs, parse URLs, convert timestamps, and generate mock data in one toolkit.',
-          'Keep API debugging next to 80+ other tools in one desktop app.',
+          'REST, GraphQL with schema introspection, WebSocket, and native gRPC with server reflection, unary and streaming calls.',
+          'Collections with saved examples, environments and response chaining, pre-request/test scripts, a runner with CSV/JSON data files and JUnit export, and a mock server built from saved examples.',
+          'Secrets from the encrypted local vault, everything stored in an encrypted database, 27 UI languages, and Insomnia v4 export if you ever want to move back.',
         ],
       },
       {
         title: 'Verdict',
         body:
-          'Insomnia is the better full API client. MyDevTools is a lightweight all-in-one alternative for quick debugging plus related developer utilities.',
+          'Insomnia is stronger for cloud and Git sync, plugins and CI. MyDevTools is the stronger free, offline client that also carries the rest of your toolkit.',
         bullets: [
-          'Best dedicated desktop API client: Insomnia.',
-          'Best toolkit around API debugging: MyDevTools.',
-          'Best no-fuss quick workflow: MyDevTools.',
+          'Best team sync, plugins and CLI: Insomnia.',
+          'Best free, offline, account-free API client: MyDevTools.',
+          'Best API client plus 80+ developer tools: MyDevTools.',
         ],
       },
     ],
     faqs: [
       {
         q: 'Is MyDevTools a full Insomnia replacement?',
-        a: 'No. It is a lightweight API client inside a larger all-in-one toolkit, not a complete API lifecycle platform.',
+        a: 'For local API work, yes: REST, GraphQL, WebSocket, gRPC, collections, environments, scripting, a runner and a mock server are all included and free. It does not offer cloud or Git sync, plugins, or a CLI runner.',
       },
       {
-        q: 'Why use MyDevTools for API testing?',
-        a: 'Use it when you want quick API requests plus JSON, JWT, URL, timestamp, and mock data tools in the same offline workspace.',
+        q: 'Can I move my Insomnia collections to MyDevTools?',
+        a: 'Export your Insomnia collection as HAR, or as an OpenAPI spec from a design document, and import it into MyDevTools; cURL commands import too. MyDevTools exports to Insomnia v4, so the move works in both directions.',
+      },
+    ],
+  },
+  {
+    slug: 'mydevtools-vs-bruno',
+    title: 'MyDevTools vs Bruno',
+    description:
+      'Compare MyDevTools with Bruno: two open-source desktop API clients. Every MyDevTools feature is free with no paid tier, no account, 27 UI languages and 80+ developer tools in one app.',
+    eyebrow: 'Comparison',
+    heading: 'MyDevTools vs Bruno: open-source desktop API clients compared',
+    intro:
+      'Bruno is an open-source, Git-native API client that stores collections as plain-text files and sells Pro and Ultimate tiers on top. MyDevTools is an open-source (AGPL-3.0) desktop API client where every feature is free for good: REST, GraphQL, WebSocket and gRPC, a local mock server, collection runner, scripting and vault-backed secrets — plus 80+ other developer tools in the same window.',
+    competitor: 'Bruno',
+    toolSlug: 'api-client',
+    primaryCta: { href: '/tools/api-client', label: 'Try API Client' },
+    sections: [
+      {
+        title: 'Choose Bruno when',
+        body:
+          'Bruno is the better fit when your collections must live in a Git repository today.',
+        bullets: [
+          'You want collections as plain-text files reviewed in pull requests, with the native Git commit and push UI on the paid tiers.',
+          'You run collections in CI with the bru CLI, Docker image or GitHub Action.',
+          'You need Windows or Linux builds — MyDevTools ships macOS builds today.',
+        ],
+      },
+      {
+        title: 'Choose MyDevTools when',
+        body:
+          'MyDevTools has no feature gates: nothing is held back for a Pro or Ultimate plan, and there is no account to create.',
+        bullets: [
+          'Secrets from the encrypted local vault, unlimited OpenAPI and Postman imports, and every feature unlocked — nothing behind a $6 or $11 per-user plan.',
+          'REST, GraphQL, WebSocket and native gRPC, plus a local mock server, a runner with data files and JUnit export, and sandboxed pm.* scripts.',
+          'A UI in 27 languages, and JSON, JWT, SQL, MongoDB, Redis and vault tools in the same window.',
+        ],
+      },
+      {
+        title: 'Verdict',
+        body:
+          'Bruno wins when Git-tracked collection files and a CI runner are the priority. MyDevTools wins when you want every feature free, a private offline setup, and the rest of your toolkit alongside the client.',
+        bullets: [
+          'Best Git-native collections and CLI: Bruno.',
+          'Best fully free, account-free API client: MyDevTools.',
+          'Best API client plus 80+ developer tools: MyDevTools.',
+        ],
+      },
+    ],
+    faqs: [
+      {
+        q: 'Is MyDevTools free like Bruno?',
+        a: 'MyDevTools is free for every feature with no paid tier, ever. The core Bruno client is free and MIT-licensed, but its native Git UI, more than two workspaces, unlimited OpenAPI sync, secret-manager integrations and AI assistant are gated behind Pro and Ultimate plans.',
+      },
+      {
+        q: 'Does MyDevTools store collections as files like Bruno?',
+        a: 'Not today. Collections are stored locally in an encrypted SQLCipher database on your device. You can export to Postman, OpenAPI 3.0, HAR or Insomnia v4 whenever you need a file.',
+      },
+    ],
+  },
+  {
+    slug: 'bruno-alternative',
+    title: 'Bruno Alternative — Free Offline API Client with No Paid Tier',
+    description:
+      'Looking for a Bruno alternative with no Pro tier? MyDevTools is a free, open-source offline desktop API client: REST, GraphQL, WebSocket, gRPC, mock server, runner and vault-backed secrets.',
+    eyebrow: 'Alternative',
+    heading: 'Bruno alternative: every API client feature free, no account, no plan',
+    intro:
+      'Bruno is a well-liked open-source API client, but its Git UI, extra workspaces, unlimited OpenAPI sync, secret-manager integrations and AI assistant sit behind Pro and Ultimate plans. MyDevTools is a free, open-source desktop API client with nothing gated: REST, GraphQL, WebSocket and gRPC, a local mock server, a collection runner, sandboxed scripts and secrets from an encrypted local vault — with 80+ other developer tools in the same app.',
+    competitor: 'Bruno',
+    toolSlug: 'api-client',
+    primaryCta: { href: '/tools/api-client', label: 'Try API Client' },
+    sections: [
+      {
+        title: 'Choose Bruno when',
+        body:
+          'Bruno remains the right choice when the files-on-disk model is the point.',
+        bullets: [
+          'You need collections as plain-text files reviewed in Git today.',
+          'You run collections in CI with the bru CLI, Docker image or GitHub Action.',
+          'You need Windows or Linux builds — MyDevTools ships macOS builds today.',
+        ],
+      },
+      {
+        title: 'Choose MyDevTools when',
+        body:
+          'MyDevTools covers the same daily API work without a paid tier or a sign-in, and goes further on protocols and languages.',
+        bullets: [
+          'REST, GraphQL with introspection, WebSocket, and native gRPC with server reflection, unary and streaming calls.',
+          'Local mock server from saved examples, a runner with CSV/JSON data and JUnit export, environments, response chaining and pm.* scripts.',
+          'Secrets resolved from the encrypted local vault and never written into collections, a UI in 27 languages, and JSON, JWT, SQL, MongoDB and Redis tools one click away.',
+        ],
+      },
+      {
+        title: 'Verdict',
+        body:
+          'Bruno is best for Git-tracked collection files and CI. MyDevTools is best when you want a private, offline client with every feature free and a full toolkit around it.',
+        bullets: [
+          'Best Git-native files and CLI: Bruno.',
+          'Best free, offline, account-free client: MyDevTools.',
+          'Best API client plus 80+ developer tools: MyDevTools.',
+        ],
+      },
+    ],
+    faqs: [
+      {
+        q: 'Does MyDevTools have a paid tier like Bruno Pro?',
+        a: 'No. MyDevTools is licensed under the AGPL-3.0 and every feature — mock server, runner, gRPC, vault-backed secrets, imports and exports — is free with no plan, no trial and no account.',
+      },
+      {
+        q: 'Can I import my Bruno collections?',
+        a: 'Not directly yet. Export from Bruno as a Postman collection and import that into MyDevTools, which also accepts OpenAPI, HAR and cURL.',
       },
     ],
   },

From 5ce3275a8da65f50e842388bace10f1242cfdee4 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sat, 22 Aug 2026 13:46:38 +0530
Subject: [PATCH 07/39] feat(api-client): Postman environment import + export

The Postman environment importer existed but nothing called it. The import
dialog now detects `{ name, values[] }` payloads and creates the environment;
the environment manager gets a per-environment Postman export button.
i18n key ApiClient.environmentManager.exportPostman in all 27 locales.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 apps/desktop-ui/messages/af.json              |  1 +
 apps/desktop-ui/messages/ar.json              |  1 +
 apps/desktop-ui/messages/ca.json              |  1 +
 apps/desktop-ui/messages/cs.json              |  1 +
 apps/desktop-ui/messages/da.json              |  1 +
 apps/desktop-ui/messages/de.json              |  1 +
 apps/desktop-ui/messages/el.json              |  1 +
 apps/desktop-ui/messages/en.json              |  1 +
 apps/desktop-ui/messages/es.json              |  1 +
 apps/desktop-ui/messages/fa.json              |  1 +
 apps/desktop-ui/messages/fr.json              |  1 +
 apps/desktop-ui/messages/id.json              |  1 +
 apps/desktop-ui/messages/it.json              |  1 +
 apps/desktop-ui/messages/ja.json              |  1 +
 apps/desktop-ui/messages/ko.json              |  1 +
 apps/desktop-ui/messages/ms.json              |  1 +
 apps/desktop-ui/messages/nb.json              |  1 +
 apps/desktop-ui/messages/nl.json              |  1 +
 apps/desktop-ui/messages/pl.json              |  1 +
 apps/desktop-ui/messages/pt-BR.json           |  1 +
 apps/desktop-ui/messages/pt.json              |  1 +
 apps/desktop-ui/messages/ru.json              |  1 +
 apps/desktop-ui/messages/sv.json              |  1 +
 apps/desktop-ui/messages/tr.json              |  1 +
 apps/desktop-ui/messages/uk.json              |  1 +
 apps/desktop-ui/messages/vi.json              |  1 +
 apps/desktop-ui/messages/zh.json              |  1 +
 .../api-client/environment-manager.tsx        | 15 +++++++-
 .../components/api-client/import-dialog.tsx   | 15 ++++++--
 .../__tests__/postman-env-roundtrip.test.ts   | 32 +++++++++++++++++
 apps/desktop-ui/src/lib/export/postman-env.ts | 35 +++++++++++++++++++
 apps/desktop-ui/src/lib/import/detect.ts      |  6 +++-
 32 files changed, 126 insertions(+), 4 deletions(-)
 create mode 100644 apps/desktop-ui/src/lib/__tests__/postman-env-roundtrip.test.ts
 create mode 100644 apps/desktop-ui/src/lib/export/postman-env.ts

diff --git a/apps/desktop-ui/messages/af.json b/apps/desktop-ui/messages/af.json
index 62da5e17..5226d011 100644
--- a/apps/desktop-ui/messages/af.json
+++ b/apps/desktop-ui/messages/af.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "Nuwe omgewing",
       "variablesHeading": "{name}-veranderlikes",
       "addVariable": "Voeg veranderlike by",
+      "exportPostman": "Voer uit (Postman-omgewing)",
       "columnVariable": "Veranderlike",
       "columnValue": "Waarde",
       "placeholderKey": "Sleutel",
diff --git a/apps/desktop-ui/messages/ar.json b/apps/desktop-ui/messages/ar.json
index 535d0dfd..41831c2a 100644
--- a/apps/desktop-ui/messages/ar.json
+++ b/apps/desktop-ui/messages/ar.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "بيئة جديدة",
       "variablesHeading": "متغيرات {name}",
       "addVariable": "إضافة متغير",
+      "exportPostman": "تصدير (بيئة Postman)",
       "columnVariable": "متغير",
       "columnValue": "قيمة",
       "placeholderKey": "مفتاح",
diff --git a/apps/desktop-ui/messages/ca.json b/apps/desktop-ui/messages/ca.json
index b4968a54..16670042 100644
--- a/apps/desktop-ui/messages/ca.json
+++ b/apps/desktop-ui/messages/ca.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Entorn nou",
       "variablesHeading": "Variables de {name}",
       "addVariable": "Afegeix variable",
+      "exportPostman": "Exporta (entorn de Postman)",
       "columnVariable": "Variable",
       "columnValue": "Valor",
       "placeholderKey": "Clau",
diff --git a/apps/desktop-ui/messages/cs.json b/apps/desktop-ui/messages/cs.json
index cca9f35e..e748a831 100644
--- a/apps/desktop-ui/messages/cs.json
+++ b/apps/desktop-ui/messages/cs.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Nové prostředí",
       "variablesHeading": "Proměnné: {name}",
       "addVariable": "Přidat proměnnou",
+      "exportPostman": "Exportovat (prostředí Postman)",
       "columnVariable": "Proměnná",
       "columnValue": "Hodnota",
       "placeholderKey": "Klíč",
diff --git a/apps/desktop-ui/messages/da.json b/apps/desktop-ui/messages/da.json
index ed69952e..edffc75c 100644
--- a/apps/desktop-ui/messages/da.json
+++ b/apps/desktop-ui/messages/da.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Nyt miljø",
       "variablesHeading": "{name} variabler",
       "addVariable": "Tilføj variabel",
+      "exportPostman": "Eksportér (Postman-miljø)",
       "columnVariable": "Variabel",
       "columnValue": "Værdi",
       "placeholderKey": "Nøgle",
diff --git a/apps/desktop-ui/messages/de.json b/apps/desktop-ui/messages/de.json
index 09cdcf0b..259b7035 100644
--- a/apps/desktop-ui/messages/de.json
+++ b/apps/desktop-ui/messages/de.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Neue Umgebung",
       "variablesHeading": "Variablen: {name}",
       "addVariable": "Variable hinzufügen",
+      "exportPostman": "Exportieren (Postman-Umgebung)",
       "columnVariable": "Variable",
       "columnValue": "Wert",
       "placeholderKey": "Schlüssel",
diff --git a/apps/desktop-ui/messages/el.json b/apps/desktop-ui/messages/el.json
index 1313ddbb..9da3820b 100644
--- a/apps/desktop-ui/messages/el.json
+++ b/apps/desktop-ui/messages/el.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Νέο περιβάλλον",
       "variablesHeading": "{name} μεταβλητές",
       "addVariable": "Προσθήκη μεταβλητής",
+      "exportPostman": "Εξαγωγή (περιβάλλον Postman)",
       "columnVariable": "Μεταβλητός",
       "columnValue": "Αξία",
       "placeholderKey": "Κλειδί",
diff --git a/apps/desktop-ui/messages/en.json b/apps/desktop-ui/messages/en.json
index 7a8edc52..59bb38e2 100644
--- a/apps/desktop-ui/messages/en.json
+++ b/apps/desktop-ui/messages/en.json
@@ -2395,6 +2395,7 @@
       "placeholderNewEnv": "New environment",
       "variablesHeading": "{name} variables",
       "addVariable": "Add variable",
+      "exportPostman": "Export (Postman environment)",
       "columnVariable": "Variable",
       "columnValue": "Value",
       "placeholderKey": "Key",
diff --git a/apps/desktop-ui/messages/es.json b/apps/desktop-ui/messages/es.json
index ce45769a..6d552b01 100644
--- a/apps/desktop-ui/messages/es.json
+++ b/apps/desktop-ui/messages/es.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "Nuevo entorno",
       "variablesHeading": "Variables de {name}",
       "addVariable": "Añadir variable",
+      "exportPostman": "Exportar (entorno de Postman)",
       "columnVariable": "Variable",
       "columnValue": "Valor",
       "placeholderKey": "Clave",
diff --git a/apps/desktop-ui/messages/fa.json b/apps/desktop-ui/messages/fa.json
index 50b4c948..bcbc10d0 100644
--- a/apps/desktop-ui/messages/fa.json
+++ b/apps/desktop-ui/messages/fa.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "محیط جدید",
       "variablesHeading": "{name} متغیرها",
       "addVariable": "متغیر اضافه کنید",
+      "exportPostman": "خروجی (محیط Postman)",
       "columnVariable": "متغیر",
       "columnValue": "ارزش",
       "placeholderKey": "کلید",
diff --git a/apps/desktop-ui/messages/fr.json b/apps/desktop-ui/messages/fr.json
index d6e005fa..1a681f24 100644
--- a/apps/desktop-ui/messages/fr.json
+++ b/apps/desktop-ui/messages/fr.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "Nouvel environnement",
       "variablesHeading": "Variables {name}",
       "addVariable": "Ajouter une variable",
+      "exportPostman": "Exporter (environnement Postman)",
       "columnVariable": "Variable",
       "columnValue": "Valeur",
       "placeholderKey": "Clé",
diff --git a/apps/desktop-ui/messages/id.json b/apps/desktop-ui/messages/id.json
index 83e05e5b..da056a98 100644
--- a/apps/desktop-ui/messages/id.json
+++ b/apps/desktop-ui/messages/id.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "New environment",
       "variablesHeading": "{name} variables",
       "addVariable": "Add variable",
+      "exportPostman": "Ekspor (lingkungan Postman)",
       "columnVariable": "Variable",
       "columnValue": "Value",
       "placeholderKey": "Key",
diff --git a/apps/desktop-ui/messages/it.json b/apps/desktop-ui/messages/it.json
index aedb91ed..26411714 100644
--- a/apps/desktop-ui/messages/it.json
+++ b/apps/desktop-ui/messages/it.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "Nuovo ambiente",
       "variablesHeading": "{name} variabili",
       "addVariable": "Aggiungi variabile",
+      "exportPostman": "Esporta (ambiente Postman)",
       "columnVariable": "Variabile",
       "columnValue": "Valore",
       "placeholderKey": "Chiave",
diff --git a/apps/desktop-ui/messages/ja.json b/apps/desktop-ui/messages/ja.json
index b239bb57..391af32c 100644
--- a/apps/desktop-ui/messages/ja.json
+++ b/apps/desktop-ui/messages/ja.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "新しい環境",
       "variablesHeading": "{name}の変数",
       "addVariable": "変数を追加",
+      "exportPostman": "エクスポート（Postman 環境）",
       "columnVariable": "変数",
       "columnValue": "値",
       "placeholderKey": "キー",
diff --git a/apps/desktop-ui/messages/ko.json b/apps/desktop-ui/messages/ko.json
index cf3f0eff..6573a880 100644
--- a/apps/desktop-ui/messages/ko.json
+++ b/apps/desktop-ui/messages/ko.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "새 환경",
       "variablesHeading": "{name} 변수",
       "addVariable": "변수 추가",
+      "exportPostman": "내보내기 (Postman 환경)",
       "columnVariable": "변수",
       "columnValue": "값",
       "placeholderKey": "키",
diff --git a/apps/desktop-ui/messages/ms.json b/apps/desktop-ui/messages/ms.json
index e9c877e5..889cf36f 100644
--- a/apps/desktop-ui/messages/ms.json
+++ b/apps/desktop-ui/messages/ms.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "Persekitaran baharu",
       "variablesHeading": "Pembolehubah {name}",
       "addVariable": "Tambah pembolehubah",
+      "exportPostman": "Eksport (persekitaran Postman)",
       "columnVariable": "Pembolehubah",
       "columnValue": "Nilai",
       "placeholderKey": "Kunci",
diff --git a/apps/desktop-ui/messages/nb.json b/apps/desktop-ui/messages/nb.json
index f14eef4e..afd3b8a5 100644
--- a/apps/desktop-ui/messages/nb.json
+++ b/apps/desktop-ui/messages/nb.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Nytt miljø",
       "variablesHeading": "{name}-variabler",
       "addVariable": "Legg til variabel",
+      "exportPostman": "Eksporter (Postman-miljø)",
       "columnVariable": "Variabel",
       "columnValue": "Verdi",
       "placeholderKey": "Nøkkel",
diff --git a/apps/desktop-ui/messages/nl.json b/apps/desktop-ui/messages/nl.json
index 08384b94..d45d8ee7 100644
--- a/apps/desktop-ui/messages/nl.json
+++ b/apps/desktop-ui/messages/nl.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Nieuwe omgeving",
       "variablesHeading": "{name} variabelen",
       "addVariable": "Variabele toevoegen",
+      "exportPostman": "Exporteren (Postman-omgeving)",
       "columnVariable": "Variabele",
       "columnValue": "Waarde",
       "placeholderKey": "Sleutel",
diff --git a/apps/desktop-ui/messages/pl.json b/apps/desktop-ui/messages/pl.json
index 1d2b9d28..314ab030 100644
--- a/apps/desktop-ui/messages/pl.json
+++ b/apps/desktop-ui/messages/pl.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "New environment",
       "variablesHeading": "{name} variables",
       "addVariable": "Add variable",
+      "exportPostman": "Eksportuj (środowisko Postman)",
       "columnVariable": "Variable",
       "columnValue": "Value",
       "placeholderKey": "Key",
diff --git a/apps/desktop-ui/messages/pt-BR.json b/apps/desktop-ui/messages/pt-BR.json
index a5354f43..b43499e2 100644
--- a/apps/desktop-ui/messages/pt-BR.json
+++ b/apps/desktop-ui/messages/pt-BR.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Novo ambiente",
       "variablesHeading": "Variáveis de {name}",
       "addVariable": "Adicionar variável",
+      "exportPostman": "Exportar (ambiente Postman)",
       "columnVariable": "Variável",
       "columnValue": "Valor",
       "placeholderKey": "Chave",
diff --git a/apps/desktop-ui/messages/pt.json b/apps/desktop-ui/messages/pt.json
index 632262f5..4719463c 100644
--- a/apps/desktop-ui/messages/pt.json
+++ b/apps/desktop-ui/messages/pt.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Novo ambiente",
       "variablesHeading": "Variáveis de {name}",
       "addVariable": "Adicionar variável",
+      "exportPostman": "Exportar (ambiente Postman)",
       "columnVariable": "Variável",
       "columnValue": "Valor",
       "placeholderKey": "Chave",
diff --git a/apps/desktop-ui/messages/ru.json b/apps/desktop-ui/messages/ru.json
index 781d896a..faf1dfee 100644
--- a/apps/desktop-ui/messages/ru.json
+++ b/apps/desktop-ui/messages/ru.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Новое окружение",
       "variablesHeading": "Переменные {name}",
       "addVariable": "Добавить переменную",
+      "exportPostman": "Экспорт (окружение Postman)",
       "columnVariable": "Переменная",
       "columnValue": "Значение",
       "placeholderKey": "Ключ",
diff --git a/apps/desktop-ui/messages/sv.json b/apps/desktop-ui/messages/sv.json
index eec6bd4c..ba7cb0ec 100644
--- a/apps/desktop-ui/messages/sv.json
+++ b/apps/desktop-ui/messages/sv.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "Ny miljö",
       "variablesHeading": "{name}-variabler",
       "addVariable": "Lägg till variabel",
+      "exportPostman": "Exportera (Postman-miljö)",
       "columnVariable": "Variabel",
       "columnValue": "Värde",
       "placeholderKey": "Nyckel",
diff --git a/apps/desktop-ui/messages/tr.json b/apps/desktop-ui/messages/tr.json
index f04625ff..91ce80ee 100644
--- a/apps/desktop-ui/messages/tr.json
+++ b/apps/desktop-ui/messages/tr.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "Yeni ortam",
       "variablesHeading": "{name} değişkenleri",
       "addVariable": "Değişken ekle",
+      "exportPostman": "Dışa aktar (Postman ortamı)",
       "columnVariable": "Değişken",
       "columnValue": "Değer",
       "placeholderKey": "Anahtar",
diff --git a/apps/desktop-ui/messages/uk.json b/apps/desktop-ui/messages/uk.json
index 298cf54d..b820fef0 100644
--- a/apps/desktop-ui/messages/uk.json
+++ b/apps/desktop-ui/messages/uk.json
@@ -2394,6 +2394,7 @@
       "placeholderNewEnv": "Нове середовище",
       "variablesHeading": "Змінні {name}",
       "addVariable": "Додати змінну",
+      "exportPostman": "Експорт (середовище Postman)",
       "columnVariable": "Змінна",
       "columnValue": "Значення",
       "placeholderKey": "Ключ",
diff --git a/apps/desktop-ui/messages/vi.json b/apps/desktop-ui/messages/vi.json
index 1a533fa3..047503e4 100644
--- a/apps/desktop-ui/messages/vi.json
+++ b/apps/desktop-ui/messages/vi.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "Môi trường mới",
       "variablesHeading": "Biến {name}",
       "addVariable": "Thêm biến",
+      "exportPostman": "Xuất (môi trường Postman)",
       "columnVariable": "Biến",
       "columnValue": "Giá trị",
       "placeholderKey": "Khóa",
diff --git a/apps/desktop-ui/messages/zh.json b/apps/desktop-ui/messages/zh.json
index 3f0ab326..73852b8e 100644
--- a/apps/desktop-ui/messages/zh.json
+++ b/apps/desktop-ui/messages/zh.json
@@ -2383,6 +2383,7 @@
       "placeholderNewEnv": "新环境",
       "variablesHeading": "{name} 变量",
       "addVariable": "添加变量",
+      "exportPostman": "导出（Postman 环境）",
       "columnVariable": "变量",
       "columnValue": "值",
       "placeholderKey": "键",
diff --git a/apps/desktop-ui/src/components/api-client/environment-manager.tsx b/apps/desktop-ui/src/components/api-client/environment-manager.tsx
index c85b15b6..448b35c5 100644
--- a/apps/desktop-ui/src/components/api-client/environment-manager.tsx
+++ b/apps/desktop-ui/src/components/api-client/environment-manager.tsx
@@ -10,8 +10,9 @@ import {
     DialogTitle,
 } from "@/components/ui/dialog"
 import { ScrollArea } from "@/components/ui/scroll-area"
-import { IconPlus, IconTrash, IconEdit } from "@tabler/icons-react"
+import { IconPlus, IconTrash, IconEdit, IconDownload } from "@tabler/icons-react"
 import { EnvironmentVariable } from "./use-environments"
+import { downloadEnvironmentAsPostman } from "@/lib/export/postman-env"
 import { useTranslations } from "next-intl"
 import { useEnvironmentsState, useEnvironmentsActions } from "./context/environments-context"
 
@@ -140,6 +141,18 @@ export function EnvironmentManager({ open, onOpenChange }: EnvironmentManagerPro
                                                     >
                                                         <IconEdit className="h-3 w-3" />
                                                     </Button>
+                                                    <Button
+                                                        variant="ghost"
+                                                        size="icon"
+                                                        className="h-6 w-6"
+                                                        title={t("exportPostman")}
+                                                        onClick={(e) => {
+                                                            e.stopPropagation()
+                                                            downloadEnvironmentAsPostman(env)
+                                                        }}
+                                                    >
+                                                        <IconDownload className="h-3 w-3" />
+                                                    </Button>
                                                     <Button
                                                         variant="ghost"
                                                         size="icon"
diff --git a/apps/desktop-ui/src/components/api-client/import-dialog.tsx b/apps/desktop-ui/src/components/api-client/import-dialog.tsx
index 45fbe6a9..84c7a06f 100644
--- a/apps/desktop-ui/src/components/api-client/import-dialog.tsx
+++ b/apps/desktop-ui/src/components/api-client/import-dialog.tsx
@@ -15,6 +15,7 @@ import { detectImportFormat, type ImportFormat } from "@/lib/import/detect"
 import { importPostmanCollectionWithMeta } from "@/lib/import/postman"
 import { importHar } from "@/lib/import/har"
 import { importOpenApiSpec } from "@/lib/import/openapi"
+import { importPostmanEnvironment } from "@/lib/import/postman-env"
 import { generateMockExamplesFromOpenApi } from "@/lib/mocks/openapi-mock-gen"
 import { useCollectionsActions } from "./context/collections-context"
 import { useEnvironmentsActions } from "./context/environments-context"
@@ -27,6 +28,7 @@ interface ImportDialogProps {
 
 const FORMAT_LABEL: Record<ImportFormat, string> = {
     postman: "Postman Collection v2.1",
+    "postman-env": "Postman Environment",
     har: "HAR (HTTP Archive)",
     openapi: "OpenAPI 3.x / Swagger 2.0",
     curl: "cURL command — use the cURL importer instead",
@@ -40,7 +42,7 @@ export function ImportDialog({ open, onOpenChange }: ImportDialogProps) {
     const [busy, setBusy] = React.useState(false)
 
     const detected: ImportFormat = React.useMemo(() => detectImportFormat(text), [text])
-    const canImport = detected === "postman" || detected === "har" || detected === "openapi"
+    const canImport = detected === "postman" || detected === "postman-env" || detected === "har" || detected === "openapi"
 
     const handleFile = async (file: File | null) => {
         if (!file) return
@@ -52,6 +54,15 @@ export function ImportDialog({ open, onOpenChange }: ImportDialogProps) {
         if (!canImport) return
         setBusy(true)
         try {
+            if (detected === "postman-env") {
+                const env = importPostmanEnvironment(text)
+                const envId = await addEnvironment(env.name)
+                if (envId) await updateEnvironment(envId, { variables: env.variables })
+                toast.success(`Imported environment "${env.name}" (${env.variables.length} variables)`)
+                onOpenChange(false)
+                setText("")
+                return
+            }
             let postmanVariables: Array<{ key: string; value: string }> = []
             let collection
             if (detected === "postman") {
@@ -100,7 +111,7 @@ export function ImportDialog({ open, onOpenChange }: ImportDialogProps) {
                 <DialogHeader>
                     <DialogTitle>Import collection</DialogTitle>
                     <DialogDescription>
-                        Paste a Postman v2.1 collection or HAR file, or pick one from disk.
+                        Paste a Postman collection or environment, OpenAPI spec or HAR file, or pick one from disk.
                         Format is auto-detected.
                     </DialogDescription>
                 </DialogHeader>
diff --git a/apps/desktop-ui/src/lib/__tests__/postman-env-roundtrip.test.ts b/apps/desktop-ui/src/lib/__tests__/postman-env-roundtrip.test.ts
new file mode 100644
index 00000000..797155c9
--- /dev/null
+++ b/apps/desktop-ui/src/lib/__tests__/postman-env-roundtrip.test.ts
@@ -0,0 +1,32 @@
+import { exportPostmanEnvironment } from "../export/postman-env"
+import { importPostmanEnvironment, looksLikePostmanEnvironment } from "../import/postman-env"
+import { detectImportFormat } from "../import/detect"
+
+const env = {
+    id: "env-1",
+    name: "Prod",
+    variables: [
+        { id: "a", key: "host", value: "https://api.example.com", enabled: true },
+        { id: "b", key: "token", value: "{{vault.prod}}", enabled: false },
+        { id: "c", key: "", value: "ignored", enabled: true },
+    ],
+}
+
+describe("postman environment export/import round-trip", () => {
+    it("exports values and re-imports them with enabled flags intact", () => {
+        const json = exportPostmanEnvironment(env)
+        expect(looksLikePostmanEnvironment(json)).toBe(true)
+        expect(detectImportFormat(json)).toBe("postman-env")
+        const back = importPostmanEnvironment(json)
+        expect(back.name).toBe("Prod")
+        expect(back.variables.map((v) => [v.key, v.value, v.enabled])).toEqual([
+            ["host", "https://api.example.com", true],
+            ["token", "{{vault.prod}}", false],
+        ])
+    })
+
+    it("does not mistake a Postman collection for an environment", () => {
+        const collection = JSON.stringify({ info: { schema: "https://schema.getpostman.com/x" }, item: [] })
+        expect(detectImportFormat(collection)).toBe("postman")
+    })
+})
diff --git a/apps/desktop-ui/src/lib/export/postman-env.ts b/apps/desktop-ui/src/lib/export/postman-env.ts
new file mode 100644
index 00000000..3bdc0b55
--- /dev/null
+++ b/apps/desktop-ui/src/lib/export/postman-env.ts
@@ -0,0 +1,35 @@
+/**
+ * Postman Environment v2 export — mirror of `lib/import/postman-env.ts`.
+ */
+
+import type { Environment } from "@/components/api-client/use-environments"
+
+export function exportPostmanEnvironment(env: Environment): string {
+    return JSON.stringify(
+        {
+            id: env.id,
+            name: env.name,
+            values: env.variables
+                .filter((v) => v.key)
+                .map((v) => ({ key: v.key, value: v.value, enabled: v.enabled, type: "default" })),
+            _postman_variable_scope: "environment",
+            _postman_exported_at: new Date().toISOString(),
+        },
+        null,
+        2,
+    )
+}
+
+/** Trigger a browser download of the JSON. */
+export function downloadEnvironmentAsPostman(env: Environment): void {
+    if (typeof window === "undefined") return
+    const blob = new Blob([exportPostmanEnvironment(env)], { type: "application/json" })
+    const url = URL.createObjectURL(blob)
+    const a = document.createElement("a")
+    a.href = url
+    a.download = `${env.name.replace(/[^a-zA-Z0-9-_]+/g, "_") || "environment"}.postman_environment.json`
+    document.body.appendChild(a)
+    a.click()
+    document.body.removeChild(a)
+    URL.revokeObjectURL(url)
+}
diff --git a/apps/desktop-ui/src/lib/import/detect.ts b/apps/desktop-ui/src/lib/import/detect.ts
index 6359377c..c58e1cc7 100644
--- a/apps/desktop-ui/src/lib/import/detect.ts
+++ b/apps/desktop-ui/src/lib/import/detect.ts
@@ -1,4 +1,4 @@
-export type ImportFormat = "postman" | "har" | "openapi" | "curl" | "unknown"
+export type ImportFormat = "postman" | "postman-env" | "har" | "openapi" | "curl" | "unknown"
 
 interface ParsedRoot {
     info?: { schema?: string }
@@ -6,6 +6,7 @@ interface ParsedRoot {
     log?: { entries?: unknown }
     openapi?: string
     swagger?: string
+    values?: unknown
 }
 
 /**
@@ -23,6 +24,9 @@ export function detectImportFormat(raw: string): ImportFormat {
             const data = JSON.parse(t) as ParsedRoot
             if (data?.info?.schema?.includes("schema.getpostman.com")) return "postman"
             if (data?.info && Array.isArray(data.item)) return "postman"
+            // Postman environment: `{ name, values: [{ key, value }] }`, no `info`.
+            if (!data?.info && Array.isArray(data?.values) &&
+                data.values.every((v) => !!v && typeof v === "object" && "key" in (v as object))) return "postman-env"
             if (data?.log && data.log.entries !== undefined) return "har"
             if (typeof data?.openapi === "string") return "openapi"
             if (typeof data?.swagger === "string") return "openapi"

From 45f00cad99fe398fd550995a02c7611fc1f5f063 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sat, 22 Aug 2026 20:17:11 +0530
Subject: [PATCH 08/39] chore(api-client): open-folder button in empty state;
 drop stale Log in palette entry

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../api-client/collections/collections-sidebar.tsx | 14 +++++++++++---
 .../src/components/global-command-palette.tsx      |  8 ++------
 apps/desktop-ui/src/components/palette-entries.ts  |  9 +--------
 3 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
index cc93929a..f94fddb2 100644
--- a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
+++ b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
@@ -349,9 +349,17 @@ export function CollectionsSidebar({ onLoadRequest: loadRequest }: CollectionsSi
                                     <p className="text-xs text-muted-foreground mt-1 mb-4">
                                         {t("noCollectionsHint")}
                                     </p>
-                                    <Button size="sm" onClick={() => setNewCollectionDialogOpen(true)}>
-                                        {t("createCollection")}
-                                    </Button>
+                                    <div className="flex flex-col gap-2">
+                                        <Button size="sm" onClick={() => setNewCollectionDialogOpen(true)}>
+                                            {t("createCollection")}
+                                        </Button>
+                                        {desktop && (
+                                            <Button size="sm" variant="outline" onClick={() => void openFolderCollection()}>
+                                                <FolderGit2 className="h-3.5 w-3.5 mr-2" />
+                                                {t("openFolderCollection")}
+                                            </Button>
+                                        )}
+                                    </div>
                                 </div>
                             ) : (
                                 collectionsForActiveWs.map((collection) => (
diff --git a/apps/desktop-ui/src/components/global-command-palette.tsx b/apps/desktop-ui/src/components/global-command-palette.tsx
index 30293548..0c8fde1c 100644
--- a/apps/desktop-ui/src/components/global-command-palette.tsx
+++ b/apps/desktop-ui/src/components/global-command-palette.tsx
@@ -30,13 +30,9 @@ export function GlobalCommandPalette() {
   const { user } = useAuth(false)
   const pinnedTools = usePinnedToolsForActiveWorkspace()
 
-  const isLoggedIn = !!user
   const entries = React.useMemo((): PaletteEntry[] => {
-    const site = STATIC_ENTRIES_WITH_SEARCH.filter(
-      (s) => s.url !== '/login' || !isLoggedIn
-    )
-    return [...site, ...getToolEntries()]
-  }, [isLoggedIn])
+    return [...STATIC_ENTRIES_WITH_SEARCH, ...getToolEntries()]
+  }, [])
 
   const pinnedEntries = React.useMemo(() => {
     const urlSet = new Set(pinnedTools)
diff --git a/apps/desktop-ui/src/components/palette-entries.ts b/apps/desktop-ui/src/components/palette-entries.ts
index 8b36273c..1dfee59c 100644
--- a/apps/desktop-ui/src/components/palette-entries.ts
+++ b/apps/desktop-ui/src/components/palette-entries.ts
@@ -1,5 +1,5 @@
 import type React from 'react'
-import { HelpCircle, Home, LayoutDashboard, LogIn, Settings } from 'lucide-react'
+import { HelpCircle, Home, LayoutDashboard, Settings } from 'lucide-react'
 import { sidebarData } from '@/components/sidebar/data/sidebar-data'
 import { getAllToolsMetadata } from '@/lib/tools-registry'
 
@@ -44,13 +44,6 @@ const STATIC_ENTRIES: Omit<PaletteEntry, 'searchValue'>[] = [
     category: 'Site',
     Icon: HelpCircle,
   },
-  {
-    title: 'Log in',
-    url: '/login',
-    description: 'Sign in to your account',
-    category: 'Site',
-    Icon: LogIn,
-  },
 ]
 
 function buildSidebarIconMap(): Map<string, React.ElementType> {

From ab1b1d6b515e7e6e46008b92a1a73d0474aa9aa5 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sat, 22 Aug 2026 20:17:11 +0530
Subject: [PATCH 09/39] feat(api-client): import Insomnia and Bruno collections
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two importers for the switcher path, both pure libs with tests:

- Insomnia (`lib/import/insomnia.ts`): v4 JSON resources and v5 YAML, nested
  groups, every body/auth type we support, `{{ _.VAR }}` → `{{VAR}}`,
  pre-request/after-response scripts, environments. Round-trips our own
  Insomnia v4 exporter.
- Bruno (`lib/import/bruno.ts`): the legacy `.bru` language and v4
  OpenCollection YAML. Folder trees with `folder.bru` defaults, `seq`
  ordering, `~key` disabled rows, json/text/xml/form/multipart (`@file(...)`)
  /graphql bodies, basic/bearer/apikey/oauth2 auth, scripts, and
  `environments/*` (secret var names come in with empty values).

Detection covers both, and the import dialog now creates the environments an
import brings with it instead of dropping them. 22 new tests.

Still folder-only from a paste of a single file: picking a whole Bruno
directory needs a desktop folder-read pass (readCollectionFiles is .yaml-only).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../components/api-client/import-dialog.tsx   |  29 +-
 .../src/lib/__tests__/import-export.test.ts   |   9 +
 .../src/lib/import/__tests__/bruno.test.ts    | 277 ++++++++++
 .../src/lib/import/__tests__/insomnia.test.ts | 404 +++++++++++++++
 apps/desktop-ui/src/lib/import/bruno.ts       | 472 ++++++++++++++++++
 apps/desktop-ui/src/lib/import/detect.ts      |  11 +-
 apps/desktop-ui/src/lib/import/insomnia.ts    | 300 +++++++++++
 7 files changed, 1497 insertions(+), 5 deletions(-)
 create mode 100644 apps/desktop-ui/src/lib/import/__tests__/bruno.test.ts
 create mode 100644 apps/desktop-ui/src/lib/import/__tests__/insomnia.test.ts
 create mode 100644 apps/desktop-ui/src/lib/import/bruno.ts
 create mode 100644 apps/desktop-ui/src/lib/import/insomnia.ts

diff --git a/apps/desktop-ui/src/components/api-client/import-dialog.tsx b/apps/desktop-ui/src/components/api-client/import-dialog.tsx
index 84c7a06f..74d3553b 100644
--- a/apps/desktop-ui/src/components/api-client/import-dialog.tsx
+++ b/apps/desktop-ui/src/components/api-client/import-dialog.tsx
@@ -16,9 +16,12 @@ import { importPostmanCollectionWithMeta } from "@/lib/import/postman"
 import { importHar } from "@/lib/import/har"
 import { importOpenApiSpec } from "@/lib/import/openapi"
 import { importPostmanEnvironment } from "@/lib/import/postman-env"
+import { importInsomniaWithMeta } from "@/lib/import/insomnia"
+import { importBrunoFolder } from "@/lib/import/bruno"
 import { generateMockExamplesFromOpenApi } from "@/lib/mocks/openapi-mock-gen"
 import { useCollectionsActions } from "./context/collections-context"
 import { useEnvironmentsActions } from "./context/environments-context"
+import type { EnvironmentVariable } from "./use-environments"
 import { toast } from "sonner"
 
 interface ImportDialogProps {
@@ -31,6 +34,8 @@ const FORMAT_LABEL: Record<ImportFormat, string> = {
     "postman-env": "Postman Environment",
     har: "HAR (HTTP Archive)",
     openapi: "OpenAPI 3.x / Swagger 2.0",
+    insomnia: "Insomnia export (v4 / v5)",
+    bruno: "Bruno request (.bru / OpenCollection YAML)",
     curl: "cURL command — use the cURL importer instead",
     unknown: "Unknown / unsupported format",
 }
@@ -42,7 +47,7 @@ export function ImportDialog({ open, onOpenChange }: ImportDialogProps) {
     const [busy, setBusy] = React.useState(false)
 
     const detected: ImportFormat = React.useMemo(() => detectImportFormat(text), [text])
-    const canImport = detected === "postman" || detected === "postman-env" || detected === "har" || detected === "openapi"
+    const canImport = detected !== "curl" && detected !== "unknown"
 
     const handleFile = async (file: File | null) => {
         if (!file) return
@@ -64,11 +69,23 @@ export function ImportDialog({ open, onOpenChange }: ImportDialogProps) {
                 return
             }
             let postmanVariables: Array<{ key: string; value: string }> = []
+            // Insomnia and Bruno carry their own environments alongside the tree.
+            let importedEnvironments: Array<{ name: string; variables: EnvironmentVariable[] }> = []
             let collection
             if (detected === "postman") {
                 const result = importPostmanCollectionWithMeta(text)
                 collection = result.collection
                 postmanVariables = result.variables
+            } else if (detected === "insomnia") {
+                const result = importInsomniaWithMeta(text)
+                collection = result.collection
+                importedEnvironments = result.environments
+            } else if (detected === "bruno") {
+                // Pasting one .bru/.yml file — the folder importer handles a
+                // single-entry list and names the collection after the request.
+                const result = importBrunoFolder([{ path: "request.bru", text }])
+                collection = result.collection
+                importedEnvironments = result.environments
             } else {
                 collection = detected === "har" ? importHar(text) : importOpenApiSpec(text)
             }
@@ -95,6 +112,10 @@ export function ImportDialog({ open, onOpenChange }: ImportDialogProps) {
                         })
                     }
                 }
+                for (const env of importedEnvironments) {
+                    const envId = await addEnvironment(env.name)
+                    if (envId) await updateEnvironment(envId, { variables: env.variables })
+                }
                 onOpenChange(false)
                 setText("")
             }
@@ -111,8 +132,8 @@ export function ImportDialog({ open, onOpenChange }: ImportDialogProps) {
                 <DialogHeader>
                     <DialogTitle>Import collection</DialogTitle>
                     <DialogDescription>
-                        Paste a Postman collection or environment, OpenAPI spec or HAR file, or pick one from disk.
-                        Format is auto-detected.
+                        Paste a Postman, Insomnia or Bruno export, an OpenAPI spec or a HAR file,
+                        or pick one from disk. Format is auto-detected.
                     </DialogDescription>
                 </DialogHeader>
 
@@ -121,7 +142,7 @@ export function ImportDialog({ open, onOpenChange }: ImportDialogProps) {
                         <label className="inline-flex">
                             <input
                                 type="file"
-                                accept=".json,.har,.yaml,.yml,application/json,application/x-yaml,text/yaml"
+                                accept=".json,.har,.yaml,.yml,.bru,application/json,application/x-yaml,text/yaml"
                                 className="hidden"
                                 onChange={(e) => void handleFile(e.target.files?.[0] ?? null)}
                             />
diff --git a/apps/desktop-ui/src/lib/__tests__/import-export.test.ts b/apps/desktop-ui/src/lib/__tests__/import-export.test.ts
index ff7d1ee6..308fcbc0 100644
--- a/apps/desktop-ui/src/lib/__tests__/import-export.test.ts
+++ b/apps/desktop-ui/src/lib/__tests__/import-export.test.ts
@@ -31,6 +31,15 @@ describe("detectImportFormat", () => {
     it("detects cURL", () => {
         expect(detectImportFormat("curl https://example.com")).toBe("curl")
     })
+    it("detects Insomnia v4 JSON and v5 YAML", () => {
+        expect(detectImportFormat(JSON.stringify({ _type: "export", __export_format: 4, resources: [] })))
+            .toBe("insomnia")
+        expect(detectImportFormat("type: collection.insomnia.rest/5.0\nname: X\n")).toBe("insomnia")
+    })
+    it("detects Bruno .bru and OpenCollection YAML", () => {
+        expect(detectImportFormat("meta {\n  name: Ping\n}\n\nget {\n  url: https://x/y\n}\n")).toBe("bruno")
+        expect(detectImportFormat("info:\n  name: X\nhttp:\n  method: GET\n  url: https://x/y\n")).toBe("bruno")
+    })
     it("returns unknown on garbage", () => {
         expect(detectImportFormat("{not json")).toBe("unknown")
         expect(detectImportFormat("")).toBe("unknown")
diff --git a/apps/desktop-ui/src/lib/import/__tests__/bruno.test.ts b/apps/desktop-ui/src/lib/import/__tests__/bruno.test.ts
new file mode 100644
index 00000000..a96cdac5
--- /dev/null
+++ b/apps/desktop-ui/src/lib/import/__tests__/bruno.test.ts
@@ -0,0 +1,277 @@
+import {
+    looksLikeBrunoBru,
+    looksLikeOpenCollectionYaml,
+    parseBruRequest,
+    parseBrunoEnvironment,
+    parseOpenCollectionRequestYaml,
+    importBrunoFolder,
+} from "../bruno"
+import type { KeyValueItem } from "@/components/api-client/types"
+
+const kv = (items: KeyValueItem[] | undefined) =>
+    (items ?? []).map((i) => [i.key, i.value, i.active] as const)
+
+// ── fixtures ────────────────────────────────────────────────────────────────
+
+const createUser = `meta {
+  name: Create user
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{base_url}}/users?dry=1
+  body: json
+  auth: bearer
+}
+
+params:query {
+  dry: 1
+  ~verbose: true
+}
+
+headers {
+  Content-Type: application/json
+  ~X-Debug: 1
+}
+
+auth:bearer {
+  token: {{token}}
+}
+
+body:json {
+  {
+    "name": "Ada"
+  }
+}
+
+script:pre-request {
+  bru.setVar("t", Date.now())
+}
+
+tests {
+  test("created", function() {
+    expect(res.getStatus()).to.equal(201)
+  })
+}
+`
+
+const listUsers = `meta {
+  name: List users
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{base_url}}/users
+}
+`
+
+const graphqlReq = `meta {
+  name: Search
+  type: graphql
+  seq: 1
+}
+
+post {
+  url: {{base_url}}/graphql
+  body: graphql
+}
+
+body:graphql {
+  query Search($q: String) { search(q: $q) { id } }
+}
+
+body:graphql:vars {
+  { "q": "ada" }
+}
+`
+
+const uploadReq = `meta {
+  name: Upload
+  seq: 2
+}
+
+post {
+  url: {{base_url}}/upload
+  body: multipartForm
+  auth: oauth2
+}
+
+body:multipart-form {
+  avatar: @file(/tmp/a.png)
+  caption: hello
+}
+
+auth:oauth2 {
+  grant_type: client_credentials
+  access_token_url: https://id.example.com/token
+  client_id: cid
+  client_secret: shh
+  scope: read write
+}
+`
+
+const folderBru = `meta {
+  name: Users API
+  seq: 1
+}
+
+headers {
+  Accept: application/json
+}
+`
+
+const envBru = `vars {
+  base_url: https://api.example.com
+  ~staging_only: 1
+}
+
+vars:secret [
+  token
+]
+`
+
+const ocRequest = `info:
+  name: OC ping
+  type: http
+  seq: 1
+http:
+  method: GET
+  url: "{{base_url}}/ping"
+  headers:
+    - name: Accept
+      value: application/json
+    - name: X-Off
+      value: "1"
+      disabled: true
+  auth:
+    type: bearer
+    token: "{{token}}"
+`
+
+// ── tests ───────────────────────────────────────────────────────────────────
+
+describe("bruno .bru detection", () => {
+    it("recognises .bru files and rejects other text", () => {
+        expect(looksLikeBrunoBru(createUser)).toBe(true)
+        expect(looksLikeBrunoBru(folderBru)).toBe(true)
+        expect(looksLikeBrunoBru('{"info":{"name":"x"},"item":[]}')).toBe(false)
+    })
+})
+
+describe("parseBruRequest", () => {
+    it("maps method, url, params, headers, json body, bearer auth and scripts", () => {
+        const r = parseBruRequest(createUser)
+        expect(r.name).toBe("Create user")
+        expect(r.method).toBe("POST")
+        expect(r.url).toBe("{{base_url}}/users?dry=1")
+        expect(kv(r.params)).toEqual([["dry", "1", true], ["verbose", "true", false]])
+        expect(kv(r.headers)).toEqual([
+            ["Content-Type", "application/json", true],
+            ["X-Debug", "1", false],
+        ])
+        expect(r.body.type).toBe("json")
+        expect(JSON.parse(r.body.content)).toEqual({ name: "Ada" })
+        expect(r.auth).toEqual({ type: "bearer", token: "{{token}}" })
+        expect(r.preRequestScript).toContain('bru.setVar("t"')
+        expect(r.testScript).toContain('test("created"')
+    })
+
+    it("maps a graphql body with variables", () => {
+        const r = parseBruRequest(graphqlReq)
+        expect(r.body.type).toBe("graphql")
+        expect(r.body.content).toContain("query Search")
+        expect(JSON.parse(r.body.graphqlVariables ?? "{}")).toEqual({ q: "ada" })
+    })
+
+    it("maps multipart @file entries and oauth2 client_credentials", () => {
+        const r = parseBruRequest(uploadReq)
+        expect(r.body.type).toBe("form-data")
+        const [avatar, caption] = r.body.formData ?? []
+        expect(avatar).toMatchObject({ key: "avatar", valueType: "file", fileName: "/tmp/a.png" })
+        expect(caption).toMatchObject({ key: "caption", value: "hello", valueType: "text" })
+        expect(r.auth).toMatchObject({
+            type: "oauth2",
+            oauth2: {
+                grantType: "client_credentials",
+                tokenUrl: "https://id.example.com/token",
+                clientId: "cid",
+                clientSecret: "shh",
+                scope: "read write",
+            },
+        })
+    })
+})
+
+describe("parseBrunoEnvironment", () => {
+    it("reads vars, disabled vars and secret names (values blank)", () => {
+        const env = parseBrunoEnvironment(envBru, "prod")
+        expect(env.name).toBe("prod")
+        expect(env.variables.map((v) => [v.key, v.value, v.enabled])).toEqual([
+            ["base_url", "https://api.example.com", true],
+            ["staging_only", "1", false],
+            ["token", "", true],
+        ])
+    })
+})
+
+describe("OpenCollection YAML", () => {
+    it("detects and parses a request.yml", () => {
+        expect(looksLikeOpenCollectionYaml(ocRequest)).toBe(true)
+        const r = parseOpenCollectionRequestYaml(ocRequest)
+        expect(r.name).toBe("OC ping")
+        expect(r.method).toBe("GET")
+        expect(r.url).toBe("{{base_url}}/ping")
+        expect(kv(r.headers)).toEqual([
+            ["Accept", "application/json", true],
+            ["X-Off", "1", false],
+        ])
+        expect(r.auth).toEqual({ type: "bearer", token: "{{token}}" })
+    })
+})
+
+describe("importBrunoFolder", () => {
+    const files = [
+        { path: "bruno.json", text: JSON.stringify({ version: "1", name: "Pet Store", type: "collection" }) },
+        { path: "users/folder.bru", text: folderBru },
+        { path: "users/create-user.bru", text: createUser },
+        { path: "users/list-users.bru", text: listUsers },
+        { path: "environments/prod.bru", text: envBru },
+        { path: "README.md", text: "ignored" },
+    ]
+
+    it("builds the collection tree, honours seq order and reads environments", () => {
+        const { collection, environments } = importBrunoFolder(files)
+        expect(collection.name).toBe("Pet Store")
+        expect(collection.items).toHaveLength(1)
+
+        const folder = collection.items[0]
+        expect(folder).toMatchObject({ type: "folder", name: "Users API" })
+        if (!("type" in folder) || folder.type !== "folder") throw new Error("expected a folder")
+        expect(kv(folder.defaultHeaders)).toEqual([["Accept", "application/json", true]])
+        // seq 1 before seq 2, not file order
+        expect(folder.items.map((i) => i.name)).toEqual(["List users", "Create user"])
+
+        expect(environments).toHaveLength(1)
+        expect(environments[0].name).toBe("prod")
+        expect(environments[0].variables[0]).toMatchObject({ key: "base_url" })
+    })
+
+    it("tolerates a wrapping directory (zip-style) and windows separators", () => {
+        const wrapped = files.map((f) => ({ ...f, path: `Pet Store\\${f.path.replace(/\//g, "\\")}` }))
+        const { collection, environments } = importBrunoFolder(wrapped)
+        expect(collection.name).toBe("Pet Store")
+        expect(collection.items).toHaveLength(1)
+        expect(environments).toHaveLength(1)
+    })
+
+    it("mixes OpenCollection YAML requests into the same tree", () => {
+        const { collection } = importBrunoFolder([
+            { path: "opencollection.yml", text: "info:\n  name: OC Store\n" },
+            { path: "ping.yml", text: ocRequest },
+        ])
+        expect(collection.name).toBe("OC Store")
+        expect(collection.items.map((i) => i.name)).toEqual(["OC ping"])
+    })
+})
diff --git a/apps/desktop-ui/src/lib/import/__tests__/insomnia.test.ts b/apps/desktop-ui/src/lib/import/__tests__/insomnia.test.ts
new file mode 100644
index 00000000..30c11356
--- /dev/null
+++ b/apps/desktop-ui/src/lib/import/__tests__/insomnia.test.ts
@@ -0,0 +1,404 @@
+import { exportCollectionAsInsomnia } from "../../export/insomnia"
+import { importInsomniaWithMeta, looksLikeInsomniaExport } from "../insomnia"
+import type { Collection, CollectionFolder, CollectionRequest, KeyValueItem } from "@/components/api-client/types"
+
+// ── v4 JSON fixture ──────────────────────────────────────────────────────────
+
+const v4 = {
+    _type: "export",
+    __export_format: 4,
+    __export_source: "insomnia.desktop.app:v2023.5.8",
+    resources: [
+        { _id: "wrk_1", _type: "workspace", name: "Pet Store", scope: "collection", parentId: null },
+        {
+            _id: "env_base", _type: "environment", parentId: "wrk_1", name: "Base Environment", metaSortKey: 1,
+            data: { base_url: "https://api.example.com", auth: { token: "abc", nested: { deep: 1 } }, flag: true, list: [1, 2], ref: "{{ _.base_url }}/v1" },
+        },
+        { _id: "env_prod", _type: "environment", parentId: "env_base", name: "Production", metaSortKey: 2, data: { base_url: "https://prod.example.com" } },
+        { _id: "env_empty", _type: "environment", parentId: "env_base", name: "Empty", data: {} },
+        { _id: "jar_1", _type: "cookie_jar", parentId: "wrk_1", name: "Default Jar", cookies: [] },
+        { _id: "fld_users", _type: "request_group", parentId: "wrk_1", name: "Users", metaSortKey: -200, preRequestScript: "insomnia.environment.set('x', 1)" },
+        { _id: "fld_admin", _type: "request_group", parentId: "fld_users", name: "Admin", metaSortKey: -100, environment: { ignored: true } },
+        {
+            _id: "req_list", _type: "request", parentId: "fld_users", name: "List users", method: "get", metaSortKey: -300,
+            url: "{{ _.base_url }}/users",
+            parameters: [{ name: "page", value: "1" }, { name: "debug", value: "true", disabled: true }],
+            headers: [{ name: "Accept", value: "application/json" }, { name: "X-Off", value: "1", disabled: true }],
+            body: {},
+            authentication: { type: "bearer", token: "{{ _.auth.token }}", prefix: "Bearer" },
+            preRequestScript: "insomnia.request.addHeader({ name: 'a', value: 'b' })",
+            afterResponseScript: "insomnia.test('ok', () => {})",
+        },
+        {
+            _id: "req_create", _type: "request", parentId: "fld_users", name: "Create user", method: "POST", metaSortKey: -200,
+            url: "{{ base_url }}/users",
+            body: { mimeType: "application/json", text: '{"name":"{{ _.name }}"}' },
+            authentication: { type: "basic", username: "u", password: "p" },
+        },
+        {
+            _id: "req_ban", _type: "request", parentId: "fld_admin", name: "Ban", method: "DELETE",
+            url: "{{ _.base_url }}/users/1",
+            body: { mimeType: "text/plain", text: "bye" },
+            authentication: { type: "apikey", key: "X-Api-Key", value: "k", addTo: "header" },
+        },
+        {
+            _id: "req_xml", _type: "request", parentId: "wrk_1", name: "XML", method: "PUT", metaSortKey: 10,
+            url: "https://x/xml",
+            body: { mimeType: "application/xml", text: "<a/>" },
+            authentication: { type: "apikey", key: "api_key", value: "k", addTo: "queryParams" },
+        },
+        {
+            _id: "req_form", _type: "request", parentId: "wrk_1", name: "Form", method: "POST", metaSortKey: 20,
+            url: "https://x/form",
+            body: { mimeType: "application/x-www-form-urlencoded", params: [{ name: "a", value: "1" }, { name: "b", value: "2", disabled: true }] },
+            authentication: { type: "oauth2", grantType: "client_credentials", accessTokenUrl: "https://x/token", clientId: "cid", clientSecret: "sec", scope: "read" },
+        },
+        {
+            _id: "req_multi", _type: "request", parentId: "wrk_1", name: "Upload", method: "POST", metaSortKey: 30,
+            url: "https://x/upload",
+            body: { mimeType: "multipart/form-data", params: [{ name: "file", type: "file", fileName: "/Users/me/a.png" }, { name: "note", value: "hi" }] },
+            authentication: { type: "oauth2", grantType: "authorization_code", accessTokenUrl: "https://x/token", authorizationUrl: "https://x/auth", clientId: "cid", redirectUrl: "http://localhost/cb" },
+        },
+        {
+            _id: "req_gql", _type: "request", parentId: "wrk_1", name: "GQL", method: "POST", metaSortKey: 40,
+            url: "https://x/graphql",
+            body: { mimeType: "application/graphql", text: JSON.stringify({ query: "query { me { id } }", variables: '{"a":1}' }) },
+            authentication: { type: "basic", disabled: true, username: "u", password: "p" },
+        },
+        { _id: "req_bogus", _type: "request", parentId: "wrk_1", name: "Bogus", method: "PURGE", url: "https://x/", metaSortKey: 50 },
+    ],
+}
+
+// ── v5 YAML fixtures ─────────────────────────────────────────────────────────
+
+const v5 = `
+type: collection.insomnia.rest/5.0
+name: Pet Store v5
+meta:
+  id: wrk_v5
+collection:
+  - name: Users
+    meta:
+      id: fld_1
+      sortKey: -100
+    scripts:
+      preRequest: insomnia.environment.set("folder", 1)
+    children:
+      - url: "{{ _.base_url }}/users"
+        name: List users
+        meta:
+          id: req_1
+          sortKey: -50
+        method: GET
+        parameters:
+          - name: page
+            value: "1"
+          - name: off
+            value: x
+            disabled: true
+        headers:
+          - name: Accept
+            value: application/json
+        authentication:
+          type: apikey
+          key: X-Key
+          value: "{{ _.key }}"
+          addTo: header
+        scripts:
+          preRequest: |-
+            insomnia.request.addHeader({ name: "a", value: "b" })
+          afterResponse: |-
+            insomnia.test("ok", () => {})
+      - url: "{{ _.base_url }}/users"
+        name: Create user
+        meta:
+          id: req_2
+          sortKey: -40
+        method: POST
+        body:
+          mimeType: application/json
+          text: '{"name":"{{ _.name }}"}'
+        authentication:
+          type: bearer
+          token: "{{ _.token }}"
+  - url: https://x/ping
+    name: Ping
+    meta:
+      id: req_3
+      sortKey: 5
+    method: HEAD
+cookieJar:
+  name: Default Jar
+environments:
+  name: Base Environment
+  data:
+    base_url: https://api.example.com
+    key: k1
+  subEnvironments:
+    - name: Staging
+      data:
+        base_url: https://staging.example.com
+`
+
+const v5Env = `
+type: environment.insomnia.rest/5.0
+name: Prod
+data:
+  base_url: https://prod
+  db:
+    host: h
+`
+
+const folders = (items: Collection["items"]) => items as CollectionFolder[]
+const reqs = (items: Collection["items"]) => items as CollectionRequest[]
+const bare = (kv: KeyValueItem[]) => kv.map(({ key, value, active }) => ({ key, value, active }))
+
+describe("looksLikeInsomniaExport", () => {
+    it("detects v4 JSON and v5 YAML", () => {
+        expect(looksLikeInsomniaExport(JSON.stringify(v4))).toBe(true)
+        expect(looksLikeInsomniaExport(v5)).toBe(true)
+        expect(looksLikeInsomniaExport(v5Env)).toBe(true)
+    })
+
+    it("rejects other formats and garbage", () => {
+        expect(looksLikeInsomniaExport(JSON.stringify({ info: { name: "pm" }, item: [] }))).toBe(false)
+        expect(looksLikeInsomniaExport("openapi: 3.0.0\ninfo:\n  title: x")).toBe(false)
+        expect(looksLikeInsomniaExport("{ not json")).toBe(false)
+        expect(looksLikeInsomniaExport("")).toBe(false)
+    })
+})
+
+describe("Insomnia v4 import", () => {
+    const { collection, environments } = importInsomniaWithMeta(JSON.stringify(v4))
+
+    it("uses the workspace name and orders by metaSortKey", () => {
+        expect(collection.name).toBe("Pet Store")
+        expect(collection.items.map((i) => i.name)).toEqual(["Users", "XML", "Form", "Upload", "GQL", "Bogus"])
+    })
+
+    it("nests groups via parentId and keeps group scripts", () => {
+        const users = folders(collection.items)[0]
+        expect(users.type).toBe("folder")
+        expect(users.preRequestScript).toBe("insomnia.environment.set('x', 1)")
+        expect(users.items.map((i) => i.name)).toEqual(["List users", "Create user", "Admin"])
+        const admin = users.items[2] as CollectionFolder
+        expect(admin.type).toBe("folder")
+        expect(admin.items.map((i) => i.name)).toEqual(["Ban"])
+    })
+
+    it("converts params, headers, disabled rows, template tags, and scripts", () => {
+        const list = reqs(folders(collection.items)[0].items)[0]
+        expect(list.method).toBe("GET")
+        expect(list.url).toBe("{{base_url}}/users")
+        expect(bare(list.params)).toEqual([{ key: "page", value: "1", active: true }, { key: "debug", value: "true", active: false }])
+        expect(bare(list.headers)).toEqual([{ key: "Accept", value: "application/json", active: true }, { key: "X-Off", value: "1", active: false }])
+        expect(list.body).toEqual({ type: "none", content: "" })
+        expect(list.auth).toEqual({ type: "bearer", token: "{{auth.token}}" })
+        expect(list.preRequestScript).toBe("insomnia.request.addHeader({ name: 'a', value: 'b' })")
+        expect(list.testScript).toBe("insomnia.test('ok', () => {})")
+        expect(list.params.every((p) => typeof p.id === "string" && p.id.length > 0)).toBe(true)
+    })
+
+    it("converts json / text / xml bodies and basic / apikey auth", () => {
+        const create = reqs(folders(collection.items)[0].items)[1]
+        expect(create.url).toBe("{{base_url}}/users")
+        expect(create.body).toEqual({ type: "json", content: '{"name":"{{name}}"}' })
+        expect(create.auth).toEqual({ type: "basic", username: "u", password: "p" })
+
+        const ban = reqs((folders(collection.items)[0].items[2] as CollectionFolder).items)[0]
+        expect(ban.method).toBe("DELETE")
+        expect(ban.body).toEqual({ type: "text", content: "bye" })
+        expect(ban.auth).toEqual({ type: "api-key", apiKeyKey: "X-Api-Key", apiKeyValue: "k", apiKeyLocation: "header" })
+
+        const xml = reqs(collection.items)[1]
+        expect(xml.body).toEqual({ type: "text", content: "<a/>" })
+        expect(xml.auth).toEqual({ type: "api-key", apiKeyKey: "api_key", apiKeyValue: "k", apiKeyLocation: "query" })
+    })
+
+    it("converts urlencoded + multipart bodies and oauth2 auth", () => {
+        const form = reqs(collection.items)[2]
+        expect(form.body.type).toBe("x-www-form-urlencoded")
+        expect(bare(form.body.urlEncoded!)).toEqual([{ key: "a", value: "1", active: true }, { key: "b", value: "2", active: false }])
+        expect(form.auth).toMatchObject({
+            type: "oauth2",
+            oauth2: { grantType: "client_credentials", tokenUrl: "https://x/token", clientId: "cid", clientSecret: "sec", scope: "read" },
+        })
+
+        const upload = reqs(collection.items)[3]
+        expect(upload.body.type).toBe("form-data")
+        expect(upload.body.formData!.map(({ key, value, active, valueType, fileName, fileContentBase64 }) => ({ key, value, active, valueType, fileName, fileContentBase64 }))).toEqual([
+            { key: "file", value: "", active: true, valueType: "file", fileName: "a.png", fileContentBase64: undefined },
+            { key: "note", value: "hi", active: true, valueType: "text", fileName: undefined, fileContentBase64: undefined },
+        ])
+        expect(upload.auth).toMatchObject({
+            type: "oauth2",
+            oauth2: { grantType: "authorization_code", tokenUrl: "https://x/token", authUrl: "https://x/auth", clientId: "cid", redirectUri: "http://localhost/cb" },
+        })
+    })
+
+    it("unpacks graphql bodies, drops disabled auth, and falls back on unknown methods", () => {
+        const gql = reqs(collection.items)[4]
+        expect(gql.body).toEqual({ type: "graphql", content: "query { me { id } }", graphqlVariables: '{"a":1}' })
+        expect(gql.auth).toEqual({ type: "none" })
+
+        const bogus = reqs(collection.items)[5]
+        expect(bogus.method).toBe("GET")
+        expect(bogus.auth).toEqual({ type: "none" })
+        expect(bogus.body).toEqual({ type: "none", content: "" })
+    })
+
+    it("flattens environments to dotted keys and skips empty ones", () => {
+        expect(environments.map((e) => e.name)).toEqual(["Base Environment", "Production"])
+        const vars = Object.fromEntries(environments[0].variables.map((v) => [v.key, v.value]))
+        expect(vars).toEqual({
+            base_url: "https://api.example.com",
+            "auth.token": "abc",
+            "auth.nested.deep": "1",
+            flag: "true",
+            list: "[1,2]",
+            ref: "{{base_url}}/v1",
+        })
+        expect(environments[0].variables.every((v) => v.enabled && v.id)).toBe(true)
+        expect(environments[1].variables).toHaveLength(1)
+    })
+})
+
+describe("Insomnia v5 YAML import", () => {
+    it("walks the collection tree", () => {
+        const { collection, environments } = importInsomniaWithMeta(v5)
+        expect(collection.name).toBe("Pet Store v5")
+        expect(collection.items.map((i) => i.name)).toEqual(["Users", "Ping"])
+
+        const users = folders(collection.items)[0]
+        expect(users.type).toBe("folder")
+        expect(users.preRequestScript).toBe('insomnia.environment.set("folder", 1)')
+
+        const list = reqs(users.items)[0]
+        expect(list.method).toBe("GET")
+        expect(list.url).toBe("{{base_url}}/users")
+        expect(bare(list.params)).toEqual([{ key: "page", value: "1", active: true }, { key: "off", value: "x", active: false }])
+        expect(bare(list.headers)).toEqual([{ key: "Accept", value: "application/json", active: true }])
+        expect(list.auth).toEqual({ type: "api-key", apiKeyKey: "X-Key", apiKeyValue: "{{key}}", apiKeyLocation: "header" })
+        expect(list.preRequestScript).toBe('insomnia.request.addHeader({ name: "a", value: "b" })')
+        expect(list.testScript).toBe('insomnia.test("ok", () => {})')
+
+        const create = reqs(users.items)[1]
+        expect(create.body).toEqual({ type: "json", content: '{"name":"{{name}}"}' })
+        expect(create.auth).toEqual({ type: "bearer", token: "{{token}}" })
+
+        const ping = reqs(collection.items)[1]
+        expect(ping.method).toBe("HEAD")
+        expect(ping.body).toEqual({ type: "none", content: "" })
+
+        expect(environments.map((e) => e.name)).toEqual(["Base Environment", "Staging"])
+        expect(environments[0].variables.map((v) => [v.key, v.value])).toEqual([["base_url", "https://api.example.com"], ["key", "k1"]])
+        expect(environments[1].variables.map((v) => [v.key, v.value])).toEqual([["base_url", "https://staging.example.com"]])
+    })
+
+    it("imports a standalone environment file", () => {
+        const { collection, environments } = importInsomniaWithMeta(v5Env)
+        expect(collection.items).toEqual([])
+        expect(environments).toHaveLength(1)
+        expect(environments[0].name).toBe("Prod")
+        expect(environments[0].variables.map((v) => [v.key, v.value])).toEqual([["base_url", "https://prod"], ["db.host", "h"]])
+    })
+
+    it("throws on non-Insomnia input", () => {
+        expect(() => importInsomniaWithMeta("openapi: 3.0.0")).toThrow(/Not an Insomnia/)
+        expect(() => importInsomniaWithMeta('{"info":{"name":"pm"},"item":[]}')).toThrow(/Not an Insomnia/)
+    })
+})
+
+describe("round-trip through export/insomnia.ts", () => {
+    const kv = (key: string, value: string, active = true): KeyValueItem => ({ id: crypto.randomUUID(), key, value, active })
+    const req = (over: Partial<CollectionRequest>): CollectionRequest => ({
+        id: crypto.randomUUID(),
+        name: "r",
+        method: "GET",
+        url: "https://api.test/x",
+        params: [],
+        headers: [],
+        body: { type: "none", content: "" },
+        auth: { type: "none" },
+        ...over,
+    })
+
+    const original: Collection = {
+        id: "c1",
+        name: "Round trip",
+        items: [
+            req({
+                name: "Create",
+                method: "POST",
+                url: "https://api.test/users",
+                params: [kv("page", "2"), kv("off", "1", false)],
+                headers: [kv("Content-Type", "application/json"), kv("X-Off", "1", false)],
+                body: { type: "json", content: '{"a":1}' },
+                auth: { type: "bearer", token: "{{TOKEN}}" },
+            }),
+            {
+                id: "f", name: "Auth", type: "folder", isOpen: true,
+                items: [
+                    req({
+                        name: "Login",
+                        method: "POST",
+                        url: "https://api.test/login",
+                        body: { type: "x-www-form-urlencoded", content: "", urlEncoded: [kv("user", "a b"), kv("pass", "p&q"), kv("skip", "x", false)] },
+                        auth: { type: "basic", username: "u", password: "p" },
+                    }),
+                    {
+                        id: "f2", name: "Deep", type: "folder",
+                        items: [
+                            req({
+                                name: "Note",
+                                method: "PUT",
+                                url: "https://api.test/n",
+                                body: { type: "text", content: "hello" },
+                                auth: { type: "api-key", apiKeyKey: "X-Key", apiKeyValue: "k", apiKeyLocation: "header" },
+                            }),
+                        ],
+                    },
+                ],
+            },
+        ],
+    }
+
+    it("preserves structure, method, url, active rows, body and auth", () => {
+        const exported = exportCollectionAsInsomnia(original)
+        expect(looksLikeInsomniaExport(exported)).toBe(true)
+        const { collection, environments } = importInsomniaWithMeta(exported)
+
+        expect(environments).toEqual([])
+        expect(collection.name).toBe("Round trip")
+        expect(collection.id).not.toBe(original.id)
+        expect(collection.items.map((i) => i.name)).toEqual(["Create", "Auth"])
+
+        const create = reqs(collection.items)[0]
+        const origCreate = reqs(original.items)[0]
+        expect(create.id).not.toBe(origCreate.id)
+        expect(create.method).toBe("POST")
+        expect(create.url).toBe("https://api.test/users")
+        // Exporter drops inactive rows; everything active must survive.
+        expect(bare(create.params)).toEqual([{ key: "page", value: "2", active: true }])
+        expect(bare(create.headers)).toEqual([{ key: "Content-Type", value: "application/json", active: true }])
+        expect(create.body).toEqual({ type: "json", content: '{"a":1}' })
+        expect(create.auth).toEqual({ type: "bearer", token: "{{TOKEN}}" })
+
+        const auth = folders(collection.items)[1]
+        expect(auth.type).toBe("folder")
+        expect(auth.items.map((i) => i.name)).toEqual(["Login", "Deep"])
+
+        const login = reqs(auth.items)[0]
+        expect(login.method).toBe("POST")
+        expect(login.url).toBe("https://api.test/login")
+        expect(login.body.type).toBe("x-www-form-urlencoded")
+        expect(bare(login.body.urlEncoded!)).toEqual([{ key: "user", value: "a b", active: true }, { key: "pass", value: "p&q", active: true }])
+        expect(login.auth).toEqual({ type: "basic", username: "u", password: "p" })
+
+        const note = reqs((auth.items[1] as CollectionFolder).items)[0]
+        expect(note.method).toBe("PUT")
+        expect(note.url).toBe("https://api.test/n")
+        expect(note.body).toEqual({ type: "text", content: "hello" })
+        expect(note.auth).toEqual({ type: "api-key", apiKeyKey: "X-Key", apiKeyValue: "k", apiKeyLocation: "header" })
+    })
+})
diff --git a/apps/desktop-ui/src/lib/import/bruno.ts b/apps/desktop-ui/src/lib/import/bruno.ts
new file mode 100644
index 00000000..eb03c8d0
--- /dev/null
+++ b/apps/desktop-ui/src/lib/import/bruno.ts
@@ -0,0 +1,472 @@
+/**
+ * Bruno import — both on-disk formats:
+ *   - legacy `.bru` language (`meta { … }`, `post { … }`, `body:json { … }` …),
+ *   - v4 OpenCollection YAML (`opencollection.yml` + one `request.yml` per request).
+ *
+ * Pure functions, no fs: the UI hands us a flat `{ path, text }[]` of the opened
+ * folder. `{{var}}` syntax is identical to ours so values pass through untouched.
+ *
+ * OpenCollection shape (from bruno-filestore `formats/yml`, docs 404 at time of
+ * writing): `info.{name,type,seq}`, `http.{method,url,params,headers,body,auth}`
+ * (`graphql.*` for graphql requests), `runtime.scripts[{type,code}]`. A flatter
+ * `{ name, type, http, params, headers, body, auth, scripts, tests }` is accepted
+ * too since the spec is still moving.
+ */
+
+import { load } from "js-yaml"
+import type {
+    Collection,
+    CollectionFolder,
+    CollectionRequest,
+    KeyValueItem,
+    RequestAuth,
+    RequestBody,
+    RequestFormDataItem,
+    RequestMethod,
+} from "@/components/api-client/types"
+import type { Environment, EnvironmentVariable } from "@/components/api-client/use-environments"
+import type { OAuth2GrantType } from "@/lib/oauth2"
+
+const METHODS: RequestMethod[] = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]
+
+function id(): string { return crypto.randomUUID() }
+
+// ── .bru block parser ──────────────────────────────────────────────────────
+// A file is a sequence of `name {` … `}` (dict or raw text) and `name [` … `]`
+// (array) blocks. Closing brackets sit at column 0; inner lines are indented 2.
+
+interface BruBlock { lines: string[] }
+type BruBlocks = Map<string, BruBlock>
+interface Entry { key: string; value: string; enabled: boolean }
+
+export function parseBruBlocks(text: string): BruBlocks {
+    const out: BruBlocks = new Map()
+    const lines = text.split(/\r?\n/)
+    let i = 0
+    while (i < lines.length) {
+        const m = /^([A-Za-z][\w:-]*)\s*([{[])\s*$/.exec(lines[i])
+        if (!m) { i++; continue }
+        const close = m[2] === "{" ? "}" : "]"
+        const body: string[] = []
+        i++
+        while (i < lines.length && lines[i].trimEnd() !== close) body.push(lines[i++])
+        i++
+        out.set(m[1], { lines: body })
+    }
+    return out
+}
+
+/** `key: value` lines; `~key` = disabled; `'''` opens a multi-line value. */
+function dict(block: BruBlock | undefined): Entry[] {
+    if (!block) return []
+    const out: Entry[] = []
+    const ls = block.lines
+    for (let i = 0; i < ls.length; i++) {
+        const line = ls[i].trim()
+        const idx = line.indexOf(":")
+        if (!line || idx < 0) continue
+        let key = line.slice(0, idx).trim()
+        let value = line.slice(idx + 1).trim()
+        if (value === "[") { // nested array (meta.tags) — skip
+            while (i < ls.length && ls[i].trim() !== "]") i++
+            continue
+        }
+        if (value === "'''") {
+            const acc: string[] = []
+            i++
+            while (i < ls.length && ls[i].trim() !== "'''") acc.push(ls[i++].replace(/^ {4}/, ""))
+            value = acc.join("\n")
+        }
+        const enabled = !key.startsWith("~")
+        if (!enabled) key = key.slice(1)
+        out.push({ key, value, enabled })
+    }
+    return out
+}
+
+function text(block: BruBlock | undefined): string {
+    return block ? block.lines.map((l) => l.replace(/^ {2}/, "")).join("\n") : ""
+}
+
+function array(block: BruBlock | undefined): Entry[] {
+    if (!block) return []
+    return block.lines
+        .map((l) => l.trim().replace(/,$/, "").trim())
+        .filter(Boolean)
+        .map((k) => ({ key: k.replace(/^~/, ""), value: "", enabled: !k.startsWith("~") }))
+}
+
+function get(entries: Entry[], key: string): string | undefined {
+    return entries.find((e) => e.key === key)?.value
+}
+
+function toKv(entries: Entry[]): KeyValueItem[] {
+    return entries.map((e) => ({ id: id(), key: e.key, value: e.value, active: e.enabled }))
+}
+
+function joinScripts(...parts: Array<string | undefined>): string | undefined {
+    const cleaned = parts.map((p) => (p ?? "").trim()).filter(Boolean)
+    return cleaned.length ? cleaned.join("\n\n") : undefined
+}
+
+// ── Shared converters (used by both formats) ───────────────────────────────
+
+function formItem(key: string, value: string, enabled: boolean): RequestFormDataItem {
+    const file = /^@file\(([^)]*)\)/.exec(value)
+    return file
+        ? { id: id(), key, value: "", active: enabled, valueType: "file", fileName: file[1].split("|")[0] }
+        : { id: id(), key, value: value.replace(/\s*@contentType\([^)]*\)\s*$/, ""), active: enabled, valueType: "text" }
+}
+
+function grantType(raw: string | undefined): OAuth2GrantType {
+    return raw === "authorization_code" || raw === "password" ? raw : "client_credentials"
+}
+
+function bruAuth(mode: string | undefined, blocks: BruBlocks): RequestAuth {
+    const block = (name: string) => dict(blocks.get(`auth:${name}`))
+    if (mode === "basic" || (!mode && blocks.has("auth:basic"))) {
+        const a = block("basic")
+        return { type: "basic", username: get(a, "username"), password: get(a, "password") }
+    }
+    if (mode === "bearer" || (!mode && blocks.has("auth:bearer"))) {
+        return { type: "bearer", token: get(block("bearer"), "token") }
+    }
+    if (mode === "apikey" || (!mode && blocks.has("auth:apikey"))) {
+        const a = block("apikey")
+        return {
+            type: "api-key",
+            apiKeyKey: get(a, "key"),
+            apiKeyValue: get(a, "value"),
+            apiKeyLocation: get(a, "placement") === "queryparams" || get(a, "placement") === "query" ? "query" : "header",
+        }
+    }
+    if (mode === "oauth2" || (!mode && blocks.has("auth:oauth2"))) {
+        const a = block("oauth2")
+        return {
+            type: "oauth2",
+            oauth2: {
+                grantType: grantType(get(a, "grant_type")),
+                tokenUrl: get(a, "access_token_url") ?? "",
+                clientId: get(a, "client_id") ?? "",
+                clientSecret: get(a, "client_secret"),
+                scope: get(a, "scope"),
+                authUrl: get(a, "authorization_url"),
+                redirectUri: get(a, "callback_url"),
+            },
+        }
+    }
+    return { type: "none" }
+}
+
+function bruBody(mode: string | undefined, blocks: BruBlocks): RequestBody {
+    const has = (n: string) => blocks.has(n)
+    if (mode === "json" || (!mode && (has("body:json") || has("body")))) {
+        return { type: "json", content: text(blocks.get("body:json") ?? blocks.get("body")) }
+    }
+    if (mode === "text" || mode === "xml" || mode === "sparql" || (!mode && (has("body:text") || has("body:xml")))) {
+        return { type: "text", content: text(blocks.get(`body:${mode ?? (has("body:text") ? "text" : "xml")}`)) }
+    }
+    if (mode === "formUrlEncoded" || (!mode && has("body:form-urlencoded"))) {
+        return { type: "x-www-form-urlencoded", content: "", urlEncoded: toKv(dict(blocks.get("body:form-urlencoded"))) }
+    }
+    if (mode === "multipartForm" || (!mode && has("body:multipart-form"))) {
+        return {
+            type: "form-data",
+            content: "",
+            formData: dict(blocks.get("body:multipart-form")).map((e) => formItem(e.key, e.value, e.enabled)),
+        }
+    }
+    if (mode === "graphql" || (!mode && has("body:graphql"))) {
+        return {
+            type: "graphql",
+            content: text(blocks.get("body:graphql")),
+            graphqlVariables: text(blocks.get("body:graphql:vars")) || undefined,
+        }
+    }
+    return { type: "none", content: "" }
+}
+
+/** Folder-level defaults shared by `folder.bru` and request files. */
+function bruDefaults(blocks: BruBlocks, authMode: string | undefined) {
+    return {
+        headers: toKv(dict(blocks.get("headers"))),
+        auth: bruAuth(authMode, blocks),
+        preRequestScript: joinScripts(text(blocks.get("script:pre-request"))),
+        testScript: joinScripts(text(blocks.get("script:post-response")), text(blocks.get("tests"))),
+    }
+}
+
+// ── .bru request ───────────────────────────────────────────────────────────
+
+export function looksLikeBrunoBru(text: string): boolean {
+    return /^(meta|get|post|put|patch|delete|head|options|headers|params:(query|path)|body(:[\w-]+)*|auth:\w+|vars:[\w-]+|script:[\w-]+|tests|docs)\s*[{[]\s*$/m.test(text)
+}
+
+export function parseBruRequest(text: string): CollectionRequest {
+    const blocks = parseBruBlocks(text)
+    const meta = dict(blocks.get("meta"))
+    const methodName = METHODS.find((m) => blocks.has(m.toLowerCase()))
+    const req = dict(methodName ? blocks.get(methodName.toLowerCase()) : undefined)
+    const authMode = get(req, "auth") ?? get(dict(blocks.get("auth")), "mode")
+    const d = bruDefaults(blocks, authMode)
+    // ponytail: `params:path` values are dropped — our model has no path params;
+    // the `:id` placeholders stay in the URL for the user to fill.
+    return {
+        id: id(),
+        name: get(meta, "name") || methodName || "Request",
+        method: methodName ?? "GET",
+        url: get(req, "url") ?? "",
+        params: toKv(dict(blocks.get("params:query") ?? blocks.get("query"))),
+        headers: d.headers,
+        body: bruBody(get(req, "body"), blocks),
+        auth: d.auth,
+        preRequestScript: d.preRequestScript,
+        testScript: d.testScript,
+    }
+}
+
+export function parseBrunoEnvironment(text: string, name: string): Environment {
+    const blocks = parseBruBlocks(text)
+    const toVar = (e: Entry): EnvironmentVariable => ({ id: id(), key: e.key, value: e.value, enabled: e.enabled })
+    return {
+        id: id(),
+        name,
+        variables: [...dict(blocks.get("vars")), ...array(blocks.get("vars:secret"))].map(toVar),
+    }
+}
+
+// ── OpenCollection YAML ────────────────────────────────────────────────────
+
+type Yaml = Record<string, unknown>
+const obj = (v: unknown): Yaml => (v && typeof v === "object" && !Array.isArray(v) ? (v as Yaml) : {})
+const str = (v: unknown): string => (v == null ? "" : typeof v === "string" ? v : typeof v === "object" ? str(obj(v).data) : String(v))
+const list = (v: unknown): Yaml[] => (Array.isArray(v) ? v.map(obj) : [])
+
+export function looksLikeOpenCollectionYaml(text: string): boolean {
+    return /^(http|graphql):\s*$/m.test(text) && /^\s+(method|url):/m.test(text)
+}
+
+function ocKv(items: unknown): KeyValueItem[] {
+    return list(items).map((e) => ({ id: id(), key: str(e.name), value: str(e.value), active: e.disabled !== true }))
+}
+
+function ocAuth(a: unknown): RequestAuth {
+    const y = obj(a)
+    const type = str(y.type)
+    if (type === "basic") return { type: "basic", username: str(y.username), password: str(y.password) }
+    if (type === "bearer") return { type: "bearer", token: str(y.token) }
+    if (type === "apikey") {
+        return {
+            type: "api-key",
+            apiKeyKey: str(y.key),
+            apiKeyValue: str(y.value),
+            apiKeyLocation: str(y.placement) === "query" ? "query" : "header",
+        }
+    }
+    if (type === "oauth2") {
+        return {
+            type: "oauth2",
+            oauth2: {
+                grantType: grantType(str(y.grantType)),
+                tokenUrl: str(y.accessTokenUrl),
+                clientId: str(y.clientId),
+                clientSecret: str(y.clientSecret) || undefined,
+                scope: str(y.scope) || undefined,
+                authUrl: str(y.authorizationUrl) || undefined,
+                redirectUri: str(y.callbackUrl) || undefined,
+            },
+        }
+    }
+    return { type: "none" }
+}
+
+function ocBody(b: unknown): RequestBody {
+    const y = obj(b)
+    if (y.query != null) return { type: "graphql", content: str(y.query), graphqlVariables: str(y.variables) || undefined }
+    const type = str(y.type).toLowerCase().replace(/[^a-z]/g, "")
+    if (type === "json") return { type: "json", content: str(y.data) }
+    if (type === "text" || type === "xml" || type === "sparql") return { type: "text", content: str(y.data) }
+    if (type === "formurlencoded") return { type: "x-www-form-urlencoded", content: "", urlEncoded: ocKv(y.data) }
+    if (type === "multipartform") {
+        return {
+            type: "form-data",
+            content: "",
+            formData: list(y.data).map((e) =>
+                str(e.type) === "file" || Array.isArray(e.value)
+                    ? formItem(str(e.name), `@file(${Array.isArray(e.value) ? str(e.value[0]) : str(e.value)})`, e.disabled !== true)
+                    : formItem(str(e.name), str(e.value), e.disabled !== true)),
+        }
+    }
+    return { type: "none", content: "" }
+}
+
+function ocScripts(scripts: unknown, tests: unknown): { pre?: string; test?: string } {
+    const y = obj(scripts)
+    const byType = (t: string) => list(scripts).find((s) => str(s.type) === t)?.code
+    return {
+        pre: joinScripts(str(byType("before-request") ?? y.preRequest)),
+        test: joinScripts(str(byType("after-response") ?? y.postResponse), str(byType("tests") ?? y.tests ?? tests)),
+    }
+}
+
+/** Shared by request.yml and folder.yml: the `http`/`graphql` block (or root) carries headers + auth. */
+function ocDefaults(doc: Yaml) {
+    const block = obj(doc.http ?? doc.graphql ?? doc.request)
+    const runtime = obj(doc.runtime)
+    const s = ocScripts(runtime.scripts ?? doc.scripts, doc.tests)
+    return {
+        block,
+        headers: ocKv(block.headers ?? doc.headers),
+        auth: ocAuth(block.auth ?? doc.auth),
+        preRequestScript: s.pre,
+        testScript: s.test,
+    }
+}
+
+export function parseOpenCollectionRequestYaml(text: string): CollectionRequest {
+    const doc = obj(load(text))
+    const info = obj(doc.info)
+    const d = ocDefaults(doc)
+    const method = str(d.block.method ?? doc.method).toUpperCase() as RequestMethod
+    return {
+        id: id(),
+        name: str(info.name ?? doc.name) || "Request",
+        method: METHODS.includes(method) ? method : "GET",
+        url: str(d.block.url ?? doc.url),
+        params: ocKv(d.block.params ?? doc.params).filter((_, i) => str(list(d.block.params ?? doc.params)[i].type) !== "path"),
+        headers: d.headers,
+        body: ocBody(d.block.body ?? doc.body),
+        auth: d.auth,
+        preRequestScript: d.preRequestScript,
+        testScript: d.testScript,
+    }
+}
+
+function parseOpenCollectionEnvironment(text: string, fallbackName: string): Environment {
+    const doc = obj(load(text))
+    return {
+        id: id(),
+        name: str(doc.name) || fallbackName,
+        variables: list(doc.variables).map((v) => ({
+            id: id(),
+            key: str(v.name),
+            value: v.secret === true ? "" : str(v.value),
+            enabled: v.disabled !== true,
+        })),
+    }
+}
+
+// ── Folder import ──────────────────────────────────────────────────────────
+
+export interface BrunoFile { path: string; text: string }
+export interface BrunoImportResult { collection: Collection; environments: Environment[] }
+
+interface Node {
+    name: string
+    seq?: number
+    order: number
+    item: CollectionFolder | CollectionRequest
+}
+
+const basename = (p: string) => p.slice(p.lastIndexOf("/") + 1)
+const dirname = (p: string) => (p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "")
+const stripExt = (p: string) => p.replace(/\.(bru|ya?ml)$/, "")
+
+export function importBrunoFolder(input: BrunoFile[]): BrunoImportResult {
+    const files = input.map((f) => ({ ...f, path: f.path.replace(/\\/g, "/").replace(/^\.?\//, "") }))
+    // Root = wherever the manifest lives (tolerates a zip with a wrapping directory).
+    const manifest = files.find((f) => /(^|\/)(bruno\.json|opencollection\.yml)$/.test(f.path))
+    const root = manifest ? dirname(manifest.path) : ""
+    const rel = (p: string) => (root ? p.slice(root.length + 1) : p)
+    const inRoot = files.filter((f) => !root || f.path.startsWith(root + "/"))
+
+    let name = "Bruno collection"
+    if (manifest?.path.endsWith(".json")) {
+        try { name = str(obj(JSON.parse(manifest.text)).name) || name } catch { /* keep default */ }
+    } else if (manifest) {
+        const doc = obj(load(manifest.text))
+        name = str(obj(doc.info).name ?? doc.name) || name
+    }
+
+    const environments: Environment[] = []
+    const folders = new Map<string, Node>()   // dir path → folder node
+    const children = new Map<string, Node[]>() // dir path → nodes
+    const push = (dir: string, node: Node) => {
+        if (!children.has(dir)) children.set(dir, [])
+        children.get(dir)!.push(node)
+    }
+    const folderNode = (dir: string): Node => {
+        let node = folders.get(dir)
+        if (!node) {
+            node = {
+                name: basename(dir),
+                order: Number.MAX_SAFE_INTEGER, // folders without seq sort after seq'd siblings, by path
+                item: { id: id(), name: basename(dir), type: "folder", items: [], isOpen: false },
+            }
+            folders.set(dir, node)
+            if (dir) push(dirname(dir), node)
+        }
+        return node
+    }
+
+    inRoot.forEach((file, order) => {
+        const p = rel(file.path)
+        const base = basename(p)
+        const dir = dirname(p)
+        if (p.startsWith("environments/")) {
+            if (base.endsWith(".bru")) environments.push(parseBrunoEnvironment(file.text, stripExt(base)))
+            else if (/\.ya?ml$/.test(base)) environments.push(parseOpenCollectionEnvironment(file.text, stripExt(base)))
+            return
+        }
+        if (base === "folder.bru" || base === "folder.yml") {
+            const node = folderNode(dir)
+            const folder = node.item as CollectionFolder
+            let d: ReturnType<typeof bruDefaults> | ReturnType<typeof ocDefaults>
+            let meta: Yaml
+            if (base === "folder.bru") {
+                const blocks = parseBruBlocks(file.text)
+                meta = Object.fromEntries(dict(blocks.get("meta")).map((e) => [e.key, e.value]))
+                d = bruDefaults(blocks, get(dict(blocks.get("auth")), "mode"))
+            } else {
+                const doc = obj(load(file.text))
+                meta = obj(doc.info ?? doc)
+                d = ocDefaults(doc)
+            }
+            node.name = folder.name = str(meta.name) || folder.name
+            if (meta.seq != null && meta.seq !== "") node.seq = Number(meta.seq)
+            if (d.headers.length) folder.defaultHeaders = d.headers
+            if (d.auth.type !== "none") folder.defaultAuth = d.auth
+            folder.preRequestScript = d.preRequestScript
+            folder.testScript = d.testScript
+            return
+        }
+        if (base === "bruno.json" || base === "collection.bru" || base === "opencollection.yml") return
+        let request: CollectionRequest
+        let seq: string | undefined
+        if (base.endsWith(".bru")) {
+            const blocks = parseBruBlocks(file.text)
+            const meta = dict(blocks.get("meta"))
+            const type = get(meta, "type")
+            if (type && type !== "http" && type !== "graphql") return
+            request = parseBruRequest(file.text)
+            seq = get(meta, "seq")
+        } else if (/\.ya?ml$/.test(base) && looksLikeOpenCollectionYaml(file.text)) {
+            request = parseOpenCollectionRequestYaml(file.text)
+            seq = str(obj(obj(load(file.text)).info).seq) || undefined
+        } else {
+            return
+        }
+        folderNode(dir)
+        push(dir, { name: request.name, seq: seq ? Number(seq) : undefined, order, item: request })
+    })
+
+    const build = (dir: string): Array<CollectionFolder | CollectionRequest> =>
+        (children.get(dir) ?? [])
+            .sort((a, b) => (a.seq ?? Infinity) - (b.seq ?? Infinity) || a.order - b.order)
+            .map((n) => {
+                if ("type" in n.item && n.item.type === "folder") n.item.items = build([...folders].find(([, v]) => v === n)![0])
+                return n.item
+            })
+
+    return { collection: { id: id(), name, items: build("") }, environments }
+}
diff --git a/apps/desktop-ui/src/lib/import/detect.ts b/apps/desktop-ui/src/lib/import/detect.ts
index c58e1cc7..3b7e4e02 100644
--- a/apps/desktop-ui/src/lib/import/detect.ts
+++ b/apps/desktop-ui/src/lib/import/detect.ts
@@ -1,4 +1,8 @@
-export type ImportFormat = "postman" | "postman-env" | "har" | "openapi" | "curl" | "unknown"
+import { looksLikeInsomniaExport } from "./insomnia"
+import { looksLikeBrunoBru, looksLikeOpenCollectionYaml } from "./bruno"
+
+export type ImportFormat =
+    | "postman" | "postman-env" | "har" | "openapi" | "insomnia" | "bruno" | "curl" | "unknown"
 
 interface ParsedRoot {
     info?: { schema?: string }
@@ -22,6 +26,7 @@ export function detectImportFormat(raw: string): ImportFormat {
     if (t.startsWith("{") || t.startsWith("[")) {
         try {
             const data = JSON.parse(t) as ParsedRoot
+            if (looksLikeInsomniaExport(t)) return "insomnia"
             if (data?.info?.schema?.includes("schema.getpostman.com")) return "postman"
             if (data?.info && Array.isArray(data.item)) return "postman"
             // Postman environment: `{ name, values: [{ key, value }] }`, no `info`.
@@ -40,5 +45,9 @@ export function detectImportFormat(raw: string): ImportFormat {
     if (/^openapi\s*:/m.test(head)) return "openapi"
     if (/^swagger\s*:/m.test(head)) return "openapi"
 
+    // Bruno's `.bru` language and Insomnia/Bruno YAML exports.
+    if (looksLikeInsomniaExport(t)) return "insomnia"
+    if (looksLikeBrunoBru(t) || looksLikeOpenCollectionYaml(t)) return "bruno"
+
     return "unknown"
 }
diff --git a/apps/desktop-ui/src/lib/import/insomnia.ts b/apps/desktop-ui/src/lib/import/insomnia.ts
new file mode 100644
index 00000000..392ed89e
--- /dev/null
+++ b/apps/desktop-ui/src/lib/import/insomnia.ts
@@ -0,0 +1,300 @@
+/**
+ * Insomnia import — v4 JSON (`_type: "export"`, `resources[]`) and v5 YAML
+ * (`type: collection.insomnia.rest/5.0` / `environment.insomnia.rest/5.0`).
+ * Round-trips `lib/export/insomnia.ts`. Template tags `{{ _.VAR }}` become
+ * our `{{VAR}}`; `insomnia.*` scripts are copied verbatim (no translation).
+ */
+
+import yaml from "js-yaml"
+
+import type {
+    Collection,
+    CollectionFolder,
+    CollectionRequest,
+    KeyValueItem,
+    RequestAuth,
+    RequestBody,
+    RequestFormDataItem,
+    RequestMethod,
+} from "@/components/api-client/types"
+import type { Environment, EnvironmentVariable } from "@/components/api-client/use-environments"
+
+interface InsKV { name?: string; value?: string; disabled?: boolean; type?: string; fileName?: string }
+interface InsBody { mimeType?: string; text?: string; params?: InsKV[] }
+interface InsAuth { type?: string; disabled?: boolean; [k: string]: unknown }
+
+/** Fields shared by v4 `request`/`request_group` resources and v5 tree items. */
+interface InsNode {
+    name?: string
+    method?: string
+    url?: string
+    parameters?: InsKV[]
+    headers?: InsKV[]
+    body?: InsBody
+    authentication?: InsAuth
+    preRequestScript?: string   // v4
+    afterResponseScript?: string
+    scripts?: { preRequest?: string; afterResponse?: string } // v5
+}
+
+interface InsV4Resource extends InsNode {
+    _id: string
+    _type: string
+    parentId?: string | null
+    metaSortKey?: number
+    data?: Record<string, unknown>
+}
+
+interface InsV5Item extends InsNode {
+    children?: InsV5Item[]
+    meta?: { sortKey?: number }
+}
+
+interface InsV5Env { name?: string; data?: Record<string, unknown>; subEnvironments?: InsV5Env[] }
+
+interface InsV5Doc {
+    type?: string
+    name?: string
+    collection?: InsV5Item[]
+    environments?: InsV5Env | InsV5Env[]
+    /** `environment.insomnia.rest/5.0` files carry the variables at the root. */
+    data?: Record<string, unknown>
+}
+
+export interface InsomniaImportResult {
+    collection: Collection
+    environments: Environment[]
+}
+
+const VALID_METHODS = new Set<RequestMethod>([
+    "GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS",
+])
+
+function id(): string { return crypto.randomUUID() }
+
+/** `{{ _.base_url }}` / `{{ base_url }}` → `{{base_url}}`. `{% tags %}` are left alone. */
+function tpl(v: unknown): string {
+    return typeof v === "string" ? v.replace(/\{\{\s*(?:_\.)?([^{}\s]+)\s*\}\}/g, "{{$1}}") : ""
+}
+
+function opt(v: unknown): string | undefined {
+    return typeof v === "string" ? tpl(v) : undefined
+}
+
+function kvList(items: InsKV[] | undefined): KeyValueItem[] {
+    return (items ?? [])
+        .filter((kv) => kv && (kv.name || kv.value))
+        .map((kv) => ({ id: id(), key: tpl(kv.name), value: tpl(kv.value), active: !kv.disabled }))
+}
+
+function convertBody(b: InsBody | undefined): RequestBody {
+    const mime = (b?.mimeType ?? "").toLowerCase()
+    const text = tpl(b?.text)
+    if (mime === "application/x-www-form-urlencoded") {
+        // Our exporter writes the encoded string; Insomnia writes params[].
+        const urlEncoded = b?.params
+            ? kvList(b.params)
+            : [...new URLSearchParams(text)].map(([key, value]) => ({ id: id(), key, value, active: true }))
+        return { type: "x-www-form-urlencoded", content: "", urlEncoded }
+    }
+    if (mime === "multipart/form-data") {
+        const formData: RequestFormDataItem[] = (b?.params ?? [])
+            .filter((p) => p && (p.name || p.value || p.fileName))
+            .map((p) => p.type === "file"
+                ? { id: id(), key: tpl(p.name), value: "", active: !p.disabled, valueType: "file", fileName: p.fileName?.split(/[\\/]/).pop() || undefined }
+                : { id: id(), key: tpl(p.name), value: tpl(p.value), active: !p.disabled, valueType: "text" })
+        return { type: "form-data", content: "", formData }
+    }
+    if (mime === "application/graphql") {
+        try {
+            const g = JSON.parse(b?.text ?? "") as { query?: unknown; variables?: unknown }
+            const vars = g.variables
+            return {
+                type: "graphql",
+                content: tpl(g.query),
+                graphqlVariables: vars == null || vars === ""
+                    ? undefined
+                    : typeof vars === "string" ? tpl(vars) : JSON.stringify(vars, null, 2),
+            }
+        } catch {
+            return { type: "graphql", content: text }
+        }
+    }
+    if (mime === "application/json") return { type: "json", content: text }
+    if (!mime && !text) return { type: "none", content: "" }
+    // text/plain, application/xml, anything else → raw text.
+    return { type: "text", content: text }
+}
+
+function convertAuth(a: InsAuth | undefined): RequestAuth {
+    if (!a || a.disabled || !a.type) return { type: "none" }
+    switch (a.type) {
+        case "basic":
+            return { type: "basic", username: opt(a.username), password: opt(a.password) }
+        case "bearer":
+            // ponytail: Insomnia's custom `prefix` is dropped — we always send "Bearer".
+            return { type: "bearer", token: opt(a.token) }
+        case "apikey":
+            return {
+                type: "api-key",
+                apiKeyKey: opt(a.key),
+                apiKeyValue: opt(a.value),
+                apiKeyLocation: a.addTo === "queryParams" ? "query" : "header",
+            }
+        case "oauth2":
+            return {
+                type: "oauth2",
+                oauth2: {
+                    grantType: a.grantType === "authorization_code" ? "authorization_code" : "client_credentials",
+                    tokenUrl: opt(a.accessTokenUrl) ?? "",
+                    clientId: opt(a.clientId) ?? "",
+                    clientSecret: opt(a.clientSecret),
+                    scope: opt(a.scope),
+                    audience: opt(a.audience),
+                    authUrl: opt(a.authorizationUrl),
+                    redirectUri: opt(a.redirectUrl),
+                },
+            }
+        default:
+            return { type: "none" }
+    }
+}
+
+function scripts(n: InsNode): { preRequestScript?: string; testScript?: string } {
+    return {
+        preRequestScript: (n.preRequestScript ?? n.scripts?.preRequest) || undefined,
+        testScript: (n.afterResponseScript ?? n.scripts?.afterResponse) || undefined,
+    }
+}
+
+function convertRequest(r: InsNode): CollectionRequest {
+    const m = (r.method ?? "GET").toUpperCase() as RequestMethod
+    const method = VALID_METHODS.has(m) ? m : "GET"
+    return {
+        id: id(),
+        name: r.name || method,
+        method,
+        url: tpl(r.url),
+        params: kvList(r.parameters),
+        headers: kvList(r.headers),
+        body: convertBody(r.body),
+        auth: convertAuth(r.authentication),
+        ...scripts(r),
+    }
+}
+
+function convertFolder(n: InsNode, items: CollectionFolder["items"]): CollectionFolder {
+    const defaultAuth = convertAuth(n.authentication)
+    const defaultHeaders = kvList(n.headers)
+    return {
+        id: id(),
+        name: n.name || "Folder",
+        type: "folder",
+        items,
+        isOpen: false,
+        defaultAuth: defaultAuth.type === "none" ? undefined : defaultAuth,
+        defaultHeaders: defaultHeaders.length ? defaultHeaders : undefined,
+        ...scripts(n),
+    }
+}
+
+/** Nested env objects become dotted keys; non-string leaves are JSON-encoded. */
+function flatten(data: unknown, prefix: string, out: EnvironmentVariable[]): void {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return
+    for (const [k, v] of Object.entries(data)) {
+        const key = prefix ? `${prefix}.${k}` : k
+        if (v && typeof v === "object" && !Array.isArray(v)) flatten(v, key, out)
+        else out.push({ id: id(), key, value: typeof v === "string" ? tpl(v) : v == null ? "" : JSON.stringify(v), enabled: true })
+    }
+}
+
+function toEnvironment(name: string | undefined, data: unknown): Environment | null {
+    const variables: EnvironmentVariable[] = []
+    flatten(data, "", variables)
+    return variables.length ? { id: id(), name: name || "Insomnia environment", variables } : null
+}
+
+function importV4(resources: InsV4Resource[]): InsomniaImportResult {
+    const res = resources.filter((r) => r && typeof r === "object")
+    const bySort = (a: InsV4Resource, b: InsV4Resource) => (a.metaSortKey ?? 0) - (b.metaSortKey ?? 0)
+    const ROOT = "__root__"
+    const groupIds = new Set(res.filter((r) => r._type === "request_group").map((r) => r._id))
+    const children = new Map<string, InsV4Resource[]>()
+    for (const r of res) {
+        if (r._type !== "request" && r._type !== "request_group") continue
+        // ponytail: everything not under a known group (workspace children, orphans,
+        // extra workspaces) lands at the root.
+        const parent = r.parentId && groupIds.has(r.parentId) ? r.parentId : ROOT
+        children.set(parent, [...(children.get(parent) ?? []), r])
+    }
+    const walk = (parent: string): CollectionFolder["items"] =>
+        (children.get(parent) ?? []).sort(bySort).map((r) =>
+            r._type === "request_group" ? convertFolder(r, walk(r._id)) : convertRequest(r))
+
+    const workspace = res.find((r) => r._type === "workspace")
+    const environments = res
+        .filter((r) => r._type === "environment")
+        .sort(bySort)
+        .map((r) => toEnvironment(r.name, r.data))
+        .filter((e): e is Environment => e !== null)
+
+    return {
+        collection: { id: id(), name: workspace?.name || "Imported Insomnia collection", items: walk(ROOT) },
+        environments,
+    }
+}
+
+function importV5(doc: InsV5Doc): InsomniaImportResult {
+    const walk = (items: InsV5Item[] | undefined): CollectionFolder["items"] =>
+        (items ?? [])
+            .filter((it) => it && typeof it === "object")
+            .sort((a, b) => (a.meta?.sortKey ?? 0) - (b.meta?.sortKey ?? 0))
+            .map((it) => it.children || (!it.url && !it.method)
+                ? convertFolder(it, walk(it.children))
+                : convertRequest(it))
+
+    const environments: Environment[] = []
+    const collect = (e: InsV5Env | undefined): void => {
+        if (!e || typeof e !== "object") return
+        const env = toEnvironment(e.name, e.data)
+        if (env) environments.push(env)
+        for (const sub of e.subEnvironments ?? []) collect(sub)
+    }
+    if (Array.isArray(doc.environments)) doc.environments.forEach(collect)
+    else collect(doc.environments)
+    if (doc.data) collect({ name: doc.name, data: doc.data })
+
+    return {
+        collection: { id: id(), name: doc.name || "Imported Insomnia collection", items: walk(doc.collection) },
+        environments,
+    }
+}
+
+export function looksLikeInsomniaExport(text: string): boolean {
+    const t = text.trim()
+    if (t.startsWith("{")) {
+        try {
+            const d = JSON.parse(t) as { _type?: unknown; resources?: unknown }
+            return d?._type === "export" && Array.isArray(d.resources)
+        } catch {
+            return false
+        }
+    }
+    return /^type:\s*["']?(collection|environment)\.insomnia\.rest\/5\.0/m.test(t)
+        || /^_type:\s*["']?export\b/m.test(t)
+}
+
+export function importInsomniaWithMeta(text: string): InsomniaImportResult {
+    const t = text.trim()
+    // yaml.load also parses JSON, so v4 YAML exports come for free.
+    const doc = (t.startsWith("{") ? JSON.parse(t) : yaml.load(t)) as
+        { _type?: string; resources?: InsV4Resource[] } & InsV5Doc
+    if (!doc || typeof doc !== "object") throw new Error("Not an Insomnia export")
+    if (doc._type === "export" && Array.isArray(doc.resources)) return importV4(doc.resources)
+    if (/insomnia\.rest\/5\.0$/.test(String(doc.type))) return importV5(doc)
+    throw new Error("Not an Insomnia export (expected v4 `_type: export` or v5 `type: *.insomnia.rest/5.0`)")
+}
+
+export function importInsomnia(text: string): Collection {
+    return importInsomniaWithMeta(text).collection
+}

From 7ab5e4fb04d377b30431bc92b137d50bea1dcf11 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sun, 23 Aug 2026 19:22:27 +0530
Subject: [PATCH 10/39] feat(secure-files): encrypted .mydt file vault, shared
 format crate and CLI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds the Secure Files tool ("Files" in the UI): import files or folders and
store them as opaque `<32 random hex>.mydt` objects in a storage folder the
user picks. Original names, folder paths, types and contents are encrypted;
the app shows them only while the vault is unlocked.

Format (docs/MYDT_FORMAT.md, crates/mydt):
- Self-contained per file: Argon2id salt/params + per-file DEK wrapped by the
  key derived from the master password + XChaCha20-Poly1305 metadata and
  payload, with the header bound in as AAD. No index — listing scans the
  folder and decrypts headers, so a folder is portable and self-healing.
- Extracted into the standalone `mydt` crate: library plus a `mydt` CLI
  (encrypt/decrypt/info/ls) behind `--features cli`, so the desktop app and
  the CLI read and write identical objects. Wired into rust.yml.

Desktop:
- New `/api/v1/secure-files/*` routes: settings, list, import, patch, replace,
  export, delete, folder rename/delete; raw-bytes `secure_file_read` command
  for previews.
- The webview gate hands the verified master password to Rust once per unlock
  so Argon2id can derive the Secure Files key; it lives in AppState only and
  is dropped on lock (idle auto-lock included).
- Listing keeps a decrypted-metadata cache reconciled by an id-set diff, and
  import encrypts across threads with one directory fsync per batch. 10k
  files: import 1.75s, cold list 0.30s, warm list 24ms.

UI:
- Folder tree, list and grid views (both virtualized), preview for text,
  code, images and PDF, export with a plaintext warning, rename/move/replace,
  dismissible warning for unreadable objects. Files up to 20 MB.
- Fixes a latent bug in the shared s3-drive FilePreviewDialog, which used
  Radix Tooltip without a TooltipProvider and crashed the dialog subtree.

`pnpm i18n:sync` also backfilled unrelated missing keys across the 26
non-English locales, which is why messages/ is broad.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01No7es2PjF9SNQs22RYHcdM
---
 .github/workflows/rust.yml                    |  11 +-
 .gitignore                                    |   4 +-
 README.md                                     |   1 +
 apps/desktop-ui/messages/af.json              |  85 +-
 apps/desktop-ui/messages/ar.json              |  98 +-
 apps/desktop-ui/messages/ca.json              |  98 +-
 apps/desktop-ui/messages/cs.json              |  98 +-
 apps/desktop-ui/messages/da.json              |  98 +-
 apps/desktop-ui/messages/de.json              |  98 +-
 apps/desktop-ui/messages/el.json              |  98 +-
 apps/desktop-ui/messages/en.json              |  69 ++
 apps/desktop-ui/messages/es.json              |  85 +-
 apps/desktop-ui/messages/fa.json              |  85 +-
 apps/desktop-ui/messages/fr.json              |  85 +-
 apps/desktop-ui/messages/id.json              |  98 +-
 apps/desktop-ui/messages/it.json              |  85 +-
 apps/desktop-ui/messages/ja.json              |  98 +-
 apps/desktop-ui/messages/ko.json              |  98 +-
 apps/desktop-ui/messages/ms.json              |  85 +-
 apps/desktop-ui/messages/nb.json              |  98 +-
 apps/desktop-ui/messages/nl.json              |  98 +-
 apps/desktop-ui/messages/pl.json              |  98 +-
 apps/desktop-ui/messages/pt-BR.json           |  98 +-
 apps/desktop-ui/messages/pt.json              |  98 +-
 apps/desktop-ui/messages/ru.json              |  98 +-
 apps/desktop-ui/messages/sv.json              |  85 +-
 apps/desktop-ui/messages/tr.json              |  85 +-
 apps/desktop-ui/messages/uk.json              |  85 +-
 apps/desktop-ui/messages/vi.json              |  98 +-
 apps/desktop-ui/messages/zh.json              |  98 +-
 apps/desktop-ui/package.json                  |   1 +
 .../src/app/app/secure-files/layout.tsx       |   7 +
 .../src/app/app/secure-files/page.tsx         |  20 +
 .../src/components/master-password-gate.tsx   |   4 +
 .../s3-drive/file-preview-dialog.tsx          |   6 +-
 .../components/secure-files/folder-tree.tsx   | 192 ++++
 .../secure-files/secure-files-tool.tsx        | 721 +++++++++++++
 .../components/sidebar/data/sidebar-data.ts   |   7 +
 .../src/lib/__tests__/secure-files.test.ts    |  47 +
 apps/desktop-ui/src/lib/global-vault-api.ts   |  28 +
 apps/desktop-ui/src/lib/metadata.ts           |   6 +
 apps/desktop-ui/src/lib/route-config.ts       |   2 +
 apps/desktop-ui/src/lib/secure-files-api.ts   |  57 +
 apps/desktop-ui/src/lib/secure-files.ts       |  89 ++
 apps/desktop-ui/src/lib/tab-registry.tsx      |   1 +
 apps/desktop-ui/src/lib/tool-categories.ts    |   1 +
 apps/desktop-ui/src/lib/tool-i18n.ts          |   1 +
 apps/desktop-ui/src/store/master-key-store.ts |  15 +-
 apps/desktop/src-tauri/Cargo.lock             | 192 ++++
 apps/desktop/src-tauri/Cargo.toml             |   4 +
 .../src-tauri/capabilities/default.json       |   2 +-
 apps/desktop/src-tauri/src/lib.rs             |  11 +-
 apps/desktop/src-tauri/src/router/backup.rs   |   4 +-
 .../src-tauri/src/router/master_vault.rs      |  30 +-
 apps/desktop/src-tauri/src/router/mod.rs      |   4 +
 .../src-tauri/src/router/preferences.rs       |   1 +
 .../src-tauri/src/router/secure_files/mod.rs  | 995 ++++++++++++++++++
 apps/desktop/src-tauri/src/state.rs           |  14 +-
 crates/mydt/Cargo.lock                        | 521 +++++++++
 crates/mydt/Cargo.toml                        |  34 +
 crates/mydt/README.md                         |  43 +
 crates/mydt/src/lib.rs                        | 392 +++++++
 crates/mydt/src/main.rs                       | 229 ++++
 docs/ARCHITECTURE.md                          |   8 +
 docs/MYDT_FORMAT.md                           | 134 +++
 pnpm-lock.yaml                                |  38 +-
 66 files changed, 6253 insertions(+), 124 deletions(-)
 create mode 100644 apps/desktop-ui/src/app/app/secure-files/layout.tsx
 create mode 100644 apps/desktop-ui/src/app/app/secure-files/page.tsx
 create mode 100644 apps/desktop-ui/src/components/secure-files/folder-tree.tsx
 create mode 100644 apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
 create mode 100644 apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
 create mode 100644 apps/desktop-ui/src/lib/secure-files-api.ts
 create mode 100644 apps/desktop-ui/src/lib/secure-files.ts
 create mode 100644 apps/desktop/src-tauri/src/router/secure_files/mod.rs
 create mode 100644 crates/mydt/Cargo.lock
 create mode 100644 crates/mydt/Cargo.toml
 create mode 100644 crates/mydt/README.md
 create mode 100644 crates/mydt/src/lib.rs
 create mode 100644 crates/mydt/src/main.rs
 create mode 100644 docs/MYDT_FORMAT.md

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 73c6849b..aa86409a 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -63,9 +63,18 @@ jobs:
       - name: Rust cache
         uses: swatinem/rust-cache@v2
         with:
-          workspaces: apps/desktop/src-tauri -> target
+          workspaces: |
+            apps/desktop/src-tauri -> target
+            crates/mydt -> target
 
       # SQLCipher + OpenSSL are vendored (rusqlite bundled-sqlcipher-vendored-openssl),
       # so the first run compiles them; rust-cache makes later runs fast.
       - name: cargo test
         run: cargo test --locked
+
+      # Shared .mydt format crate + CLI (no Tauri deps, builds in seconds).
+      - name: mydt crate (format + CLI)
+        working-directory: crates/mydt
+        run: |
+          cargo test --locked
+          cargo build --locked --release --features cli
diff --git a/.gitignore b/.gitignore
index b174a5e0..e413a1f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -99,4 +99,6 @@ docs/superpowers/
 # graft's local graph cache — regenerable, not committed (run `graft build`).
 graft/
 # Local Linux build output (published to GitHub releases, never committed)
-dist-linux/
\ No newline at end of file
+dist-linux/
+# Rust crates outside the Tauri shell
+crates/*/target/
diff --git a/README.md b/README.md
index 090d6c45..88c81cb2 100644
--- a/README.md
+++ b/README.md
@@ -176,6 +176,7 @@ go straight from your machine to your database.
 | Tool | Description |
 |---|---|
 | **Password Manager** | Credential vault encrypted with a password only you know |
+| **Secure Files** | Encrypt files and folders into masked `.mydt` objects in any folder you choose; browse, preview and export them after unlocking ([format spec](docs/MYDT_FORMAT.md), [`mydt` CLI](crates/mydt/README.md)) |
 | **Encryption Playground** | AES-GCM with a raw key or passphrase; encrypt/decrypt JSON bundles |
 | **JWT Decoder** | Decode JWT header, payload and expiry |
 | **Hash Generator** | MD5, SHA-1, SHA-256/384/512 digests for text or files |
diff --git a/apps/desktop-ui/messages/af.json b/apps/desktop-ui/messages/af.json
index b5c44dfe..01b5e7e1 100644
--- a/apps/desktop-ui/messages/af.json
+++ b/apps/desktop-ui/messages/af.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Token-teller",
     "webhookTester": "Webhook-toetser",
     "websocketTester": "WebSocket-toetser",
-    "whoisLookup": "Whois-opsoek"
+    "whoisLookup": "Whois-opsoek",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Hulp en dokumentasie",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois-opsoek",
         "description": "Soek domein- en IP-registrasiebesonderhede op via RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "Antwoord na knipbord gekopieer",
       "codeCopied": "Kode na knipbord gekopieer",
       "copyFailed": "Failed to copy to clipboard",
-      "curlCopied": "cURL-opdrag gekopieer"
+      "curlCopied": "cURL-opdrag gekopieer",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Versamelings",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "Deel anoniem",
       "decline": "Nee dankie"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/ar.json b/apps/desktop-ui/messages/ar.json
index 9a8aadc5..789fe85c 100644
--- a/apps/desktop-ui/messages/ar.json
+++ b/apps/desktop-ui/messages/ar.json
@@ -76,7 +76,8 @@
     "tokenCounter": "عدّاد الرموز",
     "webhookTester": "مختبِر Webhook",
     "websocketTester": "مختبِر WebSocket",
-    "whoisLookup": "بحث Whois"
+    "whoisLookup": "بحث Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "المساعدة والتوثيق",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "بحث Whois",
         "description": "ابحث عن تفاصيل تسجيل النطاق وعنوان IP عبر RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "تم أخذ عينة من {docs} مستند · {fields} حقل",
       "colField": "الحقل",
       "colTypes": "الأنواع",
-      "colCoverage": "التغطية"
+      "colCoverage": "التغطية",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "تم نسخ الاستجابة",
       "codeCopied": "تم نسخ الكود",
       "copyFailed": "فشل نسخ المحتوى إلى الحافظة",
-      "curlCopied": "تم نسخ أمر cURL"
+      "curlCopied": "تم نسخ أمر cURL",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "المجموعات",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "المشاركة بشكل مجهول",
       "decline": "لا، شكرًا"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/ca.json b/apps/desktop-ui/messages/ca.json
index edd94bda..67746894 100644
--- a/apps/desktop-ui/messages/ca.json
+++ b/apps/desktop-ui/messages/ca.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Comptador de tokens",
     "webhookTester": "Provador de webhooks",
     "websocketTester": "Provador de WebSocket",
-    "whoisLookup": "Consulta Whois"
+    "whoisLookup": "Consulta Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Ajuda i documentació",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Consulta Whois",
         "description": "Consulta les dades de registre de dominis i IP mitjançant RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "S'han mostrejat {docs} documents · {fields} camps",
       "colField": "Camp",
       "colTypes": "Tipus",
-      "colCoverage": "Cobertura"
+      "colCoverage": "Cobertura",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Resposta copiada al porta-retalls",
       "codeCopied": "Codi copiat al porta-retalls",
       "copyFailed": "No s'ha pogut copiar al porta-retalls",
-      "curlCopied": "Ordre cURL copiada"
+      "curlCopied": "Ordre cURL copiada",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Col·leccions",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Comparteix anònimament",
       "decline": "No, gràcies"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/cs.json b/apps/desktop-ui/messages/cs.json
index 1cecc88f..ca1680ae 100644
--- a/apps/desktop-ui/messages/cs.json
+++ b/apps/desktop-ui/messages/cs.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Počítadlo tokenů",
     "webhookTester": "Tester webhooků",
     "websocketTester": "Tester WebSocket",
-    "whoisLookup": "Whois vyhledávání"
+    "whoisLookup": "Whois vyhledávání",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Nápověda a dokumentace",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois vyhledávání",
         "description": "Vyhledejte registrační údaje domény a IP adresy přes RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Vzorkováno {docs} dokumentů · {fields} polí",
       "colField": "Pole",
       "colTypes": "Typy",
-      "colCoverage": "Pokrytí"
+      "colCoverage": "Pokrytí",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Odpověď zkopírována",
       "codeCopied": "Kód zkopírován",
       "copyFailed": "Nepodařilo se zkopírovat do schránky",
-      "curlCopied": "Příkaz cURL zkopírován"
+      "curlCopied": "Příkaz cURL zkopírován",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Kolekce",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Sdílet anonymně",
       "decline": "Ne, děkuji"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/da.json b/apps/desktop-ui/messages/da.json
index c3b78cb8..859d7cfc 100644
--- a/apps/desktop-ui/messages/da.json
+++ b/apps/desktop-ui/messages/da.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Token-tæller",
     "webhookTester": "Webhook-tester",
     "websocketTester": "WebSocket-tester",
-    "whoisLookup": "Whois-opslag"
+    "whoisLookup": "Whois-opslag",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Hjælp og dokumentation",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois-opslag",
         "description": "Slå registreringsoplysninger for domæner og IP-adresser op via RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Stikprøve af {docs} dokumenter · {fields} felter",
       "colField": "Felt",
       "colTypes": "Typer",
-      "colCoverage": "Dækning"
+      "colCoverage": "Dækning",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Svar kopieret til udklipsholder",
       "codeCopied": "Kode kopieret til udklipsholder",
       "copyFailed": "Kopiering til udklipsholder mislykkedes",
-      "curlCopied": "cURL-kommando kopieret"
+      "curlCopied": "cURL-kommando kopieret",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Samlinger",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Del anonymt",
       "decline": "Nej tak"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/de.json b/apps/desktop-ui/messages/de.json
index 33813e79..7dc7b6e0 100644
--- a/apps/desktop-ui/messages/de.json
+++ b/apps/desktop-ui/messages/de.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Token-Zähler",
     "webhookTester": "Webhook-Tester",
     "websocketTester": "WebSocket-Tester",
-    "whoisLookup": "Whois-Abfrage"
+    "whoisLookup": "Whois-Abfrage",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Hilfe & Dokumentation",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois-Abfrage",
         "description": "Registrierungsdaten von Domains und IPs per RDAP abrufen."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "{docs} Dokumente untersucht · {fields} Felder",
       "colField": "Feld",
       "colTypes": "Typen",
-      "colCoverage": "Abdeckung"
+      "colCoverage": "Abdeckung",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Antwort in die Zwischenablage kopiert",
       "codeCopied": "Code in die Zwischenablage kopiert",
       "copyFailed": "In die Zwischenablage kopieren fehlgeschlagen",
-      "curlCopied": "cURL-Befehl kopiert"
+      "curlCopied": "cURL-Befehl kopiert",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Sammlungen",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Anonym teilen",
       "decline": "Nein, danke"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/el.json b/apps/desktop-ui/messages/el.json
index 98a744c5..6f9f0051 100644
--- a/apps/desktop-ui/messages/el.json
+++ b/apps/desktop-ui/messages/el.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Μετρητής token",
     "webhookTester": "Δοκιμαστής webhook",
     "websocketTester": "Δοκιμαστής WebSocket",
-    "whoisLookup": "Αναζήτηση Whois"
+    "whoisLookup": "Αναζήτηση Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Βοήθεια και τεκμηρίωση",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Αναζήτηση Whois",
         "description": "Αναζητήστε στοιχεία καταχώρισης τομέα και IP μέσω RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Δείγμα {docs} εγγράφων · {fields} πεδία",
       "colField": "Πεδίο",
       "colTypes": "Τύποι",
-      "colCoverage": "Κάλυψη"
+      "colCoverage": "Κάλυψη",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Η απάντηση αντιγράφηκε στο πρόχειρο",
       "codeCopied": "Ο κώδικας αντιγράφηκε στο πρόχειρο",
       "copyFailed": "Αποτυχία αντιγραφής στο πρόχειρο",
-      "curlCopied": "Η εντολή cURL αντιγράφηκε"
+      "curlCopied": "Η εντολή cURL αντιγράφηκε",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Συλλογές",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Ανώνυμη κοινοποίηση",
       "decline": "Όχι, ευχαριστώ"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/en.json b/apps/desktop-ui/messages/en.json
index 24f9b8cd..8b904f03 100644
--- a/apps/desktop-ui/messages/en.json
+++ b/apps/desktop-ui/messages/en.json
@@ -43,6 +43,7 @@
     "gitignoreGenerator": ".gitignore Generator",
     "csvExcelJson": "CSV / Excel ↔ JSON",
     "snippetManager": "Code Snippets",
+    "secureFiles": "Files",
     "markdownPreview": "Markdown Preview",
     "numberBaseConverter": "Number Base Converter",
     "formatConverter": "Format Converter",
@@ -626,6 +627,10 @@
         "title": "Code Snippets",
         "description": "Save snippets with syntax highlighting, auto language detection, and formatting."
       },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+      },
       "markdownPreview": {
         "title": "Markdown Preview",
         "description": "Live Markdown renderer with HTML export and HTML → Markdown conversion."
@@ -3136,6 +3141,70 @@
     "detectedFormats": "Detected formats",
     "download": "Download"
   },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "importFolder": "Import folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "Unreadable files in the storage folder: {count}",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save"
+  },
   "SnippetManager": {
     "title": "Snippet Manager",
     "subtitle": "Save, search, and format code snippets — sync optional",
diff --git a/apps/desktop-ui/messages/es.json b/apps/desktop-ui/messages/es.json
index ddd9d36a..5d638a89 100644
--- a/apps/desktop-ui/messages/es.json
+++ b/apps/desktop-ui/messages/es.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Contador de tokens",
     "webhookTester": "Probador de webhooks",
     "websocketTester": "Probador de WebSocket",
-    "whoisLookup": "Consulta Whois"
+    "whoisLookup": "Consulta Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Ayuda y documentación",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Consulta Whois",
         "description": "Consulta los datos de registro de un dominio o IP mediante RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "Respuesta copiada al portapapeles",
       "codeCopied": "Código copiado al portapapeles",
       "copyFailed": "Error al copiar al portapapeles",
-      "curlCopied": "Comando cURL copiado"
+      "curlCopied": "Comando cURL copiado",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Colecciones",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "Compartir de forma anónima",
       "decline": "No, gracias"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/fa.json b/apps/desktop-ui/messages/fa.json
index 96fa10f4..e09e45d1 100644
--- a/apps/desktop-ui/messages/fa.json
+++ b/apps/desktop-ui/messages/fa.json
@@ -76,7 +76,8 @@
     "tokenCounter": "شمارنده توکن",
     "webhookTester": "آزمایشگر Webhook",
     "websocketTester": "آزمایشگر WebSocket",
-    "whoisLookup": "جست‌وجوی Whois"
+    "whoisLookup": "جست‌وجوی Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "راهنما و مستندات",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "جست‌وجوی Whois",
         "description": "جزئیات ثبت دامنه و IP را از طریق RDAP جست‌وجو کنید."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "پاسخ در کلیپ بورد کپی شد",
       "codeCopied": "کد در کلیپ بورد کپی شد",
       "copyFailed": "کپی در کلیپ‌بورد ناموفق بود",
-      "curlCopied": "دستور cURL کپی شد"
+      "curlCopied": "دستور cURL کپی شد",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "مجموعه ها",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "اشتراک‌گذاری ناشناس",
       "decline": "نه، ممنون"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/fr.json b/apps/desktop-ui/messages/fr.json
index e6ed772a..cc6dcdf8 100644
--- a/apps/desktop-ui/messages/fr.json
+++ b/apps/desktop-ui/messages/fr.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Compteur de tokens",
     "webhookTester": "Testeur de webhook",
     "websocketTester": "Testeur WebSocket",
-    "whoisLookup": "Recherche Whois"
+    "whoisLookup": "Recherche Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Aide & documentation",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Recherche Whois",
         "description": "Consultez les détails d'enregistrement d'un domaine ou d'une IP via RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "Réponse copiée",
       "codeCopied": "Code copié",
       "copyFailed": "Impossible de copier dans le presse-papiers",
-      "curlCopied": "Commande cURL copiée"
+      "curlCopied": "Commande cURL copiée",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Collections",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "Partager anonymement",
       "decline": "Non merci"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/id.json b/apps/desktop-ui/messages/id.json
index f57d3a7e..babcd1f4 100644
--- a/apps/desktop-ui/messages/id.json
+++ b/apps/desktop-ui/messages/id.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Penghitung Token",
     "webhookTester": "Penguji Webhook",
     "websocketTester": "Penguji WebSocket",
-    "whoisLookup": "Pencarian Whois"
+    "whoisLookup": "Pencarian Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Bantuan & Dokumentasi",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Pencarian Whois",
         "description": "Cari detail pendaftaran domain dan IP melalui RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Mengambil sampel {docs} dokumen · {fields} bidang",
       "colField": "Bidang",
       "colTypes": "Tipe",
-      "colCoverage": "Cakupan"
+      "colCoverage": "Cakupan",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Tanggapan disalin ke clipboard",
       "codeCopied": "Disalin ke papan klip",
       "copyFailed": "Gagal menyalin ke papan klip",
-      "curlCopied": "Perintah cURL disalin"
+      "curlCopied": "Perintah cURL disalin",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Penagihan",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Bagikan secara anonim",
       "decline": "Tidak, terima kasih"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/it.json b/apps/desktop-ui/messages/it.json
index 8c2dbcdc..b87a0ad6 100644
--- a/apps/desktop-ui/messages/it.json
+++ b/apps/desktop-ui/messages/it.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Contatore di token",
     "webhookTester": "Tester di webhook",
     "websocketTester": "Tester WebSocket",
-    "whoisLookup": "Ricerca Whois"
+    "whoisLookup": "Ricerca Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Guida e documentazione",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Ricerca Whois",
         "description": "Cerca i dettagli di registrazione di domini e IP tramite RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "Risposta copiata negli appunti",
       "codeCopied": "Codice copiato negli appunti",
       "copyFailed": "Copia negli appunti non riuscita",
-      "curlCopied": "Comando cURL copiato"
+      "curlCopied": "Comando cURL copiato",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Collezioni",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "Condividi in forma anonima",
       "decline": "No, grazie"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/ja.json b/apps/desktop-ui/messages/ja.json
index 30f0a028..af066152 100644
--- a/apps/desktop-ui/messages/ja.json
+++ b/apps/desktop-ui/messages/ja.json
@@ -76,7 +76,8 @@
     "tokenCounter": "トークンカウンター",
     "webhookTester": "Webhook テスター",
     "websocketTester": "WebSocket テスター",
-    "whoisLookup": "Whois 検索"
+    "whoisLookup": "Whois 検索",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "ヘルプとドキュメント",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois 検索",
         "description": "RDAP を使ってドメインと IP の登録情報を調べます。"
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "{docs} 件のドキュメントをサンプリング · {fields} 個のフィールド",
       "colField": "フィールド",
       "colTypes": "型",
-      "colCoverage": "カバレッジ"
+      "colCoverage": "カバレッジ",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "レスポンスをクリップボードにコピーしました",
       "codeCopied": "コードをクリップボードにコピーしました",
       "copyFailed": "クリップボードへのコピーに失敗しました",
-      "curlCopied": "cURLコマンドをコピーしました"
+      "curlCopied": "cURLコマンドをコピーしました",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "コレクション",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "匿名で共有",
       "decline": "共有しない"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/ko.json b/apps/desktop-ui/messages/ko.json
index 07064145..7de62e42 100644
--- a/apps/desktop-ui/messages/ko.json
+++ b/apps/desktop-ui/messages/ko.json
@@ -76,7 +76,8 @@
     "tokenCounter": "토큰 카운터",
     "webhookTester": "Webhook 테스터",
     "websocketTester": "WebSocket 테스터",
-    "whoisLookup": "Whois 조회"
+    "whoisLookup": "Whois 조회",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "도움말 및 문서",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois 조회",
         "description": "RDAP를 통해 도메인과 IP 등록 정보를 조회합니다."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "{docs}개 문서 샘플링 · {fields}개 필드",
       "colField": "필드",
       "colTypes": "유형",
-      "colCoverage": "커버리지"
+      "colCoverage": "커버리지",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "응답이 클립보드에 복사되었습니다",
       "codeCopied": "코드가 클립보드에 복사되었습니다",
       "copyFailed": "클립보드에 복사하지 못했습니다",
-      "curlCopied": "cURL 명령이 복사되었습니다"
+      "curlCopied": "cURL 명령이 복사되었습니다",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "컬렉션",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "익명으로 공유",
       "decline": "괜찮습니다"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/ms.json b/apps/desktop-ui/messages/ms.json
index 5e3138d3..3486bafe 100644
--- a/apps/desktop-ui/messages/ms.json
+++ b/apps/desktop-ui/messages/ms.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Pengira Token",
     "webhookTester": "Penguji Webhook",
     "websocketTester": "Penguji WebSocket",
-    "whoisLookup": "Carian Whois"
+    "whoisLookup": "Carian Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Bantuan & Dokumentasi",
@@ -638,6 +639,10 @@
       "whoisLookup": {
         "title": "Carian Whois",
         "description": "Cari butiran pendaftaran domain dan IP melalui RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "Respons disalin ke papan klip",
       "codeCopied": "Kod disalin ke papan klip",
       "copyFailed": "Gagal menyalin ke papan klip",
-      "curlCopied": "Perintah cURL disalin"
+      "curlCopied": "Perintah cURL disalin",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Koleksi",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "Kongsi tanpa nama",
       "decline": "Tidak, terima kasih"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/nb.json b/apps/desktop-ui/messages/nb.json
index 244a3502..3cace2e7 100644
--- a/apps/desktop-ui/messages/nb.json
+++ b/apps/desktop-ui/messages/nb.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Token-teller",
     "webhookTester": "Webhook-tester",
     "websocketTester": "WebSocket-tester",
-    "whoisLookup": "Whois-oppslag"
+    "whoisLookup": "Whois-oppslag",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Hjelp og dokumentasjon",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois-oppslag",
         "description": "Slå opp registreringsdetaljer for domene og IP via RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Utvalg av {docs} dokumenter · {fields} felter",
       "colField": "Felt",
       "colTypes": "Typer",
-      "colCoverage": "Dekning"
+      "colCoverage": "Dekning",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Svar kopiert til utklippstavle",
       "codeCopied": "Kode kopiert til utklippstavle",
       "copyFailed": "Kopiering til utklippstavlen mislyktes",
-      "curlCopied": "cURL-kommando kopiert"
+      "curlCopied": "cURL-kommando kopiert",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Samlinger",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Del anonymt",
       "decline": "Nei takk"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/nl.json b/apps/desktop-ui/messages/nl.json
index 3e94ac0e..8c3961ce 100644
--- a/apps/desktop-ui/messages/nl.json
+++ b/apps/desktop-ui/messages/nl.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Token-teller",
     "webhookTester": "Webhook-tester",
     "websocketTester": "WebSocket-tester",
-    "whoisLookup": "Whois-opzoeking"
+    "whoisLookup": "Whois-opzoeking",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Help en documentatie",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois-opzoeking",
         "description": "Zoek registratiegegevens van een domein of IP op via RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "{docs} documenten bemonsterd · {fields} velden",
       "colField": "Veld",
       "colTypes": "Typen",
-      "colCoverage": "Dekking"
+      "colCoverage": "Dekking",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Antwoord gekopieerd naar klembord",
       "codeCopied": "Code gekopieerd naar klembord",
       "copyFailed": "Kopiëren naar klembord mislukt",
-      "curlCopied": "cURL-opdracht gekopieerd"
+      "curlCopied": "cURL-opdracht gekopieerd",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Collecties",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Anoniem delen",
       "decline": "Nee, bedankt"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/pl.json b/apps/desktop-ui/messages/pl.json
index 70acbfd6..b630e983 100644
--- a/apps/desktop-ui/messages/pl.json
+++ b/apps/desktop-ui/messages/pl.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Licznik tokenów",
     "webhookTester": "Tester webhooków",
     "websocketTester": "Tester WebSocket",
-    "whoisLookup": "Zapytanie Whois"
+    "whoisLookup": "Zapytanie Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Pomoc i dokumentacja",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Zapytanie Whois",
         "description": "Sprawdzaj dane rejestracyjne domen i adresów IP przez RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Próbkowano {docs} dokumentów · {fields} pól",
       "colField": "Pole",
       "colTypes": "Typy",
-      "colCoverage": "Pokrycie"
+      "colCoverage": "Pokrycie",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Response copied to clipboard",
       "codeCopied": "Code copied to clipboard",
       "copyFailed": "Kopiowanie do schowka nie powiodło się",
-      "curlCopied": "Skopiowano polecenie cURL"
+      "curlCopied": "Skopiowano polecenie cURL",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Collections",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Udostępnij anonimowo",
       "decline": "Nie, dziękuję"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/pt-BR.json b/apps/desktop-ui/messages/pt-BR.json
index 2ad26082..eff1e647 100644
--- a/apps/desktop-ui/messages/pt-BR.json
+++ b/apps/desktop-ui/messages/pt-BR.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Contador de Tokens",
     "webhookTester": "Testador de Webhook",
     "websocketTester": "Testador de WebSocket",
-    "whoisLookup": "Consulta Whois"
+    "whoisLookup": "Consulta Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Ajuda e documentação",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Consulta Whois",
         "description": "Consulte detalhes de registro de domínio e IP via RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Amostra de {docs} documentos · {fields} campos",
       "colField": "Campo",
       "colTypes": "Tipos",
-      "colCoverage": "Cobertura"
+      "colCoverage": "Cobertura",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Resposta copiada para a área de transferência",
       "codeCopied": "Código copiado para a área de transferência",
       "copyFailed": "Falha ao copiar para a área de transferência",
-      "curlCopied": "Comando cURL copiado"
+      "curlCopied": "Comando cURL copiado",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Coleções",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Compartilhar anonimamente",
       "decline": "Não, obrigado"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/pt.json b/apps/desktop-ui/messages/pt.json
index 83839c88..070df5aa 100644
--- a/apps/desktop-ui/messages/pt.json
+++ b/apps/desktop-ui/messages/pt.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Contador de tokens",
     "webhookTester": "Testador de webhooks",
     "websocketTester": "Testador de WebSocket",
-    "whoisLookup": "Pesquisa Whois"
+    "whoisLookup": "Pesquisa Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Ajuda e documentação",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Pesquisa Whois",
         "description": "Consulte os dados de registo de um domínio ou IP através de RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Amostra de {docs} documentos · {fields} campos",
       "colField": "Campo",
       "colTypes": "Tipos",
-      "colCoverage": "Cobertura"
+      "colCoverage": "Cobertura",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Resposta copiada para a área de transferência",
       "codeCopied": "Código copiado para a área de transferência",
       "copyFailed": "Falha ao copiar para a área de transferência",
-      "curlCopied": "Comando cURL copiado"
+      "curlCopied": "Comando cURL copiado",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Coleções",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Partilhar anonimamente",
       "decline": "Não, obrigado"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/ru.json b/apps/desktop-ui/messages/ru.json
index 342ec3d2..6e2b9679 100644
--- a/apps/desktop-ui/messages/ru.json
+++ b/apps/desktop-ui/messages/ru.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Счётчик токенов",
     "webhookTester": "Тестер вебхуков",
     "websocketTester": "Тестер WebSocket",
-    "whoisLookup": "Whois-запрос"
+    "whoisLookup": "Whois-запрос",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Справка и документация",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois-запрос",
         "description": "Узнавайте данные регистрации доменов и IP через RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Выборка из {docs} документов · {fields} полей",
       "colField": "Поле",
       "colTypes": "Типы",
-      "colCoverage": "Покрытие"
+      "colCoverage": "Покрытие",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Ответ скопирован в буфер обмена",
       "codeCopied": "Код скопирован в буфер обмена",
       "copyFailed": "Не удалось скопировать в буфер обмена",
-      "curlCopied": "Команда cURL скопирована"
+      "curlCopied": "Команда cURL скопирована",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Коллекции",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Делиться анонимно",
       "decline": "Нет, спасибо"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/sv.json b/apps/desktop-ui/messages/sv.json
index 2c6845e6..7b24e94a 100644
--- a/apps/desktop-ui/messages/sv.json
+++ b/apps/desktop-ui/messages/sv.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Token-räknare",
     "webhookTester": "Webhook-testare",
     "websocketTester": "WebSocket-testare",
-    "whoisLookup": "Whois-uppslag"
+    "whoisLookup": "Whois-uppslag",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Hjälp och dokumentation",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois-uppslag",
         "description": "Slå upp registreringsuppgifter för domäner och IP via RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "Svar kopierat till urklipp",
       "codeCopied": "Kod kopierad till urklipp",
       "copyFailed": "Kopiering till urklipp misslyckades",
-      "curlCopied": "cURL-kommando kopierat"
+      "curlCopied": "cURL-kommando kopierat",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Samlingar",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "Dela anonymt",
       "decline": "Nej tack"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/tr.json b/apps/desktop-ui/messages/tr.json
index 7d9d6106..d942f3cd 100644
--- a/apps/desktop-ui/messages/tr.json
+++ b/apps/desktop-ui/messages/tr.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Token Sayacı",
     "webhookTester": "Webhook Test Aracı",
     "websocketTester": "WebSocket Test Aracı",
-    "whoisLookup": "Whois Sorgulama"
+    "whoisLookup": "Whois Sorgulama",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Yardım ve Dokümantasyon",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois Sorgulama",
         "description": "Alan adı ve IP kayıt bilgilerini RDAP üzerinden sorgulayın."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "Yanıt panoya kopyalandı",
       "codeCopied": "Kod panoya kopyalandı",
       "copyFailed": "Panoya kopyalanamadı",
-      "curlCopied": "cURL komutu kopyalandı"
+      "curlCopied": "cURL komutu kopyalandı",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Koleksiyonlar",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "Anonim olarak paylaş",
       "decline": "Hayır, teşekkürler"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/uk.json b/apps/desktop-ui/messages/uk.json
index d9b4fcf7..c0ce94e6 100644
--- a/apps/desktop-ui/messages/uk.json
+++ b/apps/desktop-ui/messages/uk.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Лічильник токенів",
     "webhookTester": "Тестер вебхуків",
     "websocketTester": "Тестер WebSocket",
-    "whoisLookup": "Whois-запит"
+    "whoisLookup": "Whois-запит",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Довідка та документація",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois-запит",
         "description": "Дізнавайтеся дані реєстрації доменів та IP через RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -2278,7 +2283,8 @@
       "responseCopied": "Відповідь скопійовано до буфера обміну",
       "codeCopied": "Код скопійовано до буфера обміну",
       "copyFailed": "Не вдалося скопіювати до буфера обміну",
-      "curlCopied": "Команду cURL скопійовано"
+      "curlCopied": "Команду cURL скопійовано",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Колекції",
@@ -2448,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5226,69 @@
       "accept": "Ділитися анонімно",
       "decline": "Ні, дякую"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/vi.json b/apps/desktop-ui/messages/vi.json
index bca53f10..eb148b32 100644
--- a/apps/desktop-ui/messages/vi.json
+++ b/apps/desktop-ui/messages/vi.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Bộ đếm token",
     "webhookTester": "Trình kiểm tra Webhook",
     "websocketTester": "Trình kiểm tra WebSocket",
-    "whoisLookup": "Tra cứu Whois"
+    "whoisLookup": "Tra cứu Whois",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "Trợ giúp & Tài liệu",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Tra cứu Whois",
         "description": "Tra cứu thông tin đăng ký tên miền và IP qua RDAP."
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "Đã lấy mẫu {docs} tài liệu · {fields} trường",
       "colField": "Trường",
       "colTypes": "Loại",
-      "colCoverage": "Độ phủ"
+      "colCoverage": "Độ phủ",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "Đã sao chép phản hồi vào bộ nhớ tạm",
       "codeCopied": "Đã sao chép mã vào bộ nhớ tạm",
       "copyFailed": "Sao chép vào clipboard không thành công",
-      "curlCopied": "Đã sao chép lệnh cURL"
+      "curlCopied": "Đã sao chép lệnh cURL",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Bộ sưu tập",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "Chia sẻ ẩn danh",
       "decline": "Không, cảm ơn"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/messages/zh.json b/apps/desktop-ui/messages/zh.json
index 2a5e15b1..ac45e163 100644
--- a/apps/desktop-ui/messages/zh.json
+++ b/apps/desktop-ui/messages/zh.json
@@ -76,7 +76,8 @@
     "tokenCounter": "Token 计数器",
     "webhookTester": "Webhook 测试器",
     "websocketTester": "WebSocket 测试器",
-    "whoisLookup": "Whois 查询"
+    "whoisLookup": "Whois 查询",
+    "secureFiles": "Files"
   },
   "Help": {
     "title": "帮助与文档",
@@ -635,6 +636,10 @@
       "whoisLookup": {
         "title": "Whois 查询",
         "description": "通过 RDAP 查询域名和 IP 的注册信息。"
+      },
+      "secureFiles": {
+        "title": "Files",
+        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
       }
     },
     "tabs": {
@@ -1926,7 +1931,18 @@
       "sampled": "已抽样 {docs} 个文档 · {fields} 个字段",
       "colField": "字段",
       "colTypes": "类型",
-      "colCoverage": "覆盖率"
+      "colCoverage": "覆盖率",
+      "sampleRandom": "Random",
+      "sampleFirst": "First",
+      "sampleLast": "Last",
+      "sampleAll": "All",
+      "sampleSizeN": "{n} docs",
+      "allCapped": "capped at 10k",
+      "validatorTitle": "Validation rules",
+      "exportSchemaBtn": "Export",
+      "exportJsonSchema": "JSON Schema",
+      "exportMongoose": "Mongoose model",
+      "exportHtml": "HTML report"
     }
   },
   "DataExplorer": {
@@ -2267,7 +2283,8 @@
       "responseCopied": "响应已复制到剪贴板",
       "codeCopied": "代码已复制到剪贴板",
       "copyFailed": "复制到剪贴板失败",
-      "curlCopied": "已复制 cURL 命令"
+      "curlCopied": "已复制 cURL 命令",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "集合",
@@ -2437,7 +2454,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5200,5 +5226,69 @@
       "accept": "匿名共享",
       "decline": "不用了"
     }
+  },
+  "SecureFiles": {
+    "title": "Files",
+    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
+    "desktopOnly": "Secure Files is available in the desktop app.",
+    "allFiles": "All files",
+    "breadcrumb": "Folder path",
+    "addFiles": "Add files",
+    "addFolder": "Add folder",
+    "newFolder": "New folder",
+    "lock": "Lock",
+    "settings": "Storage settings",
+    "storageFolder": "Storage folder",
+    "notSet": "Not set",
+    "chooseFolder": "Choose folder",
+    "changeFolder": "Change folder…",
+    "chooseFolderTitle": "Choose where encrypted files are stored",
+    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
+    "changeFolderTitle": "Move encrypted files?",
+    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
+    "folderSet": "Storage folder set",
+    "movedCount": "Moved {count} encrypted files",
+    "importedCount": "Encrypted {count} files",
+    "emptyTitle": "No files here yet",
+    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
+    "name": "Name",
+    "size": "Size",
+    "modified": "Modified",
+    "actions": "Actions",
+    "expand": "Expand",
+    "collapse": "Collapse",
+    "preview": "Preview",
+    "noPreview": "No preview for this file type — export it to open it in another app.",
+    "export": "Export",
+    "exportWarningTitle": "Export a decrypted copy?",
+    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
+    "exported": "Decrypted copy exported",
+    "replace": "Replace contents…",
+    "replaced": "File contents replaced",
+    "rename": "Rename",
+    "fileName": "File name",
+    "move": "Move to folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
+    "folderName": "Folder name",
+    "delete": "Delete",
+    "deleted": "File deleted",
+    "deletedCount": "Deleted {count} files",
+    "deleteFileTitle": "Delete this file?",
+    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
+    "deleteFolderTitle": "Delete this folder?",
+    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
+    "unreadableCount": "{count} files in the storage folder could not be read",
+    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
+    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
+    "cancel": "Cancel",
+    "save": "Save",
+    "folderMissingTitle": "Storage folder not found",
+    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
+    "dismiss": "Dismiss",
+    "viewGrid": "Grid view",
+    "viewList": "List view",
+    "emptyFolderAdded": "Folder added — it had no files to encrypt",
+    "importFolder": "Import folder"
   }
 }
diff --git a/apps/desktop-ui/package.json b/apps/desktop-ui/package.json
index 2f02c1d5..e8d10964 100644
--- a/apps/desktop-ui/package.json
+++ b/apps/desktop-ui/package.json
@@ -53,6 +53,7 @@
     "@tanstack/react-virtual": "^3.14.10",
     "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-deep-link": "^2.4.9",
+    "@tauri-apps/plugin-dialog": "^2.7.2",
     "@tauri-apps/plugin-opener": "^2.5.4",
     "@tauri-apps/plugin-process": "^2.3.1",
     "@tauri-apps/plugin-updater": "^2.10.1",
diff --git a/apps/desktop-ui/src/app/app/secure-files/layout.tsx b/apps/desktop-ui/src/app/app/secure-files/layout.tsx
new file mode 100644
index 00000000..2c33eefe
--- /dev/null
+++ b/apps/desktop-ui/src/app/app/secure-files/layout.tsx
@@ -0,0 +1,7 @@
+import { generateToolMetadata } from '@/lib/metadata'
+
+export const metadata = generateToolMetadata('secure-files')
+
+export default function SecureFilesLayout({ children }: { children: React.ReactNode }) {
+  return <>{children}</>
+}
diff --git a/apps/desktop-ui/src/app/app/secure-files/page.tsx b/apps/desktop-ui/src/app/app/secure-files/page.tsx
new file mode 100644
index 00000000..85748677
--- /dev/null
+++ b/apps/desktop-ui/src/app/app/secure-files/page.tsx
@@ -0,0 +1,20 @@
+"use client";
+import { useTranslations } from "next-intl";
+import { SecureFilesTool } from "@/components/secure-files/secure-files-tool";
+import { useVaultGuard } from "@/hooks/use-vault-guard";
+import { VaultLockedPlaceholder } from "@/components/vault-locked-placeholder";
+import { VaultRestoringSkeleton } from "@/components/vault-restoring-skeleton";
+import { isDesktop } from "@/lib/desktop/is-desktop";
+
+export default function SecureFilesPage() {
+  const t = useTranslations("SecureFiles");
+  // Files are encrypted with a key derived from the master password; the
+  // Rust side only holds that key while the vault is unlocked.
+  const { isUnlocked, isRestoring } = useVaultGuard();
+  if (!isDesktop()) {
+    return <p className="p-8 text-center text-sm text-muted-foreground">{t("desktopOnly")}</p>;
+  }
+  if (isRestoring) return <VaultRestoringSkeleton />;
+  if (!isUnlocked) return <VaultLockedPlaceholder appName={t("title")} />;
+  return <SecureFilesTool />;
+}
diff --git a/apps/desktop-ui/src/components/master-password-gate.tsx b/apps/desktop-ui/src/components/master-password-gate.tsx
index 847a7c23..3e0ebc38 100644
--- a/apps/desktop-ui/src/components/master-password-gate.tsx
+++ b/apps/desktop-ui/src/components/master-password-gate.tsx
@@ -43,6 +43,7 @@ import {
     storeBackupCodes,
     lookupBackupCode,
     markBackupCodeUsed,
+    unlockSecureVault,
 } from "@/lib/global-vault-api"
 import { useMasterKeyStore } from "@/store/master-key-store"
 import { calcStrength } from "./master-password-gate/password-strength"
@@ -154,6 +155,7 @@ export function MasterPasswordGate() {
             )
             await storeBackupCodes(encryptedCodes)
 
+            await unlockSecureVault(password)
             setKey(key)
             setBackupCodes(codes)
             resetForm()
@@ -186,6 +188,7 @@ export function MasterPasswordGate() {
             }
 
             if (valid) {
+                await unlockSecureVault(password)
                 setKey(key)
                 resetForm()
             } else {
@@ -234,6 +237,7 @@ export function MasterPasswordGate() {
             }
 
             await markBackupCodeUsed(codeId)
+            await unlockSecureVault(masterPassword)
             setKey(key)
             toast.success("Unlocked via backup code. That code is now consumed.")
         } catch (err: any) {
diff --git a/apps/desktop-ui/src/components/s3-drive/file-preview-dialog.tsx b/apps/desktop-ui/src/components/s3-drive/file-preview-dialog.tsx
index a4e04f15..19c191f0 100644
--- a/apps/desktop-ui/src/components/s3-drive/file-preview-dialog.tsx
+++ b/apps/desktop-ui/src/components/s3-drive/file-preview-dialog.tsx
@@ -2,7 +2,7 @@
 
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog"
 import { Button } from "@/components/ui/button"
-import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip"
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip"
 import { IconDownload, IconLoader2, IconX } from "@tabler/icons-react"
 import { cn } from "@/lib/utils"
 import { FileIconComp } from "./file-icon"
@@ -87,6 +87,9 @@ export function FilePreviewDialog({
     })()
 
     return (
+        // Provider lives here so every consumer of this dialog gets working
+        // tooltips — Radix Tooltip throws without an ancestor provider.
+        <TooltipProvider delayDuration={300}>
         <Dialog open onOpenChange={(o) => !o && onClose()}>
             <DialogContent className="max-w-5xl w-full p-0 overflow-hidden gap-0 flex flex-col">
                 <DialogHeader className="flex flex-row items-center justify-between px-5 py-3 border-b shrink-0 bg-muted/20">
@@ -113,5 +116,6 @@ export function FilePreviewDialog({
                 {body}
             </DialogContent>
         </Dialog>
+        </TooltipProvider>
     )
 }
diff --git a/apps/desktop-ui/src/components/secure-files/folder-tree.tsx b/apps/desktop-ui/src/components/secure-files/folder-tree.tsx
new file mode 100644
index 00000000..6cb9b185
--- /dev/null
+++ b/apps/desktop-ui/src/components/secure-files/folder-tree.tsx
@@ -0,0 +1,192 @@
+"use client"
+
+import React, { useEffect, useState } from "react"
+import { AnimatePresence, motion } from "framer-motion"
+import { IconChevronRight, IconDots, IconFolder, IconFolderOpen, IconPencil, IconTrash } from "@tabler/icons-react"
+import { useTranslations } from "next-intl"
+import { Button } from "@/components/ui/button"
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu"
+import { useToolSidebarPanel } from "@/components/tools/tool-sidebar"
+import { cn } from "@/lib/utils"
+import type { FolderNode } from "@/lib/secure-files"
+
+type Actions = {
+  onSelect: (path: string) => void
+  onRename: (path: string) => void
+  onDelete: (path: string) => void
+}
+
+function ancestors(path: string): string[] {
+  const out: string[] = []
+  let i = path.indexOf("/")
+  while (i !== -1) {
+    out.push(path.slice(0, i))
+    i = path.indexOf("/", i + 1)
+  }
+  return out
+}
+
+export function FolderTree({ root, currentDir, ...actions }: { root: FolderNode; currentDir: string } & Actions) {
+  const t = useTranslations("SecureFiles")
+  const panel = useToolSidebarPanel()
+  const [expanded, setExpanded] = useState<Set<string>>(() => new Set(ancestors(currentDir)))
+
+  // Keep the selected folder visible when navigation happens from the main pane.
+  useEffect(() => {
+    const need = ancestors(currentDir)
+    if (need.every((p) => expanded.has(p))) return
+    setExpanded((prev) => new Set([...prev, ...need]))
+  }, [currentDir, expanded])
+
+  const toggle = React.useCallback((path: string) => {
+    setExpanded((prev) => {
+      const next = new Set(prev)
+      if (next.has(path)) next.delete(path)
+      else next.add(path)
+      return next
+    })
+  }, [])
+
+  const select = React.useCallback(
+    (path: string) => {
+      actions.onSelect(path)
+      panel?.close()
+    },
+    [actions, panel],
+  )
+
+  return (
+    <div className="flex-1 overflow-y-auto p-2">
+      <button
+        type="button"
+        onClick={() => select("")}
+        className={cn(
+          "flex w-full items-center gap-2 rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-muted",
+          currentDir === "" && "bg-muted font-medium",
+        )}
+      >
+        <IconFolderOpen className="size-4 shrink-0 text-muted-foreground" />
+        <span className="truncate">{t("allFiles")}</span>
+      </button>
+      {root.children.map((child) => (
+        <FolderRow
+          key={child.path}
+          node={child}
+          depth={0}
+          currentDir={currentDir}
+          expanded={expanded}
+          onToggle={toggle}
+          onSelect={select}
+          onRename={actions.onRename}
+          onDelete={actions.onDelete}
+        />
+      ))}
+    </div>
+  )
+}
+
+type RowProps = {
+  node: FolderNode
+  depth: number
+  currentDir: string
+  expanded: Set<string>
+  onToggle: (path: string) => void
+} & Actions
+
+const FolderRow = React.memo(function FolderRow({
+  node,
+  depth,
+  currentDir,
+  expanded,
+  onToggle,
+  onSelect,
+  onRename,
+  onDelete,
+}: RowProps) {
+  const t = useTranslations("SecureFiles")
+  const open = expanded.has(node.path)
+  const hasChildren = node.children.length > 0
+  const active = currentDir === node.path
+
+  return (
+    <div>
+      <div
+        className={cn(
+          "group flex items-center gap-1 rounded-md pr-1 text-sm transition-colors hover:bg-muted",
+          active && "bg-muted font-medium",
+        )}
+        style={{ paddingLeft: depth * 12 + 4 }}
+      >
+        <button
+          type="button"
+          aria-label={open ? t("collapse") : t("expand")}
+          onClick={() => onToggle(node.path)}
+          className={cn("flex size-5 shrink-0 items-center justify-center rounded text-muted-foreground", !hasChildren && "invisible")}
+        >
+          <IconChevronRight className={cn("size-3.5 transition-transform duration-200", open && "rotate-90")} />
+        </button>
+        <button
+          type="button"
+          onClick={() => onSelect(node.path)}
+          className="flex min-w-0 flex-1 items-center gap-2 py-1.5 text-left"
+        >
+          <IconFolder className="size-4 shrink-0 text-amber-500" />
+          <span className="truncate">{node.name}</span>
+          {node.files.length > 0 && (
+            <span className="ml-auto text-[11px] tabular-nums text-muted-foreground">{node.files.length}</span>
+          )}
+        </button>
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <Button
+              size="icon"
+              variant="ghost"
+              aria-label={t("actions")}
+              className="size-6 opacity-0 group-hover:opacity-100 data-[state=open]:opacity-100"
+            >
+              <IconDots className="size-3.5" />
+            </Button>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuItem onClick={() => onRename(node.path)}>
+              <IconPencil className="size-4" /> {t("rename")}
+            </DropdownMenuItem>
+            <DropdownMenuItem onClick={() => onDelete(node.path)} className="text-destructive focus:text-destructive">
+              <IconTrash className="size-4" /> {t("delete")}
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </div>
+      <AnimatePresence initial={false}>
+        {open && hasChildren && (
+          <motion.div
+            initial={{ opacity: 0, height: 0 }}
+            animate={{ opacity: 1, height: "auto" }}
+            exit={{ opacity: 0, height: 0 }}
+            transition={{ duration: 0.2 }}
+            className="overflow-hidden"
+          >
+            {node.children.map((child) => (
+              <FolderRow
+                key={child.path}
+                node={child}
+                depth={depth + 1}
+                currentDir={currentDir}
+                expanded={expanded}
+                onToggle={onToggle}
+                onSelect={onSelect}
+                onRename={onRename}
+                onDelete={onDelete}
+              />
+            ))}
+          </motion.div>
+        )}
+      </AnimatePresence>
+    </div>
+  )
+})
diff --git a/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx b/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
new file mode 100644
index 00000000..1a76b018
--- /dev/null
+++ b/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
@@ -0,0 +1,721 @@
+"use client"
+
+import React, { useCallback, useEffect, useMemo, useRef, useState } from "react"
+import { useTranslations } from "next-intl"
+import { toast } from "sonner"
+import { FolderLock } from "lucide-react"
+import {
+  IconAlertTriangle,
+  IconChevronRight,
+  IconDots,
+  IconDownload,
+  IconEye,
+  IconFolder,
+  IconFolderPlus,
+  IconFolderSymlink,
+  IconLock,
+  IconPencil,
+  IconPlus,
+  IconLayoutGrid,
+  IconList,
+  IconReplace,
+  IconSettings,
+  IconTrash,
+  IconX,
+} from "@tabler/icons-react"
+import { Button } from "@/components/ui/button"
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from "@/components/ui/dialog"
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu"
+import { Input } from "@/components/ui/input"
+import { Label } from "@/components/ui/label"
+import { ToolSidebarLayout } from "@/components/tools/tool-sidebar"
+import { useConfirm } from "@/components/confirm-dialog"
+import { FilePreviewDialog, type PreviewState } from "@/components/s3-drive/file-preview-dialog"
+import { FileIconComp } from "@/components/s3-drive/file-icon"
+import { getFileType, isPreviewable } from "@/components/s3-drive/file-types"
+import { useMasterKeyStore } from "@/store/master-key-store"
+import {
+  baseName,
+  buildFolderTree,
+  joinDir,
+  looksLikeText,
+  parentDir,
+  visibleRange,
+  type FolderNode,
+  type SecureFileEntry,
+} from "@/lib/secure-files"
+import {
+  deleteSecureFile,
+  deleteSecureFolder,
+  exportSecureFile,
+  getSecureFilesSettings,
+  importSecureFiles,
+  listSecureFiles,
+  patchSecureFile,
+  pickFiles,
+  pickFolder,
+  pickSavePath,
+  readSecureFile,
+  renameSecureFolder,
+  replaceSecureFile,
+  setSecureFilesDir,
+  type SecureFilesSettings,
+} from "@/lib/secure-files-api"
+import { FolderTree } from "./folder-tree"
+import { cn } from "@/lib/utils"
+import { safeGetItem, safeGetJSON, safeSetItem, safeSetJSON } from "@/lib/safe-storage"
+
+const DISMISSED_ERRORS_KEY = "secureFilesDismissedErrors"
+const VIEW_KEY = "secureFilesView"
+/** Empty (not yet populated) logical folders — they only exist in metadata
+ *  once a file lands in them, so keep the empty ones across lock/reload. */
+const EXTRA_DIRS_KEY = "secureFilesEmptyDirs"
+
+/** Stable fingerprint of an unreadable-files set: same set stays dismissed,
+ *  a new/different set brings the banner back. */
+function errorsKey(errors: { id: string }[]): string {
+  return errors
+    .map((e) => e.id)
+    .sort()
+    .join(",")
+}
+
+// ponytail: 5th formatBytes copy in the repo; promote to lib/utils when touching the others.
+function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B"
+  const units = ["B", "KB", "MB", "GB"]
+  const i = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1)
+  return `${(bytes / 1024 ** i).toFixed(i === 0 ? 0 : 1)} ${units[i]}`
+}
+
+function errMsg(e: unknown): string {
+  return e instanceof Error ? e.message : String(e)
+}
+
+function findNode(root: FolderNode, path: string): FolderNode | null {
+  if (path === "") return root
+  for (const c of root.children) {
+    if (c.path === path) return c
+    if (path.startsWith(`${c.path}/`)) return findNode(c, path)
+  }
+  return null
+}
+
+function blobMime(fileType: string, name: string): string {
+  const ext = name.split(".").pop()?.toLowerCase() ?? ""
+  if (fileType === "pdf") return "application/pdf"
+  if (fileType === "image") return ext === "svg" ? "image/svg+xml" : `image/${ext === "jpg" ? "jpeg" : ext}`
+  if (fileType === "video") return `video/${ext}`
+  if (fileType === "audio") return `audio/${ext}`
+  return "application/octet-stream"
+}
+
+type PathDialogState = {
+  title: string
+  label: string
+  hint?: string
+  initial: string
+  /** Empty input is valid (move to root). */
+  allowEmpty?: boolean
+  onSubmit: (value: string) => Promise<void>
+}
+
+export function SecureFilesTool() {
+  const t = useTranslations("SecureFiles")
+  const { confirm, dialog: confirmDialog } = useConfirm()
+  const lockVault = useMasterKeyStore((s) => s.lock)
+
+  const [settings, setSettings] = useState<SecureFilesSettings | null>(null)
+  const [files, setFiles] = useState<SecureFileEntry[]>([])
+  const [errors, setErrors] = useState<{ id: string; error: string }[]>([])
+  const [extraDirs, setExtraDirs] = useState<string[]>(() => safeGetJSON<string[]>(EXTRA_DIRS_KEY) ?? [])
+  const [currentDir, setCurrentDir] = useState("")
+  const [view, setView] = useState<"list" | "grid">(() => (safeGetItem(VIEW_KEY) === "grid" ? "grid" : "list"))
+  const [loading, setLoading] = useState(true)
+  const [busy, setBusy] = useState(false)
+  const [preview, setPreview] = useState<PreviewState | null>(null)
+  const [pathDialog, setPathDialog] = useState<PathDialogState | null>(null)
+  const [dismissedErrors, setDismissedErrors] = useState(() => safeGetItem(DISMISSED_ERRORS_KEY) ?? "")
+
+  // Virtual scrolling: rows have fixed heights, only the visible window is
+  // mounted — keeps 100k-file folders responsive.
+  const scrollRef = useRef<HTMLDivElement | null>(null)
+  const [scrollTop, setScrollTop] = useState(0)
+  const [viewport, setViewport] = useState({ w: 800, h: 600 })
+  useEffect(() => {
+    const el = scrollRef.current
+    if (!el) return
+    const measure = () => setViewport({ w: el.clientWidth, h: el.clientHeight })
+    measure()
+    const ro = new ResizeObserver(measure)
+    ro.observe(el)
+    return () => ro.disconnect()
+  }, [])
+  const previewUrl = useRef<string | null>(null)
+
+  const revokePreview = useCallback(() => {
+    if (previewUrl.current) URL.revokeObjectURL(previewUrl.current)
+    previewUrl.current = null
+  }, [])
+  useEffect(() => revokePreview, [revokePreview])
+
+  const reload = useCallback(async () => {
+    try {
+      const s = await getSecureFilesSettings()
+      setSettings(s)
+      if (s.dir && s.exists) {
+        const r = await listSecureFiles()
+        setFiles(r.files)
+        setErrors(r.errors)
+      }
+    } catch (e) {
+      toast.error(errMsg(e))
+    } finally {
+      setLoading(false)
+    }
+  }, [])
+  useEffect(() => {
+    void reload()
+  }, [reload])
+
+  /** Run a mutation, toast the outcome, refresh the listing. */
+  const run = useCallback(
+    async (fn: () => Promise<string | void>) => {
+      setBusy(true)
+      try {
+        const msg = await fn()
+        if (msg) toast.success(msg)
+        await reload()
+      } catch (e) {
+        toast.error(errMsg(e))
+      } finally {
+        setBusy(false)
+      }
+    },
+    [reload],
+  )
+
+  useEffect(() => {
+    safeSetJSON(EXTRA_DIRS_KEY, extraDirs)
+  }, [extraDirs])
+
+  const tree = useMemo(() => buildFolderTree(files, extraDirs), [files, extraDirs])
+  const node = findNode(tree, currentDir) ?? tree
+  useEffect(() => {
+    if (!findNode(tree, currentDir)) setCurrentDir("")
+  }, [tree, currentDir])
+  useEffect(() => {
+    scrollRef.current?.scrollTo({ top: 0 })
+    setScrollTop(0)
+  }, [currentDir, view])
+
+  type ViewItem = { kind: "folder"; folder: FolderNode } | { kind: "file"; file: SecureFileEntry }
+  const items: ViewItem[] = useMemo(
+    () => [
+      ...node.children.map((folder) => ({ kind: "folder" as const, folder })),
+      ...node.files.map((file) => ({ kind: "file" as const, file })),
+    ],
+    [node],
+  )
+
+  // ── Storage folder ─────────────────────────────────────────────────────
+
+  const chooseFolder = async () => {
+    if (settings?.dir) {
+      const ok = await confirm({
+        title: t("changeFolderTitle"),
+        description: t("changeFolderBody"),
+        confirmLabel: t("chooseFolder"),
+      })
+      if (!ok) return
+    }
+    const dir = await pickFolder()
+    if (!dir) return
+    await run(async () => {
+      const r = await setSecureFilesDir(dir)
+      return r.moved > 0 ? t("movedCount", { count: r.moved }) : t("folderSet")
+    })
+  }
+
+  // ── Import ─────────────────────────────────────────────────────────────
+
+  const importPaths = async (paths: string[]) => {
+    if (paths.length === 0) return
+    await run(async () => {
+      const r = await importSecureFiles(paths, currentDir)
+      // Empty folders produce no entries; keep them visible in the tree.
+      if (r.dirs.length > 0) setExtraDirs((prev) => [...new Set([...prev, ...r.dirs])])
+      for (const e of r.errors) toast.error(`${baseName(e.path)}: ${e.error}`)
+      if (r.imported.length > 0) return t("importedCount", { count: r.imported.length })
+      if (r.dirs.length > 0 && r.errors.length === 0) return t("emptyFolderAdded")
+      return undefined
+    })
+  }
+  const addFiles = async () => importPaths(await pickFiles())
+  const addFolder = async () => {
+    const dir = await pickFolder()
+    if (dir) await importPaths([dir])
+  }
+
+  // "Add folder" — creates a logical folder inside the folder being viewed.
+  const newFolder = () =>
+    setPathDialog({
+      title: t("addFolder"),
+      label: t("folderName"),
+      initial: "",
+      onSubmit: async (name) => {
+        const path = joinDir(currentDir, name)
+        setExtraDirs((d) => (d.includes(path) ? d : [...d, path]))
+        setCurrentDir(path)
+      },
+    })
+
+  // ── File actions ───────────────────────────────────────────────────────
+
+  const openPreview = async (f: SecureFileEntry) => {
+    const type = getFileType(f.name)
+    setPreview({ key: f.name, url: null, loading: true, fileType: type })
+    try {
+      const bytes = new Uint8Array(await readSecureFile(f.id))
+      let fileType = type
+      let textContent: string | undefined
+      if (type === "code" || type === "doc" || type === "sheet" || (type === "file" && looksLikeText(bytes))) {
+        fileType = "code"
+        textContent = new TextDecoder().decode(bytes)
+      }
+      if (!isPreviewable(fileType)) {
+        setPreview(null)
+        toast.info(t("noPreview"))
+        return
+      }
+      revokePreview()
+      const url = URL.createObjectURL(new Blob([bytes], { type: blobMime(fileType, f.name) }))
+      previewUrl.current = url
+      setPreview({ key: f.name, url, loading: false, fileType, textContent })
+    } catch (e) {
+      setPreview(null)
+      toast.error(errMsg(e))
+    }
+  }
+  const closePreview = () => {
+    revokePreview()
+    setPreview(null)
+  }
+
+  const exportFile = async (f: SecureFileEntry) => {
+    const ok = await confirm({
+      title: t("exportWarningTitle"),
+      description: t("exportWarningBody"),
+      confirmLabel: t("export"),
+    })
+    if (!ok) return
+    const path = await pickSavePath(f.name)
+    if (!path) return
+    await run(async () => {
+      await exportSecureFile(f.id, path)
+      return t("exported")
+    })
+  }
+
+  const replaceFile = async (f: SecureFileEntry) => {
+    const { open } = await import("@tauri-apps/plugin-dialog")
+    const path = await open({ multiple: false })
+    if (!path) return
+    await run(async () => {
+      await replaceSecureFile(f.id, path)
+      return t("replaced")
+    })
+  }
+
+  const renameFile = (f: SecureFileEntry) =>
+    setPathDialog({
+      title: t("rename"),
+      label: t("fileName"),
+      initial: f.name,
+      onSubmit: (name) => run(() => patchSecureFile(f.id, { name }).then(() => undefined)),
+    })
+
+  const moveFile = (f: SecureFileEntry) =>
+    setPathDialog({
+      title: t("move"),
+      label: t("targetFolder"),
+      hint: t("targetFolderHint"),
+      initial: f.dir,
+      allowEmpty: true,
+      onSubmit: (dir) => run(() => patchSecureFile(f.id, { dir: dir.replace(/^\/+|\/+$/g, "") }).then(() => undefined)),
+    })
+
+  const deleteFile = async (f: SecureFileEntry) => {
+    const ok = await confirm({
+      title: t("deleteFileTitle"),
+      description: t("deleteFileBody", { name: f.name }),
+      confirmLabel: t("delete"),
+      destructive: true,
+    })
+    if (ok) await run(() => deleteSecureFile(f.id).then(() => t("deleted")))
+  }
+
+  // ── Folder actions ─────────────────────────────────────────────────────
+
+  const renameFolder = (path: string) =>
+    setPathDialog({
+      title: t("rename"),
+      label: t("folderName"),
+      initial: baseName(path),
+      onSubmit: async (name) => {
+        const to = joinDir(parentDir(path), name)
+        await run(async () => {
+          await renameSecureFolder(path, to)
+          setExtraDirs((d) => d.map((x) => (x === path || x.startsWith(`${path}/`) ? to + x.slice(path.length) : x)))
+          if (currentDir === path || currentDir.startsWith(`${path}/`)) setCurrentDir(to + currentDir.slice(path.length))
+        })
+      },
+    })
+
+  const deleteFolder = async (path: string) => {
+    const ok = await confirm({
+      title: t("deleteFolderTitle"),
+      description: t("deleteFolderBody", { dir: path }),
+      confirmLabel: t("delete"),
+      destructive: true,
+    })
+    if (!ok) return
+    await run(async () => {
+      const r = await deleteSecureFolder(path)
+      setExtraDirs((d) => d.filter((x) => x !== path && !x.startsWith(`${path}/`)))
+      if (currentDir === path || currentDir.startsWith(`${path}/`)) setCurrentDir(parentDir(path))
+      return t("deletedCount", { count: r.deleted })
+    })
+  }
+
+  // ── Render ─────────────────────────────────────────────────────────────
+
+  const crumbs = currentDir ? currentDir.split("/") : []
+  const hasDir = !!settings?.dir && settings.exists
+  const dirMissing = !!settings?.dir && !settings.exists
+
+  const folderMenu = (path: string) => (
+    <>
+      <DropdownMenuItem onClick={() => renameFolder(path)}><IconPencil className="size-4" /> {t("rename")}</DropdownMenuItem>
+      <DropdownMenuItem onClick={() => deleteFolder(path)} className="text-destructive focus:text-destructive"><IconTrash className="size-4" /> {t("delete")}</DropdownMenuItem>
+    </>
+  )
+  const fileMenu = (f: SecureFileEntry) => (
+    <>
+      <DropdownMenuItem onClick={() => openPreview(f)}><IconEye className="size-4" /> {t("preview")}</DropdownMenuItem>
+      <DropdownMenuItem onClick={() => exportFile(f)}><IconDownload className="size-4" /> {t("export")}</DropdownMenuItem>
+      <DropdownMenuItem onClick={() => replaceFile(f)}><IconReplace className="size-4" /> {t("replace")}</DropdownMenuItem>
+      <DropdownMenuItem onClick={() => renameFile(f)}><IconPencil className="size-4" /> {t("rename")}</DropdownMenuItem>
+      <DropdownMenuItem onClick={() => moveFile(f)}><IconFolderSymlink className="size-4" /> {t("move")}</DropdownMenuItem>
+      <DropdownMenuSeparator />
+      <DropdownMenuItem onClick={() => deleteFile(f)} className="text-destructive focus:text-destructive"><IconTrash className="size-4" /> {t("delete")}</DropdownMenuItem>
+    </>
+  )
+
+  const LIST_ROW_H = 36
+  const GRID_ROW_H = 128
+  const listCols = "grid-cols-[minmax(0,1fr)_6rem_2.5rem] md:grid-cols-[minmax(0,1fr)_6rem_8rem_2.5rem]"
+  const cols = view === "grid" ? Math.max(1, Math.floor((viewport.w - 24) / 124)) : 1
+  const rowH = view === "grid" ? GRID_ROW_H : LIST_ROW_H
+  const rowCount = Math.ceil(items.length / cols)
+  const [startRow, endRow] = visibleRange(scrollTop, viewport.h, rowH, rowCount)
+
+  const listRow = (it: ViewItem) => {
+    const cell = "flex h-full min-w-0 items-center"
+    if (it.kind === "folder") {
+      return (
+        <div key={it.folder.path} style={{ height: LIST_ROW_H }} className={cn("group grid items-center border-b border-border/50 hover:bg-muted/50", listCols)}>
+          <button type="button" className={cn(cell, "gap-2 px-4 text-left")} onClick={() => setCurrentDir(it.folder.path)}>
+            <IconFolder className="size-4 shrink-0 text-amber-500" />
+            <span className="truncate">{it.folder.name}</span>
+          </button>
+          <span className="px-2 text-right text-muted-foreground">—</span>
+          <span className="hidden md:block" />
+          <span className="px-2 text-right"><RowMenu label={t("actions")}>{folderMenu(it.folder.path)}</RowMenu></span>
+        </div>
+      )
+    }
+    const f = it.file
+    return (
+      <div key={f.id} style={{ height: LIST_ROW_H }} className={cn("group grid items-center border-b border-border/50 hover:bg-muted/50", listCols)}>
+        <button type="button" className={cn(cell, "gap-2 px-4 text-left")} onClick={() => openPreview(f)}>
+          <FileIconComp type={getFileType(f.name)} className="size-4 shrink-0" />
+          <span className="truncate">{f.name}</span>
+        </button>
+        <span className="px-2 text-right tabular-nums text-muted-foreground">{formatBytes(f.size)}</span>
+        <span className="hidden px-2 text-right tabular-nums text-muted-foreground md:block">{new Date(f.mtime).toLocaleDateString()}</span>
+        <span className="px-2 text-right"><RowMenu label={t("actions")}>{fileMenu(f)}</RowMenu></span>
+      </div>
+    )
+  }
+
+  const tile = (it: ViewItem) => {
+    const isFolder = it.kind === "folder"
+    const key = isFolder ? it.folder.path : it.file.id
+    const name = isFolder ? it.folder.name : it.file.name
+    return (
+      <div key={key} className="group relative min-w-0">
+        <button
+          type="button"
+          className="flex h-full w-full flex-col items-center gap-1.5 rounded-lg p-3 pt-4 transition-colors hover:bg-muted/60"
+          onClick={() => (isFolder ? setCurrentDir(it.folder.path) : openPreview(it.file))}
+        >
+          {isFolder ? (
+            <IconFolder className="size-10 text-amber-500" strokeWidth={1.5} />
+          ) : (
+            <FileIconComp type={getFileType(name)} className="size-10" />
+          )}
+          <span className="w-full truncate text-center text-xs" title={name}>{name}</span>
+          {!isFolder && <span className="text-[10px] tabular-nums text-muted-foreground">{formatBytes(it.file.size)}</span>}
+        </button>
+        <div className="absolute right-1 top-1">
+          <RowMenu label={t("actions")}>{isFolder ? folderMenu(it.folder.path) : fileMenu(it.file)}</RowMenu>
+        </div>
+      </div>
+    )
+  }
+
+  const actions = (
+    <>
+      <Button size="icon" variant="ghost" className="size-7" aria-label={t("addFiles")} onClick={addFiles} disabled={!hasDir || busy}>
+        <IconPlus className="size-4" />
+      </Button>
+      <Button size="icon" variant="ghost" className="size-7" aria-label={t("newFolder")} onClick={newFolder} disabled={!hasDir || busy}>
+        <IconFolderPlus className="size-4" />
+      </Button>
+      <Button size="icon" variant="ghost" className="size-7" aria-label={t("lock")} onClick={lockVault}>
+        <IconLock className="size-4" />
+      </Button>
+    </>
+  )
+
+  const sidebar = hasDir ? (
+    <FolderTree root={tree} currentDir={currentDir} onSelect={setCurrentDir} onRename={renameFolder} onDelete={deleteFolder} />
+  ) : (
+    <p className="p-4 text-xs text-muted-foreground">{t("chooseFolderBody")}</p>
+  )
+
+  return (
+    <ToolSidebarLayout toolId="secure-files" icon={FolderLock} title={t("title")} actions={actions} sidebar={sidebar} className="bg-background mobile-nav-offset">
+      <div className="flex h-full min-h-0 flex-col">
+        {/* Toolbar */}
+        <div className="flex shrink-0 flex-wrap items-center gap-2 border-b px-4 py-2">
+          <nav className="flex min-w-0 flex-1 items-center gap-1 text-sm" aria-label={t("breadcrumb")}>
+            <button type="button" className="truncate hover:underline" onClick={() => setCurrentDir("")}>{t("allFiles")}</button>
+            {crumbs.map((c, i) => {
+              const path = crumbs.slice(0, i + 1).join("/")
+              return (
+                <React.Fragment key={path}>
+                  <IconChevronRight className="size-3.5 shrink-0 text-muted-foreground" />
+                  <button type="button" className="truncate hover:underline" onClick={() => setCurrentDir(path)}>{c}</button>
+                </React.Fragment>
+              )
+            })}
+          </nav>
+          {hasDir && (
+            <>
+              <Button size="sm" variant="outline" onClick={addFiles} disabled={busy}>
+                <IconPlus className="size-4" /> {t("addFiles")}
+              </Button>
+              <Button size="sm" variant="outline" onClick={newFolder} disabled={busy}>
+                <IconFolderPlus className="size-4" /> {t("addFolder")}
+              </Button>
+              <Button size="sm" variant="outline" onClick={addFolder} disabled={busy}>
+                <IconFolderSymlink className="size-4" /> {t("importFolder")}
+              </Button>
+            </>
+          )}
+          <Button
+            size="icon"
+            variant="ghost"
+            className="size-8"
+            aria-label={view === "list" ? t("viewGrid") : t("viewList")}
+            onClick={() => {
+              const next = view === "list" ? "grid" : "list"
+              setView(next)
+              safeSetItem(VIEW_KEY, next)
+            }}
+          >
+            {view === "list" ? <IconLayoutGrid className="size-4" /> : <IconList className="size-4" />}
+          </Button>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button size="icon" variant="ghost" className="size-8" aria-label={t("settings")}>
+                <IconSettings className="size-4" />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" className="max-w-xs">
+              <div className="px-2 py-1.5 text-xs text-muted-foreground">
+                <div className="font-medium text-foreground">{t("storageFolder")}</div>
+                <div className="truncate font-mono" title={settings?.dir ?? ""}>{settings?.dir ?? t("notSet")}</div>
+              </div>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem onClick={chooseFolder}>
+                <IconFolder className="size-4" /> {hasDir ? t("changeFolder") : t("chooseFolder")}
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+
+        {errors.length > 0 && errorsKey(errors) !== dismissedErrors && (
+          <div className="mx-4 mt-3 flex items-start gap-2 rounded-md border border-amber-500/40 bg-amber-500/10 px-3 py-2 text-xs">
+            <IconAlertTriangle className="mt-0.5 size-4 shrink-0 text-amber-600" />
+            <div className="min-w-0 flex-1">
+              <div className="font-medium">{t("unreadableCount", { count: errors.length })}</div>
+              <div className="text-muted-foreground">{t("unreadableHint")}</div>
+            </div>
+            <Button
+              size="icon"
+              variant="ghost"
+              aria-label={t("dismiss")}
+              className="-mr-1 -mt-0.5 size-6 shrink-0"
+              onClick={() => {
+                const key = errorsKey(errors)
+                setDismissedErrors(key)
+                safeSetItem(DISMISSED_ERRORS_KEY, key)
+              }}
+            >
+              <IconX className="size-3.5" />
+            </Button>
+          </div>
+        )}
+
+        <div ref={scrollRef} onScroll={(e) => setScrollTop(e.currentTarget.scrollTop)} className="min-h-0 flex-1 overflow-y-auto">
+          {loading ? null : !hasDir ? (
+            <EmptyState
+              title={dirMissing ? t("folderMissingTitle") : t("chooseFolderTitle")}
+              body={dirMissing ? t("folderMissingBody", { dir: settings?.dir ?? "" }) : t("chooseFolderBody")}
+            >
+              <Button onClick={chooseFolder} disabled={busy}>
+                <IconFolder className="size-4" /> {t("chooseFolder")}
+              </Button>
+            </EmptyState>
+          ) : node.children.length === 0 && node.files.length === 0 ? (
+            <EmptyState title={t("emptyTitle")} body={t("emptyBody")}>
+              <Button onClick={addFiles} disabled={busy}>
+                <IconPlus className="size-4" /> {t("addFiles")}
+              </Button>
+              <Button variant="outline" onClick={addFolder} disabled={busy}>
+                <IconFolderSymlink className="size-4" /> {t("importFolder")}
+              </Button>
+            </EmptyState>
+          ) : (
+            <>
+              {view === "list" && (
+                <div className={cn("sticky top-0 z-10 grid border-b bg-background py-2 text-xs font-medium text-muted-foreground", listCols)}>
+                  <span className="px-4">{t("name")}</span>
+                  <span className="px-2 text-right">{t("size")}</span>
+                  <span className="hidden px-2 text-right md:block">{t("modified")}</span>
+                  <span />
+                </div>
+              )}
+              <div className="relative text-sm" style={{ height: rowCount * rowH }}>
+                <div className="absolute inset-x-0" style={{ top: startRow * rowH }}>
+                  {view === "grid"
+                    ? Array.from({ length: endRow - startRow }, (_, i) => {
+                        const r = startRow + i
+                        return (
+                          <div
+                            key={r}
+                            style={{ height: rowH, gridTemplateColumns: `repeat(${cols}, minmax(0, 1fr))` }}
+                            className="grid gap-1 px-3"
+                          >
+                            {items.slice(r * cols, (r + 1) * cols).map(tile)}
+                          </div>
+                        )
+                      })
+                    : items.slice(startRow, endRow).map(listRow)}
+                </div>
+              </div>
+            </>
+          )}
+        </div>
+
+        <p className="shrink-0 border-t px-4 py-1.5 text-[11px] text-muted-foreground">{t("footerNote")}</p>
+      </div>
+
+      <FilePreviewDialog preview={preview} onClose={closePreview} onDownload={() => { const f = files.find((x) => x.name === preview?.key); if (f) void exportFile(f) }} />
+      <PathDialog state={pathDialog} onClose={() => setPathDialog(null)} />
+      {confirmDialog}
+    </ToolSidebarLayout>
+  )
+}
+
+function EmptyState({ title, body, children }: { title: string; body: string; children: React.ReactNode }) {
+  return (
+    <div className="flex h-full items-center justify-center p-8">
+      <div className="flex max-w-sm flex-col items-center gap-3 text-center">
+        <div className="flex size-14 items-center justify-center rounded-full border bg-muted/60">
+          <FolderLock className="size-6 text-muted-foreground/70" />
+        </div>
+        <p className="text-sm font-medium">{title}</p>
+        <p className="text-xs text-muted-foreground">{body}</p>
+        <div className="mt-1 flex flex-wrap justify-center gap-2">{children}</div>
+      </div>
+    </div>
+  )
+}
+
+function RowMenu({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button size="icon" variant="ghost" aria-label={label} className={cn("size-7 opacity-0 group-hover:opacity-100 data-[state=open]:opacity-100")}>
+          <IconDots className="size-4" />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end">{children}</DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
+
+/** One text-input dialog for rename / move / new folder. */
+function PathDialog({ state, onClose }: { state: PathDialogState | null; onClose: () => void }) {
+  const t = useTranslations("SecureFiles")
+  const [value, setValue] = useState("")
+  const [saving, setSaving] = useState(false)
+  useEffect(() => {
+    if (state) setValue(state.initial)
+  }, [state])
+
+  const submit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    if (!state) return
+    const v = value.trim()
+    if (!v && !state.allowEmpty) return
+    setSaving(true)
+    try {
+      await state.onSubmit(v)
+      onClose()
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Dialog open={state !== null} onOpenChange={(o) => !o && onClose()}>
+      <DialogContent className="max-w-sm">
+        <DialogHeader>
+          <DialogTitle>{state?.title}</DialogTitle>
+          {state?.hint && <DialogDescription>{state.hint}</DialogDescription>}
+        </DialogHeader>
+        <form onSubmit={submit} className="space-y-4 pt-2">
+          <div className="space-y-2">
+            <Label htmlFor="sf-path">{state?.label}</Label>
+            <Input id="sf-path" value={value} onChange={(e) => setValue(e.target.value)} autoFocus onFocus={(e) => e.target.select()} disabled={saving} />
+          </div>
+          <div className="flex justify-end gap-2">
+            <Button type="button" variant="outline" onClick={onClose} disabled={saving}>{t("cancel")}</Button>
+            <Button type="submit" disabled={saving}>{t("save")}</Button>
+          </div>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/desktop-ui/src/components/sidebar/data/sidebar-data.ts b/apps/desktop-ui/src/components/sidebar/data/sidebar-data.ts
index 2c15006a..411c9505 100644
--- a/apps/desktop-ui/src/components/sidebar/data/sidebar-data.ts
+++ b/apps/desktop-ui/src/components/sidebar/data/sidebar-data.ts
@@ -3,6 +3,7 @@ import {
   IconNetwork,
   IconJson,
   IconLock,
+  IconLockSquareRounded,
   IconNotes,
   IconDatabase,
   IconBookmark,
@@ -163,6 +164,12 @@ export const sidebarData: SidebarData = {
           icon: IconLock,
           description: 'Securely store and manage your passwords.',
         },
+        {
+          title: 'Files',
+          url: '/app/secure-files',
+          icon: IconLockSquareRounded,
+          description: 'Encrypt files and folders into masked .mydt objects stored wherever you choose.',
+        },
         {
           title: "Bcrypt Generator",
           url: '/app/bcrypt-generator',
diff --git a/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts b/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
new file mode 100644
index 00000000..eeb9d3eb
--- /dev/null
+++ b/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
@@ -0,0 +1,47 @@
+import { buildFolderTree, joinDir, looksLikeText, parentDir, visibleRange, type SecureFileEntry } from "../secure-files"
+
+const f = (name: string, dir: string): SecureFileEntry => ({ id: name, name, dir, size: 1, mtime: 0, importedAt: 0 })
+
+describe("buildFolderTree", () => {
+  it("derives nested folders from file dirs and keeps empty extra dirs", () => {
+    const tree = buildFolderTree(
+      [f("z.txt", ""), f("a.txt", "proj/src"), f("b.txt", "proj"), f("c.txt", "proj/src")],
+      ["proj/empty", "other"],
+    )
+    expect(tree.files.map((x) => x.name)).toEqual(["z.txt"])
+    expect(tree.children.map((c) => c.path)).toEqual(["other", "proj"])
+    const proj = tree.children[1]!
+    expect(proj.files.map((x) => x.name)).toEqual(["b.txt"])
+    expect(proj.children.map((c) => c.path)).toEqual(["proj/empty", "proj/src"])
+    expect(proj.children[1]!.files.map((x) => x.name)).toEqual(["a.txt", "c.txt"])
+    expect(proj.children[0]!.files).toEqual([])
+  })
+
+  it("path helpers", () => {
+    expect(joinDir("", "a")).toBe("a")
+    expect(joinDir("a", "b")).toBe("a/b")
+    expect(parentDir("a/b/c")).toBe("a/b")
+    expect(parentDir("a")).toBe("")
+  })
+})
+
+describe("visibleRange", () => {
+  it("windows with overscan and clamps to bounds", () => {
+    expect(visibleRange(0, 600, 36, 100000, 6)).toEqual([0, 23])
+    expect(visibleRange(3600, 600, 36, 100000, 6)).toEqual([94, 123])
+    const [s, e] = visibleRange(100000 * 36, 600, 36, 100000, 6)
+    expect(e).toBe(100000)
+    expect(s).toBeLessThanOrEqual(e)
+    expect(visibleRange(0, 600, 36, 0)).toEqual([0, 0])
+    expect(visibleRange(0, 600, 36, 5)).toEqual([0, 5])
+  })
+})
+
+describe("looksLikeText", () => {
+  it("accepts utf-8, rejects NUL/invalid bytes", () => {
+    expect(looksLikeText(new TextEncoder().encode("KEY=value\n"))).toBe(true)
+    expect(looksLikeText(new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0, 1]))).toBe(false)
+    expect(looksLikeText(new Uint8Array([0xff, 0xfe, 0xfd]))).toBe(false)
+    expect(looksLikeText(new Uint8Array())).toBe(true)
+  })
+})
diff --git a/apps/desktop-ui/src/lib/global-vault-api.ts b/apps/desktop-ui/src/lib/global-vault-api.ts
index 8d89ec3f..8ed08019 100644
--- a/apps/desktop-ui/src/lib/global-vault-api.ts
+++ b/apps/desktop-ui/src/lib/global-vault-api.ts
@@ -11,6 +11,7 @@
  */
 
 import { apiFetch } from "./desktop/api-fetch"
+import { isDesktop } from "./desktop/is-desktop"
 
 export type KeyVerifier = {
     encrypted: string
@@ -61,6 +62,33 @@ export async function setupMasterVault(
     return (await res.json()) as MasterVaultOut
 }
 
+// ── Secure Files KEK (desktop only) ───────────────────────────────────────────
+
+/**
+ * After the webview has verified the master password, hand it to Rust once so
+ * Secure Files can derive its own Argon2id key (held in memory, never stored).
+ * Never blocks the webview unlock — a failure only leaves Secure Files locked.
+ */
+export async function unlockSecureVault(password: string): Promise<void> {
+    if (!isDesktop()) return
+    try {
+        const res = await apiFetch("/api/backend/auth/master-vault/unlock", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ password }),
+        })
+        if (!res.ok) console.warn("[secure-files] unlock failed:", res.status)
+    } catch (err) {
+        console.warn("[secure-files] unlock failed:", err)
+    }
+}
+
+/** Drop the Rust-side Secure Files key. Fire-and-forget. */
+export function lockSecureVault(): void {
+    if (!isDesktop()) return
+    void apiFetch("/api/backend/auth/master-vault/lock", { method: "POST" }).catch(() => {})
+}
+
 // ── Backup codes ──────────────────────────────────────────────────────────────
 
 export type BackupCodeEntry = {
diff --git a/apps/desktop-ui/src/lib/metadata.ts b/apps/desktop-ui/src/lib/metadata.ts
index 500275db..a1b95427 100644
--- a/apps/desktop-ui/src/lib/metadata.ts
+++ b/apps/desktop-ui/src/lib/metadata.ts
@@ -22,6 +22,12 @@ export const toolsMetadata: Record<string, ToolMetadataEntry> = {
         keywords: ['to do list', 'task manager', 'todo app', 'task list', 'productivity'],
         aiSummary: 'Simple in-browser task manager for developers: add tasks, set priorities, check them off. Data synced to your account. No install needed.',
     },
+    'secure-files': {
+        title: 'Files',
+        description: 'Encrypt files and folders into opaque .mydt objects on your device. Original names, types and contents stay private until you unlock them.',
+        keywords: ['file encryption', 'encrypted files', 'secure file storage', 'encrypt folder', 'private files', 'local-first encryption'],
+        aiSummary: 'Local-first encrypted file store: import files or folders, they are stored as masked-name .mydt files (Argon2id + XChaCha20-Poly1305) in a folder you choose, and browsed/previewed/exported only after unlocking with your master password. Fully offline, open source.',
+    },
     'notes': {
         title: 'Notes',
         description: 'Create and manage notes quickly. Markdown-supported note-taking for developers.',
diff --git a/apps/desktop-ui/src/lib/route-config.ts b/apps/desktop-ui/src/lib/route-config.ts
index fa10b198..2a152e87 100644
--- a/apps/desktop-ui/src/lib/route-config.ts
+++ b/apps/desktop-ui/src/lib/route-config.ts
@@ -1,6 +1,7 @@
 import {
   CheckSquare,
   FileText,
+  FolderLock,
   Lock,
   Bookmark,
   Globe,
@@ -76,6 +77,7 @@ export const routeConfig: Record<string, RouteConfig> = {
   '/app/to-do': { title: 'Tasks', icon: CheckSquare },
   '/app/notes': { title: 'Notes', icon: FileText },
   '/app/password-manager': { title: 'Password Manager', icon: Lock },
+  '/app/secure-files': { title: 'Files', icon: FolderLock, namespace: 'SecureFiles' },
   '/app/environment-manager': { title: 'Environment Manager', icon: FileCode2, namespace: 'EnvironmentManager' },
   '/app/api-keys': { title: 'API Keys', icon: Key },
   '/app/bookmarks': { title: 'Bookmarks', icon: Bookmark },
diff --git a/apps/desktop-ui/src/lib/secure-files-api.ts b/apps/desktop-ui/src/lib/secure-files-api.ts
new file mode 100644
index 00000000..b541063a
--- /dev/null
+++ b/apps/desktop-ui/src/lib/secure-files-api.ts
@@ -0,0 +1,57 @@
+/**
+ * Secure Files — Rust-backed API (`/api/v1/secure-files/*`) plus native
+ * pickers. Files are encrypted/decrypted in Rust; the webview only ever sees
+ * plaintext bytes for the file being previewed.
+ */
+import { apiRequest } from "@/lib/backend-api"
+import type { SecureFileEntry } from "@/lib/secure-files"
+
+const BASE = "/api/v1/secure-files"
+
+/** `exists` is false when `dir` is set but missing (restored backup, unplugged drive). */
+export type SecureFilesSettings = { dir: string | null; exists: boolean; unlocked: boolean }
+export type ListResult = { files: SecureFileEntry[]; errors: { id: string; error: string }[] }
+/** `dirs` lists every walked directory (logical path) — including empty ones. */
+export type ImportResult = { imported: SecureFileEntry[]; errors: { path: string; error: string }[]; dirs: string[] }
+
+export const getSecureFilesSettings = () => apiRequest<SecureFilesSettings>("GET", `${BASE}/settings`)
+export const setSecureFilesDir = (dir: string) =>
+  apiRequest<{ dir: string; moved: number }>("PUT", `${BASE}/settings`, { dir })
+export const listSecureFiles = () => apiRequest<ListResult>("GET", `${BASE}/files`)
+export const importSecureFiles = (paths: string[], dir: string) =>
+  apiRequest<ImportResult>("POST", `${BASE}/files/import`, { paths, dir })
+export const patchSecureFile = (id: string, patch: { name?: string; dir?: string }) =>
+  apiRequest<SecureFileEntry>("PATCH", `${BASE}/files/${id}`, patch)
+export const replaceSecureFile = (id: string, path: string) =>
+  apiRequest<SecureFileEntry>("POST", `${BASE}/files/${id}/replace`, { path })
+export const exportSecureFile = (id: string, path: string) =>
+  apiRequest<void>("POST", `${BASE}/files/${id}/export`, { path })
+export const deleteSecureFile = (id: string) => apiRequest<void>("DELETE", `${BASE}/files/${id}`)
+export const renameSecureFolder = (from: string, to: string) =>
+  apiRequest<{ updated: number }>("POST", `${BASE}/folders/rename`, { from, to })
+export const deleteSecureFolder = (dir: string) =>
+  apiRequest<{ deleted: number }>("POST", `${BASE}/folders/delete`, { dir })
+
+/** Decrypted bytes via the raw-binary Tauri command (no base64 round-trip). */
+export async function readSecureFile(id: string): Promise<ArrayBuffer> {
+  const { invoke } = await import("@tauri-apps/api/core")
+  return invoke<ArrayBuffer>("secure_file_read", { id })
+}
+
+// Native dialogs — dynamic imports so the web bundle never pulls the plugin.
+
+export async function pickFiles(): Promise<string[]> {
+  const { open } = await import("@tauri-apps/plugin-dialog")
+  const res = await open({ multiple: true })
+  return res ?? []
+}
+
+export async function pickFolder(): Promise<string | null> {
+  const { open } = await import("@tauri-apps/plugin-dialog")
+  return open({ directory: true })
+}
+
+export async function pickSavePath(defaultName: string): Promise<string | null> {
+  const { save } = await import("@tauri-apps/plugin-dialog")
+  return save({ defaultPath: defaultName })
+}
diff --git a/apps/desktop-ui/src/lib/secure-files.ts b/apps/desktop-ui/src/lib/secure-files.ts
new file mode 100644
index 00000000..c4c064e6
--- /dev/null
+++ b/apps/desktop-ui/src/lib/secure-files.ts
@@ -0,0 +1,89 @@
+/**
+ * Secure Files — pure helpers (no I/O). Logical folders are just the `dir`
+ * prefix carried in each file's encrypted metadata; the tree is derived.
+ */
+
+export type SecureFileEntry = {
+  id: string
+  name: string
+  /** Logical folder, `"a/b"` or `""` for root. */
+  dir: string
+  size: number
+  mtime: number
+  importedAt: number
+}
+
+export type FolderNode = {
+  name: string
+  /** Full logical path, `""` for root. */
+  path: string
+  children: FolderNode[]
+  files: SecureFileEntry[]
+}
+
+export function joinDir(base: string, name: string): string {
+  return base ? `${base}/${name}` : name
+}
+
+export function parentDir(dir: string): string {
+  const i = dir.lastIndexOf("/")
+  return i === -1 ? "" : dir.slice(0, i)
+}
+
+export function baseName(dir: string): string {
+  return dir.slice(dir.lastIndexOf("/") + 1)
+}
+
+/** Build the folder tree from file dirs plus any empty (not yet populated) dirs. */
+export function buildFolderTree(files: SecureFileEntry[], extraDirs: Iterable<string> = []): FolderNode {
+  const root: FolderNode = { name: "", path: "", children: [], files: [] }
+  const byPath = new Map<string, FolderNode>([["", root]])
+
+  const ensure = (dir: string): FolderNode => {
+    const hit = byPath.get(dir)
+    if (hit) return hit
+    const parent = ensure(parentDir(dir))
+    const node: FolderNode = { name: baseName(dir), path: dir, children: [], files: [] }
+    parent.children.push(node)
+    byPath.set(dir, node)
+    return node
+  }
+
+  for (const dir of extraDirs) if (dir) ensure(dir)
+  for (const f of files) ensure(f.dir).files.push(f)
+
+  const sortNode = (n: FolderNode) => {
+    n.children.sort((a, b) => a.name.localeCompare(b.name))
+    n.files.sort((a, b) => a.name.localeCompare(b.name))
+    n.children.forEach(sortNode)
+  }
+  sortNode(root)
+  return root
+}
+
+/** Visible `[start, end)` row range for a fixed-row-height virtual list. */
+export function visibleRange(
+  scrollTop: number,
+  viewportH: number,
+  rowH: number,
+  total: number,
+  overscan = 6,
+): [number, number] {
+  if (total === 0 || rowH <= 0) return [0, 0]
+  const start = Math.max(0, Math.floor(scrollTop / rowH) - overscan)
+  const end = Math.min(total, Math.ceil((scrollTop + viewportH) / rowH) + overscan)
+  return [start, end]
+}
+
+/** Sniff text vs binary so `.env`, `.pem`, extension-less files preview as text. */
+export function looksLikeText(bytes: Uint8Array): boolean {
+  const sample = bytes.subarray(0, 8192)
+  if (sample.length === 0) return true
+  if (sample.includes(0)) return false
+  try {
+    new TextDecoder("utf-8", { fatal: true }).decode(sample)
+    return true
+  } catch {
+    return false
+  }
+}
diff --git a/apps/desktop-ui/src/lib/tab-registry.tsx b/apps/desktop-ui/src/lib/tab-registry.tsx
index 6036c779..85204c61 100644
--- a/apps/desktop-ui/src/lib/tab-registry.tsx
+++ b/apps/desktop-ui/src/lib/tab-registry.tsx
@@ -27,6 +27,7 @@ const TAB_REGISTRY: Record<string, React.ComponentType> = {
     { ssr: false, loading }
   ),
   '/app/password-manager': dynamic(() => import('@/app/app/password-manager/page'), { ssr: false, loading }),
+  '/app/secure-files': dynamic(() => import('@/app/app/secure-files/page'), { ssr: false, loading }),
   '/app/environment-manager': dynamic(() => import('@/app/app/environment-manager/page'), { ssr: false, loading }),
   '/app/api-keys': dynamic(() => import('@/app/app/api-keys/page'), { ssr: false, loading }),
   '/app/bookmarks': dynamic(() => import('@/app/app/bookmarks/page'), { ssr: false, loading }),
diff --git a/apps/desktop-ui/src/lib/tool-categories.ts b/apps/desktop-ui/src/lib/tool-categories.ts
index d10f4569..c6f1fc5d 100644
--- a/apps/desktop-ui/src/lib/tool-categories.ts
+++ b/apps/desktop-ui/src/lib/tool-categories.ts
@@ -12,6 +12,7 @@ export const toolCategoryMap: Record<string, string> = {
   'certificate-pem-decoder': 'Security',
   'encryption-playground': 'Security',
   'password-manager': 'Security',
+  'secure-files': 'Security',
   'json-formatter': 'Formatters',
   'json-visualizer': 'Formatters',
   'json-schema-generator': 'Formatters',
diff --git a/apps/desktop-ui/src/lib/tool-i18n.ts b/apps/desktop-ui/src/lib/tool-i18n.ts
index e47b7c0c..308795a3 100644
--- a/apps/desktop-ui/src/lib/tool-i18n.ts
+++ b/apps/desktop-ui/src/lib/tool-i18n.ts
@@ -5,6 +5,7 @@ export const TOOL_PATH_TO_MESSAGE_KEY: Record<string, string> = {
   '/app/to-do': 'toDo',
   '/app/notes': 'notes',
   '/app/password-manager': 'passwordManager',
+  '/app/secure-files': 'secureFiles',
   '/app/environment-manager': 'environmentManager',
   '/app/bookmarks': 'bookmarks',
   '/app/email-validator': 'emailValidator',
diff --git a/apps/desktop-ui/src/store/master-key-store.ts b/apps/desktop-ui/src/store/master-key-store.ts
index d09fefad..f537cb35 100644
--- a/apps/desktop-ui/src/store/master-key-store.ts
+++ b/apps/desktop-ui/src/store/master-key-store.ts
@@ -1,5 +1,5 @@
 import { create } from "zustand"
-import type { MasterVaultOut } from "@/lib/global-vault-api"
+import { lockSecureVault, type MasterVaultOut } from "@/lib/global-vault-api"
 
 export type VaultStatus =
     | "restoring"
@@ -42,7 +42,8 @@ export const useMasterKeyStore = create<MasterKeyStore>((set) => ({
             restoreError: null,
         }),
 
-    clearKey: () =>
+    clearKey: () => {
+        lockSecureVault()
         set({
             encryptionKey: null,
             vaultStatus: "restoring",
@@ -50,18 +51,22 @@ export const useMasterKeyStore = create<MasterKeyStore>((set) => ({
             vault: null,
             restoreError: null,
             vaultGateOpen: false,
-        }),
+        })
+    },
 
     // Re-lock and prompt: drop the in-memory key but keep the cached vault so the
     // gate shows unlock (not setup). Used by idle auto-lock and manual "Lock".
-    lock: () =>
+    // Also drops the Rust-side Secure Files key.
+    lock: () => {
+        lockSecureVault()
         set((s) => ({
             encryptionKey: null,
             vaultStatus: "locked",
             isUnlocked: false,
             vaultGateOpen: s.vault != null,
             restoreError: null,
-        })),
+        }))
+    },
 
     setVaultStatus: (status) =>
         set({ vaultStatus: status, isUnlocked: status === "unlocked" }),
diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
index 7896f689..51b877f2 100644
--- a/apps/desktop/src-tauri/Cargo.lock
+++ b/apps/desktop/src-tauri/Cargo.lock
@@ -8,6 +8,16 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "aead"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
+dependencies = [
+ "crypto-common 0.2.2",
+ "inout",
+]
+
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -81,6 +91,18 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "03918c3dbd7701a85c6b9887732e2921175f26c350b4563841d0958c21d57e6d"
 
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
 [[package]]
 name = "async-broadcast"
 version = "0.7.2"
@@ -300,6 +322,12 @@ version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -342,6 +370,15 @@ dependencies = [
  "wyz",
 ]
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -596,10 +633,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
+ "cipher",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "chacha20poly1305"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -614,6 +664,17 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout",
+]
+
 [[package]]
 name = "cmake"
 version = "0.1.58"
@@ -852,7 +913,9 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1082,6 +1145,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
  "crypto-common 0.1.7",
+ "subtle",
 ]
 
 [[package]]
@@ -2323,6 +2387,15 @@ dependencies = [
  "cfb",
 ]
 
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "ipconfig"
 version = "0.3.4"
@@ -2986,6 +3059,7 @@ dependencies = [
  "http",
  "keyring",
  "mongodb",
+ "mydt",
  "mysql_async",
  "native-tls",
  "postgres-native-tls",
@@ -2996,6 +3070,7 @@ dependencies = [
  "serde_json",
  "tauri",
  "tauri-build",
+ "tauri-plugin-dialog",
  "tauri-plugin-opener",
  "tauri-plugin-process",
  "tauri-plugin-updater",
@@ -3005,6 +3080,20 @@ dependencies = [
  "tokio-native-tls",
  "tokio-postgres",
  "uuid",
+ "zeroize",
+]
+
+[[package]]
+name = "mydt"
+version = "0.1.0"
+dependencies = [
+ "argon2",
+ "chacha20poly1305",
+ "getrandom 0.4.3",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.20",
+ "zeroize",
 ]
 
 [[package]]
@@ -3576,6 +3665,17 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "pbkdf2"
 version = "0.13.0"
@@ -3720,6 +3820,16 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "poly1305"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
+dependencies = [
+ "cpufeatures 0.3.0",
+ "universal-hash",
+]
+
 [[package]]
 name = "portable-atomic"
 version = "1.15.0"
@@ -4014,6 +4124,12 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
 [[package]]
 name = "rand_core"
 version = "0.9.5"
@@ -4190,6 +4306,30 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
 
+[[package]]
+name = "rfd"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a15ad77d9e70a92437d8f74c35d99b4e4691128df018833e99f90bcd36152672"
+dependencies = [
+ "block2",
+ "dispatch2",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "js-sys",
+ "log",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "raw-window-handle",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -5213,6 +5353,48 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "tauri-plugin-dialog"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2d3c1dbe38037e7f590cdf2492594d5ceebe031e7bc7e827509b22a999d2940"
+dependencies = [
+ "log",
+ "raw-window-handle",
+ "rfd",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-plugin-fs",
+ "thiserror 2.0.20",
+ "url",
+]
+
+[[package]]
+name = "tauri-plugin-fs"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7ecc274121aca0c036a2b42d1cbe83d368d348f54e0bb8a735c2b1548e8f371"
+dependencies = [
+ "anyhow",
+ "dunce",
+ "glob",
+ "log",
+ "objc2-foundation",
+ "percent-encoding",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "tauri",
+ "tauri-plugin",
+ "tauri-utils",
+ "thiserror 2.0.20",
+ "toml 1.1.4+spec-1.1.0",
+ "url",
+]
+
 [[package]]
 name = "tauri-plugin-opener"
 version = "2.5.4"
@@ -5981,6 +6163,16 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
+[[package]]
+name = "universal-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
+dependencies = [
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index 1447272d..7bcdd401 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -26,6 +26,10 @@ tauri-plugin-opener = "2"
 tauri-plugin-window-state = "2"
 tauri-plugin-updater = "2"
 tauri-plugin-process = "2"
+tauri-plugin-dialog = "2"
+# Secure Files: the .mydt format/crypto lives in the shared `mydt` crate (also the CLI).
+mydt = { path = "../../../crates/mydt" }
+zeroize = "1"
 tokio = { version = "1", features = ["time", "sync", "net", "io-util"] }
 tokio-postgres = "0.7"
 postgres-native-tls = "0.5"
diff --git a/apps/desktop/src-tauri/capabilities/default.json b/apps/desktop/src-tauri/capabilities/default.json
index 7a89c039..50314fbb 100644
--- a/apps/desktop/src-tauri/capabilities/default.json
+++ b/apps/desktop/src-tauri/capabilities/default.json
@@ -3,5 +3,5 @@
   "identifier": "default",
   "description": "Default capability for the main window",
   "windows": ["main"],
-  "permissions": ["core:default", "core:window:allow-start-dragging", "core:window:allow-is-fullscreen", "opener:default", "updater:default", "process:default"]
+  "permissions": ["core:default", "core:window:allow-start-dragging", "core:window:allow-is-fullscreen", "opener:default", "updater:default", "process:default", "dialog:default"]
 }
diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs
index 74240354..589442c7 100644
--- a/apps/desktop/src-tauri/src/lib.rs
+++ b/apps/desktop/src-tauri/src/lib.rs
@@ -51,6 +51,13 @@ async fn proxy_grpc(input: serde_json::Value) -> Result<serde_json::Value, Strin
     Ok(http::grpc::proxy_grpc(input).await)
 }
 
+/// Decrypted Secure Files payload as raw bytes (webview gets an ArrayBuffer —
+/// no base64 round-trip through the JSON router).
+#[tauri::command]
+fn secure_file_read(state: tauri::State<'_, AppState>, id: String) -> Result<tauri::ipc::Response, String> {
+    router::secure_files::read_plaintext(&state, &id).map(tauri::ipc::Response::new)
+}
+
 pub fn run() {
     tauri::Builder::default()
         .plugin(tauri_plugin_opener::init())
@@ -65,6 +72,7 @@ pub fn run() {
         )
         .plugin(tauri_plugin_updater::Builder::new().build())
         .plugin(tauri_plugin_process::init())
+        .plugin(tauri_plugin_dialog::init())
         .setup(|app| {
             let dir = app.path().app_data_dir()?;
             std::fs::create_dir_all(&dir)?;
@@ -100,7 +108,8 @@ pub fn run() {
             http_request_stream,
             http_request_stream_cancel,
             mock_server_start,
-            proxy_grpc
+            proxy_grpc,
+            secure_file_read
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");
diff --git a/apps/desktop/src-tauri/src/router/backup.rs b/apps/desktop/src-tauri/src/router/backup.rs
index db1f05e6..49397ec4 100644
--- a/apps/desktop/src-tauri/src/router/backup.rs
+++ b/apps/desktop/src-tauri/src/router/backup.rs
@@ -20,7 +20,9 @@ use crate::state::AppState;
 /// kv singletons that are portable across machines. Excludes session cookies
 /// (`cookie_jar`), per-workspace sync flags (`sync_enabled:*`), and the
 /// device-local active-workspace pointer.
-const PORTABLE_KV: &[&str] = &["master_vault", "backup_codes", "user_preferences"];
+// `secure_files` carries the Argon2 salt: without it, .mydt files are unreadable
+// even with the right password (the stored dir path is just re-picked).
+const PORTABLE_KV: &[&str] = &["master_vault", "backup_codes", "user_preferences", "secure_files"];
 
 const BACKUP_VERSION: i64 = 1;
 
diff --git a/apps/desktop/src-tauri/src/router/master_vault.rs b/apps/desktop/src-tauri/src/router/master_vault.rs
index d987c446..4b3dbcc2 100644
--- a/apps/desktop/src-tauri/src/router/master_vault.rs
+++ b/apps/desktop/src-tauri/src/router/master_vault.rs
@@ -1,14 +1,17 @@
 //! Local mirror of FastAPI `/api/v1/auth/master-vault`.
 //!
 //! Stores only `{salt, verifier, createdAt}` — the PBKDF2 salt and an
-//! AES-GCM verifier blob. The master password / derived key never reach Rust;
-//! verification happens client-side in the webview (lib/encryption.ts).
+//! AES-GCM verifier blob. Verification happens client-side in the webview
+//! (lib/encryption.ts). After a successful webview unlock the gate also POSTs
+//! the password to `/unlock` so Secure Files can derive its own Argon2id KEK
+//! (router/secure_files); `/lock` drops it. The password is never stored.
 
 use serde::{Deserialize, Serialize};
+use zeroize::Zeroizing;
 
 use crate::db::now_ms;
 use crate::error::Result;
-use crate::router::ApiResponse;
+use crate::router::{secure_files, ApiResponse};
 use crate::state::AppState;
 
 const KV_KEY: &str = "master_vault";
@@ -33,7 +36,28 @@ struct SetupRequest {
     verifier: KeyVerifier,
 }
 
+#[derive(Deserialize)]
+struct UnlockRequest {
+    password: String,
+}
+
 pub fn handle(state: &AppState, method: &str, path: &str, body: Option<&str>) -> Result<ApiResponse> {
+    match (method, path) {
+        ("POST", "/api/v1/auth/master-vault/unlock") => {
+            let req: UnlockRequest =
+                serde_json::from_str(body.unwrap_or("")).map_err(crate::error::AppError::from)?;
+            let password = Zeroizing::new(req.password);
+            // ponytail: a future change-password flow must re-call this with the
+            // new password and PATCH every .mydt (rewrap DEKs).
+            secure_files::unlock(state, password.as_bytes())?;
+            return Ok(ApiResponse::ok(&serde_json::json!({})).unwrap());
+        }
+        ("POST", "/api/v1/auth/master-vault/lock") => {
+            secure_files::lock(state);
+            return Ok(ApiResponse::empty(204));
+        }
+        _ => {}
+    }
     if path != "/api/v1/auth/master-vault" {
         return Ok(ApiResponse::detail(404, "Not found"));
     }
diff --git a/apps/desktop/src-tauri/src/router/mod.rs b/apps/desktop/src-tauri/src/router/mod.rs
index 404e6591..2bef78f6 100644
--- a/apps/desktop/src-tauri/src/router/mod.rs
+++ b/apps/desktop/src-tauri/src/router/mod.rs
@@ -8,6 +8,7 @@ pub mod json_formatter;
 pub mod master_vault;
 pub mod notes;
 pub mod preferences;
+pub mod secure_files;
 pub mod snippets;
 pub mod stubs;
 pub mod tasks;
@@ -128,6 +129,9 @@ pub fn route(state: &AppState, method: &str, full_path: &str, body: Option<&str>
     if let Some(rest) = rel.strip_prefix("/user-preferences") {
         return preferences::handle(state, method, rest, query, body);
     }
+    if let Some(rest) = rel.strip_prefix("/secure-files") {
+        return secure_files::handle(state, method, rest, body);
+    }
 
     stubs::handle(method, path)
 }
diff --git a/apps/desktop/src-tauri/src/router/preferences.rs b/apps/desktop/src-tauri/src/router/preferences.rs
index 065f022a..a5d1a3e2 100644
--- a/apps/desktop/src-tauri/src/router/preferences.rs
+++ b/apps/desktop/src-tauri/src/router/preferences.rs
@@ -23,6 +23,7 @@ const DEFAULT_ENABLED_TOOLS: &[&str] = &[
     "/app/snippet-manager",
     "/app/password-manager",
     "/app/environment-manager",
+    "/app/secure-files",
     "/app/email-validator",
     "/app/jwt-decoder",
     "/app/encryption-playground",
diff --git a/apps/desktop/src-tauri/src/router/secure_files/mod.rs b/apps/desktop/src-tauri/src/router/secure_files/mod.rs
new file mode 100644
index 00000000..8ce5c36d
--- /dev/null
+++ b/apps/desktop/src-tauri/src/router/secure_files/mod.rs
@@ -0,0 +1,995 @@
+//! Secure Files — `/api/v1/secure-files/*`.
+//!
+//! Encrypts user files into opaque `<32 hex>.mydt` objects inside one
+//! user-chosen storage directory. There is no index: every `.mydt` carries its
+//! own encrypted metadata, so listing = scan the dir + decrypt headers.
+//! The KEK lives in `AppState.kek` (set by `/auth/master-vault/unlock`).
+//!
+//! kv row `secure_files`: `{"dir": "/path" | null, "salt": "<b64>", "m", "t", "p"}`.
+
+// Format + crypto live in the standalone `mydt` crate (crates/mydt), shared
+// with the `mydt` CLI so both sides read/write identical objects.
+use mydt as crypto;
+
+use std::collections::HashSet;
+use std::fs;
+use std::io::Read;
+use std::path::{Path, PathBuf};
+
+use base64::Engine;
+use rusqlite::{Connection, OptionalExtension};
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use zeroize::Zeroizing;
+
+use crate::db::now_ms;
+use crate::error::{AppError, Result};
+use crate::router::ApiResponse;
+use crate::state::AppState;
+use mydt::{CryptoError, FileMeta, KdfParams, HEADER_LEN, MAX_FILE_BYTES, MAX_OBJECT_BYTES, SALT_LEN};
+
+pub const KV_KEY: &str = "secure_files";
+const EXT: &str = "mydt";
+const TMP_EXT: &str = "mydt.tmp";
+
+// ── Config (kv) ───────────────────────────────────────────────────────────
+
+#[derive(Serialize, Deserialize, Clone)]
+struct Cfg {
+    dir: Option<String>,
+    salt: String,
+    m: u32,
+    t: u32,
+    p: u32,
+}
+
+impl Cfg {
+    fn kdf(&self) -> Fallible<KdfParams> {
+        let raw = base64::engine::general_purpose::STANDARD
+            .decode(&self.salt)
+            .map_err(|_| Fail(500, "corrupt secure_files salt".into()))?;
+        let salt: [u8; SALT_LEN] = raw.as_slice().try_into().map_err(|_| Fail(500, "corrupt secure_files salt".into()))?;
+        Ok(KdfParams { salt, m_cost: self.m, t_cost: self.t, p_cost: self.p })
+    }
+}
+
+fn load_cfg(db: &Connection) -> Result<Option<Cfg>> {
+    let raw: Option<String> = db
+        .query_row("SELECT v FROM kv WHERE k = ?1", [KV_KEY], |r| r.get(0))
+        .optional()?;
+    Ok(match raw {
+        Some(s) => Some(serde_json::from_str(&s)?),
+        None => None,
+    })
+}
+
+fn save_cfg(db: &Connection, cfg: &Cfg) -> Result<()> {
+    db.execute(
+        "INSERT INTO kv (k, v) VALUES (?1, ?2) ON CONFLICT(k) DO UPDATE SET v = excluded.v",
+        [KV_KEY, &serde_json::to_string(cfg)?],
+    )?;
+    Ok(())
+}
+
+fn load_or_create_cfg(db: &Connection) -> Result<Cfg> {
+    if let Some(cfg) = load_cfg(db)? {
+        return Ok(cfg);
+    }
+    let p = KdfParams::generate();
+    let cfg = Cfg {
+        dir: None,
+        salt: base64::engine::general_purpose::STANDARD.encode(p.salt),
+        m: p.m_cost,
+        t: p.t_cost,
+        p: p.p_cost,
+    };
+    save_cfg(db, &cfg)?;
+    Ok(cfg)
+}
+
+// ── Unlock / lock (called from master_vault.rs) ───────────────────────────
+
+/// Derive the KEK from the master password and hold it in `AppState`.
+/// Creates the salt on first call. Argon2 runs with the DB guard released.
+// ponytail: sync Argon2 inside route(); spawn_blocking if unlock latency is felt.
+pub fn unlock(state: &AppState, password: &[u8]) -> Result<()> {
+    let cfg = load_or_create_cfg(&state.db.lock().unwrap())?;
+    let params = cfg.kdf().map_err(|f| AppError::Io(std::io::Error::other(f.1)))?;
+    let kek = crypto::derive_kek(password, &params).map_err(|e| AppError::Io(std::io::Error::other(e.to_string())))?;
+    *state.kek.lock().unwrap() = Some(kek);
+    Ok(())
+}
+
+pub fn lock(state: &AppState) {
+    *state.kek.lock().unwrap() = None;
+    *state.sf_meta.lock().unwrap() = None;
+}
+
+/// Write-through helpers — no-ops while the cache is cold (next listing scans).
+fn cache_put(state: &AppState, e: &Entry) {
+    if let Some(m) = state.sf_meta.lock().unwrap().as_mut() {
+        m.insert(e.id.clone(), e.meta.clone());
+    }
+}
+
+fn cache_remove(state: &AppState, id: &str) {
+    if let Some(m) = state.sf_meta.lock().unwrap().as_mut() {
+        m.remove(id);
+    }
+}
+
+// ── Errors → HTTP-ish status ──────────────────────────────────────────────
+
+#[derive(Debug)]
+struct Fail(u16, String);
+type Fallible<T> = std::result::Result<T, Fail>;
+
+impl From<CryptoError> for Fail {
+    fn from(e: CryptoError) -> Self {
+        Fail(422, e.to_string())
+    }
+}
+impl From<std::io::Error> for Fail {
+    fn from(e: std::io::Error) -> Self {
+        Fail(500, format!("io error: {e}"))
+    }
+}
+impl From<AppError> for Fail {
+    fn from(e: AppError) -> Self {
+        Fail(500, e.to_string())
+    }
+}
+
+fn bad(msg: &str) -> Fail {
+    Fail(400, msg.into())
+}
+
+// ── Validation (trust boundary) ───────────────────────────────────────────
+
+fn valid_id(id: &str) -> Fallible<()> {
+    if id.len() == 32 && id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
+        Ok(())
+    } else {
+        Err(bad("invalid file id"))
+    }
+}
+
+fn valid_name(name: &str) -> Fallible<()> {
+    if name.is_empty() || name.len() > 255 || name.contains('/') || name.contains('\\') || name.contains('\0') {
+        return Err(bad("invalid file name"));
+    }
+    if name == "." || name == ".." {
+        return Err(bad("invalid file name"));
+    }
+    Ok(())
+}
+
+fn valid_dir(dir: &str) -> Fallible<()> {
+    if dir.is_empty() {
+        return Ok(());
+    }
+    if dir.starts_with('/') || dir.ends_with('/') || dir.contains('\0') || dir.contains('\\') {
+        return Err(bad("invalid folder path"));
+    }
+    if dir.split('/').any(|seg| seg.is_empty() || seg == "." || seg == "..") {
+        return Err(bad("invalid folder path"));
+    }
+    Ok(())
+}
+
+fn join_dir(base: &str, name: &str) -> String {
+    if base.is_empty() {
+        name.to_string()
+    } else {
+        format!("{base}/{name}")
+    }
+}
+
+fn under(dir: &str, prefix: &str) -> bool {
+    dir == prefix || dir.starts_with(&format!("{prefix}/"))
+}
+
+// ── State access ──────────────────────────────────────────────────────────
+
+struct Ctx {
+    kek: Zeroizing<[u8; 32]>,
+    params: KdfParams,
+    dir: PathBuf,
+}
+
+fn require_kek(state: &AppState) -> Fallible<Zeroizing<[u8; 32]>> {
+    match state.kek.lock().unwrap().as_ref() {
+        Some(k) => Ok(Zeroizing::new(**k)),
+        None => Err(Fail(401, "Vault locked".into())),
+    }
+}
+
+fn ctx(state: &AppState) -> Fallible<Ctx> {
+    let kek = require_kek(state)?;
+    let cfg = load_cfg(&state.db.lock().unwrap())?.ok_or_else(|| Fail(409, "Storage folder not set".into()))?;
+    let dir = cfg.dir.clone().ok_or_else(|| Fail(409, "Storage folder not set".into()))?;
+    let dir = PathBuf::from(dir);
+    if !dir.is_dir() {
+        // Restored backup from another machine, unplugged external drive, …
+        return Err(Fail(409, "Storage folder not found".into()));
+    }
+    let params = cfg.kdf()?;
+    Ok(Ctx { kek, params, dir })
+}
+
+// ── Disk I/O ──────────────────────────────────────────────────────────────
+
+#[derive(Serialize)]
+struct Entry {
+    id: String,
+    #[serde(flatten)]
+    meta: FileMeta,
+}
+
+fn object_path(dir: &Path, id: &str) -> PathBuf {
+    dir.join(format!("{id}.{EXT}"))
+}
+
+fn new_id() -> String {
+    crypto::random::<16>().iter().map(|b| format!("{b:02x}")).collect()
+}
+
+/// Write to `<id>.mydt.tmp`, then rename over the final name. `durable` adds
+/// a per-file fsync — right for single-file ops that replace the only copy;
+/// bulk import skips it (one directory fsync per batch) since a crash there
+/// only yields an unreadable object flagged by the next listing, while the
+/// source files still exist.
+fn write_atomic(dir: &Path, id: &str, bytes: &[u8], durable: bool) -> std::io::Result<()> {
+    let tmp = dir.join(format!("{id}.{TMP_EXT}"));
+    let mut f = fs::File::create(&tmp)?;
+    std::io::Write::write_all(&mut f, bytes)?;
+    if durable {
+        f.sync_all()?;
+    }
+    drop(f);
+    fs::rename(&tmp, object_path(dir, id))
+}
+
+/// Read only header + metadata (not the payload) and decrypt the metadata.
+fn read_entry_meta(c: &Ctx, id: &str) -> Fallible<FileMeta> {
+    let mut f = fs::File::open(object_path(&c.dir, id))?;
+    let mut buf = vec![0u8; HEADER_LEN];
+    f.read_exact(&mut buf).map_err(|_| CryptoError::Format)?;
+    let n = crypto::meta_len(&buf)?;
+    f.by_ref().take(n as u64).read_to_end(&mut buf)?;
+    Ok(crypto::read_meta(&c.kek, &c.params.salt, &buf)?)
+}
+
+fn read_entry_full(c: &Ctx, id: &str) -> Fallible<(FileMeta, Zeroizing<Vec<u8>>)> {
+    let path = object_path(&c.dir, id);
+    // Size gate before reading: a hostile multi-GB object must not be slurped.
+    if fs::metadata(&path)?.len() > MAX_OBJECT_BYTES {
+        return Err(CryptoError::Format.into());
+    }
+    let bytes = fs::read(path)?;
+    Ok(crypto::decrypt_file(&c.kek, &c.params.salt, &bytes)?)
+}
+
+/// List via the in-memory metadata cache, reconciled against the id set on
+/// disk: removed ids are dropped, new ids are the only files opened and
+/// decrypted. First call after unlock scans everything; later calls cost one
+/// `read_dir`. Stale tmp files from interrupted writes are removed; unreadable
+/// or foreign files go to `errors` (never cached, so they retry every list).
+/// In-app mutations write through; a file rewritten in place by an external
+/// tool keeps its cached meta until the next unlock.
+// ponytail: id-set diff only; add a per-file mtime check if external same-id
+// rewrites ever need to be picked up live.
+fn list_entries(state: &AppState, c: &Ctx) -> Fallible<(Vec<Entry>, Vec<Value>)> {
+    let mut on_disk = HashSet::new();
+    for ent in fs::read_dir(&c.dir)? {
+        let path = ent?.path();
+        let Some(name) = path.file_name().and_then(|n| n.to_str()) else { continue };
+        if let Some(stem) = name.strip_suffix(&format!(".{TMP_EXT}")) {
+            if valid_id(stem).is_ok() {
+                let _ = fs::remove_file(&path);
+            }
+            continue;
+        }
+        let Some(id) = name.strip_suffix(&format!(".{EXT}")) else { continue };
+        if valid_id(id).is_ok() {
+            on_disk.insert(id.to_string());
+        }
+    }
+
+    let mut errors = Vec::new();
+    let mut guard = state.sf_meta.lock().unwrap();
+    let map = guard.get_or_insert_default();
+    map.retain(|id, _| on_disk.contains(id));
+    for id in &on_disk {
+        if map.contains_key(id) {
+            continue;
+        }
+        match read_entry_meta(c, id) {
+            Ok(meta) => {
+                map.insert(id.clone(), meta);
+            }
+            Err(Fail(_, msg)) => errors.push(json!({ "id": id, "error": msg })),
+        }
+    }
+    let mut files: Vec<Entry> = map.iter().map(|(id, m)| Entry { id: id.clone(), meta: m.clone() }).collect();
+    drop(guard);
+    files.sort_by(|a, b| (&a.meta.dir, &a.meta.name).cmp(&(&b.meta.dir, &b.meta.name)));
+    Ok((files, errors))
+}
+
+fn encrypt_and_store(c: &Ctx, meta: &FileMeta, plaintext: &[u8], durable: bool) -> Fallible<Entry> {
+    let id = new_id();
+    let bytes = crypto::encrypt_file(&c.kek, &c.params, meta, plaintext)?;
+    write_atomic(&c.dir, &id, &bytes, durable)?;
+    Ok(Entry { id, meta: meta.clone() })
+}
+
+fn mtime_ms(md: &fs::Metadata) -> i64 {
+    md.modified()
+        .ok()
+        .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+        .map(|d| d.as_millis() as i64)
+        .unwrap_or_else(now_ms)
+}
+
+fn import_file(c: &Ctx, src: &Path, logical_dir: &str, durable: bool) -> Fallible<Entry> {
+    let md = fs::metadata(src)?;
+    if md.len() > MAX_FILE_BYTES {
+        return Err(Fail(413, format!("file exceeds the {} MB limit", MAX_FILE_BYTES / 1024 / 1024)));
+    }
+    let name = src
+        .file_name()
+        .and_then(|n| n.to_str())
+        .ok_or_else(|| bad("invalid source file name"))?
+        .to_string();
+    valid_name(&name)?;
+    let plaintext = Zeroizing::new(fs::read(src)?);
+    if plaintext.len() as u64 > MAX_FILE_BYTES {
+        // File grew between the metadata check and the read.
+        return Err(Fail(413, format!("file exceeds the {} MB limit", MAX_FILE_BYTES / 1024 / 1024)));
+    }
+    let meta = FileMeta {
+        name,
+        dir: logical_dir.to_string(),
+        size: plaintext.len() as u64,
+        mtime: mtime_ms(&md),
+        imported_at: now_ms(),
+    };
+    encrypt_and_store(c, &meta, &plaintext, durable)
+}
+
+/// Walk `src` (file or directory) collecting `(source path, logical dir)`
+/// import targets. Directory contents land under `logical_dir/<dirname>/...`.
+/// Dot-files inside walked directories are skipped (`.DS_Store` & co);
+/// explicitly picked files are always included. Every walked directory's
+/// logical path is reported in `dirs` so empty folders still show in the tree.
+fn collect_import(src: &Path, logical_dir: &str, out: &mut Vec<(PathBuf, String)>, errors: &mut Vec<Value>, dirs: &mut Vec<String>) {
+    let push_err = |errors: &mut Vec<Value>, p: &Path, msg: String| {
+        errors.push(json!({ "path": p.to_string_lossy(), "error": msg }))
+    };
+    if src.is_dir() {
+        let Some(dirname) = src.file_name().and_then(|n| n.to_str()) else {
+            return push_err(errors, src, "invalid folder name".into());
+        };
+        let logical = join_dir(logical_dir, dirname);
+        let rd = match fs::read_dir(src) {
+            Ok(rd) => rd,
+            Err(e) => return push_err(errors, src, e.to_string()),
+        };
+        dirs.push(logical.clone());
+        let mut children: Vec<PathBuf> = rd.filter_map(|e| e.ok().map(|e| e.path())).collect();
+        children.sort();
+        for child in children {
+            if child.file_name().and_then(|n| n.to_str()).is_some_and(|n| n.starts_with('.')) {
+                continue;
+            }
+            collect_import(&child, &logical, out, errors, dirs);
+        }
+    } else {
+        out.push((src.to_path_buf(), logical_dir.to_string()));
+    }
+}
+
+/// Encrypt+write the collected targets across threads. Per-file fsync is
+/// skipped; the caller fsyncs the storage directory once per batch.
+fn import_batch(c: &Ctx, targets: &[(PathBuf, String)], imported: &mut Vec<Entry>, errors: &mut Vec<Value>) {
+    if targets.is_empty() {
+        return;
+    }
+    let workers = std::thread::available_parallelism().map(|n| n.get()).unwrap_or(4).min(8);
+    let chunk = targets.len().div_ceil(workers).max(1);
+    std::thread::scope(|s| {
+        let handles: Vec<_> = targets
+            .chunks(chunk)
+            .map(|slice| {
+                s.spawn(move || {
+                    let mut ok = Vec::new();
+                    let mut errs = Vec::new();
+                    for (src, logical) in slice {
+                        match import_file(c, src, logical, false) {
+                            Ok(e) => ok.push(e),
+                            Err(Fail(_, msg)) => errs.push(json!({ "path": src.to_string_lossy(), "error": msg })),
+                        }
+                    }
+                    (ok, errs)
+                })
+            })
+            .collect();
+        for h in handles {
+            let (ok, errs) = h.join().expect("import worker panicked");
+            imported.extend(ok);
+            errors.extend(errs);
+        }
+    });
+    let _ = fs::File::open(&c.dir).and_then(|d| d.sync_all());
+    imported.sort_by(|a, b| (&a.meta.dir, &a.meta.name).cmp(&(&b.meta.dir, &b.meta.name)));
+}
+
+/// Decrypt, mutate metadata, re-encrypt (fresh DEK/nonces), atomic replace.
+fn rewrite(c: &Ctx, id: &str, f: impl FnOnce(&mut FileMeta)) -> Fallible<Entry> {
+    let (mut meta, plaintext) = read_entry_full(c, id)?;
+    f(&mut meta);
+    let bytes = crypto::encrypt_file(&c.kek, &c.params, &meta, &plaintext)?;
+    write_atomic(&c.dir, id, &bytes, true)?;
+    Ok(Entry { id: id.to_string(), meta })
+}
+
+fn is_inside(path: &Path, dir: &Path) -> bool {
+    let canon = |p: &Path| fs::canonicalize(p).unwrap_or_else(|_| p.to_path_buf());
+    let parent = path.parent().map(canon).unwrap_or_default();
+    parent.starts_with(canon(dir))
+}
+
+/// Move every `.mydt` from `from` into `to`. Rename first, copy+remove when
+/// the volumes differ. Idempotent per file, so a retry finishes the job.
+fn migrate(from: &Path, to: &Path) -> std::io::Result<usize> {
+    let mut moved = 0;
+    for ent in fs::read_dir(from)? {
+        let path = ent?.path();
+        let Some(name) = path.file_name().and_then(|n| n.to_str()) else { continue };
+        let Some(id) = name.strip_suffix(&format!(".{EXT}")) else { continue };
+        if valid_id(id).is_err() {
+            continue;
+        }
+        let dest = to.join(name);
+        if fs::rename(&path, &dest).is_err() {
+            fs::copy(&path, &dest)?;
+            fs::remove_file(&path)?;
+        }
+        moved += 1;
+    }
+    Ok(moved)
+}
+
+// ── Routes ────────────────────────────────────────────────────────────────
+
+pub fn handle(state: &AppState, method: &str, rest: &str, body: Option<&str>) -> Result<ApiResponse> {
+    match dispatch(state, method, rest, body) {
+        Ok(r) => Ok(r),
+        Err(Fail(status, msg)) => Ok(ApiResponse::detail(status, &msg)),
+    }
+}
+
+fn parse<T: for<'de> Deserialize<'de>>(body: Option<&str>) -> Fallible<T> {
+    serde_json::from_str(body.unwrap_or("{}")).map_err(|e| bad(&format!("invalid body: {e}")))
+}
+
+fn ok(v: &impl Serialize) -> Fallible<ApiResponse> {
+    Ok(ApiResponse::ok(v)?)
+}
+
+fn dispatch(state: &AppState, method: &str, rest: &str, body: Option<&str>) -> Fallible<ApiResponse> {
+    match (method, rest) {
+        ("GET", "/settings") => {
+            let dir = load_cfg(&state.db.lock().unwrap())?.and_then(|c| c.dir);
+            let exists = dir.as_deref().is_some_and(|d| Path::new(d).is_dir());
+            let unlocked = state.kek.lock().unwrap().is_some();
+            ok(&json!({ "dir": dir, "exists": exists, "unlocked": unlocked }))
+        }
+        ("PUT", "/settings") => {
+            #[derive(Deserialize)]
+            struct Body {
+                dir: String,
+            }
+            let Body { dir } = parse(body)?;
+            let new_dir = PathBuf::from(&dir);
+            if !new_dir.is_absolute() {
+                return Err(bad("storage folder must be an absolute path"));
+            }
+            fs::create_dir_all(&new_dir)?;
+            let mut cfg = load_or_create_cfg(&state.db.lock().unwrap())?;
+            let mut moved = 0;
+            if let Some(old) = cfg.dir.as_deref().map(Path::new) {
+                let same = fs::canonicalize(old).ok() == fs::canonicalize(&new_dir).ok();
+                if !same && old.is_dir() {
+                    moved = migrate(old, &new_dir)?;
+                }
+            }
+            cfg.dir = Some(dir.clone());
+            save_cfg(&state.db.lock().unwrap(), &cfg)?;
+            ok(&json!({ "dir": dir, "moved": moved }))
+        }
+        ("GET", "/files") => {
+            let c = ctx(state)?;
+            let (files, errors) = list_entries(state, &c)?;
+            ok(&json!({ "files": files, "errors": errors }))
+        }
+        ("POST", "/files/import") => {
+            #[derive(Deserialize)]
+            struct Body {
+                paths: Vec<String>,
+                #[serde(default)]
+                dir: String,
+            }
+            let Body { paths, dir } = parse(body)?;
+            valid_dir(&dir)?;
+            let c = ctx(state)?;
+            let (mut targets, mut errors, mut dirs) = (Vec::new(), Vec::new(), Vec::new());
+            for p in &paths {
+                collect_import(Path::new(p), &dir, &mut targets, &mut errors, &mut dirs);
+            }
+            let mut imported = Vec::new();
+            import_batch(&c, &targets, &mut imported, &mut errors);
+            for e in &imported {
+                cache_put(state, e);
+            }
+            ok(&json!({ "imported": imported, "errors": errors, "dirs": dirs }))
+        }
+        ("POST", "/folders/rename") => {
+            #[derive(Deserialize)]
+            struct Body {
+                from: String,
+                to: String,
+            }
+            let Body { from, to } = parse(body)?;
+            valid_dir(&from)?;
+            valid_dir(&to)?;
+            if from.is_empty() {
+                return Err(bad("cannot rename the root folder"));
+            }
+            let c = ctx(state)?;
+            let (files, _) = list_entries(state, &c)?;
+            let mut updated = 0;
+            for e in files.iter().filter(|e| under(&e.meta.dir, &from)) {
+                let suffix = e.meta.dir[from.len()..].to_string(); // "" or "/sub"
+                let renamed = rewrite(&c, &e.id, |m| m.dir = format!("{to}{suffix}"))?;
+                cache_put(state, &renamed);
+                updated += 1;
+            }
+            ok(&json!({ "updated": updated }))
+        }
+        ("POST", "/folders/delete") => {
+            #[derive(Deserialize)]
+            struct Body {
+                dir: String,
+            }
+            let Body { dir } = parse(body)?;
+            valid_dir(&dir)?;
+            if dir.is_empty() {
+                return Err(bad("cannot delete the root folder"));
+            }
+            let c = ctx(state)?;
+            let (files, _) = list_entries(state, &c)?;
+            let mut deleted = 0;
+            for e in files.iter().filter(|e| under(&e.meta.dir, &dir)) {
+                fs::remove_file(object_path(&c.dir, &e.id))?;
+                cache_remove(state, &e.id);
+                deleted += 1;
+            }
+            ok(&json!({ "deleted": deleted }))
+        }
+        _ => {
+            let Some(tail) = rest.strip_prefix("/files/") else {
+                return Err(Fail(404, "Not found".into()));
+            };
+            let (id, action) = tail.split_once('/').unwrap_or((tail, ""));
+            valid_id(id)?;
+            match (method, action) {
+                ("PATCH", "") => {
+                    #[derive(Deserialize)]
+                    struct Body {
+                        name: Option<String>,
+                        dir: Option<String>,
+                    }
+                    let Body { name, dir } = parse(body)?;
+                    if let Some(n) = &name {
+                        valid_name(n)?;
+                    }
+                    if let Some(d) = &dir {
+                        valid_dir(d)?;
+                    }
+                    let c = ctx(state)?;
+                    let e = rewrite(&c, id, |m| {
+                        if let Some(n) = name {
+                            m.name = n;
+                        }
+                        if let Some(d) = dir {
+                            m.dir = d;
+                        }
+                    })?;
+                    cache_put(state, &e);
+                    ok(&e)
+                }
+                ("DELETE", "") => {
+                    let c = ctx(state)?;
+                    fs::remove_file(object_path(&c.dir, id))?;
+                    cache_remove(state, id);
+                    Ok(ApiResponse::empty(204))
+                }
+                ("POST", "replace") => {
+                    #[derive(Deserialize)]
+                    struct Body {
+                        path: String,
+                    }
+                    let Body { path } = parse(body)?;
+                    let src = Path::new(&path);
+                    let md = fs::metadata(src)?;
+                    if md.len() > MAX_FILE_BYTES {
+                        return Err(Fail(413, format!("file exceeds the {} MB limit", MAX_FILE_BYTES / 1024 / 1024)));
+                    }
+                    let c = ctx(state)?;
+                    let (mut meta, _) = read_entry_full(&c, id)?;
+                    let plaintext = Zeroizing::new(fs::read(src)?);
+                    if plaintext.len() as u64 > MAX_FILE_BYTES {
+                        return Err(Fail(413, format!("file exceeds the {} MB limit", MAX_FILE_BYTES / 1024 / 1024)));
+                    }
+                    meta.size = plaintext.len() as u64;
+                    meta.mtime = mtime_ms(&md);
+                    let bytes = crypto::encrypt_file(&c.kek, &c.params, &meta, &plaintext)?;
+                    write_atomic(&c.dir, id, &bytes, true)?;
+                    let e = Entry { id: id.to_string(), meta };
+                    cache_put(state, &e);
+                    ok(&e)
+                }
+                ("POST", "export") => {
+                    #[derive(Deserialize)]
+                    struct Body {
+                        path: String,
+                    }
+                    let Body { path } = parse(body)?;
+                    let dest = Path::new(&path);
+                    let c = ctx(state)?;
+                    if is_inside(dest, &c.dir) {
+                        return Err(bad("cannot export into the encrypted storage folder"));
+                    }
+                    let (_, plaintext) = read_entry_full(&c, id)?;
+                    fs::write(dest, &*plaintext)?;
+                    Ok(ApiResponse::empty(204))
+                }
+                _ => Err(Fail(404, "Not found".into())),
+            }
+        }
+    }
+}
+
+/// Plaintext bytes for the raw-binary `secure_file_read` command (preview).
+pub fn read_plaintext(state: &AppState, id: &str) -> std::result::Result<Vec<u8>, String> {
+    let run = || -> Fallible<Vec<u8>> {
+        valid_id(id)?;
+        let c = ctx(state)?;
+        let (_, mut plaintext) = read_entry_full(&c, id)?;
+        // Handed to the IPC layer, which owns (and does not zeroize) the buffer.
+        Ok(std::mem::take(&mut *plaintext))
+    };
+    run().map_err(|Fail(_, msg)| msg)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::router::route;
+
+    fn body_json(r: &ApiResponse) -> Value {
+        serde_json::from_str(&r.body).unwrap()
+    }
+
+    struct Tmp(PathBuf);
+    impl Tmp {
+        fn new(tag: &str) -> Self {
+            let dir = std::env::temp_dir().join(format!("mdt-sf-{tag}-{}", std::process::id()));
+            let _ = fs::remove_dir_all(&dir);
+            fs::create_dir_all(&dir).unwrap();
+            Self(dir)
+        }
+        fn path(&self, name: &str) -> PathBuf {
+            self.0.join(name)
+        }
+        fn s(&self, name: &str) -> String {
+            self.path(name).to_string_lossy().into_owned()
+        }
+    }
+    impl Drop for Tmp {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    /// Unlocked state with a fixed KEK (skips Argon2) and storage dir set.
+    fn unlocked(tmp: &Tmp) -> AppState {
+        let state = AppState::in_memory();
+        load_or_create_cfg(&state.db.lock().unwrap()).unwrap();
+        *state.kek.lock().unwrap() = Some(Zeroizing::new([7u8; 32]));
+        let r = route(&state, "PUT", "/api/v1/secure-files/settings", Some(&json!({ "dir": tmp.s("store") }).to_string())).unwrap();
+        assert_eq!(r.status, 200, "{}", r.body);
+        state
+    }
+
+    fn import(state: &AppState, paths: &[String], dir: &str) -> Value {
+        let body = json!({ "paths": paths, "dir": dir }).to_string();
+        let r = route(state, "POST", "/api/v1/secure-files/files/import", Some(&body)).unwrap();
+        assert_eq!(r.status, 200, "{}", r.body);
+        body_json(&r)
+    }
+
+    fn list(state: &AppState) -> Value {
+        let r = route(state, "GET", "/api/v1/secure-files/files", None).unwrap();
+        assert_eq!(r.status, 200, "{}", r.body);
+        body_json(&r)
+    }
+
+    fn store_names(tmp: &Tmp) -> Vec<String> {
+        let mut v: Vec<String> = fs::read_dir(tmp.path("store"))
+            .unwrap()
+            .map(|e| e.unwrap().file_name().to_string_lossy().into_owned())
+            .collect();
+        v.sort();
+        v
+    }
+
+    #[test]
+    fn locked_and_unconfigured_states() {
+        let state = AppState::in_memory();
+        let r = route(&state, "GET", "/api/v1/secure-files/settings", None).unwrap();
+        assert_eq!(body_json(&r), json!({ "dir": null, "exists": false, "unlocked": false }));
+        let r = route(&state, "GET", "/api/v1/secure-files/files", None).unwrap();
+        assert_eq!(r.status, 401);
+        *state.kek.lock().unwrap() = Some(Zeroizing::new([7u8; 32]));
+        let r = route(&state, "GET", "/api/v1/secure-files/files", None).unwrap();
+        assert_eq!(r.status, 409);
+        let r = route(&state, "PUT", "/api/v1/secure-files/settings", Some(r#"{"dir":"relative"}"#)).unwrap();
+        assert_eq!(r.status, 400);
+    }
+
+    #[test]
+    fn import_list_preview_rename_replace_export_delete() {
+        let tmp = Tmp::new("crud");
+        let state = unlocked(&tmp);
+        fs::write(tmp.path("config.json"), b"{\"a\":1}").unwrap();
+        fs::write(tmp.path("big.bin"), vec![0u8; (MAX_FILE_BYTES + 1) as usize]).unwrap();
+
+        let res = import(&state, &[tmp.s("config.json"), tmp.s("big.bin"), tmp.s("missing.txt")], "proj");
+        assert_eq!(res["imported"].as_array().unwrap().len(), 1);
+        assert_eq!(res["errors"].as_array().unwrap().len(), 2);
+        assert!(res["errors"][0]["error"].as_str().unwrap().contains("20 MB"));
+        let id = res["imported"][0]["id"].as_str().unwrap().to_string();
+        assert_eq!(res["imported"][0]["name"], "config.json");
+        assert_eq!(res["imported"][0]["dir"], "proj");
+        assert_eq!(res["imported"][0]["size"], 7);
+
+        // Physical store: one opaque file, no plaintext.
+        assert_eq!(store_names(&tmp), vec![format!("{id}.mydt")]);
+        let raw = fs::read(tmp.path(&format!("store/{id}.mydt"))).unwrap();
+        assert!(!raw.windows(11).any(|w| w == b"config.json"));
+
+        let l = list(&state);
+        assert_eq!(l["files"].as_array().unwrap().len(), 1);
+        assert_eq!(l["errors"].as_array().unwrap().len(), 0);
+
+        assert_eq!(read_plaintext(&state, &id).unwrap(), b"{\"a\":1}");
+        assert!(read_plaintext(&state, "nothex").is_err());
+
+        // Rename + move
+        let r = route(&state, "PATCH", &format!("/api/v1/secure-files/files/{id}"), Some(r#"{"name":"cfg.json","dir":"proj/sub"}"#)).unwrap();
+        assert_eq!(r.status, 200, "{}", r.body);
+        assert_eq!(body_json(&r)["name"], "cfg.json");
+        assert_eq!(list(&state)["files"][0]["dir"], "proj/sub");
+        assert_eq!(store_names(&tmp), vec![format!("{id}.mydt")], "rename keeps physical name");
+        let r = route(&state, "PATCH", &format!("/api/v1/secure-files/files/{id}"), Some(r#"{"name":"../x"}"#)).unwrap();
+        assert_eq!(r.status, 400);
+        let r = route(&state, "PATCH", &format!("/api/v1/secure-files/files/{id}"), Some(r#"{"dir":"a/../b"}"#)).unwrap();
+        assert_eq!(r.status, 400);
+
+        // Replace content, keep name
+        fs::write(tmp.path("new.json"), b"{\"a\":2}").unwrap();
+        let r = route(&state, "POST", &format!("/api/v1/secure-files/files/{id}/replace"), Some(&json!({ "path": tmp.s("new.json") }).to_string())).unwrap();
+        assert_eq!(r.status, 200, "{}", r.body);
+        assert_eq!(body_json(&r)["name"], "cfg.json");
+        assert_eq!(read_plaintext(&state, &id).unwrap(), b"{\"a\":2}");
+
+        // Export: refused inside store, ok outside
+        let r = route(&state, "POST", &format!("/api/v1/secure-files/files/{id}/export"), Some(&json!({ "path": tmp.s("store/out.json") }).to_string())).unwrap();
+        assert_eq!(r.status, 400);
+        let r = route(&state, "POST", &format!("/api/v1/secure-files/files/{id}/export"), Some(&json!({ "path": tmp.s("out.json") }).to_string())).unwrap();
+        assert_eq!(r.status, 204, "{}", r.body);
+        assert_eq!(fs::read(tmp.path("out.json")).unwrap(), b"{\"a\":2}");
+
+        let r = route(&state, "DELETE", &format!("/api/v1/secure-files/files/{id}"), None).unwrap();
+        assert_eq!(r.status, 204);
+        assert!(store_names(&tmp).is_empty());
+    }
+
+    #[test]
+    fn folder_import_hierarchy_rename_delete() {
+        let tmp = Tmp::new("folders");
+        let state = unlocked(&tmp);
+        fs::create_dir_all(tmp.path("src/nested")).unwrap();
+        fs::write(tmp.path("src/a.txt"), b"a").unwrap();
+        fs::write(tmp.path("src/nested/b.txt"), b"b").unwrap();
+        fs::write(tmp.path("src/.DS_Store"), b"junk").unwrap();
+
+        fs::create_dir_all(tmp.path("src/empty")).unwrap();
+        let res = import(&state, &[tmp.s("src")], "");
+        let dirs: Vec<&str> = res["imported"].as_array().unwrap().iter().map(|e| e["dir"].as_str().unwrap()).collect();
+        assert_eq!(dirs, vec!["src", "src/nested"]);
+        // Every walked directory is reported — including the empty one.
+        let walked: Vec<&str> = res["dirs"].as_array().unwrap().iter().map(|d| d.as_str().unwrap()).collect();
+        assert_eq!(walked, vec!["src", "src/empty", "src/nested"]);
+
+        let r = route(&state, "POST", "/api/v1/secure-files/folders/rename", Some(r#"{"from":"src","to":"app"}"#)).unwrap();
+        assert_eq!(body_json(&r)["updated"], 2);
+        let l = list(&state);
+        let dirs: Vec<&str> = l["files"].as_array().unwrap().iter().map(|e| e["dir"].as_str().unwrap()).collect();
+        assert_eq!(dirs, vec!["app", "app/nested"]);
+
+        let r = route(&state, "POST", "/api/v1/secure-files/folders/delete", Some(r#"{"dir":"app/nested"}"#)).unwrap();
+        assert_eq!(body_json(&r)["deleted"], 1);
+        assert_eq!(list(&state)["files"].as_array().unwrap().len(), 1);
+        let r = route(&state, "POST", "/api/v1/secure-files/folders/delete", Some(r#"{"dir":""}"#)).unwrap();
+        assert_eq!(r.status, 400);
+    }
+
+    #[test]
+    fn foreign_and_corrupt_files_reported_not_fatal_and_tmp_cleaned() {
+        let tmp = Tmp::new("errors");
+        let state = unlocked(&tmp);
+        fs::write(tmp.path("ok.txt"), b"ok").unwrap();
+        import(&state, &[tmp.s("ok.txt")], "");
+
+        // Foreign vault: same layout, different salt.
+        let other = KdfParams { salt: [1u8; SALT_LEN], m_cost: 8, t_cost: 1, p_cost: 1 };
+        let meta = FileMeta { name: "x".into(), dir: "".into(), size: 1, mtime: 0, imported_at: 0 };
+        let foreign = crypto::encrypt_file(&[7u8; 32], &other, &meta, b"x").unwrap();
+        fs::write(tmp.path(&format!("store/{}.mydt", "a".repeat(32))), foreign).unwrap();
+        // Corrupt: truncated garbage.
+        fs::write(tmp.path(&format!("store/{}.mydt", "b".repeat(32))), b"MYDTgarbage").unwrap();
+        // Stale temp (interrupted rewrite of the valid file + an orphan) + unrelated file.
+        let ok_id = list(&state)["files"][0]["id"].as_str().unwrap().to_string();
+        fs::write(tmp.path(&format!("store/{ok_id}.mydt.tmp")), b"partial").unwrap();
+        fs::write(tmp.path(&format!("store/{}.mydt.tmp", "c".repeat(32))), b"partial").unwrap();
+        fs::write(tmp.path("store/readme.txt"), b"ignored").unwrap();
+        // Oversized object: never read into memory, reported not fatal.
+        let huge = fs::File::create(tmp.path(&format!("store/{}.mydt", "d".repeat(32)))).unwrap();
+        huge.set_len(MAX_OBJECT_BYTES + 1).unwrap();
+
+        let l = list(&state);
+        assert_eq!(l["files"].as_array().unwrap().len(), 1);
+        let errs = l["errors"].as_array().unwrap();
+        assert_eq!(errs.len(), 3);
+        assert!(errs.iter().any(|e| e["error"].as_str().unwrap().contains("another vault")));
+        assert!(!store_names(&tmp).iter().any(|n| n.ends_with(".tmp")), "stale tmp removed");
+        assert_eq!(read_plaintext(&state, &ok_id).unwrap(), b"ok", "valid file untouched by tmp cleanup");
+        assert!(read_plaintext(&state, &"d".repeat(32)).is_err());
+    }
+
+    #[test]
+    fn exact_limit_accepted_and_missing_storage_dir_is_409() {
+        let tmp = Tmp::new("limit");
+        let state = unlocked(&tmp);
+        fs::write(tmp.path("max.bin"), vec![1u8; MAX_FILE_BYTES as usize]).unwrap();
+        let res = import(&state, &[tmp.s("max.bin")], "");
+        assert_eq!(res["imported"].as_array().unwrap().len(), 1, "{}", res);
+        assert_eq!(res["imported"][0]["size"], MAX_FILE_BYTES);
+
+        fs::remove_dir_all(tmp.path("store")).unwrap();
+        let r = route(&state, "GET", "/api/v1/secure-files/settings", None).unwrap();
+        assert_eq!(body_json(&r)["exists"], false);
+        let r = route(&state, "GET", "/api/v1/secure-files/files", None).unwrap();
+        assert_eq!(r.status, 409);
+        assert!(r.body.contains("not found"));
+    }
+
+    #[test]
+    fn listing_cache_tracks_external_changes_and_mutations() {
+        let tmp = Tmp::new("cache");
+        let state = unlocked(&tmp);
+        fs::write(tmp.path("a.txt"), b"a").unwrap();
+        fs::write(tmp.path("b.txt"), b"b").unwrap();
+        let res = import(&state, &[tmp.s("a.txt"), tmp.s("b.txt")], "");
+        let id_a = res["imported"][0]["id"].as_str().unwrap().to_string();
+        assert_eq!(list(&state)["files"].as_array().unwrap().len(), 2);
+        assert!(state.sf_meta.lock().unwrap().is_some(), "cache warm after list");
+
+        // External removal is picked up by the id-set diff.
+        fs::remove_file(tmp.path(&format!("store/{id_a}.mydt"))).unwrap();
+        assert_eq!(list(&state)["files"].as_array().unwrap().len(), 1);
+
+        // External addition (same salt) is decrypted incrementally.
+        let cfg = load_cfg(&state.db.lock().unwrap()).unwrap().unwrap();
+        let params = cfg.kdf().unwrap();
+        let meta = FileMeta { name: "ext.txt".into(), dir: "".into(), size: 1, mtime: 0, imported_at: 0 };
+        let obj = crypto::encrypt_file(&[7u8; 32], &params, &meta, b"x").unwrap();
+        fs::write(tmp.path(&format!("store/{}.mydt", "e".repeat(32))), obj).unwrap();
+        let l = list(&state);
+        assert_eq!(l["files"].as_array().unwrap().len(), 2);
+        assert!(l["files"].as_array().unwrap().iter().any(|f| f["name"] == "ext.txt"));
+
+        // In-app rename is visible through the cache (write-through).
+        let id_b = l["files"].as_array().unwrap().iter().find(|f| f["name"] == "b.txt").unwrap()["id"]
+            .as_str().unwrap().to_string();
+        route(&state, "PATCH", &format!("/api/v1/secure-files/files/{id_b}"), Some(r#"{"name":"b2.txt"}"#)).unwrap();
+        assert!(list(&state)["files"].as_array().unwrap().iter().any(|f| f["name"] == "b2.txt"));
+
+        // Lock clears the plaintext-metadata cache.
+        lock(&state);
+        assert!(state.sf_meta.lock().unwrap().is_none());
+    }
+
+    /// Manual scale check: `cargo test --lib scale_smoke_10k -- --ignored --nocapture`.
+    #[test]
+    #[ignore]
+    fn scale_smoke_10k() {
+        let tmp = Tmp::new("scale");
+        let state = unlocked(&tmp);
+        fs::create_dir_all(tmp.path("src")).unwrap();
+        for i in 0..10_000 {
+            fs::write(tmp.path(&format!("src/f{i:05}.txt")), format!("payload {i}")).unwrap();
+        }
+        let t0 = std::time::Instant::now();
+        let res = import(&state, &[tmp.s("src")], "");
+        let t_import = t0.elapsed();
+        assert_eq!(res["imported"].as_array().unwrap().len(), 10_000);
+
+        *state.sf_meta.lock().unwrap() = None; // force a cold scan
+        let t0 = std::time::Instant::now();
+        assert_eq!(list(&state)["files"].as_array().unwrap().len(), 10_000);
+        let t_cold = t0.elapsed();
+        let t0 = std::time::Instant::now();
+        list(&state);
+        let t_warm = t0.elapsed();
+        println!("10k files: import {t_import:?}, cold list {t_cold:?}, warm list {t_warm:?}");
+    }
+
+    #[test]
+    fn change_storage_dir_moves_files() {
+        let tmp = Tmp::new("migrate");
+        let state = unlocked(&tmp);
+        fs::write(tmp.path("f.txt"), b"f").unwrap();
+        let id = import(&state, &[tmp.s("f.txt")], "")["imported"][0]["id"].as_str().unwrap().to_string();
+
+        let r = route(&state, "PUT", "/api/v1/secure-files/settings", Some(&json!({ "dir": tmp.s("store2") }).to_string())).unwrap();
+        assert_eq!(body_json(&r)["moved"], 1);
+        assert!(store_names(&tmp).is_empty());
+        assert!(tmp.path(&format!("store2/{id}.mydt")).exists());
+        assert_eq!(read_plaintext(&state, &id).unwrap(), b"f");
+        let r = route(&state, "GET", "/api/v1/secure-files/settings", None).unwrap();
+        assert_eq!(body_json(&r)["dir"], tmp.s("store2"));
+    }
+
+    #[test]
+    fn unlock_lock_roundtrip_with_real_kdf() {
+        let tmp = Tmp::new("unlock");
+        let state = AppState::in_memory();
+        let r = route(&state, "POST", "/api/v1/auth/master-vault/unlock", Some(r#"{"password":"hunter2"}"#)).unwrap();
+        assert_eq!(r.status, 200, "{}", r.body);
+        assert!(state.kek.lock().unwrap().is_some());
+        let first = **state.kek.lock().unwrap().as_ref().unwrap();
+
+        route(&state, "PUT", "/api/v1/secure-files/settings", Some(&json!({ "dir": tmp.s("store") }).to_string())).unwrap();
+        fs::write(tmp.path("f.txt"), b"f").unwrap();
+        let id = import(&state, &[tmp.s("f.txt")], "")["imported"][0]["id"].as_str().unwrap().to_string();
+
+        let r = route(&state, "POST", "/api/v1/auth/master-vault/lock", None).unwrap();
+        assert_eq!(r.status, 204);
+        assert!(state.kek.lock().unwrap().is_none());
+        assert_eq!(route(&state, "GET", "/api/v1/secure-files/files", None).unwrap().status, 401);
+
+        // Same password → same KEK (salt persisted) → files still open.
+        route(&state, "POST", "/api/v1/auth/master-vault/unlock", Some(r#"{"password":"hunter2"}"#)).unwrap();
+        assert_eq!(**state.kek.lock().unwrap().as_ref().unwrap(), first);
+        assert_eq!(read_plaintext(&state, &id).unwrap(), b"f");
+
+        // Different password → files report tamper/auth failure, not a crash.
+        route(&state, "POST", "/api/v1/auth/master-vault/unlock", Some(r#"{"password":"wrong"}"#)).unwrap();
+        assert_eq!(list(&state)["errors"].as_array().unwrap().len(), 1);
+    }
+}
diff --git a/apps/desktop/src-tauri/src/state.rs b/apps/desktop/src-tauri/src/state.rs
index c08db39c..fd979a45 100644
--- a/apps/desktop/src-tauri/src/state.rs
+++ b/apps/desktop/src-tauri/src/state.rs
@@ -1,6 +1,8 @@
 use std::path::{Path, PathBuf};
 use std::sync::Mutex;
 
+use zeroize::Zeroizing;
+
 use crate::db;
 use crate::error::Result;
 
@@ -9,6 +11,14 @@ pub struct AppState {
     /// App data directory holding the DB files. None for in-memory test state,
     /// which keeps destructive file operations (factory reset) inert in tests.
     pub data_dir: Option<PathBuf>,
+    /// Secure Files KEK (Argon2id of the master password). `None` = locked.
+    /// Dropping the `Zeroizing` wipes the bytes.
+    pub kek: Mutex<Option<Zeroizing<[u8; 32]>>>,
+    /// Secure Files decrypted-metadata cache (id → meta), populated by the
+    /// first listing after unlock and kept fresh by write-through + an id-set
+    /// diff against the storage dir. `None` = cold (locked or never listed).
+    /// Plaintext names live here only while the vault is unlocked.
+    pub sf_meta: Mutex<Option<std::collections::HashMap<String, mydt::FileMeta>>>,
 }
 
 impl AppState {
@@ -17,6 +27,8 @@ impl AppState {
         Ok(Self {
             db: Mutex::new(conn),
             data_dir: db_path.parent().map(Path::to_path_buf),
+            kek: Mutex::new(None),
+            sf_meta: Mutex::new(None),
         })
     }
 
@@ -25,6 +37,6 @@ impl AppState {
     pub fn in_memory() -> Self {
         let conn = rusqlite::Connection::open_in_memory().unwrap();
         db::migrations::run(&conn).unwrap();
-        Self { db: Mutex::new(conn), data_dir: None }
+        Self { db: Mutex::new(conn), data_dir: None, kek: Mutex::new(None), sf_meta: Mutex::new(None) }
     }
 }
diff --git a/crates/mydt/Cargo.lock b/crates/mydt/Cargo.lock
new file mode 100644
index 00000000..657155ac
--- /dev/null
+++ b/crates/mydt/Cargo.lock
@@ -0,0 +1,521 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aead"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
+dependencies = [
+ "crypto-common 0.2.2",
+ "inout",
+]
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.3.0",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+]
+
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout",
+]
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "getrandom",
+ "hybrid-array",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mydt"
+version = "0.1.0"
+dependencies = [
+ "argon2",
+ "chacha20poly1305",
+ "getrandom",
+ "rpassword",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "zeroize",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "poly1305"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
+dependencies = [
+ "cpufeatures 0.3.0",
+ "universal-hash",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rpassword"
+version = "7.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
+dependencies = [
+ "libc",
+ "rtoolbox",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rtoolbox"
+version = "0.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50a0e551c1e27e1731aba276dbeaeac73f53c7cd34d1bda485d02bd1e0f36844"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "universal-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
+dependencies = [
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/crates/mydt/Cargo.toml b/crates/mydt/Cargo.toml
new file mode 100644
index 00000000..00b4fe75
--- /dev/null
+++ b/crates/mydt/Cargo.toml
@@ -0,0 +1,34 @@
+[package]
+name = "mydt"
+version = "0.1.0"
+edition = "2021"
+description = "MyDevTools .mydt encrypted file format — reference implementation and CLI"
+license = "AGPL-3.0"
+repository = "https://github.com/mydevtools-tech/mydevtools"
+readme = "README.md"
+
+[lib]
+name = "mydt"
+path = "src/lib.rs"
+
+[[bin]]
+name = "mydt"
+path = "src/main.rs"
+required-features = ["cli"]
+
+[features]
+cli = ["dep:rpassword"]
+
+[dependencies]
+argon2 = "0.5"
+chacha20poly1305 = "0.11"
+zeroize = "1"
+getrandom = "0.4"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "2"
+rpassword = { version = "7", optional = true }
+
+[profile.release]
+strip = true
+lto = true
diff --git a/crates/mydt/README.md b/crates/mydt/README.md
new file mode 100644
index 00000000..848bb60c
--- /dev/null
+++ b/crates/mydt/README.md
@@ -0,0 +1,43 @@
+# mydt
+
+Reference implementation of the MyDevTools `.mydt` encrypted file format
+(Argon2id + XChaCha20-Poly1305, self-contained per file) and a small CLI.
+Format spec: [`docs/MYDT_FORMAT.md`](../../docs/MYDT_FORMAT.md).
+
+The desktop app's Secure Files tool uses this crate unchanged, so anything the
+CLI writes opens in the app and vice versa.
+
+## Library
+
+```rust
+let params = mydt::KdfParams::generate();               // random salt, default costs
+let kek = mydt::derive_kek(b"password", &params)?;      // Argon2id, once per salt
+let meta = mydt::FileMeta { name: "a.env".into(), dir: "".into(), size: 3, mtime: 0, imported_at: 0 };
+let object = mydt::encrypt_file(&kek, &params, &meta, b"x=1")?;
+
+let params = mydt::kdf_params(&object)?;                // read salt/costs back
+let (meta, plaintext) = mydt::decrypt_file(&kek, &params.salt, &object)?;
+```
+
+## CLI
+
+```sh
+cargo install --path . --features cli        # or: cargo build --release --features cli
+
+export MYDT_PASSWORD=...                      # otherwise prompted
+mydt encrypt secrets.env --dir proj/config    # prints <32 hex>.mydt
+mydt encrypt a.pem --params-from ~/SecureFiles/<any>.mydt -o ~/SecureFiles/new.mydt
+mydt info   <file>.mydt [--unlock]
+mydt ls     ~/SecureFiles
+mydt decrypt <file>.mydt [-o out | -o -]
+```
+
+`--params-from` copies another object's salt and KDF parameters, which is what
+makes a CLI-written file a member of an existing Secure Files storage folder.
+Without it a fresh random salt is used and the desktop app will report the file
+as belonging to another vault.
+
+## Tests
+
+`cargo test` — round trips, tamper/truncation/garbage sweep, wrong key, foreign
+salt, 20 MiB payload, nonce freshness.
diff --git a/crates/mydt/src/lib.rs b/crates/mydt/src/lib.rs
new file mode 100644
index 00000000..a80c3367
--- /dev/null
+++ b/crates/mydt/src/lib.rs
@@ -0,0 +1,392 @@
+//! MyDevTools `.mydt` v1 container — pure crypto/format, no I/O, no DB.
+//! Spec: `docs/MYDT_FORMAT.md` in the MyDevTools repository.
+//!
+//! Byte layout (ints u32 LE):
+//! ```text
+//! off    len  field
+//! 0      4    magic "MYDT"
+//! 4      1    version = 1
+//! 5      16   argon2 salt
+//! 21     4    m_cost (KiB)
+//! 25     4    t_cost
+//! 29     4    p_cost
+//! 33     24   dek_nonce
+//! 57     48   wrapped DEK = XChaCha(KEK, dek_nonce, DEK[32], aad = bytes[0..33])
+//! 105    24   meta_nonce
+//! 129    4    meta_len (ciphertext incl. 16-byte tag)
+//! 133    N    meta ct    = XChaCha(DEK, meta_nonce, metaJSON, aad = bytes[0..133])
+//! 133+N  24   payload_nonce
+//! 157+N  ...  payload ct = XChaCha(DEK, payload_nonce, plaintext, aad = bytes[0..133])
+//! ```
+//! Every file carries its own salt + KDF params, so a lone `.mydt` is openable
+//! with just the password. All files of one vault share the salt, so the KEK
+//! is derived once per unlock and listing never runs Argon2.
+
+use argon2::{Algorithm, Argon2, Params, Version};
+use chacha20poly1305::aead::{Aead, KeyInit, Payload};
+use chacha20poly1305::{XChaCha20Poly1305, XNonce};
+use serde::{Deserialize, Serialize};
+use zeroize::Zeroizing;
+
+pub const MAGIC: &[u8; 4] = b"MYDT";
+pub const VERSION: u8 = 1;
+pub const SALT_LEN: usize = 16;
+pub const NONCE_LEN: usize = 24;
+const TAG_LEN: usize = 16;
+const KEY_LEN: usize = 32;
+/// End of the KDF block (magic + version + salt + 3 params) — AAD for the DEK wrap.
+const KDF_END: usize = 4 + 1 + SALT_LEN + 12;
+const DEK_NONCE_AT: usize = KDF_END;
+const DEK_AT: usize = DEK_NONCE_AT + NONCE_LEN;
+const META_NONCE_AT: usize = DEK_AT + KEY_LEN + TAG_LEN;
+const META_LEN_AT: usize = META_NONCE_AT + NONCE_LEN;
+/// Fixed header size; metadata ciphertext starts here.
+pub const HEADER_LEN: usize = META_LEN_AT + 4;
+pub const MAX_FILE_BYTES: u64 = 20 * 1024 * 1024;
+/// Metadata JSON is a few hundred bytes; anything bigger is not ours.
+pub const MAX_META_BYTES: usize = 64 * 1024;
+/// Largest `.mydt` object we will read into memory: payload cap + header +
+/// metadata cap + nonces/tags. Guards against a hostile multi-GB file.
+pub const MAX_OBJECT_BYTES: u64 = MAX_FILE_BYTES + (HEADER_LEN + MAX_META_BYTES + NONCE_LEN + TAG_LEN) as u64;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct KdfParams {
+    pub salt: [u8; SALT_LEN],
+    pub m_cost: u32,
+    pub t_cost: u32,
+    pub p_cost: u32,
+}
+
+impl KdfParams {
+    // ~0.3–0.8 s on a 2020+ laptop; runs once per unlock. Stored per file, so
+    // changing these only affects new writes.
+    pub const DEFAULT_M_COST: u32 = 65536;
+    pub const DEFAULT_T_COST: u32 = 3;
+    pub const DEFAULT_P_COST: u32 = 1;
+
+    pub fn generate() -> Self {
+        Self {
+            salt: random(),
+            m_cost: Self::DEFAULT_M_COST,
+            t_cost: Self::DEFAULT_T_COST,
+            p_cost: Self::DEFAULT_P_COST,
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq)]
+pub struct FileMeta {
+    pub name: String,
+    /// Logical folder, `"a/b"` or `""` for root.
+    pub dir: String,
+    pub size: u64,
+    /// Source file mtime, epoch ms.
+    pub mtime: i64,
+    #[serde(rename = "importedAt")]
+    pub imported_at: i64,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum CryptoError {
+    #[error("not a .mydt file")]
+    Format,
+    #[error("unsupported .mydt version {0}")]
+    Version(u8),
+    #[error("file belongs to another vault")]
+    ForeignVault,
+    // Wrong password and tampering are indistinguishable by design (the DEK
+    // unwrap simply fails), so say both.
+    #[error("authentication failed: wrong password, or file is tampered or corrupt")]
+    Auth,
+    #[error("key derivation failed: {0}")]
+    Kdf(String),
+}
+
+type Result<T> = std::result::Result<T, CryptoError>;
+
+pub fn random<const N: usize>() -> [u8; N] {
+    let mut buf = [0u8; N];
+    getrandom::fill(&mut buf).expect("OS entropy source unavailable");
+    buf
+}
+
+pub fn derive_kek(password: &[u8], p: &KdfParams) -> Result<Zeroizing<[u8; KEY_LEN]>> {
+    let params = Params::new(p.m_cost, p.t_cost, p.p_cost, Some(KEY_LEN))
+        .map_err(|e| CryptoError::Kdf(e.to_string()))?;
+    let mut out = Zeroizing::new([0u8; KEY_LEN]);
+    Argon2::new(Algorithm::Argon2id, Version::V0x13, params)
+        .hash_password_into(password, &p.salt, out.as_mut())
+        .map_err(|e| CryptoError::Kdf(e.to_string()))?;
+    Ok(out)
+}
+
+fn cipher(key: &[u8; KEY_LEN]) -> XChaCha20Poly1305 {
+    XChaCha20Poly1305::new_from_slice(key).expect("32-byte key")
+}
+
+fn seal(key: &[u8; KEY_LEN], nonce: &[u8; NONCE_LEN], msg: &[u8], aad: &[u8]) -> Vec<u8> {
+    cipher(key)
+        .encrypt(&XNonce::from(*nonce), Payload { msg, aad })
+        .expect("XChaCha20-Poly1305 encrypt is infallible for in-memory buffers")
+}
+
+fn open(key: &[u8; KEY_LEN], nonce: &[u8; NONCE_LEN], ct: &[u8], aad: &[u8]) -> Result<Zeroizing<Vec<u8>>> {
+    cipher(key)
+        .decrypt(&XNonce::from(*nonce), Payload { msg: ct, aad })
+        .map(Zeroizing::new)
+        .map_err(|_| CryptoError::Auth)
+}
+
+pub fn encrypt_file(kek: &[u8; KEY_LEN], p: &KdfParams, meta: &FileMeta, plaintext: &[u8]) -> Result<Vec<u8>> {
+    let meta_json = Zeroizing::new(serde_json::to_vec(meta).map_err(|_| CryptoError::Format)?);
+    let dek = Zeroizing::new(random::<KEY_LEN>());
+    let dek_nonce = random::<NONCE_LEN>();
+    let meta_nonce = random::<NONCE_LEN>();
+    let payload_nonce = random::<NONCE_LEN>();
+
+    let mut out = Vec::with_capacity(HEADER_LEN + meta_json.len() + TAG_LEN + NONCE_LEN + plaintext.len() + TAG_LEN);
+    out.extend_from_slice(MAGIC);
+    out.push(VERSION);
+    out.extend_from_slice(&p.salt);
+    out.extend_from_slice(&p.m_cost.to_le_bytes());
+    out.extend_from_slice(&p.t_cost.to_le_bytes());
+    out.extend_from_slice(&p.p_cost.to_le_bytes());
+    debug_assert_eq!(out.len(), KDF_END);
+
+    let wrapped = seal(kek, &dek_nonce, dek.as_ref(), &out[..KDF_END]);
+    out.extend_from_slice(&dek_nonce);
+    out.extend_from_slice(&wrapped);
+    out.extend_from_slice(&meta_nonce);
+    out.extend_from_slice(&((meta_json.len() + TAG_LEN) as u32).to_le_bytes());
+    debug_assert_eq!(out.len(), HEADER_LEN);
+
+    let meta_ct = seal(&dek, &meta_nonce, &meta_json, &out[..HEADER_LEN]);
+    out.extend_from_slice(&meta_ct);
+    let payload_ct = seal(&dek, &payload_nonce, plaintext, &out[..HEADER_LEN]);
+    out.extend_from_slice(&payload_nonce);
+    out.extend_from_slice(&payload_ct);
+    Ok(out)
+}
+
+struct Header {
+    dek: Zeroizing<[u8; KEY_LEN]>,
+    meta_nonce: [u8; NONCE_LEN],
+    meta_end: usize,
+}
+
+/// Metadata ciphertext length from the fixed header (unauthenticated — the
+/// value is covered by AAD, so a lie is caught at `read_meta`). Lets callers
+/// read `HEADER_LEN + meta_len` bytes instead of the whole file.
+pub fn meta_len(header: &[u8]) -> Result<usize> {
+    if header.len() < HEADER_LEN || &header[..4] != MAGIC {
+        return Err(CryptoError::Format);
+    }
+    let n = u32_at(header, META_LEN_AT) as usize;
+    if n < TAG_LEN || n > MAX_META_BYTES {
+        return Err(CryptoError::Format);
+    }
+    Ok(n)
+}
+
+fn u32_at(b: &[u8], at: usize) -> u32 {
+    u32::from_le_bytes(b[at..at + 4].try_into().unwrap())
+}
+
+/// Salt and Argon2 parameters from the public header (no password needed).
+pub fn kdf_params(bytes: &[u8]) -> Result<KdfParams> {
+    if bytes.len() < HEADER_LEN || &bytes[..4] != MAGIC {
+        return Err(CryptoError::Format);
+    }
+    if bytes[4] != VERSION {
+        return Err(CryptoError::Version(bytes[4]));
+    }
+    Ok(KdfParams {
+        salt: bytes[5..5 + SALT_LEN].try_into().unwrap(),
+        m_cost: u32_at(bytes, 21),
+        t_cost: u32_at(bytes, 25),
+        p_cost: u32_at(bytes, 29),
+    })
+}
+
+fn open_header(kek: &[u8; KEY_LEN], expected_salt: &[u8; SALT_LEN], bytes: &[u8]) -> Result<Header> {
+    if bytes.len() < HEADER_LEN || &bytes[..4] != MAGIC {
+        return Err(CryptoError::Format);
+    }
+    if bytes[4] != VERSION {
+        return Err(CryptoError::Version(bytes[4]));
+    }
+    if &bytes[5..5 + SALT_LEN] != expected_salt {
+        return Err(CryptoError::ForeignVault);
+    }
+    let dek_nonce: [u8; NONCE_LEN] = bytes[DEK_NONCE_AT..DEK_AT].try_into().unwrap();
+    let dek_raw = open(kek, &dek_nonce, &bytes[DEK_AT..META_NONCE_AT], &bytes[..KDF_END])?;
+    let dek = Zeroizing::new(<[u8; KEY_LEN]>::try_from(dek_raw.as_slice()).map_err(|_| CryptoError::Auth)?);
+    let meta_nonce = bytes[META_NONCE_AT..META_LEN_AT].try_into().unwrap();
+    let meta_end = HEADER_LEN + meta_len(bytes)?;
+    if bytes.len() < meta_end {
+        return Err(CryptoError::Format);
+    }
+    Ok(Header { dek, meta_nonce, meta_end })
+}
+
+fn open_meta(h: &Header, bytes: &[u8]) -> Result<FileMeta> {
+    let json = open(&h.dek, &h.meta_nonce, &bytes[HEADER_LEN..h.meta_end], &bytes[..HEADER_LEN])?;
+    serde_json::from_slice(&json).map_err(|_| CryptoError::Auth)
+}
+
+/// Needs only the first `HEADER_LEN + meta_len` bytes.
+pub fn read_meta(kek: &[u8; KEY_LEN], expected_salt: &[u8; SALT_LEN], bytes: &[u8]) -> Result<FileMeta> {
+    open_meta(&open_header(kek, expected_salt, bytes)?, bytes)
+}
+
+pub fn decrypt_file(
+    kek: &[u8; KEY_LEN],
+    expected_salt: &[u8; SALT_LEN],
+    bytes: &[u8],
+) -> Result<(FileMeta, Zeroizing<Vec<u8>>)> {
+    let h = open_header(kek, expected_salt, bytes)?;
+    let meta = open_meta(&h, bytes)?;
+    let nonce_end = h.meta_end + NONCE_LEN;
+    if bytes.len() < nonce_end + TAG_LEN {
+        return Err(CryptoError::Format);
+    }
+    let payload_nonce: [u8; NONCE_LEN] = bytes[h.meta_end..nonce_end].try_into().unwrap();
+    let plaintext = open(&h.dek, &payload_nonce, &bytes[nonce_end..], &bytes[..HEADER_LEN])?;
+    Ok((meta, plaintext))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn params() -> KdfParams {
+        KdfParams { salt: [9u8; SALT_LEN], m_cost: 8, t_cost: 1, p_cost: 1 }
+    }
+
+    fn meta() -> FileMeta {
+        FileMeta { name: "secrets.env".into(), dir: "proj/config".into(), size: 5, mtime: 1, imported_at: 2 }
+    }
+
+    #[test]
+    fn roundtrip_and_partial_meta_read() {
+        let kek = [1u8; KEY_LEN];
+        let p = params();
+        let bytes = encrypt_file(&kek, &p, &meta(), b"hello").unwrap();
+        assert_eq!(&bytes[..4], MAGIC);
+        assert!(!bytes.windows(11).any(|w| w == b"secrets.env"), "name leaked in plaintext");
+        assert!(!bytes.windows(5).any(|w| w == b"hello"), "payload leaked in plaintext");
+
+        let n = meta_len(&bytes[..HEADER_LEN]).unwrap();
+        let prefix = &bytes[..HEADER_LEN + n];
+        assert_eq!(read_meta(&kek, &p.salt, prefix).unwrap(), meta());
+
+        let (m, pt) = decrypt_file(&kek, &p.salt, &bytes).unwrap();
+        assert_eq!(m, meta());
+        assert_eq!(pt.as_slice(), b"hello");
+    }
+
+    #[test]
+    fn empty_payload() {
+        let kek = [1u8; KEY_LEN];
+        let p = params();
+        let bytes = encrypt_file(&kek, &p, &meta(), b"").unwrap();
+        let (_, pt) = decrypt_file(&kek, &p.salt, &bytes).unwrap();
+        assert!(pt.is_empty());
+    }
+
+    #[test]
+    fn tamper_anywhere_fails() {
+        let kek = [1u8; KEY_LEN];
+        let p = params();
+        let bytes = encrypt_file(&kek, &p, &meta(), b"hello world").unwrap();
+        // One byte in each region: kdf params, wrapped DEK, meta_len, meta ct, payload nonce, payload ct.
+        for at in [21, DEK_AT + 3, META_LEN_AT, HEADER_LEN + 2, bytes.len() - 30, bytes.len() - 1] {
+            let mut t = bytes.clone();
+            t[at] ^= 0x01;
+            assert!(decrypt_file(&kek, &p.salt, &t).is_err(), "tamper at {at} not detected");
+        }
+        let mut t = bytes.clone();
+        t[0] = b'X';
+        assert!(matches!(decrypt_file(&kek, &p.salt, &t), Err(CryptoError::Format)));
+        let mut t = bytes.clone();
+        t[4] = 9;
+        assert!(matches!(decrypt_file(&kek, &p.salt, &t), Err(CryptoError::Version(9))));
+    }
+
+    #[test]
+    fn wrong_key_and_foreign_salt() {
+        let kek = [1u8; KEY_LEN];
+        let p = params();
+        let bytes = encrypt_file(&kek, &p, &meta(), b"x").unwrap();
+        assert!(matches!(decrypt_file(&[2u8; KEY_LEN], &p.salt, &bytes), Err(CryptoError::Auth)));
+        assert!(matches!(decrypt_file(&kek, &[0u8; SALT_LEN], &bytes), Err(CryptoError::ForeignVault)));
+    }
+
+    #[test]
+    fn kdf_is_deterministic_and_salted() {
+        let p = params();
+        let a = derive_kek(b"pw", &p).unwrap();
+        let b = derive_kek(b"pw", &p).unwrap();
+        assert_eq!(a.as_ref(), b.as_ref());
+        let other = KdfParams { salt: [8u8; SALT_LEN], ..p };
+        assert_ne!(a.as_ref(), derive_kek(b"pw", &other).unwrap().as_ref());
+        assert_ne!(a.as_ref(), derive_kek(b"pw2", &p).unwrap().as_ref());
+    }
+
+    /// Deterministic fuzz: every single-byte flip, every truncation length and
+    /// a few garbage buffers must yield `Err`, never a panic or a false `Ok`.
+    #[test]
+    fn mutation_sweep_never_panics_or_accepts() {
+        let kek = [1u8; KEY_LEN];
+        let p = params();
+        let bytes = encrypt_file(&kek, &p, &meta(), b"payload bytes for the sweep").unwrap();
+
+        for at in 0..bytes.len() {
+            let mut t = bytes.clone();
+            t[at] ^= 0x80;
+            assert!(decrypt_file(&kek, &p.salt, &t).is_err(), "flip at {at} accepted");
+            let _ = read_meta(&kek, &p.salt, &t); // must not panic; Ok only for flips past the meta block
+            let _ = meta_len(&t);
+        }
+        for len in 0..bytes.len() {
+            let t = &bytes[..len];
+            assert!(decrypt_file(&kek, &p.salt, t).is_err(), "truncation to {len} accepted");
+            let _ = read_meta(&kek, &p.salt, t);
+            let _ = meta_len(t);
+        }
+        // Garbage with a valid magic/version prefix and absurd lengths.
+        let mut garbage = bytes[..HEADER_LEN].to_vec();
+        garbage[META_LEN_AT..META_LEN_AT + 4].copy_from_slice(&u32::MAX.to_le_bytes());
+        assert!(matches!(meta_len(&garbage), Err(CryptoError::Format)));
+        assert!(decrypt_file(&kek, &p.salt, &garbage).is_err());
+        let mut seed = 0x9E37_79B9u32;
+        for _ in 0..64 {
+            let mut g = vec![0u8; (seed % 700) as usize];
+            for b in g.iter_mut() {
+                seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+                *b = (seed >> 24) as u8;
+            }
+            assert!(decrypt_file(&kek, &p.salt, &g).is_err());
+        }
+    }
+
+    #[test]
+    fn max_size_payload_roundtrips() {
+        let kek = [1u8; KEY_LEN];
+        let p = params();
+        let big = vec![0xA5u8; MAX_FILE_BYTES as usize];
+        let bytes = encrypt_file(&kek, &p, &meta(), &big).unwrap();
+        assert!((bytes.len() as u64) <= MAX_OBJECT_BYTES);
+        let (_, pt) = decrypt_file(&kek, &p.salt, &bytes).unwrap();
+        assert_eq!(pt.len(), big.len());
+    }
+
+    #[test]
+    fn fresh_nonces_per_write() {
+        let kek = [1u8; KEY_LEN];
+        let a = encrypt_file(&kek, &params(), &meta(), b"x").unwrap();
+        let b = encrypt_file(&kek, &params(), &meta(), b"x").unwrap();
+        assert_ne!(a[DEK_NONCE_AT..DEK_AT], b[DEK_NONCE_AT..DEK_AT]);
+        assert_ne!(a[HEADER_LEN..], b[HEADER_LEN..]);
+    }
+}
diff --git a/crates/mydt/src/main.rs b/crates/mydt/src/main.rs
new file mode 100644
index 00000000..b5c0c338
--- /dev/null
+++ b/crates/mydt/src/main.rs
@@ -0,0 +1,229 @@
+//! `mydt` — create, inspect and open `.mydt` files from the shell.
+//!
+//! Password comes from `$MYDT_PASSWORD` or an interactive prompt. Files
+//! written with `--params-from <existing.mydt>` share that file's salt and so
+//! open inside the same MyDevTools storage folder.
+
+use std::collections::HashMap;
+use std::fs;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::process;
+
+use mydt::{CryptoError, FileMeta, KdfParams, MAX_FILE_BYTES, MAX_OBJECT_BYTES, SALT_LEN};
+use zeroize::Zeroizing;
+
+const USAGE: &str = "\
+mydt — MyDevTools encrypted file format (.mydt)
+
+USAGE
+  mydt encrypt <file> [-o <out.mydt>] [--dir <logical/folder>] [--params-from <other.mydt>]
+  mydt decrypt <file.mydt> [-o <out> | -o -] [--force]
+  mydt info    <file.mydt> [--unlock]
+  mydt ls      <folder>
+
+Password: $MYDT_PASSWORD, otherwise prompted.
+`encrypt` names the output <32 random hex>.mydt like the desktop app does.
+`--params-from` reuses another file's salt/KDF params so the result opens in the
+same Secure Files storage folder.";
+
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("error: {e}");
+        process::exit(1);
+    }
+}
+
+struct Args {
+    positional: Vec<String>,
+    opts: HashMap<String, String>,
+    flags: Vec<String>,
+}
+
+fn parse_args(raw: &[String], with_value: &[&str]) -> Args {
+    let mut a = Args { positional: Vec::new(), opts: HashMap::new(), flags: Vec::new() };
+    let mut it = raw.iter();
+    while let Some(arg) = it.next() {
+        if let Some(name) = arg.strip_prefix('-') {
+            let name = name.trim_start_matches('-');
+            if with_value.contains(&name) {
+                if let Some(v) = it.next() {
+                    a.opts.insert(name.to_string(), v.clone());
+                }
+            } else {
+                a.flags.push(name.to_string());
+            }
+        } else {
+            a.positional.push(arg.clone());
+        }
+    }
+    a
+}
+
+fn run() -> Result<(), String> {
+    let raw: Vec<String> = std::env::args().skip(1).collect();
+    match raw.first().map(String::as_str) {
+        Some("encrypt") => encrypt(parse_args(&raw[1..], &["o", "dir", "params-from"])),
+        Some("decrypt") => decrypt(parse_args(&raw[1..], &["o"])),
+        Some("info") => info(parse_args(&raw[1..], &[])),
+        Some("ls") => ls(parse_args(&raw[1..], &[])),
+        _ => {
+            eprintln!("{USAGE}");
+            process::exit(2)
+        }
+    }
+}
+
+fn password() -> Result<Zeroizing<String>, String> {
+    if let Ok(p) = std::env::var("MYDT_PASSWORD") {
+        return Ok(Zeroizing::new(p));
+    }
+    rpassword::prompt_password("Password: ").map(Zeroizing::new).map_err(|e| e.to_string())
+}
+
+fn read_object(path: &Path) -> Result<Vec<u8>, String> {
+    let md = fs::metadata(path).map_err(|e| format!("{}: {e}", path.display()))?;
+    if md.len() > MAX_OBJECT_BYTES {
+        return Err(format!("{}: larger than any valid .mydt object", path.display()));
+    }
+    fs::read(path).map_err(|e| format!("{}: {e}", path.display()))
+}
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|b| format!("{b:02x}")).collect()
+}
+
+fn positional<'a>(a: &'a Args, what: &str) -> Result<&'a Path, String> {
+    a.positional.first().map(Path::new).ok_or_else(|| format!("missing <{what}>\n\n{USAGE}"))
+}
+
+fn mtime_ms(md: &fs::Metadata) -> i64 {
+    md.modified()
+        .ok()
+        .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+        .map(|d| d.as_millis() as i64)
+        .unwrap_or(0)
+}
+
+fn now_ms() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_millis() as i64)
+        .unwrap_or(0)
+}
+
+fn encrypt(a: Args) -> Result<(), String> {
+    let src = positional(&a, "file")?;
+    let md = fs::metadata(src).map_err(|e| format!("{}: {e}", src.display()))?;
+    if md.len() > MAX_FILE_BYTES {
+        return Err(format!("file exceeds the {} MB limit", MAX_FILE_BYTES / 1024 / 1024));
+    }
+    let name = src
+        .file_name()
+        .and_then(|n| n.to_str())
+        .ok_or("source has no usable file name")?
+        .to_string();
+    let params = match a.opts.get("params-from") {
+        Some(p) => mydt::kdf_params(&read_object(Path::new(p))?).map_err(|e| e.to_string())?,
+        None => KdfParams::generate(),
+    };
+    let plaintext = Zeroizing::new(fs::read(src).map_err(|e| e.to_string())?);
+    let meta = FileMeta {
+        name,
+        dir: a.opts.get("dir").cloned().unwrap_or_default().trim_matches('/').to_string(),
+        size: plaintext.len() as u64,
+        mtime: mtime_ms(&md),
+        imported_at: now_ms(),
+    };
+    let kek = mydt::derive_kek(password()?.as_bytes(), &params).map_err(|e| e.to_string())?;
+    let bytes = mydt::encrypt_file(&kek, &params, &meta, &plaintext).map_err(|e| e.to_string())?;
+    let out = match a.opts.get("o") {
+        Some(o) => PathBuf::from(o),
+        None => PathBuf::from(format!("{}.mydt", hex(&mydt::random::<16>()))),
+    };
+    fs::write(&out, bytes).map_err(|e| format!("{}: {e}", out.display()))?;
+    println!("{}", out.display());
+    Ok(())
+}
+
+fn decrypt(a: Args) -> Result<(), String> {
+    let src = positional(&a, "file.mydt")?;
+    let bytes = read_object(src)?;
+    let params = mydt::kdf_params(&bytes).map_err(|e| e.to_string())?;
+    let kek = mydt::derive_kek(password()?.as_bytes(), &params).map_err(|e| e.to_string())?;
+    let (meta, plaintext) = mydt::decrypt_file(&kek, &params.salt, &bytes).map_err(|e| e.to_string())?;
+    match a.opts.get("o").map(String::as_str) {
+        Some("-") => std::io::stdout().write_all(&plaintext).map_err(|e| e.to_string()),
+        other => {
+            let out = other.map(PathBuf::from).unwrap_or_else(|| PathBuf::from(&meta.name));
+            if out.exists() && !a.flags.iter().any(|f| f == "force") {
+                return Err(format!("{} exists (use --force to overwrite)", out.display()));
+            }
+            fs::write(&out, &*plaintext).map_err(|e| format!("{}: {e}", out.display()))?;
+            eprintln!("{} -> {}", src.display(), out.display());
+            Ok(())
+        }
+    }
+}
+
+fn info(a: Args) -> Result<(), String> {
+    let src = positional(&a, "file.mydt")?;
+    let bytes = read_object(src)?;
+    let params = mydt::kdf_params(&bytes).map_err(|e| e.to_string())?;
+    let meta_len = mydt::meta_len(&bytes).map_err(|e| e.to_string())?;
+    println!("file:      {}", src.display());
+    println!("format:    MYDT v{}", bytes[4]);
+    println!("size:      {} bytes", bytes.len());
+    println!("salt:      {}", hex(&params.salt));
+    println!("argon2id:  m={} KiB t={} p={}", params.m_cost, params.t_cost, params.p_cost);
+    println!("meta_len:  {meta_len}");
+    if a.flags.iter().any(|f| f == "unlock") || std::env::var_os("MYDT_PASSWORD").is_some() {
+        let kek = mydt::derive_kek(password()?.as_bytes(), &params).map_err(|e| e.to_string())?;
+        let m = mydt::read_meta(&kek, &params.salt, &bytes).map_err(|e| e.to_string())?;
+        println!("name:      {}", m.name);
+        println!("dir:       {}", if m.dir.is_empty() { "/" } else { &m.dir });
+        println!("plaintext: {} bytes", m.size);
+        println!("mtime:     {}", m.mtime);
+        println!("imported:  {}", m.imported_at);
+    }
+    Ok(())
+}
+
+fn ls(a: Args) -> Result<(), String> {
+    let dir = positional(&a, "folder")?;
+    let pw = password()?;
+    // One Argon2 per distinct salt, not per file.
+    let mut keks: HashMap<[u8; SALT_LEN], Zeroizing<[u8; 32]>> = HashMap::new();
+    let mut entries: Vec<PathBuf> = fs::read_dir(dir)
+        .map_err(|e| format!("{}: {e}", dir.display()))?
+        .filter_map(|e| e.ok().map(|e| e.path()))
+        .filter(|p| p.extension().is_some_and(|x| x == "mydt"))
+        .collect();
+    entries.sort();
+    let mut rows = Vec::new();
+    for path in entries {
+        let id = path.file_stem().and_then(|s| s.to_str()).unwrap_or("?").to_string();
+        let res = read_object(&path).and_then(|bytes| {
+            let params = mydt::kdf_params(&bytes).map_err(|e| e.to_string())?;
+            let kek = match keks.get(&params.salt) {
+                Some(k) => k.clone(),
+                None => {
+                    let k = mydt::derive_kek(pw.as_bytes(), &params).map_err(|e| e.to_string())?;
+                    keks.insert(params.salt, k.clone());
+                    k
+                }
+            };
+            mydt::read_meta(&kek, &params.salt, &bytes).map_err(|e: CryptoError| e.to_string())
+        });
+        match res {
+            Ok(m) => rows.push((m.dir, m.name, m.size, id)),
+            Err(e) => eprintln!("{id}: {e}"),
+        }
+    }
+    rows.sort();
+    for (dir, name, size, id) in rows {
+        let logical = if dir.is_empty() { name } else { format!("{dir}/{name}") };
+        println!("{size:>10}  {id}  {logical}");
+    }
+    Ok(())
+}
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 2348ca26..4759ebc0 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -66,6 +66,14 @@ apps/
 - **Vault data** (password manager, API keys, database credentials) is
   additionally encrypted with a user master password; the master key never
   leaves the machine. Creating/unlocking the vault is entirely offline.
+- **Secure Files** (`router/secure_files/`) encrypts user-picked files into
+  opaque `<random hex>.mydt` objects inside a folder the user chooses. Each
+  `.mydt` is self-contained (Argon2id salt/params, per-file DEK wrapped by the
+  key derived from the master password, XChaCha20-Poly1305 metadata + payload),
+  so there is no index — listing scans the folder and decrypts headers. After
+  the webview verifies the master password it hands it to Rust once
+  (`/auth/master-vault/unlock`); the derived key lives only in `AppState` and
+  is dropped on lock. Format spec: `docs/MYDT_FORMAT.md`.
 - **Database clients** use native Rust drivers, so a connection goes straight
   from the user's machine to their database — nothing is proxied.
 - **API client** requests go through `reqwest` in Rust, which is why the app
diff --git a/docs/MYDT_FORMAT.md b/docs/MYDT_FORMAT.md
new file mode 100644
index 00000000..d82a9f23
--- /dev/null
+++ b/docs/MYDT_FORMAT.md
@@ -0,0 +1,134 @@
+# `.mydt` — MyDevTools encrypted file format, version 1
+
+`.mydt` is the on-disk representation used by the **Secure Files** tool. Each
+source file becomes one `.mydt` object with a random physical name; the
+original name, folder, size, timestamps and contents are encrypted inside it.
+The format is deliberately small so that a CLI or SDK can implement it in a few
+dozen lines. Reference implementation and CLI: the `mydt` crate in
+[`crates/mydt`](../crates/mydt/README.md) (the desktop app uses it unchanged).
+
+## Goals and non-goals
+
+- Stored representation is opaque to filesystem indexers, thumbnailers, OCR and
+  any reader that only sees the bytes on disk.
+- A single `.mydt` file is **self-contained**: it can be decrypted with just the
+  password, without any database, index or sidecar.
+- Authenticated: any modification of any byte is detected.
+- Not a container for many files, not streaming, not deniable, not a defense
+  against a compromised machine while the vault is unlocked.
+
+## Physical naming
+
+Objects are named `<id>.mydt` where `id` is 16 cryptographically random bytes
+rendered as 32 lowercase hex characters (e.g. `83a91c2f….mydt`). The name
+carries no information about the content. Writers create `<id>.mydt.tmp`,
+fsync, then rename it over the final name; readers delete stale `.mydt.tmp`
+files. Nothing else in the storage folder is touched.
+
+## Byte layout
+
+All integers are unsigned 32-bit little-endian.
+
+| Offset   | Length | Field                                                              |
+|----------|--------|--------------------------------------------------------------------|
+| 0        | 4      | Magic `MYDT` (ASCII)                                               |
+| 4        | 1      | Version, `0x01`                                                    |
+| 5        | 16     | Argon2 salt                                                        |
+| 21       | 4      | Argon2 `m_cost` (KiB)                                              |
+| 25       | 4      | Argon2 `t_cost`                                                    |
+| 29       | 4      | Argon2 `p_cost`                                                    |
+| 33       | 24     | `dek_nonce`                                                        |
+| 57       | 48     | Wrapped DEK: 32-byte key + 16-byte tag                             |
+| 105      | 24     | `meta_nonce`                                                       |
+| 129      | 4      | `meta_len` — metadata ciphertext length **including** its 16-byte tag |
+| 133      | N      | Metadata ciphertext (`N = meta_len`)                               |
+| 133 + N  | 24     | `payload_nonce`                                                    |
+| 157 + N  | rest   | Payload ciphertext + 16-byte tag, to end of file                   |
+
+The fixed header is 133 bytes. `meta_len` must be in `[16, 65536]`.
+
+## Cryptography
+
+- **KDF**: Argon2id, version 0x13, parameters from the header, 32-byte output.
+  The desktop app writes `m_cost = 65536` (64 MiB), `t_cost = 3`, `p_cost = 1`.
+  Input is the UTF-8 master password; the result is the **KEK**.
+- **AEAD**: XChaCha20-Poly1305 (24-byte nonces, 16-byte tags). Nonces are
+  random per write; the 192-bit nonce space makes random nonces safe.
+- **Keys**: each file has its own random 32-byte **DEK**. The KEK only ever
+  encrypts DEKs, so rotating the password requires rewrapping one 48-byte
+  block per file, not re-encrypting payloads.
+
+```
+KEK          = Argon2id(password, salt, m_cost, t_cost, p_cost)
+wrapped_dek  = XChaCha20Poly1305(KEK, dek_nonce, DEK,       aad = bytes[0..33])
+meta_ct      = XChaCha20Poly1305(DEK, meta_nonce, meta_json, aad = bytes[0..133])
+payload_ct   = XChaCha20Poly1305(DEK, payload_nonce, plaintext, aad = bytes[0..133])
+```
+
+The associated data binds the KDF parameters to the DEK wrap, and the whole
+fixed header (including `meta_len`) to both the metadata and the payload.
+Swapping headers, nonces or lengths between files therefore fails
+authentication.
+
+## Metadata
+
+`meta_json` is a UTF-8 JSON object:
+
+```json
+{ "name": "secrets.env", "dir": "proj/config", "size": 1432,
+  "mtime": 1755820000000, "importedAt": 1755820123456 }
+```
+
+- `name` — original file name, no path separators.
+- `dir` — logical folder as `/`-separated segments, `""` for the root. Folders
+  are derived from this field; there are no folder objects.
+- `size` — plaintext length in bytes.
+- `mtime`, `importedAt` — epoch milliseconds.
+
+Unknown fields must be ignored by readers so the object can grow without a
+version bump. MIME type is not stored; readers derive it from `name`.
+
+## Reading
+
+1. Check magic and version; reject anything else.
+2. Read the KDF block, derive (or reuse a cached) KEK. All files in one storage
+   folder share the same salt, so the KEK is derived once per unlock and a
+   listing never runs Argon2.
+3. Unwrap the DEK with `aad = bytes[0..33]`. Failure means wrong password,
+   foreign salt, or tampering — readers should not distinguish beyond that.
+4. Decrypt `meta_ct` with `aad = bytes[0..133]`. Listing stops here: only
+   `133 + meta_len` bytes need to be read from disk.
+5. Decrypt the payload with the same AAD.
+
+A reader must treat every length field as untrusted and bound what it reads
+(`MAX_META_BYTES = 64 KiB`, payload cap 20 MiB in the desktop app).
+
+## Writing
+
+Every write — import, rename, move, replace — produces a fresh DEK and fresh
+nonces and rewrites the whole object atomically. Rewriting in place is never
+done.
+
+## What leaks
+
+- Existence of the folder, number of objects, approximate plaintext size
+  (ciphertext is plaintext + 157 + `meta_len` bytes), filesystem timestamps.
+- KDF parameters and salt (public by design).
+- The storage folder path, stored in the app's SQLCipher database.
+
+Nothing else: names, extensions, folder structure, MIME types and contents are
+all inside the AEAD envelope.
+
+## Versioning
+
+The version byte is bumped only for incompatible layout changes. Readers must
+reject unknown versions; writers must never downgrade an object. KDF parameters
+are per file, so they can be changed without a version bump.
+
+## Threat model (summary)
+
+Protects stored data at rest against anything that can only read the storage
+folder: indexers, backups, other apps, a copied drive. Does **not** protect
+against malware or a privileged process on a machine where the vault is
+unlocked, against screen capture during preview, or against a keylogger. See
+the PRD's security section for the full table.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6a1ae844..d9f716e7 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -137,6 +137,9 @@ importers:
       '@tauri-apps/plugin-deep-link':
         specifier: ^2.4.9
         version: 2.4.9
+      '@tauri-apps/plugin-dialog':
+        specifier: ^2.7.2
+        version: 2.7.2
       '@tauri-apps/plugin-opener':
         specifier: ^2.5.4
         version: 2.5.4
@@ -199,7 +202,7 @@ importers:
         version: 12.43.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       geist:
         specifier: ^1.7.2
-        version: 1.7.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
+        version: 1.7.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
       gpt-tokenizer:
         specifier: ^3.4.0
         version: 3.4.0
@@ -268,7 +271,7 @@ importers:
         version: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       next-intl:
         specifier: ^4.13.7
-        version: 4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
+        version: 4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
       next-themes:
         specifier: ^0.4.6
         version: 0.4.6(patch_hash=73478c20fb87207168b5c0fa9ccabf0c042408da2bc5a36131ed1c8bb57bf5a3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
@@ -425,7 +428,7 @@ importers:
         version: 1.0.2
       '@opennextjs/cloudflare':
         specifier: ^1.20.2
-        version: 1.20.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(wrangler@4.124.0)
+        version: 1.20.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(wrangler@4.124.0)
       '@radix-ui/react-collapsible':
         specifier: ^1.1.20
         version: 1.1.20(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
@@ -452,10 +455,10 @@ importers:
         version: 3.46.0(react@19.2.8)
       '@vercel/analytics':
         specifier: ^1.6.1
-        version: 1.6.1(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))
+        version: 1.6.1(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))
       '@vercel/speed-insights':
         specifier: ^1.3.1
-        version: 1.3.1(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))
+        version: 1.3.1(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))
       class-variance-authority:
         specifier: ^0.7.1
         version: 0.7.1
@@ -467,7 +470,7 @@ importers:
         version: 12.43.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       geist:
         specifier: ^1.7.2
-        version: 1.7.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
+        version: 1.7.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
       lucide-react:
         specifier: ^0.552.0
         version: 0.552.0(react@19.2.8)
@@ -476,7 +479,7 @@ importers:
         version: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       next-intl:
         specifier: ^4.13.7
-        version: 4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
+        version: 4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
       next-themes:
         specifier: ^0.4.6
         version: 0.4.6(patch_hash=73478c20fb87207168b5c0fa9ccabf0c042408da2bc5a36131ed1c8bb57bf5a3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
@@ -3399,6 +3402,9 @@ packages:
   '@tauri-apps/plugin-deep-link@2.4.9':
     resolution: {integrity: sha512-u0SKOUHnJ1wqeqXsDFq2+kASCBj9xxbG0g9XZWPy9SOmU4wXtp6b/wiYpm6oH6/5fBTQsLqnLhIvqLBRpgHJlA==}
 
+  '@tauri-apps/plugin-dialog@2.7.2':
+    resolution: {integrity: sha512-pX0IGm1I3I6wc+zeKYcq1GSqogK6okCNX5fOdaNU5ab1AjGS6l1E5wFNjEb7meg7ZFSp0JUs+0jQGQNyOvLrsg==}
+
   '@tauri-apps/plugin-opener@2.5.4':
     resolution: {integrity: sha512-1HnPkb+AmgO29HBazm4uPLKB+r7zzcTBW1d0fyYp1uP+jwtpoiNDGKMMzz58SFp49nOIrxdE3aUJtT57lfO9CQ==}
 
@@ -9868,7 +9874,7 @@ snapshots:
 
   '@ocavue/utils@1.7.0': {}
 
-  '@opennextjs/aws@4.1.0(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))':
+  '@opennextjs/aws@4.1.0(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))':
     dependencies:
       '@ast-grep/napi': 0.40.5
       '@aws-sdk/client-cloudfront': 3.984.0
@@ -9891,11 +9897,11 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@opennextjs/cloudflare@1.20.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(wrangler@4.124.0)':
+  '@opennextjs/cloudflare@1.20.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(wrangler@4.124.0)':
     dependencies:
       '@ast-grep/napi': 0.40.5
       '@dotenvx/dotenvx': 1.31.0
-      '@opennextjs/aws': 4.1.0(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
+      '@opennextjs/aws': 4.1.0(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))
       ci-info: 4.4.0
       cloudflare: 4.5.0
       comment-json: 4.6.2
@@ -11048,6 +11054,10 @@ snapshots:
     dependencies:
       '@tauri-apps/api': 2.11.1
 
+  '@tauri-apps/plugin-dialog@2.7.2':
+    dependencies:
+      '@tauri-apps/api': 2.11.1
+
   '@tauri-apps/plugin-opener@2.5.4':
     dependencies:
       '@tauri-apps/api': 2.11.1
@@ -11360,14 +11370,14 @@ snapshots:
   '@unrs/resolver-binding-win32-x64-msvc@1.12.2':
     optional: true
 
-  '@vercel/analytics@1.6.1(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))':
+  '@vercel/analytics@1.6.1(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))':
     optionalDependencies:
       next: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       react: 19.2.8
       svelte: 5.56.9(@typescript-eslint/types@8.67.0)
       vue: 3.5.41(typescript@5.9.3)
 
-  '@vercel/speed-insights@1.3.1(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))':
+  '@vercel/speed-insights@1.3.1(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vue@3.5.41(typescript@5.9.3))':
     optionalDependencies:
       next: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       react: 19.2.8
@@ -12790,7 +12800,7 @@ snapshots:
 
   functions-have-names@1.2.3: {}
 
-  geist@1.7.2(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)):
+  geist@1.7.2(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)):
     dependencies:
       next: 16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
 
@@ -14201,7 +14211,7 @@ snapshots:
 
   next-intl-swc-plugin-extractor@4.13.7: {}
 
-  next-intl@4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@babel/core@7.29.7)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
+  next-intl@4.13.7(@swc/helpers@0.5.23)(next@16.3.1(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
     dependencies:
       '@formatjs/intl-localematcher': 0.8.13
       '@parcel/watcher': 2.6.0

From 9f7da0b9b9c6d59d2eefdab742c2814d9df27d0e Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sun, 23 Aug 2026 19:38:10 +0530
Subject: [PATCH 11/39] feat(secure-files): image thumbnails in grid view
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Grid tiles show the actual image instead of a type icon, Drive-style.

Only the tiles currently on screen are decrypted (the hook is fed the same
visible window the virtualizer computes), at most three at a time, and the
queue re-prioritizes on scroll. Each image is downscaled to 256px and
re-encoded before it is kept, so the plaintext original is dropped right away
and the blob pool stays bounded — 150 thumbnails, oldest off-screen ones
revoked, everything revoked when the tool unmounts on lock.

Cache keys include size and mtime so Replace invalidates a stale thumbnail.
SVG skips the canvas (WKWebView cannot createImageBitmap it) and anything
that fails to decode falls back to its icon without retrying.

Also moves blobMime into lib/secure-files.ts so the preview and thumbnail
paths share one implementation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01No7es2PjF9SNQs22RYHcdM
---
 .../secure-files/secure-files-tool.tsx        |  44 ++++---
 .../components/secure-files/use-thumbnails.ts | 123 ++++++++++++++++++
 .../src/lib/__tests__/secure-files.test.ts    |  12 +-
 apps/desktop-ui/src/lib/secure-files.ts       |  10 ++
 4 files changed, 172 insertions(+), 17 deletions(-)
 create mode 100644 apps/desktop-ui/src/components/secure-files/use-thumbnails.ts

diff --git a/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx b/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
index 1a76b018..f6904641 100644
--- a/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
+++ b/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
@@ -42,6 +42,7 @@ import { getFileType, isPreviewable } from "@/components/s3-drive/file-types"
 import { useMasterKeyStore } from "@/store/master-key-store"
 import {
   baseName,
+  blobMime,
   buildFolderTree,
   joinDir,
   looksLikeText,
@@ -68,6 +69,7 @@ import {
   type SecureFilesSettings,
 } from "@/lib/secure-files-api"
 import { FolderTree } from "./folder-tree"
+import { isThumbnailable, useThumbnails } from "./use-thumbnails"
 import { cn } from "@/lib/utils"
 import { safeGetItem, safeGetJSON, safeSetItem, safeSetJSON } from "@/lib/safe-storage"
 
@@ -107,15 +109,6 @@ function findNode(root: FolderNode, path: string): FolderNode | null {
   return null
 }
 
-function blobMime(fileType: string, name: string): string {
-  const ext = name.split(".").pop()?.toLowerCase() ?? ""
-  if (fileType === "pdf") return "application/pdf"
-  if (fileType === "image") return ext === "svg" ? "image/svg+xml" : `image/${ext === "jpg" ? "jpeg" : ext}`
-  if (fileType === "video") return `video/${ext}`
-  if (fileType === "audio") return `audio/${ext}`
-  return "application/octet-stream"
-}
-
 type PathDialogState = {
   title: string
   label: string
@@ -419,13 +412,23 @@ export function SecureFilesTool() {
   )
 
   const LIST_ROW_H = 36
-  const GRID_ROW_H = 128
+  const GRID_ROW_H = 152
   const listCols = "grid-cols-[minmax(0,1fr)_6rem_2.5rem] md:grid-cols-[minmax(0,1fr)_6rem_8rem_2.5rem]"
   const cols = view === "grid" ? Math.max(1, Math.floor((viewport.w - 24) / 124)) : 1
   const rowH = view === "grid" ? GRID_ROW_H : LIST_ROW_H
   const rowCount = Math.ceil(items.length / cols)
   const [startRow, endRow] = visibleRange(scrollTop, viewport.h, rowH, rowCount)
 
+  // Thumbnails are decrypted for on-screen tiles only.
+  const visibleFiles = useMemo(
+    () =>
+      view === "grid"
+        ? items.slice(startRow * cols, endRow * cols).flatMap((it) => (it.kind === "file" ? [it.file] : []))
+        : [],
+    [items, startRow, endRow, cols, view],
+  )
+  const thumbs = useThumbnails(visibleFiles, view === "grid")
+
   const listRow = (it: ViewItem) => {
     const cell = "flex h-full min-w-0 items-center"
     if (it.kind === "folder") {
@@ -459,18 +462,27 @@ export function SecureFilesTool() {
     const isFolder = it.kind === "folder"
     const key = isFolder ? it.folder.path : it.file.id
     const name = isFolder ? it.folder.name : it.file.name
+    const thumb = isFolder ? undefined : thumbs.get(it.file.id)
     return (
       <div key={key} className="group relative min-w-0">
         <button
           type="button"
-          className="flex h-full w-full flex-col items-center gap-1.5 rounded-lg p-3 pt-4 transition-colors hover:bg-muted/60"
+          className="flex h-full w-full flex-col items-center gap-1.5 rounded-lg p-2 pt-3 transition-colors hover:bg-muted/60"
           onClick={() => (isFolder ? setCurrentDir(it.folder.path) : openPreview(it.file))}
         >
-          {isFolder ? (
-            <IconFolder className="size-10 text-amber-500" strokeWidth={1.5} />
-          ) : (
-            <FileIconComp type={getFileType(name)} className="size-10" />
-          )}
+          <span className="flex h-[4.5rem] w-full items-center justify-center overflow-hidden rounded-md bg-muted/40">
+            {isFolder ? (
+              <IconFolder className="size-10 text-amber-500" strokeWidth={1.5} />
+            ) : thumb ? (
+              // eslint-disable-next-line @next/next/no-img-element
+              <img src={thumb} alt="" loading="lazy" decoding="async" className="size-full object-cover" />
+            ) : (
+              <FileIconComp
+                type={getFileType(name)}
+                className={cn("size-10", !isFolder && isThumbnailable(it.file) && "animate-pulse")}
+              />
+            )}
+          </span>
           <span className="w-full truncate text-center text-xs" title={name}>{name}</span>
           {!isFolder && <span className="text-[10px] tabular-nums text-muted-foreground">{formatBytes(it.file.size)}</span>}
         </button>
diff --git a/apps/desktop-ui/src/components/secure-files/use-thumbnails.ts b/apps/desktop-ui/src/components/secure-files/use-thumbnails.ts
new file mode 100644
index 00000000..cbc436a6
--- /dev/null
+++ b/apps/desktop-ui/src/components/secure-files/use-thumbnails.ts
@@ -0,0 +1,123 @@
+"use client"
+
+import { useCallback, useEffect, useRef, useState } from "react"
+import { getFileType } from "@/components/s3-drive/file-types"
+import { blobMime, type SecureFileEntry } from "@/lib/secure-files"
+import { readSecureFile } from "@/lib/secure-files-api"
+
+/** Longest edge of a generated thumbnail, in CSS pixels (x2 for retina). */
+const THUMB_PX = 256
+/** Don't decrypt huge images just to shrink them. */
+const MAX_SOURCE_BYTES = 12 * 1024 * 1024
+/** Bounded blob pool — oldest off-screen thumbnails are revoked past this. */
+const CACHE_MAX = 150
+const CONCURRENCY = 3
+
+export function isThumbnailable(f: SecureFileEntry): boolean {
+  return getFileType(f.name) === "image" && f.size <= MAX_SOURCE_BYTES
+}
+
+/** Cache key includes size+mtime so Replace invalidates the old thumbnail. */
+function cacheKey(f: SecureFileEntry): string {
+  return `${f.id}:${f.size}:${f.mtime}`
+}
+
+/** Decode, downscale, re-encode. SVG skips the canvas — WKWebView can't
+ *  `createImageBitmap` it, and vectors are small enough to use as-is. */
+async function makeThumb(bytes: ArrayBuffer, name: string): Promise<string> {
+  const blob = new Blob([bytes], { type: blobMime("image", name) })
+  if (blob.type === "image/svg+xml") return URL.createObjectURL(blob)
+
+  const bmp = await createImageBitmap(blob)
+  const scale = Math.min(1, THUMB_PX / Math.max(bmp.width, bmp.height))
+  const w = Math.max(1, Math.round(bmp.width * scale))
+  const h = Math.max(1, Math.round(bmp.height * scale))
+  const canvas = document.createElement("canvas")
+  canvas.width = w
+  canvas.height = h
+  const ctx = canvas.getContext("2d")
+  if (!ctx) {
+    bmp.close()
+    throw new Error("no 2d context")
+  }
+  ctx.drawImage(bmp, 0, 0, w, h)
+  bmp.close()
+  // Unsupported types fall back to image/png per spec, so this is always fine.
+  const out = await new Promise<Blob | null>((r) => canvas.toBlob(r, "image/webp", 0.8))
+  if (!out) throw new Error("thumbnail encode failed")
+  return URL.createObjectURL(out)
+}
+
+/**
+ * Google-Drive-style thumbnails for the files currently on screen.
+ *
+ * Only visible tiles are decrypted, at most `CONCURRENCY` at a time, and each
+ * result is downscaled before it is kept — the plaintext original is never
+ * held. Every blob URL is revoked on eviction and on unmount (the tool
+ * unmounts when the vault locks, so nothing outlives the session).
+ */
+export function useThumbnails(visible: SecureFileEntry[], enabled: boolean): Map<string, string> {
+  const [, bump] = useState(0)
+  const cache = useRef(new Map<string, string>()).current
+  const failed = useRef(new Set<string>()).current
+  const queue = useRef<SecureFileEntry[]>([])
+  const active = useRef(0)
+  const visibleKeys = useRef(new Set<string>())
+
+  const evict = useCallback(() => {
+    for (const key of cache.keys()) {
+      if (cache.size <= CACHE_MAX) break
+      if (visibleKeys.current.has(key)) continue
+      URL.revokeObjectURL(cache.get(key)!)
+      cache.delete(key)
+    }
+  }, [cache])
+
+  const pump = useCallback(() => {
+    while (active.current < CONCURRENCY && queue.current.length > 0) {
+      const f = queue.current.shift()!
+      const key = cacheKey(f)
+      if (cache.has(key) || failed.has(key)) continue
+      active.current++
+      void (async () => {
+        try {
+          cache.set(key, await makeThumb(await readSecureFile(f.id), f.name))
+          evict()
+          bump((n) => n + 1)
+        } catch {
+          // Unsupported/corrupt image — fall back to the type icon, don't retry.
+          failed.add(key)
+        } finally {
+          active.current--
+          pump()
+        }
+      })()
+    }
+  }, [cache, failed, evict])
+
+  const dep = enabled ? visible.map(cacheKey).join(",") : ""
+  useEffect(() => {
+    visibleKeys.current = new Set(enabled ? visible.map(cacheKey) : [])
+    if (!enabled) return
+    const wanted = visible.filter((f) => isThumbnailable(f) && !cache.has(cacheKey(f)) && !failed.has(cacheKey(f)))
+    // Re-prioritize to what is on screen now; in-flight work still completes.
+    queue.current = wanted
+    pump()
+    // `dep` is the value-identity of `visible` — the array itself is new each render.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [dep, enabled])
+
+  useEffect(() => {
+    return () => {
+      for (const url of cache.values()) URL.revokeObjectURL(url)
+      cache.clear()
+    }
+  }, [cache])
+
+  const out = new Map<string, string>()
+  for (const f of visible) {
+    const url = cache.get(cacheKey(f))
+    if (url) out.set(f.id, url)
+  }
+  return out
+}
diff --git a/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts b/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
index eeb9d3eb..124bb294 100644
--- a/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
+++ b/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
@@ -1,4 +1,4 @@
-import { buildFolderTree, joinDir, looksLikeText, parentDir, visibleRange, type SecureFileEntry } from "../secure-files"
+import { blobMime, buildFolderTree, joinDir, looksLikeText, parentDir, visibleRange, type SecureFileEntry } from "../secure-files"
 
 const f = (name: string, dir: string): SecureFileEntry => ({ id: name, name, dir, size: 1, mtime: 0, importedAt: 0 })
 
@@ -37,6 +37,16 @@ describe("visibleRange", () => {
   })
 })
 
+describe("blobMime", () => {
+  it("maps names to media types the webview understands", () => {
+    expect(blobMime("image", "a.jpg")).toBe("image/jpeg")
+    expect(blobMime("image", "a.PNG")).toBe("image/png")
+    expect(blobMime("image", "logo.svg")).toBe("image/svg+xml")
+    expect(blobMime("pdf", "doc.pdf")).toBe("application/pdf")
+    expect(blobMime("file", "secrets.env")).toBe("application/octet-stream")
+  })
+})
+
 describe("looksLikeText", () => {
   it("accepts utf-8, rejects NUL/invalid bytes", () => {
     expect(looksLikeText(new TextEncoder().encode("KEY=value\n"))).toBe(true)
diff --git a/apps/desktop-ui/src/lib/secure-files.ts b/apps/desktop-ui/src/lib/secure-files.ts
index c4c064e6..445b88a2 100644
--- a/apps/desktop-ui/src/lib/secure-files.ts
+++ b/apps/desktop-ui/src/lib/secure-files.ts
@@ -61,6 +61,16 @@ export function buildFolderTree(files: SecureFileEntry[], extraDirs: Iterable<st
   return root
 }
 
+/** Blob MIME for a decrypted payload, derived from the name (never stored). */
+export function blobMime(fileType: string, name: string): string {
+  const ext = name.split(".").pop()?.toLowerCase() ?? ""
+  if (fileType === "pdf") return "application/pdf"
+  if (fileType === "image") return ext === "svg" ? "image/svg+xml" : `image/${ext === "jpg" ? "jpeg" : ext}`
+  if (fileType === "video") return `video/${ext}`
+  if (fileType === "audio") return `audio/${ext}`
+  return "application/octet-stream"
+}
+
 /** Visible `[start, end)` row range for a fixed-row-height virtual list. */
 export function visibleRange(
   scrollTop: number,

From a744544f1ec68e628a3648ba6c381086960ae7ab Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sun, 23 Aug 2026 23:24:25 +0530
Subject: [PATCH 12/39] feat(backup-codes): regenerate backup codes from
 settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Codes were only ever issued at vault setup, so a user who burned all
eight — or set the vault up before codes existed — had no recovery path
left, even though the downloaded code file told them to regenerate from
Settings.

- New Settings card: verifies the master password, generates a fresh set
  and stores it (storing replaces the whole array, which is what
  invalidates the old codes), then shows them once with copy/download.
- GET /api/v1/auth/backup-codes returns {total, remaining} so the card
  can show how many codes are left.
- markBackupCodeUsed now throws on a non-OK response instead of failing
  silently, and the unlock gate burns the code after a successful unlock
  rather than before — a failed burn leaves a retryable code instead of
  spending one on an unlock that never happened.
- Code grid extracted so the setup gate and the settings card render
  codes identically.
- SettingsPage.backupCodes translated across all 27 locales.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018XHJKZ77EJdyDQ6gDt7WH6
---
 apps/desktop-ui/messages/af.json              |  16 ++
 apps/desktop-ui/messages/ar.json              |  16 ++
 apps/desktop-ui/messages/ca.json              |  16 ++
 apps/desktop-ui/messages/cs.json              |  16 ++
 apps/desktop-ui/messages/da.json              |  16 ++
 apps/desktop-ui/messages/de.json              |  16 ++
 apps/desktop-ui/messages/el.json              |  16 ++
 apps/desktop-ui/messages/en.json              |  16 ++
 apps/desktop-ui/messages/es.json              |  16 ++
 apps/desktop-ui/messages/fa.json              |  16 ++
 apps/desktop-ui/messages/fr.json              |  16 ++
 apps/desktop-ui/messages/id.json              |  16 ++
 apps/desktop-ui/messages/it.json              |  16 ++
 apps/desktop-ui/messages/ja.json              |  16 ++
 apps/desktop-ui/messages/ko.json              |  16 ++
 apps/desktop-ui/messages/ms.json              |  16 ++
 apps/desktop-ui/messages/nb.json              |  16 ++
 apps/desktop-ui/messages/nl.json              |  16 ++
 apps/desktop-ui/messages/pl.json              |  16 ++
 apps/desktop-ui/messages/pt-BR.json           |  16 ++
 apps/desktop-ui/messages/pt.json              |  16 ++
 apps/desktop-ui/messages/ru.json              |  16 ++
 apps/desktop-ui/messages/sv.json              |  16 ++
 apps/desktop-ui/messages/tr.json              |  16 ++
 apps/desktop-ui/messages/uk.json              |  16 ++
 apps/desktop-ui/messages/vi.json              |  16 ++
 apps/desktop-ui/messages/zh.json              |  16 ++
 apps/desktop-ui/src/app/settings/page.tsx     |   3 +
 .../src/components/master-password-gate.tsx   |  39 +----
 .../backup-codes-grid.tsx                     |  41 +++++
 .../components/settings/backup-codes-card.tsx | 142 ++++++++++++++++++
 apps/desktop-ui/src/lib/global-vault-api.ts   |  13 +-
 .../src-tauri/src/router/backup_codes.rs      |   7 +
 apps/desktop/src-tauri/src/router/mod.rs      |  12 ++
 34 files changed, 657 insertions(+), 32 deletions(-)
 create mode 100644 apps/desktop-ui/src/components/master-password-gate/backup-codes-grid.tsx
 create mode 100644 apps/desktop-ui/src/components/settings/backup-codes-card.tsx

diff --git a/apps/desktop-ui/messages/af.json b/apps/desktop-ui/messages/af.json
index 01b5e7e1..1760ade3 100644
--- a/apps/desktop-ui/messages/af.json
+++ b/apps/desktop-ui/messages/af.json
@@ -308,6 +308,22 @@
       "restoring": "Herstel tans…",
       "restoreSuccess": "Rugsteun herstel",
       "restoreError": "Herstel het misluk — verkeerde wagfrase of ongeldige rugsteunlêer"
+    },
+    "backupCodes": {
+      "title": "Rugsteunkodes",
+      "description": "Eenmalige kodes wat jou kluis herstel as jy jou meesterwagwoord vergeet.",
+      "remaining": "{remaining} van {total} kodes oor",
+      "none": "Geen rugsteunkodes gestoor nie.",
+      "hint": "'n Nuwe stel maak alle bestaande kodes ongeldig.",
+      "passwordPlaceholder": "Meesterwagwoord",
+      "regenerateButton": "Genereer nuwe kodes",
+      "generating": "Genereer tans…",
+      "wrongPassword": "Verkeerde meesterwagwoord",
+      "success": "Nuwe rugsteunkodes gegenereer",
+      "error": "Kon nie rugsteunkodes genereer nie",
+      "newCodesWarning": "Jy kan dit nie weer sien nie. Laai dit af of kopieer dit nou.",
+      "downloadButton": "Laai af",
+      "doneButton": "Ek het my kodes gestoor"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/ar.json b/apps/desktop-ui/messages/ar.json
index 789fe85c..68ec117a 100644
--- a/apps/desktop-ui/messages/ar.json
+++ b/apps/desktop-ui/messages/ar.json
@@ -308,6 +308,22 @@
       "restoring": "جارٍ الاستعادة…",
       "restoreSuccess": "تمت استعادة النسخة الاحتياطية",
       "restoreError": "فشلت الاستعادة — عبارة مرور خاطئة أو ملف نسخة احتياطية غير صالح"
+    },
+    "backupCodes": {
+      "title": "رموز النسخ الاحتياطي",
+      "description": "رموز تُستخدم لمرة واحدة لاستعادة خزنتك إذا نسيت كلمة المرور الرئيسية.",
+      "remaining": "بقي {remaining} من {total} رمزًا",
+      "none": "لا توجد رموز نسخ احتياطي مخزَّنة.",
+      "hint": "إنشاء مجموعة جديدة يُبطل جميع الرموز الحالية.",
+      "passwordPlaceholder": "كلمة المرور الرئيسية",
+      "regenerateButton": "إنشاء رموز جديدة",
+      "generating": "جارٍ الإنشاء…",
+      "wrongPassword": "كلمة المرور الرئيسية غير صحيحة",
+      "success": "تم إنشاء رموز نسخ احتياطي جديدة",
+      "error": "تعذر إنشاء رموز النسخ الاحتياطي",
+      "newCodesWarning": "لن تتمكن من رؤيتها مرة أخرى. نزّلها أو انسخها الآن.",
+      "downloadButton": "تنزيل",
+      "doneButton": "لقد حفظت رموزي"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/ca.json b/apps/desktop-ui/messages/ca.json
index 67746894..ecf0f8d0 100644
--- a/apps/desktop-ui/messages/ca.json
+++ b/apps/desktop-ui/messages/ca.json
@@ -308,6 +308,22 @@
       "restoring": "S'està restaurant…",
       "restoreSuccess": "Còpia de seguretat restaurada",
       "restoreError": "La restauració ha fallat — contrasenya incorrecta o fitxer de còpia no vàlid"
+    },
+    "backupCodes": {
+      "title": "Codis de recuperació",
+      "description": "Codis d'un sol ús que recuperen la teva caixa forta si oblides la contrasenya mestra.",
+      "remaining": "Queden {remaining} de {total} codis",
+      "none": "No hi ha cap codi de recuperació desat.",
+      "hint": "Generar un conjunt nou invalida tots els codis existents.",
+      "passwordPlaceholder": "Contrasenya mestra",
+      "regenerateButton": "Genera codis nous",
+      "generating": "S'estan generant…",
+      "wrongPassword": "Contrasenya mestra incorrecta",
+      "success": "S'han generat codis nous",
+      "error": "No s'han pogut generar els codis",
+      "newCodesWarning": "No els podràs tornar a veure. Descarrega'ls o copia'ls ara.",
+      "downloadButton": "Baixa",
+      "doneButton": "Ja he desat els codis"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/cs.json b/apps/desktop-ui/messages/cs.json
index ca1680ae..8b5ea6f0 100644
--- a/apps/desktop-ui/messages/cs.json
+++ b/apps/desktop-ui/messages/cs.json
@@ -308,6 +308,22 @@
       "restoring": "Obnovování…",
       "restoreSuccess": "Záloha obnovena",
       "restoreError": "Obnovení se nezdařilo — špatné heslo nebo neplatný soubor zálohy"
+    },
+    "backupCodes": {
+      "title": "Záložní kódy",
+      "description": "Jednorázové kódy, které obnoví přístup k trezoru, když zapomenete hlavní heslo.",
+      "remaining": "Zbývá {remaining} z {total} kódů",
+      "none": "Nejsou uloženy žádné záložní kódy.",
+      "hint": "Vygenerování nové sady zneplatní všechny stávající kódy.",
+      "passwordPlaceholder": "Hlavní heslo",
+      "regenerateButton": "Vygenerovat nové kódy",
+      "generating": "Generuji…",
+      "wrongPassword": "Nesprávné hlavní heslo",
+      "success": "Nové záložní kódy byly vygenerovány",
+      "error": "Záložní kódy se nepodařilo vygenerovat",
+      "newCodesWarning": "Znovu je již neuvidíte. Stáhněte si je nebo je zkopírujte.",
+      "downloadButton": "Stáhnout",
+      "doneButton": "Kódy jsem uložil"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/da.json b/apps/desktop-ui/messages/da.json
index 859d7cfc..4f87d603 100644
--- a/apps/desktop-ui/messages/da.json
+++ b/apps/desktop-ui/messages/da.json
@@ -308,6 +308,22 @@
       "restoring": "Gendanner…",
       "restoreSuccess": "Sikkerhedskopi gendannet",
       "restoreError": "Gendannelse mislykkedes — forkert adgangssætning eller ugyldig fil"
+    },
+    "backupCodes": {
+      "title": "Sikkerhedskoder",
+      "description": "Engangskoder, der gendanner din boks, hvis du glemmer din hovedadgangskode.",
+      "remaining": "{remaining} af {total} koder tilbage",
+      "none": "Ingen sikkerhedskoder gemt.",
+      "hint": "Nye koder ugyldiggør alle eksisterende koder.",
+      "passwordPlaceholder": "Hovedadgangskode",
+      "regenerateButton": "Generer nye koder",
+      "generating": "Genererer…",
+      "wrongPassword": "Forkert hovedadgangskode",
+      "success": "Nye sikkerhedskoder genereret",
+      "error": "Kunne ikke generere sikkerhedskoder",
+      "newCodesWarning": "Du kan ikke se dem igen. Download eller kopiér dem nu.",
+      "downloadButton": "Download",
+      "doneButton": "Jeg har gemt mine koder"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/de.json b/apps/desktop-ui/messages/de.json
index 7dc7b6e0..3d2155fc 100644
--- a/apps/desktop-ui/messages/de.json
+++ b/apps/desktop-ui/messages/de.json
@@ -308,6 +308,22 @@
       "restoring": "Wird wiederhergestellt…",
       "restoreSuccess": "Backup wiederhergestellt",
       "restoreError": "Wiederherstellung fehlgeschlagen — falsche Passphrase oder ungültige Backup-Datei"
+    },
+    "backupCodes": {
+      "title": "Backup-Codes",
+      "description": "Einmalcodes, mit denen Sie Ihren Tresor wiederherstellen, wenn Sie Ihr Master-Passwort vergessen.",
+      "remaining": "Noch {remaining} von {total} Codes",
+      "none": "Keine Backup-Codes gespeichert.",
+      "hint": "Ein neuer Satz macht alle bestehenden Codes ungültig.",
+      "passwordPlaceholder": "Master-Passwort",
+      "regenerateButton": "Neue Codes erzeugen",
+      "generating": "Wird erzeugt…",
+      "wrongPassword": "Falsches Master-Passwort",
+      "success": "Neue Backup-Codes erzeugt",
+      "error": "Backup-Codes konnten nicht erzeugt werden",
+      "newCodesWarning": "Sie können sie nicht erneut ansehen. Laden Sie sie jetzt herunter oder kopieren Sie sie.",
+      "downloadButton": "Herunterladen",
+      "doneButton": "Ich habe meine Codes gespeichert"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/el.json b/apps/desktop-ui/messages/el.json
index 6f9f0051..8475926c 100644
--- a/apps/desktop-ui/messages/el.json
+++ b/apps/desktop-ui/messages/el.json
@@ -308,6 +308,22 @@
       "restoring": "Γίνεται επαναφορά…",
       "restoreSuccess": "Το αντίγραφο ασφαλείας επαναφέρθηκε",
       "restoreError": "Η επαναφορά απέτυχε — λάθος φράση πρόσβασης ή μη έγκυρο αρχείο"
+    },
+    "backupCodes": {
+      "title": "Εφεδρικοί κωδικοί",
+      "description": "Κωδικοί μίας χρήσης που επαναφέρουν το θησαυροφυλάκιό σας αν ξεχάσετε τον κύριο κωδικό.",
+      "remaining": "Απομένουν {remaining} από {total} κωδικοί",
+      "none": "Δεν έχουν αποθηκευτεί εφεδρικοί κωδικοί.",
+      "hint": "Η δημιουργία νέων κωδικών ακυρώνει όλους τους υπάρχοντες.",
+      "passwordPlaceholder": "Κύριος κωδικός",
+      "regenerateButton": "Δημιουργία νέων κωδικών",
+      "generating": "Δημιουργία…",
+      "wrongPassword": "Λανθασμένος κύριος κωδικός",
+      "success": "Δημιουργήθηκαν νέοι εφεδρικοί κωδικοί",
+      "error": "Δεν ήταν δυνατή η δημιουργία κωδικών",
+      "newCodesWarning": "Δεν θα μπορείτε να τους δείτε ξανά. Κατεβάστε ή αντιγράψτε τους τώρα.",
+      "downloadButton": "Λήψη",
+      "doneButton": "Αποθήκευσα τους κωδικούς μου"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/en.json b/apps/desktop-ui/messages/en.json
index 8b904f03..981362e9 100644
--- a/apps/desktop-ui/messages/en.json
+++ b/apps/desktop-ui/messages/en.json
@@ -308,6 +308,22 @@
       "restoring": "Restoring…",
       "restoreSuccess": "Backup restored",
       "restoreError": "Restore failed — wrong passphrase or invalid backup file"
+    },
+    "backupCodes": {
+      "title": "Backup codes",
+      "description": "One-time codes that recover your vault if you forget your master password.",
+      "remaining": "{remaining} of {total} codes left",
+      "none": "No backup codes stored.",
+      "hint": "Generating a new set invalidates every existing code.",
+      "passwordPlaceholder": "Master password",
+      "regenerateButton": "Generate new codes",
+      "generating": "Generating…",
+      "wrongPassword": "Incorrect master password",
+      "success": "New backup codes generated",
+      "error": "Could not generate backup codes",
+      "newCodesWarning": "You cannot view these again. Download or copy them now.",
+      "downloadButton": "Download",
+      "doneButton": "I've saved my codes"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/es.json b/apps/desktop-ui/messages/es.json
index 5d638a89..cf95cf93 100644
--- a/apps/desktop-ui/messages/es.json
+++ b/apps/desktop-ui/messages/es.json
@@ -308,6 +308,22 @@
       "restoring": "Restaurando…",
       "restoreSuccess": "Copia de seguridad restaurada",
       "restoreError": "La restauración falló — frase incorrecta o archivo de copia no válido"
+    },
+    "backupCodes": {
+      "title": "Códigos de respaldo",
+      "description": "Códigos de un solo uso que recuperan tu bóveda si olvidas la contraseña maestra.",
+      "remaining": "Quedan {remaining} de {total} códigos",
+      "none": "No hay códigos de respaldo guardados.",
+      "hint": "Generar un conjunto nuevo invalida todos los códigos existentes.",
+      "passwordPlaceholder": "Contraseña maestra",
+      "regenerateButton": "Generar códigos nuevos",
+      "generating": "Generando…",
+      "wrongPassword": "Contraseña maestra incorrecta",
+      "success": "Nuevos códigos de respaldo generados",
+      "error": "No se pudieron generar los códigos de respaldo",
+      "newCodesWarning": "No podrás volver a verlos. Descárgalos o cópialos ahora.",
+      "downloadButton": "Descargar",
+      "doneButton": "Ya guardé mis códigos"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/fa.json b/apps/desktop-ui/messages/fa.json
index e09e45d1..c666143f 100644
--- a/apps/desktop-ui/messages/fa.json
+++ b/apps/desktop-ui/messages/fa.json
@@ -308,6 +308,22 @@
       "restoring": "در حال بازیابی…",
       "restoreSuccess": "نسخه پشتیبان بازیابی شد",
       "restoreError": "بازیابی ناموفق بود — عبارت عبور اشتباه یا فایل پشتیبان نامعتبر"
+    },
+    "backupCodes": {
+      "title": "کدهای پشتیبان",
+      "description": "کدهای یک‌بارمصرف برای بازیابی گاوصندوق در صورت فراموشی رمز اصلی.",
+      "remaining": "{remaining} از {total} کد باقی مانده",
+      "none": "هیچ کد پشتیبانی ذخیره نشده است.",
+      "hint": "ساخت مجموعه جدید همه کدهای فعلی را باطل می‌کند.",
+      "passwordPlaceholder": "رمز اصلی",
+      "regenerateButton": "ساخت کدهای جدید",
+      "generating": "در حال ساخت…",
+      "wrongPassword": "رمز اصلی نادرست است",
+      "success": "کدهای پشتیبان جدید ساخته شد",
+      "error": "ساخت کدهای پشتیبان ناموفق بود",
+      "newCodesWarning": "دیگر نمی‌توانید آن‌ها را ببینید. اکنون دانلود یا کپی کنید.",
+      "downloadButton": "دانلود",
+      "doneButton": "کدهایم را ذخیره کردم"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/fr.json b/apps/desktop-ui/messages/fr.json
index cc6dcdf8..e465ebb1 100644
--- a/apps/desktop-ui/messages/fr.json
+++ b/apps/desktop-ui/messages/fr.json
@@ -308,6 +308,22 @@
       "restoring": "Restauration…",
       "restoreSuccess": "Sauvegarde restaurée",
       "restoreError": "Échec de la restauration — phrase secrète incorrecte ou fichier non valide"
+    },
+    "backupCodes": {
+      "title": "Codes de secours",
+      "description": "Codes à usage unique pour récupérer votre coffre si vous oubliez votre mot de passe maître.",
+      "remaining": "{remaining} sur {total} codes restants",
+      "none": "Aucun code de secours enregistré.",
+      "hint": "Générer une nouvelle série invalide tous les codes existants.",
+      "passwordPlaceholder": "Mot de passe maître",
+      "regenerateButton": "Générer de nouveaux codes",
+      "generating": "Génération…",
+      "wrongPassword": "Mot de passe maître incorrect",
+      "success": "Nouveaux codes de secours générés",
+      "error": "Impossible de générer les codes de secours",
+      "newCodesWarning": "Vous ne pourrez plus les afficher. Téléchargez-les ou copiez-les maintenant.",
+      "downloadButton": "Télécharger",
+      "doneButton": "J'ai enregistré mes codes"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/id.json b/apps/desktop-ui/messages/id.json
index babcd1f4..17c7657f 100644
--- a/apps/desktop-ui/messages/id.json
+++ b/apps/desktop-ui/messages/id.json
@@ -308,6 +308,22 @@
       "restoring": "Memulihkan…",
       "restoreSuccess": "Cadangan dipulihkan",
       "restoreError": "Pemulihan gagal — frasa sandi salah atau file cadangan tidak valid"
+    },
+    "backupCodes": {
+      "title": "Kode cadangan",
+      "description": "Kode sekali pakai untuk memulihkan brankas jika Anda lupa kata sandi utama.",
+      "remaining": "Tersisa {remaining} dari {total} kode",
+      "none": "Belum ada kode cadangan tersimpan.",
+      "hint": "Membuat set baru membatalkan semua kode yang ada.",
+      "passwordPlaceholder": "Kata sandi utama",
+      "regenerateButton": "Buat kode baru",
+      "generating": "Membuat…",
+      "wrongPassword": "Kata sandi utama salah",
+      "success": "Kode cadangan baru dibuat",
+      "error": "Gagal membuat kode cadangan",
+      "newCodesWarning": "Anda tidak dapat melihatnya lagi. Unduh atau salin sekarang.",
+      "downloadButton": "Unduh",
+      "doneButton": "Saya sudah menyimpan kode"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/it.json b/apps/desktop-ui/messages/it.json
index b87a0ad6..9296946e 100644
--- a/apps/desktop-ui/messages/it.json
+++ b/apps/desktop-ui/messages/it.json
@@ -308,6 +308,22 @@
       "restoring": "Ripristino…",
       "restoreSuccess": "Backup ripristinato",
       "restoreError": "Ripristino non riuscito — passphrase errata o file di backup non valido"
+    },
+    "backupCodes": {
+      "title": "Codici di backup",
+      "description": "Codici monouso che recuperano la cassaforte se dimentichi la password principale.",
+      "remaining": "{remaining} di {total} codici rimasti",
+      "none": "Nessun codice di backup salvato.",
+      "hint": "Generare nuovi codici invalida tutti quelli esistenti.",
+      "passwordPlaceholder": "Password principale",
+      "regenerateButton": "Genera nuovi codici",
+      "generating": "Generazione…",
+      "wrongPassword": "Password principale errata",
+      "success": "Nuovi codici di backup generati",
+      "error": "Impossibile generare i codici di backup",
+      "newCodesWarning": "Non potrai più visualizzarli. Scaricali o copiali ora.",
+      "downloadButton": "Scarica",
+      "doneButton": "Ho salvato i codici"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/ja.json b/apps/desktop-ui/messages/ja.json
index af066152..ac978694 100644
--- a/apps/desktop-ui/messages/ja.json
+++ b/apps/desktop-ui/messages/ja.json
@@ -308,6 +308,22 @@
       "restoring": "復元中…",
       "restoreSuccess": "バックアップを復元しました",
       "restoreError": "復元に失敗しました — パスフレーズが違うか、無効なバックアップファイルです"
+    },
+    "backupCodes": {
+      "title": "バックアップコード",
+      "description": "マスターパスワードを忘れたときにボルトを復旧できる、1 回だけ使えるコードです。",
+      "remaining": "残り {remaining} / {total} コード",
+      "none": "バックアップコードは保存されていません。",
+      "hint": "新しく生成すると、既存のコードはすべて無効になります。",
+      "passwordPlaceholder": "マスターパスワード",
+      "regenerateButton": "新しいコードを生成",
+      "generating": "生成中…",
+      "wrongPassword": "マスターパスワードが違います",
+      "success": "新しいバックアップコードを生成しました",
+      "error": "バックアップコードを生成できませんでした",
+      "newCodesWarning": "この画面を離れると再表示できません。今すぐダウンロードまたはコピーしてください。",
+      "downloadButton": "ダウンロード",
+      "doneButton": "コードを保存しました"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/ko.json b/apps/desktop-ui/messages/ko.json
index 7de62e42..65e05658 100644
--- a/apps/desktop-ui/messages/ko.json
+++ b/apps/desktop-ui/messages/ko.json
@@ -308,6 +308,22 @@
       "restoring": "복원 중…",
       "restoreSuccess": "백업이 복원되었습니다",
       "restoreError": "복원에 실패했습니다 — 잘못된 암호 문구이거나 유효하지 않은 백업 파일입니다"
+    },
+    "backupCodes": {
+      "title": "백업 코드",
+      "description": "마스터 비밀번호를 잊었을 때 보관함을 복구하는 일회용 코드입니다.",
+      "remaining": "{total}개 중 {remaining}개 남음",
+      "none": "저장된 백업 코드가 없습니다.",
+      "hint": "새로 생성하면 기존 코드는 모두 무효가 됩니다.",
+      "passwordPlaceholder": "마스터 비밀번호",
+      "regenerateButton": "새 코드 생성",
+      "generating": "생성 중…",
+      "wrongPassword": "마스터 비밀번호가 올바르지 않습니다",
+      "success": "새 백업 코드를 생성했습니다",
+      "error": "백업 코드를 생성하지 못했습니다",
+      "newCodesWarning": "다시 볼 수 없습니다. 지금 다운로드하거나 복사하세요.",
+      "downloadButton": "다운로드",
+      "doneButton": "코드를 저장했습니다"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/ms.json b/apps/desktop-ui/messages/ms.json
index 3486bafe..afcf4241 100644
--- a/apps/desktop-ui/messages/ms.json
+++ b/apps/desktop-ui/messages/ms.json
@@ -308,6 +308,22 @@
       "restoring": "Memulihkan…",
       "restoreSuccess": "Sandaran dipulihkan",
       "restoreError": "Pemulihan gagal — frasa laluan salah atau fail sandaran tidak sah"
+    },
+    "backupCodes": {
+      "title": "Kod sandaran",
+      "description": "Kod sekali guna untuk memulihkan peti besi anda jika terlupa kata laluan induk.",
+      "remaining": "{remaining} daripada {total} kod berbaki",
+      "none": "Tiada kod sandaran disimpan.",
+      "hint": "Menjana set baharu membatalkan semua kod sedia ada.",
+      "passwordPlaceholder": "Kata laluan induk",
+      "regenerateButton": "Jana kod baharu",
+      "generating": "Menjana…",
+      "wrongPassword": "Kata laluan induk salah",
+      "success": "Kod sandaran baharu dijana",
+      "error": "Gagal menjana kod sandaran",
+      "newCodesWarning": "Anda tidak boleh melihatnya lagi. Muat turun atau salin sekarang.",
+      "downloadButton": "Muat turun",
+      "doneButton": "Saya telah simpan kod saya"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/nb.json b/apps/desktop-ui/messages/nb.json
index 3cace2e7..1c83d062 100644
--- a/apps/desktop-ui/messages/nb.json
+++ b/apps/desktop-ui/messages/nb.json
@@ -308,6 +308,22 @@
       "restoring": "Gjenoppretter…",
       "restoreSuccess": "Sikkerhetskopi gjenopprettet",
       "restoreError": "Gjenoppretting mislyktes — feil passfrase eller ugyldig fil"
+    },
+    "backupCodes": {
+      "title": "Sikkerhetskoder",
+      "description": "Engangskoder som gjenoppretter hvelvet hvis du glemmer hovedpassordet.",
+      "remaining": "{remaining} av {total} koder igjen",
+      "none": "Ingen sikkerhetskoder lagret.",
+      "hint": "Nye koder gjør alle eksisterende koder ugyldige.",
+      "passwordPlaceholder": "Hovedpassord",
+      "regenerateButton": "Generer nye koder",
+      "generating": "Genererer…",
+      "wrongPassword": "Feil hovedpassord",
+      "success": "Nye sikkerhetskoder generert",
+      "error": "Kunne ikke generere sikkerhetskoder",
+      "newCodesWarning": "Du kan ikke se dem igjen. Last ned eller kopier dem nå.",
+      "downloadButton": "Last ned",
+      "doneButton": "Jeg har lagret kodene"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/nl.json b/apps/desktop-ui/messages/nl.json
index 8c3961ce..890ed8b5 100644
--- a/apps/desktop-ui/messages/nl.json
+++ b/apps/desktop-ui/messages/nl.json
@@ -308,6 +308,22 @@
       "restoring": "Herstellen…",
       "restoreSuccess": "Back-up hersteld",
       "restoreError": "Herstellen mislukt — verkeerde wachtwoordzin of ongeldig back-upbestand"
+    },
+    "backupCodes": {
+      "title": "Back-upcodes",
+      "description": "Eenmalige codes waarmee je je kluis herstelt als je je hoofdwachtwoord vergeet.",
+      "remaining": "Nog {remaining} van {total} codes",
+      "none": "Geen back-upcodes opgeslagen.",
+      "hint": "Een nieuwe set maakt alle bestaande codes ongeldig.",
+      "passwordPlaceholder": "Hoofdwachtwoord",
+      "regenerateButton": "Nieuwe codes genereren",
+      "generating": "Genereren…",
+      "wrongPassword": "Onjuist hoofdwachtwoord",
+      "success": "Nieuwe back-upcodes gegenereerd",
+      "error": "Back-upcodes genereren mislukt",
+      "newCodesWarning": "Je kunt ze niet opnieuw bekijken. Download of kopieer ze nu.",
+      "downloadButton": "Downloaden",
+      "doneButton": "Ik heb mijn codes opgeslagen"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/pl.json b/apps/desktop-ui/messages/pl.json
index b630e983..f17eac1a 100644
--- a/apps/desktop-ui/messages/pl.json
+++ b/apps/desktop-ui/messages/pl.json
@@ -308,6 +308,22 @@
       "restoring": "Przywracanie…",
       "restoreSuccess": "Kopia zapasowa przywrócona",
       "restoreError": "Przywracanie nie powiodło się — błędne hasło lub nieprawidłowy plik kopii"
+    },
+    "backupCodes": {
+      "title": "Kody zapasowe",
+      "description": "Jednorazowe kody przywracające dostęp do sejfu, gdy zapomnisz hasła głównego.",
+      "remaining": "Pozostało {remaining} z {total} kodów",
+      "none": "Brak zapisanych kodów zapasowych.",
+      "hint": "Wygenerowanie nowego zestawu unieważnia wszystkie dotychczasowe kody.",
+      "passwordPlaceholder": "Hasło główne",
+      "regenerateButton": "Wygeneruj nowe kody",
+      "generating": "Generowanie…",
+      "wrongPassword": "Nieprawidłowe hasło główne",
+      "success": "Wygenerowano nowe kody zapasowe",
+      "error": "Nie udało się wygenerować kodów zapasowych",
+      "newCodesWarning": "Nie zobaczysz ich ponownie. Pobierz je lub skopiuj teraz.",
+      "downloadButton": "Pobierz",
+      "doneButton": "Zapisałem kody"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/pt-BR.json b/apps/desktop-ui/messages/pt-BR.json
index eff1e647..4f391f54 100644
--- a/apps/desktop-ui/messages/pt-BR.json
+++ b/apps/desktop-ui/messages/pt-BR.json
@@ -308,6 +308,22 @@
       "restoring": "Restaurando…",
       "restoreSuccess": "Backup restaurado",
       "restoreError": "A restauração falhou — senha incorreta ou arquivo de backup inválido"
+    },
+    "backupCodes": {
+      "title": "Códigos de backup",
+      "description": "Códigos de uso único que recuperam seu cofre se você esquecer a senha mestra.",
+      "remaining": "Restam {remaining} de {total} códigos",
+      "none": "Nenhum código de backup salvo.",
+      "hint": "Gerar um novo conjunto invalida todos os códigos existentes.",
+      "passwordPlaceholder": "Senha mestra",
+      "regenerateButton": "Gerar novos códigos",
+      "generating": "Gerando…",
+      "wrongPassword": "Senha mestra incorreta",
+      "success": "Novos códigos de backup gerados",
+      "error": "Não foi possível gerar os códigos de backup",
+      "newCodesWarning": "Você não poderá vê-los novamente. Baixe ou copie agora.",
+      "downloadButton": "Baixar",
+      "doneButton": "Salvei meus códigos"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/pt.json b/apps/desktop-ui/messages/pt.json
index 070df5aa..0550bb75 100644
--- a/apps/desktop-ui/messages/pt.json
+++ b/apps/desktop-ui/messages/pt.json
@@ -308,6 +308,22 @@
       "restoring": "A restaurar…",
       "restoreSuccess": "Cópia de segurança restaurada",
       "restoreError": "O restauro falhou — frase de acesso errada ou ficheiro inválido"
+    },
+    "backupCodes": {
+      "title": "Códigos de recuperação",
+      "description": "Códigos de utilização única que recuperam o cofre se esquecer a palavra-passe principal.",
+      "remaining": "Restam {remaining} de {total} códigos",
+      "none": "Nenhum código de recuperação guardado.",
+      "hint": "Gerar um novo conjunto invalida todos os códigos existentes.",
+      "passwordPlaceholder": "Palavra-passe principal",
+      "regenerateButton": "Gerar novos códigos",
+      "generating": "A gerar…",
+      "wrongPassword": "Palavra-passe principal incorreta",
+      "success": "Novos códigos de recuperação gerados",
+      "error": "Não foi possível gerar os códigos",
+      "newCodesWarning": "Não poderá vê-los novamente. Transfira-os ou copie-os agora.",
+      "downloadButton": "Transferir",
+      "doneButton": "Já guardei os meus códigos"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/ru.json b/apps/desktop-ui/messages/ru.json
index 6e2b9679..f494a28e 100644
--- a/apps/desktop-ui/messages/ru.json
+++ b/apps/desktop-ui/messages/ru.json
@@ -308,6 +308,22 @@
       "restoring": "Восстановление…",
       "restoreSuccess": "Резервная копия восстановлена",
       "restoreError": "Восстановление не удалось — неверная фраза или повреждённый файл копии"
+    },
+    "backupCodes": {
+      "title": "Резервные коды",
+      "description": "Одноразовые коды для восстановления хранилища, если вы забыли мастер-пароль.",
+      "remaining": "Осталось {remaining} из {total} кодов",
+      "none": "Резервные коды не сохранены.",
+      "hint": "Новый набор делает все прежние коды недействительными.",
+      "passwordPlaceholder": "Мастер-пароль",
+      "regenerateButton": "Создать новые коды",
+      "generating": "Создание…",
+      "wrongPassword": "Неверный мастер-пароль",
+      "success": "Новые резервные коды созданы",
+      "error": "Не удалось создать резервные коды",
+      "newCodesWarning": "Больше вы их не увидите. Скачайте или скопируйте сейчас.",
+      "downloadButton": "Скачать",
+      "doneButton": "Я сохранил коды"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/sv.json b/apps/desktop-ui/messages/sv.json
index 7b24e94a..a4bbda3a 100644
--- a/apps/desktop-ui/messages/sv.json
+++ b/apps/desktop-ui/messages/sv.json
@@ -308,6 +308,22 @@
       "restoring": "Återställer…",
       "restoreSuccess": "Säkerhetskopia återställd",
       "restoreError": "Återställningen misslyckades — fel lösenfras eller ogiltig fil"
+    },
+    "backupCodes": {
+      "title": "Reservkoder",
+      "description": "Engångskoder som återställer ditt valv om du glömmer huvudlösenordet.",
+      "remaining": "{remaining} av {total} koder kvar",
+      "none": "Inga reservkoder sparade.",
+      "hint": "Nya koder gör alla befintliga koder ogiltiga.",
+      "passwordPlaceholder": "Huvudlösenord",
+      "regenerateButton": "Skapa nya koder",
+      "generating": "Skapar…",
+      "wrongPassword": "Fel huvudlösenord",
+      "success": "Nya reservkoder skapade",
+      "error": "Kunde inte skapa reservkoder",
+      "newCodesWarning": "Du kan inte se dem igen. Ladda ner eller kopiera dem nu.",
+      "downloadButton": "Ladda ner",
+      "doneButton": "Jag har sparat mina koder"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/tr.json b/apps/desktop-ui/messages/tr.json
index d942f3cd..f1c69ac1 100644
--- a/apps/desktop-ui/messages/tr.json
+++ b/apps/desktop-ui/messages/tr.json
@@ -308,6 +308,22 @@
       "restoring": "Geri yükleniyor…",
       "restoreSuccess": "Yedek geri yüklendi",
       "restoreError": "Geri yükleme başarısız — yanlış parola veya geçersiz yedek dosyası"
+    },
+    "backupCodes": {
+      "title": "Yedek kodlar",
+      "description": "Ana parolanızı unutursanız kasanızı kurtaran tek kullanımlık kodlar.",
+      "remaining": "{total} koddan {remaining} tanesi kaldı",
+      "none": "Kayıtlı yedek kod yok.",
+      "hint": "Yeni kod üretmek mevcut tüm kodları geçersiz kılar.",
+      "passwordPlaceholder": "Ana parola",
+      "regenerateButton": "Yeni kod üret",
+      "generating": "Üretiliyor…",
+      "wrongPassword": "Ana parola yanlış",
+      "success": "Yeni yedek kodlar üretildi",
+      "error": "Yedek kodlar üretilemedi",
+      "newCodesWarning": "Bunları tekrar göremezsiniz. Şimdi indirin veya kopyalayın.",
+      "downloadButton": "İndir",
+      "doneButton": "Kodlarımı kaydettim"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/uk.json b/apps/desktop-ui/messages/uk.json
index c0ce94e6..b9783830 100644
--- a/apps/desktop-ui/messages/uk.json
+++ b/apps/desktop-ui/messages/uk.json
@@ -308,6 +308,22 @@
       "restoring": "Відновлення…",
       "restoreSuccess": "Резервну копію відновлено",
       "restoreError": "Відновлення не вдалося — неправильна фраза або недійсний файл копії"
+    },
+    "backupCodes": {
+      "title": "Резервні коди",
+      "description": "Одноразові коди для відновлення сховища, якщо ви забули майстер-пароль.",
+      "remaining": "Залишилося {remaining} з {total} кодів",
+      "none": "Резервні коди не збережено.",
+      "hint": "Новий набір робить усі попередні коди недійсними.",
+      "passwordPlaceholder": "Майстер-пароль",
+      "regenerateButton": "Створити нові коди",
+      "generating": "Створення…",
+      "wrongPassword": "Невірний майстер-пароль",
+      "success": "Нові резервні коди створено",
+      "error": "Не вдалося створити резервні коди",
+      "newCodesWarning": "Ви більше їх не побачите. Завантажте або скопіюйте зараз.",
+      "downloadButton": "Завантажити",
+      "doneButton": "Я зберіг коди"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/vi.json b/apps/desktop-ui/messages/vi.json
index eb148b32..308f9a7b 100644
--- a/apps/desktop-ui/messages/vi.json
+++ b/apps/desktop-ui/messages/vi.json
@@ -308,6 +308,22 @@
       "restoring": "Đang khôi phục…",
       "restoreSuccess": "Đã khôi phục bản sao lưu",
       "restoreError": "Khôi phục thất bại — sai cụm mật khẩu hoặc tệp sao lưu không hợp lệ"
+    },
+    "backupCodes": {
+      "title": "Mã dự phòng",
+      "description": "Mã dùng một lần để khôi phục kho lưu trữ nếu bạn quên mật khẩu chính.",
+      "remaining": "Còn {remaining} trong {total} mã",
+      "none": "Chưa lưu mã dự phòng nào.",
+      "hint": "Tạo bộ mã mới sẽ vô hiệu hóa tất cả mã hiện có.",
+      "passwordPlaceholder": "Mật khẩu chính",
+      "regenerateButton": "Tạo mã mới",
+      "generating": "Đang tạo…",
+      "wrongPassword": "Mật khẩu chính không đúng",
+      "success": "Đã tạo mã dự phòng mới",
+      "error": "Không thể tạo mã dự phòng",
+      "newCodesWarning": "Bạn sẽ không xem lại được. Hãy tải xuống hoặc sao chép ngay.",
+      "downloadButton": "Tải xuống",
+      "doneButton": "Tôi đã lưu mã"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/messages/zh.json b/apps/desktop-ui/messages/zh.json
index ac45e163..db2bce05 100644
--- a/apps/desktop-ui/messages/zh.json
+++ b/apps/desktop-ui/messages/zh.json
@@ -308,6 +308,22 @@
       "restoring": "正在恢复…",
       "restoreSuccess": "备份已恢复",
       "restoreError": "恢复失败 — 口令错误或备份文件无效"
+    },
+    "backupCodes": {
+      "title": "备用代码",
+      "description": "一次性代码，可在忘记主密码时恢复保险库。",
+      "remaining": "剩余 {remaining} / {total} 个代码",
+      "none": "尚未保存备用代码。",
+      "hint": "生成新代码会使现有代码全部失效。",
+      "passwordPlaceholder": "主密码",
+      "regenerateButton": "生成新代码",
+      "generating": "生成中…",
+      "wrongPassword": "主密码不正确",
+      "success": "已生成新的备用代码",
+      "error": "无法生成备用代码",
+      "newCodesWarning": "离开后将无法再次查看，请立即下载或复制。",
+      "downloadButton": "下载",
+      "doneButton": "我已保存代码"
     }
   },
   "Dashboard": {
diff --git a/apps/desktop-ui/src/app/settings/page.tsx b/apps/desktop-ui/src/app/settings/page.tsx
index 1a38bcde..2519e334 100644
--- a/apps/desktop-ui/src/app/settings/page.tsx
+++ b/apps/desktop-ui/src/app/settings/page.tsx
@@ -19,6 +19,7 @@ import { ProfileCard } from '@/components/settings/profile-card'
 import { AppVersionLabel } from '@/components/desktop/app-version-label'
 import { FactoryResetCard } from '@/components/desktop/factory-reset-card'
 import { BackupRestoreCard } from '@/components/desktop/backup-restore-card'
+import { BackupCodesCard } from '@/components/settings/backup-codes-card'
 import { useActiveWorkspace } from '@/store/workspace-store'
 import { Briefcase } from 'lucide-react'
 
@@ -305,6 +306,8 @@ export default function SettingsPage() {
 
         <AppVersionLabel />
 
+        <BackupCodesCard />
+
         <BackupRestoreCard />
 
         <FactoryResetCard />
diff --git a/apps/desktop-ui/src/components/master-password-gate.tsx b/apps/desktop-ui/src/components/master-password-gate.tsx
index 3e0ebc38..e4428edd 100644
--- a/apps/desktop-ui/src/components/master-password-gate.tsx
+++ b/apps/desktop-ui/src/components/master-password-gate.tsx
@@ -5,7 +5,6 @@ import { motion, AnimatePresence } from "framer-motion"
 import {
     AlertTriangle,
     CheckCircle2,
-    Copy,
     Download,
     Eye,
     EyeOff,
@@ -48,6 +47,7 @@ import {
 import { useMasterKeyStore } from "@/store/master-key-store"
 import { calcStrength } from "./master-password-gate/password-strength"
 import { downloadBackupCodesFile } from "./master-password-gate/backup-codes-file"
+import { BackupCodesGrid } from "./master-password-gate/backup-codes-grid"
 import { Spinner, ErrorBanner } from "./master-password-gate/gate-helpers"
 
 // ── Gate modal ────────────────────────────────────────────────────────────────
@@ -77,7 +77,6 @@ export function MasterPasswordGate() {
     const [backupCodes, setBackupCodes] = useState<string[]>([])
     const [backupCodesAcknowledged, setBackupCodesAcknowledged] = useState(false)
     const [backupCodeInput, setBackupCodeInput] = useState("")
-    const [copiedIndex, setCopiedIndex] = useState<number | null>(null)
 
     const strength = calcStrength(password)
     const confirmMismatch = confirmPassword.length > 0 && confirmPassword !== password
@@ -119,12 +118,6 @@ export function MasterPasswordGate() {
         setError("")
     }
 
-    const copyCode = async (code: string, index: number) => {
-        await navigator.clipboard.writeText(code)
-        setCopiedIndex(index)
-        setTimeout(() => setCopiedIndex(null), 1500)
-    }
-
     // ── form handlers ─────────────────────────────────────────────────────────
 
     const handleSetup = async (e: React.FormEvent) => {
@@ -236,9 +229,14 @@ export function MasterPasswordGate() {
                 return
             }
 
-            await markBackupCodeUsed(codeId)
+            // Unlock first, burn the code second: a failed burn leaves a code
+            // the user can retry with, while burning first would spend it on an
+            // unlock that never happened.
             await unlockSecureVault(masterPassword)
             setKey(key)
+            await markBackupCodeUsed(codeId).catch((err) =>
+                console.error("[MasterPasswordGate] failed to consume backup code:", err),
+            )
             toast.success("Unlocked via backup code. That code is now consumed.")
         } catch (err: any) {
             console.error("[MasterPasswordGate] backup code unlock error:", err)
@@ -329,28 +327,7 @@ export function MasterPasswordGate() {
                                 </AlertDescription>
                             </Alert>
 
-                            <div className="grid grid-cols-2 gap-2">
-                                {backupCodes.map((code, i) => (
-                                    <button
-                                        key={i}
-                                        type="button"
-                                        onClick={() => copyCode(code, i)}
-                                        className="group flex cursor-pointer items-center gap-2 rounded-lg border border-border/60 bg-muted/40 px-3 py-2.5 transition-colors duration-150 hover:bg-muted"
-                                    >
-                                        <span className="w-4 shrink-0 text-xs text-muted-foreground/50">
-                                            {i + 1}
-                                        </span>
-                                        <span className="flex-1 font-mono text-xs tracking-wider text-foreground/80">
-                                            {code}
-                                        </span>
-                                        {copiedIndex === i ? (
-                                            <CheckCircle2 className="h-3.5 w-3.5 shrink-0 text-emerald-500" />
-                                        ) : (
-                                            <Copy className="h-3.5 w-3.5 shrink-0 text-muted-foreground/30 opacity-0 transition-opacity duration-150 group-hover:opacity-100" />
-                                        )}
-                                    </button>
-                                ))}
-                            </div>
+                            <BackupCodesGrid codes={backupCodes} />
 
                             <div className="flex gap-2.5">
                                 <Button
diff --git a/apps/desktop-ui/src/components/master-password-gate/backup-codes-grid.tsx b/apps/desktop-ui/src/components/master-password-gate/backup-codes-grid.tsx
new file mode 100644
index 00000000..f86f085e
--- /dev/null
+++ b/apps/desktop-ui/src/components/master-password-gate/backup-codes-grid.tsx
@@ -0,0 +1,41 @@
+"use client"
+
+import { useState } from "react"
+import { CheckCircle2, Copy } from "lucide-react"
+
+/**
+ * Click-to-copy grid of freshly generated backup codes. Shared by the setup
+ * gate and the settings regenerate card so both render codes identically.
+ */
+export function BackupCodesGrid({ codes }: { codes: string[] }) {
+    const [copiedIndex, setCopiedIndex] = useState<number | null>(null)
+
+    const copyCode = async (code: string, index: number) => {
+        await navigator.clipboard.writeText(code)
+        setCopiedIndex(index)
+        setTimeout(() => setCopiedIndex(null), 1500)
+    }
+
+    return (
+        <div className="grid grid-cols-2 gap-2">
+            {codes.map((code, i) => (
+                <button
+                    key={i}
+                    type="button"
+                    onClick={() => copyCode(code, i)}
+                    className="group flex cursor-pointer items-center gap-2 rounded-lg border border-border/60 bg-muted/40 px-3 py-2.5 transition-colors duration-150 hover:bg-muted"
+                >
+                    <span className="w-4 shrink-0 text-xs text-muted-foreground/50">{i + 1}</span>
+                    <span className="flex-1 font-mono text-xs tracking-wider text-foreground/80">
+                        {code}
+                    </span>
+                    {copiedIndex === i ? (
+                        <CheckCircle2 className="h-3.5 w-3.5 shrink-0 text-emerald-500" />
+                    ) : (
+                        <Copy className="h-3.5 w-3.5 shrink-0 text-muted-foreground/30 opacity-0 transition-opacity duration-150 group-hover:opacity-100" />
+                    )}
+                </button>
+            ))}
+        </div>
+    )
+}
diff --git a/apps/desktop-ui/src/components/settings/backup-codes-card.tsx b/apps/desktop-ui/src/components/settings/backup-codes-card.tsx
new file mode 100644
index 00000000..3d14da42
--- /dev/null
+++ b/apps/desktop-ui/src/components/settings/backup-codes-card.tsx
@@ -0,0 +1,142 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { useTranslations } from "next-intl"
+import { AlertTriangle, Download, KeyRound } from "lucide-react"
+import { toast } from "sonner"
+
+import { Alert, AlertDescription } from "@/components/ui/alert"
+import { Button } from "@/components/ui/button"
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card"
+import { Input } from "@/components/ui/input"
+import { generateBackupCodes, encryptWithBackupCode } from "@/lib/encryption"
+import {
+    getBackupCodeStatus,
+    storeBackupCodes,
+    type BackupCodeStatus,
+} from "@/lib/global-vault-api"
+import { verifyMasterPassword } from "@/lib/verify-master-password"
+import { useMasterKeyStore } from "@/store/master-key-store"
+import { BackupCodesGrid } from "@/components/master-password-gate/backup-codes-grid"
+import { downloadBackupCodesFile } from "@/components/master-password-gate/backup-codes-file"
+import useAuth from "@/utils/useAuth"
+
+/**
+ * Regenerate the master-password backup codes. Codes are only issued at vault
+ * setup otherwise, so without this a user who burns all of them (or set the
+ * vault up before codes existed) has no recovery path left.
+ *
+ * Storing a fresh set replaces the whole array, which is what invalidates the
+ * old codes. Renders nothing until a vault exists.
+ */
+export function BackupCodesCard() {
+    const t = useTranslations("SettingsPage.backupCodes")
+    const { user } = useAuth(false)
+    const { vault, vaultStatus } = useMasterKeyStore()
+    const [status, setStatus] = useState<BackupCodeStatus | null>(null)
+    const [password, setPassword] = useState("")
+    const [busy, setBusy] = useState(false)
+    const [codes, setCodes] = useState<string[]>([])
+
+    useEffect(() => {
+        if (vaultStatus === "not-configured" || vaultStatus === "restoring") return
+        getBackupCodeStatus()
+            .then(setStatus)
+            .catch(() => setStatus(null))
+    }, [vaultStatus])
+
+    if (!vault || vaultStatus === "not-configured") return null
+
+    const handleRegenerate = async () => {
+        if (!password) return
+        setBusy(true)
+        try {
+            const key = await verifyMasterPassword(password, vault)
+            if (!key) {
+                toast.error(t("wrongPassword"))
+                return
+            }
+            const fresh = generateBackupCodes(8)
+            await storeBackupCodes(
+                await Promise.all(fresh.map((code) => encryptWithBackupCode(code, password)))
+            )
+            setCodes(fresh)
+            setStatus({ total: fresh.length, remaining: fresh.length })
+            setPassword("")
+            toast.success(t("success"))
+        } catch {
+            toast.error(t("error"))
+        } finally {
+            setBusy(false)
+        }
+    }
+
+    return (
+        <Card className="rounded-2xl border border-border/60 bg-card/60 shadow-sm backdrop-blur-sm">
+            <CardHeader>
+                <CardTitle className="flex items-center gap-2.5">
+                    <span className="flex h-8 w-8 items-center justify-center rounded-lg bg-gradient-to-br from-primary/15 to-violet-500/10 text-primary ring-1 ring-inset ring-border/50">
+                        <KeyRound className="h-4 w-4" />
+                    </span>
+                    {t("title")}
+                </CardTitle>
+                <CardDescription>{t("description")}</CardDescription>
+            </CardHeader>
+            <CardContent className="space-y-4">
+                {codes.length > 0 ? (
+                    <>
+                        <Alert className="border-orange-500/30 bg-orange-500/5">
+                            <AlertTriangle className="h-4 w-4 text-orange-500" />
+                            <AlertDescription className="text-xs leading-relaxed">
+                                {t("newCodesWarning")}
+                            </AlertDescription>
+                        </Alert>
+                        <BackupCodesGrid codes={codes} />
+                        <div className="flex gap-2.5">
+                            <Button
+                                variant="outline"
+                                className="flex-1"
+                                onClick={() => downloadBackupCodesFile(codes, user?.email)}
+                            >
+                                <Download className="mr-2 h-4 w-4" />
+                                {t("downloadButton")}
+                            </Button>
+                            <Button className="flex-1" onClick={() => setCodes([])}>
+                                {t("doneButton")}
+                            </Button>
+                        </div>
+                    </>
+                ) : (
+                    <>
+                        <p className="text-xs text-muted-foreground">
+                            {status && status.total > 0
+                                ? t("remaining", {
+                                      remaining: status.remaining,
+                                      total: status.total,
+                                  })
+                                : t("none")}
+                        </p>
+                        <div className="flex flex-col gap-2 sm:flex-row">
+                            <Input
+                                type="password"
+                                placeholder={t("passwordPlaceholder")}
+                                value={password}
+                                onChange={(e) => setPassword(e.target.value)}
+                                onKeyDown={(e) => {
+                                    if (e.key === "Enter") handleRegenerate()
+                                }}
+                                autoComplete="current-password"
+                                className="sm:max-w-xs"
+                                disabled={busy}
+                            />
+                            <Button onClick={handleRegenerate} disabled={busy || !password}>
+                                {busy ? t("generating") : t("regenerateButton")}
+                            </Button>
+                        </div>
+                        <p className="text-xs text-muted-foreground">{t("hint")}</p>
+                    </>
+                )}
+            </CardContent>
+        </Card>
+    )
+}
diff --git a/apps/desktop-ui/src/lib/global-vault-api.ts b/apps/desktop-ui/src/lib/global-vault-api.ts
index 8ed08019..80ac3919 100644
--- a/apps/desktop-ui/src/lib/global-vault-api.ts
+++ b/apps/desktop-ui/src/lib/global-vault-api.ts
@@ -128,9 +128,20 @@ export async function lookupBackupCode(codeId: string): Promise<BackupCodeDataOu
 }
 
 export async function markBackupCodeUsed(codeId: string): Promise<void> {
-    await apiFetch("/api/backend/auth/backup-codes/use", {
+    const res = await apiFetch("/api/backend/auth/backup-codes/use", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ codeId }),
     })
+    if (!res.ok) {
+        throw new Error(`Failed to consume backup code (${res.status})`)
+    }
+}
+
+export type BackupCodeStatus = { total: number; remaining: number }
+
+export async function getBackupCodeStatus(): Promise<BackupCodeStatus> {
+    const res = await apiFetch("/api/backend/auth/backup-codes")
+    if (!res.ok) throw new Error(`Backup code status failed (${res.status})`)
+    return (await res.json()) as BackupCodeStatus
 }
diff --git a/apps/desktop/src-tauri/src/router/backup_codes.rs b/apps/desktop/src-tauri/src/router/backup_codes.rs
index e08e344b..e428001b 100644
--- a/apps/desktop/src-tauri/src/router/backup_codes.rs
+++ b/apps/desktop/src-tauri/src/router/backup_codes.rs
@@ -64,6 +64,13 @@ pub fn handle(state: &AppState, method: &str, path: &str, body: Option<&str>) ->
             save(&db, &req.codes)?;
             Ok(ApiResponse::detail(200, "ok"))
         }
+        ("GET", "/api/v1/auth/backup-codes") => {
+            let codes = load(&db)?;
+            ApiResponse::ok(&serde_json::json!({
+                "total": codes.len(),
+                "remaining": codes.iter().filter(|c| !c.used).count(),
+            }))
+        }
         ("POST", "/api/v1/auth/backup-codes/lookup") => {
             let req: CodeIdRequest = serde_json::from_str(body.unwrap_or(""))?;
             let codes = load(&db)?;
diff --git a/apps/desktop/src-tauri/src/router/mod.rs b/apps/desktop/src-tauri/src/router/mod.rs
index 2bef78f6..8760c3e1 100644
--- a/apps/desktop/src-tauri/src/router/mod.rs
+++ b/apps/desktop/src-tauri/src/router/mod.rs
@@ -179,6 +179,18 @@ mod tests {
         // Used codes no longer resolve
         let r = route(&state, "POST", "/api/v1/auth/backup-codes/lookup", Some(r#"{"codeId":"c1"}"#)).unwrap();
         assert_eq!(r.status, 404);
+        // Status counts used vs unused
+        let r = route(&state, "GET", "/api/v1/auth/backup-codes", None).unwrap();
+        assert_eq!(r.status, 200);
+        let v = body_json(&r);
+        assert_eq!(v["total"], 1);
+        assert_eq!(v["remaining"], 0);
+        // Re-storing replaces the whole set (regenerate from settings)
+        let fresh = r#"{"codes":[{"codeId":"n1","codeSalt":"s","encrypted":"e","iv":"i"},{"codeId":"n2","codeSalt":"s","encrypted":"e","iv":"i"}]}"#;
+        route(&state, "POST", "/api/v1/auth/backup-codes", Some(fresh)).unwrap();
+        let v = body_json(&route(&state, "GET", "/api/v1/auth/backup-codes", None).unwrap());
+        assert_eq!(v["total"], 2);
+        assert_eq!(v["remaining"], 2);
     }
 
     #[test]

From d772848c627a5fc6a5652bc91e2ae1fbc8c643e1 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Sun, 23 Aug 2026 23:43:21 +0530
Subject: [PATCH 13/39] feat(secure-files): storage overview with per-type
 breakdown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds an Overview entry above the folder tree that swaps the main pane for
storage stats: file and folder counts, content size, true on-disk size with
the encryption overhead called out, a per-type breakdown with counts, sizes
and proportional bars, plus largest and recently added files (each row jumps
to its containing folder). Unreadable objects are surfaced here too.

On-disk size is measured, not estimated. The listing cache now stores each
object's size taken from the handle it already opens to read the header, so
the first scan after unlock gets it for free and later listings cost nothing
extra; write-through keeps it exact across import, rename and replace. Totals
cover readable objects only — unreadable ones stay in `errors` rather than
being folded into the numbers.

Everything else is derived client-side from the file list already in memory
and memoized, so the view stays instant at 100k files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01No7es2PjF9SNQs22RYHcdM
---
 apps/desktop-ui/messages/af.json              |  25 ++-
 apps/desktop-ui/messages/ar.json              |  25 ++-
 apps/desktop-ui/messages/ca.json              |  25 ++-
 apps/desktop-ui/messages/cs.json              |  25 ++-
 apps/desktop-ui/messages/da.json              |  25 ++-
 apps/desktop-ui/messages/de.json              |  25 ++-
 apps/desktop-ui/messages/el.json              |  25 ++-
 apps/desktop-ui/messages/en.json              |  23 +++
 apps/desktop-ui/messages/es.json              |  25 ++-
 apps/desktop-ui/messages/fa.json              |  25 ++-
 apps/desktop-ui/messages/fr.json              |  25 ++-
 apps/desktop-ui/messages/id.json              |  25 ++-
 apps/desktop-ui/messages/it.json              |  25 ++-
 apps/desktop-ui/messages/ja.json              |  25 ++-
 apps/desktop-ui/messages/ko.json              |  25 ++-
 apps/desktop-ui/messages/ms.json              |  25 ++-
 apps/desktop-ui/messages/nb.json              |  25 ++-
 apps/desktop-ui/messages/nl.json              |  25 ++-
 apps/desktop-ui/messages/pl.json              |  25 ++-
 apps/desktop-ui/messages/pt-BR.json           |  25 ++-
 apps/desktop-ui/messages/pt.json              |  25 ++-
 apps/desktop-ui/messages/ru.json              |  25 ++-
 apps/desktop-ui/messages/sv.json              |  25 ++-
 apps/desktop-ui/messages/tr.json              |  25 ++-
 apps/desktop-ui/messages/uk.json              |  25 ++-
 apps/desktop-ui/messages/vi.json              |  25 ++-
 apps/desktop-ui/messages/zh.json              |  25 ++-
 .../src/components/secure-files/overview.tsx  | 163 ++++++++++++++++++
 .../secure-files/secure-files-tool.tsx        |  65 +++++--
 .../src/lib/__tests__/secure-files.test.ts    |  37 +++-
 apps/desktop-ui/src/lib/secure-files-api.ts   |   5 +-
 apps/desktop-ui/src/lib/secure-files.ts       |  26 +++
 .../src-tauri/src/router/secure_files/mod.rs  |  55 ++++--
 apps/desktop/src-tauri/src/state.rs           |  11 +-
 34 files changed, 980 insertions(+), 55 deletions(-)
 create mode 100644 apps/desktop-ui/src/components/secure-files/overview.tsx

diff --git a/apps/desktop-ui/messages/af.json b/apps/desktop-ui/messages/af.json
index 1760ade3..1016a172 100644
--- a/apps/desktop-ui/messages/af.json
+++ b/apps/desktop-ui/messages/af.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/ar.json b/apps/desktop-ui/messages/ar.json
index 68ec117a..aa2d91a1 100644
--- a/apps/desktop-ui/messages/ar.json
+++ b/apps/desktop-ui/messages/ar.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/ca.json b/apps/desktop-ui/messages/ca.json
index ecf0f8d0..d9db5b0a 100644
--- a/apps/desktop-ui/messages/ca.json
+++ b/apps/desktop-ui/messages/ca.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/cs.json b/apps/desktop-ui/messages/cs.json
index 8b5ea6f0..67c2500a 100644
--- a/apps/desktop-ui/messages/cs.json
+++ b/apps/desktop-ui/messages/cs.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/da.json b/apps/desktop-ui/messages/da.json
index 4f87d603..6997ebe0 100644
--- a/apps/desktop-ui/messages/da.json
+++ b/apps/desktop-ui/messages/da.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/de.json b/apps/desktop-ui/messages/de.json
index 3d2155fc..377c9015 100644
--- a/apps/desktop-ui/messages/de.json
+++ b/apps/desktop-ui/messages/de.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/el.json b/apps/desktop-ui/messages/el.json
index 8475926c..ae9dd5a1 100644
--- a/apps/desktop-ui/messages/el.json
+++ b/apps/desktop-ui/messages/el.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/en.json b/apps/desktop-ui/messages/en.json
index 981362e9..676ea55f 100644
--- a/apps/desktop-ui/messages/en.json
+++ b/apps/desktop-ui/messages/en.json
@@ -3162,6 +3162,29 @@
     "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
     "desktopOnly": "Secure Files is available in the desktop app.",
     "allFiles": "All files",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    },
     "breadcrumb": "Folder path",
     "addFiles": "Add files",
     "addFolder": "Add folder",
diff --git a/apps/desktop-ui/messages/es.json b/apps/desktop-ui/messages/es.json
index cf95cf93..7872e23b 100644
--- a/apps/desktop-ui/messages/es.json
+++ b/apps/desktop-ui/messages/es.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/fa.json b/apps/desktop-ui/messages/fa.json
index c666143f..f34a0c25 100644
--- a/apps/desktop-ui/messages/fa.json
+++ b/apps/desktop-ui/messages/fa.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/fr.json b/apps/desktop-ui/messages/fr.json
index e465ebb1..8ed96017 100644
--- a/apps/desktop-ui/messages/fr.json
+++ b/apps/desktop-ui/messages/fr.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/id.json b/apps/desktop-ui/messages/id.json
index 17c7657f..8db9067e 100644
--- a/apps/desktop-ui/messages/id.json
+++ b/apps/desktop-ui/messages/id.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/it.json b/apps/desktop-ui/messages/it.json
index 9296946e..18a9f9a5 100644
--- a/apps/desktop-ui/messages/it.json
+++ b/apps/desktop-ui/messages/it.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/ja.json b/apps/desktop-ui/messages/ja.json
index ac978694..5f1912a8 100644
--- a/apps/desktop-ui/messages/ja.json
+++ b/apps/desktop-ui/messages/ja.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/ko.json b/apps/desktop-ui/messages/ko.json
index 65e05658..0c46fab1 100644
--- a/apps/desktop-ui/messages/ko.json
+++ b/apps/desktop-ui/messages/ko.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/ms.json b/apps/desktop-ui/messages/ms.json
index afcf4241..9ec7ffbc 100644
--- a/apps/desktop-ui/messages/ms.json
+++ b/apps/desktop-ui/messages/ms.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/nb.json b/apps/desktop-ui/messages/nb.json
index 1c83d062..28bc919e 100644
--- a/apps/desktop-ui/messages/nb.json
+++ b/apps/desktop-ui/messages/nb.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/nl.json b/apps/desktop-ui/messages/nl.json
index 890ed8b5..d441563b 100644
--- a/apps/desktop-ui/messages/nl.json
+++ b/apps/desktop-ui/messages/nl.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/pl.json b/apps/desktop-ui/messages/pl.json
index f17eac1a..df49af48 100644
--- a/apps/desktop-ui/messages/pl.json
+++ b/apps/desktop-ui/messages/pl.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/pt-BR.json b/apps/desktop-ui/messages/pt-BR.json
index 4f391f54..ec5e0f1f 100644
--- a/apps/desktop-ui/messages/pt-BR.json
+++ b/apps/desktop-ui/messages/pt-BR.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/pt.json b/apps/desktop-ui/messages/pt.json
index 0550bb75..3a4a2f28 100644
--- a/apps/desktop-ui/messages/pt.json
+++ b/apps/desktop-ui/messages/pt.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/ru.json b/apps/desktop-ui/messages/ru.json
index f494a28e..5e206041 100644
--- a/apps/desktop-ui/messages/ru.json
+++ b/apps/desktop-ui/messages/ru.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/sv.json b/apps/desktop-ui/messages/sv.json
index a4bbda3a..a89c3b82 100644
--- a/apps/desktop-ui/messages/sv.json
+++ b/apps/desktop-ui/messages/sv.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/tr.json b/apps/desktop-ui/messages/tr.json
index f1c69ac1..e8b2822f 100644
--- a/apps/desktop-ui/messages/tr.json
+++ b/apps/desktop-ui/messages/tr.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/uk.json b/apps/desktop-ui/messages/uk.json
index b9783830..e8a4e07c 100644
--- a/apps/desktop-ui/messages/uk.json
+++ b/apps/desktop-ui/messages/uk.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/vi.json b/apps/desktop-ui/messages/vi.json
index 308f9a7b..20f696dd 100644
--- a/apps/desktop-ui/messages/vi.json
+++ b/apps/desktop-ui/messages/vi.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/messages/zh.json b/apps/desktop-ui/messages/zh.json
index db2bce05..5264f884 100644
--- a/apps/desktop-ui/messages/zh.json
+++ b/apps/desktop-ui/messages/zh.json
@@ -5305,6 +5305,29 @@
     "viewGrid": "Grid view",
     "viewList": "List view",
     "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder"
+    "importFolder": "Import folder",
+    "overview": "Overview",
+    "statFiles": "Files",
+    "statFolders": "Folders",
+    "statContent": "Content size",
+    "statContentHint": "Total size of the original files",
+    "statOnDisk": "On disk",
+    "statOverhead": "{size} encryption overhead",
+    "byType": "By type",
+    "fileCount": "{count, plural, one {# file} other {# files}}",
+    "largestFiles": "Largest files",
+    "recentlyAdded": "Recently added",
+    "openContainingFolder": "Open containing folder",
+    "types": {
+      "image": "Images",
+      "video": "Video",
+      "audio": "Audio",
+      "pdf": "PDF",
+      "archive": "Archives",
+      "code": "Code",
+      "doc": "Documents",
+      "sheet": "Spreadsheets",
+      "file": "Other"
+    }
   }
 }
diff --git a/apps/desktop-ui/src/components/secure-files/overview.tsx b/apps/desktop-ui/src/components/secure-files/overview.tsx
new file mode 100644
index 00000000..d7995e8f
--- /dev/null
+++ b/apps/desktop-ui/src/components/secure-files/overview.tsx
@@ -0,0 +1,163 @@
+"use client"
+
+import { useMemo } from "react"
+import { useTranslations } from "next-intl"
+import { IconAlertTriangle, IconFolder } from "@tabler/icons-react"
+import { FileIconComp } from "@/components/s3-drive/file-icon"
+import { getFileType } from "@/components/s3-drive/file-types"
+import { countFolders, fileTypeStats, type FolderNode, type SecureFileEntry } from "@/lib/secure-files"
+import type { StorageTotals } from "@/lib/secure-files-api"
+import { cn } from "@/lib/utils"
+
+function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B"
+  const units = ["B", "KB", "MB", "GB"]
+  const i = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1)
+  return `${(bytes / 1024 ** i).toFixed(i === 0 ? 0 : 1)} ${units[i]}`
+}
+
+function Stat({ label, value, hint }: { label: string; value: string; hint?: string }) {
+  return (
+    <div className="rounded-lg border bg-card/40 px-4 py-3">
+      <div className="text-xs text-muted-foreground">{label}</div>
+      <div className="mt-0.5 text-xl font-semibold tabular-nums">{value}</div>
+      {hint && <div className="mt-0.5 truncate text-[11px] text-muted-foreground">{hint}</div>}
+    </div>
+  )
+}
+
+export function Overview({
+  files,
+  tree,
+  totals,
+  errorCount,
+  dir,
+  onOpenFolder,
+}: {
+  files: SecureFileEntry[]
+  tree: FolderNode
+  totals: StorageTotals | null
+  errorCount: number
+  dir: string | null
+  onOpenFolder: (path: string) => void
+}) {
+  const t = useTranslations("SecureFiles")
+
+  const byType = useMemo(() => fileTypeStats(files, getFileType), [files])
+  const folders = useMemo(() => countFolders(tree), [tree])
+  const largest = useMemo(() => [...files].sort((a, b) => b.size - a.size).slice(0, 5), [files])
+  const recent = useMemo(() => [...files].sort((a, b) => b.importedAt - a.importedAt).slice(0, 5), [files])
+
+  const contentSize = totals?.size ?? files.reduce((n, f) => n + f.size, 0)
+  const physical = totals?.physical ?? 0
+  const overhead = Math.max(0, physical - contentSize)
+  const maxCount = byType[0]?.count ?? 1
+
+  return (
+    <div className="mx-auto max-w-4xl space-y-6 p-6">
+      <div>
+        <h2 className="text-base font-semibold">{t("overview")}</h2>
+        <p className="truncate text-xs text-muted-foreground" title={dir ?? ""}>{dir}</p>
+      </div>
+
+      <div className="grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
+        <Stat label={t("statFiles")} value={String(totals?.count ?? files.length)} />
+        <Stat label={t("statFolders")} value={String(folders)} />
+        <Stat label={t("statContent")} value={formatBytes(contentSize)} hint={t("statContentHint")} />
+        <Stat
+          label={t("statOnDisk")}
+          value={physical > 0 ? formatBytes(physical) : "—"}
+          hint={physical > 0 ? t("statOverhead", { size: formatBytes(overhead) }) : undefined}
+        />
+      </div>
+
+      {errorCount > 0 && (
+        <div className="flex items-start gap-2 rounded-lg border border-amber-500/40 bg-amber-500/10 px-3 py-2 text-xs">
+          <IconAlertTriangle className="mt-0.5 size-4 shrink-0 text-amber-600" />
+          <div>
+            <div className="font-medium">{t("unreadableCount", { count: errorCount })}</div>
+            <div className="text-muted-foreground">{t("unreadableHint")}</div>
+          </div>
+        </div>
+      )}
+
+      <section className="space-y-2">
+        <h3 className="text-sm font-medium">{t("byType")}</h3>
+        {byType.length === 0 ? (
+          <p className="text-xs text-muted-foreground">{t("emptyTitle")}</p>
+        ) : (
+          <div className="rounded-lg border">
+            {byType.map((s, i) => (
+              <div
+                key={s.type}
+                className={cn("grid grid-cols-[1.5rem_7rem_1fr_5rem_5rem] items-center gap-2 px-3 py-2 text-sm", i > 0 && "border-t")}
+              >
+                <FileIconComp type={s.type} className="size-4" />
+                <span className="truncate text-xs">{t(`types.${s.type}` as never)}</span>
+                <span className="h-1.5 rounded-full bg-muted">
+                  <span
+                    className="block h-full rounded-full bg-primary/70"
+                    style={{ width: `${Math.max(2, (s.count / maxCount) * 100)}%` }}
+                  />
+                </span>
+                <span className="text-right text-xs tabular-nums">{t("fileCount", { count: s.count })}</span>
+                <span className="text-right text-xs tabular-nums text-muted-foreground">{formatBytes(s.size)}</span>
+              </div>
+            ))}
+          </div>
+        )}
+      </section>
+
+      <div className="grid gap-6 md:grid-cols-2">
+        <FileList title={t("largestFiles")} files={largest} onOpenFolder={onOpenFolder} render={(f) => formatBytes(f.size)} />
+        <FileList
+          title={t("recentlyAdded")}
+          files={recent}
+          onOpenFolder={onOpenFolder}
+          render={(f) => new Date(f.importedAt).toLocaleDateString()}
+        />
+      </div>
+    </div>
+  )
+}
+
+function FileList({
+  title,
+  files,
+  render,
+  onOpenFolder,
+}: {
+  title: string
+  files: SecureFileEntry[]
+  render: (f: SecureFileEntry) => string
+  onOpenFolder: (path: string) => void
+}) {
+  const t = useTranslations("SecureFiles")
+  if (files.length === 0) return null
+  return (
+    <section className="space-y-2">
+      <h3 className="text-sm font-medium">{title}</h3>
+      <div className="rounded-lg border">
+        {files.map((f, i) => (
+          <button
+            key={f.id}
+            type="button"
+            title={t("openContainingFolder")}
+            onClick={() => onOpenFolder(f.dir)}
+            className={cn("flex w-full items-center gap-2 px-3 py-2 text-left text-sm hover:bg-muted/50", i > 0 && "border-t")}
+          >
+            <FileIconComp type={getFileType(f.name)} className="size-4 shrink-0" />
+            <span className="min-w-0 flex-1 truncate">{f.name}</span>
+            {f.dir && (
+              <span className="hidden min-w-0 max-w-40 shrink items-center gap-1 truncate text-xs text-muted-foreground sm:flex">
+                <IconFolder className="size-3 shrink-0" />
+                {f.dir}
+              </span>
+            )}
+            <span className="shrink-0 text-xs tabular-nums text-muted-foreground">{render(f)}</span>
+          </button>
+        ))}
+      </div>
+    </section>
+  )
+}
diff --git a/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx b/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
index f6904641..8e7401a2 100644
--- a/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
+++ b/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
@@ -16,6 +16,7 @@ import {
   IconLock,
   IconPencil,
   IconPlus,
+  IconChartPie,
   IconLayoutGrid,
   IconList,
   IconReplace,
@@ -51,6 +52,7 @@ import {
   type FolderNode,
   type SecureFileEntry,
 } from "@/lib/secure-files"
+import type { StorageTotals } from "@/lib/secure-files-api"
 import {
   deleteSecureFile,
   deleteSecureFolder,
@@ -69,6 +71,7 @@ import {
   type SecureFilesSettings,
 } from "@/lib/secure-files-api"
 import { FolderTree } from "./folder-tree"
+import { Overview } from "./overview"
 import { isThumbnailable, useThumbnails } from "./use-thumbnails"
 import { cn } from "@/lib/utils"
 import { safeGetItem, safeGetJSON, safeSetItem, safeSetJSON } from "@/lib/safe-storage"
@@ -127,6 +130,8 @@ export function SecureFilesTool() {
   const [settings, setSettings] = useState<SecureFilesSettings | null>(null)
   const [files, setFiles] = useState<SecureFileEntry[]>([])
   const [errors, setErrors] = useState<{ id: string; error: string }[]>([])
+  const [totals, setTotals] = useState<StorageTotals | null>(null)
+  const [showOverview, setShowOverview] = useState(false)
   const [extraDirs, setExtraDirs] = useState<string[]>(() => safeGetJSON<string[]>(EXTRA_DIRS_KEY) ?? [])
   const [currentDir, setCurrentDir] = useState("")
   const [view, setView] = useState<"list" | "grid">(() => (safeGetItem(VIEW_KEY) === "grid" ? "grid" : "list"))
@@ -166,6 +171,7 @@ export function SecureFilesTool() {
         const r = await listSecureFiles()
         setFiles(r.files)
         setErrors(r.errors)
+        setTotals(r.totals)
       }
     } catch (e) {
       toast.error(errMsg(e))
@@ -507,8 +513,28 @@ export function SecureFilesTool() {
     </>
   )
 
+  const openFolder = useCallback((path: string) => {
+    setShowOverview(false)
+    setCurrentDir(path)
+  }, [])
+
   const sidebar = hasDir ? (
-    <FolderTree root={tree} currentDir={currentDir} onSelect={setCurrentDir} onRename={renameFolder} onDelete={deleteFolder} />
+    <div className="flex h-full min-h-0 flex-col">
+      <div className="border-b p-2">
+        <button
+          type="button"
+          onClick={() => setShowOverview(true)}
+          className={cn(
+            "flex w-full items-center gap-2 rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-muted",
+            showOverview && "bg-muted font-medium",
+          )}
+        >
+          <IconChartPie className="size-4 shrink-0 text-muted-foreground" />
+          <span className="truncate">{t("overview")}</span>
+        </button>
+      </div>
+      <FolderTree root={tree} currentDir={showOverview ? "" : currentDir} onSelect={openFolder} onRename={renameFolder} onDelete={deleteFolder} />
+    </div>
   ) : (
     <p className="p-4 text-xs text-muted-foreground">{t("chooseFolderBody")}</p>
   )
@@ -519,16 +545,22 @@ export function SecureFilesTool() {
         {/* Toolbar */}
         <div className="flex shrink-0 flex-wrap items-center gap-2 border-b px-4 py-2">
           <nav className="flex min-w-0 flex-1 items-center gap-1 text-sm" aria-label={t("breadcrumb")}>
-            <button type="button" className="truncate hover:underline" onClick={() => setCurrentDir("")}>{t("allFiles")}</button>
-            {crumbs.map((c, i) => {
-              const path = crumbs.slice(0, i + 1).join("/")
-              return (
-                <React.Fragment key={path}>
-                  <IconChevronRight className="size-3.5 shrink-0 text-muted-foreground" />
-                  <button type="button" className="truncate hover:underline" onClick={() => setCurrentDir(path)}>{c}</button>
-                </React.Fragment>
-              )
-            })}
+            {showOverview ? (
+              <span className="truncate font-medium">{t("overview")}</span>
+            ) : (
+              <>
+                <button type="button" className="truncate hover:underline" onClick={() => openFolder("")}>{t("allFiles")}</button>
+                {crumbs.map((c, i) => {
+                  const path = crumbs.slice(0, i + 1).join("/")
+                  return (
+                    <React.Fragment key={path}>
+                      <IconChevronRight className="size-3.5 shrink-0 text-muted-foreground" />
+                      <button type="button" className="truncate hover:underline" onClick={() => openFolder(path)}>{c}</button>
+                    </React.Fragment>
+                  )
+                })}
+              </>
+            )}
           </nav>
           {hasDir && (
             <>
@@ -599,7 +631,16 @@ export function SecureFilesTool() {
         )}
 
         <div ref={scrollRef} onScroll={(e) => setScrollTop(e.currentTarget.scrollTop)} className="min-h-0 flex-1 overflow-y-auto">
-          {loading ? null : !hasDir ? (
+          {loading ? null : hasDir && showOverview ? (
+            <Overview
+              files={files}
+              tree={tree}
+              totals={totals}
+              errorCount={errors.length}
+              dir={settings?.dir ?? null}
+              onOpenFolder={openFolder}
+            />
+          ) : !hasDir ? (
             <EmptyState
               title={dirMissing ? t("folderMissingTitle") : t("chooseFolderTitle")}
               body={dirMissing ? t("folderMissingBody", { dir: settings?.dir ?? "" }) : t("chooseFolderBody")}
diff --git a/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts b/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
index 124bb294..08757bce 100644
--- a/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
+++ b/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
@@ -1,4 +1,14 @@
-import { blobMime, buildFolderTree, joinDir, looksLikeText, parentDir, visibleRange, type SecureFileEntry } from "../secure-files"
+import {
+  blobMime,
+  buildFolderTree,
+  countFolders,
+  fileTypeStats,
+  joinDir,
+  looksLikeText,
+  parentDir,
+  visibleRange,
+  type SecureFileEntry,
+} from "../secure-files"
 
 const f = (name: string, dir: string): SecureFileEntry => ({ id: name, name, dir, size: 1, mtime: 0, importedAt: 0 })
 
@@ -37,6 +47,31 @@ describe("visibleRange", () => {
   })
 })
 
+describe("fileTypeStats / countFolders", () => {
+  const classify = (name: string) => (name.endsWith(".png") ? "image" : name.endsWith(".ts") ? "code" : "file")
+
+  it("groups by type, biggest group first", () => {
+    const files: SecureFileEntry[] = [
+      { ...f("a.png", ""), size: 100 },
+      { ...f("b.ts", ""), size: 10 },
+      { ...f("c.ts", ""), size: 20 },
+      { ...f("d.bin", ""), size: 5 },
+    ]
+    // Equal counts fall back to size, biggest first.
+    expect(fileTypeStats(files, classify)).toEqual([
+      { type: "code", count: 2, size: 30 },
+      { type: "image", count: 1, size: 100 },
+      { type: "file", count: 1, size: 5 },
+    ])
+    expect(fileTypeStats([], classify)).toEqual([])
+  })
+
+  it("counts every folder except the root", () => {
+    const tree = buildFolderTree([f("x.txt", "a/b"), f("y.txt", "c")], ["d/e/f"])
+    expect(countFolders(tree)).toBe(6) // a, a/b, c, d, d/e, d/e/f
+  })
+})
+
 describe("blobMime", () => {
   it("maps names to media types the webview understands", () => {
     expect(blobMime("image", "a.jpg")).toBe("image/jpeg")
diff --git a/apps/desktop-ui/src/lib/secure-files-api.ts b/apps/desktop-ui/src/lib/secure-files-api.ts
index b541063a..308e2c01 100644
--- a/apps/desktop-ui/src/lib/secure-files-api.ts
+++ b/apps/desktop-ui/src/lib/secure-files-api.ts
@@ -10,7 +10,10 @@ const BASE = "/api/v1/secure-files"
 
 /** `exists` is false when `dir` is set but missing (restored backup, unplugged drive). */
 export type SecureFilesSettings = { dir: string | null; exists: boolean; unlocked: boolean }
-export type ListResult = { files: SecureFileEntry[]; errors: { id: string; error: string }[] }
+/** `size` is plaintext bytes; `physical` is what the folder occupies on disk
+ *  (container overhead included), counting readable objects only. */
+export type StorageTotals = { count: number; size: number; physical: number }
+export type ListResult = { totals: StorageTotals; files: SecureFileEntry[]; errors: { id: string; error: string }[] }
 /** `dirs` lists every walked directory (logical path) — including empty ones. */
 export type ImportResult = { imported: SecureFileEntry[]; errors: { path: string; error: string }[]; dirs: string[] }
 
diff --git a/apps/desktop-ui/src/lib/secure-files.ts b/apps/desktop-ui/src/lib/secure-files.ts
index 445b88a2..24a0f399 100644
--- a/apps/desktop-ui/src/lib/secure-files.ts
+++ b/apps/desktop-ui/src/lib/secure-files.ts
@@ -61,6 +61,32 @@ export function buildFolderTree(files: SecureFileEntry[], extraDirs: Iterable<st
   return root
 }
 
+export type TypeStat = { type: string; count: number; size: number }
+
+/**
+ * Per-type counts and sizes, biggest group first. `classify` is injected so
+ * this stays free of component imports (callers pass `getFileType`).
+ */
+export function fileTypeStats(files: SecureFileEntry[], classify: (name: string) => string): TypeStat[] {
+  const acc = new Map<string, TypeStat>()
+  for (const f of files) {
+    const type = classify(f.name)
+    const hit = acc.get(type)
+    if (hit) {
+      hit.count += 1
+      hit.size += f.size
+    } else {
+      acc.set(type, { type, count: 1, size: f.size })
+    }
+  }
+  return [...acc.values()].sort((a, b) => b.count - a.count || b.size - a.size || a.type.localeCompare(b.type))
+}
+
+/** Every folder in the tree, root excluded. */
+export function countFolders(node: FolderNode): number {
+  return node.children.reduce((n, c) => n + 1 + countFolders(c), 0)
+}
+
 /** Blob MIME for a decrypted payload, derived from the name (never stored). */
 export function blobMime(fileType: string, name: string): string {
   const ext = name.split(".").pop()?.toLowerCase() ?? ""
diff --git a/apps/desktop/src-tauri/src/router/secure_files/mod.rs b/apps/desktop/src-tauri/src/router/secure_files/mod.rs
index 8ce5c36d..572183e9 100644
--- a/apps/desktop/src-tauri/src/router/secure_files/mod.rs
+++ b/apps/desktop/src-tauri/src/router/secure_files/mod.rs
@@ -29,6 +29,16 @@ use crate::state::AppState;
 use mydt::{CryptoError, FileMeta, KdfParams, HEADER_LEN, MAX_FILE_BYTES, MAX_OBJECT_BYTES, SALT_LEN};
 
 pub const KV_KEY: &str = "secure_files";
+
+/// Cached decrypted metadata plus the object's size on disk (plaintext bytes
+/// plus container overhead), so storage totals need no extra stat calls.
+pub struct CachedEntry {
+    pub meta: FileMeta,
+    pub physical: u64,
+}
+
+pub type MetaCache = std::collections::HashMap<String, CachedEntry>;
+
 const EXT: &str = "mydt";
 const TMP_EXT: &str = "mydt.tmp";
 
@@ -108,7 +118,7 @@ pub fn lock(state: &AppState) {
 /// Write-through helpers — no-ops while the cache is cold (next listing scans).
 fn cache_put(state: &AppState, e: &Entry) {
     if let Some(m) = state.sf_meta.lock().unwrap().as_mut() {
-        m.insert(e.id.clone(), e.meta.clone());
+        m.insert(e.id.clone(), CachedEntry { meta: e.meta.clone(), physical: e.physical });
     }
 }
 
@@ -224,6 +234,10 @@ struct Entry {
     id: String,
     #[serde(flatten)]
     meta: FileMeta,
+    /// Bytes this object occupies in the storage folder. Aggregated into the
+    /// listing totals rather than sent per entry.
+    #[serde(skip)]
+    physical: u64,
 }
 
 fn object_path(dir: &Path, id: &str) -> PathBuf {
@@ -251,13 +265,16 @@ fn write_atomic(dir: &Path, id: &str, bytes: &[u8], durable: bool) -> std::io::R
 }
 
 /// Read only header + metadata (not the payload) and decrypt the metadata.
-fn read_entry_meta(c: &Ctx, id: &str) -> Fallible<FileMeta> {
+/// The on-disk size comes from the already-open handle, so it costs no extra
+/// syscall.
+fn read_entry_meta(c: &Ctx, id: &str) -> Fallible<(FileMeta, u64)> {
     let mut f = fs::File::open(object_path(&c.dir, id))?;
+    let physical = f.metadata()?.len();
     let mut buf = vec![0u8; HEADER_LEN];
     f.read_exact(&mut buf).map_err(|_| CryptoError::Format)?;
     let n = crypto::meta_len(&buf)?;
     f.by_ref().take(n as u64).read_to_end(&mut buf)?;
-    Ok(crypto::read_meta(&c.kek, &c.params.salt, &buf)?)
+    Ok((crypto::read_meta(&c.kek, &c.params.salt, &buf)?, physical))
 }
 
 fn read_entry_full(c: &Ctx, id: &str) -> Fallible<(FileMeta, Zeroizing<Vec<u8>>)> {
@@ -305,23 +322,37 @@ fn list_entries(state: &AppState, c: &Ctx) -> Fallible<(Vec<Entry>, Vec<Value>)>
             continue;
         }
         match read_entry_meta(c, id) {
-            Ok(meta) => {
-                map.insert(id.clone(), meta);
+            Ok((meta, physical)) => {
+                map.insert(id.clone(), CachedEntry { meta, physical });
             }
             Err(Fail(_, msg)) => errors.push(json!({ "id": id, "error": msg })),
         }
     }
-    let mut files: Vec<Entry> = map.iter().map(|(id, m)| Entry { id: id.clone(), meta: m.clone() }).collect();
+    let mut files: Vec<Entry> = map
+        .iter()
+        .map(|(id, e)| Entry { id: id.clone(), meta: e.meta.clone(), physical: e.physical })
+        .collect();
     drop(guard);
     files.sort_by(|a, b| (&a.meta.dir, &a.meta.name).cmp(&(&b.meta.dir, &b.meta.name)));
     Ok((files, errors))
 }
 
+/// Aggregate storage figures for the overview. `physical` is what the folder
+/// actually occupies for readable objects (plaintext plus per-file container
+/// overhead); unreadable objects are excluded and reported separately.
+fn totals(files: &[Entry]) -> Value {
+    json!({
+        "count": files.len(),
+        "size": files.iter().map(|e| e.meta.size).sum::<u64>(),
+        "physical": files.iter().map(|e| e.physical).sum::<u64>(),
+    })
+}
+
 fn encrypt_and_store(c: &Ctx, meta: &FileMeta, plaintext: &[u8], durable: bool) -> Fallible<Entry> {
     let id = new_id();
     let bytes = crypto::encrypt_file(&c.kek, &c.params, meta, plaintext)?;
     write_atomic(&c.dir, &id, &bytes, durable)?;
-    Ok(Entry { id, meta: meta.clone() })
+    Ok(Entry { id, meta: meta.clone(), physical: bytes.len() as u64 })
 }
 
 fn mtime_ms(md: &fs::Metadata) -> i64 {
@@ -431,7 +462,7 @@ fn rewrite(c: &Ctx, id: &str, f: impl FnOnce(&mut FileMeta)) -> Fallible<Entry>
     f(&mut meta);
     let bytes = crypto::encrypt_file(&c.kek, &c.params, &meta, &plaintext)?;
     write_atomic(&c.dir, id, &bytes, true)?;
-    Ok(Entry { id: id.to_string(), meta })
+    Ok(Entry { id: id.to_string(), meta, physical: bytes.len() as u64 })
 }
 
 fn is_inside(path: &Path, dir: &Path) -> bool {
@@ -512,7 +543,7 @@ fn dispatch(state: &AppState, method: &str, rest: &str, body: Option<&str>) -> F
         ("GET", "/files") => {
             let c = ctx(state)?;
             let (files, errors) = list_entries(state, &c)?;
-            ok(&json!({ "files": files, "errors": errors }))
+            ok(&json!({ "totals": totals(&files), "files": files, "errors": errors }))
         }
         ("POST", "/files/import") => {
             #[derive(Deserialize)]
@@ -637,7 +668,7 @@ fn dispatch(state: &AppState, method: &str, rest: &str, body: Option<&str>) -> F
                     meta.mtime = mtime_ms(&md);
                     let bytes = crypto::encrypt_file(&c.kek, &c.params, &meta, &plaintext)?;
                     write_atomic(&c.dir, id, &bytes, true)?;
-                    let e = Entry { id: id.to_string(), meta };
+                    let e = Entry { id: id.to_string(), meta, physical: bytes.len() as u64 };
                     cache_put(state, &e);
                     ok(&e)
                 }
@@ -863,6 +894,10 @@ mod tests {
 
         let l = list(&state);
         assert_eq!(l["files"].as_array().unwrap().len(), 1);
+        // Totals cover readable objects only; unreadable ones are reported apart.
+        assert_eq!(l["totals"]["count"], 1);
+        assert_eq!(l["totals"]["size"], 2);
+        assert!(l["totals"]["physical"].as_u64().unwrap() > l["totals"]["size"].as_u64().unwrap());
         let errs = l["errors"].as_array().unwrap();
         assert_eq!(errs.len(), 3);
         assert!(errs.iter().any(|e| e["error"].as_str().unwrap().contains("another vault")));
diff --git a/apps/desktop/src-tauri/src/state.rs b/apps/desktop/src-tauri/src/state.rs
index fd979a45..bd921cf2 100644
--- a/apps/desktop/src-tauri/src/state.rs
+++ b/apps/desktop/src-tauri/src/state.rs
@@ -14,11 +14,12 @@ pub struct AppState {
     /// Secure Files KEK (Argon2id of the master password). `None` = locked.
     /// Dropping the `Zeroizing` wipes the bytes.
     pub kek: Mutex<Option<Zeroizing<[u8; 32]>>>,
-    /// Secure Files decrypted-metadata cache (id → meta), populated by the
-    /// first listing after unlock and kept fresh by write-through + an id-set
-    /// diff against the storage dir. `None` = cold (locked or never listed).
-    /// Plaintext names live here only while the vault is unlocked.
-    pub sf_meta: Mutex<Option<std::collections::HashMap<String, mydt::FileMeta>>>,
+    /// Secure Files decrypted-metadata cache (id → meta + on-disk size),
+    /// populated by the first listing after unlock and kept fresh by
+    /// write-through + an id-set diff against the storage dir. `None` = cold
+    /// (locked or never listed). Plaintext names live here only while the
+    /// vault is unlocked.
+    pub sf_meta: Mutex<Option<crate::router::secure_files::MetaCache>>,
 }
 
 impl AppState {

From a32a60680ec63fe11999da6277d021d1805c10be Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 00:30:35 +0530
Subject: [PATCH 14/39] i18n(secure-files): translate the Files tool into all
 26 locales
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Files strings shipped as English placeholders because i18n-sync fills
missing keys by copying en.json — the audit passed on key presence, not on
translation. This replaces all 84 keys per locale with real translations:
navigation label, dashboard card, and the whole SecureFiles namespace.

Plural rules follow each language rather than English: ru/uk/pl/cs carry
few/many, ar carries the full zero/one/two/few/many/other set, and the
languages without a count distinction (ja/ko/zh/tr/vi/id/ms) use a single
other form. Verified by compiling all 1998 messages through
intl-messageformat per locale and formatting them with real arguments, so
every placeholder and plural branch is exercised — "3 файла", "5 plików",
"ملفان", "2 soubory".

Terminology is localised, not transliterated: vault becomes Tresor,
coffre-fort, bóveda, cassaforte, 保管庫, 保险库; storage folder, masked and
overhead follow suit. Quotation marks use each locale's convention.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01No7es2PjF9SNQs22RYHcdM
---
 apps/desktop-ui/messages/af.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/ar.json    | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/ca.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/cs.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/da.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/de.json    | 166 +++++++++++++--------------
 apps/desktop-ui/messages/el.json    | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/es.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/fa.json    | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/fr.json    | 162 +++++++++++++-------------
 apps/desktop-ui/messages/id.json    | 168 +++++++++++++--------------
 apps/desktop-ui/messages/it.json    | 168 +++++++++++++--------------
 apps/desktop-ui/messages/ja.json    | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/ko.json    | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/ms.json    | 168 +++++++++++++--------------
 apps/desktop-ui/messages/nb.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/nl.json    | 164 +++++++++++++-------------
 apps/desktop-ui/messages/pl.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/pt-BR.json | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/pt.json    | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/ru.json    | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/sv.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/tr.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/uk.json    | 172 ++++++++++++++--------------
 apps/desktop-ui/messages/vi.json    | 170 +++++++++++++--------------
 apps/desktop-ui/messages/zh.json    | 172 ++++++++++++++--------------
 26 files changed, 2208 insertions(+), 2208 deletions(-)

diff --git a/apps/desktop-ui/messages/af.json b/apps/desktop-ui/messages/af.json
index 1016a172..54fe139c 100644
--- a/apps/desktop-ui/messages/af.json
+++ b/apps/desktop-ui/messages/af.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook-toetser",
     "websocketTester": "WebSocket-toetser",
     "whoisLookup": "Whois-opsoek",
-    "secureFiles": "Files"
+    "secureFiles": "Lêers"
   },
   "Help": {
     "title": "Hulp en dokumentasie",
@@ -654,8 +654,8 @@
         "description": "Soek domein- en IP-registrasiebesonderhede op via RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Lêers",
+        "description": "Enkripteer lêers en vouers na gemaskerde .mydt-objekte; blaai en voorskou hulle nadat jy ontsluit het."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Lêers",
+    "subtitle": "Lêers wat privaat bly totdat jy hulle ontsluit — geënkripteer op jou toestel, gemasker op skyf",
+    "desktopOnly": "Secure Files is in die rekenaartoepassing beskikbaar.",
+    "allFiles": "Alle lêers",
+    "overview": "Oorsig",
+    "statFiles": "Lêers",
+    "statFolders": "Vouers",
+    "statContent": "Inhoudgrootte",
+    "statContentHint": "Totale grootte van die oorspronklike lêers",
+    "statOnDisk": "Op skyf",
+    "statOverhead": "{size} enkripsie-oorhoofse koste",
+    "byType": "Volgens tipe",
+    "fileCount": "{count, plural, one {# lêer} other {# lêers}}",
+    "largestFiles": "Grootste lêers",
+    "recentlyAdded": "Onlangs bygevoeg",
+    "openContainingFolder": "Open die vouer wat dit bevat",
     "types": {
-      "image": "Images",
+      "image": "Beelde",
       "video": "Video",
-      "audio": "Audio",
+      "audio": "Klank",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Argiewe",
+      "code": "Kode",
+      "doc": "Dokumente",
+      "sheet": "Sigblaaie",
+      "file": "Ander"
+    },
+    "breadcrumb": "Vouerpad",
+    "addFiles": "Voeg lêers by",
+    "addFolder": "Voeg vouer by",
+    "importFolder": "Voer vouer in",
+    "newFolder": "Nuwe vouer",
+    "lock": "Sluit",
+    "settings": "Bergingsinstellings",
+    "storageFolder": "Bergingsvouer",
+    "notSet": "Nie gestel nie",
+    "chooseFolder": "Kies vouer",
+    "changeFolder": "Verander vouer…",
+    "chooseFolderTitle": "Kies waar geënkripteerde lêers gestoor word",
+    "chooseFolderBody": "Kies enige vouer op hierdie toestel of op 'n eksterne skyf. Buite MyDevTools bevat dit net gemaskerde .mydt-lêers.",
+    "changeFolderTitle": "Skuif geënkripteerde lêers?",
+    "changeFolderBody": "Alle .mydt-lêers word van die huidige bergingsvouer geskuif na die een wat jy volgende kies.",
+    "folderSet": "Bergingsvouer gestel",
+    "folderMissingTitle": "Bergingsvouer nie gevind nie",
+    "folderMissingBody": "“{dir}” is nie beskikbaar nie — dit is dalk op 'n ontkoppelde skyf of kom van 'n herstelde rugsteun van 'n ander masjien. Koppel dit weer, of kies 'n nuwe vouer.",
+    "movedCount": "{count} geënkripteerde lêers geskuif",
+    "importedCount": "{count} lêers geënkripteer",
+    "emptyFolderAdded": "Vouer bygevoeg — dit het geen lêers gehad om te enkripteer nie",
+    "emptyTitle": "Nog geen lêers hier nie",
+    "emptyBody": "Voeg lêers of 'n hele vouer by. Elke lêer word geënkripteer na 'n .mydt-objek met 'n lukrake naam; die oorspronklike naam, tipe en inhoud is net hier sigbaar.",
+    "name": "Naam",
+    "size": "Grootte",
+    "modified": "Gewysig",
+    "actions": "Aksies",
+    "expand": "Vou oop",
+    "collapse": "Vou toe",
+    "preview": "Voorskou",
+    "noPreview": "Geen voorskou vir hierdie lêertipe nie — voer dit uit om dit in 'n ander toepassing te open.",
+    "export": "Voer uit",
+    "exportWarningTitle": "Voer 'n gedekripteerde kopie uit?",
+    "exportWarningBody": "Die lêer word ongeënkripteer geskryf na die plek wat jy kies. Enigiets op daardie toestel kan dit lees.",
+    "exported": "Gedekripteerde kopie uitgevoer",
+    "replace": "Vervang inhoud…",
+    "replaced": "Lêerinhoud vervang",
+    "rename": "Hernoem",
+    "fileName": "Lêernaam",
+    "move": "Skuif na vouer",
+    "targetFolder": "Vouer",
+    "targetFolderHint": "Gebruik skuinsstrepe vir geneste vouers, byvoorbeeld projek/config. Laat leeg vir die boonste vlak.",
+    "folderName": "Vouernaam",
+    "delete": "Vee uit",
+    "deleted": "Lêer uitgevee",
+    "deletedCount": "{count} lêers uitgevee",
+    "deleteFileTitle": "Vee hierdie lêer uit?",
+    "deleteFileBody": "“{name}” word permanent uit die geënkripteerde bergingsvouer verwyder.",
+    "deleteFolderTitle": "Vee hierdie vouer uit?",
+    "deleteFolderBody": "Elke lêer onder “{dir}” word permanent uit die geënkripteerde bergingsvouer verwyder.",
+    "unreadableCount": "Onleesbare lêers in die bergingsvouer: {count}",
+    "unreadableHint": "Hulle is met 'n ander meesterwagwoord geënkripteer, behoort aan 'n ander kluis, of is beskadig.",
+    "dismiss": "Maak toe",
+    "viewGrid": "Roosteraansig",
+    "viewList": "Lysaansig",
+    "footerNote": "Lêers tot 20 MB. Geënkripteer met Argon2id + XChaCha20-Poly1305; die sleutel bly net in geheue terwyl die kluis ontsluit is.",
+    "cancel": "Kanselleer",
+    "save": "Stoor"
   }
 }
diff --git a/apps/desktop-ui/messages/ar.json b/apps/desktop-ui/messages/ar.json
index aa2d91a1..996b780d 100644
--- a/apps/desktop-ui/messages/ar.json
+++ b/apps/desktop-ui/messages/ar.json
@@ -77,7 +77,7 @@
     "webhookTester": "مختبِر Webhook",
     "websocketTester": "مختبِر WebSocket",
     "whoisLookup": "بحث Whois",
-    "secureFiles": "Files"
+    "secureFiles": "الملفات"
   },
   "Help": {
     "title": "المساعدة والتوثيق",
@@ -654,8 +654,8 @@
         "description": "ابحث عن تفاصيل تسجيل النطاق وعنوان IP عبر RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "الملفات",
+        "description": "شفّر الملفات والمجلدات إلى كائنات ‎.mydt‎ مُقنَّعة الأسماء؛ تصفّحها وعاينها بعد فتح القفل."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "الملفات",
+    "subtitle": "ملفات تبقى خاصة إلى أن تفتح قفلها — مشفّرة على جهازك، ومُقنَّعة على القرص",
+    "desktopOnly": "‏Secure Files متاح في تطبيق سطح المكتب.",
+    "allFiles": "كل الملفات",
+    "overview": "نظرة عامة",
+    "statFiles": "الملفات",
+    "statFolders": "المجلدات",
+    "statContent": "حجم المحتوى",
+    "statContentHint": "الحجم الإجمالي للملفات الأصلية",
+    "statOnDisk": "على القرص",
+    "statOverhead": "‏{size} زيادة بسبب التشفير",
+    "byType": "حسب النوع",
+    "fileCount": "{count, plural, zero {لا ملفات} one {ملف واحد} two {ملفان} few {# ملفات} many {# ملفًا} other {# ملف}}",
+    "largestFiles": "أكبر الملفات",
+    "recentlyAdded": "المضافة حديثًا",
+    "openContainingFolder": "فتح المجلد الذي يحتويه",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "الصور",
+      "video": "الفيديو",
+      "audio": "الصوت",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "الأرشيفات",
+      "code": "الشيفرة",
+      "doc": "المستندات",
+      "sheet": "جداول البيانات",
+      "file": "أخرى"
+    },
+    "breadcrumb": "مسار المجلد",
+    "addFiles": "إضافة ملفات",
+    "addFolder": "إضافة مجلد",
+    "importFolder": "استيراد مجلد",
+    "newFolder": "مجلد جديد",
+    "lock": "قفل",
+    "settings": "إعدادات التخزين",
+    "storageFolder": "مجلد التخزين",
+    "notSet": "غير محدد",
+    "chooseFolder": "اختيار مجلد",
+    "changeFolder": "تغيير المجلد…",
+    "chooseFolderTitle": "اختر مكان تخزين الملفات المشفّرة",
+    "chooseFolderBody": "اختر أي مجلد على هذا الجهاز أو على قرص خارجي. خارج MyDevTools لا يحتوي إلا على ملفات ‎.mydt‎ مُقنَّعة.",
+    "changeFolderTitle": "نقل الملفات المشفّرة؟",
+    "changeFolderBody": "ستُنقل جميع ملفات ‎.mydt‎ من مجلد التخزين الحالي إلى المجلد الذي ستختاره الآن.",
+    "folderSet": "تم تحديد مجلد التخزين",
+    "folderMissingTitle": "تعذّر العثور على مجلد التخزين",
+    "folderMissingBody": "‏«{dir}» غير متاح — قد يكون على قرص غير موصول أو يعود إلى نسخة احتياطية مستعادة من جهاز آخر. أعد توصيله أو اختر مجلدًا جديدًا.",
+    "movedCount": "تم نقل {count} من الملفات المشفّرة",
+    "importedCount": "تم تشفير {count} من الملفات",
+    "emptyFolderAdded": "تمت إضافة المجلد — لم يحتوِ على ملفات لتشفيرها",
+    "emptyTitle": "لا توجد ملفات هنا بعد",
+    "emptyBody": "أضف ملفات أو مجلدًا كاملًا. يُشفَّر كل ملف إلى كائن ‎.mydt‎ باسم عشوائي؛ الاسم الأصلي والنوع والمحتوى لا تظهر إلا هنا.",
+    "name": "الاسم",
+    "size": "الحجم",
+    "modified": "آخر تعديل",
+    "actions": "الإجراءات",
+    "expand": "توسيع",
+    "collapse": "طي",
+    "preview": "معاينة",
+    "noPreview": "لا تتوفر معاينة لهذا النوع من الملفات — صدّره لفتحه في تطبيق آخر.",
+    "export": "تصدير",
+    "exportWarningTitle": "تصدير نسخة غير مشفّرة؟",
+    "exportWarningBody": "سيُكتب الملف بدون تشفير في المكان الذي تختاره. يمكن لأي شيء على ذلك الجهاز قراءته.",
+    "exported": "تم تصدير النسخة غير المشفّرة",
+    "replace": "استبدال المحتوى…",
+    "replaced": "تم استبدال محتوى الملف",
+    "rename": "إعادة تسمية",
+    "fileName": "اسم الملف",
+    "move": "نقل إلى مجلد",
+    "targetFolder": "المجلد",
+    "targetFolderHint": "استخدم الشرطة المائلة للمجلدات المتداخلة، مثل project/config. اتركه فارغًا للمستوى الأعلى.",
+    "folderName": "اسم المجلد",
+    "delete": "حذف",
+    "deleted": "تم حذف الملف",
+    "deletedCount": "تم حذف {count} من الملفات",
+    "deleteFileTitle": "حذف هذا الملف؟",
+    "deleteFileBody": "سيُحذف «{name}» نهائيًا من مجلد التخزين المشفّر.",
+    "deleteFolderTitle": "حذف هذا المجلد؟",
+    "deleteFolderBody": "ستُحذف كل الملفات داخل «{dir}» نهائيًا من مجلد التخزين المشفّر.",
+    "unreadableCount": "ملفات غير قابلة للقراءة في مجلد التخزين: {count}",
+    "unreadableHint": "شُفِّرت بكلمة مرور رئيسية أخرى، أو تنتمي إلى خزنة أخرى، أو أنها تالفة.",
+    "dismiss": "إخفاء",
+    "viewGrid": "عرض شبكي",
+    "viewList": "عرض قائمة",
+    "footerNote": "ملفات حتى 20 ميغابايت. مشفّرة بـ Argon2id + XChaCha20-Poly1305؛ يبقى المفتاح في الذاكرة فقط ما دامت الخزنة مفتوحة.",
+    "cancel": "إلغاء",
+    "save": "حفظ"
   }
 }
diff --git a/apps/desktop-ui/messages/ca.json b/apps/desktop-ui/messages/ca.json
index d9db5b0a..3ff33b1a 100644
--- a/apps/desktop-ui/messages/ca.json
+++ b/apps/desktop-ui/messages/ca.json
@@ -77,7 +77,7 @@
     "webhookTester": "Provador de webhooks",
     "websocketTester": "Provador de WebSocket",
     "whoisLookup": "Consulta Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Fitxers"
   },
   "Help": {
     "title": "Ajuda i documentació",
@@ -654,8 +654,8 @@
         "description": "Consulta les dades de registre de dominis i IP mitjançant RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Fitxers",
+        "description": "Xifra fitxers i carpetes en objectes .mydt emmascarats; navega-hi i previsualitza'ls després de desbloquejar."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Fitxers",
+    "subtitle": "Fitxers que continuen privats fins que els desbloqueges — xifrats al teu dispositiu, emmascarats al disc",
+    "desktopOnly": "Secure Files està disponible a l'aplicació d'escriptori.",
+    "allFiles": "Tots els fitxers",
+    "overview": "Resum",
+    "statFiles": "Fitxers",
+    "statFolders": "Carpetes",
+    "statContent": "Mida del contingut",
+    "statContentHint": "Mida total dels fitxers originals",
+    "statOnDisk": "Al disc",
+    "statOverhead": "{size} de sobrecàrrega de xifratge",
+    "byType": "Per tipus",
+    "fileCount": "{count, plural, one {# fitxer} other {# fitxers}}",
+    "largestFiles": "Fitxers més grans",
+    "recentlyAdded": "Afegits recentment",
+    "openContainingFolder": "Obre la carpeta que el conté",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "Imatges",
+      "video": "Vídeo",
+      "audio": "Àudio",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
+      "archive": "Arxius",
+      "code": "Codi",
       "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "sheet": "Fulls de càlcul",
+      "file": "Altres"
+    },
+    "breadcrumb": "Camí de la carpeta",
+    "addFiles": "Afegeix fitxers",
+    "addFolder": "Afegeix una carpeta",
+    "importFolder": "Importa una carpeta",
+    "newFolder": "Carpeta nova",
+    "lock": "Bloqueja",
+    "settings": "Configuració d'emmagatzematge",
+    "storageFolder": "Carpeta d'emmagatzematge",
+    "notSet": "Sense definir",
+    "chooseFolder": "Tria una carpeta",
+    "changeFolder": "Canvia de carpeta…",
+    "chooseFolderTitle": "Tria on es desen els fitxers xifrats",
+    "chooseFolderBody": "Tria qualsevol carpeta d'aquest dispositiu o d'una unitat externa. Fora de MyDevTools només conté fitxers .mydt emmascarats.",
+    "changeFolderTitle": "Voleu moure els fitxers xifrats?",
+    "changeFolderBody": "Tots els fitxers .mydt es mouran de la carpeta d'emmagatzematge actual a la que triïs tot seguit.",
+    "folderSet": "Carpeta d'emmagatzematge definida",
+    "folderMissingTitle": "No s'ha trobat la carpeta d'emmagatzematge",
+    "folderMissingBody": "«{dir}» no està disponible: pot ser en una unitat desconnectada o provenir d'una còpia de seguretat restaurada d'un altre ordinador. Torna-la a connectar o tria una carpeta nova.",
+    "movedCount": "S'han mogut {count} fitxers xifrats",
+    "importedCount": "S'han xifrat {count} fitxers",
+    "emptyFolderAdded": "Carpeta afegida: no contenia cap fitxer per xifrar",
+    "emptyTitle": "Encara no hi ha cap fitxer",
+    "emptyBody": "Afegeix fitxers o una carpeta sencera. Cada fitxer es xifra en un objecte .mydt amb un nom aleatori; el nom, el tipus i el contingut originals només es veuen aquí.",
+    "name": "Nom",
+    "size": "Mida",
+    "modified": "Modificat",
+    "actions": "Accions",
+    "expand": "Desplega",
+    "collapse": "Replega",
+    "preview": "Previsualització",
+    "noPreview": "No hi ha previsualització per a aquest tipus de fitxer: exporta'l per obrir-lo en una altra aplicació.",
+    "export": "Exporta",
+    "exportWarningTitle": "Voleu exportar una còpia desxifrada?",
+    "exportWarningBody": "El fitxer s'escriurà sense xifrar a la ubicació que triïs. Qualsevol cosa d'aquest dispositiu el podrà llegir.",
+    "exported": "Còpia desxifrada exportada",
+    "replace": "Substitueix el contingut…",
+    "replaced": "S'ha substituït el contingut del fitxer",
+    "rename": "Canvia el nom",
+    "fileName": "Nom del fitxer",
+    "move": "Mou a una carpeta",
+    "targetFolder": "Carpeta",
+    "targetFolderHint": "Fes servir barres per a carpetes imbricades, per exemple projecte/config. Deixa-ho buit per al nivell superior.",
+    "folderName": "Nom de la carpeta",
+    "delete": "Elimina",
+    "deleted": "Fitxer eliminat",
+    "deletedCount": "S'han eliminat {count} fitxers",
+    "deleteFileTitle": "Voleu eliminar aquest fitxer?",
+    "deleteFileBody": "«{name}» s'eliminarà permanentment de la carpeta d'emmagatzematge xifrada.",
+    "deleteFolderTitle": "Voleu eliminar aquesta carpeta?",
+    "deleteFolderBody": "Tots els fitxers dins de «{dir}» s'eliminaran permanentment de la carpeta d'emmagatzematge xifrada.",
+    "unreadableCount": "Fitxers illegibles a la carpeta d'emmagatzematge: {count}",
+    "unreadableHint": "Es van xifrar amb una altra contrasenya mestra, pertanyen a una altra caixa forta o estan malmesos.",
+    "dismiss": "Descarta",
+    "viewGrid": "Vista de quadrícula",
+    "viewList": "Vista de llista",
+    "footerNote": "Fitxers de fins a 20 MB. Xifrats amb Argon2id + XChaCha20-Poly1305; la clau només és a la memòria mentre la caixa forta està desbloquejada.",
+    "cancel": "Cancel·la",
+    "save": "Desa"
   }
 }
diff --git a/apps/desktop-ui/messages/cs.json b/apps/desktop-ui/messages/cs.json
index 67c2500a..7ca5d06d 100644
--- a/apps/desktop-ui/messages/cs.json
+++ b/apps/desktop-ui/messages/cs.json
@@ -77,7 +77,7 @@
     "webhookTester": "Tester webhooků",
     "websocketTester": "Tester WebSocket",
     "whoisLookup": "Whois vyhledávání",
-    "secureFiles": "Files"
+    "secureFiles": "Soubory"
   },
   "Help": {
     "title": "Nápověda a dokumentace",
@@ -654,8 +654,8 @@
         "description": "Vyhledejte registrační údaje domény a IP adresy přes RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Soubory",
+        "description": "Šifrujte soubory a složky do maskovaných objektů .mydt; po odemčení je můžete procházet a zobrazovat."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Soubory",
+    "subtitle": "Soubory zůstanou soukromé, dokud je neodemknete — zašifrované ve vašem zařízení, maskované na disku",
+    "desktopOnly": "Secure Files je k dispozici v desktopové aplikaci.",
+    "allFiles": "Všechny soubory",
+    "overview": "Přehled",
+    "statFiles": "Soubory",
+    "statFolders": "Složky",
+    "statContent": "Velikost obsahu",
+    "statContentHint": "Celková velikost původních souborů",
+    "statOnDisk": "Na disku",
+    "statOverhead": "{size} režie šifrování",
+    "byType": "Podle typu",
+    "fileCount": "{count, plural, one {# soubor} few {# soubory} many {# souboru} other {# souborů}}",
+    "largestFiles": "Největší soubory",
+    "recentlyAdded": "Nedávno přidané",
+    "openContainingFolder": "Otevřít nadřazenou složku",
     "types": {
-      "image": "Images",
+      "image": "Obrázky",
       "video": "Video",
-      "audio": "Audio",
+      "audio": "Zvuk",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Archivy",
+      "code": "Kód",
+      "doc": "Dokumenty",
+      "sheet": "Tabulky",
+      "file": "Ostatní"
+    },
+    "breadcrumb": "Cesta ke složce",
+    "addFiles": "Přidat soubory",
+    "addFolder": "Přidat složku",
+    "importFolder": "Importovat složku",
+    "newFolder": "Nová složka",
+    "lock": "Zamknout",
+    "settings": "Nastavení úložiště",
+    "storageFolder": "Složka úložiště",
+    "notSet": "Nenastaveno",
+    "chooseFolder": "Vybrat složku",
+    "changeFolder": "Změnit složku…",
+    "chooseFolderTitle": "Vyberte, kam se ukládají zašifrované soubory",
+    "chooseFolderBody": "Vyberte libovolnou složku v tomto zařízení nebo na externím disku. Mimo MyDevTools obsahuje pouze maskované soubory .mydt.",
+    "changeFolderTitle": "Přesunout zašifrované soubory?",
+    "changeFolderBody": "Všechny soubory .mydt budou přesunuty ze současné složky úložiště do té, kterou vyberete nyní.",
+    "folderSet": "Složka úložiště nastavena",
+    "folderMissingTitle": "Složka úložiště nenalezena",
+    "folderMissingBody": "„{dir}“ není dostupná — může být na odpojeném disku nebo pocházet ze zálohy obnovené z jiného počítače. Připojte ji znovu, nebo vyberte novou složku.",
+    "movedCount": "Přesunuto zašifrovaných souborů: {count}",
+    "importedCount": "Zašifrováno souborů: {count}",
+    "emptyFolderAdded": "Složka přidána — neobsahovala žádné soubory k zašifrování",
+    "emptyTitle": "Zatím zde nejsou žádné soubory",
+    "emptyBody": "Přidejte soubory nebo celou složku. Každý soubor se zašifruje do objektu .mydt s náhodným názvem; původní název, typ a obsah jsou vidět jen zde.",
+    "name": "Název",
+    "size": "Velikost",
+    "modified": "Změněno",
+    "actions": "Akce",
+    "expand": "Rozbalit",
+    "collapse": "Sbalit",
+    "preview": "Náhled",
+    "noPreview": "Pro tento typ souboru není náhled k dispozici — exportujte jej a otevřete v jiné aplikaci.",
+    "export": "Exportovat",
+    "exportWarningTitle": "Exportovat dešifrovanou kopii?",
+    "exportWarningBody": "Soubor se zapíše nezašifrovaný do zvoleného umístění. Přečte si jej cokoli v tomto zařízení.",
+    "exported": "Dešifrovaná kopie exportována",
+    "replace": "Nahradit obsah…",
+    "replaced": "Obsah souboru nahrazen",
+    "rename": "Přejmenovat",
+    "fileName": "Název souboru",
+    "move": "Přesunout do složky",
+    "targetFolder": "Složka",
+    "targetFolderHint": "Pro vnořené složky použijte lomítka, například projekt/config. Pro nejvyšší úroveň nechte prázdné.",
+    "folderName": "Název složky",
+    "delete": "Smazat",
+    "deleted": "Soubor smazán",
+    "deletedCount": "Smazáno souborů: {count}",
+    "deleteFileTitle": "Smazat tento soubor?",
+    "deleteFileBody": "„{name}“ bude trvale odstraněn ze zašifrované složky úložiště.",
+    "deleteFolderTitle": "Smazat tuto složku?",
+    "deleteFolderBody": "Každý soubor ve složce „{dir}“ bude trvale odstraněn ze zašifrované složky úložiště.",
+    "unreadableCount": "Nečitelné soubory ve složce úložiště: {count}",
+    "unreadableHint": "Byly zašifrovány jiným hlavním heslem, patří do jiného trezoru nebo jsou poškozené.",
+    "dismiss": "Zavřít",
+    "viewGrid": "Zobrazení mřížky",
+    "viewList": "Zobrazení seznamu",
+    "footerNote": "Soubory do 20 MB. Šifrováno pomocí Argon2id + XChaCha20-Poly1305; klíč je v paměti jen po dobu odemčení trezoru.",
+    "cancel": "Zrušit",
+    "save": "Uložit"
   }
 }
diff --git a/apps/desktop-ui/messages/da.json b/apps/desktop-ui/messages/da.json
index 6997ebe0..8d444efa 100644
--- a/apps/desktop-ui/messages/da.json
+++ b/apps/desktop-ui/messages/da.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook-tester",
     "websocketTester": "WebSocket-tester",
     "whoisLookup": "Whois-opslag",
-    "secureFiles": "Files"
+    "secureFiles": "Filer"
   },
   "Help": {
     "title": "Hjælp og dokumentation",
@@ -654,8 +654,8 @@
         "description": "Slå registreringsoplysninger for domæner og IP-adresser op via RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Filer",
+        "description": "Krypter filer og mapper til maskerede .mydt-objekter; gennemse og forhåndsvis dem efter oplåsning."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Filer",
+    "subtitle": "Filer, der forbliver private, indtil du låser dem op — krypteret på din enhed, maskeret på disken",
+    "desktopOnly": "Secure Files er tilgængelig i skrivebordsappen.",
+    "allFiles": "Alle filer",
+    "overview": "Oversigt",
+    "statFiles": "Filer",
+    "statFolders": "Mapper",
+    "statContent": "Indholdsstørrelse",
+    "statContentHint": "Samlet størrelse af de oprindelige filer",
+    "statOnDisk": "På disken",
+    "statOverhead": "{size} krypteringsoverhead",
+    "byType": "Efter type",
+    "fileCount": "{count, plural, one {# fil} other {# filer}}",
+    "largestFiles": "Største filer",
+    "recentlyAdded": "Senest tilføjet",
+    "openContainingFolder": "Åbn overordnet mappe",
     "types": {
-      "image": "Images",
+      "image": "Billeder",
       "video": "Video",
-      "audio": "Audio",
+      "audio": "Lyd",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Arkiver",
+      "code": "Kode",
+      "doc": "Dokumenter",
+      "sheet": "Regneark",
+      "file": "Andet"
+    },
+    "breadcrumb": "Mappesti",
+    "addFiles": "Tilføj filer",
+    "addFolder": "Tilføj mappe",
+    "importFolder": "Importér mappe",
+    "newFolder": "Ny mappe",
+    "lock": "Lås",
+    "settings": "Lagringsindstillinger",
+    "storageFolder": "Lagringsmappe",
+    "notSet": "Ikke angivet",
+    "chooseFolder": "Vælg mappe",
+    "changeFolder": "Skift mappe…",
+    "chooseFolderTitle": "Vælg, hvor krypterede filer gemmes",
+    "chooseFolderBody": "Vælg en vilkårlig mappe på denne enhed eller et eksternt drev. Uden for MyDevTools indeholder den kun maskerede .mydt-filer.",
+    "changeFolderTitle": "Flyt krypterede filer?",
+    "changeFolderBody": "Alle .mydt-filer flyttes fra den nuværende lagringsmappe til den, du vælger nu.",
+    "folderSet": "Lagringsmappe angivet",
+    "folderMissingTitle": "Lagringsmappen blev ikke fundet",
+    "folderMissingBody": "“{dir}” er ikke tilgængelig — den ligger måske på et frakoblet drev eller stammer fra en gendannet sikkerhedskopi fra en anden maskine. Tilslut den igen, eller vælg en ny mappe.",
+    "movedCount": "Flyttede {count} krypterede filer",
+    "importedCount": "Krypterede {count} filer",
+    "emptyFolderAdded": "Mappe tilføjet — den indeholdt ingen filer at kryptere",
+    "emptyTitle": "Ingen filer her endnu",
+    "emptyBody": "Tilføj filer eller en hel mappe. Hver fil krypteres til et .mydt-objekt med et tilfældigt navn; det oprindelige navn, typen og indholdet ses kun her.",
+    "name": "Navn",
+    "size": "Størrelse",
+    "modified": "Ændret",
+    "actions": "Handlinger",
+    "expand": "Udvid",
+    "collapse": "Skjul",
+    "preview": "Forhåndsvisning",
+    "noPreview": "Ingen forhåndsvisning af denne filtype — eksportér den for at åbne den i en anden app.",
+    "export": "Eksportér",
+    "exportWarningTitle": "Eksportér en dekrypteret kopi?",
+    "exportWarningBody": "Filen skrives ukrypteret til den placering, du vælger. Alt på den enhed kan læse den.",
+    "exported": "Dekrypteret kopi eksporteret",
+    "replace": "Erstat indhold…",
+    "replaced": "Filens indhold blev erstattet",
+    "rename": "Omdøb",
+    "fileName": "Filnavn",
+    "move": "Flyt til mappe",
+    "targetFolder": "Mappe",
+    "targetFolderHint": "Brug skråstreger til indlejrede mapper, for eksempel projekt/config. Lad feltet være tomt for øverste niveau.",
+    "folderName": "Mappenavn",
+    "delete": "Slet",
+    "deleted": "Filen blev slettet",
+    "deletedCount": "Slettede {count} filer",
+    "deleteFileTitle": "Slet denne fil?",
+    "deleteFileBody": "“{name}” fjernes permanent fra den krypterede lagringsmappe.",
+    "deleteFolderTitle": "Slet denne mappe?",
+    "deleteFolderBody": "Alle filer under “{dir}” fjernes permanent fra den krypterede lagringsmappe.",
+    "unreadableCount": "Ulæselige filer i lagringsmappen: {count}",
+    "unreadableHint": "De blev krypteret med en anden hovedadgangskode, hører til et andet boks-arkiv eller er beskadigede.",
+    "dismiss": "Afvis",
+    "viewGrid": "Gittervisning",
+    "viewList": "Listevisning",
+    "footerNote": "Filer op til 20 MB. Krypteret med Argon2id + XChaCha20-Poly1305; nøglen findes kun i hukommelsen, mens boksen er låst op.",
+    "cancel": "Annuller",
+    "save": "Gem"
   }
 }
diff --git a/apps/desktop-ui/messages/de.json b/apps/desktop-ui/messages/de.json
index 377c9015..810ea423 100644
--- a/apps/desktop-ui/messages/de.json
+++ b/apps/desktop-ui/messages/de.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook-Tester",
     "websocketTester": "WebSocket-Tester",
     "whoisLookup": "Whois-Abfrage",
-    "secureFiles": "Files"
+    "secureFiles": "Dateien"
   },
   "Help": {
     "title": "Hilfe & Dokumentation",
@@ -654,8 +654,8 @@
         "description": "Registrierungsdaten von Domains und IPs per RDAP abrufen."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Dateien",
+        "description": "Verschlüsseln Sie Dateien und Ordner in maskierte .mydt-Objekte; nach dem Entsperren durchsuchen und ansehen."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Dateien",
+    "subtitle": "Dateien, die privat bleiben, bis Sie sie entsperren — auf Ihrem Gerät verschlüsselt, auf der Festplatte maskiert",
+    "desktopOnly": "Secure Files ist in der Desktop-App verfügbar.",
+    "allFiles": "Alle Dateien",
+    "overview": "Übersicht",
+    "statFiles": "Dateien",
+    "statFolders": "Ordner",
+    "statContent": "Inhaltsgröße",
+    "statContentHint": "Gesamtgröße der Originaldateien",
+    "statOnDisk": "Auf der Festplatte",
+    "statOverhead": "{size} Verschlüsselungs-Overhead",
+    "byType": "Nach Typ",
+    "fileCount": "{count, plural, one {# Datei} other {# Dateien}}",
+    "largestFiles": "Größte Dateien",
+    "recentlyAdded": "Zuletzt hinzugefügt",
+    "openContainingFolder": "Übergeordneten Ordner öffnen",
     "types": {
-      "image": "Images",
+      "image": "Bilder",
       "video": "Video",
       "audio": "Audio",
       "pdf": "PDF",
-      "archive": "Archives",
+      "archive": "Archive",
       "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "doc": "Dokumente",
+      "sheet": "Tabellen",
+      "file": "Sonstige"
+    },
+    "breadcrumb": "Ordnerpfad",
+    "addFiles": "Dateien hinzufügen",
+    "addFolder": "Ordner hinzufügen",
+    "importFolder": "Ordner importieren",
+    "newFolder": "Neuer Ordner",
+    "lock": "Sperren",
+    "settings": "Speichereinstellungen",
+    "storageFolder": "Speicherordner",
+    "notSet": "Nicht festgelegt",
+    "chooseFolder": "Ordner wählen",
+    "changeFolder": "Ordner ändern…",
+    "chooseFolderTitle": "Wählen Sie, wo verschlüsselte Dateien gespeichert werden",
+    "chooseFolderBody": "Wählen Sie einen beliebigen Ordner auf diesem Gerät oder einem externen Laufwerk. Außerhalb von MyDevTools enthält er ausschließlich maskierte .mydt-Dateien.",
+    "changeFolderTitle": "Verschlüsselte Dateien verschieben?",
+    "changeFolderBody": "Alle .mydt-Dateien werden aus dem aktuellen Speicherordner in den als Nächstes gewählten verschoben.",
+    "folderSet": "Speicherordner festgelegt",
+    "folderMissingTitle": "Speicherordner nicht gefunden",
+    "folderMissingBody": "„{dir}“ ist nicht verfügbar — der Ordner liegt möglicherweise auf einem nicht angeschlossenen Laufwerk oder stammt aus einer wiederhergestellten Sicherung eines anderen Rechners. Schließen Sie ihn wieder an oder wählen Sie einen neuen Ordner.",
+    "movedCount": "{count} verschlüsselte Dateien verschoben",
+    "importedCount": "{count} Dateien verschlüsselt",
+    "emptyFolderAdded": "Ordner hinzugefügt — er enthielt keine Dateien zum Verschlüsseln",
+    "emptyTitle": "Hier sind noch keine Dateien",
+    "emptyBody": "Fügen Sie Dateien oder einen ganzen Ordner hinzu. Jede Datei wird in ein .mydt-Objekt mit zufälligem Namen verschlüsselt; Originalname, Typ und Inhalt sind nur hier sichtbar.",
+    "name": "Name",
+    "size": "Größe",
+    "modified": "Geändert",
+    "actions": "Aktionen",
+    "expand": "Ausklappen",
+    "collapse": "Einklappen",
+    "preview": "Vorschau",
+    "noPreview": "Keine Vorschau für diesen Dateityp — exportieren Sie die Datei, um sie in einer anderen App zu öffnen.",
+    "export": "Exportieren",
+    "exportWarningTitle": "Entschlüsselte Kopie exportieren?",
+    "exportWarningBody": "Die Datei wird unverschlüsselt an den gewählten Ort geschrieben. Alles auf diesem Gerät kann sie lesen.",
+    "exported": "Entschlüsselte Kopie exportiert",
+    "replace": "Inhalt ersetzen…",
+    "replaced": "Dateiinhalt ersetzt",
+    "rename": "Umbenennen",
+    "fileName": "Dateiname",
+    "move": "In Ordner verschieben",
+    "targetFolder": "Ordner",
+    "targetFolderHint": "Verwenden Sie Schrägstriche für verschachtelte Ordner, z. B. projekt/config. Für die oberste Ebene leer lassen.",
+    "folderName": "Ordnername",
+    "delete": "Löschen",
+    "deleted": "Datei gelöscht",
+    "deletedCount": "{count} Dateien gelöscht",
+    "deleteFileTitle": "Diese Datei löschen?",
+    "deleteFileBody": "„{name}“ wird endgültig aus dem verschlüsselten Speicherordner entfernt.",
+    "deleteFolderTitle": "Diesen Ordner löschen?",
+    "deleteFolderBody": "Jede Datei unter „{dir}“ wird endgültig aus dem verschlüsselten Speicherordner entfernt.",
+    "unreadableCount": "Nicht lesbare Dateien im Speicherordner: {count}",
+    "unreadableHint": "Sie wurden mit einem anderen Master-Passwort verschlüsselt, gehören zu einem anderen Tresor oder sind beschädigt.",
+    "dismiss": "Ausblenden",
+    "viewGrid": "Rasteransicht",
+    "viewList": "Listenansicht",
+    "footerNote": "Dateien bis 20 MB. Verschlüsselt mit Argon2id + XChaCha20-Poly1305; der Schlüssel bleibt nur im Arbeitsspeicher, solange der Tresor entsperrt ist.",
+    "cancel": "Abbrechen",
+    "save": "Speichern"
   }
 }
diff --git a/apps/desktop-ui/messages/el.json b/apps/desktop-ui/messages/el.json
index ae9dd5a1..7516dbb0 100644
--- a/apps/desktop-ui/messages/el.json
+++ b/apps/desktop-ui/messages/el.json
@@ -77,7 +77,7 @@
     "webhookTester": "Δοκιμαστής webhook",
     "websocketTester": "Δοκιμαστής WebSocket",
     "whoisLookup": "Αναζήτηση Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Αρχεία"
   },
   "Help": {
     "title": "Βοήθεια και τεκμηρίωση",
@@ -654,8 +654,8 @@
         "description": "Αναζητήστε στοιχεία καταχώρισης τομέα και IP μέσω RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Αρχεία",
+        "description": "Κρυπτογραφήστε αρχεία και φακέλους σε μεταμφιεσμένα αντικείμενα .mydt· περιηγηθείτε και δείτε τα μετά το ξεκλείδωμα."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Αρχεία",
+    "subtitle": "Αρχεία που παραμένουν ιδιωτικά μέχρι να τα ξεκλειδώσετε — κρυπτογραφημένα στη συσκευή σας, μεταμφιεσμένα στον δίσκο",
+    "desktopOnly": "Το Secure Files είναι διαθέσιμο στην εφαρμογή για υπολογιστή.",
+    "allFiles": "Όλα τα αρχεία",
+    "overview": "Επισκόπηση",
+    "statFiles": "Αρχεία",
+    "statFolders": "Φάκελοι",
+    "statContent": "Μέγεθος περιεχομένου",
+    "statContentHint": "Συνολικό μέγεθος των αρχικών αρχείων",
+    "statOnDisk": "Στον δίσκο",
+    "statOverhead": "{size} επιβάρυνση κρυπτογράφησης",
+    "byType": "Ανά τύπο",
+    "fileCount": "{count, plural, one {# αρχείο} other {# αρχεία}}",
+    "largestFiles": "Μεγαλύτερα αρχεία",
+    "recentlyAdded": "Προστέθηκαν πρόσφατα",
+    "openContainingFolder": "Άνοιγμα φακέλου που το περιέχει",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "Εικόνες",
+      "video": "Βίντεο",
+      "audio": "Ήχος",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Αρχειοθήκες",
+      "code": "Κώδικας",
+      "doc": "Έγγραφα",
+      "sheet": "Υπολογιστικά φύλλα",
+      "file": "Άλλα"
+    },
+    "breadcrumb": "Διαδρομή φακέλου",
+    "addFiles": "Προσθήκη αρχείων",
+    "addFolder": "Προσθήκη φακέλου",
+    "importFolder": "Εισαγωγή φακέλου",
+    "newFolder": "Νέος φάκελος",
+    "lock": "Κλείδωμα",
+    "settings": "Ρυθμίσεις αποθήκευσης",
+    "storageFolder": "Φάκελος αποθήκευσης",
+    "notSet": "Δεν έχει οριστεί",
+    "chooseFolder": "Επιλογή φακέλου",
+    "changeFolder": "Αλλαγή φακέλου…",
+    "chooseFolderTitle": "Επιλέξτε πού αποθηκεύονται τα κρυπτογραφημένα αρχεία",
+    "chooseFolderBody": "Επιλέξτε οποιονδήποτε φάκελο σε αυτή τη συσκευή ή σε εξωτερικό δίσκο. Εκτός του MyDevTools περιέχει μόνο μεταμφιεσμένα αρχεία .mydt.",
+    "changeFolderTitle": "Μετακίνηση κρυπτογραφημένων αρχείων;",
+    "changeFolderBody": "Όλα τα αρχεία .mydt θα μετακινηθούν από τον τρέχοντα φάκελο αποθήκευσης σε αυτόν που θα επιλέξετε στη συνέχεια.",
+    "folderSet": "Ο φάκελος αποθήκευσης ορίστηκε",
+    "folderMissingTitle": "Ο φάκελος αποθήκευσης δεν βρέθηκε",
+    "folderMissingBody": "Το «{dir}» δεν είναι διαθέσιμο — ίσως βρίσκεται σε αποσυνδεδεμένο δίσκο ή προέρχεται από αντίγραφο ασφαλείας άλλου υπολογιστή. Συνδέστε το ξανά ή επιλέξτε νέο φάκελο.",
+    "movedCount": "Μετακινήθηκαν {count} κρυπτογραφημένα αρχεία",
+    "importedCount": "Κρυπτογραφήθηκαν {count} αρχεία",
+    "emptyFolderAdded": "Ο φάκελος προστέθηκε — δεν περιείχε αρχεία προς κρυπτογράφηση",
+    "emptyTitle": "Δεν υπάρχουν ακόμη αρχεία εδώ",
+    "emptyBody": "Προσθέστε αρχεία ή έναν ολόκληρο φάκελο. Κάθε αρχείο κρυπτογραφείται σε αντικείμενο .mydt με τυχαίο όνομα· το αρχικό όνομα, ο τύπος και το περιεχόμενο φαίνονται μόνο εδώ.",
+    "name": "Όνομα",
+    "size": "Μέγεθος",
+    "modified": "Τροποποιήθηκε",
+    "actions": "Ενέργειες",
+    "expand": "Ανάπτυξη",
+    "collapse": "Σύμπτυξη",
+    "preview": "Προεπισκόπηση",
+    "noPreview": "Δεν υπάρχει προεπισκόπηση για αυτόν τον τύπο αρχείου — εξαγάγετέ το για να το ανοίξετε σε άλλη εφαρμογή.",
+    "export": "Εξαγωγή",
+    "exportWarningTitle": "Εξαγωγή αποκρυπτογραφημένου αντιγράφου;",
+    "exportWarningBody": "Το αρχείο θα γραφτεί χωρίς κρυπτογράφηση στη θέση που θα επιλέξετε. Οτιδήποτε σε εκείνη τη συσκευή θα μπορεί να το διαβάσει.",
+    "exported": "Το αποκρυπτογραφημένο αντίγραφο εξήχθη",
+    "replace": "Αντικατάσταση περιεχομένου…",
+    "replaced": "Το περιεχόμενο του αρχείου αντικαταστάθηκε",
+    "rename": "Μετονομασία",
+    "fileName": "Όνομα αρχείου",
+    "move": "Μετακίνηση σε φάκελο",
+    "targetFolder": "Φάκελος",
+    "targetFolderHint": "Χρησιμοποιήστε καθέτους για ένθετους φακέλους, π.χ. project/config. Αφήστε το κενό για το ανώτατο επίπεδο.",
+    "folderName": "Όνομα φακέλου",
+    "delete": "Διαγραφή",
+    "deleted": "Το αρχείο διαγράφηκε",
+    "deletedCount": "Διαγράφηκαν {count} αρχεία",
+    "deleteFileTitle": "Διαγραφή αυτού του αρχείου;",
+    "deleteFileBody": "Το «{name}» θα αφαιρεθεί οριστικά από τον κρυπτογραφημένο φάκελο αποθήκευσης.",
+    "deleteFolderTitle": "Διαγραφή αυτού του φακέλου;",
+    "deleteFolderBody": "Κάθε αρχείο μέσα στο «{dir}» θα αφαιρεθεί οριστικά από τον κρυπτογραφημένο φάκελο αποθήκευσης.",
+    "unreadableCount": "Μη αναγνώσιμα αρχεία στον φάκελο αποθήκευσης: {count}",
+    "unreadableHint": "Κρυπτογραφήθηκαν με άλλον κύριο κωδικό, ανήκουν σε άλλο θησαυροφυλάκιο ή είναι κατεστραμμένα.",
+    "dismiss": "Απόρριψη",
+    "viewGrid": "Προβολή πλέγματος",
+    "viewList": "Προβολή λίστας",
+    "footerNote": "Αρχεία έως 20 MB. Κρυπτογράφηση με Argon2id + XChaCha20-Poly1305· το κλειδί παραμένει στη μνήμη μόνο όσο το θησαυροφυλάκιο είναι ξεκλείδωτο.",
+    "cancel": "Ακύρωση",
+    "save": "Αποθήκευση"
   }
 }
diff --git a/apps/desktop-ui/messages/es.json b/apps/desktop-ui/messages/es.json
index 7872e23b..3ccb7826 100644
--- a/apps/desktop-ui/messages/es.json
+++ b/apps/desktop-ui/messages/es.json
@@ -77,7 +77,7 @@
     "webhookTester": "Probador de webhooks",
     "websocketTester": "Probador de WebSocket",
     "whoisLookup": "Consulta Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Archivos"
   },
   "Help": {
     "title": "Ayuda y documentación",
@@ -654,8 +654,8 @@
         "description": "Consulta los datos de registro de un dominio o IP mediante RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Archivos",
+        "description": "Cifra archivos y carpetas en objetos .mydt enmascarados; explóralos y previsualízalos tras desbloquear."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Archivos",
+    "subtitle": "Archivos que siguen siendo privados hasta que los desbloqueas: cifrados en tu dispositivo, enmascarados en el disco",
+    "desktopOnly": "Secure Files está disponible en la aplicación de escritorio.",
+    "allFiles": "Todos los archivos",
+    "overview": "Resumen",
+    "statFiles": "Archivos",
+    "statFolders": "Carpetas",
+    "statContent": "Tamaño del contenido",
+    "statContentHint": "Tamaño total de los archivos originales",
+    "statOnDisk": "En disco",
+    "statOverhead": "{size} de sobrecarga de cifrado",
+    "byType": "Por tipo",
+    "fileCount": "{count, plural, one {# archivo} other {# archivos}}",
+    "largestFiles": "Archivos más grandes",
+    "recentlyAdded": "Añadidos recientemente",
+    "openContainingFolder": "Abrir la carpeta contenedora",
     "types": {
-      "image": "Images",
-      "video": "Video",
+      "image": "Imágenes",
+      "video": "Vídeo",
       "audio": "Audio",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Archivos comprimidos",
+      "code": "Código",
+      "doc": "Documentos",
+      "sheet": "Hojas de cálculo",
+      "file": "Otros"
+    },
+    "breadcrumb": "Ruta de la carpeta",
+    "addFiles": "Añadir archivos",
+    "addFolder": "Añadir carpeta",
+    "importFolder": "Importar carpeta",
+    "newFolder": "Nueva carpeta",
+    "lock": "Bloquear",
+    "settings": "Ajustes de almacenamiento",
+    "storageFolder": "Carpeta de almacenamiento",
+    "notSet": "Sin definir",
+    "chooseFolder": "Elegir carpeta",
+    "changeFolder": "Cambiar carpeta…",
+    "chooseFolderTitle": "Elige dónde se guardan los archivos cifrados",
+    "chooseFolderBody": "Elige cualquier carpeta de este dispositivo o de una unidad externa. Fuera de MyDevTools solo contiene archivos .mydt enmascarados.",
+    "changeFolderTitle": "¿Mover los archivos cifrados?",
+    "changeFolderBody": "Todos los archivos .mydt se moverán de la carpeta de almacenamiento actual a la que elijas a continuación.",
+    "folderSet": "Carpeta de almacenamiento definida",
+    "folderMissingTitle": "No se encuentra la carpeta de almacenamiento",
+    "folderMissingBody": "«{dir}» no está disponible: puede estar en una unidad desconectada o proceder de una copia de seguridad restaurada de otro equipo. Vuelve a conectarla o elige una carpeta nueva.",
+    "movedCount": "Se movieron {count} archivos cifrados",
+    "importedCount": "Se cifraron {count} archivos",
+    "emptyFolderAdded": "Carpeta añadida: no contenía archivos que cifrar",
+    "emptyTitle": "Aquí todavía no hay archivos",
+    "emptyBody": "Añade archivos o una carpeta entera. Cada archivo se cifra en un objeto .mydt con nombre aleatorio; el nombre, el tipo y el contenido originales solo se ven aquí.",
+    "name": "Nombre",
+    "size": "Tamaño",
+    "modified": "Modificado",
+    "actions": "Acciones",
+    "expand": "Expandir",
+    "collapse": "Contraer",
+    "preview": "Vista previa",
+    "noPreview": "No hay vista previa para este tipo de archivo: expórtalo para abrirlo en otra aplicación.",
+    "export": "Exportar",
+    "exportWarningTitle": "¿Exportar una copia descifrada?",
+    "exportWarningBody": "El archivo se escribirá sin cifrar en la ubicación que elijas. Cualquier cosa en ese dispositivo podrá leerlo.",
+    "exported": "Copia descifrada exportada",
+    "replace": "Reemplazar contenido…",
+    "replaced": "Contenido del archivo reemplazado",
+    "rename": "Renombrar",
+    "fileName": "Nombre del archivo",
+    "move": "Mover a una carpeta",
+    "targetFolder": "Carpeta",
+    "targetFolderHint": "Usa barras para carpetas anidadas, por ejemplo proyecto/config. Déjalo vacío para el nivel superior.",
+    "folderName": "Nombre de la carpeta",
+    "delete": "Eliminar",
+    "deleted": "Archivo eliminado",
+    "deletedCount": "Se eliminaron {count} archivos",
+    "deleteFileTitle": "¿Eliminar este archivo?",
+    "deleteFileBody": "«{name}» se eliminará permanentemente de la carpeta de almacenamiento cifrada.",
+    "deleteFolderTitle": "¿Eliminar esta carpeta?",
+    "deleteFolderBody": "Todos los archivos dentro de «{dir}» se eliminarán permanentemente de la carpeta de almacenamiento cifrada.",
+    "unreadableCount": "Archivos ilegibles en la carpeta de almacenamiento: {count}",
+    "unreadableHint": "Se cifraron con otra contraseña maestra, pertenecen a otra bóveda o están dañados.",
+    "dismiss": "Descartar",
+    "viewGrid": "Vista de cuadrícula",
+    "viewList": "Vista de lista",
+    "footerNote": "Archivos de hasta 20 MB. Cifrados con Argon2id + XChaCha20-Poly1305; la clave solo permanece en memoria mientras la bóveda está desbloqueada.",
+    "cancel": "Cancelar",
+    "save": "Guardar"
   }
 }
diff --git a/apps/desktop-ui/messages/fa.json b/apps/desktop-ui/messages/fa.json
index f34a0c25..863ff2d5 100644
--- a/apps/desktop-ui/messages/fa.json
+++ b/apps/desktop-ui/messages/fa.json
@@ -77,7 +77,7 @@
     "webhookTester": "آزمایشگر Webhook",
     "websocketTester": "آزمایشگر WebSocket",
     "whoisLookup": "جست‌وجوی Whois",
-    "secureFiles": "Files"
+    "secureFiles": "پرونده‌ها"
   },
   "Help": {
     "title": "راهنما و مستندات",
@@ -654,8 +654,8 @@
         "description": "جزئیات ثبت دامنه و IP را از طریق RDAP جست‌وجو کنید."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "پرونده‌ها",
+        "description": "پرونده‌ها و پوشه‌ها را به شیء‌های ‎.mydt‎ با نام پوشیده رمزگذاری کنید؛ پس از باز کردن قفل مرور و پیش‌نمایش کنید."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "پرونده‌ها",
+    "subtitle": "پرونده‌هایی که تا زمانی که قفلشان را باز نکنید خصوصی می‌مانند — روی دستگاه شما رمزگذاری‌شده و روی دیسک پوشیده",
+    "desktopOnly": "‏Secure Files در برنامهٔ رومیزی در دسترس است.",
+    "allFiles": "همهٔ پرونده‌ها",
+    "overview": "نمای کلی",
+    "statFiles": "پرونده‌ها",
+    "statFolders": "پوشه‌ها",
+    "statContent": "حجم محتوا",
+    "statContentHint": "حجم کل پرونده‌های اصلی",
+    "statOnDisk": "روی دیسک",
+    "statOverhead": "‏{size} سربار رمزگذاری",
+    "byType": "بر پایهٔ نوع",
+    "fileCount": "{count, plural, one {# پرونده} other {# پرونده}}",
+    "largestFiles": "بزرگ‌ترین پرونده‌ها",
+    "recentlyAdded": "به‌تازگی افزوده‌شده",
+    "openContainingFolder": "باز کردن پوشهٔ دربرگیرنده",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "تصاویر",
+      "video": "ویدیو",
+      "audio": "صدا",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "بایگانی‌ها",
+      "code": "کد",
+      "doc": "سندها",
+      "sheet": "صفحه‌گسترده‌ها",
+      "file": "سایر"
+    },
+    "breadcrumb": "مسیر پوشه",
+    "addFiles": "افزودن پرونده",
+    "addFolder": "افزودن پوشه",
+    "importFolder": "درون‌ریزی پوشه",
+    "newFolder": "پوشهٔ جدید",
+    "lock": "قفل کردن",
+    "settings": "تنظیمات ذخیره‌سازی",
+    "storageFolder": "پوشهٔ ذخیره‌سازی",
+    "notSet": "تعیین‌نشده",
+    "chooseFolder": "انتخاب پوشه",
+    "changeFolder": "تغییر پوشه…",
+    "chooseFolderTitle": "انتخاب کنید پرونده‌های رمزگذاری‌شده کجا ذخیره شوند",
+    "chooseFolderBody": "هر پوشه‌ای روی این دستگاه یا یک درایو خارجی را انتخاب کنید. بیرون از MyDevTools تنها شامل پرونده‌های ‎.mydt‎ با نام پوشیده است.",
+    "changeFolderTitle": "پرونده‌های رمزگذاری‌شده جابه‌جا شوند؟",
+    "changeFolderBody": "همهٔ پرونده‌های ‎.mydt‎ از پوشهٔ ذخیره‌سازی کنونی به پوشه‌ای که در ادامه انتخاب می‌کنید منتقل می‌شوند.",
+    "folderSet": "پوشهٔ ذخیره‌سازی تعیین شد",
+    "folderMissingTitle": "پوشهٔ ذخیره‌سازی پیدا نشد",
+    "folderMissingBody": "‏«{dir}» در دسترس نیست — ممکن است روی درایوی جدا‌شده باشد یا از پشتیبان بازیابی‌شدهٔ رایانه‌ای دیگر بیاید. دوباره وصلش کنید یا پوشه‌ای تازه برگزینید.",
+    "movedCount": "‏{count} پروندهٔ رمزگذاری‌شده منتقل شد",
+    "importedCount": "‏{count} پرونده رمزگذاری شد",
+    "emptyFolderAdded": "پوشه افزوده شد — پرونده‌ای برای رمزگذاری نداشت",
+    "emptyTitle": "هنوز پرونده‌ای اینجا نیست",
+    "emptyBody": "پرونده یا یک پوشهٔ کامل بیفزایید. هر پرونده به شیء ‎.mydt‎ با نامی تصادفی رمزگذاری می‌شود؛ نام، نوع و محتوای اصلی تنها همین‌جا دیده می‌شوند.",
+    "name": "نام",
+    "size": "اندازه",
+    "modified": "تغییریافته",
+    "actions": "کنش‌ها",
+    "expand": "گستردن",
+    "collapse": "جمع کردن",
+    "preview": "پیش‌نمایش",
+    "noPreview": "برای این نوع پرونده پیش‌نمایشی نیست — آن را برون‌ریزی کنید تا در برنامه‌ای دیگر باز شود.",
+    "export": "برون‌ریزی",
+    "exportWarningTitle": "یک نسخهٔ رمزگشایی‌شده برون‌ریزی شود؟",
+    "exportWarningBody": "پرونده بدون رمزگذاری در مکانی که برمی‌گزینید نوشته می‌شود. هر چیزی روی آن دستگاه می‌تواند آن را بخواند.",
+    "exported": "نسخهٔ رمزگشایی‌شده برون‌ریزی شد",
+    "replace": "جایگزینی محتوا…",
+    "replaced": "محتوای پرونده جایگزین شد",
+    "rename": "تغییر نام",
+    "fileName": "نام پرونده",
+    "move": "انتقال به پوشه",
+    "targetFolder": "پوشه",
+    "targetFolderHint": "برای پوشه‌های تودرتو از اسلش استفاده کنید، مانند project/config. برای بالاترین سطح خالی بگذارید.",
+    "folderName": "نام پوشه",
+    "delete": "حذف",
+    "deleted": "پرونده حذف شد",
+    "deletedCount": "‏{count} پرونده حذف شد",
+    "deleteFileTitle": "این پرونده حذف شود؟",
+    "deleteFileBody": "‏«{name}» برای همیشه از پوشهٔ ذخیره‌سازی رمزگذاری‌شده حذف می‌شود.",
+    "deleteFolderTitle": "این پوشه حذف شود؟",
+    "deleteFolderBody": "همهٔ پرونده‌های درون «{dir}» برای همیشه از پوشهٔ ذخیره‌سازی رمزگذاری‌شده حذف می‌شوند.",
+    "unreadableCount": "پرونده‌های ناخوانا در پوشهٔ ذخیره‌سازی: {count}",
+    "unreadableHint": "با گذرواژهٔ اصلی دیگری رمزگذاری شده‌اند، به گاوصندوق دیگری تعلق دارند، یا آسیب دیده‌اند.",
+    "dismiss": "بستن",
+    "viewGrid": "نمای شبکه‌ای",
+    "viewList": "نمای فهرستی",
+    "footerNote": "پرونده‌های تا ۲۰ مگابایت. رمزگذاری با Argon2id + XChaCha20-Poly1305؛ کلید تنها تا زمانی که گاوصندوق باز است در حافظه می‌ماند.",
+    "cancel": "انصراف",
+    "save": "ذخیره"
   }
 }
diff --git a/apps/desktop-ui/messages/fr.json b/apps/desktop-ui/messages/fr.json
index 8ed96017..083f1792 100644
--- a/apps/desktop-ui/messages/fr.json
+++ b/apps/desktop-ui/messages/fr.json
@@ -77,7 +77,7 @@
     "webhookTester": "Testeur de webhook",
     "websocketTester": "Testeur WebSocket",
     "whoisLookup": "Recherche Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Fichiers"
   },
   "Help": {
     "title": "Aide & documentation",
@@ -654,8 +654,8 @@
         "description": "Consultez les détails d'enregistrement d'un domaine ou d'une IP via RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Fichiers",
+        "description": "Chiffrez fichiers et dossiers en objets .mydt masqués ; parcourez-les et prévisualisez-les après déverrouillage."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Fichiers",
+    "subtitle": "Des fichiers qui restent privés jusqu'à leur déverrouillage — chiffrés sur votre appareil, masqués sur le disque",
+    "desktopOnly": "Secure Files est disponible dans l'application de bureau.",
+    "allFiles": "Tous les fichiers",
+    "overview": "Vue d'ensemble",
+    "statFiles": "Fichiers",
+    "statFolders": "Dossiers",
+    "statContent": "Taille du contenu",
+    "statContentHint": "Taille totale des fichiers d'origine",
+    "statOnDisk": "Sur le disque",
+    "statOverhead": "{size} de surcoût de chiffrement",
+    "byType": "Par type",
+    "fileCount": "{count, plural, one {# fichier} other {# fichiers}}",
+    "largestFiles": "Fichiers les plus volumineux",
+    "recentlyAdded": "Ajoutés récemment",
+    "openContainingFolder": "Ouvrir le dossier parent",
     "types": {
       "image": "Images",
-      "video": "Video",
+      "video": "Vidéo",
       "audio": "Audio",
       "pdf": "PDF",
       "archive": "Archives",
       "code": "Code",
       "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "sheet": "Feuilles de calcul",
+      "file": "Autres"
+    },
+    "breadcrumb": "Chemin du dossier",
+    "addFiles": "Ajouter des fichiers",
+    "addFolder": "Ajouter un dossier",
+    "importFolder": "Importer un dossier",
+    "newFolder": "Nouveau dossier",
+    "lock": "Verrouiller",
+    "settings": "Paramètres de stockage",
+    "storageFolder": "Dossier de stockage",
+    "notSet": "Non défini",
+    "chooseFolder": "Choisir un dossier",
+    "changeFolder": "Changer de dossier…",
+    "chooseFolderTitle": "Choisissez où stocker les fichiers chiffrés",
+    "chooseFolderBody": "Choisissez n'importe quel dossier sur cet appareil ou sur un disque externe. En dehors de MyDevTools, il ne contient que des fichiers .mydt masqués.",
+    "changeFolderTitle": "Déplacer les fichiers chiffrés ?",
+    "changeFolderBody": "Tous les fichiers .mydt seront déplacés du dossier de stockage actuel vers celui que vous choisirez ensuite.",
+    "folderSet": "Dossier de stockage défini",
+    "folderMissingTitle": "Dossier de stockage introuvable",
+    "folderMissingBody": "« {dir} » n'est pas disponible — il se trouve peut-être sur un disque débranché ou provient d'une sauvegarde restaurée depuis une autre machine. Reconnectez-le ou choisissez un nouveau dossier.",
+    "movedCount": "{count} fichiers chiffrés déplacés",
+    "importedCount": "{count} fichiers chiffrés",
+    "emptyFolderAdded": "Dossier ajouté — il ne contenait aucun fichier à chiffrer",
+    "emptyTitle": "Aucun fichier ici pour l'instant",
+    "emptyBody": "Ajoutez des fichiers ou un dossier entier. Chaque fichier est chiffré dans un objet .mydt au nom aléatoire ; le nom, le type et le contenu d'origine ne sont visibles qu'ici.",
+    "name": "Nom",
+    "size": "Taille",
+    "modified": "Modifié",
+    "actions": "Actions",
+    "expand": "Développer",
+    "collapse": "Réduire",
+    "preview": "Aperçu",
+    "noPreview": "Aucun aperçu pour ce type de fichier — exportez-le pour l'ouvrir dans une autre application.",
+    "export": "Exporter",
+    "exportWarningTitle": "Exporter une copie déchiffrée ?",
+    "exportWarningBody": "Le fichier sera écrit en clair à l'emplacement choisi. Tout ce qui se trouve sur cet appareil pourra le lire.",
+    "exported": "Copie déchiffrée exportée",
+    "replace": "Remplacer le contenu…",
+    "replaced": "Contenu du fichier remplacé",
+    "rename": "Renommer",
+    "fileName": "Nom du fichier",
+    "move": "Déplacer vers un dossier",
+    "targetFolder": "Dossier",
+    "targetFolderHint": "Utilisez des barres obliques pour les dossiers imbriqués, par exemple projet/config. Laissez vide pour le niveau supérieur.",
+    "folderName": "Nom du dossier",
+    "delete": "Supprimer",
+    "deleted": "Fichier supprimé",
+    "deletedCount": "{count} fichiers supprimés",
+    "deleteFileTitle": "Supprimer ce fichier ?",
+    "deleteFileBody": "« {name} » sera définitivement retiré du dossier de stockage chiffré.",
+    "deleteFolderTitle": "Supprimer ce dossier ?",
+    "deleteFolderBody": "Tous les fichiers sous « {dir} » seront définitivement retirés du dossier de stockage chiffré.",
+    "unreadableCount": "Fichiers illisibles dans le dossier de stockage : {count}",
+    "unreadableHint": "Ils ont été chiffrés avec un autre mot de passe maître, appartiennent à un autre coffre-fort ou sont corrompus.",
+    "dismiss": "Ignorer",
+    "viewGrid": "Vue en grille",
+    "viewList": "Vue en liste",
+    "footerNote": "Fichiers jusqu'à 20 Mo. Chiffrés avec Argon2id + XChaCha20-Poly1305 ; la clé ne réside en mémoire que pendant le déverrouillage du coffre-fort.",
+    "cancel": "Annuler",
+    "save": "Enregistrer"
   }
 }
diff --git a/apps/desktop-ui/messages/id.json b/apps/desktop-ui/messages/id.json
index 8db9067e..378a01cd 100644
--- a/apps/desktop-ui/messages/id.json
+++ b/apps/desktop-ui/messages/id.json
@@ -77,7 +77,7 @@
     "webhookTester": "Penguji Webhook",
     "websocketTester": "Penguji WebSocket",
     "whoisLookup": "Pencarian Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Berkas"
   },
   "Help": {
     "title": "Bantuan & Dokumentasi",
@@ -654,8 +654,8 @@
         "description": "Cari detail pendaftaran domain dan IP melalui RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Berkas",
+        "description": "Enkripsi berkas dan folder menjadi objek .mydt bernama samar; jelajahi dan pratinjau setelah dibuka."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Berkas",
+    "subtitle": "Berkas yang tetap pribadi sampai Anda membukanya — dienkripsi di perangkat Anda, disamarkan di disk",
+    "desktopOnly": "Secure Files tersedia di aplikasi desktop.",
+    "allFiles": "Semua berkas",
+    "overview": "Ringkasan",
+    "statFiles": "Berkas",
+    "statFolders": "Folder",
+    "statContent": "Ukuran konten",
+    "statContentHint": "Ukuran total berkas asli",
+    "statOnDisk": "Di disk",
+    "statOverhead": "{size} overhead enkripsi",
+    "byType": "Menurut jenis",
+    "fileCount": "{count, plural, other {# berkas}}",
+    "largestFiles": "Berkas terbesar",
+    "recentlyAdded": "Baru ditambahkan",
+    "openContainingFolder": "Buka folder induk",
     "types": {
-      "image": "Images",
+      "image": "Gambar",
       "video": "Video",
       "audio": "Audio",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Arsip",
+      "code": "Kode",
+      "doc": "Dokumen",
+      "sheet": "Lembar kerja",
+      "file": "Lainnya"
+    },
+    "breadcrumb": "Jalur folder",
+    "addFiles": "Tambah berkas",
+    "addFolder": "Tambah folder",
+    "importFolder": "Impor folder",
+    "newFolder": "Folder baru",
+    "lock": "Kunci",
+    "settings": "Pengaturan penyimpanan",
+    "storageFolder": "Folder penyimpanan",
+    "notSet": "Belum diatur",
+    "chooseFolder": "Pilih folder",
+    "changeFolder": "Ganti folder…",
+    "chooseFolderTitle": "Pilih tempat penyimpanan berkas terenkripsi",
+    "chooseFolderBody": "Pilih folder mana pun di perangkat ini atau di drive eksternal. Di luar MyDevTools, folder itu hanya berisi berkas .mydt bernama samar.",
+    "changeFolderTitle": "Pindahkan berkas terenkripsi?",
+    "changeFolderBody": "Semua berkas .mydt akan dipindahkan dari folder penyimpanan saat ini ke folder yang Anda pilih berikutnya.",
+    "folderSet": "Folder penyimpanan diatur",
+    "folderMissingTitle": "Folder penyimpanan tidak ditemukan",
+    "folderMissingBody": "“{dir}” tidak tersedia — mungkin berada di drive yang dicabut atau berasal dari cadangan yang dipulihkan dari mesin lain. Sambungkan kembali, atau pilih folder baru.",
+    "movedCount": "{count} berkas terenkripsi dipindahkan",
+    "importedCount": "{count} berkas dienkripsi",
+    "emptyFolderAdded": "Folder ditambahkan — tidak ada berkas untuk dienkripsi",
+    "emptyTitle": "Belum ada berkas di sini",
+    "emptyBody": "Tambahkan berkas atau seluruh folder. Setiap berkas dienkripsi menjadi objek .mydt bernama acak; nama, jenis, dan isi aslinya hanya terlihat di sini.",
+    "name": "Nama",
+    "size": "Ukuran",
+    "modified": "Diubah",
+    "actions": "Tindakan",
+    "expand": "Bentangkan",
+    "collapse": "Ciutkan",
+    "preview": "Pratinjau",
+    "noPreview": "Tidak ada pratinjau untuk jenis berkas ini — ekspor untuk membukanya di aplikasi lain.",
+    "export": "Ekspor",
+    "exportWarningTitle": "Ekspor salinan yang sudah didekripsi?",
+    "exportWarningBody": "Berkas akan ditulis tanpa enkripsi ke lokasi yang Anda pilih. Apa pun di perangkat itu bisa membacanya.",
+    "exported": "Salinan terdekripsi diekspor",
+    "replace": "Ganti isi…",
+    "replaced": "Isi berkas diganti",
+    "rename": "Ganti nama",
+    "fileName": "Nama berkas",
+    "move": "Pindahkan ke folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Gunakan garis miring untuk folder bersarang, misalnya proyek/config. Kosongkan untuk tingkat teratas.",
+    "folderName": "Nama folder",
+    "delete": "Hapus",
+    "deleted": "Berkas dihapus",
+    "deletedCount": "{count} berkas dihapus",
+    "deleteFileTitle": "Hapus berkas ini?",
+    "deleteFileBody": "“{name}” akan dihapus permanen dari folder penyimpanan terenkripsi.",
+    "deleteFolderTitle": "Hapus folder ini?",
+    "deleteFolderBody": "Setiap berkas di dalam “{dir}” akan dihapus permanen dari folder penyimpanan terenkripsi.",
+    "unreadableCount": "Berkas tak terbaca di folder penyimpanan: {count}",
+    "unreadableHint": "Berkas itu dienkripsi dengan kata sandi utama lain, milik brankas lain, atau rusak.",
+    "dismiss": "Tutup",
+    "viewGrid": "Tampilan kisi",
+    "viewList": "Tampilan daftar",
+    "footerNote": "Berkas hingga 20 MB. Dienkripsi dengan Argon2id + XChaCha20-Poly1305; kunci hanya ada di memori selama brankas terbuka.",
+    "cancel": "Batal",
+    "save": "Simpan"
   }
 }
diff --git a/apps/desktop-ui/messages/it.json b/apps/desktop-ui/messages/it.json
index 18a9f9a5..a639c3e0 100644
--- a/apps/desktop-ui/messages/it.json
+++ b/apps/desktop-ui/messages/it.json
@@ -77,7 +77,7 @@
     "webhookTester": "Tester di webhook",
     "websocketTester": "Tester WebSocket",
     "whoisLookup": "Ricerca Whois",
-    "secureFiles": "Files"
+    "secureFiles": "File"
   },
   "Help": {
     "title": "Guida e documentazione",
@@ -654,8 +654,8 @@
         "description": "Cerca i dettagli di registrazione di domini e IP tramite RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "File",
+        "description": "Cifra file e cartelle in oggetti .mydt mascherati; sfogliali e visualizzali dopo lo sblocco."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "File",
+    "subtitle": "File che restano privati finché non li sblocchi — cifrati sul tuo dispositivo, mascherati sul disco",
+    "desktopOnly": "Secure Files è disponibile nell'app desktop.",
+    "allFiles": "Tutti i file",
+    "overview": "Panoramica",
+    "statFiles": "File",
+    "statFolders": "Cartelle",
+    "statContent": "Dimensione dei contenuti",
+    "statContentHint": "Dimensione totale dei file originali",
+    "statOnDisk": "Su disco",
+    "statOverhead": "{size} di overhead di cifratura",
+    "byType": "Per tipo",
+    "fileCount": "{count, plural, one {# file} other {# file}}",
+    "largestFiles": "File più grandi",
+    "recentlyAdded": "Aggiunti di recente",
+    "openContainingFolder": "Apri la cartella che lo contiene",
     "types": {
-      "image": "Images",
+      "image": "Immagini",
       "video": "Video",
       "audio": "Audio",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Archivi",
+      "code": "Codice",
+      "doc": "Documenti",
+      "sheet": "Fogli di calcolo",
+      "file": "Altro"
+    },
+    "breadcrumb": "Percorso della cartella",
+    "addFiles": "Aggiungi file",
+    "addFolder": "Aggiungi cartella",
+    "importFolder": "Importa cartella",
+    "newFolder": "Nuova cartella",
+    "lock": "Blocca",
+    "settings": "Impostazioni di archiviazione",
+    "storageFolder": "Cartella di archiviazione",
+    "notSet": "Non impostata",
+    "chooseFolder": "Scegli cartella",
+    "changeFolder": "Cambia cartella…",
+    "chooseFolderTitle": "Scegli dove archiviare i file cifrati",
+    "chooseFolderBody": "Scegli una cartella qualsiasi su questo dispositivo o su un'unità esterna. Fuori da MyDevTools contiene soltanto file .mydt mascherati.",
+    "changeFolderTitle": "Spostare i file cifrati?",
+    "changeFolderBody": "Tutti i file .mydt verranno spostati dalla cartella di archiviazione attuale a quella che sceglierai ora.",
+    "folderSet": "Cartella di archiviazione impostata",
+    "folderMissingTitle": "Cartella di archiviazione non trovata",
+    "folderMissingBody": "«{dir}» non è disponibile — potrebbe trovarsi su un'unità scollegata o provenire da un backup ripristinato da un altro computer. Ricollegala oppure scegli una nuova cartella.",
+    "movedCount": "Spostati {count} file cifrati",
+    "importedCount": "Cifrati {count} file",
+    "emptyFolderAdded": "Cartella aggiunta — non conteneva file da cifrare",
+    "emptyTitle": "Qui non ci sono ancora file",
+    "emptyBody": "Aggiungi file o un'intera cartella. Ogni file viene cifrato in un oggetto .mydt con nome casuale; nome, tipo e contenuto originali sono visibili solo qui.",
+    "name": "Nome",
+    "size": "Dimensione",
+    "modified": "Modificato",
+    "actions": "Azioni",
+    "expand": "Espandi",
+    "collapse": "Comprimi",
+    "preview": "Anteprima",
+    "noPreview": "Nessuna anteprima per questo tipo di file — esportalo per aprirlo in un'altra app.",
+    "export": "Esporta",
+    "exportWarningTitle": "Esportare una copia decifrata?",
+    "exportWarningBody": "Il file verrà scritto in chiaro nella posizione scelta. Qualsiasi cosa su quel dispositivo potrà leggerlo.",
+    "exported": "Copia decifrata esportata",
+    "replace": "Sostituisci contenuto…",
+    "replaced": "Contenuto del file sostituito",
+    "rename": "Rinomina",
+    "fileName": "Nome del file",
+    "move": "Sposta in una cartella",
+    "targetFolder": "Cartella",
+    "targetFolderHint": "Usa le barre per le cartelle annidate, ad esempio progetto/config. Lascia vuoto per il livello principale.",
+    "folderName": "Nome della cartella",
+    "delete": "Elimina",
+    "deleted": "File eliminato",
+    "deletedCount": "Eliminati {count} file",
+    "deleteFileTitle": "Eliminare questo file?",
+    "deleteFileBody": "«{name}» verrà rimosso definitivamente dalla cartella di archiviazione cifrata.",
+    "deleteFolderTitle": "Eliminare questa cartella?",
+    "deleteFolderBody": "Ogni file in «{dir}» verrà rimosso definitivamente dalla cartella di archiviazione cifrata.",
+    "unreadableCount": "File illeggibili nella cartella di archiviazione: {count}",
+    "unreadableHint": "Sono stati cifrati con un'altra password principale, appartengono a un'altra cassaforte o sono danneggiati.",
+    "dismiss": "Ignora",
+    "viewGrid": "Vista a griglia",
+    "viewList": "Vista a elenco",
+    "footerNote": "File fino a 20 MB. Cifrati con Argon2id + XChaCha20-Poly1305; la chiave resta in memoria solo finché la cassaforte è sbloccata.",
+    "cancel": "Annulla",
+    "save": "Salva"
   }
 }
diff --git a/apps/desktop-ui/messages/ja.json b/apps/desktop-ui/messages/ja.json
index 5f1912a8..8346d71c 100644
--- a/apps/desktop-ui/messages/ja.json
+++ b/apps/desktop-ui/messages/ja.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook テスター",
     "websocketTester": "WebSocket テスター",
     "whoisLookup": "Whois 検索",
-    "secureFiles": "Files"
+    "secureFiles": "ファイル"
   },
   "Help": {
     "title": "ヘルプとドキュメント",
@@ -654,8 +654,8 @@
         "description": "RDAP を使ってドメインと IP の登録情報を調べます。"
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "ファイル",
+        "description": "ファイルやフォルダーを名前が伏せられた .mydt オブジェクトに暗号化。ロック解除後に閲覧・プレビューできます。"
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "ファイル",
+    "subtitle": "ロックを解除するまで非公開のままのファイル — 端末上で暗号化され、ディスク上では名前が伏せられます",
+    "desktopOnly": "Secure Files はデスクトップアプリでご利用いただけます。",
+    "allFiles": "すべてのファイル",
+    "overview": "概要",
+    "statFiles": "ファイル",
+    "statFolders": "フォルダー",
+    "statContent": "コンテンツのサイズ",
+    "statContentHint": "元のファイルの合計サイズ",
+    "statOnDisk": "ディスク上",
+    "statOverhead": "暗号化のオーバーヘッド {size}",
+    "byType": "種類別",
+    "fileCount": "{count, plural, other {# 個のファイル}}",
+    "largestFiles": "サイズの大きいファイル",
+    "recentlyAdded": "最近追加",
+    "openContainingFolder": "含まれるフォルダーを開く",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "画像",
+      "video": "動画",
+      "audio": "音声",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "アーカイブ",
+      "code": "コード",
+      "doc": "ドキュメント",
+      "sheet": "スプレッドシート",
+      "file": "その他"
+    },
+    "breadcrumb": "フォルダーのパス",
+    "addFiles": "ファイルを追加",
+    "addFolder": "フォルダーを追加",
+    "importFolder": "フォルダーを取り込む",
+    "newFolder": "新しいフォルダー",
+    "lock": "ロック",
+    "settings": "保存設定",
+    "storageFolder": "保存フォルダー",
+    "notSet": "未設定",
+    "chooseFolder": "フォルダーを選択",
+    "changeFolder": "フォルダーを変更…",
+    "chooseFolderTitle": "暗号化ファイルの保存先を選択",
+    "chooseFolderBody": "この端末または外付けドライブの任意のフォルダーを選んでください。MyDevTools の外からは、名前が伏せられた .mydt ファイルしか見えません。",
+    "changeFolderTitle": "暗号化ファイルを移動しますか？",
+    "changeFolderBody": "すべての .mydt ファイルが現在の保存フォルダーから、次に選ぶフォルダーへ移動されます。",
+    "folderSet": "保存フォルダーを設定しました",
+    "folderMissingTitle": "保存フォルダーが見つかりません",
+    "folderMissingBody": "「{dir}」は利用できません。取り外されたドライブ上にあるか、別のマシンから復元したバックアップのものである可能性があります。再接続するか、新しいフォルダーを選んでください。",
+    "movedCount": "暗号化ファイル {count} 個を移動しました",
+    "importedCount": "{count} 個のファイルを暗号化しました",
+    "emptyFolderAdded": "フォルダーを追加しました — 暗号化するファイルはありませんでした",
+    "emptyTitle": "ここにはまだファイルがありません",
+    "emptyBody": "ファイルまたはフォルダー全体を追加してください。各ファイルはランダムな名前の .mydt オブジェクトに暗号化され、元の名前・種類・内容はここでのみ表示されます。",
+    "name": "名前",
+    "size": "サイズ",
+    "modified": "更新日",
+    "actions": "操作",
+    "expand": "展開",
+    "collapse": "折りたたむ",
+    "preview": "プレビュー",
+    "noPreview": "この種類のファイルはプレビューできません — 書き出して別のアプリで開いてください。",
+    "export": "書き出す",
+    "exportWarningTitle": "復号したコピーを書き出しますか？",
+    "exportWarningBody": "選択した場所にファイルが暗号化されないまま書き込まれます。その端末上の何からでも読み取れる状態になります。",
+    "exported": "復号したコピーを書き出しました",
+    "replace": "内容を置き換える…",
+    "replaced": "ファイルの内容を置き換えました",
+    "rename": "名前を変更",
+    "fileName": "ファイル名",
+    "move": "フォルダーへ移動",
+    "targetFolder": "フォルダー",
+    "targetFolderHint": "入れ子のフォルダーはスラッシュで指定します（例: project/config）。最上位に置く場合は空のままにします。",
+    "folderName": "フォルダー名",
+    "delete": "削除",
+    "deleted": "ファイルを削除しました",
+    "deletedCount": "{count} 個のファイルを削除しました",
+    "deleteFileTitle": "このファイルを削除しますか？",
+    "deleteFileBody": "「{name}」は暗号化保存フォルダーから完全に削除されます。",
+    "deleteFolderTitle": "このフォルダーを削除しますか？",
+    "deleteFolderBody": "「{dir}」内のすべてのファイルが暗号化保存フォルダーから完全に削除されます。",
+    "unreadableCount": "保存フォルダー内の読み取れないファイル: {count}",
+    "unreadableHint": "別のマスターパスワードで暗号化されている、別の保管庫のものである、または破損しています。",
+    "dismiss": "閉じる",
+    "viewGrid": "グリッド表示",
+    "viewList": "リスト表示",
+    "footerNote": "20 MB までのファイル。Argon2id + XChaCha20-Poly1305 で暗号化され、鍵は保管庫のロック解除中のみメモリー上に保持されます。",
+    "cancel": "キャンセル",
+    "save": "保存"
   }
 }
diff --git a/apps/desktop-ui/messages/ko.json b/apps/desktop-ui/messages/ko.json
index 0c46fab1..42fffd4a 100644
--- a/apps/desktop-ui/messages/ko.json
+++ b/apps/desktop-ui/messages/ko.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook 테스터",
     "websocketTester": "WebSocket 테스터",
     "whoisLookup": "Whois 조회",
-    "secureFiles": "Files"
+    "secureFiles": "파일"
   },
   "Help": {
     "title": "도움말 및 문서",
@@ -654,8 +654,8 @@
         "description": "RDAP를 통해 도메인과 IP 등록 정보를 조회합니다."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "파일",
+        "description": "파일과 폴더를 이름이 가려진 .mydt 객체로 암호화하고, 잠금을 해제한 뒤 탐색·미리 볼 수 있습니다."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "파일",
+    "subtitle": "잠금을 해제할 때까지 비공개로 유지되는 파일 — 기기에서 암호화되고 디스크에서는 이름이 가려집니다",
+    "desktopOnly": "Secure Files는 데스크톱 앱에서 사용할 수 있습니다.",
+    "allFiles": "모든 파일",
+    "overview": "개요",
+    "statFiles": "파일",
+    "statFolders": "폴더",
+    "statContent": "콘텐츠 크기",
+    "statContentHint": "원본 파일의 전체 크기",
+    "statOnDisk": "디스크 사용량",
+    "statOverhead": "암호화 오버헤드 {size}",
+    "byType": "유형별",
+    "fileCount": "{count, plural, other {파일 #개}}",
+    "largestFiles": "가장 큰 파일",
+    "recentlyAdded": "최근 추가됨",
+    "openContainingFolder": "포함된 폴더 열기",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "이미지",
+      "video": "동영상",
+      "audio": "오디오",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "압축 파일",
+      "code": "코드",
+      "doc": "문서",
+      "sheet": "스프레드시트",
+      "file": "기타"
+    },
+    "breadcrumb": "폴더 경로",
+    "addFiles": "파일 추가",
+    "addFolder": "폴더 추가",
+    "importFolder": "폴더 가져오기",
+    "newFolder": "새 폴더",
+    "lock": "잠그기",
+    "settings": "저장 설정",
+    "storageFolder": "저장 폴더",
+    "notSet": "설정되지 않음",
+    "chooseFolder": "폴더 선택",
+    "changeFolder": "폴더 변경…",
+    "chooseFolderTitle": "암호화된 파일을 저장할 위치 선택",
+    "chooseFolderBody": "이 기기나 외장 드라이브의 아무 폴더나 선택하세요. MyDevTools 밖에서는 이름이 가려진 .mydt 파일만 들어 있습니다.",
+    "changeFolderTitle": "암호화된 파일을 옮길까요?",
+    "changeFolderBody": "모든 .mydt 파일이 현재 저장 폴더에서 다음에 선택할 폴더로 이동됩니다.",
+    "folderSet": "저장 폴더를 설정했습니다",
+    "folderMissingTitle": "저장 폴더를 찾을 수 없음",
+    "folderMissingBody": "'{dir}'을(를) 사용할 수 없습니다. 연결이 해제된 드라이브에 있거나 다른 컴퓨터에서 복원한 백업의 폴더일 수 있습니다. 다시 연결하거나 새 폴더를 선택하세요.",
+    "movedCount": "암호화된 파일 {count}개를 옮겼습니다",
+    "importedCount": "파일 {count}개를 암호화했습니다",
+    "emptyFolderAdded": "폴더를 추가했습니다 — 암호화할 파일이 없었습니다",
+    "emptyTitle": "아직 파일이 없습니다",
+    "emptyBody": "파일이나 폴더 전체를 추가하세요. 각 파일은 임의의 이름을 가진 .mydt 객체로 암호화되며, 원래 이름과 유형, 내용은 여기에서만 보입니다.",
+    "name": "이름",
+    "size": "크기",
+    "modified": "수정일",
+    "actions": "작업",
+    "expand": "펼치기",
+    "collapse": "접기",
+    "preview": "미리보기",
+    "noPreview": "이 파일 형식은 미리 볼 수 없습니다 — 내보낸 뒤 다른 앱에서 여세요.",
+    "export": "내보내기",
+    "exportWarningTitle": "복호화된 사본을 내보낼까요?",
+    "exportWarningBody": "선택한 위치에 파일이 암호화되지 않은 상태로 저장됩니다. 그 기기의 무엇이든 읽을 수 있습니다.",
+    "exported": "복호화된 사본을 내보냈습니다",
+    "replace": "내용 바꾸기…",
+    "replaced": "파일 내용을 바꿨습니다",
+    "rename": "이름 바꾸기",
+    "fileName": "파일 이름",
+    "move": "폴더로 이동",
+    "targetFolder": "폴더",
+    "targetFolderHint": "중첩 폴더는 슬래시로 구분합니다. 예: project/config. 최상위에 두려면 비워 두세요.",
+    "folderName": "폴더 이름",
+    "delete": "삭제",
+    "deleted": "파일을 삭제했습니다",
+    "deletedCount": "파일 {count}개를 삭제했습니다",
+    "deleteFileTitle": "이 파일을 삭제할까요?",
+    "deleteFileBody": "'{name}'이(가) 암호화된 저장 폴더에서 영구히 삭제됩니다.",
+    "deleteFolderTitle": "이 폴더를 삭제할까요?",
+    "deleteFolderBody": "'{dir}' 아래의 모든 파일이 암호화된 저장 폴더에서 영구히 삭제됩니다.",
+    "unreadableCount": "저장 폴더에서 읽을 수 없는 파일: {count}",
+    "unreadableHint": "다른 마스터 비밀번호로 암호화되었거나, 다른 보관함에 속하거나, 손상되었습니다.",
+    "dismiss": "닫기",
+    "viewGrid": "그리드 보기",
+    "viewList": "목록 보기",
+    "footerNote": "최대 20MB 파일. Argon2id + XChaCha20-Poly1305로 암호화되며, 키는 보관함이 잠금 해제된 동안에만 메모리에 유지됩니다.",
+    "cancel": "취소",
+    "save": "저장"
   }
 }
diff --git a/apps/desktop-ui/messages/ms.json b/apps/desktop-ui/messages/ms.json
index 9ec7ffbc..cccb3098 100644
--- a/apps/desktop-ui/messages/ms.json
+++ b/apps/desktop-ui/messages/ms.json
@@ -77,7 +77,7 @@
     "webhookTester": "Penguji Webhook",
     "websocketTester": "Penguji WebSocket",
     "whoisLookup": "Carian Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Fail"
   },
   "Help": {
     "title": "Bantuan & Dokumentasi",
@@ -657,8 +657,8 @@
         "description": "Cari butiran pendaftaran domain dan IP melalui RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Fail",
+        "description": "Sulitkan fail dan folder menjadi objek .mydt bernama samar; layari dan pratonton selepas dibuka kunci."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Fail",
+    "subtitle": "Fail yang kekal peribadi sehingga anda membukanya — disulitkan pada peranti anda, disamarkan pada cakera",
+    "desktopOnly": "Secure Files tersedia dalam aplikasi desktop.",
+    "allFiles": "Semua fail",
+    "overview": "Gambaran keseluruhan",
+    "statFiles": "Fail",
+    "statFolders": "Folder",
+    "statContent": "Saiz kandungan",
+    "statContentHint": "Jumlah saiz fail asal",
+    "statOnDisk": "Pada cakera",
+    "statOverhead": "{size} overhed penyulitan",
+    "byType": "Mengikut jenis",
+    "fileCount": "{count, plural, other {# fail}}",
+    "largestFiles": "Fail terbesar",
+    "recentlyAdded": "Baru ditambah",
+    "openContainingFolder": "Buka folder yang mengandunginya",
     "types": {
-      "image": "Images",
+      "image": "Imej",
       "video": "Video",
       "audio": "Audio",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Arkib",
+      "code": "Kod",
+      "doc": "Dokumen",
+      "sheet": "Hamparan",
+      "file": "Lain-lain"
+    },
+    "breadcrumb": "Laluan folder",
+    "addFiles": "Tambah fail",
+    "addFolder": "Tambah folder",
+    "importFolder": "Import folder",
+    "newFolder": "Folder baharu",
+    "lock": "Kunci",
+    "settings": "Tetapan storan",
+    "storageFolder": "Folder storan",
+    "notSet": "Belum ditetapkan",
+    "chooseFolder": "Pilih folder",
+    "changeFolder": "Tukar folder…",
+    "chooseFolderTitle": "Pilih tempat fail tersulit disimpan",
+    "chooseFolderBody": "Pilih mana-mana folder pada peranti ini atau pemacu luaran. Di luar MyDevTools, ia hanya mengandungi fail .mydt bernama samar.",
+    "changeFolderTitle": "Alihkan fail tersulit?",
+    "changeFolderBody": "Semua fail .mydt akan dialihkan dari folder storan semasa ke folder yang anda pilih seterusnya.",
+    "folderSet": "Folder storan ditetapkan",
+    "folderMissingTitle": "Folder storan tidak dijumpai",
+    "folderMissingBody": "“{dir}” tidak tersedia — ia mungkin berada pada pemacu yang dicabut atau berasal daripada sandaran yang dipulihkan dari mesin lain. Sambungkan semula, atau pilih folder baharu.",
+    "movedCount": "{count} fail tersulit dialihkan",
+    "importedCount": "{count} fail disulitkan",
+    "emptyFolderAdded": "Folder ditambah — tiada fail untuk disulitkan",
+    "emptyTitle": "Belum ada fail di sini",
+    "emptyBody": "Tambah fail atau satu folder penuh. Setiap fail disulitkan menjadi objek .mydt bernama rawak; nama, jenis dan kandungan asal hanya kelihatan di sini.",
+    "name": "Nama",
+    "size": "Saiz",
+    "modified": "Diubah suai",
+    "actions": "Tindakan",
+    "expand": "Kembangkan",
+    "collapse": "Kuncupkan",
+    "preview": "Pratonton",
+    "noPreview": "Tiada pratonton untuk jenis fail ini — eksport untuk membukanya dalam aplikasi lain.",
+    "export": "Eksport",
+    "exportWarningTitle": "Eksport salinan yang telah dinyahsulit?",
+    "exportWarningBody": "Fail akan ditulis tanpa sulitan ke lokasi yang anda pilih. Apa-apa pada peranti itu boleh membacanya.",
+    "exported": "Salinan dinyahsulit dieksport",
+    "replace": "Ganti kandungan…",
+    "replaced": "Kandungan fail diganti",
+    "rename": "Namakan semula",
+    "fileName": "Nama fail",
+    "move": "Alihkan ke folder",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Gunakan garis miring untuk folder bersarang, contohnya projek/config. Biarkan kosong untuk aras teratas.",
+    "folderName": "Nama folder",
+    "delete": "Padam",
+    "deleted": "Fail dipadam",
+    "deletedCount": "{count} fail dipadam",
+    "deleteFileTitle": "Padam fail ini?",
+    "deleteFileBody": "“{name}” akan dibuang secara kekal daripada folder storan tersulit.",
+    "deleteFolderTitle": "Padam folder ini?",
+    "deleteFolderBody": "Setiap fail dalam “{dir}” akan dibuang secara kekal daripada folder storan tersulit.",
+    "unreadableCount": "Fail tidak boleh dibaca dalam folder storan: {count}",
+    "unreadableHint": "Ia disulitkan dengan kata laluan induk lain, milik peti besi lain, atau telah rosak.",
+    "dismiss": "Tutup",
+    "viewGrid": "Paparan grid",
+    "viewList": "Paparan senarai",
+    "footerNote": "Fail sehingga 20 MB. Disulitkan dengan Argon2id + XChaCha20-Poly1305; kunci hanya berada dalam ingatan selagi peti besi dibuka.",
+    "cancel": "Batal",
+    "save": "Simpan"
   }
 }
diff --git a/apps/desktop-ui/messages/nb.json b/apps/desktop-ui/messages/nb.json
index 28bc919e..c38c9936 100644
--- a/apps/desktop-ui/messages/nb.json
+++ b/apps/desktop-ui/messages/nb.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook-tester",
     "websocketTester": "WebSocket-tester",
     "whoisLookup": "Whois-oppslag",
-    "secureFiles": "Files"
+    "secureFiles": "Filer"
   },
   "Help": {
     "title": "Hjelp og dokumentasjon",
@@ -654,8 +654,8 @@
         "description": "Slå opp registreringsdetaljer for domene og IP via RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Filer",
+        "description": "Krypter filer og mapper til maskerte .mydt-objekter; bla gjennom og forhåndsvis dem etter opplåsing."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Filer",
+    "subtitle": "Filer som forblir private til du låser dem opp — kryptert på enheten din, maskert på disken",
+    "desktopOnly": "Secure Files er tilgjengelig i skrivebordsappen.",
+    "allFiles": "Alle filer",
+    "overview": "Oversikt",
+    "statFiles": "Filer",
+    "statFolders": "Mapper",
+    "statContent": "Innholdsstørrelse",
+    "statContentHint": "Samlet størrelse på originalfilene",
+    "statOnDisk": "På disk",
+    "statOverhead": "{size} krypteringsoverhead",
+    "byType": "Etter type",
+    "fileCount": "{count, plural, one {# fil} other {# filer}}",
+    "largestFiles": "Største filer",
+    "recentlyAdded": "Nylig lagt til",
+    "openContainingFolder": "Åpne overordnet mappe",
     "types": {
-      "image": "Images",
+      "image": "Bilder",
       "video": "Video",
-      "audio": "Audio",
+      "audio": "Lyd",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Arkiver",
+      "code": "Kode",
+      "doc": "Dokumenter",
+      "sheet": "Regneark",
+      "file": "Annet"
+    },
+    "breadcrumb": "Mappebane",
+    "addFiles": "Legg til filer",
+    "addFolder": "Legg til mappe",
+    "importFolder": "Importer mappe",
+    "newFolder": "Ny mappe",
+    "lock": "Lås",
+    "settings": "Lagringsinnstillinger",
+    "storageFolder": "Lagringsmappe",
+    "notSet": "Ikke angitt",
+    "chooseFolder": "Velg mappe",
+    "changeFolder": "Bytt mappe…",
+    "chooseFolderTitle": "Velg hvor krypterte filer lagres",
+    "chooseFolderBody": "Velg hvilken som helst mappe på denne enheten eller en ekstern disk. Utenfor MyDevTools inneholder den bare maskerte .mydt-filer.",
+    "changeFolderTitle": "Flytte krypterte filer?",
+    "changeFolderBody": "Alle .mydt-filer flyttes fra den nåværende lagringsmappen til den du velger nå.",
+    "folderSet": "Lagringsmappe angitt",
+    "folderMissingTitle": "Fant ikke lagringsmappen",
+    "folderMissingBody": "«{dir}» er ikke tilgjengelig — den kan ligge på en frakoblet disk eller stamme fra en gjenopprettet sikkerhetskopi fra en annen maskin. Koble den til igjen, eller velg en ny mappe.",
+    "movedCount": "Flyttet {count} krypterte filer",
+    "importedCount": "Krypterte {count} filer",
+    "emptyFolderAdded": "Mappe lagt til — den inneholdt ingen filer å kryptere",
+    "emptyTitle": "Ingen filer her ennå",
+    "emptyBody": "Legg til filer eller en hel mappe. Hver fil krypteres til et .mydt-objekt med tilfeldig navn; opprinnelig navn, type og innhold vises bare her.",
+    "name": "Navn",
+    "size": "Størrelse",
+    "modified": "Endret",
+    "actions": "Handlinger",
+    "expand": "Utvid",
+    "collapse": "Skjul",
+    "preview": "Forhåndsvisning",
+    "noPreview": "Ingen forhåndsvisning for denne filtypen — eksporter den for å åpne den i en annen app.",
+    "export": "Eksporter",
+    "exportWarningTitle": "Eksportere en dekryptert kopi?",
+    "exportWarningBody": "Filen skrives ukryptert til stedet du velger. Alt på den enheten kan lese den.",
+    "exported": "Dekryptert kopi eksportert",
+    "replace": "Erstatt innhold…",
+    "replaced": "Filinnholdet ble erstattet",
+    "rename": "Gi nytt navn",
+    "fileName": "Filnavn",
+    "move": "Flytt til mappe",
+    "targetFolder": "Mappe",
+    "targetFolderHint": "Bruk skråstreker for nestede mapper, for eksempel prosjekt/config. La feltet stå tomt for øverste nivå.",
+    "folderName": "Mappenavn",
+    "delete": "Slett",
+    "deleted": "Filen ble slettet",
+    "deletedCount": "Slettet {count} filer",
+    "deleteFileTitle": "Slette denne filen?",
+    "deleteFileBody": "«{name}» fjernes permanent fra den krypterte lagringsmappen.",
+    "deleteFolderTitle": "Slette denne mappen?",
+    "deleteFolderBody": "Alle filer under «{dir}» fjernes permanent fra den krypterte lagringsmappen.",
+    "unreadableCount": "Uleselige filer i lagringsmappen: {count}",
+    "unreadableHint": "De ble kryptert med et annet hovedpassord, hører til et annet hvelv eller er skadet.",
+    "dismiss": "Lukk",
+    "viewGrid": "Rutenettvisning",
+    "viewList": "Listevisning",
+    "footerNote": "Filer opptil 20 MB. Kryptert med Argon2id + XChaCha20-Poly1305; nøkkelen finnes bare i minnet mens hvelvet er låst opp.",
+    "cancel": "Avbryt",
+    "save": "Lagre"
   }
 }
diff --git a/apps/desktop-ui/messages/nl.json b/apps/desktop-ui/messages/nl.json
index d441563b..af234c08 100644
--- a/apps/desktop-ui/messages/nl.json
+++ b/apps/desktop-ui/messages/nl.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook-tester",
     "websocketTester": "WebSocket-tester",
     "whoisLookup": "Whois-opzoeking",
-    "secureFiles": "Files"
+    "secureFiles": "Bestanden"
   },
   "Help": {
     "title": "Help en documentatie",
@@ -654,8 +654,8 @@
         "description": "Zoek registratiegegevens van een domein of IP op via RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Bestanden",
+        "description": "Versleutel bestanden en mappen tot gemaskeerde .mydt-objecten; blader en bekijk ze na ontgrendeling."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Bestanden",
+    "subtitle": "Bestanden die privé blijven tot je ze ontgrendelt — versleuteld op je apparaat, gemaskeerd op schijf",
+    "desktopOnly": "Secure Files is beschikbaar in de desktop-app.",
+    "allFiles": "Alle bestanden",
+    "overview": "Overzicht",
+    "statFiles": "Bestanden",
+    "statFolders": "Mappen",
+    "statContent": "Inhoudsgrootte",
+    "statContentHint": "Totale grootte van de originele bestanden",
+    "statOnDisk": "Op schijf",
+    "statOverhead": "{size} versleutelingsoverhead",
+    "byType": "Op type",
+    "fileCount": "{count, plural, one {# bestand} other {# bestanden}}",
+    "largestFiles": "Grootste bestanden",
+    "recentlyAdded": "Onlangs toegevoegd",
+    "openContainingFolder": "Bovenliggende map openen",
     "types": {
-      "image": "Images",
+      "image": "Afbeeldingen",
       "video": "Video",
       "audio": "Audio",
       "pdf": "PDF",
-      "archive": "Archives",
+      "archive": "Archieven",
       "code": "Code",
-      "doc": "Documents",
+      "doc": "Documenten",
       "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "file": "Overig"
+    },
+    "breadcrumb": "Mappad",
+    "addFiles": "Bestanden toevoegen",
+    "addFolder": "Map toevoegen",
+    "importFolder": "Map importeren",
+    "newFolder": "Nieuwe map",
+    "lock": "Vergrendelen",
+    "settings": "Opslaginstellingen",
+    "storageFolder": "Opslagmap",
+    "notSet": "Niet ingesteld",
+    "chooseFolder": "Map kiezen",
+    "changeFolder": "Map wijzigen…",
+    "chooseFolderTitle": "Kies waar versleutelde bestanden worden opgeslagen",
+    "chooseFolderBody": "Kies een willekeurige map op dit apparaat of op een externe schijf. Buiten MyDevTools bevat die uitsluitend gemaskeerde .mydt-bestanden.",
+    "changeFolderTitle": "Versleutelde bestanden verplaatsen?",
+    "changeFolderBody": "Alle .mydt-bestanden worden van de huidige opslagmap naar de map verplaatst die je hierna kiest.",
+    "folderSet": "Opslagmap ingesteld",
+    "folderMissingTitle": "Opslagmap niet gevonden",
+    "folderMissingBody": "„{dir}” is niet beschikbaar — de map staat mogelijk op een losgekoppelde schijf of komt uit een teruggezette back-up van een andere machine. Sluit de schijf weer aan of kies een nieuwe map.",
+    "movedCount": "{count} versleutelde bestanden verplaatst",
+    "importedCount": "{count} bestanden versleuteld",
+    "emptyFolderAdded": "Map toegevoegd — er waren geen bestanden om te versleutelen",
+    "emptyTitle": "Hier staan nog geen bestanden",
+    "emptyBody": "Voeg bestanden of een hele map toe. Elk bestand wordt versleuteld tot een .mydt-object met een willekeurige naam; de originele naam, het type en de inhoud zijn alleen hier zichtbaar.",
+    "name": "Naam",
+    "size": "Grootte",
+    "modified": "Gewijzigd",
+    "actions": "Acties",
+    "expand": "Uitvouwen",
+    "collapse": "Samenvouwen",
+    "preview": "Voorbeeld",
+    "noPreview": "Geen voorbeeld voor dit bestandstype — exporteer het om het in een andere app te openen.",
+    "export": "Exporteren",
+    "exportWarningTitle": "Een ontsleutelde kopie exporteren?",
+    "exportWarningBody": "Het bestand wordt onversleuteld naar de gekozen locatie geschreven. Alles op dat apparaat kan het lezen.",
+    "exported": "Ontsleutelde kopie geëxporteerd",
+    "replace": "Inhoud vervangen…",
+    "replaced": "Bestandsinhoud vervangen",
+    "rename": "Naam wijzigen",
+    "fileName": "Bestandsnaam",
+    "move": "Naar map verplaatsen",
+    "targetFolder": "Map",
+    "targetFolderHint": "Gebruik schuine strepen voor geneste mappen, bijvoorbeeld project/config. Laat leeg voor het hoogste niveau.",
+    "folderName": "Mapnaam",
+    "delete": "Verwijderen",
+    "deleted": "Bestand verwijderd",
+    "deletedCount": "{count} bestanden verwijderd",
+    "deleteFileTitle": "Dit bestand verwijderen?",
+    "deleteFileBody": "„{name}” wordt definitief uit de versleutelde opslagmap verwijderd.",
+    "deleteFolderTitle": "Deze map verwijderen?",
+    "deleteFolderBody": "Elk bestand onder „{dir}” wordt definitief uit de versleutelde opslagmap verwijderd.",
+    "unreadableCount": "Onleesbare bestanden in de opslagmap: {count}",
+    "unreadableHint": "Ze zijn versleuteld met een ander hoofdwachtwoord, horen bij een andere kluis of zijn beschadigd.",
+    "dismiss": "Sluiten",
+    "viewGrid": "Rasterweergave",
+    "viewList": "Lijstweergave",
+    "footerNote": "Bestanden tot 20 MB. Versleuteld met Argon2id + XChaCha20-Poly1305; de sleutel blijft alleen in het geheugen zolang de kluis ontgrendeld is.",
+    "cancel": "Annuleren",
+    "save": "Opslaan"
   }
 }
diff --git a/apps/desktop-ui/messages/pl.json b/apps/desktop-ui/messages/pl.json
index df49af48..4a0bda1a 100644
--- a/apps/desktop-ui/messages/pl.json
+++ b/apps/desktop-ui/messages/pl.json
@@ -77,7 +77,7 @@
     "webhookTester": "Tester webhooków",
     "websocketTester": "Tester WebSocket",
     "whoisLookup": "Zapytanie Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Pliki"
   },
   "Help": {
     "title": "Pomoc i dokumentacja",
@@ -654,8 +654,8 @@
         "description": "Sprawdzaj dane rejestracyjne domen i adresów IP przez RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Pliki",
+        "description": "Szyfruj pliki i foldery do zamaskowanych obiektów .mydt; przeglądaj je po odblokowaniu."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Pliki",
+    "subtitle": "Pliki pozostają prywatne, dopóki ich nie odblokujesz — zaszyfrowane na urządzeniu, zamaskowane na dysku",
+    "desktopOnly": "Secure Files jest dostępny w aplikacji desktopowej.",
+    "allFiles": "Wszystkie pliki",
+    "overview": "Przegląd",
+    "statFiles": "Pliki",
+    "statFolders": "Foldery",
+    "statContent": "Rozmiar zawartości",
+    "statContentHint": "Łączny rozmiar oryginalnych plików",
+    "statOnDisk": "Na dysku",
+    "statOverhead": "{size} narzutu szyfrowania",
+    "byType": "Według typu",
+    "fileCount": "{count, plural, one {# plik} few {# pliki} many {# plików} other {# pliku}}",
+    "largestFiles": "Największe pliki",
+    "recentlyAdded": "Ostatnio dodane",
+    "openContainingFolder": "Otwórz folder nadrzędny",
     "types": {
-      "image": "Images",
-      "video": "Video",
+      "image": "Obrazy",
+      "video": "Wideo",
       "audio": "Audio",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Archiwa",
+      "code": "Kod",
+      "doc": "Dokumenty",
+      "sheet": "Arkusze kalkulacyjne",
+      "file": "Inne"
+    },
+    "breadcrumb": "Ścieżka folderu",
+    "addFiles": "Dodaj pliki",
+    "addFolder": "Dodaj folder",
+    "importFolder": "Importuj folder",
+    "newFolder": "Nowy folder",
+    "lock": "Zablokuj",
+    "settings": "Ustawienia magazynu",
+    "storageFolder": "Folder magazynu",
+    "notSet": "Nie ustawiono",
+    "chooseFolder": "Wybierz folder",
+    "changeFolder": "Zmień folder…",
+    "chooseFolderTitle": "Wybierz, gdzie przechowywać zaszyfrowane pliki",
+    "chooseFolderBody": "Wybierz dowolny folder na tym urządzeniu lub na dysku zewnętrznym. Poza MyDevTools zawiera on wyłącznie zamaskowane pliki .mydt.",
+    "changeFolderTitle": "Przenieść zaszyfrowane pliki?",
+    "changeFolderBody": "Wszystkie pliki .mydt zostaną przeniesione z bieżącego folderu magazynu do tego, który wybierzesz teraz.",
+    "folderSet": "Folder magazynu ustawiony",
+    "folderMissingTitle": "Nie znaleziono folderu magazynu",
+    "folderMissingBody": "„{dir}” jest niedostępny — może znajdować się na odłączonym dysku albo pochodzić z kopii zapasowej przywróconej z innego komputera. Podłącz go ponownie lub wybierz nowy folder.",
+    "movedCount": "Przeniesiono zaszyfrowane pliki: {count}",
+    "importedCount": "Zaszyfrowano pliki: {count}",
+    "emptyFolderAdded": "Folder dodany — nie zawierał plików do zaszyfrowania",
+    "emptyTitle": "Nie ma tu jeszcze plików",
+    "emptyBody": "Dodaj pliki lub cały folder. Każdy plik jest szyfrowany do obiektu .mydt o losowej nazwie; oryginalna nazwa, typ i zawartość są widoczne tylko tutaj.",
+    "name": "Nazwa",
+    "size": "Rozmiar",
+    "modified": "Zmodyfikowano",
+    "actions": "Akcje",
+    "expand": "Rozwiń",
+    "collapse": "Zwiń",
+    "preview": "Podgląd",
+    "noPreview": "Brak podglądu dla tego typu pliku — wyeksportuj go, aby otworzyć w innej aplikacji.",
+    "export": "Eksportuj",
+    "exportWarningTitle": "Wyeksportować odszyfrowaną kopię?",
+    "exportWarningBody": "Plik zostanie zapisany bez szyfrowania w wybranej lokalizacji. Odczyta go wszystko na tym urządzeniu.",
+    "exported": "Odszyfrowana kopia wyeksportowana",
+    "replace": "Zastąp zawartość…",
+    "replaced": "Zawartość pliku zastąpiona",
+    "rename": "Zmień nazwę",
+    "fileName": "Nazwa pliku",
+    "move": "Przenieś do folderu",
+    "targetFolder": "Folder",
+    "targetFolderHint": "Użyj ukośników dla folderów zagnieżdżonych, na przykład projekt/config. Pozostaw puste dla najwyższego poziomu.",
+    "folderName": "Nazwa folderu",
+    "delete": "Usuń",
+    "deleted": "Plik usunięty",
+    "deletedCount": "Usunięto pliki: {count}",
+    "deleteFileTitle": "Usunąć ten plik?",
+    "deleteFileBody": "„{name}” zostanie trwale usunięty z zaszyfrowanego folderu magazynu.",
+    "deleteFolderTitle": "Usunąć ten folder?",
+    "deleteFolderBody": "Każdy plik w „{dir}” zostanie trwale usunięty z zaszyfrowanego folderu magazynu.",
+    "unreadableCount": "Nieczytelne pliki w folderze magazynu: {count}",
+    "unreadableHint": "Zaszyfrowano je innym hasłem głównym, należą do innego sejfu albo są uszkodzone.",
+    "dismiss": "Odrzuć",
+    "viewGrid": "Widok siatki",
+    "viewList": "Widok listy",
+    "footerNote": "Pliki do 20 MB. Szyfrowanie Argon2id + XChaCha20-Poly1305; klucz pozostaje w pamięci tylko wtedy, gdy sejf jest odblokowany.",
+    "cancel": "Anuluj",
+    "save": "Zapisz"
   }
 }
diff --git a/apps/desktop-ui/messages/pt-BR.json b/apps/desktop-ui/messages/pt-BR.json
index ec5e0f1f..155e0c9e 100644
--- a/apps/desktop-ui/messages/pt-BR.json
+++ b/apps/desktop-ui/messages/pt-BR.json
@@ -77,7 +77,7 @@
     "webhookTester": "Testador de Webhook",
     "websocketTester": "Testador de WebSocket",
     "whoisLookup": "Consulta Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Arquivos"
   },
   "Help": {
     "title": "Ajuda e documentação",
@@ -654,8 +654,8 @@
         "description": "Consulte detalhes de registro de domínio e IP via RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Arquivos",
+        "description": "Criptografe arquivos e pastas em objetos .mydt mascarados; navegue e visualize depois de desbloquear."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Arquivos",
+    "subtitle": "Arquivos que continuam privados até você desbloqueá-los — criptografados no seu dispositivo, mascarados no disco",
+    "desktopOnly": "O Secure Files está disponível no aplicativo para desktop.",
+    "allFiles": "Todos os arquivos",
+    "overview": "Visão geral",
+    "statFiles": "Arquivos",
+    "statFolders": "Pastas",
+    "statContent": "Tamanho do conteúdo",
+    "statContentHint": "Tamanho total dos arquivos originais",
+    "statOnDisk": "Em disco",
+    "statOverhead": "{size} de sobrecarga de criptografia",
+    "byType": "Por tipo",
+    "fileCount": "{count, plural, one {# arquivo} other {# arquivos}}",
+    "largestFiles": "Maiores arquivos",
+    "recentlyAdded": "Adicionados recentemente",
+    "openContainingFolder": "Abrir a pasta que o contém",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "Imagens",
+      "video": "Vídeo",
+      "audio": "Áudio",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Arquivos compactados",
+      "code": "Código",
+      "doc": "Documentos",
+      "sheet": "Planilhas",
+      "file": "Outros"
+    },
+    "breadcrumb": "Caminho da pasta",
+    "addFiles": "Adicionar arquivos",
+    "addFolder": "Adicionar pasta",
+    "importFolder": "Importar pasta",
+    "newFolder": "Nova pasta",
+    "lock": "Bloquear",
+    "settings": "Configurações de armazenamento",
+    "storageFolder": "Pasta de armazenamento",
+    "notSet": "Não definida",
+    "chooseFolder": "Escolher pasta",
+    "changeFolder": "Mudar pasta…",
+    "chooseFolderTitle": "Escolha onde os arquivos criptografados ficam guardados",
+    "chooseFolderBody": "Escolha qualquer pasta neste dispositivo ou em um drive externo. Fora do MyDevTools ela contém apenas arquivos .mydt mascarados.",
+    "changeFolderTitle": "Mover os arquivos criptografados?",
+    "changeFolderBody": "Todos os arquivos .mydt serão movidos da pasta de armazenamento atual para a que você escolher a seguir.",
+    "folderSet": "Pasta de armazenamento definida",
+    "folderMissingTitle": "Pasta de armazenamento não encontrada",
+    "folderMissingBody": "«{dir}» não está disponível — ela pode estar em um drive desconectado ou vir de um backup restaurado de outra máquina. Reconecte-a ou escolha uma nova pasta.",
+    "movedCount": "{count} arquivos criptografados movidos",
+    "importedCount": "{count} arquivos criptografados",
+    "emptyFolderAdded": "Pasta adicionada — não havia arquivos para criptografar",
+    "emptyTitle": "Ainda não há arquivos aqui",
+    "emptyBody": "Adicione arquivos ou uma pasta inteira. Cada arquivo é criptografado em um objeto .mydt com nome aleatório; o nome, o tipo e o conteúdo originais só aparecem aqui.",
+    "name": "Nome",
+    "size": "Tamanho",
+    "modified": "Modificado",
+    "actions": "Ações",
+    "expand": "Expandir",
+    "collapse": "Recolher",
+    "preview": "Visualização",
+    "noPreview": "Sem visualização para este tipo de arquivo — exporte-o para abrir em outro aplicativo.",
+    "export": "Exportar",
+    "exportWarningTitle": "Exportar uma cópia descriptografada?",
+    "exportWarningBody": "O arquivo será gravado sem criptografia no local escolhido. Qualquer coisa nesse dispositivo poderá lê-lo.",
+    "exported": "Cópia descriptografada exportada",
+    "replace": "Substituir conteúdo…",
+    "replaced": "Conteúdo do arquivo substituído",
+    "rename": "Renomear",
+    "fileName": "Nome do arquivo",
+    "move": "Mover para uma pasta",
+    "targetFolder": "Pasta",
+    "targetFolderHint": "Use barras para pastas aninhadas, por exemplo projeto/config. Deixe vazio para o nível principal.",
+    "folderName": "Nome da pasta",
+    "delete": "Excluir",
+    "deleted": "Arquivo excluído",
+    "deletedCount": "{count} arquivos excluídos",
+    "deleteFileTitle": "Excluir este arquivo?",
+    "deleteFileBody": "«{name}» será removido permanentemente da pasta de armazenamento criptografada.",
+    "deleteFolderTitle": "Excluir esta pasta?",
+    "deleteFolderBody": "Todos os arquivos em «{dir}» serão removidos permanentemente da pasta de armazenamento criptografada.",
+    "unreadableCount": "Arquivos ilegíveis na pasta de armazenamento: {count}",
+    "unreadableHint": "Eles foram criptografados com outra senha mestra, pertencem a outro cofre ou estão corrompidos.",
+    "dismiss": "Dispensar",
+    "viewGrid": "Visualização em grade",
+    "viewList": "Visualização em lista",
+    "footerNote": "Arquivos de até 20 MB. Criptografados com Argon2id + XChaCha20-Poly1305; a chave fica na memória apenas enquanto o cofre está desbloqueado.",
+    "cancel": "Cancelar",
+    "save": "Salvar"
   }
 }
diff --git a/apps/desktop-ui/messages/pt.json b/apps/desktop-ui/messages/pt.json
index 3a4a2f28..5f85bd71 100644
--- a/apps/desktop-ui/messages/pt.json
+++ b/apps/desktop-ui/messages/pt.json
@@ -77,7 +77,7 @@
     "webhookTester": "Testador de webhooks",
     "websocketTester": "Testador de WebSocket",
     "whoisLookup": "Pesquisa Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Ficheiros"
   },
   "Help": {
     "title": "Ajuda e documentação",
@@ -654,8 +654,8 @@
         "description": "Consulte os dados de registo de um domínio ou IP através de RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Ficheiros",
+        "description": "Cifre ficheiros e pastas em objetos .mydt mascarados; navegue e pré-visualize depois de desbloquear."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Ficheiros",
+    "subtitle": "Ficheiros que permanecem privados até os desbloquear — cifrados no seu dispositivo, mascarados no disco",
+    "desktopOnly": "O Secure Files está disponível na aplicação de ambiente de trabalho.",
+    "allFiles": "Todos os ficheiros",
+    "overview": "Visão geral",
+    "statFiles": "Ficheiros",
+    "statFolders": "Pastas",
+    "statContent": "Tamanho do conteúdo",
+    "statContentHint": "Tamanho total dos ficheiros originais",
+    "statOnDisk": "Em disco",
+    "statOverhead": "{size} de sobrecarga de cifragem",
+    "byType": "Por tipo",
+    "fileCount": "{count, plural, one {# ficheiro} other {# ficheiros}}",
+    "largestFiles": "Ficheiros maiores",
+    "recentlyAdded": "Adicionados recentemente",
+    "openContainingFolder": "Abrir a pasta que o contém",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "Imagens",
+      "video": "Vídeo",
+      "audio": "Áudio",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Arquivos",
+      "code": "Código",
+      "doc": "Documentos",
+      "sheet": "Folhas de cálculo",
+      "file": "Outros"
+    },
+    "breadcrumb": "Caminho da pasta",
+    "addFiles": "Adicionar ficheiros",
+    "addFolder": "Adicionar pasta",
+    "importFolder": "Importar pasta",
+    "newFolder": "Nova pasta",
+    "lock": "Bloquear",
+    "settings": "Definições de armazenamento",
+    "storageFolder": "Pasta de armazenamento",
+    "notSet": "Não definida",
+    "chooseFolder": "Escolher pasta",
+    "changeFolder": "Mudar de pasta…",
+    "chooseFolderTitle": "Escolha onde guardar os ficheiros cifrados",
+    "chooseFolderBody": "Escolha qualquer pasta neste dispositivo ou numa unidade externa. Fora do MyDevTools contém apenas ficheiros .mydt mascarados.",
+    "changeFolderTitle": "Mover os ficheiros cifrados?",
+    "changeFolderBody": "Todos os ficheiros .mydt serão movidos da pasta de armazenamento atual para a que escolher a seguir.",
+    "folderSet": "Pasta de armazenamento definida",
+    "folderMissingTitle": "Pasta de armazenamento não encontrada",
+    "folderMissingBody": "«{dir}» não está disponível — pode estar numa unidade desligada ou pertencer a uma cópia de segurança restaurada de outra máquina. Volte a ligá-la ou escolha uma nova pasta.",
+    "movedCount": "Movidos {count} ficheiros cifrados",
+    "importedCount": "Cifrados {count} ficheiros",
+    "emptyFolderAdded": "Pasta adicionada — não continha ficheiros para cifrar",
+    "emptyTitle": "Ainda não há ficheiros aqui",
+    "emptyBody": "Adicione ficheiros ou uma pasta inteira. Cada ficheiro é cifrado num objeto .mydt com nome aleatório; o nome, o tipo e o conteúdo originais só são visíveis aqui.",
+    "name": "Nome",
+    "size": "Tamanho",
+    "modified": "Modificado",
+    "actions": "Ações",
+    "expand": "Expandir",
+    "collapse": "Recolher",
+    "preview": "Pré-visualização",
+    "noPreview": "Sem pré-visualização para este tipo de ficheiro — exporte-o para o abrir noutra aplicação.",
+    "export": "Exportar",
+    "exportWarningTitle": "Exportar uma cópia decifrada?",
+    "exportWarningBody": "O ficheiro será escrito sem cifra no local que escolher. Tudo o que estiver nesse dispositivo o poderá ler.",
+    "exported": "Cópia decifrada exportada",
+    "replace": "Substituir conteúdo…",
+    "replaced": "Conteúdo do ficheiro substituído",
+    "rename": "Mudar o nome",
+    "fileName": "Nome do ficheiro",
+    "move": "Mover para uma pasta",
+    "targetFolder": "Pasta",
+    "targetFolderHint": "Use barras para pastas aninhadas, por exemplo projeto/config. Deixe vazio para o nível superior.",
+    "folderName": "Nome da pasta",
+    "delete": "Eliminar",
+    "deleted": "Ficheiro eliminado",
+    "deletedCount": "Eliminados {count} ficheiros",
+    "deleteFileTitle": "Eliminar este ficheiro?",
+    "deleteFileBody": "«{name}» será removido permanentemente da pasta de armazenamento cifrada.",
+    "deleteFolderTitle": "Eliminar esta pasta?",
+    "deleteFolderBody": "Todos os ficheiros em «{dir}» serão removidos permanentemente da pasta de armazenamento cifrada.",
+    "unreadableCount": "Ficheiros ilegíveis na pasta de armazenamento: {count}",
+    "unreadableHint": "Foram cifrados com outra palavra-passe mestra, pertencem a outro cofre ou estão danificados.",
+    "dismiss": "Dispensar",
+    "viewGrid": "Vista de grelha",
+    "viewList": "Vista de lista",
+    "footerNote": "Ficheiros até 20 MB. Cifrados com Argon2id + XChaCha20-Poly1305; a chave permanece em memória apenas enquanto o cofre está desbloqueado.",
+    "cancel": "Cancelar",
+    "save": "Guardar"
   }
 }
diff --git a/apps/desktop-ui/messages/ru.json b/apps/desktop-ui/messages/ru.json
index 5e206041..3d3aca31 100644
--- a/apps/desktop-ui/messages/ru.json
+++ b/apps/desktop-ui/messages/ru.json
@@ -77,7 +77,7 @@
     "webhookTester": "Тестер вебхуков",
     "websocketTester": "Тестер WebSocket",
     "whoisLookup": "Whois-запрос",
-    "secureFiles": "Files"
+    "secureFiles": "Файлы"
   },
   "Help": {
     "title": "Справка и документация",
@@ -654,8 +654,8 @@
         "description": "Узнавайте данные регистрации доменов и IP через RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Файлы",
+        "description": "Шифруйте файлы и папки в замаскированные объекты .mydt; просматривайте их после разблокировки."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Файлы",
+    "subtitle": "Файлы остаются приватными, пока вы их не разблокируете — зашифрованы на устройстве, замаскированы на диске",
+    "desktopOnly": "Secure Files доступен в настольном приложении.",
+    "allFiles": "Все файлы",
+    "overview": "Обзор",
+    "statFiles": "Файлы",
+    "statFolders": "Папки",
+    "statContent": "Размер содержимого",
+    "statContentHint": "Общий размер исходных файлов",
+    "statOnDisk": "На диске",
+    "statOverhead": "{size} накладных расходов шифрования",
+    "byType": "По типу",
+    "fileCount": "{count, plural, one {# файл} few {# файла} many {# файлов} other {# файла}}",
+    "largestFiles": "Самые большие файлы",
+    "recentlyAdded": "Недавно добавленные",
+    "openContainingFolder": "Открыть содержащую папку",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "Изображения",
+      "video": "Видео",
+      "audio": "Аудио",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Архивы",
+      "code": "Код",
+      "doc": "Документы",
+      "sheet": "Таблицы",
+      "file": "Прочее"
+    },
+    "breadcrumb": "Путь к папке",
+    "addFiles": "Добавить файлы",
+    "addFolder": "Добавить папку",
+    "importFolder": "Импортировать папку",
+    "newFolder": "Новая папка",
+    "lock": "Заблокировать",
+    "settings": "Настройки хранилища",
+    "storageFolder": "Папка хранения",
+    "notSet": "Не задана",
+    "chooseFolder": "Выбрать папку",
+    "changeFolder": "Сменить папку…",
+    "chooseFolderTitle": "Выберите, где хранить зашифрованные файлы",
+    "chooseFolderBody": "Выберите любую папку на этом устройстве или на внешнем диске. За пределами MyDevTools в ней находятся только замаскированные файлы .mydt.",
+    "changeFolderTitle": "Переместить зашифрованные файлы?",
+    "changeFolderBody": "Все файлы .mydt будут перемещены из текущей папки хранения в ту, которую вы выберете далее.",
+    "folderSet": "Папка хранения задана",
+    "folderMissingTitle": "Папка хранения не найдена",
+    "folderMissingBody": "«{dir}» недоступна — возможно, она на отключённом диске или взята из резервной копии с другого компьютера. Подключите диск заново или выберите новую папку.",
+    "movedCount": "Перемещено зашифрованных файлов: {count}",
+    "importedCount": "Зашифровано файлов: {count}",
+    "emptyFolderAdded": "Папка добавлена — в ней не было файлов для шифрования",
+    "emptyTitle": "Здесь пока нет файлов",
+    "emptyBody": "Добавьте файлы или целую папку. Каждый файл шифруется в объект .mydt со случайным именем; исходное имя, тип и содержимое видны только здесь.",
+    "name": "Имя",
+    "size": "Размер",
+    "modified": "Изменён",
+    "actions": "Действия",
+    "expand": "Развернуть",
+    "collapse": "Свернуть",
+    "preview": "Просмотр",
+    "noPreview": "Для этого типа файла просмотр недоступен — экспортируйте его, чтобы открыть в другом приложении.",
+    "export": "Экспорт",
+    "exportWarningTitle": "Экспортировать расшифрованную копию?",
+    "exportWarningBody": "Файл будет записан в выбранное место без шифрования. Прочитать его сможет что угодно на этом устройстве.",
+    "exported": "Расшифрованная копия экспортирована",
+    "replace": "Заменить содержимое…",
+    "replaced": "Содержимое файла заменено",
+    "rename": "Переименовать",
+    "fileName": "Имя файла",
+    "move": "Переместить в папку",
+    "targetFolder": "Папка",
+    "targetFolderHint": "Используйте косые черты для вложенных папок, например проект/config. Оставьте пустым для верхнего уровня.",
+    "folderName": "Имя папки",
+    "delete": "Удалить",
+    "deleted": "Файл удалён",
+    "deletedCount": "Удалено файлов: {count}",
+    "deleteFileTitle": "Удалить этот файл?",
+    "deleteFileBody": "«{name}» будет безвозвратно удалён из зашифрованной папки хранения.",
+    "deleteFolderTitle": "Удалить эту папку?",
+    "deleteFolderBody": "Все файлы в «{dir}» будут безвозвратно удалены из зашифрованной папки хранения.",
+    "unreadableCount": "Нечитаемых файлов в папке хранения: {count}",
+    "unreadableHint": "Они зашифрованы другим мастер-паролем, принадлежат другому хранилищу или повреждены.",
+    "dismiss": "Скрыть",
+    "viewGrid": "Сетка",
+    "viewList": "Список",
+    "footerNote": "Файлы до 20 МБ. Шифрование Argon2id + XChaCha20-Poly1305; ключ хранится только в памяти, пока хранилище разблокировано.",
+    "cancel": "Отмена",
+    "save": "Сохранить"
   }
 }
diff --git a/apps/desktop-ui/messages/sv.json b/apps/desktop-ui/messages/sv.json
index a89c3b82..46dfd406 100644
--- a/apps/desktop-ui/messages/sv.json
+++ b/apps/desktop-ui/messages/sv.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook-testare",
     "websocketTester": "WebSocket-testare",
     "whoisLookup": "Whois-uppslag",
-    "secureFiles": "Files"
+    "secureFiles": "Filer"
   },
   "Help": {
     "title": "Hjälp och dokumentation",
@@ -654,8 +654,8 @@
         "description": "Slå upp registreringsuppgifter för domäner och IP via RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Filer",
+        "description": "Kryptera filer och mappar till maskerade .mydt-objekt; bläddra och förhandsgranska dem efter upplåsning."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Filer",
+    "subtitle": "Filer som förblir privata tills du låser upp dem — krypterade på din enhet, maskerade på disken",
+    "desktopOnly": "Secure Files finns i skrivbordsappen.",
+    "allFiles": "Alla filer",
+    "overview": "Översikt",
+    "statFiles": "Filer",
+    "statFolders": "Mappar",
+    "statContent": "Innehållsstorlek",
+    "statContentHint": "Total storlek på originalfilerna",
+    "statOnDisk": "På disk",
+    "statOverhead": "{size} krypteringsomkostnad",
+    "byType": "Efter typ",
+    "fileCount": "{count, plural, one {# fil} other {# filer}}",
+    "largestFiles": "Största filerna",
+    "recentlyAdded": "Nyligen tillagda",
+    "openContainingFolder": "Öppna överordnad mapp",
     "types": {
-      "image": "Images",
+      "image": "Bilder",
       "video": "Video",
-      "audio": "Audio",
+      "audio": "Ljud",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Arkiv",
+      "code": "Kod",
+      "doc": "Dokument",
+      "sheet": "Kalkylblad",
+      "file": "Övrigt"
+    },
+    "breadcrumb": "Mappsökväg",
+    "addFiles": "Lägg till filer",
+    "addFolder": "Lägg till mapp",
+    "importFolder": "Importera mapp",
+    "newFolder": "Ny mapp",
+    "lock": "Lås",
+    "settings": "Lagringsinställningar",
+    "storageFolder": "Lagringsmapp",
+    "notSet": "Inte angiven",
+    "chooseFolder": "Välj mapp",
+    "changeFolder": "Byt mapp…",
+    "chooseFolderTitle": "Välj var krypterade filer ska lagras",
+    "chooseFolderBody": "Välj vilken mapp som helst på den här enheten eller på en extern disk. Utanför MyDevTools innehåller den bara maskerade .mydt-filer.",
+    "changeFolderTitle": "Flytta krypterade filer?",
+    "changeFolderBody": "Alla .mydt-filer flyttas från den nuvarande lagringsmappen till den du väljer härnäst.",
+    "folderSet": "Lagringsmapp angiven",
+    "folderMissingTitle": "Lagringsmappen hittades inte",
+    "folderMissingBody": "”{dir}” är inte tillgänglig — den kan ligga på en frånkopplad disk eller komma från en återställd säkerhetskopia från en annan dator. Anslut den igen eller välj en ny mapp.",
+    "movedCount": "Flyttade {count} krypterade filer",
+    "importedCount": "Krypterade {count} filer",
+    "emptyFolderAdded": "Mappen lades till — den innehöll inga filer att kryptera",
+    "emptyTitle": "Inga filer här ännu",
+    "emptyBody": "Lägg till filer eller en hel mapp. Varje fil krypteras till ett .mydt-objekt med slumpmässigt namn; originalnamn, typ och innehåll syns bara här.",
+    "name": "Namn",
+    "size": "Storlek",
+    "modified": "Ändrad",
+    "actions": "Åtgärder",
+    "expand": "Expandera",
+    "collapse": "Fäll ihop",
+    "preview": "Förhandsgranska",
+    "noPreview": "Ingen förhandsgranskning för den här filtypen — exportera den för att öppna den i en annan app.",
+    "export": "Exportera",
+    "exportWarningTitle": "Exportera en dekrypterad kopia?",
+    "exportWarningBody": "Filen skrivs okrypterad till platsen du väljer. Allt på den enheten kan läsa den.",
+    "exported": "Dekrypterad kopia exporterad",
+    "replace": "Ersätt innehåll…",
+    "replaced": "Filinnehållet ersattes",
+    "rename": "Byt namn",
+    "fileName": "Filnamn",
+    "move": "Flytta till mapp",
+    "targetFolder": "Mapp",
+    "targetFolderHint": "Använd snedstreck för nästlade mappar, till exempel projekt/config. Lämna tomt för toppnivån.",
+    "folderName": "Mappnamn",
+    "delete": "Ta bort",
+    "deleted": "Filen togs bort",
+    "deletedCount": "Tog bort {count} filer",
+    "deleteFileTitle": "Ta bort den här filen?",
+    "deleteFileBody": "”{name}” tas bort permanent från den krypterade lagringsmappen.",
+    "deleteFolderTitle": "Ta bort den här mappen?",
+    "deleteFolderBody": "Alla filer under ”{dir}” tas bort permanent från den krypterade lagringsmappen.",
+    "unreadableCount": "Oläsbara filer i lagringsmappen: {count}",
+    "unreadableHint": "De krypterades med ett annat huvudlösenord, hör till ett annat valv eller är skadade.",
+    "dismiss": "Avfärda",
+    "viewGrid": "Rutnätsvy",
+    "viewList": "Listvy",
+    "footerNote": "Filer upp till 20 MB. Krypterade med Argon2id + XChaCha20-Poly1305; nyckeln finns bara i minnet medan valvet är upplåst.",
+    "cancel": "Avbryt",
+    "save": "Spara"
   }
 }
diff --git a/apps/desktop-ui/messages/tr.json b/apps/desktop-ui/messages/tr.json
index e8b2822f..7b4039f7 100644
--- a/apps/desktop-ui/messages/tr.json
+++ b/apps/desktop-ui/messages/tr.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook Test Aracı",
     "websocketTester": "WebSocket Test Aracı",
     "whoisLookup": "Whois Sorgulama",
-    "secureFiles": "Files"
+    "secureFiles": "Dosyalar"
   },
   "Help": {
     "title": "Yardım ve Dokümantasyon",
@@ -654,8 +654,8 @@
         "description": "Alan adı ve IP kayıt bilgilerini RDAP üzerinden sorgulayın."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Dosyalar",
+        "description": "Dosyaları ve klasörleri maskelenmiş .mydt nesnelerine şifreleyin; kilidi açtıktan sonra göz atın ve önizleyin."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Dosyalar",
+    "subtitle": "Kilidini açana kadar gizli kalan dosyalar — cihazınızda şifrelenir, diskte maskelenir",
+    "desktopOnly": "Secure Files masaüstü uygulamasında kullanılabilir.",
+    "allFiles": "Tüm dosyalar",
+    "overview": "Genel bakış",
+    "statFiles": "Dosyalar",
+    "statFolders": "Klasörler",
+    "statContent": "İçerik boyutu",
+    "statContentHint": "Orijinal dosyaların toplam boyutu",
+    "statOnDisk": "Diskte",
+    "statOverhead": "{size} şifreleme ek yükü",
+    "byType": "Türe göre",
+    "fileCount": "{count, plural, other {# dosya}}",
+    "largestFiles": "En büyük dosyalar",
+    "recentlyAdded": "Son eklenenler",
+    "openContainingFolder": "Bulunduğu klasörü aç",
     "types": {
-      "image": "Images",
+      "image": "Görseller",
       "video": "Video",
-      "audio": "Audio",
+      "audio": "Ses",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Arşivler",
+      "code": "Kod",
+      "doc": "Belgeler",
+      "sheet": "Elektronik tablolar",
+      "file": "Diğer"
+    },
+    "breadcrumb": "Klasör yolu",
+    "addFiles": "Dosya ekle",
+    "addFolder": "Klasör ekle",
+    "importFolder": "Klasör içe aktar",
+    "newFolder": "Yeni klasör",
+    "lock": "Kilitle",
+    "settings": "Depolama ayarları",
+    "storageFolder": "Depolama klasörü",
+    "notSet": "Ayarlanmadı",
+    "chooseFolder": "Klasör seç",
+    "changeFolder": "Klasörü değiştir…",
+    "chooseFolderTitle": "Şifreli dosyaların nerede saklanacağını seçin",
+    "chooseFolderBody": "Bu cihazdaki veya harici bir sürücüdeki herhangi bir klasörü seçin. MyDevTools dışında yalnızca maskelenmiş .mydt dosyaları içerir.",
+    "changeFolderTitle": "Şifreli dosyalar taşınsın mı?",
+    "changeFolderBody": "Tüm .mydt dosyaları geçerli depolama klasöründen birazdan seçeceğiniz klasöre taşınacak.",
+    "folderSet": "Depolama klasörü ayarlandı",
+    "folderMissingTitle": "Depolama klasörü bulunamadı",
+    "folderMissingBody": "“{dir}” kullanılamıyor — çıkarılmış bir sürücüde olabilir ya da başka bir makineden geri yüklenen bir yedeğe ait olabilir. Yeniden bağlayın veya yeni bir klasör seçin.",
+    "movedCount": "{count} şifreli dosya taşındı",
+    "importedCount": "{count} dosya şifrelendi",
+    "emptyFolderAdded": "Klasör eklendi — şifrelenecek dosya yoktu",
+    "emptyTitle": "Burada henüz dosya yok",
+    "emptyBody": "Dosya ya da bütün bir klasör ekleyin. Her dosya rastgele adlı bir .mydt nesnesine şifrelenir; orijinal ad, tür ve içerik yalnızca burada görünür.",
+    "name": "Ad",
+    "size": "Boyut",
+    "modified": "Değiştirilme",
+    "actions": "İşlemler",
+    "expand": "Genişlet",
+    "collapse": "Daralt",
+    "preview": "Önizleme",
+    "noPreview": "Bu dosya türü için önizleme yok — başka bir uygulamada açmak için dışa aktarın.",
+    "export": "Dışa aktar",
+    "exportWarningTitle": "Şifresi çözülmüş bir kopya dışa aktarılsın mı?",
+    "exportWarningBody": "Dosya, seçtiğiniz konuma şifrelenmeden yazılacak. O cihazdaki her şey onu okuyabilir.",
+    "exported": "Şifresi çözülmüş kopya dışa aktarıldı",
+    "replace": "İçeriği değiştir…",
+    "replaced": "Dosya içeriği değiştirildi",
+    "rename": "Yeniden adlandır",
+    "fileName": "Dosya adı",
+    "move": "Klasöre taşı",
+    "targetFolder": "Klasör",
+    "targetFolderHint": "İç içe klasörler için eğik çizgi kullanın, örneğin proje/config. En üst düzey için boş bırakın.",
+    "folderName": "Klasör adı",
+    "delete": "Sil",
+    "deleted": "Dosya silindi",
+    "deletedCount": "{count} dosya silindi",
+    "deleteFileTitle": "Bu dosya silinsin mi?",
+    "deleteFileBody": "“{name}” şifreli depolama klasöründen kalıcı olarak kaldırılacak.",
+    "deleteFolderTitle": "Bu klasör silinsin mi?",
+    "deleteFolderBody": "“{dir}” altındaki tüm dosyalar şifreli depolama klasöründen kalıcı olarak kaldırılacak.",
+    "unreadableCount": "Depolama klasöründe okunamayan dosyalar: {count}",
+    "unreadableHint": "Farklı bir ana parolayla şifrelenmiş, başka bir kasaya ait ya da bozulmuş olabilirler.",
+    "dismiss": "Kapat",
+    "viewGrid": "Izgara görünümü",
+    "viewList": "Liste görünümü",
+    "footerNote": "20 MB'a kadar dosyalar. Argon2id + XChaCha20-Poly1305 ile şifrelenir; anahtar yalnızca kasa açıkken bellekte tutulur.",
+    "cancel": "İptal",
+    "save": "Kaydet"
   }
 }
diff --git a/apps/desktop-ui/messages/uk.json b/apps/desktop-ui/messages/uk.json
index e8a4e07c..688b77ca 100644
--- a/apps/desktop-ui/messages/uk.json
+++ b/apps/desktop-ui/messages/uk.json
@@ -77,7 +77,7 @@
     "webhookTester": "Тестер вебхуків",
     "websocketTester": "Тестер WebSocket",
     "whoisLookup": "Whois-запит",
-    "secureFiles": "Files"
+    "secureFiles": "Файли"
   },
   "Help": {
     "title": "Довідка та документація",
@@ -654,8 +654,8 @@
         "description": "Дізнавайтеся дані реєстрації доменів та IP через RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Файли",
+        "description": "Шифруйте файли та теки в замасковані об'єкти .mydt; переглядайте їх після розблокування."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Файли",
+    "subtitle": "Файли залишаються приватними, доки ви їх не розблокуєте — зашифровані на пристрої, замасковані на диску",
+    "desktopOnly": "Secure Files доступний у настільному застосунку.",
+    "allFiles": "Усі файли",
+    "overview": "Огляд",
+    "statFiles": "Файли",
+    "statFolders": "Теки",
+    "statContent": "Розмір вмісту",
+    "statContentHint": "Загальний розмір вихідних файлів",
+    "statOnDisk": "На диску",
+    "statOverhead": "{size} накладних витрат шифрування",
+    "byType": "За типом",
+    "fileCount": "{count, plural, one {# файл} few {# файли} many {# файлів} other {# файла}}",
+    "largestFiles": "Найбільші файли",
+    "recentlyAdded": "Нещодавно додані",
+    "openContainingFolder": "Відкрити теку, що містить файл",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "Зображення",
+      "video": "Відео",
+      "audio": "Аудіо",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Архіви",
+      "code": "Код",
+      "doc": "Документи",
+      "sheet": "Таблиці",
+      "file": "Інше"
+    },
+    "breadcrumb": "Шлях до теки",
+    "addFiles": "Додати файли",
+    "addFolder": "Додати теку",
+    "importFolder": "Імпортувати теку",
+    "newFolder": "Нова тека",
+    "lock": "Заблокувати",
+    "settings": "Налаштування сховища",
+    "storageFolder": "Тека сховища",
+    "notSet": "Не задано",
+    "chooseFolder": "Вибрати теку",
+    "changeFolder": "Змінити теку…",
+    "chooseFolderTitle": "Виберіть, де зберігати зашифровані файли",
+    "chooseFolderBody": "Виберіть будь-яку теку на цьому пристрої або на зовнішньому диску. Поза MyDevTools вона містить лише замасковані файли .mydt.",
+    "changeFolderTitle": "Перемістити зашифровані файли?",
+    "changeFolderBody": "Усі файли .mydt буде переміщено з поточної теки сховища до тієї, яку ви виберете далі.",
+    "folderSet": "Теку сховища задано",
+    "folderMissingTitle": "Теку сховища не знайдено",
+    "folderMissingBody": "«{dir}» недоступна — можливо, вона на від'єднаному диску або походить із відновленої резервної копії з іншого комп'ютера. Під'єднайте його знову або виберіть нову теку.",
+    "movedCount": "Переміщено зашифрованих файлів: {count}",
+    "importedCount": "Зашифровано файлів: {count}",
+    "emptyFolderAdded": "Теку додано — у ній не було файлів для шифрування",
+    "emptyTitle": "Тут ще немає файлів",
+    "emptyBody": "Додайте файли або цілу теку. Кожен файл шифрується в об'єкт .mydt з випадковим іменем; вихідне ім'я, тип і вміст видно лише тут.",
+    "name": "Ім'я",
+    "size": "Розмір",
+    "modified": "Змінено",
+    "actions": "Дії",
+    "expand": "Розгорнути",
+    "collapse": "Згорнути",
+    "preview": "Перегляд",
+    "noPreview": "Для цього типу файлу перегляд недоступний — експортуйте його, щоб відкрити в іншому застосунку.",
+    "export": "Експортувати",
+    "exportWarningTitle": "Експортувати розшифровану копію?",
+    "exportWarningBody": "Файл буде записано у вибране місце без шифрування. Прочитати його зможе будь-що на цьому пристрої.",
+    "exported": "Розшифровану копію експортовано",
+    "replace": "Замінити вміст…",
+    "replaced": "Вміст файлу замінено",
+    "rename": "Перейменувати",
+    "fileName": "Ім'я файлу",
+    "move": "Перемістити до теки",
+    "targetFolder": "Тека",
+    "targetFolderHint": "Використовуйте похилі риски для вкладених тек, наприклад проєкт/config. Залиште порожнім для верхнього рівня.",
+    "folderName": "Ім'я теки",
+    "delete": "Видалити",
+    "deleted": "Файл видалено",
+    "deletedCount": "Видалено файлів: {count}",
+    "deleteFileTitle": "Видалити цей файл?",
+    "deleteFileBody": "«{name}» буде остаточно видалено із зашифрованої теки сховища.",
+    "deleteFolderTitle": "Видалити цю теку?",
+    "deleteFolderBody": "Усі файли в «{dir}» буде остаточно видалено із зашифрованої теки сховища.",
+    "unreadableCount": "Нечитабельних файлів у теці сховища: {count}",
+    "unreadableHint": "Їх зашифровано іншим головним паролем, вони належать до іншого сховища або пошкоджені.",
+    "dismiss": "Сховати",
+    "viewGrid": "Сітка",
+    "viewList": "Список",
+    "footerNote": "Файли до 20 МБ. Шифрування Argon2id + XChaCha20-Poly1305; ключ зберігається лише в пам'яті, доки сховище розблоковане.",
+    "cancel": "Скасувати",
+    "save": "Зберегти"
   }
 }
diff --git a/apps/desktop-ui/messages/vi.json b/apps/desktop-ui/messages/vi.json
index 20f696dd..b270a5b1 100644
--- a/apps/desktop-ui/messages/vi.json
+++ b/apps/desktop-ui/messages/vi.json
@@ -77,7 +77,7 @@
     "webhookTester": "Trình kiểm tra Webhook",
     "websocketTester": "Trình kiểm tra WebSocket",
     "whoisLookup": "Tra cứu Whois",
-    "secureFiles": "Files"
+    "secureFiles": "Tệp"
   },
   "Help": {
     "title": "Trợ giúp & Tài liệu",
@@ -654,8 +654,8 @@
         "description": "Tra cứu thông tin đăng ký tên miền và IP qua RDAP."
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "Tệp",
+        "description": "Mã hóa tệp và thư mục thành các đối tượng .mydt được che tên; duyệt và xem trước sau khi mở khóa."
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "Tệp",
+    "subtitle": "Những tệp luôn riêng tư cho đến khi bạn mở khóa — mã hóa trên thiết bị, che tên trên ổ đĩa",
+    "desktopOnly": "Secure Files có sẵn trong ứng dụng máy tính.",
+    "allFiles": "Tất cả tệp",
+    "overview": "Tổng quan",
+    "statFiles": "Tệp",
+    "statFolders": "Thư mục",
+    "statContent": "Dung lượng nội dung",
+    "statContentHint": "Tổng dung lượng của các tệp gốc",
+    "statOnDisk": "Trên ổ đĩa",
+    "statOverhead": "{size} chi phí mã hóa",
+    "byType": "Theo loại",
+    "fileCount": "{count, plural, other {# tệp}}",
+    "largestFiles": "Tệp lớn nhất",
+    "recentlyAdded": "Mới thêm gần đây",
+    "openContainingFolder": "Mở thư mục chứa tệp",
     "types": {
-      "image": "Images",
+      "image": "Hình ảnh",
       "video": "Video",
-      "audio": "Audio",
+      "audio": "Âm thanh",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "Tệp nén",
+      "code": "Mã nguồn",
+      "doc": "Tài liệu",
+      "sheet": "Bảng tính",
+      "file": "Khác"
+    },
+    "breadcrumb": "Đường dẫn thư mục",
+    "addFiles": "Thêm tệp",
+    "addFolder": "Thêm thư mục",
+    "importFolder": "Nhập thư mục",
+    "newFolder": "Thư mục mới",
+    "lock": "Khóa",
+    "settings": "Cài đặt lưu trữ",
+    "storageFolder": "Thư mục lưu trữ",
+    "notSet": "Chưa đặt",
+    "chooseFolder": "Chọn thư mục",
+    "changeFolder": "Đổi thư mục…",
+    "chooseFolderTitle": "Chọn nơi lưu các tệp đã mã hóa",
+    "chooseFolderBody": "Chọn bất kỳ thư mục nào trên thiết bị này hoặc trên ổ đĩa ngoài. Bên ngoài MyDevTools, thư mục đó chỉ chứa các tệp .mydt đã được che tên.",
+    "changeFolderTitle": "Di chuyển các tệp đã mã hóa?",
+    "changeFolderBody": "Tất cả tệp .mydt sẽ được chuyển từ thư mục lưu trữ hiện tại sang thư mục bạn chọn tiếp theo.",
+    "folderSet": "Đã đặt thư mục lưu trữ",
+    "folderMissingTitle": "Không tìm thấy thư mục lưu trữ",
+    "folderMissingBody": "“{dir}” không khả dụng — có thể nó nằm trên ổ đĩa đã tháo hoặc thuộc về một bản sao lưu khôi phục từ máy khác. Hãy kết nối lại hoặc chọn thư mục mới.",
+    "movedCount": "Đã chuyển {count} tệp đã mã hóa",
+    "importedCount": "Đã mã hóa {count} tệp",
+    "emptyFolderAdded": "Đã thêm thư mục — không có tệp nào để mã hóa",
+    "emptyTitle": "Chưa có tệp nào ở đây",
+    "emptyBody": "Thêm tệp hoặc cả một thư mục. Mỗi tệp được mã hóa thành một đối tượng .mydt có tên ngẫu nhiên; tên, loại và nội dung gốc chỉ hiển thị ở đây.",
+    "name": "Tên",
+    "size": "Kích thước",
+    "modified": "Đã sửa đổi",
+    "actions": "Thao tác",
+    "expand": "Mở rộng",
+    "collapse": "Thu gọn",
+    "preview": "Xem trước",
+    "noPreview": "Không xem trước được loại tệp này — hãy xuất ra để mở bằng ứng dụng khác.",
+    "export": "Xuất",
+    "exportWarningTitle": "Xuất một bản sao đã giải mã?",
+    "exportWarningBody": "Tệp sẽ được ghi ở dạng không mã hóa tại vị trí bạn chọn. Mọi thứ trên thiết bị đó đều có thể đọc được.",
+    "exported": "Đã xuất bản sao đã giải mã",
+    "replace": "Thay nội dung…",
+    "replaced": "Đã thay nội dung tệp",
+    "rename": "Đổi tên",
+    "fileName": "Tên tệp",
+    "move": "Chuyển vào thư mục",
+    "targetFolder": "Thư mục",
+    "targetFolderHint": "Dùng dấu gạch chéo cho thư mục lồng nhau, ví dụ project/config. Để trống nếu muốn ở cấp cao nhất.",
+    "folderName": "Tên thư mục",
+    "delete": "Xóa",
+    "deleted": "Đã xóa tệp",
+    "deletedCount": "Đã xóa {count} tệp",
+    "deleteFileTitle": "Xóa tệp này?",
+    "deleteFileBody": "“{name}” sẽ bị xóa vĩnh viễn khỏi thư mục lưu trữ đã mã hóa.",
+    "deleteFolderTitle": "Xóa thư mục này?",
+    "deleteFolderBody": "Mọi tệp trong “{dir}” sẽ bị xóa vĩnh viễn khỏi thư mục lưu trữ đã mã hóa.",
+    "unreadableCount": "Tệp không đọc được trong thư mục lưu trữ: {count}",
+    "unreadableHint": "Chúng được mã hóa bằng mật khẩu chính khác, thuộc về một kho khác, hoặc đã hỏng.",
+    "dismiss": "Bỏ qua",
+    "viewGrid": "Dạng lưới",
+    "viewList": "Dạng danh sách",
+    "footerNote": "Tệp tối đa 20 MB. Mã hóa bằng Argon2id + XChaCha20-Poly1305; khóa chỉ nằm trong bộ nhớ khi kho đang mở khóa.",
+    "cancel": "Hủy",
+    "save": "Lưu"
   }
 }
diff --git a/apps/desktop-ui/messages/zh.json b/apps/desktop-ui/messages/zh.json
index 5264f884..45035531 100644
--- a/apps/desktop-ui/messages/zh.json
+++ b/apps/desktop-ui/messages/zh.json
@@ -77,7 +77,7 @@
     "webhookTester": "Webhook 测试器",
     "websocketTester": "WebSocket 测试器",
     "whoisLookup": "Whois 查询",
-    "secureFiles": "Files"
+    "secureFiles": "文件"
   },
   "Help": {
     "title": "帮助与文档",
@@ -654,8 +654,8 @@
         "description": "通过 RDAP 查询域名和 IP 的注册信息。"
       },
       "secureFiles": {
-        "title": "Files",
-        "description": "Encrypt files and folders into masked .mydt objects; browse and preview them after unlocking."
+        "title": "文件",
+        "description": "将文件和文件夹加密为名称已掩码的 .mydt 对象；解锁后即可浏览和预览。"
       }
     },
     "tabs": {
@@ -5244,90 +5244,90 @@
     }
   },
   "SecureFiles": {
-    "title": "Files",
-    "subtitle": "Files that stay private until you unlock them — encrypted on your device, masked on disk",
-    "desktopOnly": "Secure Files is available in the desktop app.",
-    "allFiles": "All files",
-    "breadcrumb": "Folder path",
-    "addFiles": "Add files",
-    "addFolder": "Add folder",
-    "newFolder": "New folder",
-    "lock": "Lock",
-    "settings": "Storage settings",
-    "storageFolder": "Storage folder",
-    "notSet": "Not set",
-    "chooseFolder": "Choose folder",
-    "changeFolder": "Change folder…",
-    "chooseFolderTitle": "Choose where encrypted files are stored",
-    "chooseFolderBody": "Pick any folder on this device or an external drive. Outside MyDevTools it only ever contains masked .mydt files.",
-    "changeFolderTitle": "Move encrypted files?",
-    "changeFolderBody": "All .mydt files will be moved from the current storage folder into the one you pick next.",
-    "folderSet": "Storage folder set",
-    "movedCount": "Moved {count} encrypted files",
-    "importedCount": "Encrypted {count} files",
-    "emptyTitle": "No files here yet",
-    "emptyBody": "Add files or a whole folder. Each file is encrypted into a .mydt object with a random name; the original name, type and contents are only visible here.",
-    "name": "Name",
-    "size": "Size",
-    "modified": "Modified",
-    "actions": "Actions",
-    "expand": "Expand",
-    "collapse": "Collapse",
-    "preview": "Preview",
-    "noPreview": "No preview for this file type — export it to open it in another app.",
-    "export": "Export",
-    "exportWarningTitle": "Export a decrypted copy?",
-    "exportWarningBody": "The file will be written unencrypted to the location you choose. Anything on that device can read it.",
-    "exported": "Decrypted copy exported",
-    "replace": "Replace contents…",
-    "replaced": "File contents replaced",
-    "rename": "Rename",
-    "fileName": "File name",
-    "move": "Move to folder",
-    "targetFolder": "Folder",
-    "targetFolderHint": "Use slashes for nested folders, e.g. project/config. Leave empty for the top level.",
-    "folderName": "Folder name",
-    "delete": "Delete",
-    "deleted": "File deleted",
-    "deletedCount": "Deleted {count} files",
-    "deleteFileTitle": "Delete this file?",
-    "deleteFileBody": "\"{name}\" will be permanently removed from the encrypted storage folder.",
-    "deleteFolderTitle": "Delete this folder?",
-    "deleteFolderBody": "Every file under \"{dir}\" will be permanently removed from the encrypted storage folder.",
-    "unreadableCount": "{count} files in the storage folder could not be read",
-    "unreadableHint": "They were encrypted with a different master password, belong to another vault, or are corrupted.",
-    "footerNote": "Files up to 20 MB. Encrypted with Argon2id + XChaCha20-Poly1305; the key lives in memory only while the vault is unlocked.",
-    "cancel": "Cancel",
-    "save": "Save",
-    "folderMissingTitle": "Storage folder not found",
-    "folderMissingBody": "\"{dir}\" is not available — it may be on an unplugged drive or belong to a restored backup from another machine. Reconnect it, or choose a new folder.",
-    "dismiss": "Dismiss",
-    "viewGrid": "Grid view",
-    "viewList": "List view",
-    "emptyFolderAdded": "Folder added — it had no files to encrypt",
-    "importFolder": "Import folder",
-    "overview": "Overview",
-    "statFiles": "Files",
-    "statFolders": "Folders",
-    "statContent": "Content size",
-    "statContentHint": "Total size of the original files",
-    "statOnDisk": "On disk",
-    "statOverhead": "{size} encryption overhead",
-    "byType": "By type",
-    "fileCount": "{count, plural, one {# file} other {# files}}",
-    "largestFiles": "Largest files",
-    "recentlyAdded": "Recently added",
-    "openContainingFolder": "Open containing folder",
+    "title": "文件",
+    "subtitle": "在你解锁之前始终保持私密的文件 — 在设备上加密，在磁盘上掩码",
+    "desktopOnly": "Secure Files 可在桌面应用中使用。",
+    "allFiles": "全部文件",
+    "overview": "概览",
+    "statFiles": "文件",
+    "statFolders": "文件夹",
+    "statContent": "内容大小",
+    "statContentHint": "原始文件的总大小",
+    "statOnDisk": "磁盘占用",
+    "statOverhead": "加密开销 {size}",
+    "byType": "按类型",
+    "fileCount": "{count, plural, other {# 个文件}}",
+    "largestFiles": "最大的文件",
+    "recentlyAdded": "最近添加",
+    "openContainingFolder": "打开所在文件夹",
     "types": {
-      "image": "Images",
-      "video": "Video",
-      "audio": "Audio",
+      "image": "图片",
+      "video": "视频",
+      "audio": "音频",
       "pdf": "PDF",
-      "archive": "Archives",
-      "code": "Code",
-      "doc": "Documents",
-      "sheet": "Spreadsheets",
-      "file": "Other"
-    }
+      "archive": "压缩包",
+      "code": "代码",
+      "doc": "文档",
+      "sheet": "电子表格",
+      "file": "其他"
+    },
+    "breadcrumb": "文件夹路径",
+    "addFiles": "添加文件",
+    "addFolder": "添加文件夹",
+    "importFolder": "导入文件夹",
+    "newFolder": "新建文件夹",
+    "lock": "锁定",
+    "settings": "存储设置",
+    "storageFolder": "存储文件夹",
+    "notSet": "未设置",
+    "chooseFolder": "选择文件夹",
+    "changeFolder": "更改文件夹…",
+    "chooseFolderTitle": "选择加密文件的存放位置",
+    "chooseFolderBody": "在本设备或外接驱动器上任选一个文件夹。在 MyDevTools 之外，它只包含名称已掩码的 .mydt 文件。",
+    "changeFolderTitle": "移动加密文件？",
+    "changeFolderBody": "所有 .mydt 文件都会从当前存储文件夹移动到你接下来选择的文件夹。",
+    "folderSet": "已设置存储文件夹",
+    "folderMissingTitle": "未找到存储文件夹",
+    "folderMissingBody": "「{dir}」不可用 — 它可能位于已拔出的驱动器上，或来自从其他电脑恢复的备份。请重新连接，或选择新的文件夹。",
+    "movedCount": "已移动 {count} 个加密文件",
+    "importedCount": "已加密 {count} 个文件",
+    "emptyFolderAdded": "已添加文件夹 — 其中没有可加密的文件",
+    "emptyTitle": "这里还没有文件",
+    "emptyBody": "添加文件或整个文件夹。每个文件都会被加密成名称随机的 .mydt 对象；原始名称、类型和内容只在这里可见。",
+    "name": "名称",
+    "size": "大小",
+    "modified": "修改时间",
+    "actions": "操作",
+    "expand": "展开",
+    "collapse": "折叠",
+    "preview": "预览",
+    "noPreview": "此类型的文件无法预览 — 导出后用其他应用打开。",
+    "export": "导出",
+    "exportWarningTitle": "导出解密副本？",
+    "exportWarningBody": "文件将以未加密的形式写入你选择的位置。该设备上的任何程序都能读取它。",
+    "exported": "已导出解密副本",
+    "replace": "替换内容…",
+    "replaced": "已替换文件内容",
+    "rename": "重命名",
+    "fileName": "文件名",
+    "move": "移动到文件夹",
+    "targetFolder": "文件夹",
+    "targetFolderHint": "嵌套文件夹用斜杠分隔，例如 project/config。留空表示顶层。",
+    "folderName": "文件夹名称",
+    "delete": "删除",
+    "deleted": "已删除文件",
+    "deletedCount": "已删除 {count} 个文件",
+    "deleteFileTitle": "删除此文件？",
+    "deleteFileBody": "「{name}」将从加密存储文件夹中永久删除。",
+    "deleteFolderTitle": "删除此文件夹？",
+    "deleteFolderBody": "「{dir}」下的所有文件都将从加密存储文件夹中永久删除。",
+    "unreadableCount": "存储文件夹中无法读取的文件：{count}",
+    "unreadableHint": "它们使用了其他主密码加密、属于其他保险库，或者已损坏。",
+    "dismiss": "关闭",
+    "viewGrid": "网格视图",
+    "viewList": "列表视图",
+    "footerNote": "文件上限 20 MB。使用 Argon2id + XChaCha20-Poly1305 加密；密钥仅在保险库解锁期间保存在内存中。",
+    "cancel": "取消",
+    "save": "保存"
   }
 }

From fb2f45c46dd9e3e240c8e80a771b8e38ec6af76a Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 01:45:04 +0530
Subject: [PATCH 15/39] Update page.tsx

---
 apps/desktop-ui/src/app/settings/page.tsx | 98 ++++++++++-------------
 1 file changed, 42 insertions(+), 56 deletions(-)

diff --git a/apps/desktop-ui/src/app/settings/page.tsx b/apps/desktop-ui/src/app/settings/page.tsx
index 2519e334..3f7587ea 100644
--- a/apps/desktop-ui/src/app/settings/page.tsx
+++ b/apps/desktop-ui/src/app/settings/page.tsx
@@ -178,6 +178,48 @@ export default function SettingsPage() {
                   </label>
                 </div>
               </div>
+
+              <div className="space-y-2 sm:w-[220px]">
+                <div className="flex h-5 items-center gap-2">
+                  <Globe className="h-4 w-4 shrink-0 text-muted-foreground" />
+                  <Label>{t('language.selectLanguage')}</Label>
+                </div>
+                <Select value={locale} onValueChange={handleLanguageChange}>
+                  <SelectTrigger>
+                    <SelectValue placeholder={t('language.selectPlaceholder')} />
+                  </SelectTrigger>
+                  <SelectContent className="rounded-lg">
+                    <SelectItem value="en">{t('language.languages.en')}</SelectItem>
+                    <SelectItem value="af">{t('language.languages.af')}</SelectItem>
+                    <SelectItem value="ar">{t('language.languages.ar')}</SelectItem>
+                    <SelectItem value="ca">{t('language.languages.ca')}</SelectItem>
+                    <SelectItem value="cs">{t('language.languages.cs')}</SelectItem>
+                    <SelectItem value="da">{t('language.languages.da')}</SelectItem>
+                    <SelectItem value="de">{t('language.languages.de')}</SelectItem>
+                    <SelectItem value="el">{t('language.languages.el')}</SelectItem>
+                    <SelectItem value="es">{t('language.languages.es')}</SelectItem>
+                    <SelectItem value="fa">{t('language.languages.fa')}</SelectItem>
+                    <SelectItem value="fr">{t('language.languages.fr')}</SelectItem>
+                    <SelectItem value="id">{t('language.languages.id')}</SelectItem>
+                    <SelectItem value="it">{t('language.languages.it')}</SelectItem>
+                    <SelectItem value="ja">{t('language.languages.ja')}</SelectItem>
+                    <SelectItem value="ko">{t('language.languages.ko')}</SelectItem>
+                    <SelectItem value="ms">{t('language.languages.ms')}</SelectItem>
+                    <SelectItem value="nb">{t('language.languages.nb')}</SelectItem>
+                    <SelectItem value="nl">{t('language.languages.nl')}</SelectItem>
+                    <SelectItem value="pl">{t('language.languages.pl')}</SelectItem>
+                    <SelectItem value="pt">{t('language.languages.pt')}</SelectItem>
+                    <SelectItem value="pt-BR">{t('language.languages.pt-BR')}</SelectItem>
+                    <SelectItem value="ru">{t('language.languages.ru')}</SelectItem>
+                    <SelectItem value="sv">{t('language.languages.sv')}</SelectItem>
+                    <SelectItem value="tr">{t('language.languages.tr')}</SelectItem>
+                    <SelectItem value="uk">{t('language.languages.uk')}</SelectItem>
+                    <SelectItem value="vi">{t('language.languages.vi')}</SelectItem>
+                    <SelectItem value="zh">{t('language.languages.zh')}</SelectItem>
+                  </SelectContent>
+                </Select>
+                <p className="text-xs text-muted-foreground">{t('language.helpText')}</p>
+              </div>
             </div>
           </CardContent>
         </Card>
@@ -248,62 +290,6 @@ export default function SettingsPage() {
           </CardContent>
         </Card>
 
-        <Card className="rounded-2xl border border-border/60 bg-card/60 shadow-sm backdrop-blur-sm">
-          <CardHeader>
-            <CardTitle className="flex items-center gap-2.5">
-              <span className="flex h-8 w-8 items-center justify-center rounded-lg bg-gradient-to-br from-primary/15 to-violet-500/10 text-primary ring-1 ring-inset ring-border/50">
-                <Globe className="h-4 w-4" />
-              </span>
-              {t('language.title')}
-            </CardTitle>
-            <CardDescription>
-              {t('language.description')}
-            </CardDescription>
-          </CardHeader>
-          <CardContent className="space-y-6">
-            <div className="space-y-4 max-w-xs">
-              <Label>{t('language.selectLanguage')}</Label>
-              <Select value={locale} onValueChange={handleLanguageChange}>
-                <SelectTrigger>
-                  <SelectValue placeholder={t('language.selectPlaceholder')} />
-                </SelectTrigger>
-                <SelectContent className="rounded-lg">
-                  <SelectItem value="en">{t('language.languages.en')}</SelectItem>
-                  <SelectItem value="af">{t('language.languages.af')}</SelectItem>
-                  <SelectItem value="ar">{t('language.languages.ar')}</SelectItem>
-                  <SelectItem value="ca">{t('language.languages.ca')}</SelectItem>
-                  <SelectItem value="cs">{t('language.languages.cs')}</SelectItem>
-                  <SelectItem value="da">{t('language.languages.da')}</SelectItem>
-                  <SelectItem value="de">{t('language.languages.de')}</SelectItem>
-                  <SelectItem value="el">{t('language.languages.el')}</SelectItem>
-                  <SelectItem value="es">{t('language.languages.es')}</SelectItem>
-                  <SelectItem value="fa">{t('language.languages.fa')}</SelectItem>
-                  <SelectItem value="fr">{t('language.languages.fr')}</SelectItem>
-                  <SelectItem value="id">{t('language.languages.id')}</SelectItem>
-                  <SelectItem value="it">{t('language.languages.it')}</SelectItem>
-                  <SelectItem value="ja">{t('language.languages.ja')}</SelectItem>
-                  <SelectItem value="ko">{t('language.languages.ko')}</SelectItem>
-                  <SelectItem value="ms">{t('language.languages.ms')}</SelectItem>
-                  <SelectItem value="nb">{t('language.languages.nb')}</SelectItem>
-                  <SelectItem value="nl">{t('language.languages.nl')}</SelectItem>
-                  <SelectItem value="pl">{t('language.languages.pl')}</SelectItem>
-                  <SelectItem value="pt">{t('language.languages.pt')}</SelectItem>
-                  <SelectItem value="pt-BR">{t('language.languages.pt-BR')}</SelectItem>
-                  <SelectItem value="ru">{t('language.languages.ru')}</SelectItem>
-                  <SelectItem value="sv">{t('language.languages.sv')}</SelectItem>
-                  <SelectItem value="tr">{t('language.languages.tr')}</SelectItem>
-                  <SelectItem value="uk">{t('language.languages.uk')}</SelectItem>
-                  <SelectItem value="vi">{t('language.languages.vi')}</SelectItem>
-                  <SelectItem value="zh">{t('language.languages.zh')}</SelectItem>
-                </SelectContent>
-              </Select>
-            </div>
-            <p className="text-xs text-muted-foreground">
-              {t('language.helpText')}
-            </p>
-          </CardContent>
-        </Card>
-
         <AppVersionLabel />
 
         <BackupCodesCard />

From c2c7e52c7886a568b1a255c6039df2bf8f7e0b98 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 09:54:53 +0530
Subject: [PATCH 16/39] Update page.tsx

---
 apps/desktop-ui/src/app/settings/page.tsx | 33 ++++++++++++++---------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/apps/desktop-ui/src/app/settings/page.tsx b/apps/desktop-ui/src/app/settings/page.tsx
index 3f7587ea..181edc18 100644
--- a/apps/desktop-ui/src/app/settings/page.tsx
+++ b/apps/desktop-ui/src/app/settings/page.tsx
@@ -4,7 +4,8 @@ import React, { useState, useEffect } from 'react'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
 import { Label } from '@/components/ui/label'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
-import { Sun, Globe, Palette, Lock, Pipette } from 'lucide-react'
+import { Sun, Moon, Monitor, Globe, Palette, Lock, Pipette } from 'lucide-react'
+import { ToggleGroup, ToggleGroupItem } from '@/components/ui/toggle-group'
 import { IDLE_TIMEOUT_KEY, getIdleTimeoutMinutes } from '@/lib/use-idle-lock'
 import { Switch } from '@/components/ui/switch'
 import { getVaultIconsEnabled, setVaultIconsEnabled } from '@/lib/vault-icon-pref'
@@ -101,16 +102,25 @@ export default function SettingsPage() {
                 <div className="flex h-5 items-center">
                   <Label>{t('appearance.themePreference')}</Label>
                 </div>
-                <Select value={theme} onValueChange={setTheme}>
-                  <SelectTrigger>
-                    <SelectValue placeholder="Select theme" />
-                  </SelectTrigger>
-                  <SelectContent className="rounded-lg">
-                    <SelectItem value="light">{t('appearance.themes.light')}</SelectItem>
-                    <SelectItem value="dark">{t('appearance.themes.dark')}</SelectItem>
-                    <SelectItem value="system">{t('appearance.themes.system')}</SelectItem>
-                  </SelectContent>
-                </Select>
+                {/* Single-select toggles deselect on re-click: ignore the empty value
+                    so there is always an active theme. */}
+                <ToggleGroup
+                  type="single"
+                  variant="outline"
+                  value={theme}
+                  onValueChange={(value) => value && setTheme(value)}
+                  className="justify-start"
+                >
+                  <ToggleGroupItem value="light" className="h-9 px-3" aria-label={t('appearance.themes.light')} title={t('appearance.themes.light')}>
+                    <Sun className="h-4 w-4" />
+                  </ToggleGroupItem>
+                  <ToggleGroupItem value="dark" className="h-9 px-3" aria-label={t('appearance.themes.dark')} title={t('appearance.themes.dark')}>
+                    <Moon className="h-4 w-4" />
+                  </ToggleGroupItem>
+                  <ToggleGroupItem value="system" className="h-9 px-3" aria-label={t('appearance.themes.system')} title={t('appearance.themes.system')}>
+                    <Monitor className="h-4 w-4" />
+                  </ToggleGroupItem>
+                </ToggleGroup>
               </div>
 
               <div className="space-y-2 sm:w-[220px]">
@@ -218,7 +228,6 @@ export default function SettingsPage() {
                     <SelectItem value="zh">{t('language.languages.zh')}</SelectItem>
                   </SelectContent>
                 </Select>
-                <p className="text-xs text-muted-foreground">{t('language.helpText')}</p>
               </div>
             </div>
           </CardContent>

From 82df5be0d4013a9fa7b18e2da81ff4f480891413 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 10:32:58 +0530
Subject: [PATCH 17/39] UI

---
 apps/desktop-ui/messages/af.json              |  1 +
 apps/desktop-ui/messages/ar.json              |  1 +
 apps/desktop-ui/messages/ca.json              |  1 +
 apps/desktop-ui/messages/cs.json              |  1 +
 apps/desktop-ui/messages/da.json              |  1 +
 apps/desktop-ui/messages/de.json              |  1 +
 apps/desktop-ui/messages/el.json              |  1 +
 apps/desktop-ui/messages/en.json              |  1 +
 apps/desktop-ui/messages/es.json              |  1 +
 apps/desktop-ui/messages/fa.json              |  1 +
 apps/desktop-ui/messages/fr.json              |  1 +
 apps/desktop-ui/messages/id.json              |  1 +
 apps/desktop-ui/messages/it.json              |  1 +
 apps/desktop-ui/messages/ja.json              |  1 +
 apps/desktop-ui/messages/ko.json              |  1 +
 apps/desktop-ui/messages/ms.json              |  1 +
 apps/desktop-ui/messages/nb.json              |  1 +
 apps/desktop-ui/messages/nl.json              |  1 +
 apps/desktop-ui/messages/pl.json              |  1 +
 apps/desktop-ui/messages/pt-BR.json           |  1 +
 apps/desktop-ui/messages/pt.json              |  1 +
 apps/desktop-ui/messages/ru.json              |  1 +
 apps/desktop-ui/messages/sv.json              |  1 +
 apps/desktop-ui/messages/tr.json              |  1 +
 apps/desktop-ui/messages/uk.json              |  1 +
 apps/desktop-ui/messages/vi.json              |  1 +
 apps/desktop-ui/messages/zh.json              |  1 +
 apps/desktop-ui/src/app/layout.tsx            |  2 +-
 .../src/components/settings/profile-card.tsx  | 71 +++++++++++++++----
 29 files changed, 85 insertions(+), 15 deletions(-)

diff --git a/apps/desktop-ui/messages/af.json b/apps/desktop-ui/messages/af.json
index 54fe139c..11b80d12 100644
--- a/apps/desktop-ui/messages/af.json
+++ b/apps/desktop-ui/messages/af.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Wysig",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/ar.json b/apps/desktop-ui/messages/ar.json
index 996b780d..ddb6a302 100644
--- a/apps/desktop-ui/messages/ar.json
+++ b/apps/desktop-ui/messages/ar.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "تعديل",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/ca.json b/apps/desktop-ui/messages/ca.json
index 3ff33b1a..2e8b631f 100644
--- a/apps/desktop-ui/messages/ca.json
+++ b/apps/desktop-ui/messages/ca.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Edita",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/cs.json b/apps/desktop-ui/messages/cs.json
index 7ca5d06d..a62c160c 100644
--- a/apps/desktop-ui/messages/cs.json
+++ b/apps/desktop-ui/messages/cs.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Upravit",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/da.json b/apps/desktop-ui/messages/da.json
index 8d444efa..ceff0b1d 100644
--- a/apps/desktop-ui/messages/da.json
+++ b/apps/desktop-ui/messages/da.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Rediger",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/de.json b/apps/desktop-ui/messages/de.json
index 810ea423..7b5c47e3 100644
--- a/apps/desktop-ui/messages/de.json
+++ b/apps/desktop-ui/messages/de.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Bearbeiten",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/el.json b/apps/desktop-ui/messages/el.json
index 7516dbb0..453b0f11 100644
--- a/apps/desktop-ui/messages/el.json
+++ b/apps/desktop-ui/messages/el.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Επεξεργασία",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/en.json b/apps/desktop-ui/messages/en.json
index 676ea55f..ecf6c367 100644
--- a/apps/desktop-ui/messages/en.json
+++ b/apps/desktop-ui/messages/en.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Edit",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/es.json b/apps/desktop-ui/messages/es.json
index 3ccb7826..12bc89f0 100644
--- a/apps/desktop-ui/messages/es.json
+++ b/apps/desktop-ui/messages/es.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Editar",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/fa.json b/apps/desktop-ui/messages/fa.json
index 863ff2d5..74e7a9cd 100644
--- a/apps/desktop-ui/messages/fa.json
+++ b/apps/desktop-ui/messages/fa.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "ویرایش",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/fr.json b/apps/desktop-ui/messages/fr.json
index 083f1792..42231e07 100644
--- a/apps/desktop-ui/messages/fr.json
+++ b/apps/desktop-ui/messages/fr.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Modifier",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/id.json b/apps/desktop-ui/messages/id.json
index 378a01cd..e6bf56c5 100644
--- a/apps/desktop-ui/messages/id.json
+++ b/apps/desktop-ui/messages/id.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Ubah",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/it.json b/apps/desktop-ui/messages/it.json
index a639c3e0..3fff27e3 100644
--- a/apps/desktop-ui/messages/it.json
+++ b/apps/desktop-ui/messages/it.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Modifica",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/ja.json b/apps/desktop-ui/messages/ja.json
index 8346d71c..673c4ad0 100644
--- a/apps/desktop-ui/messages/ja.json
+++ b/apps/desktop-ui/messages/ja.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "編集",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/ko.json b/apps/desktop-ui/messages/ko.json
index 42fffd4a..32ec47c4 100644
--- a/apps/desktop-ui/messages/ko.json
+++ b/apps/desktop-ui/messages/ko.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "편집",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/ms.json b/apps/desktop-ui/messages/ms.json
index cccb3098..4a4d4dca 100644
--- a/apps/desktop-ui/messages/ms.json
+++ b/apps/desktop-ui/messages/ms.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Edit",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/nb.json b/apps/desktop-ui/messages/nb.json
index c38c9936..b938fd1d 100644
--- a/apps/desktop-ui/messages/nb.json
+++ b/apps/desktop-ui/messages/nb.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Rediger",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/nl.json b/apps/desktop-ui/messages/nl.json
index af234c08..7a21baf3 100644
--- a/apps/desktop-ui/messages/nl.json
+++ b/apps/desktop-ui/messages/nl.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Bewerken",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/pl.json b/apps/desktop-ui/messages/pl.json
index 4a0bda1a..2cf1ca83 100644
--- a/apps/desktop-ui/messages/pl.json
+++ b/apps/desktop-ui/messages/pl.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Edytuj",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/pt-BR.json b/apps/desktop-ui/messages/pt-BR.json
index 155e0c9e..41d548b8 100644
--- a/apps/desktop-ui/messages/pt-BR.json
+++ b/apps/desktop-ui/messages/pt-BR.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Editar",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/pt.json b/apps/desktop-ui/messages/pt.json
index 5f85bd71..147402e3 100644
--- a/apps/desktop-ui/messages/pt.json
+++ b/apps/desktop-ui/messages/pt.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Editar",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/ru.json b/apps/desktop-ui/messages/ru.json
index 3d3aca31..34570380 100644
--- a/apps/desktop-ui/messages/ru.json
+++ b/apps/desktop-ui/messages/ru.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Изменить",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/sv.json b/apps/desktop-ui/messages/sv.json
index 46dfd406..ee46d59d 100644
--- a/apps/desktop-ui/messages/sv.json
+++ b/apps/desktop-ui/messages/sv.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Redigera",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/tr.json b/apps/desktop-ui/messages/tr.json
index 7b4039f7..14569464 100644
--- a/apps/desktop-ui/messages/tr.json
+++ b/apps/desktop-ui/messages/tr.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Düzenle",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/uk.json b/apps/desktop-ui/messages/uk.json
index 688b77ca..773edf13 100644
--- a/apps/desktop-ui/messages/uk.json
+++ b/apps/desktop-ui/messages/uk.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Змінити",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/vi.json b/apps/desktop-ui/messages/vi.json
index b270a5b1..016beff5 100644
--- a/apps/desktop-ui/messages/vi.json
+++ b/apps/desktop-ui/messages/vi.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Chỉnh sửa",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/messages/zh.json b/apps/desktop-ui/messages/zh.json
index 45035531..cd3e7a38 100644
--- a/apps/desktop-ui/messages/zh.json
+++ b/apps/desktop-ui/messages/zh.json
@@ -184,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "编辑",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
diff --git a/apps/desktop-ui/src/app/layout.tsx b/apps/desktop-ui/src/app/layout.tsx
index e3d7234a..29f38ec4 100644
--- a/apps/desktop-ui/src/app/layout.tsx
+++ b/apps/desktop-ui/src/app/layout.tsx
@@ -121,7 +121,7 @@ export default async function RootLayout({
         <ThemeProvider
           attribute="class"
           defaultTheme="dark"
-          enableSystem={false}
+          enableSystem
           disableTransitionOnChange
         >
           <NextIntlClientProvider messages={messages}>
diff --git a/apps/desktop-ui/src/components/settings/profile-card.tsx b/apps/desktop-ui/src/components/settings/profile-card.tsx
index 57fe8e38..2c601857 100644
--- a/apps/desktop-ui/src/components/settings/profile-card.tsx
+++ b/apps/desktop-ui/src/components/settings/profile-card.tsx
@@ -2,11 +2,19 @@
 
 import { useEffect, useState } from 'react'
 import { useTranslations } from 'next-intl'
-import { UserRound } from 'lucide-react'
+import { Pencil, UserRound } from 'lucide-react'
 import { toast } from 'sonner'
 import { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar'
 import { Button } from '@/components/ui/button'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { PROFILE_UPDATED_EVENT } from '@/hooks/use-app-user'
@@ -21,6 +29,10 @@ export function ProfileCard() {
   const [name, setName] = useState('')
   const [avatar, setAvatar] = useState('')
   const [saving, setSaving] = useState(false)
+  const [editing, setEditing] = useState(false)
+  // Draft state so cancelling (or closing the dialog) leaves the saved values alone.
+  const [draftName, setDraftName] = useState('')
+  const [draftAvatar, setDraftAvatar] = useState('')
 
   useEffect(() => {
     void getUserPreferences()
@@ -33,15 +45,26 @@ export function ProfileCard() {
       })
   }, [])
 
+  const openEditor = () => {
+    setDraftName(name)
+    setDraftAvatar(avatar)
+    setEditing(true)
+  }
+
   const save = async () => {
+    const nextName = draftName.trim()
+    const nextAvatar = draftAvatar.trim()
     setSaving(true)
     try {
       await patchUserPreferences({
-        displayName: name.trim() || null,
-        avatar: avatar.trim() || null,
+        displayName: nextName || null,
+        avatar: nextAvatar || null,
       })
+      setName(nextName)
+      setAvatar(nextAvatar)
       window.dispatchEvent(new CustomEvent(PROFILE_UPDATED_EVENT))
       toast.success(t('saved'))
+      setEditing(false)
     } catch (e) {
       toast.error(e instanceof Error ? e.message : t('saveError'))
     } finally {
@@ -62,7 +85,7 @@ export function ProfileCard() {
         </CardTitle>
         <CardDescription>{t('description')}</CardDescription>
       </CardHeader>
-      <CardContent className="space-y-6">
+      <CardContent>
         <div className="flex items-center gap-4">
           <Avatar className="h-12 w-12 border border-border">
             {avatar ? <AvatarImage src={avatar} alt={t('avatarAlt')} /> : null}
@@ -70,13 +93,31 @@ export function ProfileCard() {
               {displayName[0]!.toUpperCase()}
             </AvatarFallback>
           </Avatar>
-          <div className="grid flex-1 gap-4 sm:grid-cols-2">
+          <div className="min-w-0 flex-1">
+            <p className="truncate font-medium">{displayName}</p>
+            <p className="truncate text-xs text-muted-foreground">
+              {avatar || t('avatarPlaceholder')}
+            </p>
+          </div>
+          <Button variant="outline" size="icon" onClick={openEditor} aria-label={t('edit')} title={t('edit')}>
+            <Pencil className="h-4 w-4" />
+          </Button>
+        </div>
+      </CardContent>
+
+      <Dialog open={editing} onOpenChange={setEditing}>
+        <DialogContent className="sm:max-w-md">
+          <DialogHeader>
+            <DialogTitle>{t('title')}</DialogTitle>
+            <DialogDescription>{t('description')}</DialogDescription>
+          </DialogHeader>
+          <div className="space-y-4">
             <div className="space-y-2">
               <Label htmlFor="profile-name">{t('nameLabel')}</Label>
               <Input
                 id="profile-name"
-                value={name}
-                onChange={(e) => setName(e.target.value)}
+                value={draftName}
+                onChange={(e) => setDraftName(e.target.value)}
                 placeholder={t('namePlaceholder')}
               />
             </div>
@@ -84,17 +125,19 @@ export function ProfileCard() {
               <Label htmlFor="profile-avatar">{t('avatarLabel')}</Label>
               <Input
                 id="profile-avatar"
-                value={avatar}
-                onChange={(e) => setAvatar(e.target.value)}
+                value={draftAvatar}
+                onChange={(e) => setDraftAvatar(e.target.value)}
                 placeholder={t('avatarPlaceholder')}
               />
             </div>
           </div>
-        </div>
-        <Button size="sm" onClick={() => void save()} disabled={saving}>
-          {t('save')}
-        </Button>
-      </CardContent>
+          <DialogFooter>
+            <Button size="sm" onClick={() => void save()} disabled={saving}>
+              {t('save')}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
     </Card>
   )
 }

From 63d78ed9cd79d35b1a37b2ce348f2174fd4e854b Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 12:38:17 +0530
Subject: [PATCH 18/39] fix(api-client): toolbar and key/value spacing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Params/Headers: the column header was a flex row with no `gap` while the
  data rows had `gap-2`, and its trailing spacer was `w-10` against a 36px
  delete button — so KEY/VALUE never sat over their inputs. Both now share one
  grid template, and the labels use the Input's own `px-3`.
- Toolbar: `OfflineIndicator` renders null whenever you are online, but the
  divider before it rendered unconditionally, leaving a hairline and two gaps
  hanging off the end of the row. The indicator now brings its own separator.
- Group dividers were `bg-border/50` and `mx-1`: too faint to read as dividers
  on a dark ground, so they looked like unexplained holes, and the extra margin
  broke the row's 8px rhythm. Now `bg-border`, spaced by the row's own gap.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/components/api-client/api-client.tsx  |  6 ++--
 .../api-client/key-value-editor.tsx           | 25 ++++++++------
 .../api-client/offline-indicator.tsx          | 34 +++++++++++--------
 3 files changed, 38 insertions(+), 27 deletions(-)

diff --git a/apps/desktop-ui/src/components/api-client/api-client.tsx b/apps/desktop-ui/src/components/api-client/api-client.tsx
index 3a8b2e72..2d297673 100644
--- a/apps/desktop-ui/src/components/api-client/api-client.tsx
+++ b/apps/desktop-ui/src/components/api-client/api-client.tsx
@@ -1238,7 +1238,7 @@ function ApiClientInner() {
                                 >
                                     <IconSettings className="h-4 w-4" />
                                 </Button>
-                                <div className="h-6 w-px bg-border/50 mx-1" />
+                                <div className="h-5 w-px shrink-0 bg-border" />
                                 <Button
                                     variant="ghost"
                                     size="icon"
@@ -1288,7 +1288,9 @@ function ApiClientInner() {
                                         </DropdownMenuItem>
                                     </DropdownMenuContent>
                                 </DropdownMenu>
-                                <div className="h-6 w-px bg-border/50 mx-1" />
+                                {/* No divider here — OfflineIndicator renders null while
+                                    online, and a lone divider left a phantom gap. It brings
+                                    its own separator when it has something to show. */}
                                 <OfflineIndicator />
                             </>
                         )}
diff --git a/apps/desktop-ui/src/components/api-client/key-value-editor.tsx b/apps/desktop-ui/src/components/api-client/key-value-editor.tsx
index 89f48bb5..df0f0ab6 100644
--- a/apps/desktop-ui/src/components/api-client/key-value-editor.tsx
+++ b/apps/desktop-ui/src/components/api-client/key-value-editor.tsx
@@ -7,6 +7,10 @@ import { Input } from "@/components/ui/input"
 import { Checkbox } from "@/components/ui/checkbox"
 import { KeyValueItem } from "./types"
 import { useTranslations } from "next-intl"
+import { cn } from "@/lib/utils"
+
+/** 2rem checkbox · key · value · 2.25rem delete button (h-9 w-9). */
+const ROW_GRID = "grid grid-cols-[2rem_minmax(0,1fr)_minmax(0,1fr)_2.25rem] items-center gap-2"
 
 interface KeyValueEditorProps {
     items: KeyValueItem[]
@@ -36,15 +40,18 @@ export function KeyValueEditor({ items, onChange }: KeyValueEditorProps) {
 
     return (
         <div className="space-y-2">
-            <div className="flex items-center font-medium text-sm text-muted-foreground mb-2">
-                <div className="w-8 text-center"></div>
-                <div className="flex-1 px-2">{t("columnKey")}</div>
-                <div className="flex-1 px-2">{t("columnValue")}</div>
-                <div className="w-10"></div>
+            {/* Header and rows share one grid template — a flex header with no
+                `gap` drifted out of line with the rows, which have one. */}
+            <div className={cn(ROW_GRID, "text-xs font-medium uppercase tracking-wide text-muted-foreground")}>
+                <div />
+                {/* px-3 matches the Input's own padding so the label sits over its text */}
+                <div className="px-3">{t("columnKey")}</div>
+                <div className="px-3">{t("columnValue")}</div>
+                <div />
             </div>
             {items.map((item) => (
-                <div key={item.id} className="flex items-center gap-2">
-                    <div className="w-8 flex justify-center">
+                <div key={item.id} className={ROW_GRID}>
+                    <div className="flex justify-center">
                         <Checkbox
                             checked={item.active}
                             onCheckedChange={(checked) =>
@@ -56,19 +63,17 @@ export function KeyValueEditor({ items, onChange }: KeyValueEditorProps) {
                         placeholder={t("placeholderKey")}
                         value={item.key}
                         onChange={(e) => updateItem(item.id, "key", e.target.value)}
-                        className="flex-1"
                     />
                     <Input
                         placeholder={t("placeholderValue")}
                         value={item.value}
                         onChange={(e) => updateItem(item.id, "value", e.target.value)}
-                        className="flex-1"
                     />
                     <Button
                         variant="ghost"
                         size="icon"
                         onClick={() => deleteItem(item.id)}
-                        className="text-muted-foreground hover:text-destructive"
+                        className="size-9 text-muted-foreground hover:text-destructive"
                     >
                         <Trash2 className="h-4 w-4" />
                     </Button>
diff --git a/apps/desktop-ui/src/components/api-client/offline-indicator.tsx b/apps/desktop-ui/src/components/api-client/offline-indicator.tsx
index 94a23c2b..63c22249 100644
--- a/apps/desktop-ui/src/components/api-client/offline-indicator.tsx
+++ b/apps/desktop-ui/src/components/api-client/offline-indicator.tsx
@@ -44,21 +44,25 @@ export function OfflineIndicator() {
     // Hide when online + nothing queued.
     if (online && queue.length === 0) return null
 
+    // Carries its own separator so the toolbar has no dangling divider while hidden.
     return (
-        <button
-            onClick={() => doDrain("manual")}
-            className={cn(
-                "h-8 px-2 rounded-md text-xs flex items-center gap-1.5 border",
-                online ? "bg-amber-500/10 border-amber-500/30 text-amber-700" : "bg-rose-500/10 border-rose-500/30 text-rose-700",
-            )}
-            title={online ? "Replay pending changes" : "You are offline"}
-        >
-            {online ? <Cloud className="h-3.5 w-3.5" /> : <CloudOff className="h-3.5 w-3.5" />}
-            <span className="font-semibold">{online ? "Pending" : "Offline"}</span>
-            {queue.length > 0 && (
-                <span className="font-mono">{queue.length}</span>
-            )}
-            {draining && <RefreshCw className="h-3 w-3 animate-spin" />}
-        </button>
+        <>
+            <div className="h-5 w-px shrink-0 bg-border" />
+            <button
+                onClick={() => doDrain("manual")}
+                className={cn(
+                    "h-8 px-2 rounded-md text-xs flex items-center gap-1.5 border",
+                    online ? "bg-amber-500/10 border-amber-500/30 text-amber-700" : "bg-rose-500/10 border-rose-500/30 text-rose-700",
+                )}
+                title={online ? "Replay pending changes" : "You are offline"}
+            >
+                {online ? <Cloud className="h-3.5 w-3.5" /> : <CloudOff className="h-3.5 w-3.5" />}
+                <span className="font-semibold">{online ? "Pending" : "Offline"}</span>
+                {queue.length > 0 && (
+                    <span className="font-mono">{queue.length}</span>
+                )}
+                {draining && <RefreshCw className="h-3 w-3 animate-spin" />}
+            </button>
+        </>
     )
 }

From abf5190e8af20497e9268bd5ea8c30ee06bfd4af Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 13:50:31 +0530
Subject: [PATCH 19/39] revert(api-client): load Monaco from the CDN again
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drops the local Monaco bundling from c50bd6e7 per maintainer decision:
removes lib/monaco-loader.ts, scripts/copy-monaco.mjs, the pre{dev,build}
hooks, the build-tauri copy step and the public/monaco gitignore entry.
@monaco-editor/loader falls back to its default
cdn.jsdelivr.net/npm/monaco-editor@0.55.1/min/vs.

Keeps monaco-editor at 0.55.1: it is a types-only dependency here, and 0.55.1
is the exact version the loader pulls from the CDN, so the local typings match
what runs.

Trade-off, recorded deliberately: with no network every Monaco-backed editor
(API client body/scripts/response plus ~15 other tools) stays on
"Loading editor..." — the app is not fully offline while this stands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .gitignore                                    |  2 --
 apps/desktop-ui/package.json                  |  3 ---
 apps/desktop-ui/scripts/build-tauri.mjs       |  6 -----
 apps/desktop-ui/scripts/copy-monaco.mjs       | 22 -------------------
 .../src/components/client-shell.tsx           |  1 -
 apps/desktop-ui/src/lib/monaco-loader.ts      |  6 -----
 6 files changed, 40 deletions(-)
 delete mode 100644 apps/desktop-ui/scripts/copy-monaco.mjs
 delete mode 100644 apps/desktop-ui/src/lib/monaco-loader.ts

diff --git a/.gitignore b/.gitignore
index f6860576..1b03b5fc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,8 +31,6 @@ yarn.lock
 /out/
 apps/*/.next/
 apps/*/out/
-# Monaco AMD bundle copied from node_modules by apps/desktop-ui/scripts/copy-monaco.mjs
-apps/desktop-ui/public/monaco/
 apps/*/.agent
 # production
 /build
diff --git a/apps/desktop-ui/package.json b/apps/desktop-ui/package.json
index c21c5602..20e52f10 100644
--- a/apps/desktop-ui/package.json
+++ b/apps/desktop-ui/package.json
@@ -6,15 +6,12 @@
     "node": ">=20.19.0"
   },
   "scripts": {
-    "predev": "node scripts/copy-monaco.mjs",
     "dev": "next dev",
-    "prebuild": "node scripts/copy-monaco.mjs",
     "build": "next build",
     "lint": "eslint .",
     "test": "jest",
     "test:watch": "jest --watch",
     "build:tauri": "node scripts/build-tauri.mjs",
-    "predev:tauri": "node scripts/copy-monaco.mjs",
     "dev:tauri": "NEXT_PUBLIC_TAURI=1 next dev"
   },
   "dependencies": {
diff --git a/apps/desktop-ui/scripts/build-tauri.mjs b/apps/desktop-ui/scripts/build-tauri.mjs
index b3824afc..849f261e 100644
--- a/apps/desktop-ui/scripts/build-tauri.mjs
+++ b/apps/desktop-ui/scripts/build-tauri.mjs
@@ -25,12 +25,6 @@ if (major < 20 || (major === 20 && minor < 19)) {
   process.exit(1);
 }
 
-// Monaco must be served from the bundle, not jsdelivr (offline app).
-const copyMonaco = spawnSync(process.execPath, [path.join(uiRoot, "scripts", "copy-monaco.mjs")], {
-  stdio: "inherit",
-});
-if (copyMonaco.status !== 0) process.exit(copyMonaco.status ?? 1);
-
 const env = {
   ...process.env,
   TAURI_BUILD: "1",
diff --git a/apps/desktop-ui/scripts/copy-monaco.mjs b/apps/desktop-ui/scripts/copy-monaco.mjs
deleted file mode 100644
index 3f044fa3..00000000
--- a/apps/desktop-ui/scripts/copy-monaco.mjs
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env node
-/**
- * Copy Monaco's prebuilt AMD bundle into public/ so the editor loads from the
- * app itself instead of jsdelivr (the @monaco-editor/loader default). The
- * desktop app is offline-first; a CDN fetch per cold launch broke every editor
- * without network. Output is gitignored — runs from the pre* lifecycle hooks.
- */
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const uiRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const src = path.join(uiRoot, "node_modules", "monaco-editor", "min", "vs");
-const dest = path.join(uiRoot, "public", "monaco", "vs");
-
-if (!fs.existsSync(src)) {
-  console.error(`copy-monaco: ${src} missing — run pnpm install first`);
-  process.exit(1);
-}
-fs.rmSync(dest, { recursive: true, force: true });
-fs.cpSync(src, dest, { recursive: true });
-console.log("copy-monaco: public/monaco/vs refreshed");
diff --git a/apps/desktop-ui/src/components/client-shell.tsx b/apps/desktop-ui/src/components/client-shell.tsx
index 467e31f0..1a7d05f4 100644
--- a/apps/desktop-ui/src/components/client-shell.tsx
+++ b/apps/desktop-ui/src/components/client-shell.tsx
@@ -5,7 +5,6 @@ import { Suspense, useEffect, type ReactNode } from "react"
 import { UserPreferencesSync } from "@/components/user-preferences-sync"
 import { PinnedToolsPreferencesSync } from "@/components/pinned-tools-preferences-sync"
 import { initTelemetry } from "@/lib/telemetry"
-import "@/lib/monaco-loader"
 
 const GlobalCommandPalette = dynamic(
   () => import('@/components/global-command-palette').then((m) => m.GlobalCommandPalette),
diff --git a/apps/desktop-ui/src/lib/monaco-loader.ts b/apps/desktop-ui/src/lib/monaco-loader.ts
deleted file mode 100644
index 48e679bd..00000000
--- a/apps/desktop-ui/src/lib/monaco-loader.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { loader } from "@monaco-editor/react";
-
-// Serve Monaco from the app bundle (scripts/copy-monaco.mjs → public/monaco/vs)
-// instead of the loader's jsdelivr default. Must run before any <Editor> mounts;
-// imported once from the client shell for that reason.
-loader.config({ paths: { vs: "/monaco/vs" } });

From 2b7e0a1e69407dea2ce2861382062de8510283c4 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 14:32:07 +0530
Subject: [PATCH 20/39] fix(tools): collapsed sidebar keeps its items, identity
 and top spacing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported against the API client, but two of the three live in the shared
ToolSidebarLayout used by 11 tools.

- Collapsed, the 40px rail rendered a single toggle: no items, no identity,
  just an empty strip. It now shows the tool's accent icon, which peeks the
  full panel as a flyout (the existing Sheet, previously mobile-only) so the
  list stays reachable without giving up the width; the pin-open toggle sits
  below it.
- New `isOverlay` on the panel context — true for the mobile sheet and the new
  desktop flyout — so picking a row dismisses a floating panel but never the
  pinned one. All five call sites moved off `isMobile`, which would have left
  the desktop flyout covering the thing you just opened.
- API client: the tool had no title of its own (the panel header says
  "Collections"), leaving it unnamed once collapsed, and its toolbar sat flush
  against the top edge. Adds an `h1` from the existing `Navigation.apiClient`
  key — present in all 27 locales, so no new strings — and `px-4 pt-3`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/components/api-client/api-client.tsx  |  6 +-
 .../collections/collections-sidebar.tsx       |  7 ++-
 .../bookmarks/bookmarks-manager.tsx           |  2 +-
 .../data-explorer/unified-sidebar.tsx         |  2 +-
 .../src/components/notes/NotesSidebar.tsx     |  2 +-
 .../components/s3-drive/bucket-sidebar.tsx    |  2 +-
 .../src/components/tools/tool-sidebar.tsx     | 59 +++++++++++++++----
 7 files changed, 60 insertions(+), 20 deletions(-)

diff --git a/apps/desktop-ui/src/components/api-client/api-client.tsx b/apps/desktop-ui/src/components/api-client/api-client.tsx
index 2d297673..acd566a5 100644
--- a/apps/desktop-ui/src/components/api-client/api-client.tsx
+++ b/apps/desktop-ui/src/components/api-client/api-client.tsx
@@ -110,6 +110,7 @@ function buildRequestUrl(raw: string): URL {
 
 function ApiClientInner() {
     const t = useTranslations("ApiClient")
+    const tNav = useTranslations("Navigation")
     const { tabs, activeTabId, activeTab } = useTabs()
     const { addTab, appendTab, closeTab, duplicateTab, renameTab, reorderTabs, setActiveTabId, updateActiveTab } = useTabsActions()
 
@@ -1149,7 +1150,10 @@ function ApiClientInner() {
             className="mobile-nav-offset"
         >
             <div className="flex-1 flex flex-col gap-4 min-w-0 h-full">
-                <div className="flex flex-wrap justify-between items-center gap-2">
+                <div className="flex flex-wrap justify-between items-center gap-2 px-4 pt-3">
+                    {/* The panel header carries "Collections"; without this the tool
+                        itself was unnamed, and unnamed entirely once collapsed. */}
+                    <h1 className="text-sm font-semibold tracking-tight">{tNav("apiClient")}</h1>
                     <div className="flex flex-wrap items-center gap-2 ml-auto">
                         {isMobile ? (
                             /* Mobile: secondary actions collapsed into dropdown */
diff --git a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
index f94fddb2..52cddd36 100644
--- a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
+++ b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
@@ -57,12 +57,13 @@ interface CollectionsSidebarProps {
 
 export function CollectionsSidebar({ onLoadRequest: loadRequest }: CollectionsSidebarProps) {
     const panel = useToolSidebarPanel()
-    // On mobile the panel is a sheet over the request pane — loading a request
-    // has to dismiss it or the loaded request stays hidden behind the sheet.
+    // While the panel floats (mobile sheet, or the desktop flyout from the
+    // collapsed rail), loading a request has to dismiss it or the loaded
+    // request stays hidden behind the panel.
     const onLoadRequest = React.useCallback(
         (request: CollectionRequest) => {
             loadRequest(request)
-            if (panel?.isMobile) panel.close()
+            if (panel?.isOverlay) panel.close()
         },
         [loadRequest, panel],
     )
diff --git a/apps/desktop-ui/src/components/bookmarks/bookmarks-manager.tsx b/apps/desktop-ui/src/components/bookmarks/bookmarks-manager.tsx
index 4a0c8d1f..1a515766 100644
--- a/apps/desktop-ui/src/components/bookmarks/bookmarks-manager.tsx
+++ b/apps/desktop-ui/src/components/bookmarks/bookmarks-manager.tsx
@@ -48,7 +48,7 @@ function FolderPanel({ onSelectFolder }: { onSelectFolder: (id: string | null) =
         <FolderTree
             onSelectFolder={(id: string | null) => {
                 onSelectFolder(id)
-                if (panel?.isMobile) panel.close()
+                if (panel?.isOverlay) panel.close()
             }}
         />
     )
diff --git a/apps/desktop-ui/src/components/data-explorer/unified-sidebar.tsx b/apps/desktop-ui/src/components/data-explorer/unified-sidebar.tsx
index 288d5cdd..24b9b083 100644
--- a/apps/desktop-ui/src/components/data-explorer/unified-sidebar.tsx
+++ b/apps/desktop-ui/src/components/data-explorer/unified-sidebar.tsx
@@ -203,7 +203,7 @@ export function UnifiedSidebar({
     const handleOpenTab = useCallback(
         (connection: UnifiedConnection, req: OpenTabRequest) => {
             onOpenTab(connection, req);
-            if (panel?.isMobile) panel.close();
+            if (panel?.isOverlay) panel.close();
         },
         [onOpenTab, panel]
     );
diff --git a/apps/desktop-ui/src/components/notes/NotesSidebar.tsx b/apps/desktop-ui/src/components/notes/NotesSidebar.tsx
index bdf48fc5..25fc902f 100644
--- a/apps/desktop-ui/src/components/notes/NotesSidebar.tsx
+++ b/apps/desktop-ui/src/components/notes/NotesSidebar.tsx
@@ -101,7 +101,7 @@ const NoteItem = React.memo(({
         onExpandPath(note.id);
         // On mobile the panel is a sheet over the editor — close it so the
         // opened note is actually visible.
-        if (panel?.isMobile) panel.close();
+        if (panel?.isOverlay) panel.close();
     };
 
     const handleCreateChild = async (e: React.MouseEvent) => {
diff --git a/apps/desktop-ui/src/components/s3-drive/bucket-sidebar.tsx b/apps/desktop-ui/src/components/s3-drive/bucket-sidebar.tsx
index 6532c4f9..11c78fa7 100644
--- a/apps/desktop-ui/src/components/s3-drive/bucket-sidebar.tsx
+++ b/apps/desktop-ui/src/components/s3-drive/bucket-sidebar.tsx
@@ -134,7 +134,7 @@ export function BucketSidebar({ encryptionKey }: Props) {
                                     setActiveConnection(conn.id)
                                     // On mobile the panel is a sheet covering the
                                     // browser — close it so the pick is visible.
-                                    if (panel?.isMobile) panel.close()
+                                    if (panel?.isOverlay) panel.close()
                                 }}
                             >
                                 {/* Active indicator line */}
diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
index 04169bd6..f4fcca86 100644
--- a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
@@ -24,6 +24,12 @@ import { cn } from '@/lib/utils'
 interface ToolSidebarContextValue {
   /** True when the panel is inside the mobile sheet rather than the column. */
   isMobile: boolean
+  /**
+   * True whenever the panel floats over the content — the mobile sheet, or the
+   * desktop flyout opened from the collapsed rail. Rows should `close()` on
+   * select in this state so the pick isn't hidden behind the panel.
+   */
+  isOverlay: boolean
   /**
    * Dismiss the panel. No-op on desktop when the panel is pinned open — call it
    * from list rows so picking an item on mobile closes the sheet instead of
@@ -158,14 +164,19 @@ export function ToolSidebarLayout({
   // colour is continuous from the grid to the tool. Falls back to primary.
   const accent = categoryAccent(toolCategoryMap[toolId] ?? '')
 
+  const collapsedOnDesktop = !isMobile && collapsed
+  // The panel floats when it is the mobile sheet, or the desktop flyout peeked
+  // out of the collapsed rail.
+  const isOverlay = (isMobile || collapsedOnDesktop) && sheetOpen
+
   const close = React.useCallback(() => {
-    if (isMobile) setSheetOpen(false)
-    else setCollapsed(toolId, true)
-  }, [isMobile, setCollapsed, toolId])
+    if (sheetOpen) setSheetOpen(false)
+    else if (!isMobile) setCollapsed(toolId, true)
+  }, [isMobile, setCollapsed, toolId, sheetOpen])
 
   const ctx = React.useMemo<ToolSidebarContextValue>(
-    () => ({ isMobile, close }),
-    [isMobile, close],
+    () => ({ isMobile, isOverlay, close }),
+    [isMobile, isOverlay, close],
   )
 
   const panel = (
@@ -213,7 +224,9 @@ export function ToolSidebarLayout({
       <div className={cn('flex h-full min-h-0 w-full overflow-hidden', className)}>
         {!isMobile && !collapsed && <div className="w-64 shrink-0">{panel}</div>}
 
-        {isMobile && (
+        {/* Also used on desktop while collapsed, so the rail can peek the panel
+            without giving up the width. */}
+        {hidden && (
           <Sheet open={sheetOpen} onOpenChange={setSheetOpen}>
             <SheetContent side="left" className="w-72 p-0">
               <SheetHeader className="sr-only">
@@ -226,19 +239,41 @@ export function ToolSidebarLayout({
 
         {/* Re-open lives in a 40px rail, not a floating overlay: every tool's
             main pane already puts a toolbar or header at the top-left, and an
-            absolutely-positioned button would sit on top of it. */}
+            absolutely-positioned button would sit on top of it. The rail keeps
+            the tool's identity and a way to reach the list — a lone toggle left
+            the collapsed state looking like an empty strip. */}
         {hidden && (
-          <div className="flex w-10 shrink-0 flex-col items-center border-r bg-muted/10 pt-2">
+          <div className="flex w-10 shrink-0 flex-col items-center gap-1 border-r bg-muted/10 pt-2">
             <Button
               variant="ghost"
               size="icon"
               className="h-8 w-8 cursor-pointer"
-              onClick={() => (isMobile ? setSheetOpen(true) : setCollapsed(toolId, false))}
-              aria-label={t('show')}
-              title={t('show')}
+              onClick={() => setSheetOpen(true)}
+              aria-label={title}
+              title={title}
             >
-              <PanelLeftOpen className="h-4 w-4" />
+              <span
+                className={cn(
+                  'flex h-6 w-6 shrink-0 items-center justify-center rounded-md',
+                  accent.bg,
+                  accent.text,
+                )}
+              >
+                <Icon className="h-3.5 w-3.5" />
+              </span>
             </Button>
+            {!isMobile && (
+              <Button
+                variant="ghost"
+                size="icon"
+                className="h-8 w-8 cursor-pointer"
+                onClick={() => setCollapsed(toolId, false)}
+                aria-label={t('show')}
+                title={t('show')}
+              >
+                <PanelLeftOpen className="h-4 w-4" />
+              </Button>
+            )}
           </div>
         )}
 

From 4f3b17e1c4a6c5b9214ba5f0642dbbb9d4bbb813 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 14:40:22 +0530
Subject: [PATCH 21/39] fix(tools): one sidebar-toggle glyph at a time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two follow-ups to the collapsed-rail work, both about showing one control
where there should be one:

- The rail rendered the tool icon *and* a separate expand arrow — two buttons
  for the same action stacked in 40px. Now a single button: the tool's accent
  icon at rest (so the strip still names the tool), swapping to the toggle
  glyph on hover/focus. The desktop flyout goes with it; clicking expands, as
  the glyph promises. `isOverlay` narrows back to the mobile sheet.
- `PanelLeftClose` / `PanelLeftOpen` draw a panel outline *and* a chevron
  inside 16px, which at this size reads as two icons overlapping rather than
  one control — visible in the Notes header. Both replaced with plain
  `PanelLeft`, the same glyph shadcn uses for its sidebar trigger.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/components/tools/tool-sidebar.tsx     | 56 ++++++++-----------
 1 file changed, 24 insertions(+), 32 deletions(-)

diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
index f4fcca86..cb7d6e35 100644
--- a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
@@ -2,7 +2,10 @@
 
 import * as React from 'react'
 import { createPortal } from 'react-dom'
-import { PanelLeftClose, PanelLeftOpen } from 'lucide-react'
+// One glyph for the sidebar toggle in both directions. `PanelLeftClose` /
+// `PanelLeftOpen` draw a panel *and* a chevron inside 16px, which reads as two
+// overlapping icons rather than one control.
+import { PanelLeft } from 'lucide-react'
 import { useTranslations } from 'next-intl'
 import { Button } from '@/components/ui/button'
 import { Sheet, SheetContent, SheetHeader, SheetTitle } from '@/components/ui/sheet'
@@ -25,9 +28,9 @@ interface ToolSidebarContextValue {
   /** True when the panel is inside the mobile sheet rather than the column. */
   isMobile: boolean
   /**
-   * True whenever the panel floats over the content — the mobile sheet, or the
-   * desktop flyout opened from the collapsed rail. Rows should `close()` on
-   * select in this state so the pick isn't hidden behind the panel.
+   * True whenever the panel floats over the content rather than sitting in its
+   * own column. Rows should `close()` on select in this state so the pick isn't
+   * left hidden behind the panel.
    */
   isOverlay: boolean
   /**
@@ -164,10 +167,8 @@ export function ToolSidebarLayout({
   // colour is continuous from the grid to the tool. Falls back to primary.
   const accent = categoryAccent(toolCategoryMap[toolId] ?? '')
 
-  const collapsedOnDesktop = !isMobile && collapsed
-  // The panel floats when it is the mobile sheet, or the desktop flyout peeked
-  // out of the collapsed rail.
-  const isOverlay = (isMobile || collapsedOnDesktop) && sheetOpen
+  // The panel floats only as the mobile sheet; on desktop it is a pinned column.
+  const isOverlay = isMobile && sheetOpen
 
   const close = React.useCallback(() => {
     if (sheetOpen) setSheetOpen(false)
@@ -206,7 +207,7 @@ export function ToolSidebarLayout({
               aria-label={t('hide')}
               title={t('hide')}
             >
-              <PanelLeftClose className="h-4 w-4" />
+              <PanelLeft className="h-4 w-4" />
             </Button>
           )}
         </div>
@@ -224,9 +225,7 @@ export function ToolSidebarLayout({
       <div className={cn('flex h-full min-h-0 w-full overflow-hidden', className)}>
         {!isMobile && !collapsed && <div className="w-64 shrink-0">{panel}</div>}
 
-        {/* Also used on desktop while collapsed, so the rail can peek the panel
-            without giving up the width. */}
-        {hidden && (
+        {isMobile && (
           <Sheet open={sheetOpen} onOpenChange={setSheetOpen}>
             <SheetContent side="left" className="w-72 p-0">
               <SheetHeader className="sr-only">
@@ -239,41 +238,34 @@ export function ToolSidebarLayout({
 
         {/* Re-open lives in a 40px rail, not a floating overlay: every tool's
             main pane already puts a toolbar or header at the top-left, and an
-            absolutely-positioned button would sit on top of it. The rail keeps
-            the tool's identity and a way to reach the list — a lone toggle left
-            the collapsed state looking like an empty strip. */}
+            absolutely-positioned button would sit on top of it.
+
+            One control, one job. The rail carries the tool's accent icon so the
+            collapsed strip still says which tool you are in, and swaps it for
+            the expand arrow on hover/focus — showing both at once read as two
+            competing buttons for the same action. */}
         {hidden && (
-          <div className="flex w-10 shrink-0 flex-col items-center gap-1 border-r bg-muted/10 pt-2">
+          <div className="flex w-10 shrink-0 flex-col items-center border-r bg-muted/10 pt-2">
             <Button
               variant="ghost"
               size="icon"
-              className="h-8 w-8 cursor-pointer"
-              onClick={() => setSheetOpen(true)}
-              aria-label={title}
-              title={title}
+              className="group h-8 w-8 cursor-pointer"
+              onClick={() => (isMobile ? setSheetOpen(true) : setCollapsed(toolId, false))}
+              aria-label={t('show')}
+              title={`${title} — ${t('show')}`}
             >
               <span
                 className={cn(
                   'flex h-6 w-6 shrink-0 items-center justify-center rounded-md',
+                  'group-hover:hidden group-focus-visible:hidden',
                   accent.bg,
                   accent.text,
                 )}
               >
                 <Icon className="h-3.5 w-3.5" />
               </span>
+              <PanelLeft className="hidden h-4 w-4 group-hover:block group-focus-visible:block" />
             </Button>
-            {!isMobile && (
-              <Button
-                variant="ghost"
-                size="icon"
-                className="h-8 w-8 cursor-pointer"
-                onClick={() => setCollapsed(toolId, false)}
-                aria-label={t('show')}
-                title={t('show')}
-              >
-                <PanelLeftOpen className="h-4 w-4" />
-              </Button>
-            )}
           </div>
         )}
 

From a360efa1d0dd93673b9137a597aae4290954fea8 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 15:03:14 +0530
Subject: [PATCH 22/39] Update Cargo.toml

---
 apps/desktop/src-tauri/Cargo.toml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index c01f349a..0a5af671 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -29,7 +29,6 @@ tauri-plugin-persisted-scope = "2"
 tauri-plugin-window-state = "2"
 tauri-plugin-updater = "2"
 tauri-plugin-process = "2"
-tauri-plugin-dialog = "2"
 # Secure Files: the .mydt format/crypto lives in the shared `mydt` crate (also the CLI).
 mydt = { path = "../../../crates/mydt" }
 zeroize = "1"

From 21a1034f83bc01055e25761e2a0526cea4e0a4cf Mon Sep 17 00:00:00 2001
From: anuphilipp3 <anuphilipp3@gmail.com>
Date: Mon, 24 Aug 2026 15:03:35 +0530
Subject: [PATCH 23/39] Network & API

---
 apps/desktop-ui/AGENTS.md                     |   9 +
 apps/desktop-ui/CLAUDE.md                     |   1 +
 .../curl-to-code/curl-to-code-layout.tsx      | 149 ++++++-----
 .../http-status-codes-layout.tsx              | 201 +++++++-------
 .../ip-subnet-calculator-layout.tsx           |  38 ++-
 .../mime-type-lookup-layout.tsx               | 245 +++++++++---------
 .../user-agent-parser-layout.tsx              | 139 +++++-----
 .../websocket-tester-layout.tsx               |  75 +++---
 .../whois-lookup/whois-lookup-layout.tsx      |  64 +++--
 9 files changed, 445 insertions(+), 476 deletions(-)
 create mode 100644 apps/desktop-ui/AGENTS.md
 create mode 100644 apps/desktop-ui/CLAUDE.md

diff --git a/apps/desktop-ui/AGENTS.md b/apps/desktop-ui/AGENTS.md
new file mode 100644
index 00000000..643577df
--- /dev/null
+++ b/apps/desktop-ui/AGENTS.md
@@ -0,0 +1,9 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->
diff --git a/apps/desktop-ui/CLAUDE.md b/apps/desktop-ui/CLAUDE.md
new file mode 100644
index 00000000..43c994c2
--- /dev/null
+++ b/apps/desktop-ui/CLAUDE.md
@@ -0,0 +1 @@
+@AGENTS.md
diff --git a/apps/desktop-ui/src/components/curl-to-code/curl-to-code-layout.tsx b/apps/desktop-ui/src/components/curl-to-code/curl-to-code-layout.tsx
index 3f366c6b..c2a95422 100644
--- a/apps/desktop-ui/src/components/curl-to-code/curl-to-code-layout.tsx
+++ b/apps/desktop-ui/src/components/curl-to-code/curl-to-code-layout.tsx
@@ -4,8 +4,6 @@ import React, { useMemo, useState } from 'react'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
 import { useTranslations } from 'next-intl'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
-import { Label } from '@/components/ui/label'
 import {
   Select,
   SelectContent,
@@ -13,11 +11,10 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@/components/ui/select'
-import { Check, Copy, FileText, Trash2 } from 'lucide-react'
+import { Check, Copy, Trash2 } from 'lucide-react'
 import { IconTerminal2 } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
+import { ToolPanels, IOPanel, ToolTextArea } from '@/components/tools/io-panel'
 import { CURL_TARGETS, curlToCode, type CurlTarget } from '@/lib/curl-to-code'
 
 const SAMPLE = `curl -X POST https://api.example.com/v1/users \\
@@ -33,83 +30,95 @@ export function CurlToCodeLayout() {
 
   const result = useMemo(() => curlToCode(input, target), [input, target])
 
-  return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconTerminal2}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Network & API']}
-          offline={false}
-        />
-      </RevealItem>
+  const toolbar = (
+    <div className="flex flex-wrap items-end gap-4 rounded-lg border border-border bg-card px-4 py-3">
+      <Select value={target} onValueChange={(v) => setTarget(v as CurlTarget)}>
+        <SelectTrigger className="w-[190px]">
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent>
+          {CURL_TARGETS.map((tg) => (
+            <SelectItem key={tg.value} value={tg.value}>
+              {tg.label}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    </div>
+  )
 
-      <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 lg:grid-cols-2">
-        <Card className="flex flex-col overflow-hidden min-h-0">
-          <div className="flex items-center justify-between border-b border-border/50 bg-muted/30 px-4 py-2.5">
-            <div className="flex items-center gap-2">
-              <FileText className="h-3.5 w-3.5 text-muted-foreground" />
-              <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">{t('panels.input')}</Label>
-            </div>
-            <div className="flex items-center gap-1">
-              <Button variant="ghost" size="sm" className="h-7 px-2 text-xs" onClick={() => setInput(SAMPLE)}>
+  return (
+    <ToolShell
+      icon={IconTerminal2}
+      title={t('title')}
+      description={t('subtitle')}
+      toolbar={toolbar}
+    >
+      <ToolPanels className="lg:grid-cols-2">
+        <IOPanel
+          label={t('panels.input')}
+          actions={
+            <>
+              <Button
+                variant="ghost"
+                size="sm"
+                className="h-7 px-2 text-xs"
+                onClick={() => setInput(SAMPLE)}
+              >
                 {t('sample')}
               </Button>
-              <Button variant="ghost" size="icon" className="h-7 w-7" onClick={() => setInput('')} disabled={!input} title={t('clear')}>
+              <Button
+                variant="ghost"
+                size="icon"
+                className="h-6 w-6"
+                onClick={() => setInput('')}
+                disabled={!input}
+                title={t('clear')}
+              >
                 <Trash2 className="h-3.5 w-3.5" />
               </Button>
-            </div>
-          </div>
-          <div className="relative min-h-0 flex-1">
-            <textarea
-              value={input}
-              onChange={(e) => setInput(e.target.value)}
-              placeholder={t('placeholder')}
-              className="absolute inset-0 h-full w-full resize-none bg-transparent p-4 font-mono text-sm placeholder:text-muted-foreground/50 focus:outline-none"
-              spellCheck={false}
-              autoComplete="off"
-            />
-          </div>
-        </Card>
+            </>
+          }
+        >
+          <ToolTextArea
+            value={input}
+            onChange={(e) => setInput(e.target.value)}
+            placeholder={t('placeholder')}
+            autoComplete="off"
+          />
+        </IOPanel>
 
-        <Card className="flex flex-col overflow-hidden min-h-0">
-          <div className="flex items-center justify-between gap-2 border-b border-border/50 bg-muted/30 px-4 py-2">
-            <Select value={target} onValueChange={(v) => setTarget(v as CurlTarget)}>
-              <SelectTrigger className="h-8 w-[190px] text-xs">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                {CURL_TARGETS.map((tg) => (
-                  <SelectItem key={tg.value} value={tg.value}>
-                    {tg.label}
-                  </SelectItem>
-                ))}
-              </SelectContent>
-            </Select>
+        <IOPanel
+          label={t('panels.output')}
+          bodyClassName="overflow-auto"
+          actions={
             <Button
               size="sm"
               variant="secondary"
+              className="h-7"
               disabled={!result.code}
               onClick={() => void copyToClipboard(result.code, { silent: true })}
             >
-              {copied ? <Check className="mr-1.5 h-4 w-4 text-emerald-600" /> : <Copy className="mr-1.5 h-4 w-4" />}
+              {copied ? (
+                <Check className="mr-1.5 h-4 w-4 text-emerald-600" />
+              ) : (
+                <Copy className="mr-1.5 h-4 w-4" />
+              )}
               {copied ? t('copied') : t('copy')}
             </Button>
-          </div>
-          <div className="min-h-0 flex-1 overflow-auto">
-            {result.error ? (
-              <div className="p-4 text-sm text-destructive">{result.error}</div>
-            ) : result.code ? (
-              <pre className="p-4 font-mono text-sm leading-relaxed whitespace-pre">{result.code}</pre>
-            ) : (
-              <div className="p-4 text-sm text-muted-foreground">{t('outputPlaceholder')}</div>
-            )}
-          </div>
-        </Card>
-      </div>
-    </div>
+          }
+        >
+          {result.error ? (
+            <div className="p-3 text-sm text-destructive">{result.error}</div>
+          ) : result.code ? (
+            <pre className="whitespace-pre p-3 font-mono text-sm leading-relaxed">
+              {result.code}
+            </pre>
+          ) : (
+            <div className="p-3 text-sm text-muted-foreground">{t('outputPlaceholder')}</div>
+          )}
+        </IOPanel>
+      </ToolPanels>
+    </ToolShell>
   )
 }
diff --git a/apps/desktop-ui/src/components/http-status-codes/http-status-codes-layout.tsx b/apps/desktop-ui/src/components/http-status-codes/http-status-codes-layout.tsx
index fea26eb6..ac1e0ec7 100644
--- a/apps/desktop-ui/src/components/http-status-codes/http-status-codes-layout.tsx
+++ b/apps/desktop-ui/src/components/http-status-codes/http-status-codes-layout.tsx
@@ -2,7 +2,6 @@
 
 import { useMemo, useState } from 'react'
 import { useTranslations } from 'next-intl'
-import { Card, CardContent } from '@/components/ui/card'
 import { Badge } from '@/components/ui/badge'
 import { Input } from '@/components/ui/input'
 import {
@@ -21,10 +20,8 @@ import {
   TableRow,
 } from '@/components/ui/table'
 import { CopyButton } from '@/components/tools/copy-button'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { ToolWrapper } from '@/components/tools/tool-wrapper'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
 import { IconListNumbers } from '@tabler/icons-react'
+import { ToolShell } from '@/components/tools/tool-shell'
 import { HTTP_STATUS_CODES, type HttpStatusClass } from '@/lib/http-status-codes'
 
 type ClassFilter = 'all' | HttpStatusClass
@@ -74,112 +71,106 @@ export function HttpStatusCodesLayout() {
     })
   }, [classFilter, query])
 
-  return (
-    <ToolWrapper toolId="http-status-codes" maxWidth="5xl">
-      <ToolPageHeader
-        icon={IconListNumbers}
-        title={t('title')}
-        description={t('subtitle')}
-        accent={CATEGORY_ACCENT['Network & API']}
-        offline={false}
-      />
-
-      <div className="mt-6 space-y-4">
-        <Card className="border-border/40 bg-background/50 backdrop-blur-sm shadow-sm">
-          <CardContent className="pt-6">
-            <div className="flex flex-col gap-3 sm:flex-row sm:items-center">
-              <div className="flex-1">
-                <Input
-                  value={query}
-                  onChange={(e) => setQuery(e.target.value)}
-                  placeholder={t('searchPlaceholder')}
-                  className="h-10"
-                  autoFocus
-                />
-              </div>
-              <div className="w-full sm:w-64">
-                <Select
-                  value={classFilter}
-                  onValueChange={(v) => setClassFilter(v as ClassFilter)}
-                >
-                  <SelectTrigger>
-                    <SelectValue placeholder={t('classFilterPlaceholder')} />
-                  </SelectTrigger>
-                  <SelectContent>
-                    <SelectItem value="all">{t('classFilterAll')}</SelectItem>
-                    {(['1xx', '2xx', '3xx', '4xx', '5xx'] as const).map((c) => (
-                      <SelectItem key={c} value={c}>
-                        {classLabel(c)}
-                      </SelectItem>
-                    ))}
-                  </SelectContent>
-                </Select>
-              </div>
-              <div className="shrink-0 text-xs text-muted-foreground tabular-nums">
-                {t('resultsCount', { count: filtered.length, total: HTTP_STATUS_CODES.length })}
-              </div>
-            </div>
-          </CardContent>
-        </Card>
+  const toolbar = (
+    <div className="rounded-lg border border-border bg-card px-4 py-3">
+      <div className="flex flex-col gap-3 sm:flex-row sm:items-center">
+        <div className="flex-1">
+          <Input
+            value={query}
+            onChange={(e) => setQuery(e.target.value)}
+            placeholder={t('searchPlaceholder')}
+            className="h-10"
+            autoFocus
+          />
+        </div>
+        <div className="w-full sm:w-64">
+          <Select
+            value={classFilter}
+            onValueChange={(v) => setClassFilter(v as ClassFilter)}
+          >
+            <SelectTrigger>
+              <SelectValue placeholder={t('classFilterPlaceholder')} />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem value="all">{t('classFilterAll')}</SelectItem>
+              {(['1xx', '2xx', '3xx', '4xx', '5xx'] as const).map((c) => (
+                <SelectItem key={c} value={c}>
+                  {classLabel(c)}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </div>
+        <div className="shrink-0 text-xs text-muted-foreground tabular-nums">
+          {t('resultsCount', { count: filtered.length, total: HTTP_STATUS_CODES.length })}
+        </div>
+      </div>
+    </div>
+  )
 
-        <Card className="border-border/40 bg-background/50 backdrop-blur-sm shadow-sm overflow-hidden">
-          <div className="max-h-[70vh] overflow-auto">
-            <Table>
-              <TableHeader className="sticky top-0 bg-background z-10">
+  return (
+    <ToolShell
+      icon={IconListNumbers}
+      title={t('title')}
+      description={t('subtitle')}
+      toolbar={toolbar}
+    >
+      <div className="overflow-hidden rounded-lg border border-border bg-card">
+        <div className="max-h-[70vh] overflow-auto">
+          <Table>
+            <TableHeader className="sticky top-0 bg-background z-10">
+              <TableRow>
+                <TableHead className="w-[120px]">{t('table.code')}</TableHead>
+                <TableHead className="w-[220px]">{t('table.phrase')}</TableHead>
+                <TableHead>{t('table.description')}</TableHead>
+                <TableHead className="w-[90px] text-right">{t('table.copy')}</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {filtered.length === 0 ? (
                 <TableRow>
-                  <TableHead className="w-[120px]">{t('table.code')}</TableHead>
-                  <TableHead className="w-[220px]">{t('table.phrase')}</TableHead>
-                  <TableHead>{t('table.description')}</TableHead>
-                  <TableHead className="w-[90px] text-right">{t('table.copy')}</TableHead>
+                  <TableCell colSpan={4} className="py-10 text-center text-muted-foreground">
+                    {t('noResults', { query })}
+                  </TableCell>
                 </TableRow>
-              </TableHeader>
-              <TableBody>
-                {filtered.length === 0 ? (
-                  <TableRow>
-                    <TableCell colSpan={4} className="py-10 text-center text-muted-foreground">
-                      {t('noResults', { query })}
+              ) : (
+                filtered.map((s) => (
+                  <TableRow key={s.code}>
+                    <TableCell className="font-mono font-semibold">
+                      <div className="flex items-center gap-2">
+                        <span>{s.code}</span>
+                        <Badge
+                          variant="outline"
+                          className={`text-[11px] px-2 py-0.5 ${badgeClass(s.class)}`}
+                        >
+                          {s.class}
+                        </Badge>
+                      </div>
+                    </TableCell>
+                    <TableCell className="font-medium">{s.phrase}</TableCell>
+                    <TableCell className="text-muted-foreground">
+                      <span>{s.description}</span>
+                      {s.spec ? (
+                        <span className="ml-2 text-xs text-muted-foreground/80">
+                          {t('specPrefix')} {s.spec}
+                        </span>
+                      ) : null}
+                    </TableCell>
+                    <TableCell className="text-right">
+                      <CopyButton
+                        text={String(s.code)}
+                        successMessage={t('copied')}
+                        variant="ghost"
+                        size="icon"
+                      />
                     </TableCell>
                   </TableRow>
-                ) : (
-                  filtered.map((s) => (
-                    <TableRow key={s.code}>
-                      <TableCell className="font-mono font-semibold">
-                        <div className="flex items-center gap-2">
-                          <span>{s.code}</span>
-                          <Badge
-                            variant="outline"
-                            className={`text-[11px] px-2 py-0.5 ${badgeClass(s.class)}`}
-                          >
-                            {s.class}
-                          </Badge>
-                        </div>
-                      </TableCell>
-                      <TableCell className="font-medium">{s.phrase}</TableCell>
-                      <TableCell className="text-muted-foreground">
-                        <span>{s.description}</span>
-                        {s.spec ? (
-                          <span className="ml-2 text-xs text-muted-foreground/80">
-                            {t('specPrefix')} {s.spec}
-                          </span>
-                        ) : null}
-                      </TableCell>
-                      <TableCell className="text-right">
-                        <CopyButton
-                          text={String(s.code)}
-                          successMessage={t('copied')}
-                          variant="ghost"
-                          size="icon"
-                        />
-                      </TableCell>
-                    </TableRow>
-                  ))
-                )}
-              </TableBody>
-            </Table>
-          </div>
-        </Card>
+                ))
+              )}
+            </TableBody>
+          </Table>
+        </div>
       </div>
-    </ToolWrapper>
+    </ToolShell>
   )
 }
-
diff --git a/apps/desktop-ui/src/components/ip-subnet-calculator/ip-subnet-calculator-layout.tsx b/apps/desktop-ui/src/components/ip-subnet-calculator/ip-subnet-calculator-layout.tsx
index 73756c93..7c33e307 100644
--- a/apps/desktop-ui/src/components/ip-subnet-calculator/ip-subnet-calculator-layout.tsx
+++ b/apps/desktop-ui/src/components/ip-subnet-calculator/ip-subnet-calculator-layout.tsx
@@ -4,7 +4,6 @@ import { useMemo, useState } from 'react';
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard';
 import { useTranslations } from 'next-intl';
 import { useDebouncedCallback } from 'use-debounce';
-import { Card } from '@/components/ui/card';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
@@ -13,9 +12,7 @@ import { Copy, Check } from 'lucide-react';
 import { computeIpv4Subnet, computeIpv6Subnet } from '@/lib/ip-subnet';
 import { cn } from '@/lib/utils';
 import { IconHierarchy2 } from '@tabler/icons-react';
-import { ToolPageHeader } from '@/components/tools/tool-page-header';
-import { RevealItem } from '@/components/dashboard/dashboard-reveal';
-import { CATEGORY_ACCENT } from '@/components/dashboard/types';
+import { ToolShell } from '@/components/tools/tool-shell';
 
 function Row({
   label,
@@ -78,16 +75,11 @@ export function IpSubnetCalculatorLayout() {
   const ipv6Result = useMemo(() => computeIpv6Subnet(ipv6Debounced), [ipv6Debounced]);
 
   return (
-    <div className="flex h-full min-h-0 w-full flex-col gap-4">
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconHierarchy2}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Network & API']}
-        />
-      </RevealItem>
-
+    <ToolShell
+      icon={IconHierarchy2}
+      title={t('title')}
+      description={t('subtitle')}
+    >
       <Tabs value={family} onValueChange={(v) => setFamily(v as 'ipv4' | 'ipv6')} className="flex min-h-0 flex-1 flex-col gap-4">
         <TabsList className="grid w-full max-w-md grid-cols-2">
           <TabsTrigger value="ipv4">{t('tabIpv4')}</TabsTrigger>
@@ -95,7 +87,7 @@ export function IpSubnetCalculatorLayout() {
         </TabsList>
 
         <TabsContent value="ipv4" className="mt-0 flex min-h-0 flex-1 flex-col gap-4 data-[state=inactive]:hidden">
-          <Card className="space-y-3 p-4">
+          <div className="space-y-3 rounded-lg border border-border bg-card px-4 py-3">
             <div className="space-y-2">
               <Label htmlFor="ipv4-input">{t('inputLabel')}</Label>
               <Input
@@ -109,9 +101,9 @@ export function IpSubnetCalculatorLayout() {
               />
               <p className="text-xs text-muted-foreground">{t('hintIpv4')}</p>
             </div>
-          </Card>
+          </div>
 
-          <Card className="flex flex-col gap-2 p-4">
+          <div className="flex flex-col gap-2 rounded-lg border border-border bg-card p-4">
             {!ipv4Result.ok ? (
               <p className="text-sm text-destructive">{t(`errors.${ipv4Result.errorKey}`)}</p>
             ) : (
@@ -147,11 +139,11 @@ export function IpSubnetCalculatorLayout() {
                 )}
               </>
             )}
-          </Card>
+          </div>
         </TabsContent>
 
         <TabsContent value="ipv6" className="mt-0 flex min-h-0 flex-1 flex-col gap-4 data-[state=inactive]:hidden">
-          <Card className="space-y-3 p-4">
+          <div className="space-y-3 rounded-lg border border-border bg-card px-4 py-3">
             <div className="space-y-2">
               <Label htmlFor="ipv6-input">{t('inputLabel')}</Label>
               <Input
@@ -165,9 +157,9 @@ export function IpSubnetCalculatorLayout() {
               />
               <p className="text-xs text-muted-foreground">{t('hintIpv6')}</p>
             </div>
-          </Card>
+          </div>
 
-          <Card className="flex flex-col gap-2 p-4">
+          <div className="flex flex-col gap-2 rounded-lg border border-border bg-card p-4">
             {!ipv6Result.ok ? (
               <p className="text-sm text-destructive">{t(`errors.${ipv6Result.errorKey}`)}</p>
             ) : (
@@ -182,9 +174,9 @@ export function IpSubnetCalculatorLayout() {
                 </p>
               </>
             )}
-          </Card>
+          </div>
         </TabsContent>
       </Tabs>
-    </div>
+    </ToolShell>
   );
 }
diff --git a/apps/desktop-ui/src/components/mime-type-lookup/mime-type-lookup-layout.tsx b/apps/desktop-ui/src/components/mime-type-lookup/mime-type-lookup-layout.tsx
index 65b561b1..ae631509 100644
--- a/apps/desktop-ui/src/components/mime-type-lookup/mime-type-lookup-layout.tsx
+++ b/apps/desktop-ui/src/components/mime-type-lookup/mime-type-lookup-layout.tsx
@@ -2,7 +2,6 @@
 
 import { useMemo, useState } from 'react'
 import { useTranslations } from 'next-intl'
-import { Card } from '@/components/ui/card'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Button } from '@/components/ui/button'
@@ -10,9 +9,7 @@ import { Check, Copy } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { lookupMimeType } from '@/lib/mime-type-lookup'
 import { IconFileInfo } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
 
 async function copyToClipboard(text: string) {
   await navigator.clipboard.writeText(text)
@@ -38,143 +35,133 @@ export function MimeTypeLookupLayout() {
   const canShow = Boolean(value.trim())
   const hasMatch = Boolean(result.mimeType)
 
-  return (
-    <div className="flex h-full min-h-0 w-full flex-col gap-4">
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconFileInfo}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Network & API']}
+  const toolbar = (
+    <div className="flex flex-wrap items-end gap-4 rounded-lg border border-border bg-card px-4 py-3">
+      <div className="min-w-0 flex-1 space-y-2">
+        <Label htmlFor="mime-input">{t('inputLabel')}</Label>
+        <Input
+          id="mime-input"
+          value={value}
+          onChange={(e) => setValue(e.target.value)}
+          placeholder={t('placeholder')}
+          spellCheck={false}
+          autoComplete="off"
+          inputMode="text"
         />
-      </RevealItem>
+        <p className="text-xs text-muted-foreground">{t('hint')}</p>
+      </div>
 
-      <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 lg:grid-cols-2">
-        <Card className="flex flex-col gap-4 overflow-auto p-4">
-          <div className="space-y-2">
-            <Label htmlFor="mime-input">{t('inputLabel')}</Label>
-            <Input
-              id="mime-input"
-              value={value}
-              onChange={(e) => setValue(e.target.value)}
-              placeholder={t('placeholder')}
-              spellCheck={false}
-              autoComplete="off"
-              inputMode="text"
-            />
-            <p className="text-xs text-muted-foreground">{t('hint')}</p>
-          </div>
+      <div className="flex flex-wrap gap-2">
+        <Button type="button" variant="secondary" size="sm" onClick={() => setValue('')}>
+          {t('clear')}
+        </Button>
+        <Button type="button" variant="outline" size="sm" onClick={() => setValue('package.json')}>
+          {t('exampleFilename')}
+        </Button>
+        <Button type="button" variant="outline" size="sm" onClick={() => setValue('.png')}>
+          {t('exampleExtension')}
+        </Button>
+      </div>
+    </div>
+  )
 
-          <div className="flex flex-wrap gap-2">
-            <Button type="button" variant="secondary" size="sm" onClick={() => setValue('')}>
-              {t('clear')}
-            </Button>
+  return (
+    <ToolShell
+      icon={IconFileInfo}
+      title={t('title')}
+      description={t('subtitle')}
+      toolbar={toolbar}
+    >
+      <div className="flex min-h-0 flex-1 flex-col gap-3 overflow-auto rounded-lg border border-border bg-card p-4">
+        <div className="flex items-center justify-between gap-2">
+          <span className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+            {t('resultLabel')}
+          </span>
+          {hasMatch && (
             <Button
               type="button"
-              variant="outline"
               size="sm"
-              onClick={() => setValue('package.json')}
+              variant="secondary"
+              onClick={async () => {
+                if (!result.mimeType) return
+                try {
+                  await copyToClipboard(result.mimeType)
+                  setCopiedKey('mimeType')
+                  setTimeout(() => setCopiedKey(null), 1500)
+                } catch {
+                  /* ignore */
+                }
+              }}
             >
-              {t('exampleFilename')}
-            </Button>
-            <Button type="button" variant="outline" size="sm" onClick={() => setValue('.png')}>
-              {t('exampleExtension')}
+              {copiedKey === 'mimeType' ? (
+                <Check className="mr-1.5 h-4 w-4 text-emerald-600" />
+              ) : (
+                <Copy className="mr-1.5 h-4 w-4" />
+              )}
+              {copiedKey === 'mimeType' ? t('copied') : t('copyMimeType')}
             </Button>
-          </div>
-        </Card>
-
-        <Card className="flex flex-col gap-3 overflow-auto p-4">
-          <div className="flex items-center justify-between gap-2">
-            <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-              {t('resultLabel')}
-            </Label>
-            {hasMatch && (
-              <Button
-                type="button"
-                size="sm"
-                variant="secondary"
-                onClick={async () => {
-                  if (!result.mimeType) return
-                  try {
-                    await copyToClipboard(result.mimeType)
-                    setCopiedKey('mimeType')
-                    setTimeout(() => setCopiedKey(null), 1500)
-                  } catch {
-                    /* ignore */
-                  }
-                }}
-              >
-                {copiedKey === 'mimeType' ? (
-                  <Check className="mr-1.5 h-4 w-4 text-emerald-600" />
-                ) : (
-                  <Copy className="mr-1.5 h-4 w-4" />
-                )}
-                {copiedKey === 'mimeType' ? t('copied') : t('copyMimeType')}
-              </Button>
-            )}
-          </div>
-
-          <div
-            className={cn(
-              'rounded-md border bg-muted/30 p-3 text-sm',
-              !canShow && 'text-muted-foreground'
-            )}
-          >
-            {!canShow ? (
-              <span>{t('emptyHint')}</span>
-            ) : !hasMatch ? (
-              <span className="text-destructive">{t('notFound')}</span>
-            ) : (
-              <div className="space-y-3">
-                <div className="text-xs text-muted-foreground">
-                  {t('normalizedLabel')}{' '}
-                  <span className="font-mono text-foreground">{result.normalized || '—'}</span>
-                </div>
-
-                <div className="space-y-2">
-                  {items.map((it) => (
-                    <div key={it.key} className="flex items-start justify-between gap-3">
-                      <div className="min-w-0">
-                        <div className="text-xs font-medium text-muted-foreground">{it.label}</div>
-                        <div className="font-mono break-all">{it.value ?? '—'}</div>
-                      </div>
+          )}
+        </div>
+
+        <div
+          className={cn(
+            'rounded-md border bg-muted/30 p-3 text-sm',
+            !canShow && 'text-muted-foreground'
+          )}
+        >
+          {!canShow ? (
+            <span>{t('emptyHint')}</span>
+          ) : !hasMatch ? (
+            <span className="text-destructive">{t('notFound')}</span>
+          ) : (
+            <div className="space-y-3">
+              <div className="text-xs text-muted-foreground">
+                {t('normalizedLabel')}{' '}
+                <span className="font-mono text-foreground">{result.normalized || '—'}</span>
+              </div>
 
-                      {it.value && (
-                        <Button
-                          type="button"
-                          size="icon"
-                          variant="ghost"
-                          className="shrink-0"
-                          onClick={async () => {
-                            try {
-                              await copyToClipboard(it.value!)
-                              setCopiedKey(it.key)
-                              setTimeout(() => setCopiedKey(null), 1500)
-                            } catch {
-                              /* ignore */
-                            }
-                          }}
-                          title={t('copy')}
-                          aria-label={t('copy')}
-                        >
-                          {copiedKey === it.key ? (
-                            <Check className="h-4 w-4 text-emerald-600" />
-                          ) : (
-                            <Copy className="h-4 w-4" />
-                          )}
-                        </Button>
-                      )}
+              <div className="space-y-2">
+                {items.map((it) => (
+                  <div key={it.key} className="flex items-start justify-between gap-3">
+                    <div className="min-w-0">
+                      <div className="text-xs font-medium text-muted-foreground">{it.label}</div>
+                      <div className="font-mono break-all">{it.value ?? '—'}</div>
                     </div>
-                  ))}
-                </div>
+
+                    {it.value && (
+                      <Button
+                        type="button"
+                        size="icon"
+                        variant="ghost"
+                        className="shrink-0"
+                        onClick={async () => {
+                          try {
+                            await copyToClipboard(it.value!)
+                            setCopiedKey(it.key)
+                            setTimeout(() => setCopiedKey(null), 1500)
+                          } catch {
+                            /* ignore */
+                          }
+                        }}
+                        title={t('copy')}
+                        aria-label={t('copy')}
+                      >
+                        {copiedKey === it.key ? (
+                          <Check className="h-4 w-4 text-emerald-600" />
+                        ) : (
+                          <Copy className="h-4 w-4" />
+                        )}
+                      </Button>
+                    )}
+                  </div>
+                ))}
               </div>
-            )}
-          </div>
+            </div>
+          )}
+        </div>
 
-          <p className="text-xs text-muted-foreground">{t('localNote')}</p>
-        </Card>
+        <p className="text-xs text-muted-foreground">{t('localNote')}</p>
       </div>
-    </div>
+    </ToolShell>
   )
 }
-
diff --git a/apps/desktop-ui/src/components/user-agent-parser/user-agent-parser-layout.tsx b/apps/desktop-ui/src/components/user-agent-parser/user-agent-parser-layout.tsx
index aa427d89..daf61668 100644
--- a/apps/desktop-ui/src/components/user-agent-parser/user-agent-parser-layout.tsx
+++ b/apps/desktop-ui/src/components/user-agent-parser/user-agent-parser-layout.tsx
@@ -2,17 +2,13 @@
 
 import { useMemo, useState } from 'react'
 import { useTranslations } from 'next-intl'
-import { Card } from '@/components/ui/card'
-import { Label } from '@/components/ui/label'
-import { Textarea } from '@/components/ui/textarea'
 import { Button } from '@/components/ui/button'
 import { Check, Copy } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { parseUserAgent } from '@/lib/user-agent-parser'
 import { IconUserSearch } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
+import { ToolPanels, IOPanel, ToolTextArea } from '@/components/tools/io-panel'
 
 async function copyToClipboard(text: string) {
   await navigator.clipboard.writeText(text)
@@ -50,73 +46,73 @@ export function UserAgentParserLayout() {
   const json = useMemo(() => (result ? JSON.stringify(result, null, 2) : ''), [result])
 
   return (
-    <div className="flex h-full min-h-0 w-full flex-col gap-4">
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconUserSearch}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Network & API']}
-        />
-      </RevealItem>
-
-      <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 lg:grid-cols-2">
-        <Card className="flex flex-col gap-4 overflow-auto p-4">
-          <div className="space-y-2">
-            <Label htmlFor="ua-input">{t('inputLabel')}</Label>
-            <Textarea
-              id="ua-input"
+    <ToolShell
+      icon={IconUserSearch}
+      title={t('title')}
+      description={t('subtitle')}
+    >
+      <ToolPanels className="lg:grid-cols-2">
+        <IOPanel
+          label={t('inputLabel')}
+          bodyClassName="flex flex-col"
+          actions={
+            <>
+              <Button type="button" variant="secondary" size="sm" className="h-7" onClick={() => setUa('')}>
+                {t('clear')}
+              </Button>
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="h-7"
+                onClick={() =>
+                  setUa(
+                    'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36'
+                  )
+                }
+              >
+                {t('exampleDesktop')}
+              </Button>
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="h-7"
+                onClick={() =>
+                  setUa(
+                    'Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1'
+                  )
+                }
+              >
+                {t('exampleMobile')}
+              </Button>
+            </>
+          }
+        >
+          <div className="relative min-h-0 flex-1">
+            <ToolTextArea
               value={ua}
               onChange={(e) => setUa(e.target.value)}
               placeholder={t('placeholder')}
-              className="min-h-[180px] resize-y font-mono text-sm"
-              spellCheck={false}
               autoComplete="off"
+              aria-label={t('inputLabel')}
             />
-            <p className="text-xs text-muted-foreground">{t('hint')}</p>
-          </div>
-
-          <div className="flex flex-wrap gap-2">
-            <Button type="button" variant="secondary" size="sm" onClick={() => setUa('')}>
-              {t('clear')}
-            </Button>
-            <Button
-              type="button"
-              variant="outline"
-              size="sm"
-              onClick={() =>
-                setUa(
-                  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36'
-                )
-              }
-            >
-              {t('exampleDesktop')}
-            </Button>
-            <Button
-              type="button"
-              variant="outline"
-              size="sm"
-              onClick={() =>
-                setUa(
-                  'Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1'
-                )
-              }
-            >
-              {t('exampleMobile')}
-            </Button>
           </div>
-        </Card>
+          <p className="shrink-0 border-t border-border/50 px-3 py-1.5 text-xs text-muted-foreground">
+            {t('hint')}
+          </p>
+        </IOPanel>
 
-        <Card className="flex flex-col gap-3 overflow-auto p-4">
-          <div className="flex items-center justify-between gap-2">
-            <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-              {t('resultLabel')}
-            </Label>
-            {canCopyJson && (
+        <IOPanel
+          label={t('resultLabel')}
+          bodyClassName="flex flex-col"
+          actions={
+            canCopyJson && (
               <Button
                 type="button"
                 size="sm"
                 variant="secondary"
+                className="h-7"
                 onClick={async () => {
                   try {
                     await copyToClipboard(json)
@@ -134,12 +130,12 @@ export function UserAgentParserLayout() {
                 )}
                 {copiedKey === 'json' ? t('copied') : t('copyJson')}
               </Button>
-            )}
-          </div>
-
+            )
+          }
+        >
           <div
             className={cn(
-              'rounded-md border bg-muted/30 p-3 text-sm',
+              'min-h-0 flex-1 overflow-auto p-3 text-sm',
               !canShow && 'text-muted-foreground'
             )}
           >
@@ -183,11 +179,12 @@ export function UserAgentParserLayout() {
               </div>
             )}
           </div>
-
-          <p className="text-xs text-muted-foreground">{t('localNote')}</p>
-        </Card>
-      </div>
-    </div>
+          <p className="shrink-0 border-t border-border/50 px-3 py-1.5 text-xs text-muted-foreground">
+            {t('localNote')}
+          </p>
+        </IOPanel>
+      </ToolPanels>
+    </ToolShell>
   )
 }
 
diff --git a/apps/desktop-ui/src/components/websocket-tester/websocket-tester-layout.tsx b/apps/desktop-ui/src/components/websocket-tester/websocket-tester-layout.tsx
index b399cffa..257a47c3 100644
--- a/apps/desktop-ui/src/components/websocket-tester/websocket-tester-layout.tsx
+++ b/apps/desktop-ui/src/components/websocket-tester/websocket-tester-layout.tsx
@@ -5,13 +5,10 @@ import { useTranslations } from 'next-intl'
 import { saveAs } from 'file-saver'
 import { toast } from 'sonner'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Badge } from '@/components/ui/badge'
 import { Switch } from '@/components/ui/switch'
-import { ScrollArea } from '@/components/ui/scroll-area'
-import { Textarea } from '@/components/ui/textarea'
 import {
   ArrowDown,
   ArrowUp,
@@ -28,9 +25,8 @@ import {
 import { IconPlugConnected } from '@tabler/icons-react'
 import { cn } from '@/lib/utils'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
+import { IOPanel, ToolTextArea } from '@/components/tools/io-panel'
 import {
   describeCloseEvent,
   formatLogEntry,
@@ -252,23 +248,9 @@ export function WebsocketTesterLayout() {
   const isConnected = status === 'connected'
   const isConnecting = status === 'connecting'
 
-  return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconPlugConnected}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Network & API']}
-          offline={false}
-        />
-      </RevealItem>
-
-      {/* Connection bar */}
-      <Card className="flex flex-wrap items-end gap-3 p-4">
-        <div className="min-w-[240px] flex-1 space-y-1.5">
+  const toolbar = (
+    <div className="flex flex-wrap items-end gap-3 rounded-lg border border-border bg-card px-4 py-3">
+      <div className="min-w-[240px] flex-1 space-y-1.5">
           <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
             {t('urlLabel')}
           </Label>
@@ -323,20 +305,28 @@ export function WebsocketTesterLayout() {
           />
           {t(`status.${status}`)}
         </Badge>
-      </Card>
+      </div>
+  )
 
+  return (
+    <ToolShell
+      icon={IconPlugConnected}
+      title={t('title')}
+      description={t('subtitle')}
+      offline={false}
+      toolbar={toolbar}
+      contentClassName="gap-4"
+    >
       {/* Message log */}
-      <Card className="flex min-h-0 flex-1 flex-col overflow-hidden">
-        <div className="flex items-center justify-between border-b border-border/50 bg-muted/30 px-4 py-2.5">
-          <div className="flex items-center gap-2">
-            <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-              {t('log.title')}
-            </Label>
+      <IOPanel
+        className="min-h-0 flex-1"
+        bodyClassName="overflow-y-auto"
+        label={t('log.title')}
+        actions={
+          <>
             <Badge variant="secondary" className="h-5 px-2 text-[11px]">
               {entries.length}
             </Badge>
-          </div>
-          <div className="flex items-center gap-1">
             <Button
               variant="ghost"
               size="icon"
@@ -367,10 +357,10 @@ export function WebsocketTesterLayout() {
             >
               <Trash2 className="h-3.5 w-3.5" />
             </Button>
-          </div>
-        </div>
-        <ScrollArea className="min-h-0 flex-1">
-          <div className="flex flex-col gap-1 p-3">
+          </>
+        }
+      >
+        <div className="flex flex-col gap-1 p-3">
             {entries.length === 0 && (
               <p className="px-1 py-6 text-center text-sm text-muted-foreground/60">{t('log.empty')}</p>
             )}
@@ -412,12 +402,11 @@ export function WebsocketTesterLayout() {
             })}
             <div ref={bottomRef} />
           </div>
-        </ScrollArea>
-      </Card>
+      </IOPanel>
 
       {/* Composer */}
-      <Card className="flex flex-col gap-3 p-4">
-        <Textarea
+      <div className="flex flex-col gap-3 rounded-lg border border-border bg-card p-4">
+        <ToolTextArea
           value={draft}
           onChange={(e) => setDraft(e.target.value)}
           onKeyDown={(e) => {
@@ -427,7 +416,7 @@ export function WebsocketTesterLayout() {
             }
           }}
           placeholder={t('composer.placeholder')}
-          className="min-h-[72px] resize-y font-mono text-sm"
+          className="relative h-auto min-h-[72px] resize-y"
           spellCheck={false}
         />
         <div className="flex flex-wrap items-center gap-3">
@@ -464,7 +453,7 @@ export function WebsocketTesterLayout() {
             <Switch id="ws-ping-switch" checked={pingEnabled} onCheckedChange={setPingEnabled} />
           </div>
         </div>
-      </Card>
-    </div>
+      </div>
+    </ToolShell>
   )
 }
diff --git a/apps/desktop-ui/src/components/whois-lookup/whois-lookup-layout.tsx b/apps/desktop-ui/src/components/whois-lookup/whois-lookup-layout.tsx
index baa9abc4..b5e2ec7e 100644
--- a/apps/desktop-ui/src/components/whois-lookup/whois-lookup-layout.tsx
+++ b/apps/desktop-ui/src/components/whois-lookup/whois-lookup-layout.tsx
@@ -3,7 +3,6 @@
 import React, { useCallback, useState } from 'react'
 import { useTranslations } from 'next-intl'
 import { motion, AnimatePresence } from 'framer-motion'
-import { Card } from '@/components/ui/card'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
 import { Badge } from '@/components/ui/badge'
@@ -23,11 +22,8 @@ import {
   Users,
 } from 'lucide-react'
 import { IconWorldSearch } from '@tabler/icons-react'
-import { cn } from '@/lib/utils'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
 import { formatIsoDate, normalizeTarget, relativeTime } from '@/lib/whois-lookup'
 import { rdapLookup, type WhoisResult } from '@/lib/rdap'
 
@@ -37,14 +33,14 @@ function DateCard({ icon: Icon, label, iso }: { icon: React.ElementType; label:
   const date = iso ? formatIsoDate(iso) : null
   const rel = iso ? relativeTime(iso) : null
   return (
-    <Card className="flex flex-col gap-1 p-3">
+    <div className="flex flex-col gap-1 rounded-lg border border-border bg-card p-3">
       <div className="flex items-center gap-1.5 text-[11px] font-medium uppercase tracking-wider text-muted-foreground">
         <Icon className="h-3.5 w-3.5" />
         {label}
       </div>
       <div className="font-mono text-sm">{date ?? '—'}</div>
       {rel && <div className="text-[11px] text-muted-foreground/70">{rel}</div>}
-    </Card>
+    </div>
   )
 }
 
@@ -80,22 +76,9 @@ export function WhoisLookupLayout() {
     [input, t],
   )
 
-  return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconWorldSearch}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT['Network & API']}
-          offline={false}
-        />
-      </RevealItem>
-
-      {/* Search card */}
-      <Card className="space-y-3 p-4">
+  const toolbar = (
+    <div className="flex flex-wrap items-end gap-4 rounded-lg border border-border bg-card px-4 py-3">
+      <div className="flex flex-1 flex-col gap-3">
         <div className="flex gap-2">
           <div className="relative flex-1">
             <Search className="pointer-events-none absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" />
@@ -131,8 +114,19 @@ export function WhoisLookupLayout() {
             </button>
           ))}
         </div>
-      </Card>
+      </div>
+    </div>
+  )
 
+  return (
+    <ToolShell
+      icon={IconWorldSearch}
+      title={t('title')}
+      description={t('subtitle')}
+      offline={false}
+      toolbar={toolbar}
+      contentClassName="gap-4"
+    >
       {/* Error */}
       <AnimatePresence>
         {error && (
@@ -153,10 +147,10 @@ export function WhoisLookupLayout() {
         <div className="space-y-3">
           <div className="grid grid-cols-2 gap-3 lg:grid-cols-4">
             {[0, 1, 2, 3].map((i) => (
-              <Card key={i} className="h-[76px] animate-pulse bg-muted/20 p-3" />
+              <div key={i} className="h-[76px] animate-pulse rounded-lg border border-border bg-muted/20 p-3" />
             ))}
           </div>
-          <Card className="h-32 animate-pulse bg-muted/20" />
+          <div className="h-32 animate-pulse rounded-lg border border-border bg-muted/20" />
         </div>
       )}
 
@@ -172,12 +166,12 @@ export function WhoisLookupLayout() {
               </Badge>
             </div>
 
-            <Card className="flex flex-col gap-1 p-3">
+            <div className="flex flex-col gap-1 rounded-lg border border-border bg-card p-3">
               <div className="text-[11px] font-medium uppercase tracking-wider text-muted-foreground">
                 {result.type === 'ip' ? t('summary.network') : t('summary.registrar')}
               </div>
               <div className="text-sm">{result.registrar ?? t('notAvailable')}</div>
-            </Card>
+            </div>
 
             {/* Dates */}
             <div className="grid grid-cols-2 gap-3 lg:grid-cols-3">
@@ -204,7 +198,7 @@ export function WhoisLookupLayout() {
 
             {/* Nameservers */}
             {result.nameservers.length > 0 && (
-              <Card className="overflow-hidden">
+              <div className="overflow-hidden rounded-lg border border-border bg-card">
                 <div className="flex items-center gap-2 border-b border-border/40 bg-muted/20 px-4 py-2.5">
                   <Server className="h-3.5 w-3.5 text-muted-foreground" />
                   <span className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
@@ -221,12 +215,12 @@ export function WhoisLookupLayout() {
                     </div>
                   ))}
                 </div>
-              </Card>
+              </div>
             )}
 
             {/* Contacts */}
             {result.contacts.length > 0 && (
-              <Card className="overflow-hidden">
+              <div className="overflow-hidden rounded-lg border border-border bg-card">
                 <div className="flex items-center gap-2 border-b border-border/40 bg-muted/20 px-4 py-2.5">
                   <Users className="h-3.5 w-3.5 text-muted-foreground" />
                   <span className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
@@ -263,12 +257,12 @@ export function WhoisLookupLayout() {
                     </tbody>
                   </table>
                 </div>
-              </Card>
+              </div>
             )}
 
             {/* Raw RDAP */}
             <Collapsible>
-              <Card className="overflow-hidden">
+              <div className="overflow-hidden rounded-lg border border-border bg-card">
                 <CollapsibleTrigger className="flex w-full items-center gap-2 px-4 py-2.5 text-left transition-colors hover:bg-muted/20">
                   <ChevronDown className="h-4 w-4 shrink-0 text-muted-foreground transition-transform data-[state=open]:rotate-180" />
                   <span className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
@@ -298,7 +292,7 @@ export function WhoisLookupLayout() {
                     {JSON.stringify(result.raw, null, 2)}
                   </pre>
                 </CollapsibleContent>
-              </Card>
+              </div>
             </Collapsible>
 
             <div className="flex justify-end">
@@ -315,6 +309,6 @@ export function WhoisLookupLayout() {
           </motion.div>
         </ScrollArea>
       )}
-    </div>
+    </ToolShell>
   )
 }

From dec2b56ed8a53d3efed6d16f0f9c9a67244949e3 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 17:55:20 +0530
Subject: [PATCH 24/39] feat(tool-sidebar): pure rail registry, overflow split
 and shortcut predicate

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../lib/__tests__/tool-sidebar-rail.test.ts   | 198 ++++++++++++++++++
 apps/desktop-ui/src/lib/tool-sidebar-rail.ts  | 150 +++++++++++++
 2 files changed, 348 insertions(+)
 create mode 100644 apps/desktop-ui/src/lib/__tests__/tool-sidebar-rail.test.ts
 create mode 100644 apps/desktop-ui/src/lib/tool-sidebar-rail.ts

diff --git a/apps/desktop-ui/src/lib/__tests__/tool-sidebar-rail.test.ts b/apps/desktop-ui/src/lib/__tests__/tool-sidebar-rail.test.ts
new file mode 100644
index 00000000..a0c7066c
--- /dev/null
+++ b/apps/desktop-ui/src/lib/__tests__/tool-sidebar-rail.test.ts
@@ -0,0 +1,198 @@
+/**
+ * Pure logic behind the collapsed tool-sidebar rail. Kept out of the React
+ * component because this project's Jest runs in the node environment with no
+ * DOM harness.
+ */
+import {
+  DEFAULT_SIDEBAR_WIDTH,
+  RAIL_MAX_VISIBLE,
+  clampSidebarWidth,
+  emptyRailRegistry,
+  flattenRail,
+  isSidebarShortcut,
+  railEntriesKey,
+  registerRailGroup,
+  splitRailEntries,
+  unregisterRailGroup,
+  type ToolSidebarRailEntry,
+} from "../tool-sidebar-rail"
+
+const entry = (id: string, over: Partial<ToolSidebarRailEntry> = {}): ToolSidebarRailEntry => ({
+  id,
+  label: id.toUpperCase(),
+  ...over,
+})
+
+describe("rail registry", () => {
+  it("keeps groups in registration order", () => {
+    let reg = emptyRailRegistry()
+    reg = registerRailGroup(reg, "security", [entry("weak")])
+    reg = registerRailGroup(reg, "tags", [entry("work")])
+    expect(reg.order).toEqual(["security", "tags"])
+  })
+
+  it("re-registering a group replaces its entries without reordering", () => {
+    let reg = emptyRailRegistry()
+    reg = registerRailGroup(reg, "a", [entry("one")])
+    reg = registerRailGroup(reg, "b", [entry("two")])
+    reg = registerRailGroup(reg, "a", [entry("three")])
+    expect(reg.order).toEqual(["a", "b"])
+    expect(reg.groups.a.map((e) => e.id)).toEqual(["three"])
+  })
+
+  it("unregistering drops the group and its slot in the order", () => {
+    let reg = emptyRailRegistry()
+    reg = registerRailGroup(reg, "a", [entry("one")])
+    reg = registerRailGroup(reg, "b", [entry("two")])
+    reg = unregisterRailGroup(reg, "a")
+    expect(reg.order).toEqual(["b"])
+    expect(reg.groups.a).toBeUndefined()
+  })
+
+  it("unregistering an unknown group returns the same object", () => {
+    const reg = registerRailGroup(emptyRailRegistry(), "a", [entry("one")])
+    expect(unregisterRailGroup(reg, "nope")).toBe(reg)
+  })
+
+  it("flattens groups in order and marks where each new group starts", () => {
+    let reg = emptyRailRegistry()
+    reg = registerRailGroup(reg, "a", [entry("one"), entry("two")])
+    reg = registerRailGroup(reg, "b", [entry("three")])
+    const flat = flattenRail(reg)
+    expect(flat.map((e) => e.label)).toEqual(["ONE", "TWO", "THREE"])
+    // The first entry overall does not start a group — nothing precedes it to
+    // separate from, and a leading separator would draw a stray line.
+    expect(flat.map((e) => !!e.groupStart)).toEqual([false, false, true])
+  })
+
+  it("skips empty groups so no stray separator appears", () => {
+    let reg = emptyRailRegistry()
+    reg = registerRailGroup(reg, "a", [entry("one")])
+    reg = registerRailGroup(reg, "empty", [])
+    reg = registerRailGroup(reg, "b", [entry("two")])
+    const flat = flattenRail(reg)
+    expect(flat.map((e) => e.label)).toEqual(["ONE", "TWO"])
+    expect(flat.map((e) => !!e.groupStart)).toEqual([false, true])
+  })
+
+  it("namespaces ids by group so two groups can reuse an entry id", () => {
+    let reg = emptyRailRegistry()
+    reg = registerRailGroup(reg, "a", [entry("all")])
+    reg = registerRailGroup(reg, "b", [entry("all")])
+    const flat = flattenRail(reg)
+    expect(new Set(flat.map((e) => e.id)).size).toBe(2)
+  })
+})
+
+describe("splitRailEntries", () => {
+  it("shows everything when the count fits", () => {
+    const entries = Array.from({ length: RAIL_MAX_VISIBLE }, (_, i) => entry(`e${i}`))
+    const { visible, overflow } = splitRailEntries(entries, RAIL_MAX_VISIBLE)
+    expect(visible).toHaveLength(RAIL_MAX_VISIBLE)
+    expect(overflow).toHaveLength(0)
+  })
+
+  it("reserves the last slot for the overflow button when it does not fit", () => {
+    const entries = Array.from({ length: RAIL_MAX_VISIBLE + 1 }, (_, i) => entry(`e${i}`))
+    const { visible, overflow } = splitRailEntries(entries, RAIL_MAX_VISIBLE)
+    expect(visible).toHaveLength(RAIL_MAX_VISIBLE - 1)
+    expect(overflow).toHaveLength(2)
+    expect(overflow.map((e) => e.id)).toEqual([`e${RAIL_MAX_VISIBLE - 1}`, `e${RAIL_MAX_VISIBLE}`])
+  })
+
+  it("keeps an active entry visible by swapping it with the last visible slot", () => {
+    const entries = Array.from({ length: RAIL_MAX_VISIBLE + 3 }, (_, i) =>
+      entry(`e${i}`, { active: i === RAIL_MAX_VISIBLE + 2 }),
+    )
+    const { visible, overflow } = splitRailEntries(entries, RAIL_MAX_VISIBLE)
+    expect(visible.some((e) => e.active)).toBe(true)
+    expect(overflow.some((e) => e.active)).toBe(false)
+  })
+})
+
+describe("railEntriesKey", () => {
+  it("is stable across a rebuilt array with equal contents", () => {
+    const a = [entry("one", { count: 3 }), entry("two")]
+    const b = [entry("one", { count: 3 }), entry("two")]
+    expect(railEntriesKey(a)).toBe(railEntriesKey(b))
+  })
+
+  it("changes when a count changes", () => {
+    expect(railEntriesKey([entry("one", { count: 3 })])).not.toBe(
+      railEntriesKey([entry("one", { count: 4 })]),
+    )
+  })
+
+  it("changes when the active entry changes", () => {
+    expect(railEntriesKey([entry("one", { active: true })])).not.toBe(
+      railEntriesKey([entry("one")]),
+    )
+  })
+
+  it("ignores handler identity so a fresh closure does not re-register", () => {
+    expect(railEntriesKey([entry("one", { onSelect: () => {} })])).toBe(
+      railEntriesKey([entry("one", { onSelect: () => {} })]),
+    )
+  })
+})
+
+describe("isSidebarShortcut", () => {
+  const ev = (over: Partial<Parameters<typeof isSidebarShortcut>[0]> = {}) => ({
+    code: "Backslash",
+    metaKey: true,
+    ctrlKey: false,
+    target: null,
+    ...over,
+  })
+
+  it("accepts cmd-backslash", () => {
+    expect(isSidebarShortcut(ev())).toBe(true)
+  })
+
+  it("accepts ctrl-backslash", () => {
+    expect(isSidebarShortcut(ev({ metaKey: false, ctrlKey: true }))).toBe(true)
+  })
+
+  it("rejects backslash with no modifier, so typing a backslash still works", () => {
+    expect(isSidebarShortcut(ev({ metaKey: false, ctrlKey: false }))).toBe(false)
+  })
+
+  it("rejects another key with the modifier held", () => {
+    expect(isSidebarShortcut(ev({ code: "KeyB" }))).toBe(false)
+  })
+
+  it("rejects the shortcut while focus is in a text field", () => {
+    expect(isSidebarShortcut(ev({ target: { tagName: "INPUT" } }))).toBe(false)
+    expect(isSidebarShortcut(ev({ target: { tagName: "TEXTAREA" } }))).toBe(false)
+    expect(isSidebarShortcut(ev({ target: { tagName: "DIV", isContentEditable: true } }))).toBe(
+      false,
+    )
+  })
+
+  it("accepts the shortcut when focus is on a plain element", () => {
+    expect(isSidebarShortcut(ev({ target: { tagName: "DIV" } }))).toBe(true)
+  })
+})
+
+describe("clampSidebarWidth", () => {
+  it("clamps below the minimum", () => {
+    expect(clampSidebarWidth(199)).toBe(200)
+  })
+
+  it("passes the boundaries through", () => {
+    expect(clampSidebarWidth(200)).toBe(200)
+    expect(clampSidebarWidth(480)).toBe(480)
+  })
+
+  it("clamps above the maximum", () => {
+    expect(clampSidebarWidth(481)).toBe(480)
+  })
+
+  it("falls back to the default for a non-finite width", () => {
+    expect(clampSidebarWidth(Number.NaN)).toBe(DEFAULT_SIDEBAR_WIDTH)
+  })
+
+  it("rounds fractional drag positions", () => {
+    expect(clampSidebarWidth(300.6)).toBe(301)
+  })
+})
diff --git a/apps/desktop-ui/src/lib/tool-sidebar-rail.ts b/apps/desktop-ui/src/lib/tool-sidebar-rail.ts
new file mode 100644
index 00000000..f43e9f72
--- /dev/null
+++ b/apps/desktop-ui/src/lib/tool-sidebar-rail.ts
@@ -0,0 +1,150 @@
+/**
+ * Pure logic behind the collapsed tool-sidebar rail — registry bookkeeping,
+ * overflow splitting, the keyboard shortcut predicate and the width clamp.
+ *
+ * This lives outside the React component on purpose: Jest here runs in the node
+ * environment with no DOM harness, so anything branchy has to be testable as a
+ * plain function.
+ */
+import type React from "react"
+
+export const DEFAULT_SIDEBAR_WIDTH = 256
+export const MIN_SIDEBAR_WIDTH = 200
+export const MAX_SIDEBAR_WIDTH = 480
+
+/** Rail buttons that fit before the overflow menu takes the last slot. */
+export const RAIL_MAX_VISIBLE = 8
+
+export interface ToolSidebarRailEntry {
+  /** Unique within its group. `flattenRail` namespaces it to `groupId/id`. */
+  id: string
+  /** Tooltip text and accessible name. */
+  label: string
+  icon?: React.ElementType
+  count?: number
+  active?: boolean
+  /**
+   * Set by `flattenRail` on the first entry of every group but the first, so
+   * the rail can draw a separator above it. Not set by producers.
+   */
+  groupStart?: boolean
+  /**
+   * Invoked on rail click, after the layout expands the panel. Deliberately
+   * excluded from `railEntriesKey` — see the note there.
+   */
+  onSelect?: () => void
+}
+
+export interface RailRegistry {
+  /** Group ids in mount order. */
+  order: string[]
+  groups: Record<string, ToolSidebarRailEntry[]>
+}
+
+/** The handler-map key for an entry, shared by the registry and the layout. */
+export function railHandlerKey(groupId: string, entryId: string): string {
+  return `${groupId}/${entryId}`
+}
+
+export function emptyRailRegistry(): RailRegistry {
+  return { order: [], groups: {} }
+}
+
+export function registerRailGroup(
+  reg: RailRegistry,
+  groupId: string,
+  entries: ToolSidebarRailEntry[],
+): RailRegistry {
+  return {
+    order: reg.order.includes(groupId) ? reg.order : [...reg.order, groupId],
+    groups: { ...reg.groups, [groupId]: entries },
+  }
+}
+
+export function unregisterRailGroup(reg: RailRegistry, groupId: string): RailRegistry {
+  if (!(groupId in reg.groups)) return reg
+  const groups = { ...reg.groups }
+  delete groups[groupId]
+  return { order: reg.order.filter((id) => id !== groupId), groups }
+}
+
+/**
+ * Render order for the rail. Ids are namespaced to their group so two groups can
+ * both have an "all" entry, and the first entry of each group after the first is
+ * marked `groupStart` so the rail can draw a separator above it. Empty groups
+ * are skipped, so a tool whose facets are still loading leaves no stray line.
+ */
+export function flattenRail(reg: RailRegistry): ToolSidebarRailEntry[] {
+  const out: ToolSidebarRailEntry[] = []
+  for (const groupId of reg.order) {
+    const entries = reg.groups[groupId]
+    if (!entries?.length) continue
+    entries.forEach((e, i) => {
+      out.push({
+        ...e,
+        id: railHandlerKey(groupId, e.id),
+        groupStart: i === 0 && out.length > 0,
+      })
+    })
+  }
+  return out
+}
+
+/**
+ * Splits entries into the buttons the rail draws and the ones behind the "…"
+ * menu. When anything overflows, the menu itself consumes a slot, so only
+ * `max - 1` entries stay visible. An active entry is always kept visible —
+ * a rail that hides the current selection tells you nothing.
+ */
+export function splitRailEntries(
+  entries: ToolSidebarRailEntry[],
+  max: number = RAIL_MAX_VISIBLE,
+): { visible: ToolSidebarRailEntry[]; overflow: ToolSidebarRailEntry[] } {
+  if (entries.length <= max) return { visible: entries, overflow: [] }
+
+  const visible = entries.slice(0, max - 1)
+  const overflow = entries.slice(max - 1)
+
+  const activeIndex = overflow.findIndex((e) => e.active)
+  if (activeIndex !== -1 && visible.length) {
+    const [active] = overflow.splice(activeIndex, 1)
+    const displaced = visible[visible.length - 1]
+    visible[visible.length - 1] = active
+    overflow.unshift(displaced)
+  }
+
+  return { visible, overflow }
+}
+
+/**
+ * Dependency key for the registration effect. Handlers are excluded on purpose:
+ * a body that rebuilds `onSelect` every render would otherwise re-register in a
+ * loop. The layout reads live handlers through a ref instead, so excluding them
+ * here cannot go stale.
+ */
+export function railEntriesKey(entries: ToolSidebarRailEntry[]): string {
+  return entries.map((e) => `${e.id}${e.label}${e.count ?? ""}${e.active ? 1 : 0}`).join("")
+}
+
+/**
+ * True when a keydown should toggle the tool sidebar. Matched on `code` rather
+ * than `key` because backslash sits behind different physical keys per layout.
+ */
+export function isSidebarShortcut(e: {
+  code: string
+  metaKey: boolean
+  ctrlKey: boolean
+  target: { tagName?: string; isContentEditable?: boolean } | null
+}): boolean {
+  if (e.code !== "Backslash") return false
+  if (!e.metaKey && !e.ctrlKey) return false
+  const t = e.target
+  if (!t) return true
+  if (t.isContentEditable) return false
+  return t.tagName !== "INPUT" && t.tagName !== "TEXTAREA" && t.tagName !== "SELECT"
+}
+
+export function clampSidebarWidth(px: number): number {
+  if (!Number.isFinite(px)) return DEFAULT_SIDEBAR_WIDTH
+  return Math.min(MAX_SIDEBAR_WIDTH, Math.max(MIN_SIDEBAR_WIDTH, Math.round(px)))
+}

From d7f6b707ff339984d2e6340a6808d9147c2d53eb Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 17:56:16 +0530
Subject: [PATCH 25/39] feat(tool-sidebar): persist panel width per tool

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../__tests__/tool-sidebar-store.test.ts      | 34 ++++++++++++++++++-
 .../src/store/tool-sidebar-store.ts           | 20 +++++++++++
 2 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/apps/desktop-ui/src/store/__tests__/tool-sidebar-store.test.ts b/apps/desktop-ui/src/store/__tests__/tool-sidebar-store.test.ts
index f4314ea2..c1631762 100644
--- a/apps/desktop-ui/src/store/__tests__/tool-sidebar-store.test.ts
+++ b/apps/desktop-ui/src/store/__tests__/tool-sidebar-store.test.ts
@@ -4,7 +4,7 @@
 import { useToolSidebarStore } from "../tool-sidebar-store"
 
 beforeEach(() => {
-  useToolSidebarStore.setState({ collapsed: {} })
+  useToolSidebarStore.setState({ collapsed: {}, width: {} })
 })
 
 describe("tool-sidebar-store", () => {
@@ -33,4 +33,36 @@ describe("tool-sidebar-store", () => {
     setCollapsed("notes", true)
     expect(useToolSidebarStore.getState().collapsed["s3-drive"]).toBeUndefined()
   })
+
+  it("has no stored width until one is set", () => {
+    expect(useToolSidebarStore.getState().width["notes"]).toBeUndefined()
+  })
+
+  it("stores a width per tool", () => {
+    useToolSidebarStore.getState().setWidth("notes", 320)
+    expect(useToolSidebarStore.getState().width["notes"]).toBe(320)
+    expect(useToolSidebarStore.getState().width["bookmarks"]).toBeUndefined()
+  })
+
+  it("clamps a stored width to the allowed range", () => {
+    const { setWidth } = useToolSidebarStore.getState()
+    setWidth("notes", 50)
+    expect(useToolSidebarStore.getState().width["notes"]).toBe(200)
+    setWidth("notes", 5000)
+    expect(useToolSidebarStore.getState().width["notes"]).toBe(480)
+  })
+
+  it("resetWidth clears the key so the default applies again", () => {
+    useToolSidebarStore.getState().setWidth("notes", 320)
+    useToolSidebarStore.getState().resetWidth("notes")
+    expect(useToolSidebarStore.getState().width["notes"]).toBeUndefined()
+  })
+
+  it("width and collapse are independent", () => {
+    const { setWidth, setCollapsed } = useToolSidebarStore.getState()
+    setWidth("notes", 320)
+    setCollapsed("notes", true)
+    expect(useToolSidebarStore.getState().width["notes"]).toBe(320)
+    expect(useToolSidebarStore.getState().collapsed["notes"]).toBe(true)
+  })
 })
diff --git a/apps/desktop-ui/src/store/tool-sidebar-store.ts b/apps/desktop-ui/src/store/tool-sidebar-store.ts
index 5694945c..b2e7f0df 100644
--- a/apps/desktop-ui/src/store/tool-sidebar-store.ts
+++ b/apps/desktop-ui/src/store/tool-sidebar-store.ts
@@ -1,5 +1,6 @@
 import { create } from 'zustand'
 import { persist } from 'zustand/middleware'
+import { clampSidebarWidth } from '@/lib/tool-sidebar-rail'
 
 interface ToolSidebarState {
   /**
@@ -7,19 +8,38 @@ interface ToolSidebarState {
    * default — so a tool that has never been collapsed stores nothing.
    */
   collapsed: Record<string, boolean>
+  /**
+   * Panel width in px keyed by tool id. A missing key means the 256px default,
+   * so a tool the user never dragged stores nothing.
+   */
+  width: Record<string, number>
   setCollapsed: (toolId: string, collapsed: boolean) => void
   toggle: (toolId: string) => void
+  setWidth: (toolId: string, px: number) => void
+  resetWidth: (toolId: string) => void
 }
 
 export const useToolSidebarStore = create<ToolSidebarState>()(
   persist(
     (set) => ({
       collapsed: {},
+      width: {},
       setCollapsed: (toolId, collapsed) =>
         set((s) => ({ collapsed: { ...s.collapsed, [toolId]: collapsed } })),
       toggle: (toolId) =>
         set((s) => ({ collapsed: { ...s.collapsed, [toolId]: !s.collapsed[toolId] } })),
+      setWidth: (toolId, px) =>
+        set((s) => ({ width: { ...s.width, [toolId]: clampSidebarWidth(px) } })),
+      resetWidth: (toolId) =>
+        set((s) => {
+          const width = { ...s.width }
+          delete width[toolId]
+          return { width }
+        }),
     }),
+    // No version bump needed: `persist` shallow-merges the stored object over
+    // the initializer's, and payloads written before `width` existed simply have
+    // no such key, so the `{}` default survives.
     { name: 'tool-sidebar-storage' },
   ),
 )

From 3d001392f1a7a189e0f9cea766e77ddcc6306aab Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 17:57:27 +0530
Subject: [PATCH 26/39] i18n(tool-sidebar): rail expand/collapse/resize keys in
 27 locales

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 apps/desktop-ui/messages/af.json              |  6 +++
 apps/desktop-ui/messages/ar.json              |  6 +++
 apps/desktop-ui/messages/ca.json              |  6 +++
 apps/desktop-ui/messages/cs.json              |  6 +++
 apps/desktop-ui/messages/da.json              |  6 +++
 apps/desktop-ui/messages/de.json              |  6 +++
 apps/desktop-ui/messages/el.json              |  6 +++
 apps/desktop-ui/messages/en.json              |  6 +++
 apps/desktop-ui/messages/es.json              |  6 +++
 apps/desktop-ui/messages/fa.json              |  6 +++
 apps/desktop-ui/messages/fr.json              |  6 +++
 apps/desktop-ui/messages/id.json              |  6 +++
 apps/desktop-ui/messages/it.json              |  6 +++
 apps/desktop-ui/messages/ja.json              |  6 +++
 apps/desktop-ui/messages/ko.json              |  6 +++
 apps/desktop-ui/messages/ms.json              |  6 +++
 apps/desktop-ui/messages/nb.json              |  6 +++
 apps/desktop-ui/messages/nl.json              |  6 +++
 apps/desktop-ui/messages/pl.json              |  6 +++
 apps/desktop-ui/messages/pt-BR.json           |  6 +++
 apps/desktop-ui/messages/pt.json              |  6 +++
 apps/desktop-ui/messages/ru.json              |  6 +++
 apps/desktop-ui/messages/sv.json              |  6 +++
 apps/desktop-ui/messages/tr.json              |  6 +++
 apps/desktop-ui/messages/uk.json              |  6 +++
 apps/desktop-ui/messages/vi.json              |  6 +++
 apps/desktop-ui/messages/zh.json              |  6 +++
 .../scripts/add-tool-sidebar-i18n.mjs         | 48 +++++++++++++++++++
 28 files changed, 210 insertions(+)
 create mode 100644 apps/desktop-ui/scripts/add-tool-sidebar-i18n.mjs

diff --git a/apps/desktop-ui/messages/af.json b/apps/desktop-ui/messages/af.json
index cfdd5d36..aa61f875 100644
--- a/apps/desktop-ui/messages/af.json
+++ b/apps/desktop-ui/messages/af.json
@@ -5223,6 +5223,12 @@
     "offline": "100% aflyn"
   },
   "ToolSidebar": {
+    "expand": "Vou sybalk uit",
+    "collapse": "Vou sybalk in",
+    "resize": "Verstel sybalk se grootte",
+    "resetWidth": "Herstel sybalk se breedte",
+    "moreSections": "Meer afdelings",
+    "sections": "Sybalk-afdelings",
     "show": "Wys sybalk",
     "hide": "Versteek sybalk"
   },
diff --git a/apps/desktop-ui/messages/ar.json b/apps/desktop-ui/messages/ar.json
index 94522005..4e1ac6d2 100644
--- a/apps/desktop-ui/messages/ar.json
+++ b/apps/desktop-ui/messages/ar.json
@@ -5223,6 +5223,12 @@
     "offline": "100% دون اتصال"
   },
   "ToolSidebar": {
+    "expand": "توسيع الشريط الجانبي",
+    "collapse": "طي الشريط الجانبي",
+    "resize": "تغيير حجم الشريط الجانبي",
+    "resetWidth": "إعادة تعيين عرض الشريط الجانبي",
+    "moreSections": "المزيد من الأقسام",
+    "sections": "أقسام الشريط الجانبي",
     "show": "إظهار الشريط الجانبي",
     "hide": "إخفاء الشريط الجانبي"
   },
diff --git a/apps/desktop-ui/messages/ca.json b/apps/desktop-ui/messages/ca.json
index 5b980ce2..0bbbc2fb 100644
--- a/apps/desktop-ui/messages/ca.json
+++ b/apps/desktop-ui/messages/ca.json
@@ -5223,6 +5223,12 @@
     "offline": "100% fora de línia"
   },
   "ToolSidebar": {
+    "expand": "Amplia la barra lateral",
+    "collapse": "Redueix la barra lateral",
+    "resize": "Redimensiona la barra lateral",
+    "resetWidth": "Restableix l'amplada de la barra lateral",
+    "moreSections": "Més seccions",
+    "sections": "Seccions de la barra lateral",
     "show": "Mostra la barra lateral",
     "hide": "Amaga la barra lateral"
   },
diff --git a/apps/desktop-ui/messages/cs.json b/apps/desktop-ui/messages/cs.json
index d2940606..ae84c5af 100644
--- a/apps/desktop-ui/messages/cs.json
+++ b/apps/desktop-ui/messages/cs.json
@@ -5223,6 +5223,12 @@
     "offline": "100% offline"
   },
   "ToolSidebar": {
+    "expand": "Rozbalit postranní panel",
+    "collapse": "Sbalit postranní panel",
+    "resize": "Změnit šířku panelu",
+    "resetWidth": "Obnovit šířku panelu",
+    "moreSections": "Další sekce",
+    "sections": "Sekce postranního panelu",
     "show": "Zobrazit postranní panel",
     "hide": "Skrýt postranní panel"
   },
diff --git a/apps/desktop-ui/messages/da.json b/apps/desktop-ui/messages/da.json
index c92161b5..c348e15d 100644
--- a/apps/desktop-ui/messages/da.json
+++ b/apps/desktop-ui/messages/da.json
@@ -5223,6 +5223,12 @@
     "offline": "100 % offline"
   },
   "ToolSidebar": {
+    "expand": "Udvid sidepanel",
+    "collapse": "Skjul sidepanel",
+    "resize": "Tilpas sidepanelets bredde",
+    "resetWidth": "Nulstil sidepanelets bredde",
+    "moreSections": "Flere sektioner",
+    "sections": "Sidepanelsektioner",
     "show": "Vis sidepanel",
     "hide": "Skjul sidepanel"
   },
diff --git a/apps/desktop-ui/messages/de.json b/apps/desktop-ui/messages/de.json
index ea508a90..b3af3829 100644
--- a/apps/desktop-ui/messages/de.json
+++ b/apps/desktop-ui/messages/de.json
@@ -5223,6 +5223,12 @@
     "offline": "100 % offline"
   },
   "ToolSidebar": {
+    "expand": "Seitenleiste ausklappen",
+    "collapse": "Seitenleiste einklappen",
+    "resize": "Seitenleiste anpassen",
+    "resetWidth": "Breite zurücksetzen",
+    "moreSections": "Weitere Abschnitte",
+    "sections": "Abschnitte der Seitenleiste",
     "show": "Seitenleiste einblenden",
     "hide": "Seitenleiste ausblenden"
   },
diff --git a/apps/desktop-ui/messages/el.json b/apps/desktop-ui/messages/el.json
index a22c17ec..d441276c 100644
--- a/apps/desktop-ui/messages/el.json
+++ b/apps/desktop-ui/messages/el.json
@@ -5223,6 +5223,12 @@
     "offline": "100% εκτός σύνδεσης"
   },
   "ToolSidebar": {
+    "expand": "Ανάπτυξη πλαϊνής στήλης",
+    "collapse": "Σύμπτυξη πλαϊνής στήλης",
+    "resize": "Αλλαγή πλάτους",
+    "resetWidth": "Επαναφορά πλάτους",
+    "moreSections": "Περισσότερες ενότητες",
+    "sections": "Ενότητες πλαϊνής στήλης",
     "show": "Εμφάνιση πλαϊνής μπάρας",
     "hide": "Απόκρυψη πλαϊνής μπάρας"
   },
diff --git a/apps/desktop-ui/messages/en.json b/apps/desktop-ui/messages/en.json
index f1f97a6d..a430419d 100644
--- a/apps/desktop-ui/messages/en.json
+++ b/apps/desktop-ui/messages/en.json
@@ -5310,6 +5310,12 @@
     "offline": "100% offline"
   },
   "ToolSidebar": {
+    "expand": "Expand sidebar",
+    "collapse": "Collapse sidebar",
+    "resize": "Resize sidebar",
+    "resetWidth": "Reset sidebar width",
+    "moreSections": "More sections",
+    "sections": "Sidebar sections",
     "show": "Show sidebar",
     "hide": "Hide sidebar"
   },
diff --git a/apps/desktop-ui/messages/es.json b/apps/desktop-ui/messages/es.json
index 194b0446..b5bd3aa9 100644
--- a/apps/desktop-ui/messages/es.json
+++ b/apps/desktop-ui/messages/es.json
@@ -5223,6 +5223,12 @@
     "offline": "100% sin conexión"
   },
   "ToolSidebar": {
+    "expand": "Expandir barra lateral",
+    "collapse": "Contraer barra lateral",
+    "resize": "Redimensionar barra lateral",
+    "resetWidth": "Restablecer ancho",
+    "moreSections": "Más secciones",
+    "sections": "Secciones de la barra lateral",
     "show": "Mostrar barra lateral",
     "hide": "Ocultar barra lateral"
   },
diff --git a/apps/desktop-ui/messages/fa.json b/apps/desktop-ui/messages/fa.json
index e01d8972..10b2a386 100644
--- a/apps/desktop-ui/messages/fa.json
+++ b/apps/desktop-ui/messages/fa.json
@@ -5223,6 +5223,12 @@
     "offline": "۱۰۰٪ آفلاین"
   },
   "ToolSidebar": {
+    "expand": "گسترش نوار کناری",
+    "collapse": "جمع کردن نوار کناری",
+    "resize": "تغییر اندازه نوار کناری",
+    "resetWidth": "بازنشانی عرض نوار کناری",
+    "moreSections": "بخش‌های بیشتر",
+    "sections": "بخش‌های نوار کناری",
     "show": "نمایش نوار کناری",
     "hide": "پنهان کردن نوار کناری"
   },
diff --git a/apps/desktop-ui/messages/fr.json b/apps/desktop-ui/messages/fr.json
index 41af1a02..e4420437 100644
--- a/apps/desktop-ui/messages/fr.json
+++ b/apps/desktop-ui/messages/fr.json
@@ -5223,6 +5223,12 @@
     "offline": "100 % hors ligne"
   },
   "ToolSidebar": {
+    "expand": "Développer la barre latérale",
+    "collapse": "Réduire la barre latérale",
+    "resize": "Redimensionner la barre latérale",
+    "resetWidth": "Réinitialiser la largeur",
+    "moreSections": "Plus de sections",
+    "sections": "Sections de la barre latérale",
     "show": "Afficher la barre latérale",
     "hide": "Masquer la barre latérale"
   },
diff --git a/apps/desktop-ui/messages/id.json b/apps/desktop-ui/messages/id.json
index 13ca9cdd..ba78f61d 100644
--- a/apps/desktop-ui/messages/id.json
+++ b/apps/desktop-ui/messages/id.json
@@ -5223,6 +5223,12 @@
     "offline": "100% offline"
   },
   "ToolSidebar": {
+    "expand": "Bentangkan bilah sisi",
+    "collapse": "Ciutkan bilah sisi",
+    "resize": "Ubah ukuran bilah sisi",
+    "resetWidth": "Atur ulang lebar bilah sisi",
+    "moreSections": "Bagian lainnya",
+    "sections": "Bagian bilah sisi",
     "show": "Tampilkan bilah sisi",
     "hide": "Sembunyikan bilah sisi"
   },
diff --git a/apps/desktop-ui/messages/it.json b/apps/desktop-ui/messages/it.json
index 21110000..5cf8185b 100644
--- a/apps/desktop-ui/messages/it.json
+++ b/apps/desktop-ui/messages/it.json
@@ -5223,6 +5223,12 @@
     "offline": "100% offline"
   },
   "ToolSidebar": {
+    "expand": "Espandi barra laterale",
+    "collapse": "Comprimi barra laterale",
+    "resize": "Ridimensiona barra laterale",
+    "resetWidth": "Reimposta larghezza",
+    "moreSections": "Altre sezioni",
+    "sections": "Sezioni della barra laterale",
     "show": "Mostra barra laterale",
     "hide": "Nascondi barra laterale"
   },
diff --git a/apps/desktop-ui/messages/ja.json b/apps/desktop-ui/messages/ja.json
index 378cb30a..2fe81b64 100644
--- a/apps/desktop-ui/messages/ja.json
+++ b/apps/desktop-ui/messages/ja.json
@@ -5223,6 +5223,12 @@
     "offline": "完全オフライン"
   },
   "ToolSidebar": {
+    "expand": "サイドバーを展開",
+    "collapse": "サイドバーを折りたたむ",
+    "resize": "サイドバーの幅を変更",
+    "resetWidth": "サイドバーの幅をリセット",
+    "moreSections": "その他のセクション",
+    "sections": "サイドバーのセクション",
     "show": "サイドバーを表示",
     "hide": "サイドバーを非表示"
   },
diff --git a/apps/desktop-ui/messages/ko.json b/apps/desktop-ui/messages/ko.json
index 5e87a02c..69e705ba 100644
--- a/apps/desktop-ui/messages/ko.json
+++ b/apps/desktop-ui/messages/ko.json
@@ -5223,6 +5223,12 @@
     "offline": "100% 오프라인"
   },
   "ToolSidebar": {
+    "expand": "사이드바 펼치기",
+    "collapse": "사이드바 접기",
+    "resize": "사이드바 너비 조절",
+    "resetWidth": "사이드바 너비 초기화",
+    "moreSections": "섹션 더 보기",
+    "sections": "사이드바 섹션",
     "show": "사이드바 표시",
     "hide": "사이드바 숨기기"
   },
diff --git a/apps/desktop-ui/messages/ms.json b/apps/desktop-ui/messages/ms.json
index de039994..86646f8c 100644
--- a/apps/desktop-ui/messages/ms.json
+++ b/apps/desktop-ui/messages/ms.json
@@ -5223,6 +5223,12 @@
     "offline": "100% luar talian"
   },
   "ToolSidebar": {
+    "expand": "Kembangkan bar sisi",
+    "collapse": "Runtuhkan bar sisi",
+    "resize": "Ubah saiz bar sisi",
+    "resetWidth": "Tetapkan semula lebar bar sisi",
+    "moreSections": "Lagi bahagian",
+    "sections": "Bahagian bar sisi",
     "show": "Tunjukkan bar sisi",
     "hide": "Sembunyikan bar sisi"
   },
diff --git a/apps/desktop-ui/messages/nb.json b/apps/desktop-ui/messages/nb.json
index ded6f006..a958af60 100644
--- a/apps/desktop-ui/messages/nb.json
+++ b/apps/desktop-ui/messages/nb.json
@@ -5223,6 +5223,12 @@
     "offline": "100 % offline"
   },
   "ToolSidebar": {
+    "expand": "Utvid sidepanel",
+    "collapse": "Skjul sidepanel",
+    "resize": "Endre bredde på sidepanel",
+    "resetWidth": "Tilbakestill bredde",
+    "moreSections": "Flere seksjoner",
+    "sections": "Sidepanelseksjoner",
     "show": "Vis sidepanel",
     "hide": "Skjul sidepanel"
   },
diff --git a/apps/desktop-ui/messages/nl.json b/apps/desktop-ui/messages/nl.json
index 25c096d0..b93207a8 100644
--- a/apps/desktop-ui/messages/nl.json
+++ b/apps/desktop-ui/messages/nl.json
@@ -5223,6 +5223,12 @@
     "offline": "100% offline"
   },
   "ToolSidebar": {
+    "expand": "Zijbalk uitklappen",
+    "collapse": "Zijbalk inklappen",
+    "resize": "Zijbalkbreedte aanpassen",
+    "resetWidth": "Breedte herstellen",
+    "moreSections": "Meer secties",
+    "sections": "Zijbalksecties",
     "show": "Zijbalk tonen",
     "hide": "Zijbalk verbergen"
   },
diff --git a/apps/desktop-ui/messages/pl.json b/apps/desktop-ui/messages/pl.json
index 86cc6ab4..bdec4d87 100644
--- a/apps/desktop-ui/messages/pl.json
+++ b/apps/desktop-ui/messages/pl.json
@@ -5223,6 +5223,12 @@
     "offline": "100% offline"
   },
   "ToolSidebar": {
+    "expand": "Rozwiń panel boczny",
+    "collapse": "Zwiń panel boczny",
+    "resize": "Zmień szerokość panelu",
+    "resetWidth": "Przywróć szerokość panelu",
+    "moreSections": "Więcej sekcji",
+    "sections": "Sekcje panelu bocznego",
     "show": "Pokaż pasek boczny",
     "hide": "Ukryj pasek boczny"
   },
diff --git a/apps/desktop-ui/messages/pt-BR.json b/apps/desktop-ui/messages/pt-BR.json
index c9957d75..d0afff29 100644
--- a/apps/desktop-ui/messages/pt-BR.json
+++ b/apps/desktop-ui/messages/pt-BR.json
@@ -5223,6 +5223,12 @@
     "offline": "100% offline"
   },
   "ToolSidebar": {
+    "expand": "Expandir barra lateral",
+    "collapse": "Recolher barra lateral",
+    "resize": "Redimensionar barra lateral",
+    "resetWidth": "Redefinir largura",
+    "moreSections": "Mais seções",
+    "sections": "Seções da barra lateral",
     "show": "Mostrar barra lateral",
     "hide": "Ocultar barra lateral"
   },
diff --git a/apps/desktop-ui/messages/pt.json b/apps/desktop-ui/messages/pt.json
index 64be03dd..58a83485 100644
--- a/apps/desktop-ui/messages/pt.json
+++ b/apps/desktop-ui/messages/pt.json
@@ -5223,6 +5223,12 @@
     "offline": "100% offline"
   },
   "ToolSidebar": {
+    "expand": "Expandir barra lateral",
+    "collapse": "Recolher barra lateral",
+    "resize": "Redimensionar barra lateral",
+    "resetWidth": "Repor largura",
+    "moreSections": "Mais secções",
+    "sections": "Secções da barra lateral",
     "show": "Mostrar barra lateral",
     "hide": "Ocultar barra lateral"
   },
diff --git a/apps/desktop-ui/messages/ru.json b/apps/desktop-ui/messages/ru.json
index f87079b6..d7459120 100644
--- a/apps/desktop-ui/messages/ru.json
+++ b/apps/desktop-ui/messages/ru.json
@@ -5223,6 +5223,12 @@
     "offline": "100% офлайн"
   },
   "ToolSidebar": {
+    "expand": "Развернуть боковую панель",
+    "collapse": "Свернуть боковую панель",
+    "resize": "Изменить ширину панели",
+    "resetWidth": "Сбросить ширину панели",
+    "moreSections": "Ещё разделы",
+    "sections": "Разделы боковой панели",
     "show": "Показать боковую панель",
     "hide": "Скрыть боковую панель"
   },
diff --git a/apps/desktop-ui/messages/sv.json b/apps/desktop-ui/messages/sv.json
index fa8bc36a..1753ab49 100644
--- a/apps/desktop-ui/messages/sv.json
+++ b/apps/desktop-ui/messages/sv.json
@@ -5223,6 +5223,12 @@
     "offline": "100 % offline"
   },
   "ToolSidebar": {
+    "expand": "Expandera sidopanelen",
+    "collapse": "Fäll ihop sidopanelen",
+    "resize": "Ändra sidopanelens bredd",
+    "resetWidth": "Återställ bredden",
+    "moreSections": "Fler sektioner",
+    "sections": "Sidopanelens sektioner",
     "show": "Visa sidopanel",
     "hide": "Dölj sidopanel"
   },
diff --git a/apps/desktop-ui/messages/tr.json b/apps/desktop-ui/messages/tr.json
index 858d5948..a4c0333b 100644
--- a/apps/desktop-ui/messages/tr.json
+++ b/apps/desktop-ui/messages/tr.json
@@ -5223,6 +5223,12 @@
     "offline": "%100 çevrimdışı"
   },
   "ToolSidebar": {
+    "expand": "Kenar çubuğunu genişlet",
+    "collapse": "Kenar çubuğunu daralt",
+    "resize": "Kenar çubuğunu yeniden boyutlandır",
+    "resetWidth": "Genişliği sıfırla",
+    "moreSections": "Daha fazla bölüm",
+    "sections": "Kenar çubuğu bölümleri",
     "show": "Kenar çubuğunu göster",
     "hide": "Kenar çubuğunu gizle"
   },
diff --git a/apps/desktop-ui/messages/uk.json b/apps/desktop-ui/messages/uk.json
index e6ae9299..2820a96c 100644
--- a/apps/desktop-ui/messages/uk.json
+++ b/apps/desktop-ui/messages/uk.json
@@ -5223,6 +5223,12 @@
     "offline": "100% офлайн"
   },
   "ToolSidebar": {
+    "expand": "Розгорнути бічну панель",
+    "collapse": "Згорнути бічну панель",
+    "resize": "Змінити ширину панелі",
+    "resetWidth": "Скинути ширину панелі",
+    "moreSections": "Більше розділів",
+    "sections": "Розділи бічної панелі",
     "show": "Показати бічну панель",
     "hide": "Сховати бічну панель"
   },
diff --git a/apps/desktop-ui/messages/vi.json b/apps/desktop-ui/messages/vi.json
index e2b80a14..344f364c 100644
--- a/apps/desktop-ui/messages/vi.json
+++ b/apps/desktop-ui/messages/vi.json
@@ -5223,6 +5223,12 @@
     "offline": "100% ngoại tuyến"
   },
   "ToolSidebar": {
+    "expand": "Mở rộng thanh bên",
+    "collapse": "Thu gọn thanh bên",
+    "resize": "Thay đổi kích thước thanh bên",
+    "resetWidth": "Đặt lại chiều rộng thanh bên",
+    "moreSections": "Thêm mục",
+    "sections": "Các mục thanh bên",
     "show": "Hiện thanh bên",
     "hide": "Ẩn thanh bên"
   },
diff --git a/apps/desktop-ui/messages/zh.json b/apps/desktop-ui/messages/zh.json
index 333bb79d..461e2643 100644
--- a/apps/desktop-ui/messages/zh.json
+++ b/apps/desktop-ui/messages/zh.json
@@ -5223,6 +5223,12 @@
     "offline": "100% 离线"
   },
   "ToolSidebar": {
+    "expand": "展开侧边栏",
+    "collapse": "折叠侧边栏",
+    "resize": "调整侧边栏宽度",
+    "resetWidth": "重置侧边栏宽度",
+    "moreSections": "更多分区",
+    "sections": "侧边栏分区",
     "show": "显示侧边栏",
     "hide": "隐藏侧边栏"
   },
diff --git a/apps/desktop-ui/scripts/add-tool-sidebar-i18n.mjs b/apps/desktop-ui/scripts/add-tool-sidebar-i18n.mjs
new file mode 100644
index 00000000..24ed9cf2
--- /dev/null
+++ b/apps/desktop-ui/scripts/add-tool-sidebar-i18n.mjs
@@ -0,0 +1,48 @@
+// Adds the collapse-to-icon rail keys to the ToolSidebar namespace in every
+// locale. Idempotent: existing keys are left untouched.
+import { readFileSync, writeFileSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+
+const DIR = new URL('../messages/', import.meta.url).pathname
+
+const T = {
+  en: { expand: 'Expand sidebar', collapse: 'Collapse sidebar', resize: 'Resize sidebar', resetWidth: 'Reset sidebar width', moreSections: 'More sections', sections: 'Sidebar sections' },
+  af: { expand: 'Vou sybalk uit', collapse: 'Vou sybalk in', resize: 'Verstel sybalk se grootte', resetWidth: 'Herstel sybalk se breedte', moreSections: 'Meer afdelings', sections: 'Sybalk-afdelings' },
+  ar: { expand: 'توسيع الشريط الجانبي', collapse: 'طي الشريط الجانبي', resize: 'تغيير حجم الشريط الجانبي', resetWidth: 'إعادة تعيين عرض الشريط الجانبي', moreSections: 'المزيد من الأقسام', sections: 'أقسام الشريط الجانبي' },
+  ca: { expand: 'Amplia la barra lateral', collapse: 'Redueix la barra lateral', resize: 'Redimensiona la barra lateral', resetWidth: "Restableix l'amplada de la barra lateral", moreSections: 'Més seccions', sections: 'Seccions de la barra lateral' },
+  cs: { expand: 'Rozbalit postranní panel', collapse: 'Sbalit postranní panel', resize: 'Změnit šířku panelu', resetWidth: 'Obnovit šířku panelu', moreSections: 'Další sekce', sections: 'Sekce postranního panelu' },
+  da: { expand: 'Udvid sidepanel', collapse: 'Skjul sidepanel', resize: 'Tilpas sidepanelets bredde', resetWidth: 'Nulstil sidepanelets bredde', moreSections: 'Flere sektioner', sections: 'Sidepanelsektioner' },
+  de: { expand: 'Seitenleiste ausklappen', collapse: 'Seitenleiste einklappen', resize: 'Seitenleiste anpassen', resetWidth: 'Breite zurücksetzen', moreSections: 'Weitere Abschnitte', sections: 'Abschnitte der Seitenleiste' },
+  el: { expand: 'Ανάπτυξη πλαϊνής στήλης', collapse: 'Σύμπτυξη πλαϊνής στήλης', resize: 'Αλλαγή πλάτους', resetWidth: 'Επαναφορά πλάτους', moreSections: 'Περισσότερες ενότητες', sections: 'Ενότητες πλαϊνής στήλης' },
+  es: { expand: 'Expandir barra lateral', collapse: 'Contraer barra lateral', resize: 'Redimensionar barra lateral', resetWidth: 'Restablecer ancho', moreSections: 'Más secciones', sections: 'Secciones de la barra lateral' },
+  fa: { expand: 'گسترش نوار کناری', collapse: 'جمع کردن نوار کناری', resize: 'تغییر اندازه نوار کناری', resetWidth: 'بازنشانی عرض نوار کناری', moreSections: 'بخش‌های بیشتر', sections: 'بخش‌های نوار کناری' },
+  fr: { expand: 'Développer la barre latérale', collapse: 'Réduire la barre latérale', resize: 'Redimensionner la barre latérale', resetWidth: 'Réinitialiser la largeur', moreSections: 'Plus de sections', sections: 'Sections de la barre latérale' },
+  id: { expand: 'Bentangkan bilah sisi', collapse: 'Ciutkan bilah sisi', resize: 'Ubah ukuran bilah sisi', resetWidth: 'Atur ulang lebar bilah sisi', moreSections: 'Bagian lainnya', sections: 'Bagian bilah sisi' },
+  it: { expand: 'Espandi barra laterale', collapse: 'Comprimi barra laterale', resize: 'Ridimensiona barra laterale', resetWidth: 'Reimposta larghezza', moreSections: 'Altre sezioni', sections: 'Sezioni della barra laterale' },
+  ja: { expand: 'サイドバーを展開', collapse: 'サイドバーを折りたたむ', resize: 'サイドバーの幅を変更', resetWidth: 'サイドバーの幅をリセット', moreSections: 'その他のセクション', sections: 'サイドバーのセクション' },
+  ko: { expand: '사이드바 펼치기', collapse: '사이드바 접기', resize: '사이드바 너비 조절', resetWidth: '사이드바 너비 초기화', moreSections: '섹션 더 보기', sections: '사이드바 섹션' },
+  ms: { expand: 'Kembangkan bar sisi', collapse: 'Runtuhkan bar sisi', resize: 'Ubah saiz bar sisi', resetWidth: 'Tetapkan semula lebar bar sisi', moreSections: 'Lagi bahagian', sections: 'Bahagian bar sisi' },
+  nb: { expand: 'Utvid sidepanel', collapse: 'Skjul sidepanel', resize: 'Endre bredde på sidepanel', resetWidth: 'Tilbakestill bredde', moreSections: 'Flere seksjoner', sections: 'Sidepanelseksjoner' },
+  nl: { expand: 'Zijbalk uitklappen', collapse: 'Zijbalk inklappen', resize: 'Zijbalkbreedte aanpassen', resetWidth: 'Breedte herstellen', moreSections: 'Meer secties', sections: 'Zijbalksecties' },
+  pl: { expand: 'Rozwiń panel boczny', collapse: 'Zwiń panel boczny', resize: 'Zmień szerokość panelu', resetWidth: 'Przywróć szerokość panelu', moreSections: 'Więcej sekcji', sections: 'Sekcje panelu bocznego' },
+  'pt-BR': { expand: 'Expandir barra lateral', collapse: 'Recolher barra lateral', resize: 'Redimensionar barra lateral', resetWidth: 'Redefinir largura', moreSections: 'Mais seções', sections: 'Seções da barra lateral' },
+  pt: { expand: 'Expandir barra lateral', collapse: 'Recolher barra lateral', resize: 'Redimensionar barra lateral', resetWidth: 'Repor largura', moreSections: 'Mais secções', sections: 'Secções da barra lateral' },
+  ru: { expand: 'Развернуть боковую панель', collapse: 'Свернуть боковую панель', resize: 'Изменить ширину панели', resetWidth: 'Сбросить ширину панели', moreSections: 'Ещё разделы', sections: 'Разделы боковой панели' },
+  sv: { expand: 'Expandera sidopanelen', collapse: 'Fäll ihop sidopanelen', resize: 'Ändra sidopanelens bredd', resetWidth: 'Återställ bredden', moreSections: 'Fler sektioner', sections: 'Sidopanelens sektioner' },
+  tr: { expand: 'Kenar çubuğunu genişlet', collapse: 'Kenar çubuğunu daralt', resize: 'Kenar çubuğunu yeniden boyutlandır', resetWidth: 'Genişliği sıfırla', moreSections: 'Daha fazla bölüm', sections: 'Kenar çubuğu bölümleri' },
+  uk: { expand: 'Розгорнути бічну панель', collapse: 'Згорнути бічну панель', resize: 'Змінити ширину панелі', resetWidth: 'Скинути ширину панелі', moreSections: 'Більше розділів', sections: 'Розділи бічної панелі' },
+  vi: { expand: 'Mở rộng thanh bên', collapse: 'Thu gọn thanh bên', resize: 'Thay đổi kích thước thanh bên', resetWidth: 'Đặt lại chiều rộng thanh bên', moreSections: 'Thêm mục', sections: 'Các mục thanh bên' },
+  zh: { expand: '展开侧边栏', collapse: '折叠侧边栏', resize: '调整侧边栏宽度', resetWidth: '重置侧边栏宽度', moreSections: '更多分区', sections: '侧边栏分区' },
+}
+
+let changed = 0
+for (const file of readdirSync(DIR).filter((f) => f.endsWith('.json'))) {
+  const locale = file.replace(/\.json$/, '')
+  const add = T[locale] ?? T.en
+  const path = join(DIR, file)
+  const json = JSON.parse(readFileSync(path, 'utf8'))
+  json.ToolSidebar = { ...add, ...(json.ToolSidebar ?? {}) }
+  writeFileSync(path, JSON.stringify(json, null, 2) + '\n')
+  changed++
+}
+console.log(`updated ${changed} locale files`)

From e17fd867fe57793c2dd10cc64f31382935ffbf78 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 17:58:59 +0530
Subject: [PATCH 27/39] feat(tool-sidebar): 48px icon rail with facets,
 overflow and roving tabindex

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../__tests__/tool-sidebar-rail.memo.test.tsx |  42 +++
 .../components/tools/tool-sidebar-rail.tsx    | 296 ++++++++++++++++++
 2 files changed, 338 insertions(+)
 create mode 100644 apps/desktop-ui/src/components/tools/__tests__/tool-sidebar-rail.memo.test.tsx
 create mode 100644 apps/desktop-ui/src/components/tools/tool-sidebar-rail.tsx

diff --git a/apps/desktop-ui/src/components/tools/__tests__/tool-sidebar-rail.memo.test.tsx b/apps/desktop-ui/src/components/tools/__tests__/tool-sidebar-rail.memo.test.tsx
new file mode 100644
index 00000000..75d75300
--- /dev/null
+++ b/apps/desktop-ui/src/components/tools/__tests__/tool-sidebar-rail.memo.test.tsx
@@ -0,0 +1,42 @@
+/**
+ * Metadata-level test: this project's Jest runs in the node environment with no
+ * DOM harness, so we assert the memo contract rather than rendered output —
+ * same approach as api-client/__tests__/collection-item.memo.test.tsx.
+ */
+jest.mock("next-intl", () => ({ useTranslations: () => (k: string) => k }))
+
+describe("RailButton memo", () => {
+  it("is wrapped in React.memo with a custom comparator", () => {
+    const { RailButton } = require("../tool-sidebar-rail")
+    expect(RailButton.$$typeof).toBe(Symbol.for("react.memo"))
+    expect(RailButton.compare).toBeInstanceOf(Function)
+  })
+
+  it("skips re-render when the displayed props are unchanged", () => {
+    const { RailButton } = require("../tool-sidebar-rail")
+    const compare = RailButton.compare as (a: never, b: never) => boolean
+    const base = {
+      entry: { id: "tags", label: "Tags", count: 3, active: false },
+      accent: { bg: "bg-blue-500/10", text: "text-blue-500" },
+      onActivate: () => {},
+    }
+    const same = { ...base, entry: { ...base.entry }, onActivate: () => {} }
+    expect(compare(base as never, same as never)).toBe(true)
+  })
+
+  it("re-renders when active or count changes", () => {
+    const { RailButton } = require("../tool-sidebar-rail")
+    const compare = RailButton.compare as (a: never, b: never) => boolean
+    const base = {
+      entry: { id: "tags", label: "Tags", count: 3, active: false },
+      accent: { bg: "bg-blue-500/10", text: "text-blue-500" },
+      onActivate: () => {},
+    }
+    expect(
+      compare(base as never, { ...base, entry: { ...base.entry, active: true } } as never),
+    ).toBe(false)
+    expect(compare(base as never, { ...base, entry: { ...base.entry, count: 4 } } as never)).toBe(
+      false,
+    )
+  })
+})
diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar-rail.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar-rail.tsx
new file mode 100644
index 00000000..487ef00c
--- /dev/null
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar-rail.tsx
@@ -0,0 +1,296 @@
+'use client'
+
+import * as React from 'react'
+import { MoreHorizontal, PanelLeft } from 'lucide-react'
+import { useTranslations } from 'next-intl'
+import { Button } from '@/components/ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu'
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipProvider,
+  TooltipTrigger,
+} from '@/components/ui/tooltip'
+import {
+  RAIL_MAX_VISIBLE,
+  splitRailEntries,
+  type ToolSidebarRailEntry,
+} from '@/lib/tool-sidebar-rail'
+import { cn } from '@/lib/utils'
+
+/**
+ * The collapsed sidebar: a 48px column that keeps the tool's identity, its
+ * primary action and its facets reachable without expanding. Buttons are 40x40
+ * inside 4px gutters, which clears the 44px pointer target.
+ *
+ * The rail owns no state. Entries arrive already flattened, and every click is
+ * routed back through `onActivate` so the layout can expand the panel first.
+ */
+
+interface Accent {
+  bg: string
+  text: string
+}
+
+interface RailButtonProps {
+  entry: ToolSidebarRailEntry
+  accent: Accent
+  onActivate: (entry: ToolSidebarRailEntry) => void
+}
+
+function RailButtonImpl({ entry, accent, onActivate }: RailButtonProps) {
+  const Icon = entry.icon
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <button
+          type="button"
+          tabIndex={-1}
+          data-rail-entry={entry.id}
+          aria-label={entry.label}
+          aria-current={entry.active ? 'true' : undefined}
+          onClick={() => onActivate(entry)}
+          className={cn(
+            'relative flex h-10 w-10 shrink-0 cursor-pointer items-center justify-center rounded-md transition-colors',
+            entry.active
+              ? cn(accent.bg, accent.text)
+              : 'text-muted-foreground hover:bg-foreground/[0.06] hover:text-foreground',
+          )}
+        >
+          {entry.active && (
+            <span aria-hidden className="absolute -left-1 h-5 w-0.5 rounded-full bg-current" />
+          )}
+          {Icon ? (
+            <Icon className="h-[17px] w-[17px]" aria-hidden />
+          ) : (
+            <span aria-hidden className="text-xs font-semibold uppercase">
+              {entry.label.slice(0, 2)}
+            </span>
+          )}
+          {entry.count !== undefined && entry.count > 0 && (
+            <span
+              aria-hidden
+              className="absolute -right-0.5 -top-0.5 min-w-3.5 rounded-full bg-foreground/10 px-1 text-[9px] font-medium leading-[14px] tabular-nums text-foreground/70"
+            >
+              {entry.count > 99 ? '99+' : entry.count}
+            </span>
+          )}
+        </button>
+      </TooltipTrigger>
+      <TooltipContent side="right" sideOffset={8}>
+        {entry.count !== undefined ? `${entry.label} (${entry.count})` : entry.label}
+      </TooltipContent>
+    </Tooltip>
+  )
+}
+
+/**
+ * Memoized on displayed data only. `onActivate` is compared by identity but the
+ * layout passes a `useCallback`-stable handler, and entry handlers are resolved
+ * through a ref at click time, so a changing closure never forces a re-render.
+ */
+export const RailButton = React.memo(RailButtonImpl, (a, b) => {
+  return (
+    a.entry.id === b.entry.id &&
+    a.entry.label === b.entry.label &&
+    a.entry.count === b.entry.count &&
+    a.entry.active === b.entry.active &&
+    a.entry.icon === b.entry.icon &&
+    a.entry.groupStart === b.entry.groupStart &&
+    a.accent.bg === b.accent.bg &&
+    a.accent.text === b.accent.text
+  )
+})
+RailButton.displayName = 'RailButton'
+
+export interface ToolSidebarRailProps {
+  /** Tool identity chip at the top. Clicking it expands the panel. */
+  icon: React.ElementType
+  title: string
+  accent: Accent
+  entries: ToolSidebarRailEntry[]
+  primaryAction?: { icon: React.ElementType; label: string; onClick: () => void }
+  /** Expand the panel (rail bottom button, tool chip, and before any entry). */
+  onExpand: () => void
+  onActivate: (entry: ToolSidebarRailEntry) => void
+  /** Wired by the layout so `aria-controls` points at the panel. */
+  panelId: string
+  /** So the layout can return focus here when the panel collapses. */
+  expandRef?: React.RefObject<HTMLButtonElement | null>
+}
+
+export function ToolSidebarRail({
+  icon: Icon,
+  title,
+  accent,
+  entries,
+  primaryAction,
+  onExpand,
+  onActivate,
+  panelId,
+  expandRef,
+}: ToolSidebarRailProps) {
+  const t = useTranslations('ToolSidebar')
+  const listRef = React.useRef<HTMLDivElement | null>(null)
+  const { visible, overflow } = splitRailEntries(entries, RAIL_MAX_VISIBLE)
+
+  // Roving tabindex: the container is the single tab stop, arrows move focus
+  // between buttons. Without this a tool with eight facets adds eight stops to
+  // every Tab sweep of the app.
+  const focusAt = React.useCallback((delta: number | 'first' | 'last') => {
+    const nodes = Array.from(
+      listRef.current?.querySelectorAll<HTMLButtonElement>('button[data-rail-entry]') ?? [],
+    )
+    if (!nodes.length) return
+    const current = nodes.findIndex((n) => n === document.activeElement)
+    let next: number
+    if (delta === 'first') next = 0
+    else if (delta === 'last') next = nodes.length - 1
+    else next = current === -1 ? 0 : (current + delta + nodes.length) % nodes.length
+    nodes[next]?.focus()
+  }, [])
+
+  const onKeyDown = React.useCallback(
+    (e: React.KeyboardEvent) => {
+      if (e.key === 'ArrowDown') {
+        e.preventDefault()
+        focusAt(1)
+      } else if (e.key === 'ArrowUp') {
+        e.preventDefault()
+        focusAt(-1)
+      } else if (e.key === 'Home') {
+        e.preventDefault()
+        focusAt('first')
+      } else if (e.key === 'End') {
+        e.preventDefault()
+        focusAt('last')
+      }
+    },
+    [focusAt],
+  )
+
+  return (
+    <TooltipProvider delayDuration={300}>
+      <div className="flex w-12 shrink-0 flex-col items-center gap-1 border-r bg-muted/10 py-2">
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <button
+              type="button"
+              onClick={onExpand}
+              aria-label={`${title} — ${t('expand')}`}
+              className="flex h-10 w-10 shrink-0 cursor-pointer items-center justify-center rounded-md hover:bg-foreground/[0.06]"
+            >
+              <span
+                className={cn(
+                  'flex h-6 w-6 items-center justify-center rounded-md',
+                  accent.bg,
+                  accent.text,
+                )}
+              >
+                <Icon className="h-3.5 w-3.5" aria-hidden />
+              </span>
+            </button>
+          </TooltipTrigger>
+          <TooltipContent side="right" sideOffset={8}>
+            {title}
+          </TooltipContent>
+        </Tooltip>
+
+        {primaryAction && (
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                variant="ghost"
+                size="icon"
+                className="h-10 w-10 cursor-pointer"
+                onClick={primaryAction.onClick}
+                aria-label={primaryAction.label}
+              >
+                <primaryAction.icon className="h-4 w-4" aria-hidden />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent side="right" sideOffset={8}>
+              {primaryAction.label}
+            </TooltipContent>
+          </Tooltip>
+        )}
+
+        {(visible.length > 0 || overflow.length > 0) && (
+          <div className="my-1 h-px w-6 shrink-0 bg-border" aria-hidden />
+        )}
+
+        <div
+          ref={listRef}
+          role="toolbar"
+          aria-orientation="vertical"
+          aria-label={t('sections')}
+          tabIndex={visible.length ? 0 : -1}
+          onKeyDown={onKeyDown}
+          className="flex min-h-0 flex-1 flex-col items-center gap-1 overflow-hidden"
+        >
+          {visible.map((entry) => (
+            <React.Fragment key={entry.id}>
+              {entry.groupStart && (
+                <div className="my-1 h-px w-6 shrink-0 bg-border" aria-hidden />
+              )}
+              <RailButton entry={entry} accent={accent} onActivate={onActivate} />
+            </React.Fragment>
+          ))}
+
+          {overflow.length > 0 && (
+            <DropdownMenu>
+              <DropdownMenuTrigger asChild>
+                <Button
+                  variant="ghost"
+                  size="icon"
+                  className="h-10 w-10 cursor-pointer"
+                  aria-label={t('moreSections')}
+                >
+                  <MoreHorizontal className="h-4 w-4" aria-hidden />
+                </Button>
+              </DropdownMenuTrigger>
+              <DropdownMenuContent side="right" align="start">
+                {overflow.map((entry) => (
+                  <DropdownMenuItem key={entry.id} onSelect={() => onActivate(entry)}>
+                    {entry.icon && <entry.icon className="mr-2 h-4 w-4" aria-hidden />}
+                    <span className="flex-1">{entry.label}</span>
+                    {entry.count !== undefined && (
+                      <span className="ml-2 text-xs tabular-nums text-muted-foreground">
+                        {entry.count}
+                      </span>
+                    )}
+                  </DropdownMenuItem>
+                ))}
+              </DropdownMenuContent>
+            </DropdownMenu>
+          )}
+        </div>
+
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <Button
+              ref={expandRef}
+              variant="ghost"
+              size="icon"
+              className="mt-auto h-10 w-10 cursor-pointer"
+              onClick={onExpand}
+              aria-label={t('expand')}
+              aria-expanded={false}
+              aria-controls={panelId}
+            >
+              <PanelLeft className="h-4 w-4" aria-hidden />
+            </Button>
+          </TooltipTrigger>
+          <TooltipContent side="right" sideOffset={8}>
+            {t('expand')}
+          </TooltipContent>
+        </Tooltip>
+      </div>
+    </TooltipProvider>
+  )
+}

From beff5c10b55b2436102dacefbf9cf6a380f5926c Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 18:02:13 +0530
Subject: [PATCH 28/39] feat(tool-sidebar): keep the panel mounted while
 collapsed and render the icon rail

Collapsing used to unmount the panel, which discarded the body's search text,
expanded tree groups and scroll position every time. It also made a rail
impossible: entries are published by hooks inside the body, and an unmounted
body cannot publish. Hide with display:none instead, mirroring how TabContent
keeps inactive tool tabs alive.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/components/tools/tool-sidebar.tsx     | 259 +++++++++++++-----
 1 file changed, 194 insertions(+), 65 deletions(-)

diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
index cb7d6e35..a7ccbf8a 100644
--- a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
@@ -13,8 +13,22 @@ import { useIsMobile } from '@/components/hooks/use-mobile'
 import { useToolSidebarStore } from '@/store/tool-sidebar-store'
 import { toolCategoryMap } from '@/lib/tool-categories'
 import { categoryAccent } from '@/components/dashboard/types'
+import { ToolSidebarRail } from '@/components/tools/tool-sidebar-rail'
+import {
+  DEFAULT_SIDEBAR_WIDTH,
+  emptyRailRegistry,
+  flattenRail,
+  railEntriesKey,
+  railHandlerKey,
+  registerRailGroup,
+  unregisterRailGroup,
+  type RailRegistry,
+  type ToolSidebarRailEntry,
+} from '@/lib/tool-sidebar-rail'
 import { cn } from '@/lib/utils'
 
+export type { ToolSidebarRailEntry } from '@/lib/tool-sidebar-rail'
+
 /**
  * The one in-tool left panel. Every app-like tool (notes, bookmarks, api-client,
  * data-explorer, s3-drive, snippet-manager, password-manager, api-keys,
@@ -33,6 +47,12 @@ interface ToolSidebarContextValue {
    * left hidden behind the panel.
    */
   isOverlay: boolean
+  /**
+   * False while the panel is collapsed or the mobile sheet is shut. The body
+   * stays mounted in that state — gate anything expensive that assumes the user
+   * can see the panel on this rather than on mount.
+   */
+  isVisible: boolean
   /**
    * Dismiss the panel. No-op on desktop when the panel is pinned open — call it
    * from list rows so picking an item on mobile closes the sheet instead of
@@ -60,6 +80,50 @@ export function ToolSidebarActions({ children }: { children: React.ReactNode })
   return slot ? createPortal(children, slot) : null
 }
 
+interface RailRegistrationValue {
+  register: (groupId: string, entries: ToolSidebarRailEntry[]) => void
+  unregister: (groupId: string) => void
+  /**
+   * Live handlers keyed `${groupId}/${entryId}`. Handlers live in a ref rather
+   * than in registry state so a body that rebuilds its closures every render
+   * does not re-register in a loop, and the rail still calls the current one.
+   */
+  handlers: React.RefObject<Map<string, () => void>>
+}
+
+const RailRegistrationContext = React.createContext<RailRegistrationValue | null>(null)
+
+/**
+ * Publishes rail entries from inside the panel body, so the collapsed 48px rail
+ * can offer the tool's facets/roots instead of only an expand button. Safe to
+ * call unconditionally: outside a ToolSidebarLayout it is a no-op.
+ *
+ * `entries` may be rebuilt every render — registration is keyed on the entries'
+ * displayed data, not on array identity.
+ */
+export function useToolSidebarRail(groupId: string, entries: ToolSidebarRailEntry[]) {
+  const reg = React.useContext(RailRegistrationContext)
+  const key = railEntriesKey(entries)
+  const latest = React.useRef(entries)
+  latest.current = entries
+
+  // Refresh handlers on every commit so the rail always calls the current
+  // closure, without that identity churn triggering re-registration.
+  React.useEffect(() => {
+    if (!reg) return
+    const map = reg.handlers.current
+    for (const e of latest.current) {
+      if (e.onSelect) map.set(railHandlerKey(groupId, e.id), e.onSelect)
+    }
+  })
+
+  React.useEffect(() => {
+    if (!reg) return
+    reg.register(groupId, latest.current)
+    return () => reg.unregister(groupId)
+  }, [reg, groupId, key])
+}
+
 export interface ToolSidebarFilterItem {
   id: string
   label: string
@@ -138,6 +202,13 @@ interface ToolSidebarLayoutProps {
   title: string
   /** Header buttons (add, sort, filter…) rendered left of the collapse toggle. */
   actions?: React.ReactNode
+  /**
+   * Rail entries the page owns directly. Bodies that own their own state should
+   * call `useToolSidebarRail` instead; these render after the registered ones.
+   */
+  rail?: ToolSidebarRailEntry[]
+  /** The tool's one "create" affordance. Shown in the header and in the rail. */
+  primaryAction?: { icon: React.ElementType; label: string; onClick: () => void }
   /**
    * Panel body: the tool's list, tree, or filter set. Laid out as a flex column
    * that does NOT scroll — the panel owns its own `overflow-y-auto` region so a
@@ -153,6 +224,8 @@ export function ToolSidebarLayout({
   icon: Icon,
   title,
   actions,
+  rail,
+  primaryAction,
   sidebar,
   children,
   className,
@@ -161,27 +234,72 @@ export function ToolSidebarLayout({
   const isMobile = useIsMobile()
   const collapsed = useToolSidebarStore((s) => !!s.collapsed[toolId])
   const setCollapsed = useToolSidebarStore((s) => s.setCollapsed)
+  const width = useToolSidebarStore((s) => s.width[toolId] ?? DEFAULT_SIDEBAR_WIDTH)
   const [sheetOpen, setSheetOpen] = React.useState(false)
   const [actionsSlot, setActionsSlot] = React.useState<HTMLDivElement | null>(null)
+  const [registry, setRegistry] = React.useState<RailRegistry>(emptyRailRegistry)
+  const handlers = React.useRef<Map<string, () => void>>(new Map())
+  const panelId = React.useId()
+  const railExpandRef = React.useRef<HTMLButtonElement | null>(null)
+  const panelRef = React.useRef<HTMLDivElement | null>(null)
   // Same category tint the dashboard card for this tool uses, so the identity
   // colour is continuous from the grid to the tool. Falls back to primary.
   const accent = categoryAccent(toolCategoryMap[toolId] ?? '')
 
   // The panel floats only as the mobile sheet; on desktop it is a pinned column.
   const isOverlay = isMobile && sheetOpen
+  const hidden = isMobile || collapsed
+
+  const railRegistration = React.useMemo<RailRegistrationValue>(
+    () => ({
+      register: (groupId, entries) => setRegistry((r) => registerRailGroup(r, groupId, entries)),
+      unregister: (groupId) => setRegistry((r) => unregisterRailGroup(r, groupId)),
+      handlers,
+    }),
+    [],
+  )
+
+  const railEntries = React.useMemo(() => {
+    const flat = flattenRail(registry)
+    if (!rail?.length) return flat
+    // Prop entries are their own group, so they get a separator too.
+    return [...flat, ...rail.map((e, i) => ({ ...e, groupStart: i === 0 && flat.length > 0 }))]
+  }, [registry, rail])
+
+  const expand = React.useCallback(() => {
+    if (isMobile) setSheetOpen(true)
+    else setCollapsed(toolId, false)
+  }, [isMobile, setCollapsed, toolId])
 
   const close = React.useCallback(() => {
     if (sheetOpen) setSheetOpen(false)
     else if (!isMobile) setCollapsed(toolId, true)
   }, [isMobile, setCollapsed, toolId, sheetOpen])
 
+  const activateRailEntry = React.useCallback(
+    (entry: ToolSidebarRailEntry) => {
+      expand()
+      // `flattenRail` namespaced the id to `groupId/entryId`, which is exactly
+      // the handler-map key. Entries that arrived via the `rail` prop are not in
+      // the map, so they fall back to their own closure.
+      ;(handlers.current.get(entry.id) ?? entry.onSelect)?.()
+    },
+    [expand],
+  )
+
   const ctx = React.useMemo<ToolSidebarContextValue>(
-    () => ({ isMobile, isOverlay, close }),
-    [isMobile, isOverlay, close],
+    () => ({ isMobile, isOverlay, isVisible: !hidden, close }),
+    [isMobile, isOverlay, hidden, close],
   )
 
   const panel = (
-    <div className="flex h-full min-h-0 flex-col border-r bg-muted/10">
+    <div
+      id={panelId}
+      ref={panelRef}
+      tabIndex={-1}
+      aria-label={title}
+      className="flex h-full min-h-0 flex-col border-r bg-muted/10 outline-none"
+    >
       <div className="flex shrink-0 items-center justify-between gap-2 border-b px-3 py-2">
         <div className="flex min-w-0 items-center gap-2 text-sm font-semibold">
           <span
@@ -196,6 +314,18 @@ export function ToolSidebarLayout({
           <span className="truncate">{title}</span>
         </div>
         <div className="flex shrink-0 items-center gap-0.5">
+          {primaryAction && (
+            <Button
+              variant="ghost"
+              size="icon"
+              className="h-8 w-8 cursor-pointer"
+              onClick={primaryAction.onClick}
+              aria-label={primaryAction.label}
+              title={primaryAction.label}
+            >
+              <primaryAction.icon className="h-4 w-4" />
+            </Button>
+          )}
           {actions}
           <div ref={setActionsSlot} className="flex items-center gap-0.5" />
           {!isMobile && (
@@ -203,9 +333,15 @@ export function ToolSidebarLayout({
               variant="ghost"
               size="icon"
               className="h-8 w-8 cursor-pointer"
-              onClick={() => setCollapsed(toolId, true)}
-              aria-label={t('hide')}
-              title={t('hide')}
+              onClick={() => {
+                setCollapsed(toolId, true)
+                // Focus would otherwise land on <body> when this button hides.
+                requestAnimationFrame(() => railExpandRef.current?.focus())
+              }}
+              aria-label={t('collapse')}
+              title={t('collapse')}
+              aria-expanded={true}
+              aria-controls={panelId}
             >
               <PanelLeft className="h-4 w-4" />
             </Button>
@@ -218,72 +354,65 @@ export function ToolSidebarLayout({
     </div>
   )
 
-  const hidden = isMobile || collapsed
-
   return (
     <ToolSidebarContext.Provider value={ctx}>
-      <div className={cn('flex h-full min-h-0 w-full overflow-hidden', className)}>
-        {!isMobile && !collapsed && <div className="w-64 shrink-0">{panel}</div>}
-
-        {isMobile && (
-          <Sheet open={sheetOpen} onOpenChange={setSheetOpen}>
-            <SheetContent side="left" className="w-72 p-0">
-              <SheetHeader className="sr-only">
-                <SheetTitle>{title}</SheetTitle>
-              </SheetHeader>
+      <RailRegistrationContext.Provider value={railRegistration}>
+        <div className={cn('flex h-full min-h-0 w-full overflow-hidden', className)}>
+          {/* Mounted even while collapsed. Two reasons: rail entries are published
+              by hooks inside the body and an unmounted body cannot publish, and
+              unmounting threw away the body's search text, expanded tree groups
+              and scroll position on every collapse. */}
+          {!isMobile && (
+            <div className="shrink-0" style={{ width, display: collapsed ? 'none' : undefined }}>
               {panel}
-            </SheetContent>
-          </Sheet>
-        )}
+            </div>
+          )}
 
-        {/* Re-open lives in a 40px rail, not a floating overlay: every tool's
-            main pane already puts a toolbar or header at the top-left, and an
-            absolutely-positioned button would sit on top of it.
+          {isMobile && (
+            <Sheet open={sheetOpen} onOpenChange={setSheetOpen}>
+              <SheetContent side="left" className="w-72 p-0">
+                <SheetHeader className="sr-only">
+                  <SheetTitle>{title}</SheetTitle>
+                </SheetHeader>
+                {panel}
+              </SheetContent>
+            </Sheet>
+          )}
 
-            One control, one job. The rail carries the tool's accent icon so the
-            collapsed strip still says which tool you are in, and swaps it for
-            the expand arrow on hover/focus — showing both at once read as two
-            competing buttons for the same action. */}
-        {hidden && (
-          <div className="flex w-10 shrink-0 flex-col items-center border-r bg-muted/10 pt-2">
-            <Button
-              variant="ghost"
-              size="icon"
-              className="group h-8 w-8 cursor-pointer"
-              onClick={() => (isMobile ? setSheetOpen(true) : setCollapsed(toolId, false))}
-              aria-label={t('show')}
-              title={`${title} — ${t('show')}`}
-            >
-              <span
-                className={cn(
-                  'flex h-6 w-6 shrink-0 items-center justify-center rounded-md',
-                  'group-hover:hidden group-focus-visible:hidden',
-                  accent.bg,
-                  accent.text,
-                )}
-              >
-                <Icon className="h-3.5 w-3.5" />
-              </span>
-              <PanelLeft className="hidden h-4 w-4 group-hover:block group-focus-visible:block" />
-            </Button>
-          </div>
-        )}
+          {/* Collapsed state is a 48px rail, not a floating overlay: every tool's
+              main pane already puts a toolbar or header at the top-left, and an
+              absolutely-positioned button would sit on top of it. The rail keeps
+              the tool's identity, its primary action and its facets reachable. */}
+          {hidden && (
+            <ToolSidebarRail
+              icon={Icon}
+              title={title}
+              accent={accent}
+              entries={railEntries}
+              primaryAction={primaryAction}
+              onExpand={expand}
+              onActivate={activateRailEntry}
+              panelId={panelId}
+              expandRef={railExpandRef}
+            />
+          )}
 
-        {/* Same surface the 71 single-pane tools paint (dashboard-grid-bg +
-            dash-ambient), so moving between a converter and a workspace tool
-            doesn't change the background under you. */}
-        <div
-          className="dashboard-grid-bg relative flex min-w-0 flex-1 flex-col overflow-hidden"
-          // .dashboard-grid-bg rounds its corners for the padded single-pane
-          // column; this pane is flush against the panel border, and the radius
-          // would clip content corners under overflow-hidden. Inline beats the
-          // utilities-layer rule.
-          style={{ borderRadius: 0 }}
-        >
-          <div className="dash-ambient -z-10" aria-hidden />
-          {children}
+          {/* Same surface the 71 single-pane tools paint (dashboard-grid-bg +
+              dash-ambient), so moving between a converter and a workspace tool
+              doesn't change the background under you. */}
+          <div
+            className="dashboard-grid-bg relative flex min-w-0 flex-1 flex-col overflow-hidden"
+            // .dashboard-grid-bg rounds its corners for the padded single-pane
+            // column; this pane is flush against the panel border, and the radius
+            // would clip content corners under overflow-hidden. Inline beats the
+            // utilities-layer rule.
+            style={{ borderRadius: 0 }}
+          >
+            <div className="dash-ambient -z-10" aria-hidden />
+            {children}
+          </div>
         </div>
-      </div>
+      </RailRegistrationContext.Provider>
     </ToolSidebarContext.Provider>
   )
 }

From f26768f1f5fdab5de9ecd448454e35a734e5e432 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 18:03:40 +0530
Subject: [PATCH 29/39] feat(tool-sidebar): filter lists publish their facets
 to the collapsed rail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

password-manager, api-keys, to-do and environment-manager gain a populated rail
with no edits of their own — the facets are already declared as filter items.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../password-manager/password-list.tsx        |  2 ++
 .../src/components/tools/tool-sidebar.tsx     | 26 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/apps/desktop-ui/src/components/password-manager/password-list.tsx b/apps/desktop-ui/src/components/password-manager/password-list.tsx
index 2fe076b5..78933c87 100644
--- a/apps/desktop-ui/src/components/password-manager/password-list.tsx
+++ b/apps/desktop-ui/src/components/password-manager/password-list.tsx
@@ -367,6 +367,7 @@ export function PasswordList() {
                         value={quickFilter}
                         onChange={(id) => setQuickFilter(id as typeof quickFilter)}
                         heading={t("filters.heading")}
+                        railGroupId="security"
                     />
                     {tagFilters.length > 0 && (
                         <ToolSidebarFilterList
@@ -374,6 +375,7 @@ export function PasswordList() {
                             value={tagFilter}
                             onChange={setTagFilter}
                             heading={t("filters.tagsHeading")}
+                            railGroupId="tags"
                         />
                     )}
                 </div>
diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
index a7ccbf8a..a3db7b87 100644
--- a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
@@ -143,6 +143,7 @@ export function ToolSidebarFilterList({
   onChange,
   heading,
   className,
+  railGroupId,
 }: {
   items: ToolSidebarFilterItem[]
   value: string
@@ -150,8 +151,33 @@ export function ToolSidebarFilterList({
   /** Optional uppercase section label above the rows. */
   heading?: string
   className?: string
+  /**
+   * Group id for the collapsed rail. Defaults to the heading, so a panel with
+   * two filter lists (password-manager: security + tags) produces two rail
+   * groups. Pass explicitly when there is no heading.
+   */
+  railGroupId?: string
 }) {
   const panel = useToolSidebarPanel()
+  const groupId = railGroupId ?? heading ?? 'filters'
+
+  // The facets this list already renders are exactly what the collapsed rail
+  // should offer, so publish them rather than making each tool restate them.
+  const railEntries = React.useMemo(
+    () =>
+      items.map((item) => ({
+        id: item.id,
+        label: item.label,
+        icon: item.icon,
+        count: item.count,
+        active: item.id === value,
+        onSelect: () => onChange(item.id),
+      })),
+    [items, value, onChange],
+  )
+
+  useToolSidebarRail(groupId, railEntries)
+
   return (
     <div className={cn('space-y-0.5 p-2', className)}>
       {heading && (

From d795f045159ab3de871b5cfc6ba5bc74d1a0cf32 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 18:09:31 +0530
Subject: [PATCH 30/39] feat(tool-sidebar): tree sidebars publish their
 top-level entries to the rail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

notes and snippet-manager publish pinned items, api-client its collections,
data-explorer and s3-drive their connections, bookmarks and secure-files their
root folders.

Also fixes secure-files' folder tree calling panel.close() unconditionally on
select, which collapsed the whole sidebar on every folder pick on desktop —
every other sidebar guards that with isOverlay.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../collections/collections-sidebar.tsx       | 29 +++++++++++++++--
 .../src/components/bookmarks/folder-tree.tsx  | 31 ++++++++++++++++++-
 .../data-explorer/unified-sidebar.tsx         | 28 ++++++++++++++++-
 .../src/components/notes/NotesSidebar.tsx     | 21 +++++++++++--
 .../components/s3-drive/bucket-sidebar.tsx    | 21 +++++++++++--
 .../components/secure-files/folder-tree.tsx   | 23 ++++++++++++--
 .../src/components/sidebar/client-layout.tsx  | 14 ++-------
 .../snippet-manager/snippet-manager-tool.tsx  | 23 +++++++++++++-
 8 files changed, 168 insertions(+), 22 deletions(-)

diff --git a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
index 52cddd36..00d6ae6d 100644
--- a/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
+++ b/apps/desktop-ui/src/components/api-client/collections/collections-sidebar.tsx
@@ -49,7 +49,7 @@ import { useHistoryState, useHistoryActions } from "../context/history-context"
 import { CollectionsSidebarSkeleton, HistoryListSkeleton } from "../skeletons"
 import { useDebouncedValue } from "@/lib/use-debounced-value"
 import { isDesktop } from "@/lib/desktop/is-desktop"
-import { ToolSidebarActions, useToolSidebarPanel } from "@/components/tools/tool-sidebar"
+import { ToolSidebarActions, useToolSidebarPanel, useToolSidebarRail } from "@/components/tools/tool-sidebar"
 
 interface CollectionsSidebarProps {
     onLoadRequest: (request: CollectionRequest) => void
@@ -144,6 +144,31 @@ export function CollectionsSidebar({ onLoadRequest: loadRequest }: CollectionsSi
         return filteredCollections.filter((c) => c.workspace === activeWorkspaceId)
     }, [filteredCollections, activeWorkspaceId])
 
+    // Collections stay reachable from the collapsed rail. A collection has no
+    // open/closed state of its own — only the folders inside it toggle — so
+    // picking one expands the panel and scrolls that collection into view.
+    useToolSidebarRail(
+        "collections",
+        React.useMemo(
+            () =>
+                collectionsForActiveWs.slice(0, 8).map((c) => ({
+                    id: c.id,
+                    label: c.name,
+                    icon: FolderGit2,
+                    count: c.items.length,
+                    onSelect: () => {
+                        // The panel is expanding in the same tick; wait for layout.
+                        requestAnimationFrame(() =>
+                            document
+                                .querySelector(`[data-collection-id="${CSS.escape(c.id)}"]`)
+                                ?.scrollIntoView({ block: "nearest" }),
+                        )
+                    },
+                })),
+            [collectionsForActiveWs],
+        ),
+    )
+
     const activeWorkspaceName = workspaces.find((w) => w.id === activeWorkspaceId)?.name ?? "All"
     const [selectedCollections, setSelectedCollections] = React.useState<Set<string>>(new Set())
     const [deleteBulkDialogOpen, setDeleteBulkDialogOpen] = React.useState(false)
@@ -364,7 +389,7 @@ export function CollectionsSidebar({ onLoadRequest: loadRequest }: CollectionsSi
                                 </div>
                             ) : (
                                 collectionsForActiveWs.map((collection) => (
-                                    <div key={collection.id} className="mb-4">
+                                    <div key={collection.id} data-collection-id={collection.id} className="mb-4">
                                         <div className="flex items-center justify-between px-2 py-1.5 mb-1 group rounded-md hover:bg-muted/50 transition-colors">
                                             <div className="flex items-center gap-2 flex-1 min-w-0">
                                                 <div className="flex items-center">
diff --git a/apps/desktop-ui/src/components/bookmarks/folder-tree.tsx b/apps/desktop-ui/src/components/bookmarks/folder-tree.tsx
index 4858c11e..5b0fe0c2 100644
--- a/apps/desktop-ui/src/components/bookmarks/folder-tree.tsx
+++ b/apps/desktop-ui/src/components/bookmarks/folder-tree.tsx
@@ -1,6 +1,6 @@
 "use client"
 
-import { useState } from "react"
+import { useMemo, useState } from "react"
 import { motion, AnimatePresence } from "framer-motion"
 import {
     IconFolder,
@@ -43,6 +43,7 @@ import {
 import EditFolderDialog from "./edit-folder-dialog"
 import AddFolderDialog from "./add-folder-dialog"
 import { useTranslations } from "next-intl"
+import { useToolSidebarRail } from "@/components/tools/tool-sidebar"
 
 interface FolderTreeProps {
     onSelectFolder: (id: string | null) => void
@@ -51,9 +52,37 @@ interface FolderTreeProps {
 export default function FolderTree({ onSelectFolder }: FolderTreeProps) {
     const t = useTranslations("Bookmarks.folderTree")
     const { selectedFolderId, bookmarks } = useBookmarkStore()
+    // Memoized selector (bookmark-store.ts:506), so calling it here as well as
+    // in RootFolders costs nothing.
+    const rootFolders = useChildFolders(null)
 
     const totalBookmarks = bookmarks.length
 
+    // "All bookmarks" plus the root folders, for the collapsed rail.
+    useToolSidebarRail(
+        "folders",
+        useMemo(
+            () => [
+                {
+                    id: "all",
+                    label: t("allBookmarks"),
+                    icon: IconBookmarks,
+                    count: totalBookmarks,
+                    active: selectedFolderId === null,
+                    onSelect: () => onSelectFolder(null),
+                },
+                ...rootFolders.slice(0, 7).map(f => ({
+                    id: f.id,
+                    label: f.name,
+                    icon: IconFolder,
+                    active: selectedFolderId === f.id,
+                    onSelect: () => onSelectFolder(f.id),
+                })),
+            ],
+            [rootFolders, totalBookmarks, selectedFolderId, onSelectFolder, t],
+        ),
+    )
+
     return (
         <div className="space-y-1">
             {/* All Bookmarks */}
diff --git a/apps/desktop-ui/src/components/data-explorer/unified-sidebar.tsx b/apps/desktop-ui/src/components/data-explorer/unified-sidebar.tsx
index 24b9b083..bff91586 100644
--- a/apps/desktop-ui/src/components/data-explorer/unified-sidebar.tsx
+++ b/apps/desktop-ui/src/components/data-explorer/unified-sidebar.tsx
@@ -7,6 +7,7 @@ import { motion, AnimatePresence } from "framer-motion";
 import {
     IconAlertTriangle,
     IconChevronRight,
+    IconDatabase,
     IconDots,
     IconDownload,
     IconEdit,
@@ -35,7 +36,7 @@ import {
     AlertDialogTitle,
 } from "@/components/ui/alert-dialog";
 import { cn } from "@/lib/utils";
-import { useToolSidebarPanel } from "@/components/tools/tool-sidebar";
+import { useToolSidebarPanel, useToolSidebarRail } from "@/components/tools/tool-sidebar";
 import { SOURCES, SOURCE_ORDER, getAdapter } from "./sources";
 import { deleteConnection } from "./connection-service";
 import type { OpenTabRequest, SourceId, UnifiedConnection } from "./types";
@@ -208,6 +209,31 @@ export function UnifiedSidebar({
         [onOpenTab, panel]
     );
 
+    // Connections stay reachable from the collapsed rail; picking one expands
+    // its tree, which is what the row click does too.
+    useToolSidebarRail(
+        "connections",
+        useMemo(
+            () =>
+                connections
+                    .filter((c): c is UnifiedConnection => !!c && typeof c.id === "string")
+                    .slice(0, 8)
+                    .map((c) => ({
+                        id: c.id,
+                        label: c.name,
+                        icon: IconDatabase,
+                        active: expandedIds.has(c.id),
+                        onSelect: () =>
+                            setExpandedIds((prev) => {
+                                const next = new Set(prev);
+                                next.add(c.id);
+                                return next;
+                            }),
+                    })),
+            [connections, expandedIds]
+        )
+    );
+
     const filtered = useMemo(() => {
         const q = query.trim().toLowerCase();
         const safe = connections.filter(
diff --git a/apps/desktop-ui/src/components/notes/NotesSidebar.tsx b/apps/desktop-ui/src/components/notes/NotesSidebar.tsx
index 25fc902f..87983a3b 100644
--- a/apps/desktop-ui/src/components/notes/NotesSidebar.tsx
+++ b/apps/desktop-ui/src/components/notes/NotesSidebar.tsx
@@ -55,7 +55,7 @@ import {
     AlertDialogTitle,
 } from "@/components/ui/alert-dialog";
 import { Note } from "@/app/app/notes/types/Note";
-import { ToolSidebarActions, useToolSidebarPanel } from "@/components/tools/tool-sidebar";
+import { ToolSidebarActions, useToolSidebarPanel, useToolSidebarRail } from "@/components/tools/tool-sidebar";
 import { useTranslations } from "next-intl";
 import { extractSnippet } from "@/app/app/notes/utils/noteContentUtils";
 import { type ChildrenMap, type SortDir, type SortKey, buildChildrenMap, getCachedPlainText } from "./notes-helpers";
@@ -273,7 +273,7 @@ NoteItem.displayName = "NoteItem";
 export default function NotesSidebar() {
     const t = useTranslations("Notes.sidebar");
     const { notes, noteById, isLoading, searchIndexReady } = useNotesData();
-    const { activeNoteId } = useNotesUI();
+    const { activeNoteId, setActiveNoteId } = useNotesUI();
     const { createNote, deleteNote, moveNote, warmSearchIndex } = useNotesActions();
     const [noteToDelete, setNoteToDelete] = useState<Note | null>(null);
     const [noteToMove, setNoteToMove] = useState<Note | null>(null);
@@ -309,6 +309,23 @@ export default function NotesSidebar() {
     const pinnedNotes = useMemo(() => rootNotes.filter(n => n.pinned), [rootNotes]);
     const unpinnedNotes = useMemo(() => rootNotes.filter(n => !n.pinned), [rootNotes]);
 
+    // Pinned notes are the sidebar's own shortlist, so they are what the
+    // collapsed rail offers.
+    useToolSidebarRail(
+        "pinned",
+        useMemo(
+            () =>
+                pinnedNotes.slice(0, 8).map(n => ({
+                    id: n.id,
+                    label: n.title || t("untitled"),
+                    icon: Pin,
+                    active: n.id === activeNoteId,
+                    onSelect: () => setActiveNoteId(n.id),
+                })),
+            [pinnedNotes, activeNoteId, setActiveNoteId, t],
+        ),
+    );
+
     const searchResults = useMemo(() => {
         const trimmed = debouncedQuery.trim();
         if (!trimmed) return null;
diff --git a/apps/desktop-ui/src/components/s3-drive/bucket-sidebar.tsx b/apps/desktop-ui/src/components/s3-drive/bucket-sidebar.tsx
index 11c78fa7..34d2fdd2 100644
--- a/apps/desktop-ui/src/components/s3-drive/bucket-sidebar.tsx
+++ b/apps/desktop-ui/src/components/s3-drive/bucket-sidebar.tsx
@@ -1,6 +1,6 @@
 "use client"
 
-import { useState } from "react"
+import { useMemo, useState } from "react"
 import { toast } from "sonner"
 import { cn } from "@/lib/utils"
 import { Button } from "@/components/ui/button"
@@ -23,7 +23,7 @@ import {
 import { IconBucket, IconPlus, IconDots, IconPencil, IconTrash, IconBrandAws, IconCloud, IconServer } from "@tabler/icons-react"
 import { deleteConnection } from "@/lib/s3-drive-api"
 import { useS3DriveStore, type DecryptedConnection } from "@/store/s3-drive-store"
-import { useToolSidebarPanel } from "@/components/tools/tool-sidebar"
+import { useToolSidebarPanel, useToolSidebarRail } from "@/components/tools/tool-sidebar"
 import { AddBucketDialog } from "./add-bucket-dialog"
 
 type Props = {
@@ -61,6 +61,23 @@ function connSubtitle(conn: DecryptedConnection): string {
 export function BucketSidebar({ encryptionKey }: Props) {
     const { connections, activeConnectionId, setActiveConnection, removeConnection } = useS3DriveStore()
     const panel = useToolSidebarPanel()
+
+    // Connections stay switchable from the collapsed rail.
+    useToolSidebarRail(
+        "connections",
+        useMemo(
+            () =>
+                connections.slice(0, 8).map((c) => ({
+                    id: c.id,
+                    label: c.name,
+                    icon: IconBucket,
+                    active: c.id === activeConnectionId,
+                    onSelect: () => setActiveConnection(c.id),
+                })),
+            [connections, activeConnectionId, setActiveConnection],
+        ),
+    )
+
     const [addOpen, setAddOpen] = useState(false)
     const [editTarget, setEditTarget] = useState<DecryptedConnection | null>(null)
     const [deleteTarget, setDeleteTarget] = useState<DecryptedConnection | null>(null)
diff --git a/apps/desktop-ui/src/components/secure-files/folder-tree.tsx b/apps/desktop-ui/src/components/secure-files/folder-tree.tsx
index 6cb9b185..63a42b2f 100644
--- a/apps/desktop-ui/src/components/secure-files/folder-tree.tsx
+++ b/apps/desktop-ui/src/components/secure-files/folder-tree.tsx
@@ -11,7 +11,7 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu"
-import { useToolSidebarPanel } from "@/components/tools/tool-sidebar"
+import { useToolSidebarPanel, useToolSidebarRail } from "@/components/tools/tool-sidebar"
 import { cn } from "@/lib/utils"
 import type { FolderNode } from "@/lib/secure-files"
 
@@ -55,11 +55,30 @@ export function FolderTree({ root, currentDir, ...actions }: { root: FolderNode;
   const select = React.useCallback(
     (path: string) => {
       actions.onSelect(path)
-      panel?.close()
+      // Only when the panel floats over the result. On desktop it is a pinned
+      // column, and closing it collapsed the sidebar on every folder pick.
+      if (panel?.isOverlay) panel.close()
     },
     [actions, panel],
   )
 
+  // Top-level folders stay reachable from the collapsed rail.
+  useToolSidebarRail(
+    "folders",
+    React.useMemo(
+      () =>
+        root.children.slice(0, 8).map((child) => ({
+          id: child.path,
+          label: child.name,
+          icon: IconFolder,
+          count: child.files.length,
+          active: currentDir === child.path,
+          onSelect: () => select(child.path),
+        })),
+      [root.children, currentDir, select],
+    ),
+  )
+
   return (
     <div className="flex-1 overflow-y-auto p-2">
       <button
diff --git a/apps/desktop-ui/src/components/sidebar/client-layout.tsx b/apps/desktop-ui/src/components/sidebar/client-layout.tsx
index 7b345565..697bc66e 100644
--- a/apps/desktop-ui/src/components/sidebar/client-layout.tsx
+++ b/apps/desktop-ui/src/components/sidebar/client-layout.tsx
@@ -100,16 +100,8 @@ function Layout({ children }: { children: React.ReactNode }) {
 }
 
 export function ClientLayout({ children }: { children: React.ReactNode }) {
-  // Hydrate the workspace store on app launch. Nothing else does this on
-  // desktop (EnsureBackendSession is unmounted here), and without it the
-  // local personal workspace never resolves — encrypted tools (api-key-vault,
-  // password-manager, environment-manager) fail with "No active workspace".
-  useEffect(() => {
-    const { hydrated, loadFromBackend } = useWorkspaceStore.getState();
-    if (!hydrated) {
-      loadFromBackend().catch((e) => console.warn('Workspace hydration failed:', e));
-    }
-  }, []);
-
+  // Workspace hydration lives in <DesktopInit /> (mounted in app/layout.tsx).
+  // Doing it here too fired a second GET + POST /workspaces/active on every
+  // desktop launch, and 404'd in a plain browser dev server (no Next API routes).
   return <Layout>{children}</Layout>;
 }
diff --git a/apps/desktop-ui/src/components/snippet-manager/snippet-manager-tool.tsx b/apps/desktop-ui/src/components/snippet-manager/snippet-manager-tool.tsx
index aa5f964f..248707f1 100644
--- a/apps/desktop-ui/src/components/snippet-manager/snippet-manager-tool.tsx
+++ b/apps/desktop-ui/src/components/snippet-manager/snippet-manager-tool.tsx
@@ -68,7 +68,7 @@ import {
   SheetTitle,
   SheetTrigger,
 } from "@/components/ui/sheet";
-import { ToolSidebarActions, ToolSidebarLayout } from "@/components/tools/tool-sidebar";
+import { ToolSidebarActions, ToolSidebarLayout, useToolSidebarRail } from "@/components/tools/tool-sidebar";
 import { cn } from "@/lib/utils";
 import {
   SnippetMonaco,
@@ -319,6 +319,27 @@ export function SnippetManagerTool() {
   const pinnedVisible = visibleSnippets.filter((s) => s.pinned);
   const unpinnedVisible = visibleSnippets.filter((s) => !s.pinned);
 
+  // Pinned snippets are the sidebar's own shortlist, so they are what the
+  // collapsed rail offers. Flushing the pending save mirrors the row click —
+  // selecting from the rail must not drop an unsaved edit.
+  useToolSidebarRail(
+    "pinned",
+    useMemo(
+      () =>
+        pinnedVisible.slice(0, 8).map((s) => ({
+          id: s.id,
+          label: s.title,
+          icon: IconCode,
+          active: s.id === selectedId,
+          onSelect: () => {
+            debouncedSaveCode.flush();
+            setSelectedId(s.id);
+          },
+        })),
+      [pinnedVisible, selectedId, debouncedSaveCode]
+    )
+  );
+
   const effectiveLanguage = useMemo(
     () => resolveEditorLanguage(draftLanguage, debouncedCode),
     [draftLanguage, debouncedCode]

From 4b095356bae2a9584aa2fdb08427e540fdb37201 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 18:10:49 +0530
Subject: [PATCH 31/39] feat(tool-sidebar): drag-resize the panel, width
 persisted per tool

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/components/tools/tool-sidebar.tsx     | 68 ++++++++++++++++++-
 1 file changed, 67 insertions(+), 1 deletion(-)

diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
index a3db7b87..b5d20497 100644
--- a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
@@ -16,6 +16,8 @@ import { categoryAccent } from '@/components/dashboard/types'
 import { ToolSidebarRail } from '@/components/tools/tool-sidebar-rail'
 import {
   DEFAULT_SIDEBAR_WIDTH,
+  MAX_SIDEBAR_WIDTH,
+  MIN_SIDEBAR_WIDTH,
   emptyRailRegistry,
   flattenRail,
   railEntriesKey,
@@ -261,6 +263,9 @@ export function ToolSidebarLayout({
   const collapsed = useToolSidebarStore((s) => !!s.collapsed[toolId])
   const setCollapsed = useToolSidebarStore((s) => s.setCollapsed)
   const width = useToolSidebarStore((s) => s.width[toolId] ?? DEFAULT_SIDEBAR_WIDTH)
+  const setWidth = useToolSidebarStore((s) => s.setWidth)
+  const resetWidth = useToolSidebarStore((s) => s.resetWidth)
+  const dragOriginRef = React.useRef<{ x: number; width: number } | null>(null)
   const [sheetOpen, setSheetOpen] = React.useState(false)
   const [actionsSlot, setActionsSlot] = React.useState<HTMLDivElement | null>(null)
   const [registry, setRegistry] = React.useState<RailRegistry>(emptyRailRegistry)
@@ -318,6 +323,48 @@ export function ToolSidebarLayout({
     [isMobile, isOverlay, hidden, close],
   )
 
+  const onHandlePointerDown = React.useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      e.preventDefault()
+      e.currentTarget.setPointerCapture(e.pointerId)
+      dragOriginRef.current = { x: e.clientX, width }
+      // Dragging across the content pane would otherwise select its text.
+      document.body.style.userSelect = 'none'
+    },
+    [width],
+  )
+
+  const onHandlePointerMove = React.useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      const origin = dragOriginRef.current
+      if (!origin) return
+      setWidth(toolId, origin.width + (e.clientX - origin.x))
+    },
+    [setWidth, toolId],
+  )
+
+  const onHandlePointerUp = React.useCallback((e: React.PointerEvent<HTMLDivElement>) => {
+    dragOriginRef.current = null
+    e.currentTarget.releasePointerCapture(e.pointerId)
+    document.body.style.userSelect = ''
+  }, [])
+
+  const onHandleKeyDown = React.useCallback(
+    (e: React.KeyboardEvent) => {
+      if (e.key === 'ArrowLeft') {
+        e.preventDefault()
+        setWidth(toolId, width - 16)
+      } else if (e.key === 'ArrowRight') {
+        e.preventDefault()
+        setWidth(toolId, width + 16)
+      } else if (e.key === 'Home') {
+        e.preventDefault()
+        resetWidth(toolId)
+      }
+    },
+    [setWidth, resetWidth, toolId, width],
+  )
+
   const panel = (
     <div
       id={panelId}
@@ -389,8 +436,27 @@ export function ToolSidebarLayout({
               unmounting threw away the body's search text, expanded tree groups
               and scroll position on every collapse. */}
           {!isMobile && (
-            <div className="shrink-0" style={{ width, display: collapsed ? 'none' : undefined }}>
+            <div
+              className="relative shrink-0"
+              style={{ width, display: collapsed ? 'none' : undefined }}
+            >
               {panel}
+              <div
+                role="separator"
+                aria-orientation="vertical"
+                aria-label={t('resize')}
+                aria-valuenow={width}
+                aria-valuemin={MIN_SIDEBAR_WIDTH}
+                aria-valuemax={MAX_SIDEBAR_WIDTH}
+                tabIndex={0}
+                title={`${t('resize')} — ${t('resetWidth')}`}
+                onPointerDown={onHandlePointerDown}
+                onPointerMove={onHandlePointerMove}
+                onPointerUp={onHandlePointerUp}
+                onDoubleClick={() => resetWidth(toolId)}
+                onKeyDown={onHandleKeyDown}
+                className="absolute inset-y-0 -right-0.5 z-10 w-1 cursor-col-resize touch-none bg-transparent transition-colors hover:bg-primary/40 focus-visible:bg-primary/60 focus-visible:outline-none"
+              />
             </div>
           )}
 

From bd2c7c0121164690e186602639d96f52b83d1607 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 18:11:37 +0530
Subject: [PATCH 32/39] feat(tool-sidebar): cmd+backslash toggle with focus
 hand-off across collapse

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/components/tools/tool-sidebar.tsx     | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
index b5d20497..e3744891 100644
--- a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
@@ -20,6 +20,7 @@ import {
   MIN_SIDEBAR_WIDTH,
   emptyRailRegistry,
   flattenRail,
+  isSidebarShortcut,
   railEntriesKey,
   railHandlerKey,
   registerRailGroup,
@@ -323,6 +324,27 @@ export function ToolSidebarLayout({
     [isMobile, isOverlay, hidden, close],
   )
 
+  // Cmd/Ctrl+\ toggles the panel. Registered per mounted layout; inactive tool
+  // tabs stay mounted behind display:none, so the handler bails unless its own
+  // tab is the one on screen (offsetParent is null inside a hidden ancestor).
+  React.useEffect(() => {
+    if (isMobile) return
+    const onKeyDown = (e: KeyboardEvent) => {
+      if (!isSidebarShortcut(e as unknown as Parameters<typeof isSidebarShortcut>[0])) return
+      if (!panelRef.current?.offsetParent && !railExpandRef.current?.offsetParent) return
+      e.preventDefault()
+      if (collapsed) {
+        setCollapsed(toolId, false)
+        requestAnimationFrame(() => panelRef.current?.focus())
+      } else {
+        setCollapsed(toolId, true)
+        requestAnimationFrame(() => railExpandRef.current?.focus())
+      }
+    }
+    window.addEventListener('keydown', onKeyDown)
+    return () => window.removeEventListener('keydown', onKeyDown)
+  }, [collapsed, isMobile, setCollapsed, toolId])
+
   const onHandlePointerDown = React.useCallback(
     (e: React.PointerEvent<HTMLDivElement>) => {
       e.preventDefault()

From d325332b7a4b15c7d0b4bd3ed726ec623777c4fc Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 18:12:53 +0530
Subject: [PATCH 33/39] fix(secure-files): name the no-folder sentinel instead
 of embedding a NUL byte

The "overview showing, nothing selected" sentinel was a literal NUL inside a
string literal in the source. Same value, but the byte made the whole file
binary to grep, ripgrep and diff, which then skip it without saying so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/components/secure-files/secure-files-tool.tsx  |  3 ++-
 apps/desktop-ui/src/lib/__tests__/secure-files.test.ts | 10 ++++++++++
 apps/desktop-ui/src/lib/secure-files.ts                |  9 +++++++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx b/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
index 8e7401a2..462f8a95 100644
--- a/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
+++ b/apps/desktop-ui/src/components/secure-files/secure-files-tool.tsx
@@ -44,6 +44,7 @@ import { useMasterKeyStore } from "@/store/master-key-store"
 import {
   baseName,
   blobMime,
+  NO_FOLDER,
   buildFolderTree,
   joinDir,
   looksLikeText,
@@ -533,7 +534,7 @@ export function SecureFilesTool() {
           <span className="truncate">{t("overview")}</span>
         </button>
       </div>
-      <FolderTree root={tree} currentDir={showOverview ? "" : currentDir} onSelect={openFolder} onRename={renameFolder} onDelete={deleteFolder} />
+      <FolderTree root={tree} currentDir={showOverview ? NO_FOLDER : currentDir} onSelect={openFolder} onRename={renameFolder} onDelete={deleteFolder} />
     </div>
   ) : (
     <p className="p-4 text-xs text-muted-foreground">{t("chooseFolderBody")}</p>
diff --git a/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts b/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
index 08757bce..a5e023b0 100644
--- a/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
+++ b/apps/desktop-ui/src/lib/__tests__/secure-files.test.ts
@@ -90,3 +90,13 @@ describe("looksLikeText", () => {
     expect(looksLikeText(new Uint8Array())).toBe(true)
   })
 })
+
+describe("NO_FOLDER", () => {
+  it("is a value no real folder path can equal", () => {
+    const { NO_FOLDER } = require("../secure-files")
+    expect(typeof NO_FOLDER).toBe("string")
+    // "" is the root folder and must stay distinct from "no selection".
+    expect(NO_FOLDER).not.toBe("")
+    expect(NO_FOLDER).not.toMatch(/^[\w./-]+$/)
+  })
+})
diff --git a/apps/desktop-ui/src/lib/secure-files.ts b/apps/desktop-ui/src/lib/secure-files.ts
index 24a0f399..b8578b4c 100644
--- a/apps/desktop-ui/src/lib/secure-files.ts
+++ b/apps/desktop-ui/src/lib/secure-files.ts
@@ -34,6 +34,15 @@ export function baseName(dir: string): string {
   return dir.slice(dir.lastIndexOf("/") + 1)
 }
 
+/**
+ * `currentDir` value meaning "the overview is showing, no folder is selected".
+ * `""` is the root folder and would highlight it (folder-tree.tsx:70), so the
+ * sentinel has to be a string no path can equal. Written as an escape, not a
+ * raw byte — a literal NUL in the source makes the whole file binary to grep,
+ * ripgrep and diff, which then skip it silently.
+ */
+export const NO_FOLDER = "\u0000"
+
 /** Build the folder tree from file dirs plus any empty (not yet populated) dirs. */
 export function buildFolderTree(files: SecureFileEntry[], extraDirs: Iterable<string> = []): FolderNode {
   const root: FolderNode = { name: "", path: "", children: [], files: [] }

From 15b405868656cd6349f834035e57b840071bbce8 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 18:14:04 +0530
Subject: [PATCH 34/39] feat(tool-sidebar): shared search, section, row and
 empty-state primitives

Shipped unused. They give the next per-tool sidebar migration somewhere to land
without that migration also having to design the pieces.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../tools/tool-sidebar-primitives.tsx         | 196 ++++++++++++++++++
 .../src/components/tools/tool-sidebar.tsx     |  11 +
 2 files changed, 207 insertions(+)
 create mode 100644 apps/desktop-ui/src/components/tools/tool-sidebar-primitives.tsx

diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar-primitives.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar-primitives.tsx
new file mode 100644
index 00000000..a34eafc0
--- /dev/null
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar-primitives.tsx
@@ -0,0 +1,196 @@
+'use client'
+
+import * as React from 'react'
+import { AnimatePresence, motion } from 'framer-motion'
+import { IconChevronRight } from '@tabler/icons-react'
+import { Search, X } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { useToolSidebarPanel } from '@/components/tools/tool-sidebar'
+import { cn } from '@/lib/utils'
+
+/**
+ * Body building blocks shared by tool sidebars. Adopting them is per-tool
+ * follow-up work — nothing was rewritten onto them in the branch that added
+ * them, so they exist here unused until a tool migrates.
+ */
+
+/** The filter field five sidebars each rebuild. */
+export function ToolSidebarSearch({
+  value,
+  onChange,
+  placeholder,
+  className,
+}: {
+  value: string
+  onChange: (next: string) => void
+  placeholder: string
+  className?: string
+}) {
+  return (
+    <div className={cn('relative shrink-0 px-2 py-2', className)}>
+      <Search
+        className="pointer-events-none absolute left-4 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-muted-foreground"
+        aria-hidden
+      />
+      <Input
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        placeholder={placeholder}
+        aria-label={placeholder}
+        className="h-8 pl-8 pr-8 text-sm"
+      />
+      {value && (
+        <Button
+          variant="ghost"
+          size="icon"
+          className="absolute right-3 top-1/2 h-5 w-5 -translate-y-1/2 cursor-pointer"
+          onClick={() => onChange('')}
+          aria-label={placeholder}
+        >
+          <X className="h-3 w-3" aria-hidden />
+        </Button>
+      )}
+    </div>
+  )
+}
+
+/**
+ * Collapsible group following the project convention: chevron rotates 90deg
+ * when open, framer-motion height/opacity at ~0.2s, nothing rendered when empty.
+ */
+export function ToolSidebarSection({
+  title,
+  count,
+  defaultOpen = true,
+  actions,
+  children,
+}: {
+  title: string
+  count?: number
+  defaultOpen?: boolean
+  actions?: React.ReactNode
+  children: React.ReactNode
+}) {
+  const [open, setOpen] = React.useState(defaultOpen)
+  if (count === 0) return null
+
+  return (
+    <div className="shrink-0">
+      <div className="flex items-center gap-1 px-2 py-1">
+        <button
+          type="button"
+          onClick={() => setOpen((v) => !v)}
+          aria-expanded={open}
+          className="flex min-w-0 flex-1 items-center gap-1 rounded-md px-1 py-1 text-[10px] font-semibold uppercase tracking-wider text-muted-foreground/70 transition-colors hover:text-foreground"
+        >
+          <IconChevronRight
+            className={cn('h-3 w-3 shrink-0 transition-transform', open && 'rotate-90')}
+            aria-hidden
+          />
+          <span className="truncate">{title}</span>
+          {count !== undefined && <span className="ml-auto shrink-0 tabular-nums">{count}</span>}
+        </button>
+        {actions}
+      </div>
+      <AnimatePresence initial={false}>
+        {open && (
+          <motion.div
+            initial={{ height: 0, opacity: 0 }}
+            animate={{ height: 'auto', opacity: 1 }}
+            exit={{ height: 0, opacity: 0 }}
+            transition={{ duration: 0.2 }}
+            className="overflow-hidden"
+          >
+            {children}
+          </motion.div>
+        )}
+      </AnimatePresence>
+    </div>
+  )
+}
+
+interface ToolSidebarRowProps {
+  label: string
+  icon?: React.ElementType
+  count?: number
+  active?: boolean
+  /** Indent depth for tree rows. */
+  level?: number
+  actions?: React.ReactNode
+  onSelect: () => void
+}
+
+function ToolSidebarRowImpl({
+  label,
+  icon: Icon,
+  count,
+  active,
+  level = 0,
+  actions,
+  onSelect,
+}: ToolSidebarRowProps) {
+  const panel = useToolSidebarPanel()
+  return (
+    <div className="group/row flex items-center gap-1 px-2">
+      <button
+        type="button"
+        aria-current={active ? 'true' : undefined}
+        onClick={() => {
+          onSelect()
+          // On mobile the panel covers the result, so picking has to dismiss it.
+          if (panel?.isOverlay) panel.close()
+        }}
+        style={{ paddingLeft: 8 + level * 12 }}
+        className={cn(
+          'flex min-w-0 flex-1 items-center gap-2 rounded-md py-1.5 pr-2 text-left text-sm transition-colors',
+          active
+            ? 'bg-primary/10 font-medium text-foreground'
+            : 'text-muted-foreground hover:bg-muted/60 hover:text-foreground',
+        )}
+      >
+        {Icon && <Icon className="size-4 shrink-0" aria-hidden />}
+        <span className="min-w-0 flex-1 truncate">{label}</span>
+        {count !== undefined && (
+          <span className="shrink-0 text-xs tabular-nums text-muted-foreground/70">{count}</span>
+        )}
+      </button>
+      {actions && (
+        <div className="shrink-0 opacity-0 transition-opacity focus-within:opacity-100 group-hover/row:opacity-100">
+          {actions}
+        </div>
+      )}
+    </div>
+  )
+}
+
+export const ToolSidebarRow = React.memo(ToolSidebarRowImpl, (a, b) => {
+  return (
+    a.label === b.label &&
+    a.icon === b.icon &&
+    a.count === b.count &&
+    a.active === b.active &&
+    a.level === b.level &&
+    a.actions === b.actions &&
+    a.onSelect === b.onSelect
+  )
+})
+ToolSidebarRow.displayName = 'ToolSidebarRow'
+
+export function ToolSidebarEmpty({
+  icon: Icon,
+  message,
+  action,
+}: {
+  icon: React.ElementType
+  message: string
+  action?: React.ReactNode
+}) {
+  return (
+    <div className="flex flex-col items-center gap-2 px-4 py-8 text-center">
+      <Icon className="h-6 w-6 text-muted-foreground/40" aria-hidden />
+      <p className="text-xs text-muted-foreground">{message}</p>
+      {action}
+    </div>
+  )
+}
diff --git a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
index e3744891..d1f91db8 100644
--- a/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
+++ b/apps/desktop-ui/src/components/tools/tool-sidebar.tsx
@@ -32,6 +32,17 @@ import { cn } from '@/lib/utils'
 
 export type { ToolSidebarRailEntry } from '@/lib/tool-sidebar-rail'
 
+// Body primitives live in their own file (this one is the layout), but consumers
+// import everything sidebar-shaped from here. `ToolSidebarFilterList` stays
+// below: the primitives file imports `useToolSidebarPanel` from here, so moving
+// it would close an import cycle.
+export {
+  ToolSidebarSearch,
+  ToolSidebarSection,
+  ToolSidebarRow,
+  ToolSidebarEmpty,
+} from '@/components/tools/tool-sidebar-primitives'
+
 /**
  * The one in-tool left panel. Every app-like tool (notes, bookmarks, api-client,
  * data-explorer, s3-drive, snippet-manager, password-manager, api-keys,

From 74f607199e91cc5c2c4d5bf4d09e29b76e6f9ba5 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 20:25:21 +0530
Subject: [PATCH 35/39] fix(dashboard): greet the user by their profile name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hero greeted off `useAuth().user.displayName`, which is a hardcoded null —
that identity object is deliberately name-free, and the editable profile name
lives in local preferences behind `useAppUser` (as top-bar and mobile-nav
already read it). So the greeting never named anyone, however the profile was
filled in.

Reads the profile name instead, via a `greetingFirstName` helper that is unit
tested. The now-unused `user` prop is dropped from DashboardHero.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 apps/desktop-ui/src/app/dashboard/page.tsx    |  2 --
 .../__tests__/dashboard-greeting.test.ts      | 27 +++++++++++++++++++
 .../components/dashboard/dashboard-hero.tsx   | 17 ++++++------
 .../src/components/dashboard/types.ts         | 10 +++++++
 4 files changed, 45 insertions(+), 11 deletions(-)
 create mode 100644 apps/desktop-ui/src/components/dashboard/__tests__/dashboard-greeting.test.ts

diff --git a/apps/desktop-ui/src/app/dashboard/page.tsx b/apps/desktop-ui/src/app/dashboard/page.tsx
index 6df8dc43..ceec1f1b 100644
--- a/apps/desktop-ui/src/app/dashboard/page.tsx
+++ b/apps/desktop-ui/src/app/dashboard/page.tsx
@@ -262,7 +262,6 @@ const DashboardPage: React.FC = () => {
       <div className="dash-ambient -z-10" aria-hidden />
       {/* ── Mobile Sticky Header (outside padded container for full-bleed) ── */}
       <DashboardHero
-        user={user}
         totalTools={totalTools}
         pinnedCount={pinnedItems.length}
         recentCount={recentlyUsedItems.length}
@@ -274,7 +273,6 @@ const DashboardPage: React.FC = () => {
           {/* ── Desktop Hero (inside padded container for alignment) ── */}
           <RevealItem index={0}>
             <DashboardHero
-              user={user}
               totalTools={totalTools}
               pinnedCount={pinnedItems.length}
               recentCount={recentlyUsedItems.length}
diff --git a/apps/desktop-ui/src/components/dashboard/__tests__/dashboard-greeting.test.ts b/apps/desktop-ui/src/components/dashboard/__tests__/dashboard-greeting.test.ts
new file mode 100644
index 00000000..5789da6b
--- /dev/null
+++ b/apps/desktop-ui/src/components/dashboard/__tests__/dashboard-greeting.test.ts
@@ -0,0 +1,27 @@
+/**
+ * The dashboard greeting takes its name from the local profile (user
+ * preferences), never from `useAuth` — that identity is a fixed object whose
+ * displayName is always null by design (utils/useAuth.tsx:29).
+ */
+import { greetingFirstName } from "../types"
+
+describe("greetingFirstName", () => {
+  it("uses the first word of a full name", () => {
+    expect(greetingFirstName("Akhil Edathadan")).toBe("Akhil")
+  })
+
+  it("passes a single-word name through", () => {
+    expect(greetingFirstName("Akhil")).toBe("Akhil")
+  })
+
+  it("ignores surrounding and repeated whitespace", () => {
+    expect(greetingFirstName("  Akhil  Edathadan ")).toBe("Akhil")
+  })
+
+  it("returns null for an unset name so the greeting falls back", () => {
+    expect(greetingFirstName("")).toBeNull()
+    expect(greetingFirstName("   ")).toBeNull()
+    expect(greetingFirstName(undefined)).toBeNull()
+    expect(greetingFirstName(null)).toBeNull()
+  })
+})
diff --git a/apps/desktop-ui/src/components/dashboard/dashboard-hero.tsx b/apps/desktop-ui/src/components/dashboard/dashboard-hero.tsx
index befde774..ed2b3884 100644
--- a/apps/desktop-ui/src/components/dashboard/dashboard-hero.tsx
+++ b/apps/desktop-ui/src/components/dashboard/dashboard-hero.tsx
@@ -4,12 +4,12 @@ import React from 'react'
 import Link from 'next/link'
 import { Layers, Zap, Pin, Clock, History } from 'lucide-react'
 import { useTranslations } from 'next-intl'
-import { dashboardGreeting } from './types'
+import { dashboardGreeting, greetingFirstName } from './types'
+import { useAppUser } from '@/hooks/use-app-user'
 import { useCountUp } from '@/hooks/use-count-up'
 import { cn } from '@/lib/utils'
 
 interface DashboardHeroProps {
-  user: { displayName?: string | null } | null
   totalTools: number
   pinnedCount: number
   recentCount: number
@@ -67,7 +67,6 @@ function Stat({
 }
 
 export function DashboardHero({
-  user,
   totalTools,
   pinnedCount,
   recentCount,
@@ -75,6 +74,10 @@ export function DashboardHero({
   desktopOnly,
 }: DashboardHeroProps) {
   const t = useTranslations('Dashboard')
+  // The editable profile name lives in local preferences. `useAuth` is identity
+  // only — its displayName is a hardcoded null, so greeting off it never named
+  // anyone.
+  const firstName = greetingFirstName(useAppUser().name)
 
   return (
     <>
@@ -92,9 +95,7 @@ export function DashboardHero({
                 </div>
                 <p className="text-[11px] text-muted-foreground">
                   {dashboardGreeting(t)}
-                  {user?.displayName
-                    ? t('commaName', { name: user.displayName.split(' ')[0] })
-                    : ''}
+                  {firstName ? t('commaName', { name: firstName }) : ''}
                 </p>
               </div>
             </div>
@@ -124,9 +125,7 @@ export function DashboardHero({
               {dashboardGreeting(t)}
             </p>
             <h1 className="text-2xl sm:text-[1.75rem] font-bold tracking-tight leading-tight text-foreground">
-              {user?.displayName
-                ? t('welcomeBackNamed', { name: user.displayName.split(' ')[0] })
-                : t('welcomeBack')}
+              {firstName ? t('welcomeBackNamed', { name: firstName }) : t('welcomeBack')}
             </h1>
             <p className="text-sm text-muted-foreground">{t('tagline')}</p>
           </div>
diff --git a/apps/desktop-ui/src/components/dashboard/types.ts b/apps/desktop-ui/src/components/dashboard/types.ts
index ca746129..368debef 100644
--- a/apps/desktop-ui/src/components/dashboard/types.ts
+++ b/apps/desktop-ui/src/components/dashboard/types.ts
@@ -103,6 +103,16 @@ export function groupDisplayTitle(title: string, t: (key: string) => string): st
   return title
 }
 
+/**
+ * First name for the dashboard greeting, or null when the profile has no name
+ * set. The name comes from local preferences (`useAppUser`) — `useAuth` is
+ * identity only and its displayName is always null.
+ */
+export function greetingFirstName(name: string | null | undefined): string | null {
+  const first = name?.trim().split(/\s+/)[0]
+  return first || null
+}
+
 /** Time-of-day greeting key. */
 export function dashboardGreeting(t: (key: string) => string): string {
   const hour = new Date().getHours()

From 91c88682785a277b7e33f1361582f5cdf5ff5e56 Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Mon, 24 Aug 2026 20:37:17 +0530
Subject: [PATCH 36/39] fix(notes): hide the sidebar until the vault is
 unlocked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The vault gate sat in page.tsx, which is this layout's children — so a locked
vault swapped the editor for the placeholder while the sidebar column kept
rendering a note tree, a search field and a New note button, all backed by a
vault with no key loaded.

Gate in the layout instead, above NotesProvider so the provider does not mount
and fail to load notes it cannot decrypt. password-manager, api-keys,
environment-manager, secure-files and snippet-manager already gate before the
component that owns their ToolSidebarLayout; notes differed only because its
layout is a separate route-level wrapper.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3GuKxASDXLwFCLA7o3GGH
---
 .../src/app/app/notes/notes-client-layout.tsx   | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/apps/desktop-ui/src/app/app/notes/notes-client-layout.tsx b/apps/desktop-ui/src/app/app/notes/notes-client-layout.tsx
index 94cc182a..cfb8220b 100644
--- a/apps/desktop-ui/src/app/app/notes/notes-client-layout.tsx
+++ b/apps/desktop-ui/src/app/app/notes/notes-client-layout.tsx
@@ -5,6 +5,9 @@ import NotesSidebar from "@/components/notes/NotesSidebar";
 import { ToolSidebarLayout } from "@/components/tools/tool-sidebar";
 import { NotebookPen } from "lucide-react";
 import { useTranslations } from "next-intl";
+import { useVaultGuard } from "@/hooks/use-vault-guard";
+import { VaultLockedPlaceholder } from "@/components/vault-locked-placeholder";
+import { VaultRestoringSkeleton } from "@/components/vault-restoring-skeleton";
 
 function NotesLayout({ children }: { children: React.ReactNode }) {
     const tSidebar = useTranslations("Notes.sidebar");
@@ -33,6 +36,20 @@ function NotesLayout({ children }: { children: React.ReactNode }) {
 }
 
 export default function NotesClientLayout({ children }: { children: React.ReactNode }) {
+    const { isUnlocked, isRestoring } = useVaultGuard();
+
+    // Gate here, not in page.tsx. The page is this layout's *children*, so a gate
+    // there swaps the editor for the placeholder while the sidebar column keeps
+    // rendering — a note tree, a search field and a New note button, all backed
+    // by a vault that cannot be read. password-manager, api-keys and
+    // environment-manager gate before their ToolSidebarLayout for the same
+    // reason; notes only differed because its layout is a separate wrapper.
+    //
+    // Above NotesProvider, so a locked vault does not mount the provider and
+    // have it fail to load notes it has no key for.
+    if (isRestoring) return <VaultRestoringSkeleton />;
+    if (!isUnlocked) return <VaultLockedPlaceholder appName="Notes" />;
+
     return (
         <NotesProvider>
             <NotesLayout>{children}</NotesLayout>

From 99a67c06c002cc461f60c2c660fd698e0b4f5685 Mon Sep 17 00:00:00 2001
From: anuphilipp3 <anuphilipp3@gmail.com>
Date: Mon, 24 Aug 2026 21:55:10 +0530
Subject: [PATCH 37/39] Phase 6-Security

---
 .../bcrypt-generator-layout.tsx               |  28 +-
 .../email-validator/email-validator.tsx       |  87 ++-
 .../encryption-playground-layout.tsx          | 520 +++++++++---------
 .../jwt-decoder/jwt-decoder-layout.tsx        |  83 ++-
 .../pem-cert-decoder-layout.tsx               |  61 +-
 5 files changed, 368 insertions(+), 411 deletions(-)

diff --git a/apps/desktop-ui/src/components/bcrypt-generator/bcrypt-generator-layout.tsx b/apps/desktop-ui/src/components/bcrypt-generator/bcrypt-generator-layout.tsx
index 819bdfe6..7a9bb2cb 100644
--- a/apps/desktop-ui/src/components/bcrypt-generator/bcrypt-generator-layout.tsx
+++ b/apps/desktop-ui/src/components/bcrypt-generator/bcrypt-generator-layout.tsx
@@ -4,7 +4,6 @@ import React, { useCallback, useEffect, useRef, useState } from 'react'
 import { useTranslations } from 'next-intl'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
 import { Button } from '@/components/ui/button'
-import { Card } from '@/components/ui/card'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Badge } from '@/components/ui/badge'
@@ -23,9 +22,7 @@ import {
   TriangleAlert,
 } from 'lucide-react'
 import { IconShieldLock } from '@tabler/icons-react'
-import { ToolPageHeader } from '@/components/tools/tool-page-header'
-import { RevealItem } from '@/components/dashboard/dashboard-reveal'
-import { CATEGORY_ACCENT } from '@/components/dashboard/types'
+import { ToolShell } from '@/components/tools/tool-shell'
 import {
   hashPassword,
   parseBcryptHash,
@@ -323,20 +320,13 @@ export function BcryptGeneratorLayout() {
   const t = useTranslations('BcryptGenerator')
 
   return (
-    <div className="relative flex h-full min-h-0 w-full flex-col gap-4 overflow-hidden dashboard-grid-bg">
-      <div className="dash-ambient -z-10" aria-hidden />
-
-      <RevealItem index={0}>
-        <ToolPageHeader
-          icon={IconShieldLock}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT.Security}
-        />
-      </RevealItem>
-
+    <ToolShell
+      icon={IconShieldLock}
+      title={t('title')}
+      description={t('subtitle')}
+    >
       <div className="min-h-0 flex-1 overflow-y-auto">
-        <Card className="mx-auto max-w-2xl p-5">
+        <div className="mx-auto max-w-2xl rounded-lg border border-border bg-card p-5">
           <Tabs defaultValue="hash">
             <TabsList className="mb-4 grid w-full grid-cols-2">
               <TabsTrigger value="hash">
@@ -355,8 +345,8 @@ export function BcryptGeneratorLayout() {
               <VerifyTab />
             </TabsContent>
           </Tabs>
-        </Card>
+        </div>
       </div>
-    </div>
+    </ToolShell>
   )
 }
diff --git a/apps/desktop-ui/src/components/email-validator/email-validator.tsx b/apps/desktop-ui/src/components/email-validator/email-validator.tsx
index d2b5d7be..8a32960f 100644
--- a/apps/desktop-ui/src/components/email-validator/email-validator.tsx
+++ b/apps/desktop-ui/src/components/email-validator/email-validator.tsx
@@ -1,13 +1,10 @@
 "use client";
 
 import { useState, useRef, useMemo } from "react";
-import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Input } from "@/components/ui/input";
 import { Button } from "@/components/ui/button";
 import { Badge } from "@/components/ui/badge";
-import { ToolPageHeader } from "@/components/tools/tool-page-header";
-import { RevealItem } from "@/components/dashboard/dashboard-reveal";
-import { CATEGORY_ACCENT } from "@/components/dashboard/types";
+import { ToolShell } from "@/components/tools/tool-shell";
 import {
     IconCheck,
     IconX,
@@ -409,17 +406,13 @@ export function EmailValidator() {
     };
 
     return (
-        <div className="flex h-full min-h-0 w-full flex-col gap-4 overflow-y-auto">
-            <RevealItem index={0} className="shrink-0">
-                <ToolPageHeader
-                    icon={IconMailCheck}
-                    title={t("header.title")}
-                    description={t("header.description")}
-                    accent={CATEGORY_ACCENT["Security"]}
-                    offline={false}
-                />
-            </RevealItem>
-
+        <ToolShell
+            icon={IconMailCheck}
+            title={t("header.title")}
+            description={t("header.description")}
+            offline={false}
+            contentClassName="overflow-y-auto"
+        >
             <Tabs value={activeTab} onValueChange={setActiveTab} className="w-full space-y-4">
                 <div className="flex justify-center">
                     <TabsList className="grid w-full max-w-md grid-cols-2 p-1">
@@ -505,11 +498,11 @@ export function EmailValidator() {
                             )}
 
                             <div className="grid gap-4 md:grid-cols-12">
-                                <Card className="col-span-12 md:col-span-4 h-full flex flex-col">
-                                    <CardHeader>
-                                        <CardTitle className="text-base font-medium text-center text-muted-foreground">{t("score.reliabilityTitle")}</CardTitle>
-                                    </CardHeader>
-                                    <CardContent className="flex flex-col items-center justify-center flex-1 pb-8">
+                                <div className="col-span-12 md:col-span-4 h-full flex flex-col rounded-lg border border-border bg-card">
+                                    <div className="p-6 pb-0">
+                                        <h3 className="text-base font-medium text-center text-muted-foreground">{t("score.reliabilityTitle")}</h3>
+                                    </div>
+                                    <div className="flex flex-col items-center justify-center flex-1 p-6 pt-4 pb-8">
                                         <div className="relative flex items-center justify-center">
                                             {/* Simple SVG Circular Progress */}
                                             <svg className="h-40 w-40 transform -rotate-90">
@@ -550,14 +543,14 @@ export function EmailValidator() {
                                                 </TooltipProvider>
                                             </div>
                                         </div>
-                                    </CardContent>
-                                </Card>
-
-                                <Card className="col-span-12 md:col-span-8 h-full">
-                                    <CardHeader>
-                                        <CardTitle className="text-base font-medium">{t("details.sectionTitle")}</CardTitle>
-                                    </CardHeader>
-                                    <CardContent>
+                                    </div>
+                                </div>
+
+                                <div className="col-span-12 md:col-span-8 h-full rounded-lg border border-border bg-card">
+                                    <div className="p-6 pb-0">
+                                        <h3 className="text-base font-medium">{t("details.sectionTitle")}</h3>
+                                    </div>
+                                    <div className="p-6 pt-4">
                                         <div className="grid gap-3 sm:grid-cols-2">
                                             <ValidationItem
                                                 label={t("validation.syntaxLabel")}
@@ -594,8 +587,8 @@ export function EmailValidator() {
                                                 tooltip={t("validation.roleBasedTooltip")}
                                             />
                                         </div>
-                                    </CardContent>
-                                </Card>
+                                    </div>
+                                </div>
                             </div>
                         </motion.div>
                     )}
@@ -603,8 +596,8 @@ export function EmailValidator() {
 
                 <TabsContent value="bulk" className="space-y-4 focus-visible:outline-none">
                     {!bulkLoading && bulkResults.length === 0 && (
-                        <Card className={`max-w-2xl mx-auto mt-6 md:mt-10 border-dashed border-2 transition-all cursor-pointer ${dragActive ? "border-primary bg-primary/5 scale-[1.02]" : "bg-muted/20 hover:bg-muted/40"}`}>
-                            <CardContent className="flex flex-col items-center justify-center py-12 px-4 text-center cursor-pointer"
+                        <div className={`rounded-lg border-2 border-dashed max-w-2xl mx-auto mt-6 md:mt-10 transition-all cursor-pointer ${dragActive ? "border-primary bg-primary/5 scale-[1.02]" : "border-border bg-muted/20 hover:bg-muted/40"}`}>
+                            <div className="flex flex-col items-center justify-center py-12 px-4 text-center cursor-pointer"
                                 onClick={() => fileInputRef.current?.click()}
                                 onDragOver={onDragOver}
                                 onDrop={onDrop}
@@ -634,12 +627,12 @@ export function EmailValidator() {
                                         <IconDownload className="mr-2 h-4 w-4" /> {t("bulk.downloadTemplate")}
                                     </Button>
                                 </div>
-                            </CardContent>
-                        </Card>
+                            </div>
+                        </div>
                     )}
 
                     {bulkLoading && (
-                        <Card className="max-w-2xl mx-auto p-8 text-center">
+                        <div className="rounded-lg border border-border bg-card max-w-2xl mx-auto p-8 text-center">
                             <div className="max-w-md mx-auto space-y-6">
                                 <div className="flex flex-col items-center gap-4">
                                     <div className="relative">
@@ -651,31 +644,31 @@ export function EmailValidator() {
                                 </div>
                                 <Progress value={progress} className="h-2 w-full" />
                             </div>
-                        </Card>
+                        </div>
                     )}
 
                     {bulkResults.length > 0 && !bulkLoading && (
                         <div className="space-y-4">
                             <div className="grid gap-4 grid-cols-2 md:grid-cols-4">
-                                <Card className="p-4 flex flex-col justify-between gap-1">
+                                <div className="rounded-lg border border-border bg-card p-4 flex flex-col justify-between gap-1">
                                     <span className="text-sm font-medium text-muted-foreground">{t("stats.totalProcessed")}</span>
                                     <span className="text-2xl font-bold">{bulkStats.total}</span>
-                                </Card>
-                                <Card className="bg-green-500/10 border-green-500/20 p-4 flex flex-col justify-between">
+                                </div>
+                                <div className="rounded-lg border border-green-500/20 bg-green-500/10 p-4 flex flex-col justify-between">
                                     <span className="text-sm font-medium text-green-600 dark:text-green-400">{t("stats.valid")}</span>
                                     <span className="text-2xl font-bold text-green-700 dark:text-green-300">{bulkStats.valid}</span>
-                                </Card>
-                                <Card className="bg-yellow-500/10 border-yellow-500/20 p-4 flex flex-col justify-between">
+                                </div>
+                                <div className="rounded-lg border border-yellow-500/20 bg-yellow-500/10 p-4 flex flex-col justify-between">
                                     <span className="text-sm font-medium text-yellow-600 dark:text-yellow-400">{t("stats.risky")}</span>
                                     <span className="text-2xl font-bold text-yellow-700 dark:text-yellow-300">{bulkStats.risky}</span>
-                                </Card>
-                                <Card className="bg-red-500/10 border-red-500/20 p-4 flex flex-col justify-between">
+                                </div>
+                                <div className="rounded-lg border border-red-500/20 bg-red-500/10 p-4 flex flex-col justify-between">
                                     <span className="text-sm font-medium text-red-600 dark:text-red-400">{t("stats.invalid")}</span>
                                     <span className="text-2xl font-bold text-red-700 dark:text-red-300">{bulkStats.invalid}</span>
-                                </Card>
+                                </div>
                             </div>
 
-                            <Card className="overflow-hidden">
+                            <div className="rounded-lg border border-border bg-card overflow-hidden">
                                 <div className="p-4 border-b border-border/40 bg-muted/20">
                                     <div className="flex flex-col sm:flex-row gap-4 justify-between items-start sm:items-center">
                                         <h3 className="font-medium">{t("results.detailedTitle")}</h3>
@@ -796,11 +789,11 @@ export function EmailValidator() {
                                         </TableBody>
                                     </Table>
                                 </div>
-                            </Card>
+                            </div>
                         </div>
                     )}
                 </TabsContent>
             </Tabs>
-        </div>
+        </ToolShell>
     );
 }
diff --git a/apps/desktop-ui/src/components/encryption-playground/encryption-playground-layout.tsx b/apps/desktop-ui/src/components/encryption-playground/encryption-playground-layout.tsx
index 4c3c220f..518bdfb1 100644
--- a/apps/desktop-ui/src/components/encryption-playground/encryption-playground-layout.tsx
+++ b/apps/desktop-ui/src/components/encryption-playground/encryption-playground-layout.tsx
@@ -3,7 +3,6 @@
 import { useCallback, useState } from 'react';
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard';
 import { useTranslations } from 'next-intl';
-import { Card } from '@/components/ui/card';
 import { Label } from '@/components/ui/label';
 import { Textarea } from '@/components/ui/textarea';
 import { Button } from '@/components/ui/button';
@@ -30,9 +29,8 @@ import {
 import { cn } from '@/lib/utils';
 import { mapEncryptError, mapDecryptError } from './error-mapping';
 import { IconShieldLock } from '@tabler/icons-react';
-import { ToolPageHeader } from '@/components/tools/tool-page-header';
-import { RevealItem } from '@/components/dashboard/dashboard-reveal';
-import { CATEGORY_ACCENT } from '@/components/dashboard/types';
+import { ToolShell } from '@/components/tools/tool-shell';
+import { ToolPanels, IOPanel, ToolTextArea } from '@/components/tools/io-panel';
 
 const AES_BITS: AesBits[] = [128, 192, 256];
 
@@ -118,285 +116,275 @@ export function EncryptionPlaygroundLayout() {
     void copyDecFn(decryptedOut, { silent: true });
   };
 
-  return (
-    <div className="flex h-full min-h-0 w-full flex-col gap-4">
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconShieldLock}
-          title={t('title')}
-          description={t('subtitle')}
-          accent={CATEGORY_ACCENT.Security}
-        />
-      </RevealItem>
+  const copyEncAction = (
+    <Button type="button" size="sm" variant="secondary" className="h-7" disabled={!bundleJson} onClick={copyEnc}>
+      {copiedEnc ? (
+        <Check className="mr-1.5 h-4 w-4 text-emerald-600" />
+      ) : (
+        <Copy className="mr-1.5 h-4 w-4" />
+      )}
+      {copiedEnc ? t('copied') : t('copyBundle')}
+    </Button>
+  );
+
+  const copyDecAction = (
+    <Button type="button" size="sm" variant="secondary" className="h-7" disabled={!decryptedOut} onClick={copyDec}>
+      {copiedDec ? (
+        <Check className="mr-1.5 h-4 w-4 text-emerald-600" />
+      ) : (
+        <Copy className="mr-1.5 h-4 w-4" />
+      )}
+      {copiedDec ? t('copied') : t('copyPlaintext')}
+    </Button>
+  );
 
-      <Tabs value={tab} onValueChange={(v) => setTab(v as 'encrypt' | 'decrypt')} className="flex min-h-0 flex-1 flex-col gap-4">
-        <TabsList className="grid w-full max-w-md grid-cols-2">
+  return (
+    <ToolShell icon={IconShieldLock} title={t('title')} description={t('subtitle')}>
+      <Tabs
+        value={tab}
+        onValueChange={(v) => setTab(v as 'encrypt' | 'decrypt')}
+        className="flex min-h-0 flex-1 flex-col gap-4"
+      >
+        <TabsList className="grid w-full max-w-md shrink-0 grid-cols-2">
           <TabsTrigger value="encrypt">{t('tabEncrypt')}</TabsTrigger>
           <TabsTrigger value="decrypt">{t('tabDecrypt')}</TabsTrigger>
         </TabsList>
 
-        <div className="grid min-h-0 flex-1 grid-cols-1 gap-4 xl:grid-cols-2">
-          <Card className="flex flex-col gap-4 overflow-auto p-4">
-            {tab === 'encrypt' ? (
-              <>
-                <div className="space-y-3">
-                  <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                    {t('keyModeLabel')}
-                  </Label>
-                  <RadioGroup
-                    value={mode}
-                    onValueChange={(v) => setMode(v as 'raw' | 'passphrase')}
-                    className="flex flex-wrap gap-4"
-                  >
-                    <div className="flex items-center space-x-2">
-                      <RadioGroupItem value="passphrase" id="mode-pass" />
-                      <Label htmlFor="mode-pass" className="cursor-pointer font-normal">
-                        {t('modePassphrase')}
-                      </Label>
-                    </div>
-                    <div className="flex items-center space-x-2">
-                      <RadioGroupItem value="raw" id="mode-raw" />
-                      <Label htmlFor="mode-raw" className="cursor-pointer font-normal">
-                        {t('modeRawKey')}
-                      </Label>
-                    </div>
-                  </RadioGroup>
-                </div>
+        {tab === 'encrypt' ? (
+          <div className="flex min-h-0 flex-1 flex-col gap-4">
+            <div className="shrink-0 space-y-4 overflow-auto rounded-lg border border-border bg-card p-4">
+              <div className="space-y-3">
+                <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                  {t('keyModeLabel')}
+                </Label>
+                <RadioGroup
+                  value={mode}
+                  onValueChange={(v) => setMode(v as 'raw' | 'passphrase')}
+                  className="flex flex-wrap gap-4"
+                >
+                  <div className="flex items-center space-x-2">
+                    <RadioGroupItem value="passphrase" id="mode-pass" />
+                    <Label htmlFor="mode-pass" className="cursor-pointer font-normal">
+                      {t('modePassphrase')}
+                    </Label>
+                  </div>
+                  <div className="flex items-center space-x-2">
+                    <RadioGroupItem value="raw" id="mode-raw" />
+                    <Label htmlFor="mode-raw" className="cursor-pointer font-normal">
+                      {t('modeRawKey')}
+                    </Label>
+                  </div>
+                </RadioGroup>
+              </div>
 
-                {mode === 'raw' ? (
-                  <>
-                    <div className="space-y-2">
-                      <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                        {t('aesBitsLabel')}
-                      </Label>
-                      <Select value={String(aesBits)} onValueChange={(v) => setAesBits(Number(v) as AesBits)}>
-                        <SelectTrigger>
-                          <SelectValue />
-                        </SelectTrigger>
-                        <SelectContent>
-                          {AES_BITS.map((b) => (
-                            <SelectItem key={b} value={String(b)}>
-                              {t(`aesBits.${b}` as 'aesBits.256')}
-                            </SelectItem>
-                          ))}
-                        </SelectContent>
-                      </Select>
-                    </div>
-                    <div className="space-y-2">
-                      <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                        {t('rawEncodingLabel')}
-                      </Label>
-                      <Select
-                        value={rawKeyEncoding}
-                        onValueChange={(v) => setRawKeyEncoding(v as RawKeyEncoding)}
-                      >
-                        <SelectTrigger>
-                          <SelectValue />
-                        </SelectTrigger>
-                        <SelectContent>
-                          <SelectItem value="auto">{t('encodingAuto')}</SelectItem>
-                          <SelectItem value="hex">{t('encodingHex')}</SelectItem>
-                          <SelectItem value="base64">{t('encodingBase64')}</SelectItem>
-                        </SelectContent>
-                      </Select>
-                    </div>
-                    <div className="space-y-2">
-                      <Label htmlFor="ep-raw-key">{t('rawKeyLabel')}</Label>
-                      <Textarea
-                        id="ep-raw-key"
-                        value={rawKeyInput}
-                        onChange={(e) => setRawKeyInput(e.target.value)}
-                        placeholder={t('rawKeyPlaceholder')}
-                        className="min-h-[88px] resize-y font-mono text-sm"
-                        spellCheck={false}
-                        autoComplete="off"
-                      />
-                    </div>
-                  </>
-                ) : (
-                  <>
-                    <div className="space-y-2">
-                      <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                        {t('aesBitsLabel')}
-                      </Label>
-                      <Select value={String(aesBits)} onValueChange={(v) => setAesBits(Number(v) as AesBits)}>
-                        <SelectTrigger>
-                          <SelectValue />
-                        </SelectTrigger>
-                        <SelectContent>
-                          {AES_BITS.map((b) => (
-                            <SelectItem key={b} value={String(b)}>
-                              {t(`aesBits.${b}` as 'aesBits.256')}
-                            </SelectItem>
-                          ))}
-                        </SelectContent>
-                      </Select>
-                    </div>
-                    <div className="space-y-2">
-                      <Label htmlFor="ep-pass">{t('passphraseLabel')}</Label>
-                      <Input
-                        id="ep-pass"
-                        type="password"
-                        value={passphrase}
-                        onChange={(e) => setPassphrase(e.target.value)}
-                        placeholder={t('passphrasePlaceholder')}
-                        autoComplete="off"
-                        className="font-mono text-sm"
-                      />
-                    </div>
-                    <div className="space-y-2">
-                      <Label htmlFor="ep-iter">{t('pbkdf2IterLabel')}</Label>
-                      <Input
-                        id="ep-iter"
-                        type="number"
-                        min={10_000}
-                        max={2_000_000}
-                        value={pbkdf2Iter}
-                        onChange={(e) => setPbkdf2Iter(e.target.value)}
-                        className="font-mono text-sm"
-                      />
-                      <p className="text-xs text-muted-foreground">{t('pbkdf2Hint')}</p>
-                    </div>
-                  </>
-                )}
+              {mode === 'raw' ? (
+                <>
+                  <div className="space-y-2">
+                    <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                      {t('aesBitsLabel')}
+                    </Label>
+                    <Select value={String(aesBits)} onValueChange={(v) => setAesBits(Number(v) as AesBits)}>
+                      <SelectTrigger>
+                        <SelectValue />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {AES_BITS.map((b) => (
+                          <SelectItem key={b} value={String(b)}>
+                            {t(`aesBits.${b}` as 'aesBits.256')}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  </div>
+                  <div className="space-y-2">
+                    <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                      {t('rawEncodingLabel')}
+                    </Label>
+                    <Select
+                      value={rawKeyEncoding}
+                      onValueChange={(v) => setRawKeyEncoding(v as RawKeyEncoding)}
+                    >
+                      <SelectTrigger>
+                        <SelectValue />
+                      </SelectTrigger>
+                      <SelectContent>
+                        <SelectItem value="auto">{t('encodingAuto')}</SelectItem>
+                        <SelectItem value="hex">{t('encodingHex')}</SelectItem>
+                        <SelectItem value="base64">{t('encodingBase64')}</SelectItem>
+                      </SelectContent>
+                    </Select>
+                  </div>
+                  <div className="space-y-2">
+                    <Label htmlFor="ep-raw-key">{t('rawKeyLabel')}</Label>
+                    <Textarea
+                      id="ep-raw-key"
+                      value={rawKeyInput}
+                      onChange={(e) => setRawKeyInput(e.target.value)}
+                      placeholder={t('rawKeyPlaceholder')}
+                      className="min-h-[88px] resize-y font-mono text-sm"
+                      spellCheck={false}
+                      autoComplete="off"
+                    />
+                  </div>
+                </>
+              ) : (
+                <>
+                  <div className="space-y-2">
+                    <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                      {t('aesBitsLabel')}
+                    </Label>
+                    <Select value={String(aesBits)} onValueChange={(v) => setAesBits(Number(v) as AesBits)}>
+                      <SelectTrigger>
+                        <SelectValue />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {AES_BITS.map((b) => (
+                          <SelectItem key={b} value={String(b)}>
+                            {t(`aesBits.${b}` as 'aesBits.256')}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  </div>
+                  <div className="space-y-2">
+                    <Label htmlFor="ep-pass">{t('passphraseLabel')}</Label>
+                    <Input
+                      id="ep-pass"
+                      type="password"
+                      value={passphrase}
+                      onChange={(e) => setPassphrase(e.target.value)}
+                      placeholder={t('passphrasePlaceholder')}
+                      autoComplete="off"
+                      className="font-mono text-sm"
+                    />
+                  </div>
+                  <div className="space-y-2">
+                    <Label htmlFor="ep-iter">{t('pbkdf2IterLabel')}</Label>
+                    <Input
+                      id="ep-iter"
+                      type="number"
+                      min={10_000}
+                      max={2_000_000}
+                      value={pbkdf2Iter}
+                      onChange={(e) => setPbkdf2Iter(e.target.value)}
+                      className="font-mono text-sm"
+                    />
+                    <p className="text-xs text-muted-foreground">{t('pbkdf2Hint')}</p>
+                  </div>
+                </>
+              )}
 
-                <div className="space-y-2">
-                  <Label htmlFor="ep-plain">{t('plaintextLabel')}</Label>
-                  <Textarea
-                    id="ep-plain"
-                    value={plaintext}
-                    onChange={(e) => setPlaintext(e.target.value)}
-                    placeholder={t('plaintextPlaceholder')}
-                    className="min-h-[120px] resize-y font-mono text-sm"
-                    spellCheck
-                  />
-                </div>
+              <div className="flex flex-wrap items-center gap-3">
                 <Button type="button" onClick={() => void runEncrypt()} disabled={busy}>
                   {t('encryptButton')}
                 </Button>
                 {errEncrypt && <p className="text-sm text-destructive">{errEncrypt}</p>}
-              </>
-            ) : (
-              <>
-                <p className="text-xs text-muted-foreground">{t('decryptKeyHint')}</p>
-                <div className="space-y-2">
-                  <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                    {t('rawEncodingLabel')}
-                  </Label>
-                  <Select
-                    value={rawKeyEncoding}
-                    onValueChange={(v) => setRawKeyEncoding(v as RawKeyEncoding)}
-                  >
-                    <SelectTrigger>
-                      <SelectValue />
-                    </SelectTrigger>
-                    <SelectContent>
-                      <SelectItem value="auto">{t('encodingAuto')}</SelectItem>
-                      <SelectItem value="hex">{t('encodingHex')}</SelectItem>
-                      <SelectItem value="base64">{t('encodingBase64')}</SelectItem>
-                    </SelectContent>
-                  </Select>
-                </div>
-                <div className="space-y-2">
-                  <Label htmlFor="ep-raw-key-dec">{t('rawKeyLabel')}</Label>
-                  <Textarea
-                    id="ep-raw-key-dec"
-                    value={rawKeyInput}
-                    onChange={(e) => setRawKeyInput(e.target.value)}
-                    placeholder={t('rawKeyPlaceholderDecrypt')}
-                    className="min-h-[72px] resize-y font-mono text-sm"
-                    spellCheck={false}
-                    autoComplete="off"
-                  />
-                </div>
-                <div className="space-y-2">
-                  <Label htmlFor="ep-pass-dec">{t('passphraseLabel')}</Label>
-                  <Input
-                    id="ep-pass-dec"
-                    type="password"
-                    value={passphrase}
-                    onChange={(e) => setPassphrase(e.target.value)}
-                    placeholder={t('passphrasePlaceholderDecrypt')}
-                    autoComplete="off"
-                    className="font-mono text-sm"
-                  />
-                </div>
-                <div className="space-y-2">
-                  <Label htmlFor="ep-bundle-in">{t('bundleInputLabel')}</Label>
-                  <Textarea
-                    id="ep-bundle-in"
-                    value={decryptBundleInput}
-                    onChange={(e) => setDecryptBundleInput(e.target.value)}
-                    placeholder={t('bundlePlaceholder')}
-                    className="min-h-[160px] resize-y font-mono text-xs"
-                    spellCheck={false}
-                  />
-                </div>
+              </div>
+            </div>
+
+            <ToolPanels className="lg:grid-cols-2">
+              <IOPanel label={t('plaintextLabel')}>
+                <ToolTextArea
+                  id="ep-plain"
+                  value={plaintext}
+                  onChange={(e) => setPlaintext(e.target.value)}
+                  placeholder={t('plaintextPlaceholder')}
+                  spellCheck
+                />
+              </IOPanel>
+
+              <IOPanel label={t('bundleOutputLabel')} actions={copyEncAction}>
+                <ToolTextArea
+                  readOnly
+                  value={bundleJson}
+                  placeholder={t('emptyBundleHint')}
+                  className={cn('text-xs', busy && 'opacity-60')}
+                />
+              </IOPanel>
+            </ToolPanels>
+
+            <p className="shrink-0 text-xs text-muted-foreground">{t('securityNote')}</p>
+          </div>
+        ) : (
+          <div className="flex min-h-0 flex-1 flex-col gap-4">
+            <div className="shrink-0 space-y-4 overflow-auto rounded-lg border border-border bg-card p-4">
+              <p className="text-xs text-muted-foreground">{t('decryptKeyHint')}</p>
+              <div className="space-y-2">
+                <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                  {t('rawEncodingLabel')}
+                </Label>
+                <Select
+                  value={rawKeyEncoding}
+                  onValueChange={(v) => setRawKeyEncoding(v as RawKeyEncoding)}
+                >
+                  <SelectTrigger>
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="auto">{t('encodingAuto')}</SelectItem>
+                    <SelectItem value="hex">{t('encodingHex')}</SelectItem>
+                    <SelectItem value="base64">{t('encodingBase64')}</SelectItem>
+                  </SelectContent>
+                </Select>
+              </div>
+              <div className="space-y-2">
+                <Label htmlFor="ep-raw-key-dec">{t('rawKeyLabel')}</Label>
+                <Textarea
+                  id="ep-raw-key-dec"
+                  value={rawKeyInput}
+                  onChange={(e) => setRawKeyInput(e.target.value)}
+                  placeholder={t('rawKeyPlaceholderDecrypt')}
+                  className="min-h-[72px] resize-y font-mono text-sm"
+                  spellCheck={false}
+                  autoComplete="off"
+                />
+              </div>
+              <div className="space-y-2">
+                <Label htmlFor="ep-pass-dec">{t('passphraseLabel')}</Label>
+                <Input
+                  id="ep-pass-dec"
+                  type="password"
+                  value={passphrase}
+                  onChange={(e) => setPassphrase(e.target.value)}
+                  placeholder={t('passphrasePlaceholderDecrypt')}
+                  autoComplete="off"
+                  className="font-mono text-sm"
+                />
+              </div>
+              <div className="flex flex-wrap items-center gap-3">
                 <Button type="button" onClick={() => void runDecrypt()} disabled={busy}>
                   {t('decryptButton')}
                 </Button>
                 {errDecrypt && <p className="text-sm text-destructive">{errDecrypt}</p>}
-              </>
-            )}
-          </Card>
+              </div>
+            </div>
 
-          <Card className="flex flex-col gap-3 overflow-auto p-4">
-            {tab === 'encrypt' ? (
-              <>
-                <div className="flex flex-wrap items-center justify-between gap-2">
-                  <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                    {t('bundleOutputLabel')}
-                  </Label>
-                  <Button type="button" size="sm" variant="secondary" disabled={!bundleJson} onClick={copyEnc}>
-                    {copiedEnc ? (
-                      <Check className="mr-1.5 h-4 w-4 text-emerald-600" />
-                    ) : (
-                      <Copy className="mr-1.5 h-4 w-4" />
-                    )}
-                    {copiedEnc ? t('copied') : t('copyBundle')}
-                  </Button>
-                </div>
-                <pre
-                  className={cn(
-                    'min-h-[200px] flex-1 overflow-auto whitespace-pre-wrap rounded-md border bg-muted/30 p-3 font-mono text-xs break-all',
-                    busy && 'opacity-60'
-                  )}
-                >
-                  {bundleJson || <span className="text-muted-foreground">{t('emptyBundleHint')}</span>}
-                </pre>
-              </>
-            ) : (
-              <>
-                <div className="flex flex-wrap items-center justify-between gap-2">
-                  <Label className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
-                    {t('plaintextOutputLabel')}
-                  </Label>
-                  <Button type="button" size="sm" variant="secondary" disabled={!decryptedOut} onClick={copyDec}>
-                    {copiedDec ? (
-                      <Check className="mr-1.5 h-4 w-4 text-emerald-600" />
-                    ) : (
-                      <Copy className="mr-1.5 h-4 w-4" />
-                    )}
-                    {copiedDec ? t('copied') : t('copyPlaintext')}
-                  </Button>
-                </div>
-                <div
-                  className={cn(
-                    'min-h-[200px] flex-1 overflow-auto rounded-md border bg-muted/30 p-3 font-mono text-sm whitespace-pre-wrap break-all',
-                    busy && 'opacity-60'
-                  )}
-                >
-                  {decryptedOut || (
-                    <span className="text-muted-foreground">{t('emptyDecryptHint')}</span>
-                  )}
-                </div>
-              </>
-            )}
-            <p className="text-xs text-muted-foreground">{t('securityNote')}</p>
-          </Card>
-        </div>
+            <ToolPanels className="lg:grid-cols-2">
+              <IOPanel label={t('bundleInputLabel')}>
+                <ToolTextArea
+                  id="ep-bundle-in"
+                  value={decryptBundleInput}
+                  onChange={(e) => setDecryptBundleInput(e.target.value)}
+                  placeholder={t('bundlePlaceholder')}
+                  className="text-xs"
+                />
+              </IOPanel>
+
+              <IOPanel label={t('plaintextOutputLabel')} actions={copyDecAction}>
+                <ToolTextArea
+                  readOnly
+                  value={decryptedOut}
+                  placeholder={t('emptyDecryptHint')}
+                  className={cn(busy && 'opacity-60')}
+                />
+              </IOPanel>
+            </ToolPanels>
+
+            <p className="shrink-0 text-xs text-muted-foreground">{t('securityNote')}</p>
+          </div>
+        )}
       </Tabs>
-    </div>
+    </ToolShell>
   );
 }
 
diff --git a/apps/desktop-ui/src/components/jwt-decoder/jwt-decoder-layout.tsx b/apps/desktop-ui/src/components/jwt-decoder/jwt-decoder-layout.tsx
index 22a4e9ee..ee8a7bb8 100644
--- a/apps/desktop-ui/src/components/jwt-decoder/jwt-decoder-layout.tsx
+++ b/apps/desktop-ui/src/components/jwt-decoder/jwt-decoder-layout.tsx
@@ -3,7 +3,6 @@
 import { useMemo, useState } from 'react';
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard';
 import { Button } from '@/components/ui/button';
-import { Card } from '@/components/ui/card';
 import { Label } from '@/components/ui/label';
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { decodeJwt, type RelativeUnit } from '@/lib/jwt-decode';
@@ -14,9 +13,8 @@ import { useSearchParams } from 'next/navigation';
 import { JwtSignerLayout } from './jwt-signer-layout';
 import { SendToMenu } from '@/components/ui/send-to-menu';
 import { IconKey } from '@tabler/icons-react';
-import { ToolPageHeader } from '@/components/tools/tool-page-header';
-import { RevealItem } from '@/components/dashboard/dashboard-reveal';
-import { CATEGORY_ACCENT } from '@/components/dashboard/types';
+import { ToolShell } from '@/components/tools/tool-shell';
+import { IOPanel, ToolTextArea } from '@/components/tools/io-panel';
 
 function CopyBtn({ text, title }: { text: string; title: string }) {
   const { isCopied: done, copyToClipboard } = useCopyToClipboard();
@@ -45,7 +43,7 @@ function JsonPanel({
   copyLabel: string;
 }) {
   return (
-    <Card className="flex flex-col overflow-hidden min-h-0">
+    <div className="flex flex-col overflow-hidden min-h-0 rounded-lg border border-border bg-card">
       <div className="flex items-center justify-between px-3 py-2 border-b border-border/50 bg-muted/30 gap-2">
         <Label className="text-xs font-medium text-muted-foreground uppercase tracking-wider">
           {title}
@@ -60,7 +58,7 @@ function JsonPanel({
           {content}
         </pre>
       </div>
-    </Card>
+    </div>
   );
 }
 
@@ -83,11 +81,11 @@ function JwtDecodePanel() {
 
   return (
     <div className="flex flex-col h-full gap-4 min-h-0">
-      <Card className="flex flex-col overflow-hidden shrink-0">
-        <div className="flex items-center justify-between px-3 py-2 border-b border-border/50 bg-muted/30">
-          <Label htmlFor="jwt-input" className="text-xs font-medium text-muted-foreground uppercase tracking-wider">
-            {t('tokenLabel')}
-          </Label>
+      <IOPanel
+        className="shrink-0"
+        bodyClassName="min-h-[120px]"
+        label={t('tokenLabel')}
+        actions={
           <Button
             type="button"
             variant="ghost"
@@ -98,16 +96,16 @@ function JwtDecodePanel() {
             <Trash2 className="h-3 w-3" />
             {t('clear')}
           </Button>
-        </div>
-        <textarea
+        }
+      >
+        <ToolTextArea
           id="jwt-input"
           value={input}
           onChange={(e) => setInput(e.target.value)}
           placeholder={t('placeholder')}
-          spellCheck={false}
-          className="min-h-[100px] max-h-[160px] w-full resize-y bg-transparent p-3 text-xs font-mono focus:outline-none placeholder:text-muted-foreground/50"
+          className="text-xs"
         />
-      </Card>
+      </IOPanel>
 
       {!result.ok && input.trim() && (
         <div className="flex items-start gap-2 rounded-lg border border-destructive/40 bg-destructive/5 px-3 py-2 text-sm text-destructive">
@@ -118,9 +116,9 @@ function JwtDecodePanel() {
 
       {result.ok && (
         <div className="flex flex-col gap-4 flex-1 min-h-0">
-          <Card
+          <div
             className={cn(
-              'border p-4 space-y-3',
+              'rounded-lg border border-border bg-card p-4 space-y-3',
               result.expiry.kind === 'present' &&
                 (result.expiry.expired
                   ? 'border-destructive/40 bg-destructive/5'
@@ -192,7 +190,7 @@ function JwtDecodePanel() {
                 )}
               </div>
             )}
-          </Card>
+          </div>
 
           <div className="grid grid-cols-1 lg:grid-cols-2 gap-4 flex-1 min-h-0">
             <JsonPanel title={t('panels.header')} content={result.headerFormatted} copyLabel={t('copy')} />
@@ -208,30 +206,27 @@ export function JwtDecoderLayout() {
   const t = useTranslations('JwtDecoder');
 
   return (
-    <Tabs defaultValue="decode" className="flex h-full min-h-0 w-full flex-col gap-4">
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconKey}
-          title={t('title')}
-          description={t.rich('subtitle', {
-            code: (chunks) => <code className="text-foreground">{chunks}</code>,
-          })}
-          accent={CATEGORY_ACCENT.Security}
-        />
-      </RevealItem>
-
-      <TabsList className="shrink-0 w-fit">
-        <TabsTrigger value="decode">{t('tabs.decode')}</TabsTrigger>
-        <TabsTrigger value="sign">{t('tabs.sign')}</TabsTrigger>
-      </TabsList>
-
-      <TabsContent value="decode" className="flex-1 min-h-0 m-0 data-[state=inactive]:hidden">
-        <JwtDecodePanel />
-      </TabsContent>
-
-      <TabsContent value="sign" className="flex-1 min-h-0 m-0 data-[state=inactive]:hidden">
-        <JwtSignerLayout />
-      </TabsContent>
-    </Tabs>
+    <ToolShell
+      icon={IconKey}
+      title={t('title')}
+      description={t.rich('subtitle', {
+        code: (chunks) => <code className="text-foreground">{chunks}</code>,
+      })}
+    >
+      <Tabs defaultValue="decode" className="flex h-full min-h-0 w-full flex-col gap-4">
+        <TabsList className="shrink-0 w-fit">
+          <TabsTrigger value="decode">{t('tabs.decode')}</TabsTrigger>
+          <TabsTrigger value="sign">{t('tabs.sign')}</TabsTrigger>
+        </TabsList>
+
+        <TabsContent value="decode" className="flex-1 min-h-0 m-0 data-[state=inactive]:hidden">
+          <JwtDecodePanel />
+        </TabsContent>
+
+        <TabsContent value="sign" className="flex-1 min-h-0 m-0 data-[state=inactive]:hidden">
+          <JwtSignerLayout />
+        </TabsContent>
+      </Tabs>
+    </ToolShell>
   );
 }
diff --git a/apps/desktop-ui/src/components/pem-cert-decoder/pem-cert-decoder-layout.tsx b/apps/desktop-ui/src/components/pem-cert-decoder/pem-cert-decoder-layout.tsx
index 2a3adf04..b5aaec3b 100644
--- a/apps/desktop-ui/src/components/pem-cert-decoder/pem-cert-decoder-layout.tsx
+++ b/apps/desktop-ui/src/components/pem-cert-decoder/pem-cert-decoder-layout.tsx
@@ -5,15 +5,11 @@ import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard';
 import type { DecodedPemBlock } from '@/lib/pem-cert-decode';
 import { decodePemCertificateInput } from '@/lib/pem-cert-decode';
 import { Button } from '@/components/ui/button';
-import { Card } from '@/components/ui/card';
-import { Label } from '@/components/ui/label';
-import { cn } from '@/lib/utils';
 import { AlertCircle, Check, Copy, Trash2 } from 'lucide-react';
 import { useLocale, useTranslations } from 'next-intl';
 import { IconCertificate } from '@tabler/icons-react';
-import { ToolPageHeader } from '@/components/tools/tool-page-header';
-import { RevealItem } from '@/components/dashboard/dashboard-reveal';
-import { CATEGORY_ACCENT } from '@/components/dashboard/types';
+import { ToolShell } from '@/components/tools/tool-shell';
+import { IOPanel, ToolTextArea } from '@/components/tools/io-panel';
 
 function CopyBtn({ text, title }: { text: string; title: string }) {
   const { isCopied, copyToClipboard } = useCopyToClipboard();
@@ -59,7 +55,7 @@ function BlockCard({
         : '';
 
   return (
-    <Card className="flex flex-col overflow-hidden min-h-0">
+    <div className="flex min-h-0 flex-col overflow-hidden rounded-lg border border-border bg-card">
       <div className="flex items-center justify-between gap-2 border-b border-border/50 bg-muted/30 px-3 py-2">
         <div className="min-w-0">
           <p className="text-xs font-medium text-muted-foreground uppercase tracking-wider">
@@ -142,7 +138,7 @@ function BlockCard({
           </dd>
         </div>
       </dl>
-    </Card>
+    </div>
   );
 }
 
@@ -184,56 +180,51 @@ export function PemCertDecoderLayout() {
   }, [input]);
 
   return (
-    <div className={cn('flex flex-col h-full gap-4 min-h-0')}>
-      <RevealItem index={0} className="shrink-0">
-        <ToolPageHeader
-          icon={IconCertificate}
-          title={t('title')}
-          description={t.rich('subtitle', {
-            code: (chunks) => <code className="text-foreground">{chunks}</code>,
-          })}
-          accent={CATEGORY_ACCENT.Security}
-        />
-      </RevealItem>
-
-      <Card className="flex flex-col overflow-hidden shrink-0">
-        <div className="flex items-center justify-between px-3 py-2 border-b border-border/50 bg-muted/30">
-          <Label htmlFor="pem-input" className="text-xs font-medium text-muted-foreground uppercase tracking-wider">
-            {t('pemLabel')}
-          </Label>
-          <Button type="button" variant="ghost" size="sm" className="h-7 text-xs gap-1" onClick={() => setInput('')}>
+    <ToolShell
+      icon={IconCertificate}
+      title={t('title')}
+      description={t.rich('subtitle', {
+        code: (chunks) => <code className="text-foreground">{chunks}</code>,
+      })}
+      contentClassName="gap-4"
+    >
+      <IOPanel
+        className="h-[200px] shrink-0"
+        label={t('pemLabel')}
+        actions={
+          <Button type="button" variant="ghost" size="sm" className="h-7 gap-1 text-xs" onClick={() => setInput('')}>
             <Trash2 className="h-3 w-3" />
             {t('clear')}
           </Button>
-        </div>
-        <textarea
+        }
+      >
+        <ToolTextArea
           id="pem-input"
           value={input}
           onChange={(e) => setInput(e.target.value)}
           placeholder={t('placeholder')}
-          spellCheck={false}
-          className="min-h-[120px] max-h-[200px] w-full resize-y bg-transparent p-3 text-xs font-mono focus:outline-none placeholder:text-muted-foreground/50"
+          className="text-xs"
         />
-      </Card>
+      </IOPanel>
 
       {busy && input.trim() && (
-        <p className="text-xs text-muted-foreground px-1">{t('parsing')}</p>
+        <p className="px-1 text-xs text-muted-foreground">{t('parsing')}</p>
       )}
 
       {errorKey && input.trim() && !busy && (
         <div className="flex items-start gap-2 rounded-lg border border-destructive/40 bg-destructive/5 px-3 py-2 text-sm text-destructive">
-          <AlertCircle className="h-4 w-4 shrink-0 mt-0.5" />
+          <AlertCircle className="mt-0.5 h-4 w-4 shrink-0" />
           <p>{t(`errors.${errorKey}` as 'errors.empty')}</p>
         </div>
       )}
 
       {blocks && blocks.length > 0 && (
-        <div className="flex flex-col gap-3 min-h-0 flex-1 overflow-auto">
+        <div className="flex min-h-0 flex-1 flex-col gap-3 overflow-auto">
           {blocks.map((b, i) => (
             <BlockCard key={`${b.kind}-${i}`} block={b} index={i} t={t} locale={locale} />
           ))}
         </div>
       )}
-    </div>
+    </ToolShell>
   );
 }

From 3996b6b0a9da0f76c3749dff5d4347d97308330e Mon Sep 17 00:00:00 2001
From: anuphilipp3 <anuphilipp3@gmail.com>
Date: Mon, 24 Aug 2026 22:13:47 +0530
Subject: [PATCH 38/39] feat(settings): segregate settings into tabs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The settings page was one long scroll of stacked cards. Split it into four
tabs (reusing existing i18n keys — no locale churn):

- Profile      — profile card
- Appearance   — theme, accent color, language
- Security     — auto-lock, vault icons, telemetry, backup codes
- Backup & data — backup/restore, factory reset, app version

No logic changes; each section's cards moved verbatim into a TabsContent.
0 type errors; page renders.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 apps/desktop-ui/src/app/settings/page.tsx | 45 ++++++++++++++++++-----
 1 file changed, 35 insertions(+), 10 deletions(-)

diff --git a/apps/desktop-ui/src/app/settings/page.tsx b/apps/desktop-ui/src/app/settings/page.tsx
index 181edc18..1da11fed 100644
--- a/apps/desktop-ui/src/app/settings/page.tsx
+++ b/apps/desktop-ui/src/app/settings/page.tsx
@@ -4,8 +4,9 @@ import React, { useState, useEffect } from 'react'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
 import { Label } from '@/components/ui/label'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
-import { Sun, Moon, Monitor, Globe, Palette, Lock, Pipette } from 'lucide-react'
+import { Sun, Moon, Monitor, Globe, Palette, Lock, Pipette, User, Archive } from 'lucide-react'
 import { ToggleGroup, ToggleGroupItem } from '@/components/ui/toggle-group'
+import { Tabs, TabsList, TabsTrigger, TabsContent } from '@/components/ui/tabs'
 import { IDLE_TIMEOUT_KEY, getIdleTimeoutMinutes } from '@/lib/use-idle-lock'
 import { Switch } from '@/components/ui/switch'
 import { getVaultIconsEnabled, setVaultIconsEnabled } from '@/lib/vault-icon-pref'
@@ -77,10 +78,31 @@ export default function SettingsPage() {
         <p className="text-muted-foreground">{t('subtitle')}</p>
       </div>
 
-      <div className="grid gap-6">
+      <Tabs defaultValue="profile" className="w-full">
+        <TabsList className="mb-6 flex h-auto flex-wrap justify-start gap-1">
+          <TabsTrigger value="profile" className="gap-1.5">
+            <User className="h-4 w-4" />
+            {t('userProfile.title')}
+          </TabsTrigger>
+          <TabsTrigger value="appearance" className="gap-1.5">
+            <Palette className="h-4 w-4" />
+            {t('appearance.title')}
+          </TabsTrigger>
+          <TabsTrigger value="security" className="gap-1.5">
+            <Lock className="h-4 w-4" />
+            {t('security.title')}
+          </TabsTrigger>
+          <TabsTrigger value="data" className="gap-1.5">
+            <Archive className="h-4 w-4" />
+            {t('backup.title')}
+          </TabsTrigger>
+        </TabsList>
 
-        <ProfileCard />
+        <TabsContent value="profile" className="mt-0 space-y-6">
+          <ProfileCard />
+        </TabsContent>
 
+        <TabsContent value="appearance" className="mt-0 space-y-6">
         <Card className="rounded-2xl border border-border/60 bg-card/60 shadow-sm backdrop-blur-sm">
           <CardHeader>
             <CardTitle className="flex items-center gap-2.5">
@@ -232,7 +254,9 @@ export default function SettingsPage() {
             </div>
           </CardContent>
         </Card>
+        </TabsContent>
 
+        <TabsContent value="security" className="mt-0 space-y-6">
         <Card className="rounded-2xl border border-border/60 bg-card/60 shadow-sm backdrop-blur-sm">
           <CardHeader>
             <CardTitle className="flex items-center gap-2.5">
@@ -299,14 +323,15 @@ export default function SettingsPage() {
           </CardContent>
         </Card>
 
-        <AppVersionLabel />
+          <BackupCodesCard />
+        </TabsContent>
 
-        <BackupCodesCard />
-
-        <BackupRestoreCard />
-
-        <FactoryResetCard />
-      </div>
+        <TabsContent value="data" className="mt-0 space-y-6">
+          <BackupRestoreCard />
+          <FactoryResetCard />
+          <AppVersionLabel />
+        </TabsContent>
+      </Tabs>
     </div>
   )
 }

From a065461ceb78bd550dd81ee00e8a52f4e109e5ff Mon Sep 17 00:00:00 2001
From: AKHIL <akhiledathadan007@gmail.com>
Date: Tue, 25 Aug 2026 10:48:13 +0530
Subject: [PATCH 39/39] UI button color fix

---
 apps/desktop-ui/src/components/master-password-gate.tsx | 1 -
 apps/desktop-ui/src/components/ui/button.tsx            | 2 --
 2 files changed, 3 deletions(-)

diff --git a/apps/desktop-ui/src/components/master-password-gate.tsx b/apps/desktop-ui/src/components/master-password-gate.tsx
index e4428edd..ce34e5d2 100644
--- a/apps/desktop-ui/src/components/master-password-gate.tsx
+++ b/apps/desktop-ui/src/components/master-password-gate.tsx
@@ -610,7 +610,6 @@ export function MasterPasswordGate() {
 
                                             <Button
                                                 type="submit"
-                                                variant="gradient"
                                                 className="w-full"
                                                 size="lg"
                                                 disabled={
diff --git a/apps/desktop-ui/src/components/ui/button.tsx b/apps/desktop-ui/src/components/ui/button.tsx
index c7b1f43e..8cbca317 100644
--- a/apps/desktop-ui/src/components/ui/button.tsx
+++ b/apps/desktop-ui/src/components/ui/button.tsx
@@ -18,8 +18,6 @@ const buttonVariants = cva(
         secondary:
           "bg-secondary text-secondary-foreground shadow-sm hover:bg-secondary/80",
         ghost: "hover:bg-accent hover:text-accent-foreground",
-        gradient:
-          "text-white shadow-sm shadow-primary/25 bg-[linear-gradient(100deg,#5b63f0,#9a5cf2_52%,#4fd0e6)] hover:shadow-md hover:shadow-primary/30 hover:brightness-[1.06]",
         link: "text-primary underline-offset-4 hover:underline",
       },
       size: {