Changelog

Added

• Connections in .vscode/sftp.json, validated by a schema, with comments allowed the way VS Code's own .vscode files allow them. A connection is a name, a server (a Host alias from ssh config, or a host and port), a user, an authentication mode, a root path and a host key policy. Secrets never go in the file: passwords and passphrases are kept in the OS keychain, keyed by connection, user and host, so changing the user or the host on a connection asks again rather than reusing the old secret. Heimdall: Forget Saved Password / Passphrase clears everything saved for a connection.
• ~/.ssh/config and the SSH agent. A connection that names a Host alias takes HostName, Port, User, IdentityFile, IdentityAgent and ProxyJump from the config, following Include, with multi-hop jump chains dialled in order and each hop's host key checked. Explicit fields on the connection override. Match exec is never evaluated. The config read is the one Remote-SSH is pointed at (remote.SSH.configFile) unless heimdall.sshConfigPath says otherwise.
• Key pair and password authentication. A passphrase-protected key prompts once and can be remembered; a rejected password or passphrase is asked again, up to three times, and cancelling leaves the connection idle rather than in error.
• Host key checking against known_hosts, the same file ssh uses, including hashed hosts, wildcards, negation and @revoked lines. Policies: strict (the key must already be known), accept-new (the default: unknown keys are added, changed keys refused), ask (a modal shows the key type and SHA256 fingerprint), and off. A changed key is refused in every mode except off.
• The sftp:// file system. Every file under a connection is sftp://<connection>/<absolute path> and opens, edits, saves, reverts and shows dirty state like a local file; other extensions read it through the provider. Directories list with symbolic links flagged; rename, delete (recursive) and create work from any surface that uses the file system API.
• The Heimdall view in the activity bar: one node per connection with its state (idle, connecting, connected, error with the message, disabled), the server's directories beneath the root path, directories first. Refresh on a folder or a connection; a refresh on a broken connection reconnects. Connect, Reconnect, Disconnect and Test Connection on the node. Nothing dials until a node is expanded or a file is opened.
• Save conflicts. Saving a file someone else changed on the server since it was opened is refused: VS Code's own Compare and Overwrite notification appears, driven by the server mtime Heimdall reports, and the provider refuses stale writes that reach it by other routes. Heimdall: Show Diff with Server opens a diff against a fresh server read, Overwrite on Server writes the editor's copy and reloads it, and Reload from Server reverts to the server's copy.
• The connection editor, in its own compact floating window like Tablecloth's dialogs (or as an editor tab with heimdall.dialogs.openIn): the connections on the left with Add, Remove, Duplicate and Import; a form on the right with the Host aliases from ssh config offered as you type and hints saying what the config will supply; Test Connection on the unsaved values; and a folder pick in multi-root workspaces. Saves edit sftp.json in place and keep its comments.
• Import Connections from SSH Config…: every concrete Host alias in the config in a multi-select pick, aliases already imported shown as such, each becoming a connection with root path /.
• Open in Terminal on a connection, a folder or a file: an ssh session using the connection's alias or host, port, user, key, config file, host key policy and known_hosts, landed in that directory with the login shell.
• Settings heimdall.sshConfigPath, heimdall.knownHostsPath, heimdall.connectTimeout and heimdall.dialogs.openIn.

Known limits

• SFTP has no change notifications, so a change on the server is noticed at save time, and mtimes are whole seconds.
• A file is read whole; there is no size guard yet.
• Find in Files does not see a connection that is not a workspace folder.