diff --git a/Cargo.lock b/Cargo.lock
index e8f033f77c..7947e54309 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1694,6 +1694,7 @@ dependencies = [
  "tauri-plugin-single-instance",
  "tauri-plugin-updater",
  "tauri-plugin-window-state",
+ "tempfile",
  "tiberius",
  "tokio",
  "tokio-postgres",
diff --git a/apps/desktop/src/components/connection/ConnectionDialog.vue b/apps/desktop/src/components/connection/ConnectionDialog.vue
index 3dbf3694a9..f4e9e64696 100644
--- a/apps/desktop/src/components/connection/ConnectionDialog.vue
+++ b/apps/desktop/src/components/connection/ConnectionDialog.vue
@@ -120,7 +120,17 @@ import VisibleSchemasDialog from "@/components/sidebar/VisibleSchemasDialog.vue"
 import CloudflareD1ConnectionFields from "@/components/connection/CloudflareD1ConnectionFields.vue";
 import PluginConnectionFields from "@/components/plugins/PluginConnectionFields.vue";
 import PluginIcon from "@/components/plugins/PluginIcon.vue";
-import { buildPluginConnectionConfig, createFrontendPluginRegistry, parsePluginConnectionProviderOptionValue, pluginConnectionActionsForDialog, pluginConnectionFormValues, pluginConnectionProviderIcon, pluginConnectionProviderOptionValue } from "@/lib/plugins/frontendPlugin";
+import {
+  buildPluginConnectionConfig,
+  createFrontendPluginRegistry,
+  parsePluginConnectionProviderOptionValue,
+  pluginConnectionActionsForDialog,
+  pluginConnectionFormValues,
+  pluginConnectionProviderIcon,
+  pluginConnectionProviderOptionValue,
+  pluginFormFieldRequired,
+  pluginFormFieldVisible,
+} from "@/lib/plugins/frontendPlugin";
 import type { PluginCenterFocus } from "@/lib/plugins/pluginCenterNavigation";
 import { oceanbaseModeConnectionPatch, oceanbaseSubModeFromConfig } from "@/lib/database/oceanbaseConnectionMode";
 import { translateBackendError } from "@/i18n/backend-errors";
@@ -3308,6 +3318,16 @@ function pluginFieldHasValue(field: PluginFormField): boolean {
   return typeof value === "string" ? value.trim().length > 0 : value !== undefined;
 }
 
+function currentPluginFormValues(): Record<string, PluginFormFieldValue> {
+  const values = { ...pluginFormValues.value };
+  const provider = selectedPluginProvider.value?.contribution;
+  if (!provider) return values;
+  for (const field of provider.fields) {
+    if (field.binding === "name") values[field.key] = form.value.name;
+  }
+  return values;
+}
+
 function pluginActionLabel(action: PluginConnectionAction): string {
   if (action.label) return action.label;
   if (action.kind === "test") return t("connection.test");
@@ -3361,7 +3381,9 @@ function applyPluginActionFieldValues(values: Record<string, PluginFormFieldValu
 const hasRequiredConnectionTarget = computed(() => {
   if (isPluginConnection.value) {
     const entry = selectedPluginProvider.value;
-    return !!entry && entry.contribution.fields.every((field) => !field.required || pluginFieldHasValue(field));
+    if (!entry) return false;
+    const values = currentPluginFormValues();
+    return entry.contribution.fields.every((field) => !pluginFormFieldRequired(entry.contribution, field, values) || pluginFieldHasValue(field));
   }
   if (form.value.db_type === "mq") {
     if (mqSystemKind.value === "kafka") return mqKafkaConnectionSource.value === "zookeeper" ? !!mqKafkaZooKeeperServers.value.trim() : !!mqKafkaBootstrapServers.value.trim();
@@ -3672,7 +3694,8 @@ function connectionConfigForSubmit(id: string, generatedName = "", validatePlugi
     const entry = selectedPluginProvider.value;
     if (!entry) throw new Error(pluginLoadError.value || t("connection.pluginProviderUnavailable"));
     if (validatePluginRequired) {
-      const missingField = entry.contribution.fields.find((field) => field.required && !pluginFieldHasValue(field));
+      const values = currentPluginFormValues();
+      const missingField = entry.contribution.fields.find((field) => pluginFormFieldVisible(entry.contribution, field, values) && pluginFormFieldRequired(entry.contribution, field, values) && !pluginFieldHasValue(field));
       if (missingField) throw new Error(t("connection.pluginRequiredField", { field: missingField.label }));
     }
     const values = { ...pluginFormValues.value };
diff --git a/apps/desktop/src/components/layout/AppDialogs.vue b/apps/desktop/src/components/layout/AppDialogs.vue
index 9522c9e363..5d743f5156 100644
--- a/apps/desktop/src/components/layout/AppDialogs.vue
+++ b/apps/desktop/src/components/layout/AppDialogs.vue
@@ -17,6 +17,7 @@ const FieldLineageDialog = defineAsyncComponent(() => import("@/components/linea
 const ConfigPassphraseDialog = defineAsyncComponent(() => import("@/components/config/ConfigPassphraseDialog.vue"));
 const DatabaseSearchDialog = defineAsyncComponent(() => import("@/components/search/DatabaseSearchDialog.vue"));
 const SshHostKeyPromptDialog = defineAsyncComponent(() => import("@/components/ssh/SshHostKeyPromptDialog.vue"));
+const PluginConnectionChallengeDialog = defineAsyncComponent(() => import("@/components/plugins/PluginConnectionChallengeDialog.vue"));
 const DatabaseExportDialog = defineAsyncComponent(() => import("@/components/export/DatabaseExportDialog.vue"));
 const DataGenerateDialog = defineAsyncComponent(() => import("@/components/generate/DataGenerateDialog.vue"));
 import { useConnectionStore } from "@/stores/connectionStore";
@@ -280,4 +281,5 @@ watch(
     </DialogContent>
   </Dialog>
   <SshHostKeyPromptDialog />
+  <PluginConnectionChallengeDialog />
 </template>
diff --git a/apps/desktop/src/components/layout/ContentArea.vue b/apps/desktop/src/components/layout/ContentArea.vue
index 8378e39554..a37b9c63b4 100644
--- a/apps/desktop/src/components/layout/ContentArea.vue
+++ b/apps/desktop/src/components/layout/ContentArea.vue
@@ -1983,7 +1983,15 @@ defineExpose({ focusSearch, refreshData, refreshQueryEditorCompletionCache, hand
 
     <template v-else-if="activeTab.mode === 'plugin-workbench' && activeTab.pluginWorkbench">
       <div class="flex-1 min-h-0">
-        <PluginWorkbenchTab :key="activeTab.id" :plugin-id="activeTab.pluginWorkbench.pluginId" :contribution-id="activeTab.pluginWorkbench.contributionId" :context="activeTab.pluginWorkbench.context" />
+        <PluginWorkbenchTab
+          :key="activeTab.id"
+          :tab-id="activeTab.id"
+          :plugin-id="activeTab.pluginWorkbench.pluginId"
+          :contribution-id="activeTab.pluginWorkbench.contributionId"
+          :context="activeTab.pluginWorkbench.context"
+          :state="activeTab.pluginWorkbench.state"
+          :restored="activeTab.pluginWorkbench.restored"
+        />
       </div>
     </template>
     <template v-else-if="activeTab.mode === 'plugin-filesystem' && activeTab.pluginFilesystem">
diff --git a/apps/desktop/src/components/plugins/PluginConnectionChallengeDialog.vue b/apps/desktop/src/components/plugins/PluginConnectionChallengeDialog.vue
new file mode 100644
index 0000000000..3746268433
--- /dev/null
+++ b/apps/desktop/src/components/plugins/PluginConnectionChallengeDialog.vue
@@ -0,0 +1,103 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, onMounted, ref } from "vue";
+import { useI18n } from "vue-i18n";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import * as api from "@/lib/backend/api";
+import type { PluginEvent } from "@/types/database";
+import {
+  parsePluginConnectionChallenge,
+  pluginConnectionChallengeKey,
+  PLUGIN_CONNECTION_CHALLENGE_RESOLVE_METHOD,
+  type PluginConnectionChallenge,
+} from "@/lib/plugins/pluginConnectionChallenge";
+
+const { t } = useI18n();
+const queue = ref<PluginConnectionChallenge[]>([]);
+const current = computed(() => queue.value[0] ?? null);
+const visible = computed({
+  get: () => current.value !== null,
+  set: (open) => {
+    if (!open) void resolve(false);
+  },
+});
+const remember = ref(true);
+const resolving = ref(false);
+const seen = new Set<string>();
+let unsubscribe: (() => void) | undefined;
+let mounted = true;
+
+onMounted(async () => {
+  const stop = await api.subscribePluginEvents((event: PluginEvent) => {
+    const challenge = parsePluginConnectionChallenge(event);
+    if (!challenge) return;
+    const key = pluginConnectionChallengeKey(challenge);
+    if (seen.has(key)) return;
+    seen.add(key);
+    queue.value.push(challenge);
+  });
+  if (!mounted) stop();
+  else unsubscribe = stop;
+});
+
+onBeforeUnmount(() => {
+  mounted = false;
+  unsubscribe?.();
+});
+
+async function resolve(accept: boolean) {
+  const challenge = current.value;
+  if (!challenge || resolving.value) return;
+  resolving.value = true;
+  try {
+    await api.invokePlugin(challenge.pluginId, PLUGIN_CONNECTION_CHALLENGE_RESOLVE_METHOD, {
+      operationId: challenge.operationId,
+      challengeId: challenge.challengeId,
+      accept,
+      remember: accept && remember.value,
+    });
+  } catch (error) {
+    console.error("[DBX] failed to resolve plugin connection challenge:", error);
+  } finally {
+    seen.delete(pluginConnectionChallengeKey(challenge));
+    if (queue.value[0] === challenge) queue.value.shift();
+    else queue.value = queue.value.filter((item) => item !== challenge);
+    remember.value = true;
+    resolving.value = false;
+  }
+}
+</script>
+
+<template>
+  <Dialog v-model:open="visible">
+    <DialogContent class="sm:max-w-[460px]" :show-close-button="false" @interact-outside.prevent @escape-key-down.prevent>
+      <DialogHeader>
+        <DialogTitle>{{ current?.title || t("connection.sshHostKeyVerifyTitle") }}</DialogTitle>
+        <DialogDescription>{{ current?.message || t("connection.sshHostKeyVerifyMessage", { host: current?.host || "", port: current?.port || "" }) }}</DialogDescription>
+      </DialogHeader>
+      <div v-if="current" class="space-y-3 py-1">
+        <div class="rounded-md border border-border bg-muted/40 p-3 text-sm">
+          <div v-if="current.host" class="flex items-center justify-between gap-3">
+            <span class="text-muted-foreground">{{ current.host }}{{ current.port ? `:${current.port}` : "" }}</span>
+          </div>
+          <div class="mt-2 flex items-center justify-between gap-3">
+            <span class="text-muted-foreground">{{ t("connection.sshHostKeyVerifyKeyType") }}</span>
+            <span class="font-medium">{{ current.keyType || "—" }}</span>
+          </div>
+          <div class="mt-2 flex items-start justify-between gap-3">
+            <span class="shrink-0 text-muted-foreground">{{ t("connection.sshHostKeyVerifyFingerprint") }}</span>
+            <span class="break-all text-right font-mono text-xs font-medium">{{ current.fingerprint }}</span>
+          </div>
+        </div>
+        <label class="flex items-center gap-2 text-sm">
+          <input v-model="remember" type="checkbox" class="h-4 w-4 rounded border-border accent-primary" />
+          <span>{{ t("connection.sshHostKeyVerifyRemember") }}</span>
+        </label>
+      </div>
+      <DialogFooter>
+        <Button variant="outline" :disabled="resolving" @click="resolve(false)">{{ t("connection.sshHostKeyVerifyReject") }}</Button>
+        <Button :disabled="resolving" @click="resolve(true)">{{ t("connection.sshHostKeyVerifyAccept") }}</Button>
+      </DialogFooter>
+    </DialogContent>
+  </Dialog>
+</template>
diff --git a/apps/desktop/src/components/plugins/PluginConnectionFields.vue b/apps/desktop/src/components/plugins/PluginConnectionFields.vue
index 57bc128727..90df6cf021 100644
--- a/apps/desktop/src/components/plugins/PluginConnectionFields.vue
+++ b/apps/desktop/src/components/plugins/PluginConnectionFields.vue
@@ -6,6 +6,7 @@ import { Label } from "@/components/ui/label";
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
 import { Switch } from "@/components/ui/switch";
 import type { PluginConnectionProviderContribution, PluginFormField, PluginFormFieldBinding, PluginFormFieldValue } from "@/types/database";
+import { isTauriRuntime } from "@/lib/backend/tauriRuntime";
 
 const props = defineProps<{
   contribution: PluginConnectionProviderContribution;
@@ -19,7 +20,15 @@ const emit = defineEmits<{
 }>();
 
 const formValues = computed(() => props.modelValue);
-const visibleFields = computed(() => props.contribution.fields.filter((field) => !field.binding || !props.hiddenBindings?.includes(field.binding)));
+const visibleFields = computed(() =>
+  props.contribution.fields.filter((field) => {
+    if (field.binding && props.hiddenBindings?.includes(field.binding)) return false;
+    if (!field.visible_when) return true;
+    const source = props.contribution.fields.find((candidate) => candidate.key === field.visible_when?.field);
+    const value = formValues.value[field.visible_when.field] ?? source?.default;
+    return field.visible_when.one_of.some((candidate) => candidate === value);
+  }),
+);
 const isConnectionDialogLayout = computed(() => props.layout === "connection-dialog");
 
 function fieldValue(field: PluginFormField): PluginFormFieldValue {
@@ -59,6 +68,21 @@ function defaultValueFor(field: PluginFormField): PluginFormFieldValue {
   if (field.type === "number") return undefined;
   return "";
 }
+
+function fieldRequired(field: PluginFormField): boolean {
+  if (field.required) return true;
+  if (!field.required_when) return false;
+  const source = props.contribution.fields.find((candidate) => candidate.key === field.required_when?.field);
+  const value = formValues.value[field.required_when.field] ?? source?.default;
+  return field.required_when.one_of.some((candidate) => candidate === value);
+}
+
+async function browsePath(field: PluginFormField) {
+  if (!isTauriRuntime()) return;
+  const { open } = await import("@tauri-apps/plugin-dialog");
+  const selected = await open({ multiple: false });
+  if (typeof selected === "string") updateField(field, selected);
+}
 </script>
 
 <template>
@@ -75,10 +99,14 @@ function defaultValueFor(field: PluginFormField): PluginFormFieldValue {
     <div v-for="field in visibleFields" :key="field.key" :class="isConnectionDialogLayout ? 'col-span-full grid grid-cols-4 items-start gap-4' : 'space-y-1.5'">
       <Label :for="fieldId(field)" :class="isConnectionDialogLayout ? 'justify-self-start pt-2 text-left' : 'text-xs'">
         {{ field.label }}
-        <span v-if="field.required" class="text-destructive">*</span>
+        <span v-if="fieldRequired(field)" class="text-destructive">*</span>
       </Label>
       <div :class="isConnectionDialogLayout ? 'col-span-3 min-w-0 space-y-1.5' : ''">
         <Input v-if="field.type === 'text' || field.type === 'number'" :id="fieldId(field)" :type="field.type === 'number' ? 'number' : 'text'" :model-value="fieldValue(field) as string | number | undefined" :placeholder="field.placeholder" @update:model-value="updateTextField(field, $event)" />
+        <div v-else-if="field.type === 'path'" class="flex items-center gap-1">
+          <Input :id="fieldId(field)" class="min-w-0 flex-1" :model-value="String(fieldValue(field) ?? '')" :placeholder="field.placeholder" @update:model-value="updateField(field, String($event))" />
+          <button v-if="isTauriRuntime()" type="button" class="inline-flex h-9 shrink-0 items-center rounded-md border border-input bg-background px-3 text-xs hover:bg-accent" @click="browsePath(field)">…</button>
+        </div>
         <PasswordInput v-else-if="field.type === 'password'" :id="fieldId(field)" :model-value="String(fieldValue(field) ?? '')" :placeholder="field.placeholder" @update:model-value="updateField(field, $event)" />
         <textarea
           v-else-if="field.type === 'textarea'"
diff --git a/apps/desktop/src/components/plugins/PluginWorkbenchHost.vue b/apps/desktop/src/components/plugins/PluginWorkbenchHost.vue
index f6167d9622..0a3d7ddf26 100644
--- a/apps/desktop/src/components/plugins/PluginWorkbenchHost.vue
+++ b/apps/desktop/src/components/plugins/PluginWorkbenchHost.vue
@@ -5,6 +5,9 @@ import * as api from "@/lib/backend/api";
 import { PluginHostBridge, pluginSandboxDocument, type PluginWorkbenchContext } from "@/lib/plugins/pluginHostBridge";
 import type { InstalledPlugin, PluginWorkbenchContribution } from "@/types/database";
 import { useI18n } from "vue-i18n";
+import { useSettingsStore } from "@/stores/settingsStore";
+import { useTheme } from "@/composables/useTheme";
+import { registerPluginWorkbenchNativeFileTarget } from "@/lib/plugins/pluginWorkbenchBridgeRegistry";
 
 const props = withDefaults(
   defineProps<{
@@ -20,21 +23,51 @@ const emit = defineEmits<{
   error: [message: string];
   openWorkbench: [pluginId: string, contributionId: string, context?: PluginWorkbenchContext];
   openFilesystem: [pluginId: string, providerId: string, context?: PluginWorkbenchContext];
+  workbenchState: [state: Record<string, unknown>];
+  acknowledgeRestore: [];
 }>();
 
 const { t, locale: appLocale } = useI18n();
+const settingsStore = useSettingsStore();
+const { isDark, themePalette } = useTheme();
 const iframe = ref<HTMLIFrameElement>();
 const source = ref("");
 const loading = ref(true);
 const error = ref("");
 let bridge: PluginHostBridge | undefined;
 let unsubscribeEvents: (() => void) | undefined;
+let unregisterNativeFileTarget: (() => void) | undefined;
 let disposed = false;
 let loadGeneration = 0;
 
 const title = computed(() => `${props.plugin.manifest.name} · ${props.contribution.label}`);
 
-function createBridge() {
+function currentAppearance() {
+  const styles = getComputedStyle(document.documentElement);
+  const color = (name: string) => styles.getPropertyValue(name).trim();
+  return {
+    colorScheme: isDark.value ? ("dark" as const) : ("light" as const),
+    colors: {
+      background: color("--background"),
+      foreground: color("--foreground"),
+      muted: color("--muted"),
+      mutedForeground: color("--muted-foreground"),
+      accent: color("--accent"),
+      accentForeground: color("--accent-foreground"),
+      border: color("--border"),
+      destructive: color("--destructive"),
+    },
+    terminal: {
+      fontFamily: settingsStore.editorSettings.fontFamily,
+      fontSize: settingsStore.editorSettings.fontSize,
+    },
+    ui: {
+      fontFamily: settingsStore.editorSettings.uiFontFamily,
+    },
+  };
+}
+
+function createBridge(bridgeToken: string) {
   bridge = new PluginHostBridge(
     props.plugin,
     props.contribution,
@@ -47,8 +80,12 @@ function createBridge() {
       readAsset: api.readPluginUiAsset,
       openWorkbench: async (pluginId, contributionId, context) => emit("openWorkbench", pluginId, contributionId, context),
       openFilesystem: async (pluginId, providerId, context) => emit("openFilesystem", pluginId, providerId, context),
+      setWorkbenchState: async (state) => emit("workbenchState", state),
+      acknowledgeWorkbenchRestore: async () => emit("acknowledgeRestore"),
     },
     appLocale.value,
+    bridgeToken,
+    currentAppearance(),
   );
 }
 
@@ -62,10 +99,11 @@ async function loadWorkbench() {
     const asset = await api.readPluginUiEntry(props.plugin.manifest.id);
     if (disposed || generation !== loadGeneration) return;
     const bytes = Uint8Array.from(atob(asset.dataBase64), (character) => character.charCodeAt(0));
-    source.value = pluginSandboxDocument(new TextDecoder().decode(bytes));
+    const bridgeToken = crypto.randomUUID();
+    source.value = pluginSandboxDocument(new TextDecoder().decode(bytes), bridgeToken);
     await nextTick();
     if (disposed || generation !== loadGeneration) return;
-    createBridge();
+    createBridge(bridgeToken);
   } catch (cause) {
     if (disposed || generation !== loadGeneration) return;
     error.value = cause instanceof Error ? cause.message : String(cause);
@@ -86,6 +124,13 @@ function onFrameLoad() {
 
 onMounted(async () => {
   window.addEventListener("message", onMessage);
+  const workbenchId = typeof props.context.workbenchId === "string" ? props.context.workbenchId : "";
+  if (workbenchId) {
+    unregisterNativeFileTarget = registerPluginWorkbenchNativeFileTarget(workbenchId, {
+      acceptsNativeFileDrag: () => bridge?.acceptsNativeFileDrag() === true,
+      forwardNativeFileDrag: (type, paths) => bridge?.forwardNativeFileDrag(type, paths) ?? Promise.resolve(),
+    });
+  }
   const unsubscribe = await api.subscribePluginEvents(
     (event) => bridge?.forwardEvent(event),
     (event) => bridge?.forwardBinary(event),
@@ -99,17 +144,35 @@ onMounted(async () => {
 });
 
 watch(
-  () => [props.plugin.manifest.id, props.plugin.manifest.version, props.contribution.id, props.context, appLocale.value] as const,
+  () => [props.plugin.manifest.id, props.plugin.manifest.version, props.contribution.id] as const,
   () => void loadWorkbench(),
+);
+
+watch(appLocale, (locale) => bridge?.updateLocale(locale || "zh-CN"));
+
+watch(
+  () => props.context,
+  (context) => bridge?.updateContext(context),
+  { deep: true },
+);
+
+watch(
+  () => [isDark.value, themePalette.value, settingsStore.editorSettings.fontFamily, settingsStore.editorSettings.fontSize, settingsStore.editorSettings.uiFontFamily, settingsStore.editorSettings.customThemeColors] as const,
+  async () => {
+    await nextTick();
+    bridge?.updateAppearance(currentAppearance());
+  },
   { deep: true },
 );
 
 onBeforeUnmount(() => {
   disposed = true;
   loadGeneration += 1;
+  bridge?.dispose();
   bridge = undefined;
   window.removeEventListener("message", onMessage);
   unsubscribeEvents?.();
+  unregisterNativeFileTarget?.();
 });
 </script>
 
diff --git a/apps/desktop/src/components/plugins/PluginWorkbenchTab.vue b/apps/desktop/src/components/plugins/PluginWorkbenchTab.vue
index 1356258ca5..1b3c94184c 100644
--- a/apps/desktop/src/components/plugins/PluginWorkbenchTab.vue
+++ b/apps/desktop/src/components/plugins/PluginWorkbenchTab.vue
@@ -10,9 +10,12 @@ import { useQueryStore } from "@/stores/queryStore";
 import { useI18n } from "vue-i18n";
 
 const props = defineProps<{
+  tabId: string;
   pluginId: string;
   contributionId: string;
   context?: PluginWorkbenchContext;
+  state?: Record<string, unknown>;
+  restored?: boolean;
 }>();
 
 const { t, locale: appLocale } = useI18n();
@@ -22,6 +25,12 @@ const loading = ref(true);
 const error = ref("");
 let loadGeneration = 0;
 const entry = computed(() => createFrontendPluginRegistry(plugins.value, appLocale.value).findWorkbench(props.pluginId, props.contributionId));
+const workbenchContext = computed<PluginWorkbenchContext>(() => ({
+  ...(props.context || {}),
+  workbenchId: props.tabId,
+  restored: props.restored === true,
+  workbenchState: props.state ? JSON.parse(JSON.stringify(props.state)) : {},
+}));
 
 async function load() {
   const generation = ++loadGeneration;
@@ -58,6 +67,14 @@ function openFilesystem(pluginId: string, providerId: string, context?: PluginWo
   });
 }
 
+function updateWorkbenchState(state: Record<string, unknown>) {
+  queryStore.updatePluginWorkbenchState(props.tabId, state);
+}
+
+function acknowledgeRestore() {
+  queryStore.acknowledgePluginWorkbenchRestore(props.tabId);
+}
+
 onMounted(() => void load());
 watch(
   () => [props.pluginId, props.contributionId],
@@ -72,6 +89,6 @@ watch(
       <AlertTriangle class="mt-0.5 size-4 shrink-0" />
       <span>{{ error || t("pluginPlatform.workbenchUnavailableFallback") }}</span>
     </div>
-    <PluginWorkbenchHost v-else class="min-h-0 flex-1" :plugin="entry.plugin" :contribution="entry.contribution" :context="context" @open-workbench="openWorkbench" @open-filesystem="openFilesystem" />
+    <PluginWorkbenchHost v-else class="min-h-0 flex-1" :plugin="entry.plugin" :contribution="entry.contribution" :context="workbenchContext" @open-workbench="openWorkbench" @open-filesystem="openFilesystem" @workbench-state="updateWorkbenchState" @acknowledge-restore="acknowledgeRestore" />
   </div>
 </template>
diff --git a/apps/desktop/src/components/sidebar/SidebarTreeRuntimeHost.vue b/apps/desktop/src/components/sidebar/SidebarTreeRuntimeHost.vue
index 4adea55fee..0652c68f0b 100644
--- a/apps/desktop/src/components/sidebar/SidebarTreeRuntimeHost.vue
+++ b/apps/desktop/src/components/sidebar/SidebarTreeRuntimeHost.vue
@@ -62,7 +62,7 @@ import { useSettingsStore } from "@/stores/settingsStore";
 import { useSavedSqlStore } from "@/stores/savedSqlStore";
 import { useToast } from "@/composables/useToast";
 import { useDatabaseOptions } from "@/composables/useDatabaseOptions";
-import type { ColumnInfo, DatabaseType, TreeNode, TreeNodeType } from "@/types/database";
+import type { ColumnInfo, DatabaseType, InstalledPlugin, TreeNode, TreeNodeType } from "@/types/database";
 import * as api from "@/lib/backend/api";
 import { resolveDefaultDatabase } from "@/lib/database/defaultDatabase";
 import { connectionUsesVisibleSchemaFilter } from "@/lib/database/visibleDatabases";
@@ -276,6 +276,14 @@ const settingsStore = useSettingsStore();
 
 const savedSqlStore = useSavedSqlStore();
 
+const installedPlugins = shallowRef<InstalledPlugin[]>([]);
+void api
+  .listPlugins()
+  .then((plugins) => {
+    installedPlugins.value = plugins;
+  })
+  .catch(() => undefined);
+
 const { toast } = useToast();
 
 const { highlight } = useSqlHighlighter();
@@ -1167,6 +1175,25 @@ async function openObjectBrowser() {
   }
 }
 
+function pluginSupportsMultipleWorkbenches(connectionId: string | undefined): boolean {
+  if (!connectionId) return false;
+  const connection = connectionStore.getConfig(connectionId);
+  if (connection?.db_type !== "plugin" || !connection.plugin_id || !connection.plugin_connection_provider) return false;
+  const plugin = installedPlugins.value.find((candidate) => candidate.manifest.id === connection.plugin_id);
+  const provider = plugin?.manifest.contributions?.find((contribution) => contribution.type === "connection-provider" && contribution.id === connection.plugin_connection_provider);
+  return provider?.type === "connection-provider" && (provider.capabilities || []).includes("multiple-workbenches");
+}
+
+async function openPluginWorkbench(forceNew: boolean) {
+  const connectionId = activeNode.value.connectionId;
+  if (!connectionId) return;
+  try {
+    await queryStore.openPluginConnection(connectionId, { forceNew });
+  } catch (error: any) {
+    toast(t("connection.connectFailed", { message: translateBackendError(t, error) }), 5000);
+  }
+}
+
 async function openUserAdmin() {
   const node = activeNode.value;
   if (!node.connectionId) return;
@@ -4005,6 +4032,16 @@ function buildConnectionSidebarMenu(context: SidebarMenuFactoryContext): boolean
   if (node.type === "connection") {
     if (isConnecting.value) {
       items.push({ label: t("connection.cancelConnecting"), action: cancelConnectionAttempt, icon: X });
+    } else if (pluginSupportsMultipleWorkbenches(node.connectionId)) {
+      items.push({
+        label: t("contextMenu.openConnection"),
+        icon: Plug,
+        children: [
+          { label: t("contextMenu.openConnection"), action: () => openPluginWorkbench(false), icon: Plug },
+          { label: t("contextMenu.openNewConnection"), action: () => openPluginWorkbench(true), icon: CopyPlus },
+        ],
+      });
+      if (isConnected.value) items.push({ label: t("contextMenu.closeConnection"), action: disconnectConnection, icon: Unplug });
     } else if (!isConnected.value) {
       items.push({ label: t("contextMenu.openConnection"), action: toggle, icon: Plug });
     } else {
diff --git a/apps/desktop/src/composables/useFileDrop.ts b/apps/desktop/src/composables/useFileDrop.ts
index 4b61290c1e..f9dbe43d51 100644
--- a/apps/desktop/src/composables/useFileDrop.ts
+++ b/apps/desktop/src/composables/useFileDrop.ts
@@ -8,6 +8,7 @@ import * as api from "@/lib/backend/api";
 import type { ConnectionConfig, ExternalSqlFileVersion } from "@/types/database";
 import { detectDatabaseFileType } from "@/lib/database/databaseFileDetection";
 import { externalSqlFileOpenErrorMessage, readBrowserSqlFile } from "@/lib/sql/sqlFileOpen";
+import { forwardActivePluginNativeFileDrag } from "@/lib/plugins/pluginWorkbenchBridgeRegistry";
 
 function isSqlFilePath(path: string): boolean {
   return /\.sql$/i.test(path);
@@ -41,8 +42,12 @@ export function useFileDrop() {
       const { getCurrentWebview } = await import("@tauri-apps/api/webview");
       const webview = getCurrentWebview();
       await webview.onDragDropEvent(async (event) => {
-        if (event.payload.type !== "drop") return;
-        for (const path of event.payload.paths) {
+        const payload = event.payload;
+        const dragType = payload.type === "enter" ? "enter" : payload.type === "over" ? "over" : payload.type === "leave" ? "leave" : "drop";
+        const paths = payload.type === "drop" ? payload.paths : [];
+        if (await forwardActivePluginNativeFileDrag(queryStore.activeTabId, dragType, paths)) return;
+        if (payload.type !== "drop") return;
+        for (const path of payload.paths) {
           const name = path.split("/").pop()?.split("\\").pop() || path;
 
           const dataQuery = await getDataFileQuery(path);
diff --git a/apps/desktop/src/i18n/locales/en.ts b/apps/desktop/src/i18n/locales/en.ts
index bdfc1e24ed..1c07d2206a 100644
--- a/apps/desktop/src/i18n/locales/en.ts
+++ b/apps/desktop/src/i18n/locales/en.ts
@@ -2310,6 +2310,7 @@ export default {
   },
   contextMenu: {
     openConnection: "Open Connection",
+    openNewConnection: "New Connection",
     closeConnection: "Close Connection",
     closeDatabaseConnection: "Close Database Connection",
     deleteConnection: "Delete Connection",
diff --git a/apps/desktop/src/i18n/locales/es.ts b/apps/desktop/src/i18n/locales/es.ts
index a86ca9bef2..b65b2b86ab 100644
--- a/apps/desktop/src/i18n/locales/es.ts
+++ b/apps/desktop/src/i18n/locales/es.ts
@@ -2242,6 +2242,7 @@ export default withEnglishFallback({
   },
   contextMenu: {
     openConnection: "Abrir conexión",
+    openNewConnection: "Nueva conexión",
     closeConnection: "Cerrar conexión",
     closeDatabaseConnection: "Cerrar conexión de base de datos",
     deleteConnection: "Eliminar conexión",
diff --git a/apps/desktop/src/i18n/locales/it.ts b/apps/desktop/src/i18n/locales/it.ts
index adc03e4fff..2298a8f71f 100644
--- a/apps/desktop/src/i18n/locales/it.ts
+++ b/apps/desktop/src/i18n/locales/it.ts
@@ -2240,6 +2240,7 @@ export default withEnglishFallback({
   },
   contextMenu: {
     openConnection: "Apri Connessione",
+    openNewConnection: "Nuova connessione",
     closeConnection: "Chiudi Connessione",
     closeDatabaseConnection: "Chiudi Connessione Database",
     deleteConnection: "Elimina Connessione",
diff --git a/apps/desktop/src/i18n/locales/ja.ts b/apps/desktop/src/i18n/locales/ja.ts
index 34fb4bad84..eadc4be698 100644
--- a/apps/desktop/src/i18n/locales/ja.ts
+++ b/apps/desktop/src/i18n/locales/ja.ts
@@ -2267,6 +2267,7 @@ export default withEnglishFallback({
   },
   contextMenu: {
     openConnection: "接続を開く",
+    openNewConnection: "新しい接続",
     closeConnection: "接続を閉じる",
     closeDatabaseConnection: "データベース接続を閉じる",
     deleteConnection: "接続を削除",
diff --git a/apps/desktop/src/i18n/locales/ko.ts b/apps/desktop/src/i18n/locales/ko.ts
index 1c06edd8bb..6b115b3634 100644
--- a/apps/desktop/src/i18n/locales/ko.ts
+++ b/apps/desktop/src/i18n/locales/ko.ts
@@ -2186,6 +2186,7 @@ export default withEnglishFallback({
   },
   contextMenu: {
     openConnection: "연결 열기",
+    openNewConnection: "새 연결",
     closeConnection: "연결 닫기",
     closeDatabaseConnection: "데이터베이스 연결 닫기",
     deleteConnection: "연결 삭제",
diff --git a/apps/desktop/src/i18n/locales/pt-BR.ts b/apps/desktop/src/i18n/locales/pt-BR.ts
index 66d96c8e51..654023c795 100644
--- a/apps/desktop/src/i18n/locales/pt-BR.ts
+++ b/apps/desktop/src/i18n/locales/pt-BR.ts
@@ -2242,6 +2242,7 @@ export default withEnglishFallback({
   },
   contextMenu: {
     openConnection: "Abrir Conexão",
+    openNewConnection: "Nova conexão",
     closeConnection: "Fechar Conexão",
     closeDatabaseConnection: "Fechar Conexão do Banco de Dados",
     deleteConnection: "Excluir Conexão",
diff --git a/apps/desktop/src/i18n/locales/zh-CN.ts b/apps/desktop/src/i18n/locales/zh-CN.ts
index dcca153f98..0434f874c7 100644
--- a/apps/desktop/src/i18n/locales/zh-CN.ts
+++ b/apps/desktop/src/i18n/locales/zh-CN.ts
@@ -2301,6 +2301,7 @@ export default withEnglishFallback({
   },
   contextMenu: {
     openConnection: "打开连接",
+    openNewConnection: "新建连接",
     closeConnection: "关闭连接",
     closeDatabaseConnection: "关闭数据库连接",
     deleteConnection: "删除连接",
diff --git a/apps/desktop/src/i18n/locales/zh-TW.ts b/apps/desktop/src/i18n/locales/zh-TW.ts
index 2ec1452679..9849eb1b30 100644
--- a/apps/desktop/src/i18n/locales/zh-TW.ts
+++ b/apps/desktop/src/i18n/locales/zh-TW.ts
@@ -2241,6 +2241,7 @@ export default withEnglishFallback({
   },
   contextMenu: {
     openConnection: "開啟連線",
+    openNewConnection: "新增連線",
     closeConnection: "關閉連線",
     closeDatabaseConnection: "關閉資料庫連線",
     deleteConnection: "刪除連線",
diff --git a/apps/desktop/src/lib/__tests__/app/openTabsPersistence.spec.ts b/apps/desktop/src/lib/__tests__/app/openTabsPersistence.spec.ts
index 0b55096c3b..07ebcb3615 100644
--- a/apps/desktop/src/lib/__tests__/app/openTabsPersistence.spec.ts
+++ b/apps/desktop/src/lib/__tests__/app/openTabsPersistence.spec.ts
@@ -126,6 +126,8 @@ describe("openTabsPersistence originalSql round-trip", () => {
             providerId: "hello.connection",
             connectionType: "hello",
           },
+          state: { sessionId: "old-session" },
+          restored: false,
         },
       }),
     ]);
@@ -139,7 +141,21 @@ describe("openTabsPersistence originalSql round-trip", () => {
         providerId: "hello.connection",
         connectionType: "hello",
       },
+      state: { sessionId: "old-session" },
+      restored: true,
     });
+    const [saved] = serializeOpenTabs([
+      queryTab({
+        id: "plugin-tab",
+        mode: "plugin-workbench",
+        pluginWorkbench: {
+          pluginId: "dbx.example.hello",
+          contributionId: "dbx.example.hello.main",
+          restored: false,
+        },
+      }),
+    ]);
+    expect(saved.pluginWorkbench).not.toHaveProperty("restored");
   });
 
   it("preserves host-owned plugin filesystem navigation", () => {
diff --git a/apps/desktop/src/lib/app/openTabsPersistence.ts b/apps/desktop/src/lib/app/openTabsPersistence.ts
index 7d00788549..552eb9304d 100644
--- a/apps/desktop/src/lib/app/openTabsPersistence.ts
+++ b/apps/desktop/src/lib/app/openTabsPersistence.ts
@@ -146,7 +146,16 @@ export function serializeOpenTabs(tabs: QueryTab[]): SavedOpenTab[] {
       : {}),
     ...(tab.mode === "query" && tab.activeResultRunId !== undefined ? { activeResultRunId: tab.activeResultRunId } : {}),
     ...(tab.mode === "query" && tab.resultAutoSave ? { resultAutoSave: true } : {}),
-    ...(tab.pluginWorkbench ? { pluginWorkbench: tab.pluginWorkbench } : {}),
+    ...(tab.pluginWorkbench
+      ? {
+          pluginWorkbench: {
+            pluginId: tab.pluginWorkbench.pluginId,
+            contributionId: tab.pluginWorkbench.contributionId,
+            context: tab.pluginWorkbench.context,
+            state: tab.pluginWorkbench.state,
+          },
+        }
+      : {}),
     ...(tab.pluginFilesystem ? { pluginFilesystem: tab.pluginFilesystem } : {}),
   }));
 }
@@ -183,6 +192,7 @@ function restoreOpenTabsArray(parsed: unknown, rawActiveTabId: string | null, op
           : undefined;
       return {
         ...tab,
+        ...(tab.pluginWorkbench ? { pluginWorkbench: { ...tab.pluginWorkbench, restored: true } } : {}),
         mode,
         sql: typeof tab.sql === "string" ? tab.sql : "",
         isExecuting: false,
diff --git a/apps/desktop/src/lib/plugins/frontendPlugin.spec.ts b/apps/desktop/src/lib/plugins/frontendPlugin.spec.ts
index 1848b1cfc8..ef8ecdce2b 100644
--- a/apps/desktop/src/lib/plugins/frontendPlugin.spec.ts
+++ b/apps/desktop/src/lib/plugins/frontendPlugin.spec.ts
@@ -1,6 +1,17 @@
 import { describe, expect, it } from "vitest";
 import type { InstalledPlugin, PluginConnectionProviderContribution } from "@/types/database";
-import { buildPluginConnectionConfig, createFrontendPluginRegistry, initialPluginFormValues, parsePluginConnectionProviderOptionValue, pluginConnectionActionsForDialog, pluginConnectionFormValues, pluginConnectionProviderIcon, pluginConnectionProviderOptionValue } from "./frontendPlugin";
+import {
+  buildPluginConnectionConfig,
+  createFrontendPluginRegistry,
+  initialPluginFormValues,
+  parsePluginConnectionProviderOptionValue,
+  pluginConnectionActionsForDialog,
+  pluginConnectionFormValues,
+  pluginConnectionProviderIcon,
+  pluginConnectionProviderOptionValue,
+  pluginFormFieldRequired,
+  pluginFormFieldVisible,
+} from "./frontendPlugin";
 
 function installedPlugin(id: string, contributions: InstalledPlugin["manifest"]["contributions"] = []): InstalledPlugin {
   return {
@@ -302,4 +313,60 @@ describe("FrontendPluginRegistry", () => {
       keepalive: false,
     });
   });
+
+  it("evaluates conditional visibility and required state from current values and defaults", () => {
+    const provider: PluginConnectionProviderContribution = {
+      type: "connection-provider",
+      id: "example.ssh",
+      label: "SSH",
+      database_type: "ssh",
+      fields: [
+        {
+          key: "auth",
+          label: "Authentication",
+          type: "select",
+          default: "password",
+          options: [
+            { label: "Password", value: "password" },
+            { label: "Private key", value: "private-key" },
+          ],
+        },
+        { key: "private_key_path", label: "Private key", type: "path", visible_when: { field: "auth", one_of: ["private-key"] }, required_when: { field: "auth", one_of: ["private-key"] } },
+      ],
+    };
+    const field = provider.fields[1];
+
+    expect(pluginFormFieldVisible(provider, field, {})).toBe(false);
+    expect(pluginFormFieldRequired(provider, field, {})).toBe(false);
+    expect(pluginFormFieldVisible(provider, field, { auth: "private-key" })).toBe(true);
+    expect(pluginFormFieldRequired(provider, field, { auth: "private-key" })).toBe(true);
+  });
+
+  it("removes hidden credentials when authentication mode changes", () => {
+    const provider: PluginConnectionProviderContribution = {
+      type: "connection-provider",
+      id: "example.ssh",
+      label: "SSH",
+      database_type: "ssh",
+      fields: [
+        {
+          key: "auth",
+          label: "Authentication",
+          type: "select",
+          default: "password",
+          options: [
+            { label: "Password", value: "password" },
+            { label: "Private key", value: "private-key" },
+          ],
+        },
+        { key: "password", label: "Password", type: "password", binding: "password", visible_when: { field: "auth", one_of: ["password"] } },
+        { key: "private_key_passphrase", label: "Passphrase", type: "password", visible_when: { field: "auth", one_of: ["private-key"] } },
+      ],
+    };
+    const existing = buildPluginConnectionConfig("example.plugin", provider, { auth: "private-key", private_key_passphrase: "old-passphrase" });
+    const config = buildPluginConnectionConfig("example.plugin", provider, { auth: "password", password: "new-password", private_key_passphrase: "stale" }, existing);
+
+    expect(config.password).toBe("new-password");
+    expect(config.connection_secrets).not.toHaveProperty("private_key_passphrase");
+  });
 });
diff --git a/apps/desktop/src/lib/plugins/frontendPlugin.ts b/apps/desktop/src/lib/plugins/frontendPlugin.ts
index b0e6aa1b87..f1885e8a21 100644
--- a/apps/desktop/src/lib/plugins/frontendPlugin.ts
+++ b/apps/desktop/src/lib/plugins/frontendPlugin.ts
@@ -105,6 +105,14 @@ export function initialPluginFormValues(contribution: PluginConnectionProviderCo
   return Object.fromEntries(contribution.fields.filter((field) => field.default !== undefined).map((field) => [field.key, field.default])) as Record<string, PluginFormFieldValue>;
 }
 
+export function pluginFormFieldVisible(contribution: PluginConnectionProviderContribution, field: PluginFormField, values: Record<string, PluginFormFieldValue>): boolean {
+  return pluginFormFieldConditionMatches(contribution, field.visible_when, values);
+}
+
+export function pluginFormFieldRequired(contribution: PluginConnectionProviderContribution, field: PluginFormField, values: Record<string, PluginFormFieldValue>): boolean {
+  return pluginFormFieldVisible(contribution, field, values) && (field.required === true || (field.required_when !== undefined && pluginFormFieldConditionMatches(contribution, field.required_when, values)));
+}
+
 export function pluginConnectionFormValues(contribution: PluginConnectionProviderContribution, config?: ConnectionConfig): Record<string, PluginFormFieldValue> {
   const values = initialPluginFormValues(contribution);
   if (!config) return values;
@@ -163,7 +171,7 @@ export function buildPluginConnectionConfig(pluginId: string, contribution: Plug
     production_databases: existing?.production_databases || [],
   };
   for (const field of contribution.fields) {
-    const value = values[field.key] ?? field.default;
+    const value = pluginFormFieldVisible(contribution, field, values) ? (values[field.key] ?? field.default) : undefined;
     const binding = effectiveFieldBinding(field);
     if (binding === "config") {
       if (value === undefined) delete externalConfig[field.key];
@@ -192,6 +200,13 @@ function effectiveFieldBinding(field: PluginFormField): NonNullable<PluginFormFi
   return field.binding || (field.type === "password" ? "secret" : "config");
 }
 
+function pluginFormFieldConditionMatches(contribution: PluginConnectionProviderContribution, condition: PluginFormField["visible_when"], values: Record<string, PluginFormFieldValue>): boolean {
+  if (!condition) return true;
+  const referencedField = contribution.fields.find((field) => field.key === condition.field);
+  const value = values[condition.field] ?? referencedField?.default;
+  return condition.one_of.some((candidate) => Object.is(candidate, value));
+}
+
 function normalizeFrontendPlugin(plugin: InstalledPlugin, locale: string): FrontendPluginDefinition {
   const localization = pluginLocalization(plugin, locale);
   const localizedPlugin = localizePluginMetadata(plugin, localization);
diff --git a/apps/desktop/src/lib/plugins/pluginClipboardPermission.spec.ts b/apps/desktop/src/lib/plugins/pluginClipboardPermission.spec.ts
new file mode 100644
index 0000000000..3f45519cfc
--- /dev/null
+++ b/apps/desktop/src/lib/plugins/pluginClipboardPermission.spec.ts
@@ -0,0 +1,25 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { requestPluginClipboardReadGrant, resetPluginClipboardReadGrantsForTests } from "./pluginClipboardPermission";
+
+describe("plugin clipboard read grants", () => {
+  afterEach(() => {
+    resetPluginClipboardReadGrantsForTests();
+    vi.unstubAllGlobals();
+  });
+
+  it("asks once per plugin for the current process after approval", async () => {
+    const confirm = vi.fn().mockReturnValue(true);
+    vi.stubGlobal("confirm", confirm);
+    await expect(requestPluginClipboardReadGrant("one", "One")).resolves.toBe(true);
+    await expect(requestPluginClipboardReadGrant("one", "One")).resolves.toBe(true);
+    expect(confirm).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not read after a refusal and asks again on a later request", async () => {
+    const confirm = vi.fn().mockReturnValue(false);
+    vi.stubGlobal("confirm", confirm);
+    await expect(requestPluginClipboardReadGrant("one", "One")).resolves.toBe(false);
+    await expect(requestPluginClipboardReadGrant("one", "One")).resolves.toBe(false);
+    expect(confirm).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/apps/desktop/src/lib/plugins/pluginClipboardPermission.ts b/apps/desktop/src/lib/plugins/pluginClipboardPermission.ts
new file mode 100644
index 0000000000..b6173cadae
--- /dev/null
+++ b/apps/desktop/src/lib/plugins/pluginClipboardPermission.ts
@@ -0,0 +1,22 @@
+const readGrants = new Set<string>();
+const pending = new Map<string, Promise<boolean>>();
+
+export async function requestPluginClipboardReadGrant(pluginId: string, pluginName: string): Promise<boolean> {
+  if (readGrants.has(pluginId)) return true;
+  const existing = pending.get(pluginId);
+  if (existing) return existing;
+  const request = Promise.resolve().then(() => globalThis.confirm(`Allow plugin “${pluginName || pluginId}” to read text from the clipboard for this DBX session?`));
+  pending.set(pluginId, request);
+  try {
+    const granted = await request;
+    if (granted) readGrants.add(pluginId);
+    return granted;
+  } finally {
+    pending.delete(pluginId);
+  }
+}
+
+export function resetPluginClipboardReadGrantsForTests(): void {
+  readGrants.clear();
+  pending.clear();
+}
diff --git a/apps/desktop/src/lib/plugins/pluginConnectionChallenge.spec.ts b/apps/desktop/src/lib/plugins/pluginConnectionChallenge.spec.ts
new file mode 100644
index 0000000000..39c6fd3ccf
--- /dev/null
+++ b/apps/desktop/src/lib/plugins/pluginConnectionChallenge.spec.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { parsePluginConnectionChallenge, pluginConnectionChallengeKey, PLUGIN_CONNECTION_CHALLENGE_EVENT } from "./pluginConnectionChallenge";
+import type { PluginEvent } from "@/types/database";
+
+function challenge(connectionId = "connection-1"): PluginEvent {
+  return {
+    pluginId: "sample.ssh",
+    method: PLUGIN_CONNECTION_CHALLENGE_EVENT,
+    params: {
+      challengeId: "challenge-1",
+      operationId: "operation-1",
+      connectionId,
+      kind: "host-key",
+      host: "server.example",
+      port: 22,
+      keyType: "ssh-ed25519",
+      fingerprint: "SHA256:sample",
+    },
+  };
+}
+
+describe("plugin connection challenges", () => {
+  it("accepts only the active plugin and connection", () => {
+    expect(parsePluginConnectionChallenge(challenge(), "sample.ssh", "connection-1")?.fingerprint).toBe("SHA256:sample");
+    expect(parsePluginConnectionChallenge(challenge("other"), "sample.ssh", "connection-1")).toBeUndefined();
+    expect(parsePluginConnectionChallenge(challenge(), "other.plugin", "connection-1")).toBeUndefined();
+  });
+
+  it("builds a global de-duplication key scoped to plugin, operation, and challenge", () => {
+    const parsed = parsePluginConnectionChallenge(challenge());
+    expect(parsed).toBeDefined();
+    expect(pluginConnectionChallengeKey(parsed!)).toBe("sample.ssh\u0000operation-1\u0000challenge-1");
+  });
+
+  it("rejects malformed operation and challenge tokens", () => {
+    const event = challenge();
+    event.params = { ...(event.params as Record<string, unknown>), operationId: "bad operation" };
+    expect(parsePluginConnectionChallenge(event)).toBeUndefined();
+  });
+});
diff --git a/apps/desktop/src/lib/plugins/pluginConnectionChallenge.ts b/apps/desktop/src/lib/plugins/pluginConnectionChallenge.ts
new file mode 100644
index 0000000000..3175fe68b6
--- /dev/null
+++ b/apps/desktop/src/lib/plugins/pluginConnectionChallenge.ts
@@ -0,0 +1,65 @@
+import type { PluginEvent } from "@/types/database";
+
+export const PLUGIN_CONNECTION_CHALLENGE_EVENT = "connection/challenge";
+export const PLUGIN_CONNECTION_CHALLENGE_RESOLVE_METHOD = "connection/challenge/resolve";
+
+export interface PluginConnectionChallenge {
+  pluginId: string;
+  challengeId: string;
+  operationId: string;
+  connectionId?: string;
+  kind: "host-key";
+  title: string;
+  message: string;
+  host?: string;
+  port?: number;
+  keyType?: string;
+  fingerprint: string;
+}
+
+export function parsePluginConnectionChallenge(event: PluginEvent, pluginId?: string, connectionId?: string): PluginConnectionChallenge | undefined {
+  if ((pluginId && event.pluginId !== pluginId) || event.method !== PLUGIN_CONNECTION_CHALLENGE_EVENT || !isRecord(event.params)) return undefined;
+  const params = event.params;
+  const challengeId = safeToken(params.challengeId, 128);
+  const operationId = safeToken(params.operationId, 128);
+  const eventConnectionId = optionalText(params.connectionId, 128);
+  const fingerprint = text(params.fingerprint, 512);
+  if (!challengeId || !operationId || !fingerprint || params.kind !== "host-key") return undefined;
+  if (connectionId && eventConnectionId && eventConnectionId !== connectionId) return undefined;
+  const port = typeof params.port === "number" && Number.isInteger(params.port) && params.port >= 1 && params.port <= 65_535 ? params.port : undefined;
+  return {
+    pluginId: event.pluginId,
+    challengeId,
+    operationId,
+    connectionId: eventConnectionId,
+    kind: "host-key",
+    title: optionalText(params.title, 160) || "Verify plugin connection",
+    message: optionalText(params.message, 2_000) || "Confirm the server identity before credentials are sent.",
+    host: optionalText(params.host, 255),
+    port,
+    keyType: optionalText(params.keyType, 128),
+    fingerprint,
+  };
+}
+
+export function pluginConnectionChallengeKey(challenge: PluginConnectionChallenge): string {
+  return `${challenge.pluginId}\u0000${challenge.operationId}\u0000${challenge.challengeId}`;
+}
+
+function text(value: unknown, maxLength: number): string | undefined {
+  if (typeof value !== "string" || !value || value.length > maxLength || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value)) return undefined;
+  return value;
+}
+
+function optionalText(value: unknown, maxLength: number): string | undefined {
+  return value === undefined ? undefined : text(value, maxLength);
+}
+
+function safeToken(value: unknown, maxLength: number): string | undefined {
+  const candidate = text(value, maxLength);
+  return candidate && /^[A-Za-z0-9._:-]+$/.test(candidate) ? candidate : undefined;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
diff --git a/apps/desktop/src/lib/plugins/pluginHostBridge.spec.ts b/apps/desktop/src/lib/plugins/pluginHostBridge.spec.ts
index 3992dc31de..bd4620586c 100644
--- a/apps/desktop/src/lib/plugins/pluginHostBridge.spec.ts
+++ b/apps/desktop/src/lib/plugins/pluginHostBridge.spec.ts
@@ -57,6 +57,118 @@ describe("PluginHostBridge", () => {
     expect(messages[0]).toMatchObject({ source: "dbx-host", type: "init", locale: "zh-CN", context: { connectionId: "connection" } });
   });
 
+  it("forwards locale changes without reloading the workbench", () => {
+    const messages: unknown[] = [];
+    const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
+    const bridge = new PluginHostBridge(plugin(), workbench, {}, () => target, {
+      invoke: vi.fn(),
+      notify: vi.fn(),
+      sendBinary: vi.fn(),
+      readAsset: vi.fn(),
+    });
+
+    bridge.updateLocale("zh-TW");
+
+    expect(messages[0]).toMatchObject({ source: "dbx-host", type: "locale", locale: "zh-TW" });
+  });
+
+  it("persists bounded workbench state only for a host.workbench plugin", async () => {
+    const messages: any[] = [];
+    const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
+    const setWorkbenchState = vi.fn();
+    const bridge = new PluginHostBridge(plugin(["host.workbench"]), workbench, { workbenchId: "tab-1" }, () => target, {
+      invoke: vi.fn(),
+      notify: vi.fn(),
+      sendBinary: vi.fn(),
+      readAsset: vi.fn(),
+      setWorkbenchState,
+    });
+
+    bridge.handleWindowMessage({
+      source: target,
+      data: { source: "dbx-plugin", version: 1, type: "request", id: "state", method: "host.workbenchState.set", params: { state: { sessionId: "session-1", terminalSequence: 42 } } },
+    } as MessageEvent);
+    await vi.waitFor(() => expect(messages).toHaveLength(1));
+
+    expect(setWorkbenchState).toHaveBeenCalledWith({ sessionId: "session-1", terminalSequence: 42 });
+    expect(messages[0]).toMatchObject({ id: "state", result: null });
+  });
+
+  it("rejects workbench state larger than 64 KiB", async () => {
+    const messages: any[] = [];
+    const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
+    const bridge = new PluginHostBridge(plugin(["host.workbench"]), workbench, {}, () => target, {
+      invoke: vi.fn(),
+      notify: vi.fn(),
+      sendBinary: vi.fn(),
+      readAsset: vi.fn(),
+      setWorkbenchState: vi.fn(),
+    });
+
+    bridge.handleWindowMessage({
+      source: target,
+      data: { source: "dbx-plugin", version: 1, type: "request", id: "large-state", method: "host.workbenchState.set", params: { state: { value: "x".repeat(64 * 1024) } } },
+    } as MessageEvent);
+    await vi.waitFor(() => expect(messages).toHaveLength(1));
+
+    expect(messages[0]).toMatchObject({ id: "large-state", error: "Workbench state exceeds the 64 KiB limit" });
+  });
+
+  it("acknowledges restored workbench state only through the owning host bridge", async () => {
+    const messages: any[] = [];
+    const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
+    const acknowledgeWorkbenchRestore = vi.fn();
+    const bridge = new PluginHostBridge(plugin(["host.workbench"]), workbench, { workbenchId: "tab-1", restored: true }, () => target, {
+      invoke: vi.fn(),
+      notify: vi.fn(),
+      sendBinary: vi.fn(),
+      readAsset: vi.fn(),
+      acknowledgeWorkbenchRestore,
+    });
+
+    bridge.handleWindowMessage({
+      source: target,
+      data: { source: "dbx-plugin", version: 1, type: "request", id: "restore", method: "host.workbenchState.acknowledgeRestore" },
+    } as MessageEvent);
+    await vi.waitFor(() => expect(messages).toHaveLength(1));
+
+    expect(acknowledgeWorkbenchRestore).toHaveBeenCalledOnce();
+    expect(messages[0]).toMatchObject({ id: "restore", result: null });
+  });
+
+  it("serializes reactive workbench context proxies before posting init", () => {
+    const messages: unknown[] = [];
+    const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
+    const reactiveContext = new Proxy({ connectionId: "proxied-connection", values: { database: "main" } }, {});
+    const bridge = new PluginHostBridge(plugin(), workbench, reactiveContext, () => target, { invoke: vi.fn(), notify: vi.fn(), sendBinary: vi.fn(), readAsset: vi.fn() });
+
+    expect(() => bridge.sendInit()).not.toThrow();
+    expect(messages[0]).toMatchObject({ context: { connectionId: "proxied-connection", values: { database: "main" } } });
+  });
+
+  it("accepts opaque WebView messages only with the current bridge token", async () => {
+    const messages: unknown[] = [];
+    const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
+    const invoke = vi.fn().mockResolvedValue({ ok: true });
+    const bridge = new PluginHostBridge(plugin(), workbench, {}, () => target, { invoke, notify: vi.fn(), sendBinary: vi.fn(), readAsset: vi.fn() }, "en", "workbench-token");
+
+    expect(
+      bridge.handleWindowMessage({
+        source: null,
+        data: { source: "dbx-plugin", version: 1, token: "wrong-token", type: "request", id: "opaque-wrong", method: "backend.invoke", params: { method: "sample/hello" } },
+      } as MessageEvent),
+    ).toBe(false);
+    expect(
+      bridge.handleWindowMessage({
+        source: null,
+        data: { source: "dbx-plugin", version: 1, token: "workbench-token", type: "request", id: "opaque", method: "backend.invoke", params: { method: "sample/hello" } },
+      } as MessageEvent),
+    ).toBe(true);
+    await vi.waitFor(() => expect(messages).toHaveLength(1));
+    expect(invoke).toHaveBeenCalledOnce();
+    expect(messages[0]).toMatchObject({ source: "dbx-host", token: "workbench-token", id: "opaque", result: { ok: true } });
+  });
+
   it("rejects privileged host calls without manifest permission", async () => {
     const messages: unknown[] = [];
     const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
@@ -128,6 +240,67 @@ describe("PluginHostBridge", () => {
     expect(messages[2]).toMatchObject({ type: "response", id: "3", result: null });
   });
 
+  it("does not forward connection challenges into the iframe", () => {
+    const messages: unknown[] = [];
+    const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
+    const bridge = new PluginHostBridge(plugin(["host.events"]), workbench, {}, () => target, {
+      invoke: vi.fn(),
+      notify: vi.fn(),
+      sendBinary: vi.fn(),
+      readAsset: vi.fn(),
+    });
+    bridge.forwardEvent({ pluginId: "sample", method: "connection/challenge", params: { operationId: "operation-1" } });
+    expect(messages).toHaveLength(0);
+  });
+
+  it("enforces sequential bounded writes for opaque local file handles", async () => {
+    const messages: any[] = [];
+    const target = { postMessage: (message: unknown) => messages.push(message) } as unknown as Window;
+    const bridge = new PluginHostBridge(plugin(["host.fileTransfer"]), workbench, {}, () => target, {
+      invoke: vi.fn(),
+      notify: vi.fn(),
+      sendBinary: vi.fn(),
+      readAsset: vi.fn(),
+    });
+    bridge.handleWindowMessage({
+      source: target,
+      data: { source: "dbx-plugin", version: 1, type: "request", id: "save", method: "host.fileTransfer.beginSave", params: { name: "backup.bin", size: 2 } },
+    } as MessageEvent);
+    await vi.waitFor(() => expect(messages).toHaveLength(1));
+    const handleId = messages[0].result.handleId;
+
+    bridge.handleWindowMessage({
+      source: target,
+      data: { source: "dbx-plugin", version: 1, type: "request", id: "write", method: "host.fileTransfer.write", params: { handleId, offset: 1, dataBase64: "AQI=" } },
+    } as MessageEvent);
+    await vi.waitFor(() => expect(messages).toHaveLength(2));
+
+    expect(messages[1]).toMatchObject({ id: "write", error: "File transfer write offset 1 does not match expected offset 0" });
+  });
+
+  it("does not allow a handle to cross workbench bridge instances", async () => {
+    const firstMessages: any[] = [];
+    const secondMessages: any[] = [];
+    const first = { postMessage: (message: unknown) => firstMessages.push(message) } as unknown as Window;
+    const second = { postMessage: (message: unknown) => secondMessages.push(message) } as unknown as Window;
+    const api = { invoke: vi.fn(), notify: vi.fn(), sendBinary: vi.fn(), readAsset: vi.fn() };
+    const firstBridge = new PluginHostBridge(plugin(["host.fileTransfer"]), workbench, {}, () => first, api);
+    const secondBridge = new PluginHostBridge(plugin(["host.fileTransfer"]), workbench, {}, () => second, api);
+    firstBridge.handleWindowMessage({
+      source: first,
+      data: { source: "dbx-plugin", version: 1, type: "request", id: "save", method: "host.fileTransfer.beginSave", params: { name: "backup.bin" } },
+    } as MessageEvent);
+    await vi.waitFor(() => expect(firstMessages).toHaveLength(1));
+
+    secondBridge.handleWindowMessage({
+      source: second,
+      data: { source: "dbx-plugin", version: 1, type: "request", id: "cancel", method: "host.fileTransfer.cancel", params: { handleId: firstMessages[0].result.handleId } },
+    } as MessageEvent);
+    await vi.waitFor(() => expect(secondMessages).toHaveLength(1));
+
+    expect(secondMessages[0]).toMatchObject({ id: "cancel", error: "File transfer handle is invalid or already closed" });
+  });
+
   it("returns delayed responses to the iframe that issued the request", async () => {
     const firstMessages: unknown[] = [];
     const secondMessages: unknown[] = [];
@@ -161,10 +334,17 @@ describe("PluginHostBridge", () => {
   });
 
   it("injects the SDK and a restrictive sandbox CSP", () => {
-    const document = pluginSandboxDocument("<html><head></head><body>Hello</body></html>");
+    const document = pluginSandboxDocument("<html><head></head><body>Hello</body></html>", "document-token");
     expect(document).toContain("window.dbxPlugin");
     expect(document).toContain("get locale() { return locale; }");
     expect(document).toContain("openFilesystem");
+    expect(document).toContain("fileTransfer");
+    expect(document).toContain("workbenchState");
+    expect(document).toContain("onAppearanceChange");
+    expect(document).toContain("onLocaleChange");
+    expect(document).toContain("clipboard");
     expect(document).toContain("connect-src 'none'");
+    expect(document).toContain('const token = "document-token"');
+    expect(document).toContain("event.source !== null && event.source !== parent");
   });
 });
diff --git a/apps/desktop/src/lib/plugins/pluginHostBridge.ts b/apps/desktop/src/lib/plugins/pluginHostBridge.ts
index 952a0199e9..99c1e47504 100644
--- a/apps/desktop/src/lib/plugins/pluginHostBridge.ts
+++ b/apps/desktop/src/lib/plugins/pluginHostBridge.ts
@@ -1,9 +1,31 @@
 import type { InstalledPlugin, PluginBinaryEvent, PluginEvent, PluginUiAssetPayload, PluginWorkbenchContribution } from "@/types/database";
+import { copyToClipboard, readTextFromClipboard } from "@/lib/common/clipboard";
+import { isTauriRuntime } from "@/lib/backend/tauriRuntime";
+import { requestPluginClipboardReadGrant } from "@/lib/plugins/pluginClipboardPermission";
 
 const PLUGIN_MESSAGE_SOURCE = "dbx-plugin";
 const HOST_MESSAGE_SOURCE = "dbx-host";
 const BRIDGE_VERSION = 1;
 const MAX_BRIDGE_PAYLOAD_BYTES = 2 * 1024 * 1024;
+const FILE_TRANSFER_CHUNK_BYTES = 256 * 1024;
+const MAX_FILE_TRANSFER_BYTES = 16 * 1024 * 1024 * 1024;
+const MAX_BUFFERED_FILE_TRANSFER_BYTES = 1024 * 1024 * 1024;
+const MAX_FILE_TRANSFER_HANDLES = 32;
+const MAX_WORKBENCH_STATE_BYTES = 64 * 1024;
+
+type LocalFileTransferHandle =
+  | { kind: "source"; file: File }
+  | { kind: "desktop-source"; name: string; size: number; contentType: string }
+  | { kind: "target"; name: string; contentType: string; expectedSize?: number; size: number; chunks: Uint8Array[] }
+  | { kind: "opfs-target"; name: string; contentType: string; expectedSize?: number; size: number; root: FileSystemDirectoryHandle; file: FileSystemFileHandle; writable: FileSystemWritableFileStream }
+  | { kind: "desktop-target"; name: string; contentType: string; expectedSize?: number; size: number };
+
+export interface PluginFileTransferFile {
+  handleId: string;
+  name: string;
+  size: number;
+  contentType: string;
+}
 
 export interface PluginWorkbenchContext {
   connectionId?: string;
@@ -13,6 +35,27 @@ export interface PluginWorkbenchContext {
   [key: string]: unknown;
 }
 
+export interface PluginAppearance {
+  colorScheme: "light" | "dark";
+  colors: {
+    background: string;
+    foreground: string;
+    muted: string;
+    mutedForeground: string;
+    accent: string;
+    accentForeground: string;
+    border: string;
+    destructive: string;
+  };
+  terminal: {
+    fontFamily: string;
+    fontSize: number;
+  };
+  ui: {
+    fontFamily: string;
+  };
+}
+
 export interface PluginHostBridgeApi {
   invoke<T = unknown>(pluginId: string, method: string, params?: unknown, timeoutMs?: number): Promise<T>;
   notify(pluginId: string, method: string, params?: unknown): Promise<void>;
@@ -20,6 +63,8 @@ export interface PluginHostBridgeApi {
   readAsset(pluginId: string, path: string): Promise<PluginUiAssetPayload>;
   openWorkbench?(pluginId: string, contributionId: string, context?: PluginWorkbenchContext): Promise<void> | void;
   openFilesystem?(pluginId: string, providerId: string, context?: PluginWorkbenchContext): Promise<void> | void;
+  setWorkbenchState?(state: Record<string, unknown>): Promise<void> | void;
+  acknowledgeWorkbenchRestore?(): Promise<void> | void;
 }
 
 interface PluginRequestMessage {
@@ -32,23 +77,40 @@ interface PluginRequestMessage {
 }
 
 export class PluginHostBridge {
+  private readonly fileTransferHandles = new Map<string, LocalFileTransferHandle>();
+
   constructor(
     private readonly plugin: InstalledPlugin,
     private readonly workbench: PluginWorkbenchContribution,
-    private readonly context: PluginWorkbenchContext,
+    private context: PluginWorkbenchContext,
     private readonly targetWindow: () => Window | null,
     private readonly api: PluginHostBridgeApi,
-    private readonly locale = "en",
+    private locale = "zh-CN",
+    private readonly bridgeToken = "",
+    private appearance?: PluginAppearance,
   ) {}
 
   handleWindowMessage(event: MessageEvent): boolean {
     const target = this.targetWindow();
-    if (!target || event.source !== target || !isRecord(event.data)) return false;
+    if (!target || (event.source !== null && event.source !== target) || !isRecord(event.data)) return false;
     if (event.data.source !== PLUGIN_MESSAGE_SOURCE || event.data.version !== BRIDGE_VERSION) return false;
+    if (this.bridgeToken && event.data.token !== this.bridgeToken) return false;
     if (event.data.type === "ready") {
       this.sendInit();
       return true;
     }
+    if (event.data.type === "fileDragState") {
+      if (this.hasPermission("host.fileTransfer")) this.postFileDragState(event.data.active === true);
+      return true;
+    }
+    if (event.data.type === "fileDrop") {
+      if (!this.hasPermission("host.fileTransfer")) return true;
+      const files = Array.isArray(event.data.files) ? event.data.files.filter((file): file is File => file instanceof File) : [];
+      void this.registerBrowserFiles(files)
+        .then((registered) => this.postFileDrop(registered))
+        .catch(() => this.postFileDragState(false));
+      return true;
+    }
     if (event.data.type !== "request" || !validRequestMessage(event.data)) return false;
     void this.handleRequest(event.data, target);
     return true;
@@ -64,11 +126,68 @@ export class PluginHostBridge {
       locale: this.locale,
       permissions: [...(this.plugin.manifest.permissions || [])],
       context: structuredCloneSafe(this.context),
+      appearance: structuredCloneSafe(this.appearance),
     });
   }
 
+  updateContext(context: PluginWorkbenchContext): void {
+    this.context = context;
+    this.post({ source: HOST_MESSAGE_SOURCE, version: BRIDGE_VERSION, type: "context", context: structuredCloneSafe(context) });
+  }
+
+  updateLocale(locale: string): void {
+    this.locale = locale || "zh-CN";
+    this.post({ source: HOST_MESSAGE_SOURCE, version: BRIDGE_VERSION, type: "locale", locale: this.locale });
+  }
+
+  updateAppearance(appearance: PluginAppearance): void {
+    this.appearance = appearance;
+    this.post({ source: HOST_MESSAGE_SOURCE, version: BRIDGE_VERSION, type: "appearance", appearance: structuredCloneSafe(appearance) });
+  }
+
+  async forwardNativeFileDrag(type: "enter" | "over" | "leave" | "drop", paths: string[] = []): Promise<void> {
+    if (!this.hasPermission("host.fileTransfer")) return;
+    if (type === "leave") {
+      this.postFileDragState(false);
+      return;
+    }
+    if (type === "enter" || type === "over") {
+      this.postFileDragState(true);
+      return;
+    }
+    try {
+      this.postFileDrop(await this.registerDesktopPaths(paths));
+    } finally {
+      this.postFileDragState(false);
+    }
+  }
+
+  acceptsNativeFileDrag(): boolean {
+    return this.hasPermission("host.fileTransfer");
+  }
+
+  dispose(): void {
+    for (const [handleId, handle] of this.fileTransferHandles) void this.cleanupHandle(handleId, handle);
+    this.fileTransferHandles.clear();
+    if (isTauriRuntime()) {
+      const owner = this.nativeOwner();
+      void invokeDesktopFileTransfer("dispose_plugin_file_transfer_workbench", owner).catch(() => undefined);
+    }
+  }
+
+  private postFileDragState(active: boolean): void {
+    this.post({ source: HOST_MESSAGE_SOURCE, version: BRIDGE_VERSION, type: "fileTransferDragState", active });
+  }
+
+  private postFileDrop(files: PluginFileTransferFile[]): void {
+    this.post({ source: HOST_MESSAGE_SOURCE, version: BRIDGE_VERSION, type: "fileTransferDrop", files });
+  }
+
   forwardEvent(event: PluginEvent): void {
     if (event.pluginId !== this.plugin.manifest.id || !this.hasPermission("host.events")) return;
+    // Connection challenges are consumed by the single host-level dialog.
+    // Never forward them into an iframe or create a per-workbench prompt.
+    if (event.method === "connection/challenge") return;
     this.post({ source: HOST_MESSAGE_SOURCE, version: BRIDGE_VERSION, type: "event", method: event.method, params: event.params });
   }
 
@@ -124,9 +243,243 @@ export class PluginHostBridge {
       await this.api.openFilesystem(this.plugin.manifest.id, requireProtocolName(input.providerId, "filesystem provider"), isRecord(input.context) ? input.context : undefined);
       return null;
     }
+    if (method === "host.workbenchState.set") {
+      this.requirePermission("host.workbench");
+      if (!this.api.setWorkbenchState) throw new Error("Host workbench state is unavailable");
+      const input = requireRecord(params, "host.workbenchState.set params");
+      const state = requireRecord(input.state, "workbench state");
+      enforceWorkbenchStateLimit(state);
+      await this.api.setWorkbenchState(structuredCloneSafe(state));
+      return null;
+    }
+    if (method === "host.workbenchState.acknowledgeRestore") {
+      this.requirePermission("host.workbench");
+      if (!this.api.acknowledgeWorkbenchRestore) throw new Error("Host workbench restore acknowledgement is unavailable");
+      await this.api.acknowledgeWorkbenchRestore();
+      return null;
+    }
+    if (method === "host.clipboard.readText") {
+      this.requirePermission("host.clipboard");
+      if (!(await requestPluginClipboardReadGrant(this.plugin.manifest.id, this.plugin.manifest.name))) throw new Error("Clipboard read permission was denied");
+      return readTextFromClipboard();
+    }
+    if (method === "host.clipboard.writeText") {
+      this.requirePermission("host.clipboard");
+      const input = requireRecord(params, "host.clipboard.writeText params");
+      if (typeof input.text !== "string") throw new Error("Clipboard text must be a string");
+      await copyToClipboard(input.text);
+      return null;
+    }
+    if (method === "host.fileTransfer.pick") {
+      this.requirePermission("host.fileTransfer");
+      const input = params === undefined ? {} : requireRecord(params, "host.fileTransfer.pick params");
+      return this.pickLocalFiles(input);
+    }
+    if (method === "host.fileTransfer.read") {
+      this.requirePermission("host.fileTransfer");
+      const input = requireRecord(params, "host.fileTransfer.read params");
+      return this.readLocalFile(input);
+    }
+    if (method === "host.fileTransfer.beginSave") {
+      this.requirePermission("host.fileTransfer");
+      const input = requireRecord(params, "host.fileTransfer.beginSave params");
+      return this.beginLocalSave(input);
+    }
+    if (method === "host.fileTransfer.write") {
+      this.requirePermission("host.fileTransfer");
+      const input = requireRecord(params, "host.fileTransfer.write params");
+      return this.writeLocalSave(input);
+    }
+    if (method === "host.fileTransfer.finish") {
+      this.requirePermission("host.fileTransfer");
+      const input = requireRecord(params, "host.fileTransfer.finish params");
+      return this.finishLocalSave(input);
+    }
+    if (method === "host.fileTransfer.cancel" || method === "host.fileTransfer.release") {
+      this.requirePermission("host.fileTransfer");
+      const input = requireRecord(params, "host.fileTransfer.cancel params");
+      const handleId = requireHandleId(input.handleId);
+      const handle = this.fileTransferHandles.get(handleId);
+      if (!handle) throw new Error("File transfer handle is invalid or already closed");
+      this.fileTransferHandles.delete(handleId);
+      await this.cleanupHandle(handleId, handle);
+      return null;
+    }
     throw new Error(`Unsupported plugin host method '${method}'`);
   }
 
+  private async pickLocalFiles(input: Record<string, unknown>): Promise<{ files: PluginFileTransferFile[] }> {
+    if (this.fileTransferHandles.size >= MAX_FILE_TRANSFER_HANDLES) throw new Error("Too many open file transfer handles");
+    const accept = input.accept === undefined ? "" : requireAcceptFilter(input.accept);
+    const multiple = input.multiple === true;
+    if (isTauriRuntime()) {
+      const files = await invokeDesktopFileTransfer<PluginFileTransferFile[]>("pick_plugin_file_transfer_sources", {
+        ...this.nativeOwner(),
+        multiple,
+      });
+      for (const file of files) this.fileTransferHandles.set(file.handleId, { kind: "desktop-source", name: file.name, size: file.size, contentType: file.contentType });
+      return { files };
+    }
+    const picker = document.createElement("input");
+    picker.type = "file";
+    picker.accept = accept;
+    picker.multiple = multiple;
+    picker.style.display = "none";
+    document.body.appendChild(picker);
+    try {
+      const files = await new Promise<File[]>((resolve) => {
+        let settled = false;
+        const finish = (selected: File[]) => {
+          if (settled) return;
+          settled = true;
+          resolve(selected);
+        };
+        picker.addEventListener("change", () => finish(Array.from(picker.files || [])), { once: true });
+        window.addEventListener("focus", () => setTimeout(() => finish(Array.from(picker.files || [])), 250), { once: true });
+        picker.click();
+      });
+      return { files: await this.registerBrowserFiles(files) };
+    } finally {
+      picker.remove();
+    }
+  }
+
+  private async readLocalFile(input: Record<string, unknown>): Promise<{ dataBase64: string; length: number; eof: boolean }> {
+    const handleId = requireHandleId(input.handleId);
+    const handle = this.fileTransferHandles.get(handleId);
+    if (!handle || (handle.kind !== "source" && handle.kind !== "desktop-source")) throw new Error("File transfer source handle is invalid or already closed");
+    const size = handle.kind === "source" ? handle.file.size : handle.size;
+    const offset = requireInteger(input.offset, "offset", 0, size);
+    const length = requireInteger(input.length, "length", 1, FILE_TRANSFER_CHUNK_BYTES);
+    let bytes: Uint8Array;
+    if (handle.kind === "source") {
+      bytes = new Uint8Array(await handle.file.slice(offset, Math.min(size, offset + length)).arrayBuffer());
+    } else {
+      return invokeDesktopFileTransfer<{ dataBase64: string; length: number; eof: boolean }>("read_plugin_file_transfer_source", {
+        ...this.nativeOwner(),
+        handleId,
+        offset,
+        length,
+      });
+    }
+    return { dataBase64: encodeBase64(bytes), length: bytes.byteLength, eof: offset + bytes.byteLength >= size };
+  }
+
+  private async beginLocalSave(input: Record<string, unknown>): Promise<{ handleId: string; chunkBytes: number }> {
+    if (this.fileTransferHandles.size >= MAX_FILE_TRANSFER_HANDLES) throw new Error("Too many open file transfer handles");
+    const name = requireDownloadName(input.name);
+    const contentType = input.contentType === undefined ? "application/octet-stream" : requireContentType(input.contentType);
+    const expectedSize = input.size === undefined ? undefined : requireInteger(input.size, "size", 0, MAX_FILE_TRANSFER_BYTES);
+    const handleId = newTransferHandleId();
+    if (isTauriRuntime()) {
+      const target = await invokeDesktopFileTransfer<{ handleId: string; chunkBytes: number } | null>("begin_plugin_file_transfer_target", {
+        ...this.nativeOwner(),
+        name,
+        expectedSize,
+      });
+      if (!target) throw new Error("Save cancelled");
+      this.fileTransferHandles.set(target.handleId, { kind: "desktop-target", name, contentType, expectedSize, size: 0 });
+      return target;
+    } else if (typeof navigator !== "undefined" && navigator.storage?.getDirectory) {
+      const root = await navigator.storage.getDirectory();
+      const file = await root.getFileHandle(`.dbx-plugin-${handleId}.part`, { create: true });
+      const writable = await file.createWritable();
+      this.fileTransferHandles.set(handleId, { kind: "opfs-target", name, contentType, expectedSize, size: 0, root, file, writable });
+    } else {
+      if (expectedSize !== undefined && expectedSize > MAX_BUFFERED_FILE_TRANSFER_BYTES) {
+        throw new Error("This browser cannot stream downloads larger than 1 GiB because private file storage is unavailable");
+      }
+      this.fileTransferHandles.set(handleId, { kind: "target", name, contentType, expectedSize, size: 0, chunks: [] });
+    }
+    return { handleId, chunkBytes: FILE_TRANSFER_CHUNK_BYTES };
+  }
+
+  private async writeLocalSave(input: Record<string, unknown>): Promise<{ written: number; nextOffset: number }> {
+    const handleId = requireHandleId(input.handleId);
+    const handle = this.fileTransferHandles.get(handleId);
+    if (!handle || !isTargetHandle(handle)) throw new Error("File transfer target handle is invalid or already closed");
+    const offset = requireInteger(input.offset, "offset", 0, MAX_FILE_TRANSFER_BYTES);
+    if (offset !== handle.size) throw new Error(`File transfer write offset ${offset} does not match expected offset ${handle.size}`);
+    const bytes = decodeBase64(requireBase64(input.dataBase64));
+    if (bytes.byteLength > FILE_TRANSFER_CHUNK_BYTES) throw new Error(`File transfer chunks are limited to ${FILE_TRANSFER_CHUNK_BYTES} bytes`);
+    if (handle.size + bytes.byteLength > MAX_FILE_TRANSFER_BYTES) throw new Error("File transfer exceeds the 16 GiB limit");
+    if (handle.expectedSize !== undefined && handle.size + bytes.byteLength > handle.expectedSize) throw new Error("File transfer write exceeds the declared size");
+    if (handle.kind === "target") {
+      if (handle.size + bytes.byteLength > MAX_BUFFERED_FILE_TRANSFER_BYTES) throw new Error("This browser cannot buffer downloads larger than 1 GiB because private file storage is unavailable");
+      handle.chunks.push(bytes);
+    } else if (handle.kind === "opfs-target") {
+      await handle.writable.write({ type: "write", position: offset, data: bytes.slice().buffer });
+    } else {
+      const nextOffset = await invokeDesktopFileTransfer<number>("write_plugin_file_transfer_target", {
+        ...this.nativeOwner(),
+        handleId,
+        offset,
+        dataBase64: encodeBase64(bytes),
+      });
+      if (nextOffset !== offset + bytes.byteLength) throw new Error("Native file transfer returned an invalid write offset");
+    }
+    handle.size += bytes.byteLength;
+    return { written: bytes.byteLength, nextOffset: handle.size };
+  }
+
+  private async finishLocalSave(input: Record<string, unknown>): Promise<null> {
+    const handleId = requireHandleId(input.handleId);
+    const handle = this.fileTransferHandles.get(handleId);
+    if (!handle || !isTargetHandle(handle)) throw new Error("File transfer target handle is invalid or already closed");
+    if (handle.expectedSize !== undefined && handle.size !== handle.expectedSize) {
+      throw new Error(`File transfer is incomplete: received ${handle.size} of ${handle.expectedSize} bytes`);
+    }
+    this.fileTransferHandles.delete(handleId);
+    if (handle.kind === "desktop-target") {
+      await invokeDesktopFileTransfer("finish_plugin_file_transfer_target", { ...this.nativeOwner(), handleId });
+    } else if (handle.kind === "opfs-target") {
+      await handle.writable.close();
+      const blob = await handle.file.getFile();
+      triggerBrowserDownload(blob, handle.name);
+      await handle.root.removeEntry(handle.file.name).catch(() => undefined);
+    } else {
+      triggerBrowserDownload(
+        new Blob(
+          handle.chunks.map((chunk) => chunk.slice().buffer as ArrayBuffer),
+          { type: handle.contentType },
+        ),
+        handle.name,
+      );
+    }
+    return null;
+  }
+
+  private async registerBrowserFiles(files: File[]): Promise<PluginFileTransferFile[]> {
+    if (this.fileTransferHandles.size + files.length > MAX_FILE_TRANSFER_HANDLES) throw new Error("Selected files exceed the open handle limit");
+    return files.map((file) => {
+      if (file.size > MAX_FILE_TRANSFER_BYTES) throw new Error(`Local file '${file.name}' exceeds the 16 GiB transfer limit`);
+      const handleId = newTransferHandleId();
+      this.fileTransferHandles.set(handleId, { kind: "source", file });
+      return { handleId, name: file.name, size: file.size, contentType: file.type || "application/octet-stream" };
+    });
+  }
+
+  private async registerDesktopPaths(paths: string[]): Promise<PluginFileTransferFile[]> {
+    if (!paths.length) return [];
+    if (this.fileTransferHandles.size + paths.length > MAX_FILE_TRANSFER_HANDLES) throw new Error("Selected files exceed the open handle limit");
+    const files = await invokeDesktopFileTransfer<PluginFileTransferFile[]>("register_dropped_plugin_file_transfer_sources", {
+      ...this.nativeOwner(),
+      paths,
+    });
+    for (const file of files) this.fileTransferHandles.set(file.handleId, { kind: "desktop-source", name: file.name, size: file.size, contentType: file.contentType });
+    return files;
+  }
+
+  private async cleanupHandle(handleId: string, handle: LocalFileTransferHandle): Promise<void> {
+    if (handle.kind === "opfs-target") {
+      await handle.writable.abort().catch(() => undefined);
+      await handle.root.removeEntry(handle.file.name).catch(() => undefined);
+    } else if (handle.kind === "desktop-target" || handle.kind === "desktop-source") {
+      await invokeDesktopFileTransfer("release_plugin_file_transfer_handle", { ...this.nativeOwner(), handleId }).catch(() => undefined);
+    }
+    this.fileTransferHandles.delete(handleId);
+  }
+
   private requirePermission(permission: string): void {
     if (!this.hasPermission(permission)) throw new Error(`Plugin has not declared permission '${permission}'`);
   }
@@ -135,36 +488,64 @@ export class PluginHostBridge {
     return (this.plugin.manifest.permissions || []).includes(permission);
   }
 
+  private nativeOwner(): { pluginId: string; workbenchId: string } {
+    const workbenchId = typeof this.context.workbenchId === "string" ? this.context.workbenchId : "";
+    if (!workbenchId) throw new Error("Plugin workbench context is missing workbenchId");
+    return { pluginId: this.plugin.manifest.id, workbenchId };
+  }
+
   private respond(target: Window, id: string, payload: { result?: unknown; error?: string }): void {
-    target.postMessage({ source: HOST_MESSAGE_SOURCE, version: BRIDGE_VERSION, type: "response", id, ...payload }, "*");
+    target.postMessage({ source: HOST_MESSAGE_SOURCE, version: BRIDGE_VERSION, token: this.bridgeToken, type: "response", id, ...payload }, "*");
   }
 
   private post(message: Record<string, unknown>): void {
-    this.targetWindow()?.postMessage(message, "*");
+    this.targetWindow()?.postMessage({ ...message, token: this.bridgeToken }, "*");
   }
 }
 
-export function pluginSandboxDocument(html: string): string {
+function isTargetHandle(handle: LocalFileTransferHandle): handle is Extract<LocalFileTransferHandle, { kind: "target" | "opfs-target" | "desktop-target" }> {
+  return handle.kind === "target" || handle.kind === "opfs-target" || handle.kind === "desktop-target";
+}
+
+async function invokeDesktopFileTransfer<T = void>(command: string, args: Record<string, unknown>): Promise<T> {
+  const { invoke } = await import("@tauri-apps/api/core");
+  return invoke<T>(command, args);
+}
+
+function triggerBrowserDownload(blob: Blob, name: string): void {
+  const url = URL.createObjectURL(blob);
+  const link = document.createElement("a");
+  link.href = url;
+  link.download = name;
+  link.rel = "noopener";
+  link.click();
+  setTimeout(() => URL.revokeObjectURL(url), 1_000);
+}
+
+export function pluginSandboxDocument(html: string, bridgeToken = ""): string {
   const csp = `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline' blob:; style-src 'unsafe-inline' blob:; img-src data: blob:; font-src data: blob:; connect-src 'none'; media-src data: blob:;">`;
-  const sdk = `<script>${pluginSdkSource()}</script>`;
+  const sdk = `<script>${pluginSdkSource(bridgeToken)}</script>`;
   const injection = `${csp}${sdk}`;
   if (/<head(?:\s[^>]*)?>/i.test(html)) return html.replace(/<head(?:\s[^>]*)?>/i, (head) => `${head}${injection}`);
   return `<!doctype html><html><head>${injection}</head><body>${html}</body></html>`;
 }
 
-function pluginSdkSource(): string {
+function pluginSdkSource(bridgeToken: string): string {
   return `(() => {
+    const token = ${JSON.stringify(bridgeToken)};
     const pending = new Map();
-    const listeners = { event: new Set(), binary: new Set(), init: new Set() };
+    const listeners = { event: new Set(), binary: new Set(), init: new Set(), appearance: new Set(), locale: new Set(), context: new Set(), fileDrag: new Set(), fileDrop: new Set() };
     let sequence = 0;
     let context;
-    let locale = 'en';
+    let appearance;
+    let locale = 'zh-CN';
+    let permissions = [];
     let resolveReady;
     const ready = new Promise((resolve) => { resolveReady = resolve; });
     const request = (method, params) => new Promise((resolve, reject) => {
       const id = String(++sequence);
       pending.set(id, { resolve, reject });
-      parent.postMessage({ source: '${PLUGIN_MESSAGE_SOURCE}', version: ${BRIDGE_VERSION}, type: 'request', id, method, params }, '*');
+      parent.postMessage({ source: '${PLUGIN_MESSAGE_SOURCE}', version: ${BRIDGE_VERSION}, token, type: 'request', id, method, params }, '*');
     });
     const decode = (value) => Uint8Array.from(atob(value), (character) => character.charCodeAt(0));
     const encode = (value) => {
@@ -176,6 +557,7 @@ function pluginSdkSource(): string {
     window.dbxPlugin = Object.freeze({
       ready,
       get context() { return context; },
+      get appearance() { return appearance; },
       get locale() { return locale; },
       request,
       invoke: (method, params, options = {}) => request('backend.invoke', { method, params, timeoutMs: options.timeoutMs }),
@@ -188,14 +570,38 @@ function pluginSdkSource(): string {
       },
       openWorkbench: (contributionId, childContext) => request('host.openWorkbench', { contributionId, context: childContext }),
       openFilesystem: (providerId, childContext) => request('host.openFilesystem', { providerId, context: childContext }),
+      workbenchState: Object.freeze({
+        set: (state) => request('host.workbenchState.set', { state }),
+        acknowledgeRestore: () => request('host.workbenchState.acknowledgeRestore'),
+      }),
+      clipboard: Object.freeze({
+        readText: () => request('host.clipboard.readText'),
+        writeText: (text) => request('host.clipboard.writeText', { text }),
+      }),
+      fileTransfer: Object.freeze({
+        pick: (options = {}) => request('host.fileTransfer.pick', options),
+        read: (handleId, offset, length = ${FILE_TRANSFER_CHUNK_BYTES}) => request('host.fileTransfer.read', { handleId, offset, length }),
+        beginSave: (options) => request('host.fileTransfer.beginSave', options),
+        write: (handleId, offset, data) => request('host.fileTransfer.write', { handleId, offset, dataBase64: typeof data === 'string' ? data : encode(data) }),
+        finish: (handleId) => request('host.fileTransfer.finish', { handleId }),
+        cancel: (handleId) => request('host.fileTransfer.cancel', { handleId }),
+        release: (handleId) => request('host.fileTransfer.release', { handleId }),
+        onDragState: (listener) => { listeners.fileDrag.add(listener); return () => listeners.fileDrag.delete(listener); },
+        onDrop: (listener) => { listeners.fileDrop.add(listener); return () => listeners.fileDrop.delete(listener); },
+      }),
       onEvent: (listener) => { listeners.event.add(listener); return () => listeners.event.delete(listener); },
       onBinary: (listener) => { listeners.binary.add(listener); return () => listeners.binary.delete(listener); },
       onInit: (listener) => { listeners.init.add(listener); if (context !== undefined) listener(context); return () => listeners.init.delete(listener); },
+      onAppearanceChange: (listener) => { listeners.appearance.add(listener); if (appearance !== undefined) listener(appearance); return () => listeners.appearance.delete(listener); },
+      onLocaleChange: (listener) => { listeners.locale.add(listener); listener(locale); return () => listeners.locale.delete(listener); },
+      onContextChange: (listener) => { listeners.context.add(listener); if (context !== undefined) listener(context); return () => listeners.context.delete(listener); },
       decodeBase64: decode,
       encodeBase64: encode,
     });
+    let initialized = false;
+    let readyTimer;
     addEventListener('message', (event) => {
-      if (event.source !== parent || !event.data || event.data.source !== '${HOST_MESSAGE_SOURCE}' || event.data.version !== ${BRIDGE_VERSION}) return;
+      if ((event.source !== null && event.source !== parent) || !event.data || event.data.source !== '${HOST_MESSAGE_SOURCE}' || event.data.version !== ${BRIDGE_VERSION} || (token && event.data.token !== token)) return;
       const message = event.data;
       if (message.type === 'response') {
         const handler = pending.get(message.id);
@@ -204,19 +610,72 @@ function pluginSdkSource(): string {
         if (message.error) handler.reject(new Error(message.error)); else handler.resolve(message.result);
       } else if (message.type === 'init') {
         context = message.context;
-        locale = typeof message.locale === 'string' ? message.locale : 'en';
-        resolveReady(context);
-        listeners.init.forEach((listener) => listener(context));
-        dispatchEvent(new CustomEvent('dbx-plugin-init', { detail: message }));
+        appearance = message.appearance;
+        locale = typeof message.locale === 'string' && message.locale ? message.locale : 'zh-CN';
+        permissions = Array.isArray(message.permissions) ? message.permissions : [];
+        if (!initialized) {
+          initialized = true;
+          if (readyTimer) clearInterval(readyTimer);
+          resolveReady(context);
+          listeners.init.forEach((listener) => listener(context));
+          dispatchEvent(new CustomEvent('dbx-plugin-init', { detail: message }));
+        }
+      } else if (message.type === 'appearance') {
+        appearance = message.appearance;
+        listeners.appearance.forEach((listener) => listener(appearance));
+        dispatchEvent(new CustomEvent('dbx-plugin-appearance', { detail: appearance }));
+      } else if (message.type === 'locale') {
+        locale = typeof message.locale === 'string' && message.locale ? message.locale : 'zh-CN';
+        listeners.locale.forEach((listener) => listener(locale));
+        dispatchEvent(new CustomEvent('dbx-plugin-locale', { detail: locale }));
+      } else if (message.type === 'context') {
+        context = message.context;
+        listeners.context.forEach((listener) => listener(context));
+        dispatchEvent(new CustomEvent('dbx-plugin-context', { detail: context }));
       } else if (message.type === 'event') {
         listeners.event.forEach((listener) => listener(message));
         dispatchEvent(new CustomEvent('dbx-plugin-event', { detail: message }));
       } else if (message.type === 'binary') {
         listeners.binary.forEach((listener) => listener(message));
         dispatchEvent(new CustomEvent('dbx-plugin-binary', { detail: message }));
+      } else if (message.type === 'fileTransferDragState') {
+        listeners.fileDrag.forEach((listener) => listener(message.active === true));
+      } else if (message.type === 'fileTransferDrop') {
+        listeners.fileDrop.forEach((listener) => listener(message.files || []));
       }
     });
-    parent.postMessage({ source: '${PLUGIN_MESSAGE_SOURCE}', version: ${BRIDGE_VERSION}, type: 'ready' }, '*');
+    const hasFileTransfer = () => permissions.includes('host.fileTransfer');
+    const hasDraggedFiles = (event) => Array.from(event.dataTransfer?.types || []).includes('Files');
+    addEventListener('dragenter', (event) => {
+      if (!hasFileTransfer() || !hasDraggedFiles(event)) return;
+      event.preventDefault();
+      event.stopImmediatePropagation();
+      parent.postMessage({ source: '${PLUGIN_MESSAGE_SOURCE}', version: ${BRIDGE_VERSION}, token, type: 'fileDragState', active: true }, '*');
+    }, true);
+    addEventListener('dragover', (event) => {
+      if (!hasFileTransfer() || !hasDraggedFiles(event)) return;
+      event.preventDefault();
+      event.stopImmediatePropagation();
+      if (event.dataTransfer) event.dataTransfer.dropEffect = 'copy';
+    }, true);
+    addEventListener('dragleave', (event) => {
+      if (!hasFileTransfer()) return;
+      event.preventDefault();
+      event.stopImmediatePropagation();
+      parent.postMessage({ source: '${PLUGIN_MESSAGE_SOURCE}', version: ${BRIDGE_VERSION}, token, type: 'fileDragState', active: false }, '*');
+    }, true);
+    addEventListener('drop', (event) => {
+      if (!hasFileTransfer() || !hasDraggedFiles(event)) return;
+      event.preventDefault();
+      event.stopImmediatePropagation();
+      parent.postMessage({ source: '${PLUGIN_MESSAGE_SOURCE}', version: ${BRIDGE_VERSION}, token, type: 'fileDrop', files: Array.from(event.dataTransfer?.files || []) }, '*');
+    }, true);
+    const signalReady = () => parent.postMessage({ source: '${PLUGIN_MESSAGE_SOURCE}', version: ${BRIDGE_VERSION}, token, type: 'ready' }, '*');
+    signalReady();
+    readyTimer = setInterval(() => {
+      if (initialized) clearInterval(readyTimer); else signalReady();
+    }, 250);
+    setTimeout(() => clearInterval(readyTimer), 10000);
   })();`;
 }
 
@@ -224,6 +683,16 @@ function validRequestMessage(value: Record<string, unknown>): value is Record<st
   return typeof value.id === "string" && value.id.length > 0 && value.id.length <= 128 && typeof value.method === "string" && value.method.length > 0 && value.method.length <= 128;
 }
 
+function enforceWorkbenchStateLimit(state: Record<string, unknown>): void {
+  let serialized: string;
+  try {
+    serialized = JSON.stringify(state);
+  } catch {
+    throw new Error("Workbench state must be JSON serializable");
+  }
+  if (new TextEncoder().encode(serialized).byteLength > MAX_WORKBENCH_STATE_BYTES) throw new Error("Workbench state exceeds the 64 KiB limit");
+}
+
 function requireRecord(value: unknown, label: string): Record<string, unknown> {
   if (!isRecord(value)) throw new Error(`${label} must be an object`);
   return value;
@@ -249,6 +718,49 @@ function requireSafeAssetPath(value: unknown): string {
   return value;
 }
 
+function requireHandleId(value: unknown): string {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(value)) throw new Error("File transfer handle is invalid");
+  return value;
+}
+
+function requireInteger(value: unknown, label: string, minimum: number, maximum: number): number {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`${label} must be an integer between ${minimum} and ${maximum}`);
+  }
+  return value;
+}
+
+function requireAcceptFilter(value: unknown): string {
+  if (typeof value !== "string" || value.length > 512 || /[\r\n<>]/.test(value)) throw new Error("File accept filter is invalid");
+  return value;
+}
+
+function requireDownloadName(value: unknown): string {
+  if (typeof value !== "string" || !value || value.length > 255 || /[\\/:*?\"<>|\u0000-\u001f]/.test(value)) throw new Error("Download file name is invalid");
+  return value;
+}
+
+function requireContentType(value: unknown): string {
+  if (typeof value !== "string" || value.length > 128 || !/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+\/-]*$/.test(value)) throw new Error("File content type is invalid");
+  return value;
+}
+
+function newTransferHandleId(): string {
+  if (typeof crypto.randomUUID === "function") return crypto.randomUUID().replaceAll("-", "");
+  const bytes = crypto.getRandomValues(new Uint8Array(24));
+  return encodeBase64(bytes).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+
+function encodeBase64(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+function decodeBase64(value: string): Uint8Array {
+  return Uint8Array.from(atob(value), (character) => character.charCodeAt(0));
+}
+
 function enforcePayloadLimit(value: unknown): void {
   if (value === undefined) return;
   const bytes = new TextEncoder().encode(JSON.stringify(value)).byteLength;
@@ -256,8 +768,18 @@ function enforcePayloadLimit(value: unknown): void {
 }
 
 function structuredCloneSafe<T>(value: T): T {
-  if (typeof structuredClone === "function") return structuredClone(value);
-  return JSON.parse(JSON.stringify(value)) as T;
+  if (value === undefined) return value;
+  if (typeof structuredClone === "function") {
+    try {
+      return structuredClone(value);
+    } catch {
+      // Vue exposes component props as reactive proxies, which are valid JSON
+      // data but cannot be passed directly to structuredClone/postMessage.
+    }
+  }
+  const serialized = JSON.stringify(value);
+  if (serialized === undefined) throw new Error("Plugin workbench context is not serializable");
+  return JSON.parse(serialized) as T;
 }
 
 function isRecord(value: unknown): value is Record<string, any> {
diff --git a/apps/desktop/src/lib/plugins/pluginWorkbenchBridgeRegistry.spec.ts b/apps/desktop/src/lib/plugins/pluginWorkbenchBridgeRegistry.spec.ts
new file mode 100644
index 0000000000..fa77c84e8d
--- /dev/null
+++ b/apps/desktop/src/lib/plugins/pluginWorkbenchBridgeRegistry.spec.ts
@@ -0,0 +1,23 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { clearPluginWorkbenchNativeFileTargetsForTests, forwardActivePluginNativeFileDrag, registerPluginWorkbenchNativeFileTarget } from "./pluginWorkbenchBridgeRegistry";
+
+describe("plugin workbench native file routing", () => {
+  beforeEach(clearPluginWorkbenchNativeFileTargetsForTests);
+
+  it("routes a drop only to the active workbench", async () => {
+    const first = vi.fn().mockResolvedValue(undefined);
+    const second = vi.fn().mockResolvedValue(undefined);
+    registerPluginWorkbenchNativeFileTarget("first", { acceptsNativeFileDrag: () => true, forwardNativeFileDrag: first });
+    registerPluginWorkbenchNativeFileTarget("second", { acceptsNativeFileDrag: () => true, forwardNativeFileDrag: second });
+
+    expect(await forwardActivePluginNativeFileDrag("second", "drop", ["selected.bin"])).toBe(true);
+    expect(first).not.toHaveBeenCalled();
+    expect(second).toHaveBeenCalledWith("drop", ["selected.bin"]);
+  });
+
+  it("falls through when the active tab is not an eligible plugin workbench", async () => {
+    registerPluginWorkbenchNativeFileTarget("plugin", { acceptsNativeFileDrag: () => false, forwardNativeFileDrag: vi.fn() });
+    expect(await forwardActivePluginNativeFileDrag("plugin", "drop", ["query.sql"])).toBe(false);
+    expect(await forwardActivePluginNativeFileDrag("query", "drop", ["query.sql"])).toBe(false);
+  });
+});
diff --git a/apps/desktop/src/lib/plugins/pluginWorkbenchBridgeRegistry.ts b/apps/desktop/src/lib/plugins/pluginWorkbenchBridgeRegistry.ts
new file mode 100644
index 0000000000..2785ad44d3
--- /dev/null
+++ b/apps/desktop/src/lib/plugins/pluginWorkbenchBridgeRegistry.ts
@@ -0,0 +1,27 @@
+export type PluginNativeFileDragType = "enter" | "over" | "leave" | "drop";
+
+export interface PluginWorkbenchNativeFileTarget {
+  acceptsNativeFileDrag(): boolean;
+  forwardNativeFileDrag(type: PluginNativeFileDragType, paths?: string[]): Promise<void>;
+}
+
+const targets = new Map<string, PluginWorkbenchNativeFileTarget>();
+
+export function registerPluginWorkbenchNativeFileTarget(workbenchId: string, target: PluginWorkbenchNativeFileTarget): () => void {
+  targets.set(workbenchId, target);
+  return () => {
+    if (targets.get(workbenchId) === target) targets.delete(workbenchId);
+  };
+}
+
+export async function forwardActivePluginNativeFileDrag(activeTabId: string | null | undefined, type: PluginNativeFileDragType, paths: string[] = []): Promise<boolean> {
+  if (!activeTabId) return false;
+  const target = targets.get(activeTabId);
+  if (!target?.acceptsNativeFileDrag()) return false;
+  await target.forwardNativeFileDrag(type, paths);
+  return true;
+}
+
+export function clearPluginWorkbenchNativeFileTargetsForTests(): void {
+  targets.clear();
+}
diff --git a/apps/desktop/src/stores/queryStore.ts b/apps/desktop/src/stores/queryStore.ts
index de64824cfa..c39c7ec7ff 100644
--- a/apps/desktop/src/stores/queryStore.ts
+++ b/apps/desktop/src/stores/queryStore.ts
@@ -1809,6 +1809,7 @@ export const useQueryStore = defineStore("query", () => {
         pluginId,
         contributionId,
         context: options.context ? structuredClone(options.context) : undefined,
+        restored: false,
       },
     };
     tabs.value.push(tab);
@@ -1816,6 +1817,20 @@ export const useQueryStore = defineStore("query", () => {
     return id;
   }
 
+  function updatePluginWorkbenchState(tabId: string, state: Record<string, unknown>) {
+    const tab = tabs.value.find((candidate) => candidate.id === tabId && candidate.mode === "plugin-workbench");
+    if (!tab?.pluginWorkbench) return;
+    const serialized = JSON.stringify(state);
+    if (new TextEncoder().encode(serialized).byteLength > 64 * 1024) throw new Error("Plugin workbench state exceeds the 64 KiB limit");
+    tab.pluginWorkbench.state = structuredClone(state);
+  }
+
+  function acknowledgePluginWorkbenchRestore(tabId: string) {
+    const tab = tabs.value.find((candidate) => candidate.id === tabId && candidate.mode === "plugin-workbench");
+    if (!tab?.pluginWorkbench) return;
+    tab.pluginWorkbench.restored = false;
+  }
+
   function openPluginFilesystem(pluginId: string, providerId: string, options: { title?: string; connectionId?: string; rootUri?: string; currentUri?: string; forceNew?: boolean } = {}) {
     if (!options.forceNew) {
       const existing = tabs.value.find((tab) => tab.mode === "plugin-filesystem" && tab.pluginFilesystem?.pluginId === pluginId && tab.pluginFilesystem?.providerId === providerId && tab.connectionId === (options.connectionId || ""));
@@ -1849,7 +1864,7 @@ export const useQueryStore = defineStore("query", () => {
     return id;
   }
 
-  async function openPluginConnection(connectionId: string) {
+  async function openPluginConnection(connectionId: string, options: { forceNew?: boolean } = {}) {
     const connectionStore = useConnectionStore();
     const connection = connectionStore.getConfig(connectionId);
     if (!connection || connection.db_type !== "plugin") throw new Error("Plugin connection config not found");
@@ -1865,10 +1880,19 @@ export const useQueryStore = defineStore("query", () => {
       return openPluginWorkbench(pluginId, workbench.contribution.id, {
         title: `${connection.name} · ${workbench.contribution.label}`,
         connectionId,
+        forceNew: options.forceNew,
         context: {
           connectionId,
           providerId,
           connectionType: connection.plugin_connection_type,
+          connection: {
+            name: connection.name,
+            host: connection.host,
+            port: connection.port,
+            username: connection.username,
+            color: connection.color,
+            readOnly: connection.read_only,
+          },
         },
       });
     }
@@ -1878,6 +1902,7 @@ export const useQueryStore = defineStore("query", () => {
     return openPluginFilesystem(pluginId, filesystem.contribution.id, {
       title: `${connection.name} · ${filesystem.contribution.label}`,
       connectionId,
+      forceNew: options.forceNew,
       rootUri: filesystem.contribution.root_uri,
     });
   }
@@ -2116,6 +2141,15 @@ export const useQueryStore = defineStore("query", () => {
     }
     const idx = tabs.value.findIndex((t) => t.id === id);
     if (idx < 0) return;
+    const closingTab = tabs.value[idx];
+    if (closingTab.mode === "plugin-workbench" && closingTab.pluginWorkbench) {
+      void api
+        .notifyPlugin(closingTab.pluginWorkbench.pluginId, "workbench/close", {
+          connectionId: closingTab.connectionId || undefined,
+          workbenchId: closingTab.id,
+        })
+        .catch(() => undefined);
+    }
     persistSavedSqlEditorPosition(tabs.value[idx]);
     clearDataGridPendingSnapshotsForTab(id);
     if (tabs.value[idx].txnSessionId) void rollbackTransaction(id);
@@ -5556,6 +5590,8 @@ export const useQueryStore = defineStore("query", () => {
     openMqttAdmin,
     openNacosAdmin,
     openPluginWorkbench,
+    updatePluginWorkbenchState,
+    acknowledgePluginWorkbenchRestore,
     openPluginFilesystem,
     openPluginConnection,
     clearNacosNavigationTarget,
diff --git a/apps/desktop/src/types/database.ts b/apps/desktop/src/types/database.ts
index 57a89a0840..72e8dee5b6 100644
--- a/apps/desktop/src/types/database.ts
+++ b/apps/desktop/src/types/database.ts
@@ -308,7 +308,7 @@ export interface PluginDriverManifest {
   database_type?: string;
 }
 
-export type PluginFormFieldType = "text" | "password" | "number" | "boolean" | "select" | "textarea";
+export type PluginFormFieldType = "text" | "path" | "password" | "number" | "boolean" | "select" | "textarea";
 export type PluginFormFieldBinding = "config" | "secret" | "name" | "host" | "port" | "username" | "password" | "database";
 
 export type PluginFormFieldValue = string | number | boolean | undefined;
@@ -318,6 +318,11 @@ export interface PluginFormFieldOption {
   value: string;
 }
 
+export interface PluginFormFieldCondition {
+  field: string;
+  one_of: PluginFormFieldValue[];
+}
+
 export interface PluginFormField {
   key: string;
   label: string;
@@ -328,9 +333,11 @@ export interface PluginFormField {
   default?: PluginFormFieldValue;
   options?: PluginFormFieldOption[];
   binding?: PluginFormFieldBinding;
+  visible_when?: PluginFormFieldCondition;
+  required_when?: PluginFormFieldCondition;
 }
 
-export type PluginConnectionCapability = "test" | "connect" | "disconnect";
+export type PluginConnectionCapability = "test" | "connect" | "disconnect" | "multiple-workbenches";
 export type PluginConnectionActionKind = "test" | "save" | "save-and-connect" | "custom";
 export type PluginConnectionActionVariant = "default" | "outline" | "secondary" | "destructive" | "ghost";
 export type PluginConnectionActionWhen = "always" | "create" | "edit";
@@ -1349,6 +1356,8 @@ export interface QueryTab {
     pluginId: string;
     contributionId: string;
     context?: Record<string, unknown>;
+    state?: Record<string, unknown>;
+    restored?: boolean;
   };
   pluginFilesystem?: {
     pluginId: string;
diff --git a/crates/dbx-core/examples/ssh_plugin_package_smoke.rs b/crates/dbx-core/examples/ssh_plugin_package_smoke.rs
new file mode 100644
index 0000000000..216c3c7c18
--- /dev/null
+++ b/crates/dbx-core/examples/ssh_plugin_package_smoke.rs
@@ -0,0 +1,414 @@
+use std::path::PathBuf;
+use std::time::Duration;
+
+use dbx_core::models::connection::ConnectionConfig;
+use dbx_core::plugins::{PluginHost, PluginInstallPolicy, PluginPackageInstaller, PluginRegistry};
+use serde_json::{json, Value};
+
+const PLUGIN_ID: &str = "io.dbx.ssh-sftp";
+const ALTERNATE_HOST_PUBLIC_KEY: &str =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEftRCmpwBkC7IEcQ0pbOudddk5ICglnh6ho+e9gwMp6";
+
+#[tokio::main]
+async fn main() {
+    if let Err(error) = run().await {
+        eprintln!("SSH plugin package smoke failed: {error}");
+        std::process::exit(1);
+    }
+}
+
+async fn run() -> Result<(), String> {
+    let mut args = std::env::args().skip(1);
+    let package =
+        args.next().map(PathBuf::from).ok_or("Usage: ssh_plugin_package_smoke <package.dbxp> [plugin-store]")?;
+    let requested_store = args.next().map(PathBuf::from);
+    let temporary_store =
+        if requested_store.is_none() { Some(tempfile::tempdir().map_err(|error| error.to_string())?) } else { None };
+    let store = requested_store
+        .unwrap_or_else(|| temporary_store.as_ref().expect("temporary store exists").path().to_path_buf());
+    let app_version = current_dbx_app_version()?;
+    let installer = PluginPackageInstaller::new(store.clone(), app_version.clone())?;
+    let installed = installer.install_file(&package, PluginInstallPolicy::LocalDevelopment)?;
+    if installed.plugin.manifest.id != PLUGIN_ID {
+        return Err(format!("Expected plugin '{PLUGIN_ID}', got '{}'", installed.plugin.manifest.id));
+    }
+    for permission in ["host.events", "host.binary", "host.filesystem", "host.fileTransfer", "host.clipboard"] {
+        if !installed.plugin.manifest.permissions.iter().any(|declared| declared == permission) {
+            return Err(format!("Packaged plugin is missing permission '{permission}'"));
+        }
+    }
+
+    let registry = PluginRegistry::new_with_app_version(store.clone(), app_version);
+    let ui = registry.read_ui_entry(PLUGIN_ID)?;
+    if ui.bytes.is_empty() || !String::from_utf8_lossy(&ui.bytes).contains("dbxPlugin") {
+        return Err("Packaged plugin UI is empty or does not use the Host API".to_string());
+    }
+
+    let host = PluginHost::new(registry);
+    let live_host = std::env::var("SSH_SMOKE_HOST").ok();
+    let target_host = live_host.as_deref().unwrap_or("127.0.0.1");
+    let target_port = std::env::var("SSH_SMOKE_PORT").ok().and_then(|value| value.parse().ok()).unwrap_or(22);
+    let target_user = std::env::var("SSH_SMOKE_USER").unwrap_or_else(|_| "smoke".to_string());
+    let target_password = std::env::var("SSH_SMOKE_PASSWORD").unwrap_or_else(|_| "not-sent-by-smoke".to_string());
+    let config: ConnectionConfig = serde_json::from_value(json!({
+        "id": "ssh-package-smoke",
+        "name": "SSH package smoke",
+        "db_type": "plugin",
+        "driver_profile": "plugin",
+        "host": target_host,
+        "port": target_port,
+        "username": target_user,
+        "password": target_password,
+        "database": null,
+        "external_config": {},
+        "plugin_id": PLUGIN_ID,
+        "plugin_connection_provider": "io.dbx.ssh-sftp.connection",
+        "plugin_connection_type": "ssh"
+    }))
+    .map_err(|error| error.to_string())?;
+
+    // connection/connect only caches the lifecycle payload. It must not open a
+    // socket or send credentials before the workbench starts a verified session.
+    let handle = host.connect_connection(&config, &config.host, config.port).await?;
+    if !handle.is_running() {
+        return Err("SSH plugin Sidecar did not remain running after connection/connect".to_string());
+    }
+    let data_dir = store.join(PLUGIN_ID).join("data");
+    if !data_dir.is_dir() {
+        return Err(format!("Plugin data directory was not created at {}", data_dir.display()));
+    }
+    if live_host.is_some() {
+        let learned_host_key = run_live_smoke(&host, &config, &data_dir).await?;
+        if learned_host_key && !data_dir.join("known_hosts").is_file() {
+            return Err("Accepted host key was not persisted in the plugin data directory".to_string());
+        }
+    }
+
+    handle.disconnect().await?;
+    host.stop_all().await;
+    println!("SSH plugin package smoke passed: install -> UI -> lifecycle -> data dir -> live SSH/SFTP -> disconnect");
+    Ok(())
+}
+
+fn current_dbx_app_version() -> Result<String, String> {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../src-tauri/Cargo.toml");
+    let contents = std::fs::read_to_string(&manifest)
+        .map_err(|error| format!("Failed to read current DBX package version from {}: {error}", manifest.display()))?;
+    contents
+        .lines()
+        .find_map(|line| line.trim().strip_prefix("version = \"").and_then(|value| value.strip_suffix('"')))
+        .map(str::to_string)
+        .ok_or_else(|| format!("Current DBX package version is missing from {}", manifest.display()))
+}
+
+async fn run_live_smoke(
+    host: &PluginHost,
+    config: &ConnectionConfig,
+    data_dir: &std::path::Path,
+) -> Result<bool, String> {
+    let mut events = host.subscribe_events();
+    let (opened, challenged) = open_session(host, &config.id, &mut events, true).await?;
+    let session_id = opened
+        .get("sessionId")
+        .and_then(Value::as_str)
+        .ok_or("SSH session result did not contain sessionId")?
+        .to_string();
+
+    host.invoke::<Value>(
+        PLUGIN_ID,
+        "ssh/terminal/resize",
+        json!({ "sessionId": session_id, "cols": 120, "rows": 40 }),
+        None,
+        Some(Duration::from_secs(5)),
+    )
+    .await?;
+    let mut binary = host.subscribe_binary();
+    let command = b"printf 'DBX_TERMINAL_OK\\n'\n";
+    let mut input = Vec::with_capacity(8 + command.len());
+    input.extend_from_slice(&1_u64.to_be_bytes());
+    input.extend_from_slice(command);
+    host.send_binary(PLUGIN_ID, &format!("ssh/terminal/in/{session_id}"), &input, None).await?;
+    tokio::time::timeout(Duration::from_secs(10), async {
+        loop {
+            let message = binary.recv().await.map_err(|error| error.to_string())?;
+            if message.channel == format!("ssh/terminal/out/{session_id}")
+                && message.data.len() >= 9
+                && message.data[9..].windows(b"DBX_TERMINAL_OK".len()).any(|window| window == b"DBX_TERMINAL_OK")
+            {
+                return Ok::<(), String>(());
+            }
+        }
+    })
+    .await
+    .map_err(|_| "Timed out waiting for terminal output".to_string())??;
+
+    let home = host
+        .invoke::<Value>(
+            PLUGIN_ID,
+            "sftp/home",
+            json!({ "sessionId": session_id }),
+            None,
+            Some(Duration::from_secs(10)),
+        )
+        .await?
+        .get("path")
+        .and_then(Value::as_str)
+        .ok_or("SFTP home response did not contain path")?
+        .to_string();
+    host.invoke::<Value>(
+        PLUGIN_ID,
+        "sftp/list",
+        json!({ "sessionId": session_id, "path": home }),
+        None,
+        Some(Duration::from_secs(10)),
+    )
+    .await?;
+
+    let remote_path = format!("{}/dbx-plugin-smoke.bin", home.trim_end_matches('/'));
+    let content = (0..(4 * 1024 * 1024)).map(|index| (index % 251) as u8).collect::<Vec<_>>();
+    upload(host, &session_id, &remote_path, &content).await?;
+    let downloaded = download(host, &session_id, &remote_path, &mut binary).await?;
+    if downloaded != content {
+        return Err("SFTP 4 MiB round-trip content mismatch".to_string());
+    }
+
+    let empty_path = format!("{}/dbx-plugin-empty.bin", home.trim_end_matches('/'));
+    upload(host, &session_id, &empty_path, &[]).await?;
+    if !download(host, &session_id, &empty_path, &mut binary).await?.is_empty() {
+        return Err("SFTP empty-file round trip returned data".to_string());
+    }
+
+    let cancelled_path = format!("{}/dbx-plugin-cancelled.bin", home.trim_end_matches('/'));
+    let cancelled = host
+        .invoke::<Value>(
+            PLUGIN_ID,
+            "sftp/upload/start",
+            json!({ "sessionId": session_id, "remotePath": cancelled_path, "size": 1024 }),
+            None,
+            Some(Duration::from_secs(5)),
+        )
+        .await?;
+    host.invoke::<Value>(
+        PLUGIN_ID,
+        "sftp/transfer/cancel",
+        json!({ "taskId": required_value_string(&cancelled, "taskId")? }),
+        None,
+        Some(Duration::from_secs(5)),
+    )
+    .await?;
+
+    for path in [&remote_path, &empty_path] {
+        host.invoke::<Value>(
+            PLUGIN_ID,
+            "sftp/delete",
+            json!({ "sessionId": session_id, "path": path, "recursive": false }),
+            None,
+            Some(Duration::from_secs(10)),
+        )
+        .await?;
+    }
+    host.invoke::<Value>(
+        PLUGIN_ID,
+        "ssh/session/close",
+        json!({ "sessionId": session_id }),
+        None,
+        Some(Duration::from_secs(5)),
+    )
+    .await?;
+
+    let known_hosts_path = data_dir.join("known_hosts");
+    let original_known_hosts = std::fs::read(&known_hosts_path).ok();
+    let host_identity =
+        if config.port == 22 { config.host.clone() } else { format!("[{}]:{}", config.host, config.port) };
+    std::fs::write(&known_hosts_path, format!("{host_identity} {ALTERNATE_HOST_PUBLIC_KEY}\n"))
+        .map_err(|error| format!("Failed to stage changed-host-key test: {error}"))?;
+    let changed_result = open_session(host, &config.id, &mut events, false).await;
+    match original_known_hosts {
+        Some(contents) => std::fs::write(&known_hosts_path, contents)
+            .map_err(|error| format!("Failed to restore known_hosts after changed-key test: {error}"))?,
+        None => match std::fs::remove_file(&known_hosts_path) {
+            Ok(()) => {}
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => return Err(format!("Failed to remove changed-key test file: {error}")),
+        },
+    }
+    match changed_result {
+        Ok((unexpected, _)) => {
+            if let Some(session_id) = unexpected.get("sessionId").and_then(Value::as_str) {
+                let _ = host
+                    .invoke::<Value>(
+                        PLUGIN_ID,
+                        "ssh/session/close",
+                        json!({ "sessionId": session_id }),
+                        None,
+                        Some(Duration::from_secs(5)),
+                    )
+                    .await;
+            }
+            return Err("Changed host key was accepted".to_string());
+        }
+        Err(error) if error.to_ascii_lowercase().contains("changed") => {}
+        Err(error) => return Err(format!("Changed host key failed for an unexpected reason: {error}")),
+    }
+
+    // The remembered key must allow another handshake without a second prompt.
+    let (reopened, _) = open_session(host, &config.id, &mut events, false).await?;
+    host.invoke::<Value>(
+        PLUGIN_ID,
+        "ssh/session/close",
+        json!({ "sessionId": required_value_string(&reopened, "sessionId")? }),
+        None,
+        Some(Duration::from_secs(5)),
+    )
+    .await?;
+    Ok(challenged)
+}
+
+async fn open_session(
+    host: &PluginHost,
+    connection_id: &str,
+    events: &mut tokio::sync::broadcast::Receiver<dbx_core::plugins::PluginEvent>,
+    allow_challenge: bool,
+) -> Result<(Value, bool), String> {
+    let open = host.invoke::<Value>(
+        PLUGIN_ID,
+        "ssh/session/open",
+        json!({ "connectionId": connection_id, "workbenchId": "ssh-package-smoke-workbench", "cols": 100, "rows": 30 }),
+        None,
+        Some(Duration::from_secs(30)),
+    );
+    tokio::pin!(open);
+    tokio::time::timeout(Duration::from_secs(30), async {
+        let mut challenged = false;
+        loop {
+            tokio::select! {
+                opened = &mut open => return opened.map(|value| (value, challenged)),
+                event = events.recv() => {
+                    let event = event.map_err(|error| error.to_string())?;
+                    if event.plugin_id != PLUGIN_ID || event.method != "connection/challenge" {
+                        continue;
+                    }
+                    if !allow_challenge {
+                        return Err("Reconnect unexpectedly requested a host-key challenge".to_string());
+                    }
+                    let challenge_id = event.params
+                        .get("challengeId")
+                        .and_then(Value::as_str)
+                        .ok_or("Host-key challenge did not contain challengeId")?;
+                    let operation_id = event.params
+                        .get("operationId")
+                        .and_then(Value::as_str)
+                        .ok_or("Host-key challenge did not contain operationId")?;
+                    host.invoke::<Value>(
+                        PLUGIN_ID,
+                        "connection/challenge/resolve",
+                        json!({ "challengeId": challenge_id, "operationId": operation_id, "accept": true, "remember": true }),
+                        None,
+                        Some(Duration::from_secs(5)),
+                    ).await?;
+                    challenged = true;
+                }
+            }
+        }
+    })
+    .await
+    .map_err(|_| "Timed out opening the SSH session".to_string())?
+}
+
+async fn upload(host: &PluginHost, session_id: &str, path: &str, content: &[u8]) -> Result<(), String> {
+    let started = host
+        .invoke::<Value>(
+            PLUGIN_ID,
+            "sftp/upload/start",
+            json!({ "sessionId": session_id, "remotePath": path, "size": content.len() }),
+            None,
+            Some(Duration::from_secs(5)),
+        )
+        .await?;
+    let task_id = required_value_string(&started, "taskId")?;
+    let chunk_size =
+        started.get("chunkSize").and_then(Value::as_u64).ok_or("Upload response did not contain chunkSize")? as usize;
+    for (index, chunk) in content.chunks(chunk_size).enumerate() {
+        let offset = index * chunk_size;
+        let mut payload = Vec::with_capacity(8 + chunk.len());
+        payload.extend_from_slice(&(offset as u64).to_be_bytes());
+        payload.extend_from_slice(chunk);
+        host.send_binary(PLUGIN_ID, &format!("sftp/upload/{task_id}"), &payload, None).await?;
+    }
+    host.invoke::<Value>(
+        PLUGIN_ID,
+        "sftp/upload/finish",
+        json!({ "taskId": task_id }),
+        None,
+        Some(Duration::from_secs(30)),
+    )
+    .await?;
+    Ok(())
+}
+
+async fn download(
+    host: &PluginHost,
+    session_id: &str,
+    path: &str,
+    binary: &mut tokio::sync::broadcast::Receiver<dbx_core::plugins::PluginBinaryMessage>,
+) -> Result<Vec<u8>, String> {
+    let started = host
+        .invoke::<Value>(
+            PLUGIN_ID,
+            "sftp/download/start",
+            json!({ "sessionId": session_id, "remotePath": path }),
+            None,
+            Some(Duration::from_secs(30)),
+        )
+        .await?;
+    let task_id = required_value_string(&started, "taskId")?.to_string();
+    let size = started.get("size").and_then(Value::as_u64).ok_or("Download response did not contain size")? as usize;
+    let mut output = vec![0_u8; size];
+    let mut offset = 0;
+    while offset < size {
+        let result = host
+            .invoke::<Value>(
+                PLUGIN_ID,
+                "sftp/download/next",
+                json!({ "taskId": task_id, "offset": offset }),
+                None,
+                Some(Duration::from_secs(10)),
+            )
+            .await?;
+        let length =
+            result.get("length").and_then(Value::as_u64).ok_or("Download chunk did not contain length")? as usize;
+        let message = tokio::time::timeout(Duration::from_secs(10), async {
+            loop {
+                let message = binary.recv().await.map_err(|error| error.to_string())?;
+                if message.channel == format!("sftp/download/{task_id}") {
+                    return Ok::<_, String>(message);
+                }
+            }
+        })
+        .await
+        .map_err(|_| "Timed out waiting for an SFTP download chunk".to_string())??;
+        if message.data.len() != 8 + length {
+            return Err("SFTP download frame length mismatch".to_string());
+        }
+        let frame_offset =
+            u64::from_be_bytes(message.data[..8].try_into().map_err(|_| "Invalid download offset")?) as usize;
+        if frame_offset != offset {
+            return Err(format!("SFTP download offset mismatch: expected {offset}, received {frame_offset}"));
+        }
+        output[offset..offset + length].copy_from_slice(&message.data[8..]);
+        offset += length;
+    }
+    host.invoke::<Value>(
+        PLUGIN_ID,
+        "sftp/download/finish",
+        json!({ "taskId": task_id }),
+        None,
+        Some(Duration::from_secs(5)),
+    )
+    .await?;
+    Ok(output)
+}
+
+fn required_value_string<'a>(value: &'a Value, key: &str) -> Result<&'a str, String> {
+    value.get(key).and_then(Value::as_str).ok_or_else(|| format!("Response did not contain {key}"))
+}
diff --git a/crates/dbx-core/src/plugins.rs b/crates/dbx-core/src/plugins.rs
index 3bce359474..2ac84d321e 100644
--- a/crates/dbx-core/src/plugins.rs
+++ b/crates/dbx-core/src/plugins.rs
@@ -41,9 +41,11 @@ pub use manifest::{
     PluginConnectionCapability, PluginConnectionProviderContribution, PluginContribution, PluginDriverManifest,
     PluginEngines, PluginEntrypoints, PluginFilesystemCapability, PluginFilesystemProviderContribution,
     PluginFormFieldBinding, PluginFormFieldDefinition, PluginFormFieldOption, PluginFormFieldType, PluginManifest,
-    PluginUiEntrypoint, PluginWorkbenchContribution, PLUGIN_CONNECTION_ACTION_METHOD, PLUGIN_CONNECTION_CONNECT_METHOD,
-    PLUGIN_CONNECTION_DISCONNECT_METHOD, PLUGIN_CONNECTION_TEST_METHOD, SUPPORTED_PLUGIN_HOST_API_VERSION,
-    SUPPORTED_PLUGIN_MANIFEST_VERSION, SUPPORTED_PLUGIN_PERMISSIONS, SUPPORTED_PLUGIN_PROTOCOL_VERSION,
+    PluginUiEntrypoint, PluginWorkbenchContribution, PLUGIN_CONNECTION_ACTION_METHOD,
+    PLUGIN_CONNECTION_CHALLENGE_EVENT_METHOD, PLUGIN_CONNECTION_CHALLENGE_RESOLVE_METHOD,
+    PLUGIN_CONNECTION_CONNECT_METHOD, PLUGIN_CONNECTION_DISCONNECT_METHOD, PLUGIN_CONNECTION_TEST_METHOD,
+    SUPPORTED_PLUGIN_HOST_API_VERSION, SUPPORTED_PLUGIN_MANIFEST_VERSION, SUPPORTED_PLUGIN_PERMISSIONS,
+    SUPPORTED_PLUGIN_PROTOCOL_VERSION,
 };
 pub use runtime::{
     PluginBinaryMessage, PluginEvent, PluginHandshake, PluginHandshakeIdentity, PluginSessionState,
diff --git a/crates/dbx-core/src/plugins/host.rs b/crates/dbx-core/src/plugins/host.rs
index adaf6efa64..cf060bd1d3 100644
--- a/crates/dbx-core/src/plugins/host.rs
+++ b/crates/dbx-core/src/plugins/host.rs
@@ -11,10 +11,20 @@ use super::{
     InstalledPlugin, PluginBinaryMessage, PluginConnectionActionContribution, PluginConnectionCapability,
     PluginConnectionProviderContribution, PluginEvent, PluginFormFieldBinding, PluginFormFieldDefinition,
     PluginFormFieldType, PluginRegistry, PluginRuntimeEnv, PluginSessionState, PluginSidecarSession,
-    PLUGIN_CONNECTION_ACTION_METHOD, PLUGIN_CONNECTION_CONNECT_METHOD, PLUGIN_CONNECTION_DISCONNECT_METHOD,
+    PLUGIN_CONNECTION_ACTION_METHOD, PLUGIN_CONNECTION_CHALLENGE_EVENT_METHOD,
+    PLUGIN_CONNECTION_CHALLENGE_RESOLVE_METHOD, PLUGIN_CONNECTION_CONNECT_METHOD, PLUGIN_CONNECTION_DISCONNECT_METHOD,
     PLUGIN_CONNECTION_TEST_METHOD,
 };
 
+#[derive(Clone)]
+struct ActivePluginOperation {
+    plugin_id: String,
+    connection_id: Option<String>,
+    challenge_id: Option<String>,
+    challenge_resolving: bool,
+    challenge_resolved: bool,
+}
+
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ActivePluginSession {
@@ -45,6 +55,7 @@ pub struct PluginConnectionHandle {
     session: Option<Arc<PluginSidecarSession>>,
     disconnect: bool,
     params: serde_json::Value,
+    host: PluginHost,
 }
 
 impl PluginConnectionHandle {
@@ -59,14 +70,15 @@ impl PluginConnectionHandle {
         if !self.disconnect || session.status().state != PluginSessionState::Running {
             return Ok(());
         }
-        let result: serde_json::Value = session
-            .invoke_with_timeout(
-                PLUGIN_CONNECTION_DISCONNECT_METHOD,
-                self.params.clone(),
-                None,
-                Some(super::PLUGIN_REQUEST_TIMEOUT),
-            )
-            .await?;
+        let mut params = self.params.clone();
+        let operation_id = self.host.begin_operation(&self.plugin_id, &mut params).await?;
+        let result = session
+            .invoke_with_timeout(PLUGIN_CONNECTION_DISCONNECT_METHOD, params, None, Some(super::PLUGIN_REQUEST_TIMEOUT))
+            .await;
+        if let Some(operation_id) = operation_id {
+            self.host.inner.active_operations.write().await.remove(&operation_id);
+        }
+        let result: serde_json::Value = result?;
         ensure_plugin_operation_succeeded(result)
     }
 }
@@ -77,6 +89,7 @@ struct PluginHostInner {
     activation_lock: Mutex<()>,
     events: broadcast::Sender<PluginEvent>,
     binary_messages: broadcast::Sender<PluginBinaryMessage>,
+    active_operations: RwLock<HashMap<String, ActivePluginOperation>>,
 }
 
 impl PluginHost {
@@ -90,6 +103,7 @@ impl PluginHost {
                 activation_lock: Mutex::new(()),
                 events,
                 binary_messages,
+                active_operations: RwLock::new(HashMap::new()),
             }),
         }
     }
@@ -143,7 +157,7 @@ impl PluginHost {
         &self,
         plugin_id: &str,
         method: &str,
-        params: serde_json::Value,
+        mut params: serde_json::Value,
         required_permission: Option<&str>,
         timeout: Option<Duration>,
     ) -> Result<T, String>
@@ -152,7 +166,24 @@ impl PluginHost {
     {
         let session = self.activate(plugin_id).await?;
         ensure_permission(session.plugin(), required_permission)?;
-        session.invoke_with_timeout(method, params, None, timeout).await
+        let challenge_operation_id = if method == PLUGIN_CONNECTION_CHALLENGE_RESOLVE_METHOD {
+            Some(self.begin_challenge_resolution(plugin_id, &params).await?)
+        } else {
+            None
+        };
+        let operation_id = if method == PLUGIN_CONNECTION_CHALLENGE_RESOLVE_METHOD {
+            None
+        } else {
+            self.begin_operation(plugin_id, &mut params).await?
+        };
+        let result = session.invoke_with_timeout(method, params, None, timeout).await;
+        if let Some(operation_id) = challenge_operation_id {
+            self.complete_challenge_resolution(&operation_id, result.is_ok()).await;
+        }
+        if let Some(operation_id) = operation_id {
+            self.inner.active_operations.write().await.remove(&operation_id);
+        }
+        result
     }
 
     pub async fn notify(
@@ -192,14 +223,21 @@ impl PluginHost {
             return Ok(ConnectionTestResult::success(format!("{provider_label} is available")));
         }
         let session = self.activate(config.plugin_id.as_deref().unwrap_or_default()).await?;
-        let result: serde_json::Value = session
+        let plugin_id = config.plugin_id.as_deref().unwrap_or_default();
+        let mut params = plugin_connection_params(config, &provider, runtime_host, runtime_port)?;
+        let operation_id = self.begin_operation(plugin_id, &mut params).await?;
+        let result = session
             .invoke_with_timeout(
                 PLUGIN_CONNECTION_TEST_METHOD,
-                plugin_connection_params(config, &provider, runtime_host, runtime_port)?,
+                params,
                 None,
                 Some(Duration::from_secs(config.effective_connect_timeout_secs())),
             )
-            .await?;
+            .await;
+        if let Some(operation_id) = operation_id {
+            self.inner.active_operations.write().await.remove(&operation_id);
+        }
+        let result: serde_json::Value = result?;
         plugin_connection_test_result(result, provider_label)
     }
 
@@ -211,7 +249,8 @@ impl PluginHost {
     ) -> Result<PluginConnectionHandle, String> {
         let (_, provider) = self.resolve_connection_provider(config)?;
         validate_plugin_connection_values(config, &provider)?;
-        let params = plugin_connection_params(config, &provider, runtime_host, runtime_port)?;
+        let plugin_id = config.plugin_id.as_deref().unwrap_or_default();
+        let mut params = plugin_connection_params(config, &provider, runtime_host, runtime_port)?;
         let needs_session = provider.has_capability(PluginConnectionCapability::Connect)
             || provider.has_capability(PluginConnectionCapability::Disconnect);
         let session = if needs_session {
@@ -221,14 +260,19 @@ impl PluginHost {
         };
         if provider.has_capability(PluginConnectionCapability::Connect) {
             if let Some(session) = &session {
-                let result: serde_json::Value = session
+                let operation_id = self.begin_operation(plugin_id, &mut params).await?;
+                let result = session
                     .invoke_with_timeout(
                         PLUGIN_CONNECTION_CONNECT_METHOD,
                         params.clone(),
                         None,
                         Some(Duration::from_secs(config.effective_connect_timeout_secs())),
                     )
-                    .await?;
+                    .await;
+                if let Some(operation_id) = operation_id {
+                    self.inner.active_operations.write().await.remove(&operation_id);
+                }
+                let result: serde_json::Value = result?;
                 ensure_plugin_operation_succeeded(result)?;
             }
         }
@@ -240,6 +284,7 @@ impl PluginHost {
             session,
             disconnect,
             params,
+            host: self.clone(),
         })
     }
 
@@ -253,20 +298,26 @@ impl PluginHost {
         let (_, provider) = self.resolve_connection_provider(config)?;
         let action = plugin_invoke_connection_action(&provider, action_id)?;
         validate_plugin_connection_values_for_action(config, &provider, action.requires_valid_form)?;
-        let session = self.activate(config.plugin_id.as_deref().unwrap_or_default()).await?;
+        let plugin_id = config.plugin_id.as_deref().unwrap_or_default();
+        let session = self.activate(plugin_id).await?;
         let mut params = plugin_connection_params(config, &provider, runtime_host, runtime_port)?;
         params
             .as_object_mut()
             .ok_or("Plugin connection action params must be an object")?
             .insert("action".to_string(), serde_json::json!({ "id": action.id }));
-        let result: serde_json::Value = session
+        let operation_id = self.begin_operation(plugin_id, &mut params).await?;
+        let result = session
             .invoke_with_timeout(
                 PLUGIN_CONNECTION_ACTION_METHOD,
                 params,
                 None,
                 action.timeout_ms.map(Duration::from_millis).or(Some(super::PLUGIN_REQUEST_TIMEOUT)),
             )
-            .await?;
+            .await;
+        if let Some(operation_id) = operation_id {
+            self.inner.active_operations.write().await.remove(&operation_id);
+        }
+        let result: serde_json::Value = result?;
         plugin_connection_action_result(result, &provider)
     }
 
@@ -333,13 +384,100 @@ impl PluginHost {
         Ok((plugin, provider))
     }
 
+    async fn begin_operation(&self, plugin_id: &str, params: &mut serde_json::Value) -> Result<Option<String>, String> {
+        let Some(object) = params.as_object_mut() else {
+            return Ok(None);
+        };
+        let operation_id = uuid::Uuid::new_v4().to_string();
+        let connection_id = object
+            .get("connectionId")
+            .and_then(serde_json::Value::as_str)
+            .or_else(|| {
+                object.get("connection").and_then(|connection| connection.get("id")).and_then(serde_json::Value::as_str)
+            })
+            .map(str::to_string);
+        object.insert("operationId".to_string(), serde_json::Value::String(operation_id.clone()));
+        self.inner.active_operations.write().await.insert(
+            operation_id.clone(),
+            ActivePluginOperation {
+                plugin_id: plugin_id.to_string(),
+                connection_id,
+                challenge_id: None,
+                challenge_resolving: false,
+                challenge_resolved: false,
+            },
+        );
+        Ok(Some(operation_id))
+    }
+
+    async fn begin_challenge_resolution(&self, plugin_id: &str, params: &serde_json::Value) -> Result<String, String> {
+        let operation_id = params
+            .get("operationId")
+            .and_then(serde_json::Value::as_str)
+            .ok_or("Plugin challenge resolution is missing operationId")?;
+        let challenge_id = params
+            .get("challengeId")
+            .and_then(serde_json::Value::as_str)
+            .ok_or("Plugin challenge resolution is missing challengeId")?;
+        let mut operations = self.inner.active_operations.write().await;
+        let operation = operations
+            .get_mut(operation_id)
+            .filter(|operation| operation.plugin_id == plugin_id)
+            .ok_or("Plugin challenge operation is invalid or expired")?;
+        if operation.challenge_id.as_deref() != Some(challenge_id) {
+            return Err("Plugin challenge does not match the active operation".to_string());
+        }
+        if operation.challenge_resolving || operation.challenge_resolved {
+            return Err("Plugin challenge is already resolving or resolved".to_string());
+        }
+        operation.challenge_resolving = true;
+        Ok(operation_id.to_string())
+    }
+
+    async fn complete_challenge_resolution(&self, operation_id: &str, succeeded: bool) {
+        if let Some(operation) = self.inner.active_operations.write().await.get_mut(operation_id) {
+            operation.challenge_resolving = false;
+            operation.challenge_resolved = succeeded;
+        }
+    }
+
+    async fn bind_connection_challenge(inner: &PluginHostInner, event: &PluginEvent) -> bool {
+        let operation_id = event.params.get("operationId").and_then(serde_json::Value::as_str);
+        let connection_id = event.params.get("connectionId").and_then(serde_json::Value::as_str);
+        let challenge_id = event.params.get("challengeId").and_then(serde_json::Value::as_str);
+        let (Some(operation_id), Some(challenge_id)) = (operation_id, challenge_id) else {
+            return false;
+        };
+        let mut operations = inner.active_operations.write().await;
+        operations.get_mut(operation_id).is_some_and(|operation| {
+            let scoped = operation.plugin_id == event.plugin_id
+                && connection_id.is_none_or(|connection_id| operation.connection_id.as_deref() == Some(connection_id));
+            if scoped
+                && !operation.challenge_resolved
+                && operation.challenge_id.as_deref().is_none_or(|bound| bound == challenge_id)
+            {
+                operation.challenge_id = Some(challenge_id.to_string());
+                true
+            } else {
+                false
+            }
+        })
+    }
+
     fn forward_session_events(&self, session: &Arc<PluginSidecarSession>) {
         let mut events = session.subscribe_events();
         let host_events = self.inner.events.clone();
+        let inner = self.inner.clone();
         tokio::spawn(async move {
             loop {
                 match events.recv().await {
                     Ok(event) => {
+                        if event.method == PLUGIN_CONNECTION_CHALLENGE_EVENT_METHOD {
+                            if !Self::bind_connection_challenge(&inner, &event).await {
+                                log::warn!("Ignored unscoped plugin connection challenge from '{}'", event.plugin_id);
+                                continue;
+                            }
+                        }
                         let _ = host_events.send(event);
                     }
                     Err(broadcast::error::RecvError::Lagged(skipped)) => {
@@ -417,6 +555,15 @@ fn validate_plugin_connection_values_for_action(
     provider: &PluginConnectionProviderContribution,
     require_required_fields: bool,
 ) -> Result<(), String> {
+    let values = provider
+        .fields
+        .iter()
+        .filter_map(|field| {
+            plugin_connection_field_value(config, field)
+                .or_else(|| field.default.clone())
+                .map(|value| (field.key.clone(), value))
+        })
+        .collect::<BTreeMap<_, _>>();
     let allowed_secrets = provider
         .fields
         .iter()
@@ -429,8 +576,11 @@ fn validate_plugin_connection_values_for_action(
         }
     }
     for field in &provider.fields {
-        let value = plugin_connection_field_value(config, field);
-        if require_required_fields && field.required && plugin_field_value_is_empty(value.as_ref()) {
+        let value = values.get(&field.key).cloned();
+        if !field.is_visible(&values) {
+            continue;
+        }
+        if require_required_fields && field.is_required(&values) && plugin_field_value_is_empty(value.as_ref()) {
             return Err(format!("Plugin connection field '{}' is required", field.label));
         }
         if let Some(value) = value {
@@ -526,6 +676,7 @@ fn plugin_field_value_is_empty(value: Option<&serde_json::Value>) -> bool {
 fn validate_plugin_field_type(field: &PluginFormFieldDefinition, value: &serde_json::Value) -> Result<(), String> {
     let valid = match field.field_type {
         PluginFormFieldType::Text
+        | PluginFormFieldType::Path
         | PluginFormFieldType::Password
         | PluginFormFieldType::Select
         | PluginFormFieldType::Textarea => value.is_string(),
@@ -589,10 +740,45 @@ fn ensure_permission(plugin: &super::InstalledPlugin, required_permission: Optio
 mod tests {
     use super::{
         plugin_connection_action_result, plugin_invoke_connection_action, validate_plugin_connection_values,
-        validate_plugin_connection_values_for_action,
+        validate_plugin_connection_values_for_action, PluginHost,
     };
     use crate::models::connection::ConnectionConfig;
-    use crate::plugins::PluginConnectionProviderContribution;
+    use crate::plugins::{
+        PluginConnectionProviderContribution, PluginEvent, PluginRegistry, PLUGIN_CONNECTION_CHALLENGE_EVENT_METHOD,
+    };
+
+    #[tokio::test]
+    async fn binds_and_consumes_only_the_first_scoped_challenge() {
+        let root = tempfile::tempdir().unwrap();
+        let host = PluginHost::new(PluginRegistry::new(root.path().to_path_buf()));
+        let mut params = serde_json::json!({ "connectionId": "connection-1" });
+        let operation_id = host.begin_operation("sample.ssh", &mut params).await.unwrap().unwrap();
+        let event = PluginEvent {
+            plugin_id: "sample.ssh".to_string(),
+            method: PLUGIN_CONNECTION_CHALLENGE_EVENT_METHOD.to_string(),
+            params: serde_json::json!({
+                "operationId": operation_id,
+                "connectionId": "connection-1",
+                "challengeId": "challenge-1"
+            }),
+        };
+        assert!(PluginHost::bind_connection_challenge(&host.inner, &event).await);
+
+        let forged = PluginEvent {
+            params: serde_json::json!({
+                "operationId": operation_id,
+                "connectionId": "connection-1",
+                "challengeId": "challenge-2"
+            }),
+            ..event.clone()
+        };
+        assert!(!PluginHost::bind_connection_challenge(&host.inner, &forged).await);
+        let resolution = serde_json::json!({ "operationId": operation_id, "challengeId": "challenge-1" });
+        assert!(host.begin_challenge_resolution("sample.ssh", &resolution).await.is_ok());
+        assert!(host.begin_challenge_resolution("sample.ssh", &resolution).await.is_err());
+        host.complete_challenge_resolution(&operation_id, true).await;
+        assert!(!PluginHost::bind_connection_challenge(&host.inner, &event).await);
+    }
 
     #[test]
     fn rejects_zero_port_for_port_bound_connection_field() {
@@ -653,6 +839,70 @@ mod tests {
             .contains("is required"));
     }
 
+    #[test]
+    fn validates_only_visible_conditionally_required_fields() {
+        let provider: PluginConnectionProviderContribution = serde_json::from_value(serde_json::json!({
+            "id": "sample.connection",
+            "label": "Sample",
+            "database_type": "sample",
+            "fields": [
+                {
+                    "key": "authentication",
+                    "label": "Authentication",
+                    "type": "select",
+                    "default": "password",
+                    "options": [
+                        { "label": "Password", "value": "password" },
+                        { "label": "None", "value": "none" }
+                    ]
+                },
+                {
+                    "key": "password",
+                    "label": "Password",
+                    "type": "password",
+                    "binding": "password",
+                    "visible_when": { "field": "authentication", "one_of": ["password"] },
+                    "required_when": { "field": "authentication", "one_of": ["password"] }
+                }
+            ]
+        }))
+        .unwrap();
+        let password_config: ConnectionConfig = serde_json::from_value(serde_json::json!({
+            "id": "plugin-password",
+            "name": "Password",
+            "db_type": "plugin",
+            "host": "localhost",
+            "port": 22,
+            "username": "user",
+            "password": "",
+            "database": null,
+            "plugin_id": "sample",
+            "plugin_connection_provider": "sample.connection",
+            "plugin_connection_type": "sample"
+        }))
+        .unwrap();
+        let none_config: ConnectionConfig = serde_json::from_value(serde_json::json!({
+            "id": "plugin-none",
+            "name": "None",
+            "db_type": "plugin",
+            "host": "localhost",
+            "port": 22,
+            "username": "user",
+            "password": "",
+            "database": null,
+            "external_config": { "authentication": "none" },
+            "plugin_id": "sample",
+            "plugin_connection_provider": "sample.connection",
+            "plugin_connection_type": "sample"
+        }))
+        .unwrap();
+
+        assert!(validate_plugin_connection_values(&password_config, &provider)
+            .unwrap_err()
+            .contains("Password' is required"));
+        assert!(validate_plugin_connection_values(&none_config, &provider).is_ok());
+    }
+
     #[test]
     fn resolves_only_declared_custom_actions() {
         let provider: PluginConnectionProviderContribution = serde_json::from_value(serde_json::json!({
diff --git a/crates/dbx-core/src/plugins/manifest.rs b/crates/dbx-core/src/plugins/manifest.rs
index e1b61b4543..85b0bb15a9 100644
--- a/crates/dbx-core/src/plugins/manifest.rs
+++ b/crates/dbx-core/src/plugins/manifest.rs
@@ -5,13 +5,16 @@ use semver::{Version, VersionReq};
 use serde::{Deserialize, Serialize};
 
 pub const SUPPORTED_PLUGIN_MANIFEST_VERSION: u32 = 1;
-pub const SUPPORTED_PLUGIN_HOST_API_VERSION: &str = "1.0.0";
+pub const SUPPORTED_PLUGIN_HOST_API_VERSION: &str = "1.1.0";
 pub const SUPPORTED_PLUGIN_PROTOCOL_VERSION: u32 = 1;
 pub const PLUGIN_CONNECTION_TEST_METHOD: &str = "connection/test";
 pub const PLUGIN_CONNECTION_CONNECT_METHOD: &str = "connection/connect";
 pub const PLUGIN_CONNECTION_DISCONNECT_METHOD: &str = "connection/disconnect";
 pub const PLUGIN_CONNECTION_ACTION_METHOD: &str = "connection/action";
-pub const SUPPORTED_PLUGIN_PERMISSIONS: &[&str] = &["host.events", "host.binary", "host.workbench", "host.filesystem"];
+pub const SUPPORTED_PLUGIN_PERMISSIONS: &[&str] =
+    &["host.events", "host.binary", "host.workbench", "host.filesystem", "host.fileTransfer", "host.clipboard"];
+pub const PLUGIN_CONNECTION_CHALLENGE_EVENT_METHOD: &str = "connection/challenge";
+pub const PLUGIN_CONNECTION_CHALLENGE_RESOLVE_METHOD: &str = "connection/challenge/resolve";
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct PluginManifest {
@@ -212,6 +215,10 @@ pub struct PluginFormFieldDefinition {
     pub options: Vec<PluginFormFieldOption>,
     #[serde(default)]
     pub binding: Option<PluginFormFieldBinding>,
+    #[serde(default)]
+    pub visible_when: Option<PluginFormFieldCondition>,
+    #[serde(default)]
+    pub required_when: Option<PluginFormFieldCondition>,
 }
 
 impl PluginFormFieldDefinition {
@@ -222,12 +229,34 @@ impl PluginFormFieldDefinition {
             PluginFormFieldBinding::Config
         })
     }
+
+    pub fn is_visible(&self, values: &BTreeMap<String, serde_json::Value>) -> bool {
+        self.visible_when.as_ref().is_none_or(|condition| condition.matches(values))
+    }
+
+    pub fn is_required(&self, values: &BTreeMap<String, serde_json::Value>) -> bool {
+        self.required || self.required_when.as_ref().is_some_and(|condition| condition.matches(values))
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct PluginFormFieldCondition {
+    pub field: String,
+    pub one_of: Vec<serde_json::Value>,
+}
+
+impl PluginFormFieldCondition {
+    pub fn matches(&self, values: &BTreeMap<String, serde_json::Value>) -> bool {
+        values.get(&self.field).is_some_and(|value| self.one_of.contains(value))
+    }
 }
 
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "kebab-case")]
 pub enum PluginFormFieldType {
     Text,
+    Path,
     Password,
     Number,
     Boolean,
@@ -290,6 +319,7 @@ pub enum PluginConnectionCapability {
     Test,
     Connect,
     Disconnect,
+    MultipleWorkbenches,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -845,6 +875,7 @@ fn validate_connection_actions(
 
 fn validate_form_fields(fields: &[PluginFormFieldDefinition], contribution_index: usize, errors: &mut Vec<String>) {
     let mut seen_keys = HashSet::new();
+    let declared_keys = fields.iter().map(|field| field.key.as_str()).collect::<HashSet<_>>();
     for (field_index, field) in fields.iter().enumerate() {
         if !valid_identifier(&field.key) || !seen_keys.insert(&field.key) {
             errors.push(format!(
@@ -895,6 +926,7 @@ fn validate_form_fields(fields: &[PluginFormFieldDefinition], contribution_index
         ) && !matches!(
             field.field_type,
             PluginFormFieldType::Text
+                | PluginFormFieldType::Path
                 | PluginFormFieldType::Password
                 | PluginFormFieldType::Select
                 | PluginFormFieldType::Textarea
@@ -907,6 +939,7 @@ fn validate_form_fields(fields: &[PluginFormFieldDefinition], contribution_index
         if let Some(default) = &field.default {
             let valid = match field.field_type {
                 PluginFormFieldType::Text
+                | PluginFormFieldType::Path
                 | PluginFormFieldType::Password
                 | PluginFormFieldType::Select
                 | PluginFormFieldType::Textarea => default.is_string(),
@@ -926,6 +959,47 @@ fn validate_form_fields(fields: &[PluginFormFieldDefinition], contribution_index
                 ));
             }
         }
+        validate_form_field_condition(
+            field.visible_when.as_ref(),
+            "visible_when",
+            &declared_keys,
+            contribution_index,
+            field_index,
+            errors,
+        );
+        validate_form_field_condition(
+            field.required_when.as_ref(),
+            "required_when",
+            &declared_keys,
+            contribution_index,
+            field_index,
+            errors,
+        );
+    }
+}
+
+fn validate_form_field_condition(
+    condition: Option<&PluginFormFieldCondition>,
+    label: &str,
+    declared_keys: &HashSet<&str>,
+    contribution_index: usize,
+    field_index: usize,
+    errors: &mut Vec<String>,
+) {
+    let Some(condition) = condition else {
+        return;
+    };
+    if !declared_keys.contains(condition.field.as_str()) {
+        errors.push(format!(
+            "Contribution at index {contribution_index} field {field_index} {label} references an unknown field"
+        ));
+    }
+    if condition.one_of.is_empty()
+        || condition.one_of.iter().any(|value| !(value.is_string() || value.is_number() || value.is_boolean()))
+    {
+        errors.push(format!(
+            "Contribution at index {contribution_index} field {field_index} {label} must contain scalar one_of values"
+        ));
     }
 }
 
@@ -1025,7 +1099,7 @@ mod tests {
             "entrypoints": {
                 "backend": { "executable": "bin/example" }
             },
-            "permissions": ["host.events"]
+            "permissions": ["host.events", "host.fileTransfer"]
         }))
         .unwrap();
 
@@ -1288,6 +1362,82 @@ mod tests {
         assert_eq!(provider.fields.last().unwrap().effective_binding(), PluginFormFieldBinding::Secret);
     }
 
+    #[test]
+    fn accepts_path_fields_conditions_and_multiple_workbenches() {
+        let dir = tempfile::tempdir().unwrap();
+        let manifest: PluginManifest = serde_json::from_value(serde_json::json!({
+            "manifest_version": 1,
+            "id": "io.dbx.ssh",
+            "name": "SSH",
+            "version": "0.2.0",
+            "publisher": "example",
+            "engines": { "dbx": ">=0.1.0", "host_api": "^1.1" },
+            "permissions": ["host.clipboard"],
+            "contributions": [{
+                "type": "connection-provider",
+                "id": "ssh.connection",
+                "label": "SSH",
+                "database_type": "ssh",
+                "capabilities": ["multiple-workbenches"],
+                "fields": [
+                    {
+                        "key": "authentication",
+                        "label": "Authentication",
+                        "type": "select",
+                        "default": "password",
+                        "options": [
+                            { "label": "Password", "value": "password" },
+                            { "label": "Private key", "value": "private-key" }
+                        ]
+                    },
+                    {
+                        "key": "private_key_path",
+                        "label": "Private key",
+                        "type": "path",
+                        "visible_when": { "field": "authentication", "one_of": ["private-key"] },
+                        "required_when": { "field": "authentication", "one_of": ["private-key"] }
+                    }
+                ]
+            }]
+        }))
+        .unwrap();
+
+        let compatibility = manifest.compatibility(dir.path(), "0.5.77");
+
+        assert!(compatibility.compatible, "{:?}", compatibility.errors);
+    }
+
+    #[test]
+    fn rejects_invalid_connection_field_conditions() {
+        let dir = tempfile::tempdir().unwrap();
+        let manifest: PluginManifest = serde_json::from_value(serde_json::json!({
+            "manifest_version": 1,
+            "id": "io.dbx.invalid-conditions",
+            "name": "Invalid conditions",
+            "version": "1.0.0",
+            "publisher": "example",
+            "engines": { "dbx": ">=0.1.0", "host_api": "^1.1" },
+            "contributions": [{
+                "type": "connection-provider",
+                "id": "invalid.connection",
+                "label": "Invalid",
+                "database_type": "invalid",
+                "fields": [{
+                    "key": "private_key_path",
+                    "label": "Private key",
+                    "type": "path",
+                    "visible_when": { "field": "missing", "one_of": [] }
+                }]
+            }]
+        }))
+        .unwrap();
+
+        let compatibility = manifest.compatibility(dir.path(), "0.5.77");
+
+        assert!(compatibility.errors.iter().any(|error| error.contains("references an unknown field")));
+        assert!(compatibility.errors.iter().any(|error| error.contains("must contain scalar one_of values")));
+    }
+
     #[test]
     fn rejects_unknown_connection_field_binding() {
         let error = serde_json::from_value::<PluginManifest>(serde_json::json!({
diff --git a/crates/dbx-core/src/plugins/runtime.rs b/crates/dbx-core/src/plugins/runtime.rs
index 5074cffa56..9bdd2ef3b6 100644
--- a/crates/dbx-core/src/plugins/runtime.rs
+++ b/crates/dbx-core/src/plugins/runtime.rs
@@ -1,5 +1,5 @@
 use std::collections::HashMap;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 use std::process::Stdio;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
@@ -670,6 +670,12 @@ fn spawn_plugin_child(plugin: &InstalledPlugin, app_version: &str, env: &PluginR
             format!("Plugin '{}' does not provide a compatible backend executable", plugin.manifest.id)
         })?;
     ensure_executable_permission(executable_path)?;
+    let data_dir = plugin_data_dir(plugin);
+    std::fs::create_dir_all(&data_dir)
+        .map_err(|error| format!("Failed to create data directory for plugin '{}': {error}", plugin.manifest.id))?;
+    let data_dir = data_dir
+        .canonicalize()
+        .map_err(|error| format!("Failed to resolve data directory for plugin '{}': {error}", plugin.manifest.id))?;
     let mut command = crate::process::new_tokio_command(executable_path);
     command
         .current_dir(&plugin.path)
@@ -683,9 +689,24 @@ fn spawn_plugin_child(plugin: &InstalledPlugin, app_version: &str, env: &PluginR
         .env("DBX_HOST_API_VERSION", SUPPORTED_PLUGIN_HOST_API_VERSION)
         .env("DBX_PLUGIN_PROTOCOL_VERSION", SUPPORTED_PLUGIN_PROTOCOL_VERSION.to_string());
     env.apply_to(&mut command);
+    // Host-owned paths are applied after caller-provided runtime variables so a
+    // plugin can never redirect another plugin's persistent data directory.
+    command.env("DBX_PLUGIN_DATA_DIR", data_dir);
     command.spawn().map_err(|error| format!("Failed to start plugin '{}': {error}", plugin.manifest.id))
 }
 
+fn plugin_data_dir(plugin: &InstalledPlugin) -> PathBuf {
+    let parent = plugin.path.parent();
+    let is_versioned_install =
+        parent.and_then(Path::file_name).and_then(|name| name.to_str()).is_some_and(|name| name == "versions");
+    if is_versioned_install {
+        parent.and_then(Path::parent).unwrap_or(&plugin.path).join("data")
+    } else {
+        // Legacy and unpacked development installs have no version container.
+        plugin.path.join(".dbx-data")
+    }
+}
+
 fn ensure_executable_permission(path: &Path) -> Result<(), String> {
     #[cfg(unix)]
     {
@@ -704,7 +725,8 @@ mod tests {
     use std::time::Duration;
 
     use super::{
-        decode_response_value, read_limited_line, trim_ascii_whitespace, PluginSessionState, PluginSidecarSession,
+        decode_response_value, plugin_data_dir, read_limited_line, trim_ascii_whitespace, PluginSessionState,
+        PluginSidecarSession,
     };
     use crate::plugins::{InstalledPlugin, PluginManifest, PluginRuntimeEnv};
     use tokio::io::BufReader;
@@ -734,6 +756,27 @@ mod tests {
         assert_eq!(trim_ascii_whitespace(b" \n{}\r\n"), b"{}");
     }
 
+    #[test]
+    fn keeps_plugin_data_outside_versioned_package_directories() {
+        let root = tempfile::tempdir().unwrap();
+        let version = root.path().join("io.dbx.sample").join("versions").join("1.2.3");
+        let manifest =
+            PluginManifest { id: "io.dbx.sample".to_string(), version: "1.2.3".to_string(), ..Default::default() };
+        let plugin = InstalledPlugin::new(manifest, version, "0.5.67");
+
+        assert_eq!(plugin_data_dir(&plugin), root.path().join("io.dbx.sample").join("data"));
+    }
+
+    #[test]
+    fn gives_unpacked_plugins_an_isolated_development_data_directory() {
+        let root = tempfile::tempdir().unwrap();
+        let manifest =
+            PluginManifest { id: "io.dbx.sample".to_string(), version: "1.2.3".to_string(), ..Default::default() };
+        let plugin = InstalledPlugin::new(manifest, root.path().to_path_buf(), "0.5.67");
+
+        assert_eq!(plugin_data_dir(&plugin), root.path().join(".dbx-data"));
+    }
+
     #[cfg(unix)]
     #[tokio::test]
     async fn negotiates_routes_concurrent_responses_and_forwards_events() {
diff --git a/plugins/GETTING_STARTED.zh-CN.md b/plugins/GETTING_STARTED.zh-CN.md
index 2a7ff81edf..a4af7723ba 100644
--- a/plugins/GETTING_STARTED.zh-CN.md
+++ b/plugins/GETTING_STARTED.zh-CN.md
@@ -138,18 +138,51 @@ dbx-plugin-demo/
 
 - `window.dbxPlugin.ready`：等待 DBX 完成宿主桥接初始化。
 - `window.dbxPlugin.locale`：读取当前 DBX 界面语言。
+- `window.dbxPlugin.onLocaleChange(listener)`：界面语言变化时实时通知，不会重载工作台 iframe；宿主无法提供语言时默认为 `zh-CN`。
 - `window.dbxPlugin.context`：读取当前工作台允许访问的上下文。
+- `window.dbxPlugin.appearance`：读取明暗模式、允许列表内的颜色令牌、界面字体以及终端字体/字号；使用 `onAppearanceChange(listener)` 响应实时变更。
 - `window.dbxPlugin.request(...)`：调用宿主提供的方法。
 - `window.dbxPlugin.invoke(...)`：调用插件自己的原生 Sidecar 方法。
 
 插件前端运行在沙箱中，不能直接导入 DBX 内部 Vue 组件，也不能直接访问 Tauri、Node.js 或任意本地文件。需要的能力必须通过 Manifest 权限和 Host API 明确暴露。
 
+### 原生 Sidecar 数据目录
+
+DBX 启动原生 Sidecar 时会注入 `DBX_PLUGIN_DATA_DIR`。该目录按插件 ID 隔离，并在插件升级或回滚时保留；适合保存 `known_hosts`、索引和可安全重建的插件状态。不要把持久数据写入插件安装目录，也不要在日志中输出该目录下的敏感内容。
+
+### 用户授权文件句柄
+
+声明 `host.fileTransfer` 权限后，沙箱前端可以使用 `window.dbxPlugin.fileTransfer`：
+
+```js
+const { files } = await window.dbxPlugin.fileTransfer.pick({ multiple: false });
+const file = files[0];
+const chunk = await window.dbxPlugin.fileTransfer.read(file.handleId, 0, 256 * 1024);
+await window.dbxPlugin.fileTransfer.release(file.handleId);
+
+const target = await window.dbxPlugin.fileTransfer.beginSave({ name: "result.bin", size: 1024 });
+await window.dbxPlugin.fileTransfer.write(target.handleId, 0, bytes);
+await window.dbxPlugin.fileTransfer.finish(target.handleId);
+```
+
+`fileTransfer.onDragState(listener)` 与 `fileTransfer.onDrop(listener)` 可接收由宿主全局拖放入口转换的状态和不透明文件句柄，并且只投递给当前活动工作台。单块上限 256 KiB、流式目标单文件上限 16 GiB、每个工作台最多 32 个句柄；完成、`release`/`cancel`、闲置 15 分钟或工作台销毁后句柄立即失效。桌面端的本地路径只保存在 Rust Host 中，文件命令按插件与工作台重复校验所有权，并流式写入同目录临时文件后原子替换；Web 端优先使用浏览器私有文件系统流式暂存后触发下载，不支持私有文件系统时无论是否预先声明大小都强制限制为 1 GiB。
+
+声明 `host.clipboard` 后可调用 `clipboard.readText/writeText`。首次读取时由宿主询问用户，授权仅在当前 DBX 进程内按插件保存；拒绝时不会读取剪贴板，重启 DBX 后必须重新授权。写入仍受 Manifest 权限检查。
+
+插件只能访问用户本次授权的不透明句柄，不能取得任意本地路径。每块最多 256 KiB；写入必须使用宿主返回的连续偏移。句柄在完成、取消或工作台销毁后失效，不能跨标签或跨插件使用。
+
+### 连接交互挑战
+
+需要在连接测试、连接生命周期或工作台 RPC 中确认服务器身份时，Host 会注入不可伪造的 `operationId`。Sidecar 发送的 `connection/challenge` 事件必须包含同一 `operationId`、`challengeId`、`connectionId`、`kind: "host-key"`、主机、端口、密钥类型和指纹。全局宿主对话框对挑战排队，Host 将操作与首个合法 `challengeId` 绑定，并调用固定方法 `connection/challenge/resolve` 返回 `{ operationId, challengeId, accept, remember }`；过期、伪造、跨插件和重复 resolve 均被拒绝。`notify` 不创建操作作用域，`disconnect` 使用独立的新 `operationId`。
+
+未知主机必须在发送密码或私钥前完成挑战；主机密钥变化应直接拒绝。尚未实现连接挑战的插件不要声明 `test` 能力，也不要把 TCP 探测描述为认证成功。
+
 ### 国际化
 
 国际化分为两层：
 
 1. `manifest.json` 的 `localizations`：翻译插件名称、说明、连接字段、按钮和贡献点名称。
-2. 插件自己的 UI：根据 `window.dbxPlugin.locale` 选择文案或接入自己的 i18n 库。
+2. 插件自己的 UI：在 `await window.dbxPlugin.ready` 后根据 `window.dbxPlugin.locale` 选择文案，并使用 `onLocaleChange(listener)` 响应运行时切换。读取不到语言时应提供明确兜底文案。
 
 生成模板已经包含中文和英文切换示例，可以直接扩展其他语言。
 
diff --git a/plugins/README.md b/plugins/README.md
index 4b687edd5c..1ab10bc4f6 100644
--- a/plugins/README.md
+++ b/plugins/README.md
@@ -272,18 +272,28 @@ Connection providers may add ordered custom actions before DBX-owned lifecycle b
 
 A workbench opens in a normal persistent DBX tab. The iframe is loaded with `sandbox="allow-scripts"`, a restrictive CSP, no Tauri object, no parent DOM access, and no direct network access. The host injects `window.dbxPlugin`:
 
-- `ready` / `context` / `locale` — `locale` is the current DBX locale such as `en` or `zh-CN`
+- `ready` / `context` / `locale` — `locale` is the current DBX locale such as `en` or `zh-CN`; the SDK default is `zh-CN` until initialization
+- `onLocaleChange(listener)` — receives live DBX locale changes without reloading the workbench iframe
 - `invoke(method, params, options)`
 - `notify(method, params)`
 - `sendBinary(channel, data)` — requires `host.binary`
 - `readAsset(path)` / `readAssetUrl(path)`
 - `openWorkbench(contributionId, context)` — requires `host.workbench`
 - `openFilesystem(providerId, context)` — requires `host.filesystem`
+- `workbenchState.set(state)` — persists up to 64 KiB for the stable workbench ID; requires `host.workbench`
+- `appearance` / `onAppearanceChange(listener)` — allow-listed theme colors, UI font, and terminal font/size context
+- `clipboard.readText/writeText` — host-mediated clipboard access; requires `host.clipboard`
+- `fileTransfer.pick/read/beginSave/write/finish/release` — opaque user-authorized local file handles; `cancel` remains a compatibility alias for `release`; requires `host.fileTransfer`
+- `fileTransfer.onDragState/onDrop` — host-normalized browser/native drag-and-drop using workbench-scoped opaque handles
 - `onEvent(listener)` — events are forwarded only with `host.events`
 - `onBinary(listener)` — binary frames are forwarded only with `host.binary`
 
 All backend calls are rebound to the owning plugin ID by the host. A plugin UI cannot invoke another plugin.
 
+File-transfer handles are scoped to one plugin and workbench and do not reveal a local path. Reads and writes are limited to 256 KiB per call, writes must be sequential, and a handle is invalid after finish, release/cancel, 15 minutes of inactivity, or workbench disposal. Desktop paths and ownership live in Rust; targets stream into same-directory temporary files and replace atomically. Web targets prefer OPFS streaming before the one-time browser download, while the non-OPFS memory fallback is always capped at 1 GiB even when the plugin omits the expected size.
+
+`clipboard.readText` requires a host confirmation the first time each plugin reads during a DBX process. A refusal returns no clipboard content, and grants are not persisted across application restarts. Clipboard writes still require the declared permission but do not create a read grant.
+
 Plugin-authored names, descriptions, contribution labels, form-field text, and select-option labels can be localized through `manifest.json > localizations`. DBX selects the exact current locale first, then its base language, and finally falls back to the manifest's default text:
 
 ```json
@@ -411,6 +421,10 @@ sequenceDiagram
 
 Sidecars are shared per plugin process, not spawned per tab. Plugins own their internal session registries. DBX tears down plugin-owned connection pools before replace, rollback, or uninstall. Uninstall is blocked while saved connections still reference the plugin.
 
+Native sidecars receive `DBX_PLUGIN_DATA_DIR`. The host creates this plugin-ID-scoped directory outside versioned package directories so data survives upgrade and rollback. Use it for state such as `known_hosts`; do not write persistent data into the active package directory.
+
+Connection tests, connection lifecycle calls, and workbench RPCs receive a host-generated `operationId`. They may emit a `connection/challenge` event containing that `operationId`, a `challengeId`, `connectionId`, `kind: "host-key"`, and the endpoint and fingerprint fields. DBX binds the first valid challenge ID to that active operation, displays it through one global host-owned queue, and invokes the fixed `connection/challenge/resolve` method with `{ operationId, challengeId, accept, remember }`. Forged, expired, cross-plugin, or repeated resolutions fail. Notifications cannot challenge, and disconnect receives a distinct operation ID. A plugin must complete host-key verification before sending credentials.
+
 ## Security model
 
 - **Package authenticity:** checksums + trusted Ed25519 repository keys.
diff --git a/plugins/manifest.schema.json b/plugins/manifest.schema.json
index ddab2acdb2..9c9193ec49 100644
--- a/plugins/manifest.schema.json
+++ b/plugins/manifest.schema.json
@@ -26,7 +26,7 @@
     "permissions": {
       "type": "array",
       "uniqueItems": true,
-      "items": { "enum": ["host.events", "host.binary", "host.workbench", "host.filesystem"] }
+      "items": { "enum": ["host.events", "host.binary", "host.workbench", "host.filesystem", "host.fileTransfer", "host.clipboard"] }
     },
     "entrypoints": {
       "type": "object",
@@ -134,6 +134,19 @@
         "contributions": { "type": "object", "propertyNames": { "$ref": "#/$defs/identifier" }, "additionalProperties": { "$ref": "#/$defs/contributionLocalization" } }
       }
     },
+    "formFieldCondition": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["field", "one_of"],
+      "properties": {
+        "field": { "$ref": "#/$defs/identifier" },
+        "one_of": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": ["string", "number", "boolean"] }
+        }
+      }
+    },
     "formField": {
       "type": "object",
       "additionalProperties": false,
@@ -141,13 +154,15 @@
       "properties": {
         "key": { "$ref": "#/$defs/identifier" },
         "label": { "type": "string", "minLength": 1 },
-        "type": { "enum": ["text", "password", "number", "boolean", "select", "textarea"] },
+        "type": { "enum": ["text", "path", "password", "number", "boolean", "select", "textarea"] },
         "description": { "type": ["string", "null"] },
         "placeholder": { "type": ["string", "null"] },
         "required": { "type": "boolean" },
         "default": { "type": ["string", "number", "boolean", "null"] },
         "options": { "type": "array", "items": { "$ref": "#/$defs/selectOption" } },
-        "binding": { "enum": ["config", "secret", "name", "host", "port", "username", "password", "database"] }
+        "binding": { "enum": ["config", "secret", "name", "host", "port", "username", "password", "database"] },
+        "visible_when": { "$ref": "#/$defs/formFieldCondition" },
+        "required_when": { "$ref": "#/$defs/formFieldCondition" }
       },
       "allOf": [
         {
@@ -164,7 +179,7 @@
             "properties": { "binding": { "enum": ["secret", "name", "host", "username", "password", "database"] } },
             "required": ["binding"]
           },
-          "then": { "properties": { "type": { "enum": ["text", "password", "select", "textarea"] } } }
+          "then": { "properties": { "type": { "enum": ["text", "path", "password", "select", "textarea"] } } }
         }
       ]
     },
@@ -185,7 +200,7 @@
         "capabilities": {
           "type": "array",
           "uniqueItems": true,
-          "items": { "enum": ["test", "connect", "disconnect"] }
+          "items": { "enum": ["test", "connect", "disconnect", "multiple-workbenches"] }
         },
         "actions": { "type": "array", "items": { "$ref": "#/$defs/connectionAction" } }
       }
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 66739b5aa3..1ba1ec01d8 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -69,6 +69,7 @@ sys-locale = "0.3"
 
 [dev-dependencies]
 tauri = { version = "2.10.3", features = ["test"] }
+tempfile = "3"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 objc2 = { version = "0.6.4", default-features = false, features = ["std"] }
diff --git a/src-tauri/src/commands/mod.rs b/src-tauri/src/commands/mod.rs
index 1ca267d7b8..dcac2dfd2b 100644
--- a/src-tauri/src/commands/mod.rs
+++ b/src-tauri/src/commands/mod.rs
@@ -30,6 +30,7 @@ pub mod mq_cmd;
 #[cfg(feature = "mq-admin")]
 pub mod mqtt_cmd;
 pub mod nacos_cmd;
+pub mod plugin_file_transfer;
 pub mod plugins;
 pub mod prompt_template;
 pub mod query;
diff --git a/src-tauri/src/commands/plugin_file_transfer.rs b/src-tauri/src/commands/plugin_file_transfer.rs
new file mode 100644
index 0000000000..01e3f3da2b
--- /dev/null
+++ b/src-tauri/src/commands/plugin_file_transfer.rs
@@ -0,0 +1,634 @@
+use std::collections::HashMap;
+use std::fs::{self, OpenOptions};
+use std::io::{Read, Seek, SeekFrom, Write};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use base64::Engine;
+use serde::Serialize;
+use tauri::{State, Window};
+use tauri_plugin_dialog::DialogExt;
+
+const TRANSFER_CHUNK_BYTES: usize = 256 * 1024;
+const MAX_TRANSFER_BYTES: u64 = 16 * 1024 * 1024 * 1024;
+const MAX_HANDLES_PER_WORKBENCH: usize = 32;
+const HANDLE_IDLE_TIMEOUT: Duration = Duration::from_secs(15 * 60);
+
+#[derive(Clone, Default)]
+pub struct PluginFileTransferState {
+    handles: Arc<Mutex<HashMap<String, TransferHandle>>>,
+}
+
+struct TransferHandle {
+    plugin_id: String,
+    workbench_id: String,
+    last_access: Instant,
+    kind: TransferHandleKind,
+}
+
+enum TransferHandleKind {
+    Source(SourceHandle),
+    Target(TargetHandle),
+}
+
+struct SourceHandle {
+    path: PathBuf,
+    size: u64,
+}
+
+struct TargetHandle {
+    path: PathBuf,
+    temporary_path: PathBuf,
+    backup_path: PathBuf,
+    expected_size: Option<u64>,
+    size: u64,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginFileTransferSource {
+    handle_id: String,
+    name: String,
+    size: u64,
+    content_type: String,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginFileTransferRead {
+    data_base64: String,
+    length: usize,
+    eof: bool,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginFileTransferTarget {
+    handle_id: String,
+    chunk_bytes: usize,
+}
+
+impl PluginFileTransferState {
+    fn cleanup_expired(&self) {
+        let expired = {
+            let mut handles = self.handles.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+            let expired_ids = handles
+                .iter()
+                .filter_map(|(id, handle)| (handle.last_access.elapsed() >= HANDLE_IDLE_TIMEOUT).then_some(id.clone()))
+                .collect::<Vec<_>>();
+            expired_ids.into_iter().filter_map(|id| handles.remove(&id)).collect::<Vec<_>>()
+        };
+        for handle in expired {
+            cleanup_handle(handle);
+        }
+    }
+
+    fn register_sources(
+        &self,
+        plugin_id: &str,
+        workbench_id: &str,
+        paths: Vec<PathBuf>,
+    ) -> Result<Vec<PluginFileTransferSource>, String> {
+        validate_owner(plugin_id, workbench_id)?;
+        self.cleanup_expired();
+        let sources = paths
+            .into_iter()
+            .filter_map(|path| {
+                let metadata = fs::metadata(&path).ok()?;
+                if !metadata.is_file() || metadata.len() > MAX_TRANSFER_BYTES {
+                    return None;
+                }
+                let name = path.file_name()?.to_string_lossy().into_owned();
+                Some((path, name, metadata.len()))
+            })
+            .collect::<Vec<_>>();
+
+        let mut handles = self.handles.lock().map_err(|_| "Plugin file transfer state is unavailable")?;
+        let existing = handles
+            .values()
+            .filter(|handle| handle.plugin_id == plugin_id && handle.workbench_id == workbench_id)
+            .count();
+        if existing + sources.len() > MAX_HANDLES_PER_WORKBENCH {
+            return Err(format!("Plugin workbenches are limited to {MAX_HANDLES_PER_WORKBENCH} file handles"));
+        }
+
+        let mut registered = Vec::with_capacity(sources.len());
+        for (path, name, size) in sources {
+            let handle_id = new_handle_id();
+            let content_type = "application/octet-stream".to_string();
+            handles.insert(
+                handle_id.clone(),
+                TransferHandle {
+                    plugin_id: plugin_id.to_string(),
+                    workbench_id: workbench_id.to_string(),
+                    last_access: Instant::now(),
+                    kind: TransferHandleKind::Source(SourceHandle { path, size }),
+                },
+            );
+            registered.push(PluginFileTransferSource { handle_id, name, size, content_type });
+        }
+        Ok(registered)
+    }
+
+    fn register_target(
+        &self,
+        plugin_id: &str,
+        workbench_id: &str,
+        path: PathBuf,
+        expected_size: Option<u64>,
+    ) -> Result<PluginFileTransferTarget, String> {
+        validate_owner(plugin_id, workbench_id)?;
+        if expected_size.is_some_and(|size| size > MAX_TRANSFER_BYTES) {
+            return Err("File transfers are limited to 16 GiB".to_string());
+        }
+        self.cleanup_expired();
+        let mut handles = self.handles.lock().map_err(|_| "Plugin file transfer state is unavailable")?;
+        let existing = handles
+            .values()
+            .filter(|handle| handle.plugin_id == plugin_id && handle.workbench_id == workbench_id)
+            .count();
+        if existing >= MAX_HANDLES_PER_WORKBENCH {
+            return Err(format!("Plugin workbenches are limited to {MAX_HANDLES_PER_WORKBENCH} file handles"));
+        }
+
+        let handle_id = new_handle_id();
+        let (temporary_path, backup_path) = transfer_paths(&path, &handle_id)?;
+        if backup_path.exists() {
+            fs::remove_file(&backup_path)
+                .map_err(|error| format!("Failed to remove stale download backup: {error}"))?;
+        }
+        OpenOptions::new()
+            .create_new(true)
+            .write(true)
+            .open(&temporary_path)
+            .map_err(|error| format!("Failed to create download temporary file: {error}"))?;
+        handles.insert(
+            handle_id.clone(),
+            TransferHandle {
+                plugin_id: plugin_id.to_string(),
+                workbench_id: workbench_id.to_string(),
+                last_access: Instant::now(),
+                kind: TransferHandleKind::Target(TargetHandle {
+                    path,
+                    temporary_path,
+                    backup_path,
+                    expected_size,
+                    size: 0,
+                }),
+            },
+        );
+        Ok(PluginFileTransferTarget { handle_id, chunk_bytes: TRANSFER_CHUNK_BYTES })
+    }
+
+    fn remove_owned(&self, plugin_id: &str, workbench_id: &str, handle_id: &str) -> Result<TransferHandle, String> {
+        validate_owner(plugin_id, workbench_id)?;
+        validate_handle_id(handle_id)?;
+        self.cleanup_expired();
+        let mut handles = self.handles.lock().map_err(|_| "Plugin file transfer state is unavailable")?;
+        let owned = handles
+            .get(handle_id)
+            .is_some_and(|handle| handle.plugin_id == plugin_id && handle.workbench_id == workbench_id);
+        if !owned {
+            return Err("File transfer handle is invalid, expired, or belongs to another workbench".to_string());
+        }
+        handles.remove(handle_id).ok_or_else(|| "File transfer handle is invalid or expired".to_string())
+    }
+
+    pub fn cleanup_workbench(&self, plugin_id: &str, workbench_id: &str) {
+        let removed = {
+            let mut handles = self.handles.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+            let ids = handles
+                .iter()
+                .filter_map(|(id, handle)| {
+                    (handle.plugin_id == plugin_id && handle.workbench_id == workbench_id).then_some(id.clone())
+                })
+                .collect::<Vec<_>>();
+            ids.into_iter().filter_map(|id| handles.remove(&id)).collect::<Vec<_>>()
+        };
+        for handle in removed {
+            cleanup_handle(handle);
+        }
+    }
+
+    pub fn cleanup_all(&self) {
+        let removed = {
+            let mut handles = self.handles.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+            handles.drain().map(|(_, handle)| handle).collect::<Vec<_>>()
+        };
+        for handle in removed {
+            cleanup_handle(handle);
+        }
+    }
+}
+
+pub fn start_plugin_file_transfer_sweeper(state: PluginFileTransferState) {
+    tauri::async_runtime::spawn(async move {
+        let mut interval = tokio::time::interval(Duration::from_secs(60));
+        loop {
+            interval.tick().await;
+            state.cleanup_expired();
+        }
+    });
+}
+
+#[tauri::command]
+pub async fn pick_plugin_file_transfer_sources(
+    window: Window,
+    state: State<'_, PluginFileTransferState>,
+    plugin_id: String,
+    workbench_id: String,
+    multiple: bool,
+) -> Result<Vec<PluginFileTransferSource>, String> {
+    validate_owner(&plugin_id, &workbench_id)?;
+    let (sender, receiver) = tokio::sync::oneshot::channel();
+    let dialog = window.dialog().file();
+    if multiple {
+        dialog.pick_files(move |paths| {
+            let _ = sender.send(paths.unwrap_or_default());
+        });
+    } else {
+        dialog.pick_file(move |path| {
+            let _ = sender.send(path.into_iter().collect());
+        });
+    }
+    let paths = receiver
+        .await
+        .map_err(|_| "File picker closed unexpectedly".to_string())?
+        .into_iter()
+        .map(|path| path.into_path().map_err(|error| format!("Failed to resolve selected file path: {error}")))
+        .collect::<Result<Vec<_>, _>>()?;
+    state.register_sources(&plugin_id, &workbench_id, paths)
+}
+
+#[tauri::command]
+pub async fn register_dropped_plugin_file_transfer_sources(
+    state: State<'_, PluginFileTransferState>,
+    plugin_id: String,
+    workbench_id: String,
+    paths: Vec<String>,
+) -> Result<Vec<PluginFileTransferSource>, String> {
+    state.register_sources(&plugin_id, &workbench_id, paths.into_iter().map(PathBuf::from).collect())
+}
+
+#[tauri::command]
+pub async fn read_plugin_file_transfer_source(
+    state: State<'_, PluginFileTransferState>,
+    plugin_id: String,
+    workbench_id: String,
+    handle_id: String,
+    offset: u64,
+    length: usize,
+) -> Result<PluginFileTransferRead, String> {
+    validate_owner(&plugin_id, &workbench_id)?;
+    validate_handle_id(&handle_id)?;
+    if length == 0 || length > TRANSFER_CHUNK_BYTES {
+        return Err(format!("File transfer reads are limited to {TRANSFER_CHUNK_BYTES} bytes"));
+    }
+    state.cleanup_expired();
+    let (path, size) = {
+        let mut handles = state.handles.lock().map_err(|_| "Plugin file transfer state is unavailable")?;
+        let handle = handles
+            .get_mut(&handle_id)
+            .filter(|handle| handle.plugin_id == plugin_id && handle.workbench_id == workbench_id)
+            .ok_or("File transfer handle is invalid, expired, or belongs to another workbench")?;
+        let TransferHandleKind::Source(source) = &handle.kind else {
+            return Err("File transfer handle is not a readable source".to_string());
+        };
+        if offset > source.size {
+            return Err(format!("File transfer offset {offset} exceeds source size {}", source.size));
+        }
+        handle.last_access = Instant::now();
+        (source.path.clone(), source.size)
+    };
+    let mut file =
+        OpenOptions::new().read(true).open(&path).map_err(|error| format!("Failed to open selected file: {error}"))?;
+    file.seek(SeekFrom::Start(offset)).map_err(|error| format!("Failed to seek selected file: {error}"))?;
+    let mut bytes = vec![0; length.min((size - offset) as usize)];
+    file.read_exact(&mut bytes).map_err(|error| format!("Failed to read selected file: {error}"))?;
+    Ok(PluginFileTransferRead {
+        data_base64: base64::engine::general_purpose::STANDARD.encode(&bytes),
+        length: bytes.len(),
+        eof: offset + bytes.len() as u64 >= size,
+    })
+}
+
+#[tauri::command]
+pub async fn begin_plugin_file_transfer_target(
+    window: Window,
+    state: State<'_, PluginFileTransferState>,
+    plugin_id: String,
+    workbench_id: String,
+    name: String,
+    expected_size: Option<u64>,
+) -> Result<Option<PluginFileTransferTarget>, String> {
+    validate_owner(&plugin_id, &workbench_id)?;
+    validate_download_name(&name)?;
+    let (sender, receiver) = tokio::sync::oneshot::channel();
+    window.dialog().file().set_file_name(name).save_file(move |path| {
+        let _ = sender.send(path);
+    });
+    let Some(path) = receiver.await.map_err(|_| "Save dialog closed unexpectedly".to_string())? else {
+        return Ok(None);
+    };
+    let path = path.into_path().map_err(|error| format!("Failed to resolve download target: {error}"))?;
+    state.register_target(&plugin_id, &workbench_id, path, expected_size).map(Some)
+}
+
+#[tauri::command]
+pub async fn write_plugin_file_transfer_target(
+    state: State<'_, PluginFileTransferState>,
+    plugin_id: String,
+    workbench_id: String,
+    handle_id: String,
+    offset: u64,
+    data_base64: String,
+) -> Result<u64, String> {
+    write_target(&state, &plugin_id, &workbench_id, &handle_id, offset, &data_base64)
+}
+
+fn write_target(
+    state: &PluginFileTransferState,
+    plugin_id: &str,
+    workbench_id: &str,
+    handle_id: &str,
+    offset: u64,
+    data_base64: &str,
+) -> Result<u64, String> {
+    validate_owner(plugin_id, workbench_id)?;
+    validate_handle_id(handle_id)?;
+    let bytes = base64::engine::general_purpose::STANDARD
+        .decode(data_base64)
+        .map_err(|error| format!("Invalid download data: {error}"))?;
+    if bytes.len() > TRANSFER_CHUNK_BYTES {
+        return Err(format!("File transfer writes are limited to {TRANSFER_CHUNK_BYTES} bytes"));
+    }
+    state.cleanup_expired();
+    let mut handles = state.handles.lock().map_err(|_| "Plugin file transfer state is unavailable")?;
+    let handle = handles
+        .get_mut(handle_id)
+        .filter(|handle| handle.plugin_id == plugin_id && handle.workbench_id == workbench_id)
+        .ok_or("File transfer handle is invalid, expired, or belongs to another workbench")?;
+    let TransferHandleKind::Target(target) = &mut handle.kind else {
+        return Err("File transfer handle is not a writable target".to_string());
+    };
+    if target.size != offset {
+        return Err(format!("File transfer offset {offset} does not match expected offset {}", target.size));
+    }
+    let next_offset = offset.checked_add(bytes.len() as u64).ok_or("File transfer size overflow")?;
+    if next_offset > MAX_TRANSFER_BYTES {
+        return Err("File transfers are limited to 16 GiB".to_string());
+    }
+    if target.expected_size.is_some_and(|size| next_offset > size) {
+        return Err("File transfer write exceeds the declared size".to_string());
+    }
+    let mut file = OpenOptions::new()
+        .write(true)
+        .open(&target.temporary_path)
+        .map_err(|error| format!("Failed to open download temporary file: {error}"))?;
+    let current_size = file.metadata().map_err(|error| error.to_string())?.len();
+    if current_size != offset {
+        return Err(format!("Download temporary file size {current_size} does not match offset {offset}"));
+    }
+    file.seek(SeekFrom::Start(offset)).map_err(|error| format!("Failed to seek download temporary file: {error}"))?;
+    file.write_all(&bytes).map_err(|error| format!("Failed to write download temporary file: {error}"))?;
+    file.flush().map_err(|error| format!("Failed to flush download temporary file: {error}"))?;
+    target.size = next_offset;
+    handle.last_access = Instant::now();
+    Ok(next_offset)
+}
+
+#[tauri::command]
+pub async fn finish_plugin_file_transfer_target(
+    state: State<'_, PluginFileTransferState>,
+    plugin_id: String,
+    workbench_id: String,
+    handle_id: String,
+) -> Result<(), String> {
+    finish_target(&state, &plugin_id, &workbench_id, &handle_id)
+}
+
+fn finish_target(
+    state: &PluginFileTransferState,
+    plugin_id: &str,
+    workbench_id: &str,
+    handle_id: &str,
+) -> Result<(), String> {
+    let handle = state.remove_owned(plugin_id, workbench_id, handle_id)?;
+    let TransferHandleKind::Target(target) = handle.kind else {
+        return Err("File transfer handle is not a writable target".to_string());
+    };
+    if target.expected_size.is_some_and(|size| target.size != size) {
+        cleanup_target(&target);
+        return Err(format!(
+            "File transfer is incomplete: received {} of {} bytes",
+            target.size,
+            target.expected_size.unwrap_or_default()
+        ));
+    }
+    commit_target(target)
+}
+
+#[tauri::command]
+pub async fn release_plugin_file_transfer_handle(
+    state: State<'_, PluginFileTransferState>,
+    plugin_id: String,
+    workbench_id: String,
+    handle_id: String,
+) -> Result<(), String> {
+    let handle = state.remove_owned(&plugin_id, &workbench_id, &handle_id)?;
+    cleanup_handle(handle);
+    Ok(())
+}
+
+#[tauri::command]
+pub async fn dispose_plugin_file_transfer_workbench(
+    state: State<'_, PluginFileTransferState>,
+    plugin_id: String,
+    workbench_id: String,
+) -> Result<(), String> {
+    validate_owner(&plugin_id, &workbench_id)?;
+    state.cleanup_workbench(&plugin_id, &workbench_id);
+    Ok(())
+}
+
+fn transfer_paths(target: &Path, handle_id: &str) -> Result<(PathBuf, PathBuf), String> {
+    validate_handle_id(handle_id)?;
+    let file_name = target.file_name().ok_or("Download target must be a file")?.to_string_lossy();
+    let parent = target.parent().ok_or("Download target must have a parent directory")?;
+    Ok((
+        parent.join(format!("{file_name}.dbx-{handle_id}.part")),
+        parent.join(format!("{file_name}.dbx-{handle_id}.backup")),
+    ))
+}
+
+fn commit_target(target: TargetHandle) -> Result<(), String> {
+    let target_existed = target.path.exists();
+    if target_existed {
+        if target.backup_path.exists() {
+            fs::remove_file(&target.backup_path)
+                .map_err(|error| format!("Failed to clear download backup: {error}"))?;
+        }
+        fs::rename(&target.path, &target.backup_path)
+            .map_err(|error| format!("Failed to back up existing download target: {error}"))?;
+    }
+    if let Err(error) = fs::rename(&target.temporary_path, &target.path) {
+        if target_existed {
+            let _ = fs::rename(&target.backup_path, &target.path);
+        }
+        let _ = fs::remove_file(&target.temporary_path);
+        return Err(format!("Failed to commit downloaded file: {error}"));
+    }
+    if target_existed {
+        let _ = fs::remove_file(&target.backup_path);
+    }
+    Ok(())
+}
+
+fn cleanup_target(target: &TargetHandle) {
+    let _ = fs::remove_file(&target.temporary_path);
+    if target.backup_path.exists() {
+        if target.path.exists() {
+            let _ = fs::remove_file(&target.backup_path);
+        } else {
+            let _ = fs::rename(&target.backup_path, &target.path);
+        }
+    }
+}
+
+fn cleanup_handle(handle: TransferHandle) {
+    if let TransferHandleKind::Target(target) = handle.kind {
+        cleanup_target(&target);
+    }
+}
+
+fn validate_owner(plugin_id: &str, workbench_id: &str) -> Result<(), String> {
+    if plugin_id.is_empty()
+        || plugin_id.len() > 128
+        || !plugin_id
+            .bytes()
+            .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'-' | b'_'))
+    {
+        return Err("Plugin file transfer pluginId is invalid".to_string());
+    }
+    if workbench_id.is_empty()
+        || workbench_id.len() > 128
+        || !workbench_id.bytes().all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b':' | b'-' | b'_'))
+    {
+        return Err("Plugin file transfer workbenchId is invalid".to_string());
+    }
+    Ok(())
+}
+
+fn validate_handle_id(handle_id: &str) -> Result<(), String> {
+    if handle_id.len() < 16
+        || handle_id.len() > 64
+        || !handle_id.bytes().all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+    {
+        return Err("Invalid plugin file transfer handle".to_string());
+    }
+    Ok(())
+}
+
+fn validate_download_name(name: &str) -> Result<(), String> {
+    if name.is_empty()
+        || name.len() > 255
+        || name.chars().any(|character| {
+            character.is_control() || matches!(character, '\\' | '/' | ':' | '*' | '?' | '"' | '<' | '>' | '|')
+        })
+    {
+        return Err("Download file name is invalid".to_string());
+    }
+    Ok(())
+}
+
+fn new_handle_id() -> String {
+    uuid::Uuid::new_v4().simple().to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn state_with_source(root: &Path) -> (PluginFileTransferState, PluginFileTransferSource) {
+        let path = root.join("source.bin");
+        fs::write(&path, b"source").unwrap();
+        let state = PluginFileTransferState::default();
+        let source = state.register_sources("io.dbx.test", "workbench-1", vec![path]).unwrap().remove(0);
+        (state, source)
+    }
+
+    #[test]
+    fn isolates_handles_by_plugin_and_workbench() {
+        let root = tempfile::tempdir().unwrap();
+        let (state, source) = state_with_source(root.path());
+
+        assert!(state.remove_owned("io.dbx.other", "workbench-1", &source.handle_id).is_err());
+        assert!(state.remove_owned("io.dbx.test", "workbench-2", &source.handle_id).is_err());
+        assert!(state.remove_owned("io.dbx.test", "workbench-1", &source.handle_id).is_ok());
+    }
+
+    #[test]
+    fn atomically_replaces_a_desktop_target() {
+        let root = tempfile::tempdir().unwrap();
+        let path = root.path().join("target.bin");
+        fs::write(&path, b"old").unwrap();
+        let state = PluginFileTransferState::default();
+        let target = state.register_target("io.dbx.test", "workbench-1", path.clone(), Some(3)).unwrap();
+        let handle = state.remove_owned("io.dbx.test", "workbench-1", &target.handle_id).unwrap();
+        let TransferHandleKind::Target(mut target) = handle.kind else {
+            panic!("expected target");
+        };
+        fs::write(&target.temporary_path, b"new").unwrap();
+        target.size = 3;
+        commit_target(target).unwrap();
+        assert_eq!(fs::read(path).unwrap(), b"new");
+    }
+
+    #[test]
+    fn rejects_untrusted_owner_and_handle_shapes() {
+        assert!(validate_owner("../plugin", "workbench-1").is_err());
+        assert!(validate_owner("io.dbx.test", "../workbench").is_err());
+        assert!(transfer_paths(Path::new("target.bin"), "../escape").is_err());
+    }
+
+    #[test]
+    fn enforces_offsets_chunk_limits_and_single_finish() {
+        let root = tempfile::tempdir().unwrap();
+        let path = root.path().join("target.bin");
+        let state = PluginFileTransferState::default();
+        let target = state.register_target("io.dbx.test", "workbench-1", path.clone(), Some(3)).unwrap();
+        let data = base64::engine::general_purpose::STANDARD.encode(b"new");
+
+        assert!(write_target(&state, "io.dbx.test", "workbench-1", &target.handle_id, 1, &data).is_err());
+        assert_eq!(write_target(&state, "io.dbx.test", "workbench-1", &target.handle_id, 0, &data).unwrap(), 3);
+        finish_target(&state, "io.dbx.test", "workbench-1", &target.handle_id).unwrap();
+        assert_eq!(fs::read(path).unwrap(), b"new");
+        assert!(finish_target(&state, "io.dbx.test", "workbench-1", &target.handle_id).is_err());
+
+        let too_large = base64::engine::general_purpose::STANDARD.encode(vec![0_u8; TRANSFER_CHUNK_BYTES + 1]);
+        let target = state.register_target("io.dbx.test", "workbench-1", root.path().join("large.bin"), None).unwrap();
+        assert!(write_target(&state, "io.dbx.test", "workbench-1", &target.handle_id, 0, &too_large).is_err());
+        state.cleanup_all();
+    }
+
+    #[test]
+    fn expires_idle_handles_and_removes_temporary_files() {
+        let root = tempfile::tempdir().unwrap();
+        let state = PluginFileTransferState::default();
+        let target = state.register_target("io.dbx.test", "workbench-1", root.path().join("target.bin"), None).unwrap();
+        let temporary_path = {
+            let mut handles = state.handles.lock().unwrap();
+            let handle = handles.get_mut(&target.handle_id).unwrap();
+            handle.last_access = Instant::now() - HANDLE_IDLE_TIMEOUT - Duration::from_secs(1);
+            let TransferHandleKind::Target(target) = &handle.kind else {
+                panic!("expected target");
+            };
+            target.temporary_path.clone()
+        };
+        assert!(temporary_path.exists());
+        state.cleanup_expired();
+        assert!(!temporary_path.exists());
+        assert!(state.remove_owned("io.dbx.test", "workbench-1", &target.handle_id).is_err());
+    }
+}
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index fc0a84c666..30ea2a248a 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -1499,6 +1499,9 @@ pub fn run() {
             app.manage(commands::deep_link::DeepLinkOpenState::default());
             app.manage(commands::update::PendingUpdateState::default());
             app.manage(commands::ssh_prompt::SshPromptState::new());
+            let plugin_file_transfer_state = commands::plugin_file_transfer::PluginFileTransferState::default();
+            commands::plugin_file_transfer::start_plugin_file_transfer_sweeper(plugin_file_transfer_state.clone());
+            app.manage(plugin_file_transfer_state);
             commands::ssh_prompt::install_ssh_prompt_bridge(app.handle());
             commands::ssh_prompt::install_ssh_notice_bridge(app.handle());
             #[cfg(target_os = "macos")]
@@ -1669,6 +1672,14 @@ pub fn run() {
             commands::plugins::read_plugin_asset,
             commands::plugins::read_plugin_ui_entry,
             commands::plugins::read_plugin_ui_asset,
+            commands::plugin_file_transfer::pick_plugin_file_transfer_sources,
+            commands::plugin_file_transfer::register_dropped_plugin_file_transfer_sources,
+            commands::plugin_file_transfer::read_plugin_file_transfer_source,
+            commands::plugin_file_transfer::begin_plugin_file_transfer_target,
+            commands::plugin_file_transfer::write_plugin_file_transfer_target,
+            commands::plugin_file_transfer::finish_plugin_file_transfer_target,
+            commands::plugin_file_transfer::release_plugin_file_transfer_handle,
+            commands::plugin_file_transfer::dispose_plugin_file_transfer_workbench,
             commands::plugins::list_jdbc_drivers,
             commands::plugins::list_jdbc_maven_bundles,
             commands::plugins::list_jdbc_local_bundles,
@@ -2210,6 +2221,11 @@ pub fn run() {
                     api.prevent_exit();
                     request_app_close(app_handle, "quit");
                 } else {
+                    if let Some(state) =
+                        app_handle.try_state::<commands::plugin_file_transfer::PluginFileTransferState>()
+                    {
+                        state.cleanup_all();
+                    }
                     tauri::async_runtime::block_on(async {
                         if let Some(server) = app_handle.try_state::<commands::redis_pubsub_server::PubSubServerState>()
                         {