refactor: merge mark and action toolbars to the right side

Place the mark toolbar to the left of the action toolbar on the same row
with an 8px gap, so the two button groups never overlap on tiny selections.

app.go

@@ -337,10 +337,20 @@ func (a *App) runSaveRemotePipeline(pngBytes []byte) error {
 	}
 	slog.Info("save-remote dispatch",
 		"host", cfg.SSH.Host, "user", cfg.SSH.User, "port", cfg.SSH.Port,
-		"png_size", len(pngBytes))
+		"auth_method", cfg.SSH.AuthMethod, "png_size", len(pngBytes))
+
+	// Select the uploader by auth method: Kerberos delegates to the system
+	// ssh/scp binaries (reusing the kinit credential cache), while builtin
+	// uses the in-process Go SSH client.
+	var uploader application.SSHUploader
+	if cfg.SSH.IsKerberos() {
+		uploader = sshpkg.NewKerberosUploader(cfg.SSH)
+	} else {
+		uploader = sshpkg.NewUploader(cfg.SSH)
+	}
 
 	svc := &application.CaptureAndSSHService{
-		Uploader:  sshpkg.NewUploader(cfg.SSH),
+		Uploader:  uploader,
 		Clipboard: a.clip,
 		Notifier:  &runtimeNotifier{ctx: a.ctx},
 		Cfg:       cfg.SSH,
@@ -446,7 +456,17 @@ func (a *App) TestConnection(cfg domain.S3Config) error {
 func (a *App) TestSSHConnection(cfg domain.SSHConfig) error {
 	slog.Info("RPC TestSSHConnection",
 		"host", cfg.Host, "user", cfg.User, "port", cfg.Port,
+		"auth_method", cfg.AuthMethod,
 		"strict_host_key", cfg.StrictHostKey, "has_password", cfg.Password != "")
+	// Kerberos auth delegates to the system ssh binary (see KerberosUploader)
+	// so its probe path differs from the in-process client.
+	if cfg.IsKerberos() {
+		if err := sshpkg.TestKerberosConnection(a.ctx, cfg); err != nil {
+			slog.Error("RPC TestSSHConnection (kerberos) failed", "err", err)
+			return err
+		}
+		return nil
+	}
 	if err := sshpkg.TestConnection(a.ctx, cfg); err != nil {
 		slog.Error("RPC TestSSHConnection failed", "err", err)
 		return err

frontend/src/App.vue

@@ -46,8 +46,8 @@ const activeTab = ref<SettingsTab>('general')
 // a one-line change. The label values match the user-facing tab names.
 const sidebarItems: Array<{ id: SettingsTab; label: string }> = [
   { id: 'general', label: 'General' },
-  { id: 's3', label: 'S3-Conf' },
+  { id: 's3', label: 'S3' },
-  { id: 'ssh', label: 'SSH-Conf' },
+  { id: 'ssh', label: 'SSH' },
 ]
 
 interface OverlayPayload {

frontend/src/views/CaptureOverlay.vue

@@ -111,14 +111,24 @@ const sizeLabel = computed(() => {
   return `${Math.round(rect.value.w)} × ${Math.round(rect.value.h)}`
 })
 
+const MARK_TOOLBAR_W = 190
+const ACTION_TOOLBAR_W = 180
+const TOOLBAR_GROUP_GAP = 8
+
 const rightToolbarPos = computed(() => {
   if (!rect.value) return null
-  return placeToolbar(rect.value, 180, 40, 'right')
+  return placeToolbar(rect.value, ACTION_TOOLBAR_W, 40, 'right')
 })
 
 const leftToolbarPos = computed(() => {
-  if (!rect.value) return null
+  if (!rect.value || !rightToolbarPos.value) return null
-  return placeToolbar(rect.value, 190, 40, 'left')
+  // 标记组与操作组合并到右侧，紧贴在操作组左侧，中间保留间隔
+  const x = clamp(
+    rightToolbarPos.value.x - TOOLBAR_GROUP_GAP - MARK_TOOLBAR_W,
+    0,
+    props.width - MARK_TOOLBAR_W
+  )
+  return { x, y: rightToolbarPos.value.y }
 })
 
 const handles = computed(() => {

frontend/src/views/SettingsView.vue

@@ -43,6 +43,7 @@ interface SSHConfig {
   host: string
   port: number
   user: string
+  authMethod: string
   password: string
   pathPrefix: string
   strictHostKey: boolean
@@ -77,6 +78,7 @@ function defaultConfig(): AppConfig {
       host: '',
       port: 22,
       user: '',
+      authMethod: 'password',
       password: '',
       pathPrefix: 'snapgo/',
       strictHostKey: false,
@@ -280,14 +282,27 @@ onMounted(load)
             placeholder="22"
           />
         </label>
-        <label class="field">
+        <div class="field-row auth-row">
-          <span>User *</span>
+          <label class="field">
-          <input v-model="config.ssh.user" placeholder="ubuntu" />
+            <span>Auth method</span>
-        </label>
+            <select v-model="config.ssh.authMethod">
-        <label class="field">
+              <option value="password">Password</option>
-          <span>Password (optional)</span>
+              <option value="key">SSH-Key</option>
-          <input v-model="config.ssh.password" type="password" />
+              <option value="kerberos">Kerberos</option>
-        </label>
+            </select>
+          </label>
+          <label class="field">
+            <span>User *</span>
+            <input v-model="config.ssh.user" placeholder="ubuntu" />
+          </label>
+          <label
+            v-if="config.ssh.authMethod === 'password'"
+            class="field"
+          >
+            <span>Password</span>
+            <input v-model="config.ssh.password" type="password" />
+          </label>
+        </div>
         <label class="field full">
           <span>Remote path (under home)</span>
           <div class="prefixed-input">
@@ -324,9 +339,23 @@ onMounted(load)
           </span>
         </label>
       </div>
-      <p v-if="!config.ssh.password" class="hint warn">
+      <p v-if="config.ssh.authMethod === 'kerberos'" class="hint">
-        Password is empty — please make sure password-less SSH is configured on
+        Kerberos mode delegates to the system <code>ssh</code>/<code>scp</code>.
-        this machine (e.g. via <code>ssh-copy-id</code> or your <code>ssh-agent</code>).
+        Run <code>kinit your.name@BYTEDANCE.COM</code> in a terminal first; tickets
+        expire (typically every 10–24h), so re-run <code>kinit</code> if uploads
+        start failing. Verify with <code>klist</code>.
+      </p>
+      <p v-else-if="config.ssh.authMethod === 'key'" class="hint">
+        SSH-Key mode uses your <code>ssh-agent</code> and <code>~/.ssh/id_*</code>
+        keys. Make sure password-less login already works (e.g. via
+        <code>ssh-copy-id</code>).
+      </p>
+      <p
+        v-else-if="config.ssh.authMethod === 'password' && !config.ssh.password"
+        class="hint warn"
+      >
+        Password is empty — enter the remote login password, or switch the auth
+        method to SSH-Key.
       </p>
 
       <div class="actions">
@@ -414,17 +443,30 @@ kbd {
 .field.full {
   grid-column: 1 / -1;
 }
+/* field-row groups several fields onto a single full-width row. auth-row
+   splits Auth method / User / Password roughly 1:2:2. */
+.field-row {
+  grid-column: 1 / -1;
+  display: grid;
+  gap: 12px 16px;
+}
+.auth-row {
+  grid-template-columns: 1fr 2fr 2fr;
+}
 .field span {
   color: #374151;
   font-weight: 500;
 }
 .field input[type='text'],
 .field input[type='number'],
-.field input:not([type='checkbox']) {
+.field input:not([type='checkbox']),
+.field select {
   border: 1px solid #d1d5db;
   border-radius: 6px;
   padding: 7px 10px;
   font-size: 13px;
+  line-height: 1.4;
+  height: 36px;
   background: #fff;
   color: inherit;
   outline: none;
@@ -432,7 +474,8 @@ kbd {
   width: 100%;
   box-sizing: border-box;
 }
-.field input:focus {
+.field input:focus,
+.field select:focus {
   border-color: #3b82f6;
   box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.18);
 }
@@ -560,6 +603,11 @@ kbd {
     border-color: #374151;
     color: #e5e7eb;
   }
+  .field select {
+    background: #111827;
+    border-color: #374151;
+    color: #e5e7eb;
+  }
   .field input:disabled {
     background: #1f2937;
     color: #6b7280;

frontend/wailsjs/go/models.ts

@@ -57,6 +57,7 @@ export namespace domain {
 	    host: string;
 	    port: number;
 	    user: string;
+	    authMethod: string;
 	    password: string;
 	    pathPrefix: string;
 	    strictHostKey: boolean;
@@ -72,6 +73,7 @@ export namespace domain {
 	        this.host = source["host"];
 	        this.port = source["port"];
 	        this.user = source["user"];
+	        this.authMethod = source["authMethod"];
 	        this.password = source["password"];
 	        this.pathPrefix = source["pathPrefix"];
 	        this.strictHostKey = source["strictHostKey"];

internal/domain/config.go

@@ -33,9 +33,22 @@ type S3Config struct {
 // Field design notes:
 //   - Host / Port form the destination endpoint. Port defaults to 22 when 0.
 //   - User is the SSH login name.
+//   - AuthMethod selects how the connection authenticates:
+//       "password"     → password only, via the in-process Go SSH client.
+//       "key"          → ssh-agent + ~/.ssh/id_* key files (no password),
+//                         via the in-process Go SSH client.
+//       "kerberos"     → delegate to the system /usr/bin/ssh binary so the
+//                         existing Kerberos (GSSAPI) credential cache from
+//                         `kinit` is reused. Native GSSAPI is required here
+//                         because macOS stores tickets in an API: ccache
+//                         that pure-Go SSH libraries cannot read.
+//       "" / "builtin" → legacy combined behaviour (password → agent → key
+//                         files) kept only for backward compatibility with
+//                         configs written before the method was split.
 //   - Password is optional; when empty the implementation falls back to the
 //     local SSH agent or ~/.ssh/id_* keys (i.e. the user is responsible for
 //     having password-less access already configured on this machine).
+//     It is ignored entirely when AuthMethod is "kerberos".
 //   - PathPrefix is interpreted *relative to the remote user's $HOME*. The
 //     UI presents it as "~/<PathPrefix>" so the user cannot escape the home
 //     directory by writing absolute paths. Leading "/" or "~" markers are
@@ -51,6 +64,7 @@ type SSHConfig struct {
 	Host               string `json:"host"`
 	Port               int    `json:"port"`
 	User               string `json:"user"`
+	AuthMethod         string `json:"authMethod"`
 	Password           string `json:"password"`
 	PathPrefix         string `json:"pathPrefix"`
 	StrictHostKey      bool   `json:"strictHostKey"`
@@ -58,6 +72,26 @@ type SSHConfig struct {
 	ConnectTimeoutSecs int    `json:"connectTimeoutSecs"`
 }
 
+// SSH authentication method identifiers stored in SSHConfig.AuthMethod.
+const (
+	// SSHAuthBuiltin is the legacy combined method (password → agent → key
+	// files). Retained for backward compatibility with older config files;
+	// new configs use the explicit methods below.
+	SSHAuthBuiltin = "builtin"
+	// SSHAuthPassword authenticates with the password field only.
+	SSHAuthPassword = "password"
+	// SSHAuthKey authenticates with ssh-agent / ~/.ssh/id_* key files only.
+	SSHAuthKey = "key"
+	// SSHAuthKerberos delegates to the system ssh binary so an existing
+	// Kerberos credential cache (populated by `kinit`) is reused via GSSAPI.
+	SSHAuthKerberos = "kerberos"
+)
+
+// IsKerberos reports whether this config requests Kerberos/GSSAPI auth.
+func (c SSHConfig) IsKerberos() bool {
+	return c.AuthMethod == SSHAuthKerberos
+}
+
 // AppConfig is the top-level on-disk configuration document.
 //
 // We keep S3 / SSH nested so that adding more providers later (e.g. AliyunOSS,

internal/infrastructure/ssh/client.go

@@ -385,7 +385,14 @@ func shellQuote(s string) string {
 }
 
 // buildAuthMethods chooses authentication methods given the supplied
-// configuration. See Dial's docstring for the priority order.
+// configuration.
+//
+// The method set is gated by cfg.AuthMethod:
+//   - SSHAuthPassword            → password only.
+//   - SSHAuthKey                 → ssh-agent + ~/.ssh/id_* key files only.
+//   - "" / SSHAuthBuiltin (legacy) → password (if set) + agent + key files.
+//
+// (Kerberos never reaches here; it uses the system ssh binary instead.)
 //
 // Returns a human-readable summary alongside the method slice so the
 // caller can include "password+agent+ed25519" (and similar) in its dial
@@ -393,47 +400,58 @@ func shellQuote(s string) string {
 func buildAuthMethods(cfg domain.SSHConfig) ([]ssh.AuthMethod, string, error) {
 	var methods []ssh.AuthMethod
 	var sources []string
-	if cfg.Password != "" {
+
+	// Decide which families are allowed for the selected method. An empty /
+	// "builtin" value preserves the original combined behaviour so configs
+	// written before the split keep working.
+	allowPassword := cfg.AuthMethod == domain.SSHAuthPassword ||
+		cfg.AuthMethod == domain.SSHAuthBuiltin || cfg.AuthMethod == ""
+	allowKey := cfg.AuthMethod == domain.SSHAuthKey ||
+		cfg.AuthMethod == domain.SSHAuthBuiltin || cfg.AuthMethod == ""
+
+	if allowPassword && cfg.Password != "" {
 		methods = append(methods, ssh.Password(cfg.Password))
 		sources = append(sources, "password")
 	}
-	if sock := os.Getenv("SSH_AUTH_SOCK"); sock != "" {
+	if allowKey {
-		if conn, err := net.Dial("unix", sock); err == nil {
+		if sock := os.Getenv("SSH_AUTH_SOCK"); sock != "" {
-			// 关键: 仅在 agent 真正持有 key 时才把它加入 auth methods.
+			if conn, err := net.Dial("unix", sock); err == nil {
-			//
+				// 关键: 仅在 agent 真正持有 key 时才把它加入 auth methods.
-			// macOS 的 launchd ssh-agent 即便没有任何 identity 也会响应,
+				//
-			// 此时若仍注册 PublicKeysCallback, x/crypto 会把它当作一次空的
+				// macOS 的 launchd ssh-agent 即便没有任何 identity 也会响应,
-			// publickey 尝试. 配合服务器的 MaxAuthTries 计数, 这次"空尝试"
+				// 此时若仍注册 PublicKeysCallback, x/crypto 会把它当作一次空的
-			// 会挤占后续基于磁盘私钥的认证机会, 最终导致
+				// publickey 尝试. 配合服务器的 MaxAuthTries 计数, 这次"空尝试"
-			// "[none publickey] no supported methods remain" —— 即便磁盘上
+				// 会挤占后续基于磁盘私钥的认证机会, 最终导致
-			// 的 key 本身完全可用. 因此空 agent 必须跳过.
+				// "[none publickey] no supported methods remain" —— 即便磁盘上
-			ag := agent.NewClient(conn)
+				// 的 key 本身完全可用. 因此空 agent 必须跳过.
-			if keys, lerr := ag.List(); lerr == nil && len(keys) > 0 {
+				ag := agent.NewClient(conn)
-				methods = append(methods, ssh.PublicKeysCallback(ag.Signers))
+				if keys, lerr := ag.List(); lerr == nil && len(keys) > 0 {
-				sources = append(sources, fmt.Sprintf("agent(%d)", len(keys)))
+					methods = append(methods, ssh.PublicKeysCallback(ag.Signers))
+					sources = append(sources, fmt.Sprintf("agent(%d)", len(keys)))
+				} else {
+					sshLog().Debug("ssh-agent has no identities; skipping",
+						"sock", sock, "list_err", lerr)
+				}
 			} else {
-				sshLog().Debug("ssh-agent has no identities; skipping",
+				sshLog().Debug("ssh-agent dial failed", "sock", sock, "err", err)
-					"sock", sock, "list_err", lerr)
+			}
+		}
+		home, err := os.UserHomeDir()
+		if err == nil {
+			// Probe the common default keys; any unreadable / missing file is
+			// silently skipped so the user never sees noise about keys they did
+			// not set up.
+			for _, name := range []string{"id_ed25519", "id_rsa", "id_ecdsa"} {
+				signer, err := loadPrivateKey(path.Join(home, ".ssh", name))
+				if err == nil && signer != nil {
+					methods = append(methods, ssh.PublicKeys(signer))
+					sources = append(sources, name)
+				}
 			}
 		} else {
-			sshLog().Debug("ssh-agent dial failed", "sock", sock, "err", err)
+			sshLog().Debug("home dir unavailable for ssh keys", "err", err)
 		}
 	}
-	home, err := os.UserHomeDir()
-	if err == nil {
-		// Probe the common default keys; any unreadable / missing file is
-		// silently skipped so the user never sees noise about keys they did
-		// not set up.
-		for _, name := range []string{"id_ed25519", "id_rsa", "id_ecdsa"} {
-			signer, err := loadPrivateKey(path.Join(home, ".ssh", name))
-			if err == nil && signer != nil {
-				methods = append(methods, ssh.PublicKeys(signer))
-				sources = append(sources, name)
-			}
-		}
-	} else {
-		sshLog().Debug("home dir unavailable for ssh keys", "err", err)
-	}
 	if len(sources) == 0 {
 		return methods, "none", nil
 	}

internal/infrastructure/ssh/kerberos_uploader.go

@@ -0,0 +1,230 @@
+// kerberos_uploader.go — an SSHUploader implementation that delegates to
+// the system /usr/bin/ssh + /usr/bin/scp binaries so an existing Kerberos
+// (GSSAPI) credential cache populated by `kinit` is reused transparently.
+//
+// 设计理由 (为什么不用 golang.org/x/crypto/ssh 做 Kerberos):
+//   - macOS 的 Kerberos 票据默认存放在 API: 类型的 credential cache 中,
+//     由系统 GSSD (Heimdal) 守护进程托管. Go 生态的 gokrb5 只能读取
+//     FILE: 类型 ccache 与 keytab, 无法访问 API: ccache, 因此在 macOS 上
+//     用纯 Go 实现 GSSAPI 认证基本不可行.
+//   - 系统自带的 /usr/bin/ssh 原生集成 Heimdal GSSAPI, 用户 `kinit` 之后
+//     的票据可被直接复用. 把上传委托给系统 ssh/scp 是最稳妥的方案, 也与
+//     用户"命令行能免密登录即可"的预期完全一致.
+//   - 仅在 AuthMethod == kerberos 时启用此实现; builtin 路径不受影响.
+package ssh
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/mmmy/snapgo/internal/domain"
+)
+
+// systemSSHPath / systemSCPPath are the absolute paths to the macOS system
+// binaries. We use absolute paths rather than relying on $PATH so a hijacked
+// PATH cannot redirect us to an arbitrary binary, and because GUI apps on
+// macOS often launch with a minimal PATH that omits /usr/bin entirely.
+const (
+	systemSSHPath = "/usr/bin/ssh"
+	systemSCPPath = "/usr/bin/scp"
+)
+
+// KerberosUploader satisfies application.SSHUploader by shelling out to the
+// system scp binary with GSSAPI authentication enabled.
+type KerberosUploader struct {
+	cfg domain.SSHConfig
+}
+
+// NewKerberosUploader returns an uploader that delegates to system scp.
+func NewKerberosUploader(cfg domain.SSHConfig) *KerberosUploader {
+	return &KerberosUploader{cfg: cfg}
+}
+
+// Upload writes data to remoteRelPath (relative to the remote $HOME) by
+// staging it in a local temp file and invoking system scp once.
+//
+// We stage to a temp file because scp transfers files, not stdin; piping a
+// stream would require the more fragile `scp -t` sink protocol that we only
+// use for the in-process client. A temp file is simpler and robust.
+func (u *KerberosUploader) Upload(ctx context.Context, remoteRelPath string, data []byte, mode os.FileMode) error {
+	start := time.Now()
+	cleaned := normaliseRemotePath(remoteRelPath)
+	if cleaned == "" {
+		return fmt.Errorf("ssh(kerberos): remote path is empty")
+	}
+	sshLog().Info("kerberos uploader start",
+		"host", u.cfg.Host, "user", u.cfg.User, "port", u.cfg.Port,
+		"remote_path", cleaned, "size", len(data))
+
+	// 1. Ensure the remote directory tree exists. scp itself will not create
+	//    intermediate directories, so we run a remote `mkdir -p` first.
+	dir, _ := path.Split(cleaned)
+	dir = strings.Trim(dir, "/")
+	if dir != "" {
+		if err := u.runRemoteMkdir(ctx, dir); err != nil {
+			sshLog().Error("kerberos uploader mkdir failed",
+				"dir", dir, "elapsed", time.Since(start), "err", err)
+			return err
+		}
+	}
+
+	// 2. Stage the payload to a local temp file for scp to read.
+	tmp, err := os.CreateTemp("", "snapgo-scp-*.png")
+	if err != nil {
+		return fmt.Errorf("ssh(kerberos): create temp: %w", err)
+	}
+	tmpPath := tmp.Name()
+	defer os.Remove(tmpPath)
+	if _, err := tmp.Write(data); err != nil {
+		_ = tmp.Close()
+		return fmt.Errorf("ssh(kerberos): write temp: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("ssh(kerberos): close temp: %w", err)
+	}
+	if err := os.Chmod(tmpPath, mode.Perm()); err != nil {
+		sshLog().Debug("kerberos uploader chmod temp failed", "err", err)
+	}
+
+	// 3. scp the temp file to "user@host:cleaned" (cleaned is relative to
+	//    $HOME, which scp interprets correctly for a remote login shell).
+	remoteTarget := fmt.Sprintf("%s@%s:%s", u.cfg.User, u.cfg.Host, cleaned)
+	args := append(u.commonSCPArgs(), tmpPath, remoteTarget)
+	if err := u.runCommand(ctx, systemSCPPath, args); err != nil {
+		sshLog().Error("kerberos uploader scp failed",
+			"remote_path", cleaned, "elapsed", time.Since(start), "err", err)
+		return err
+	}
+	sshLog().Info("kerberos uploader done",
+		"remote_path", cleaned, "size", len(data), "total_elapsed", time.Since(start))
+	return nil
+}
+
+// runRemoteMkdir runs `mkdir -p ~/<dir>` on the remote host via system ssh.
+func (u *KerberosUploader) runRemoteMkdir(ctx context.Context, dir string) error {
+	remote := fmt.Sprintf("%s@%s", u.cfg.User, u.cfg.Host)
+	// Quote the directory so spaces / metacharacters cannot break the shell
+	// command. dir is already normalised (no leading ~ or /).
+	cmd := "mkdir -p " + shellQuote("./"+dir)
+	args := append(u.commonSSHArgs(), remote, cmd)
+	return u.runCommand(ctx, systemSSHPath, args)
+}
+
+// commonSSHArgs builds the shared option set that enables GSSAPI auth and
+// disables interactive prompts (we want a hard failure, never a hang waiting
+// for a password the GUI cannot answer).
+func (u *KerberosUploader) commonSSHArgs() []string {
+	port := u.cfg.Port
+	if port <= 0 {
+		port = 22
+	}
+	timeout := u.cfg.ConnectTimeoutSecs
+	if timeout <= 0 {
+		timeout = 10
+	}
+	args := []string{
+		"-p", strconv.Itoa(port),
+		"-o", "GSSAPIAuthentication=yes",
+		"-o", "GSSAPIDelegateCredentials=no",
+		"-o", "PreferredAuthentications=gssapi-with-mic,gssapi-keyex",
+		"-o", "PubkeyAuthentication=no",
+		"-o", "PasswordAuthentication=no",
+		"-o", "KbdInteractiveAuthentication=no",
+		"-o", "BatchMode=yes",
+		"-o", "ConnectTimeout=" + strconv.Itoa(timeout),
+	}
+	args = append(args, u.hostKeyArgs()...)
+	return args
+}
+
+// commonSCPArgs mirrors commonSSHArgs but uses scp's uppercase -P port flag.
+func (u *KerberosUploader) commonSCPArgs() []string {
+	port := u.cfg.Port
+	if port <= 0 {
+		port = 22
+	}
+	timeout := u.cfg.ConnectTimeoutSecs
+	if timeout <= 0 {
+		timeout = 10
+	}
+	args := []string{
+		"-P", strconv.Itoa(port),
+		"-o", "GSSAPIAuthentication=yes",
+		"-o", "GSSAPIDelegateCredentials=no",
+		"-o", "PreferredAuthentications=gssapi-with-mic,gssapi-keyex",
+		"-o", "PubkeyAuthentication=no",
+		"-o", "PasswordAuthentication=no",
+		"-o", "KbdInteractiveAuthentication=no",
+		"-o", "BatchMode=yes",
+		"-o", "ConnectTimeout=" + strconv.Itoa(timeout),
+	}
+	args = append(args, u.hostKeyArgs()...)
+	return args
+}
+
+// hostKeyArgs maps StrictHostKey onto OpenSSH's StrictHostKeyChecking option,
+// keeping behaviour consistent with the in-process client.
+func (u *KerberosUploader) hostKeyArgs() []string {
+	if u.cfg.StrictHostKey {
+		if u.cfg.KnownHostsPath != "" {
+			return []string{
+				"-o", "StrictHostKeyChecking=yes",
+				"-o", "UserKnownHostsFile=" + u.cfg.KnownHostsPath,
+			}
+		}
+		return []string{"-o", "StrictHostKeyChecking=yes"}
+	}
+	// Non-strict: accept new keys automatically but still record them. This
+	// mirrors the in-process InsecureIgnoreHostKey trade-off the UI warns of.
+	return []string{"-o", "StrictHostKeyChecking=accept-new"}
+}
+
+// runCommand executes the given binary, capturing combined stderr so a
+// failure surfaces the remote/OpenSSH diagnostic instead of a bare exit code.
+func (u *KerberosUploader) runCommand(ctx context.Context, bin string, args []string) error {
+	cmd := exec.CommandContext(ctx, bin, args...)
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	sshLog().Debug("kerberos exec", "bin", bin, "args", strings.Join(args, " "))
+	if err := cmd.Run(); err != nil {
+		msg := strings.TrimSpace(stderr.String())
+		if msg == "" {
+			msg = err.Error()
+		}
+		return fmt.Errorf("%s failed: %s", path.Base(bin), msg)
+	}
+	return nil
+}
+
+// TestKerberosConnection probes the remote host with system ssh, surfacing a
+// clear hint when no valid ticket is present.
+func TestKerberosConnection(ctx context.Context, cfg domain.SSHConfig) error {
+	sshLog().Info("kerberos test connection start",
+		"host", cfg.Host, "user", cfg.User, "port", cfg.Port)
+	u := &KerberosUploader{cfg: cfg}
+	remote := fmt.Sprintf("%s@%s", cfg.User, cfg.Host)
+	args := append(u.commonSSHArgs(), remote, "true")
+	if err := u.runCommand(ctx, systemSSHPath, args); err != nil {
+		// Detect the most common cause: no/expired Kerberos ticket.
+		if !hasKerberosTicket(ctx) {
+			return fmt.Errorf("no valid Kerberos ticket found — run `kinit %s@BYTEDANCE.COM` first (%w)", cfg.User, err)
+		}
+		return err
+	}
+	sshLog().Info("kerberos test connection ok")
+	return nil
+}
+
+// hasKerberosTicket reports whether `klist -s` indicates a valid ticket.
+// `klist -s` exits 0 when a valid TGT exists, non-zero otherwise.
+func hasKerberosTicket(ctx context.Context) bool {
+	cmd := exec.CommandContext(ctx, "/usr/bin/klist", "-s")
+	return cmd.Run() == nil
+}

native_overlay_darwin.go

@@ -633,8 +633,11 @@ static id nativeOverlayKeyMonitor = nil;
     [_saveRemoteButton setFrame:NSMakeRect(baseX + (actionBtnSize + actionGap) * 3, btnY, actionBtnSize, actionBtnSize)];
     [_uploadButton     setFrame:NSMakeRect(baseX + (actionBtnSize + actionGap) * 4, btnY, actionBtnSize, actionBtnSize)];
 
+    // Mark toolbar sits to the LEFT of the action toolbar (same row) with an
+    // 8px gap between the two groups, so they never overlap on tiny selections.
     CGFloat markW = 170;
-    CGFloat markX = MAX(0, MIN(_selection.origin.x, self.bounds.size.width - markW));
+    CGFloat markGap = 8;
+    CGFloat markX = MAX(0, x - markGap - markW);
     [_penButton setFrame:NSMakeRect(markX + 4, y + 4, 28, 28)];
     [_rectButton setFrame:NSMakeRect(markX + 36, y + 4, 28, 28)];
     [_ellipseButton setFrame:NSMakeRect(markX + 68, y + 4, 28, 28)];