diff --git a/frontend/src/layouts/MainLayout.vue b/frontend/src/layouts/MainLayout.vue
index 8d02373..c973f4a 100644
--- a/frontend/src/layouts/MainLayout.vue
+++ b/frontend/src/layouts/MainLayout.vue
@@ -211,7 +211,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, onMounted, onUnmounted } from "vue";
+import { ref, watch, onMounted, onUnmounted } from "vue";
 import { Call, Application } from "@wailsio/runtime";
 import { useAppStore } from "@/stores/app.store";
 import { useConnectionStore } from "@/stores/connection.store";
@@ -247,6 +247,13 @@ const sidebarWidth = ref(240);
 const sidebarTab = ref<SidebarTab>("connections");
 const quickConnectInput = ref("");
 
+// Auto-switch to SFTP tab when an SSH session becomes active
+watch(() => sessionStore.activeSession, (session) => {
+  if (session && session.protocol === "ssh") {
+    sidebarTab.value = "sftp";
+  }
+});
+
 /** Currently open file in the editor panel (null = no file open). */
 const editorFile = ref<{ content: string; path: string; sessionId: string } | null>(null);
 
diff --git a/internal/app/app.go b/internal/app/app.go
index 7adffdc..5e6a17e 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -261,11 +261,19 @@ func (a *WraithApp) ConnectSSH(connectionID int64, cols, rows int) (string, erro
 	var authMethods []gossh.AuthMethod
 	username := "root" // default
 
+	slog.Info("ConnectSSH resolving auth",
+		"connectionID", connectionID,
+		"host", conn.Hostname,
+		"credentialID", conn.CredentialID,
+		"vaultUnlocked", a.Credentials != nil,
+	)
+
 	if conn.CredentialID != nil && a.Credentials != nil {
 		cred, err := a.Credentials.GetCredential(*conn.CredentialID)
 		if err != nil {
 			slog.Warn("failed to load credential", "id", *conn.CredentialID, "error", err)
 		} else {
+			slog.Info("credential loaded", "name", cred.Name, "type", cred.Type, "username", cred.Username, "sshKeyID", cred.SSHKeyID)
 			if cred.Username != "" {
 				username = cred.Username
 			}