release-2.7.1 (#1296)

* Add Helm and GitOps deployment setup * fix: build better-sqlite3 from source in Docker (#1267) * fix: preserve runtime SSL settings (#1268) * fix: support forwarding from the memory SSH agent (#1269) * fix: support forwarding from the memory agent * style: format memory agent test * fix: prompt for encrypted SFTP key passphrases (#1270) * fix: prompt for SFTP key passphrases * style: format SSH key utility test * fix: include host context in automation notifications (#1271) * fix: include host context in automation notifications * style: format automation notification changes * fix: reserve sidebar height for host tags (#1272) * fix: keep host action rows stable at large font sizes (#1273) * fix: honor certificate setting during server probe (#1274) * fix: package standard Linux icon sizes (#1275) * fix: avoid duplicate Docker HTTPS listener (#1276) * Fix host status without metrics collection (#1277) * fix: allow eight-digit secure auth codes (#1263) Allow TOTP prompts to accept secure auth codes longer than six digits without blocking valid authentication attempts. Generated with Codebuff 🤖 Co-authored-by: Chetan <chetan.development@gmail.com> Co-authored-by: Codebuff <noreply@codebuff.com> * Harden Helm deployment defaults * Update Helm workflow action * Exclude Helm templates from Prettier * Fix browser RDP file drops (#1279) * Fix Proxmox guest credential usernames (#1280) * Add WSL local terminal option (#1281) * refactor: split the transfer engine into focused modules (#1282) * refactor: extract SFTP promisify helpers into sftp-promisify module * refactor: extract transfer timing and rate stats into transfer-stats module * refactor: extract transfer error classes and recovery checks into transfer-errors module * refactor: extract host/path utility helpers into transfer-host-utils module * refactor: extract SFTP directory tree helpers into transfer-sftp-dir module * refactor: extract segment copy job builder into transfer-segment-copy module * refactor: extract file scan and sample helpers into transfer-scan module * refactor: move throttled progress helper into transfer-stats module * style: format transfer modules * perf: optimize tmux monitor aggregation (#1283) * fix: reserve credential tag row height (#1284) * feat: edit AI provider model settings (#1285) * fix: clarify click-to-expand host setting (#1286) * fix: allow portable imports on remote databases (#1287) * fix: allow HTTPS to share the configured port (#1288) * fix: resolve synced jump hosts on the server (#1289) * fix: make terminal clipboard shortcuts layout independent (#1290) * fix: use compatible fetch dispatcher for Tailscale (#1291) * fix: add OIDC environment recovery override (#1292) * fix: coalesce rapid mobile terminal input (#1293) * fix: coalesce rapid mobile terminal input * fix: support clean xterm patch installs * fix: resolve synced remote desktop host IDs (#1295) * feat: make the SFTP file manager path bar editable (#1294) Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * feat: add passkey sign in to the login screen * fix: remove rounded corners from the host list search bar * fix: stop image storage settings text wrapping to one word per line * fix: prevent malformed websocket messages from crashing the server * chore: increment version * fix: remove gaps between host rows in the sidebar list Keep sub-pixel row measurements and stop wiping the size cache on hover. * fix: Failed to connect through jump hosts (#1180) https://github.com/Termix-SSH/Support/issues/1180 * feat: Progress bar for file downloads in the file manager (#1158) https://github.com/Termix-SSH/Support/issues/1158 * feat: Allow setting Silent OIDC Login via ENV var (#1174) https://github.com/Termix-SSH/Support/issues/1174 * feat: `IdentityFile` to limit the number of attempts by agents (#1165) https://github.com/Termix-SSH/Support/issues/1165 * feat: Credentials clone (#1159) https://github.com/Termix-SSH/Support/issues/1159 * chore: update release notes * docs: move helm setup guide to the docs site * fix: type errors in FilteredAgent agent identity handling * fix: remove stale better-sqlite3 prebuilds so the source build is used * fix: actually build better-sqlite3 from source so arm64 docker images work * fix: credential edit pencil in host editor and add clone action to credential list * fix: clear editingHost so the credential pencil actually opens the editor * chore: run format and lint * fix: folder drag and drop upload failing in the file manager * chore: sync Crowdin translations for 2.7.1 --------- Co-authored-by: alex-ctms <alex-ctms@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: Chetan Kumar <74929596+ckloop@users.noreply.github.com> Co-authored-by: Chetan <chetan.development@gmail.com> Co-authored-by: Codebuff <noreply@codebuff.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> Co-authored-by: dropafterfree <maxime.bonillo@gmail.com> Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com>
2026-08-30 02:41:34 +00:00 · 2026-08-22 19:47:40 -05:00
parent 566b908daf
commit 76fd9eedbf
165 changed files with 6778 additions and 2090 deletions
@@ -0,0 +1,41 @@
+import { createServer } from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+import { fetchWithProxy } from "../../utils/proxy-agent.js";
+
+describe("fetchWithProxy", () => {
+  const savedProxies = {
+    HTTP_PROXY: process.env.HTTP_PROXY,
+    HTTPS_PROXY: process.env.HTTPS_PROXY,
+    http_proxy: process.env.http_proxy,
+    https_proxy: process.env.https_proxy,
+  };
+
+  afterEach(() => {
+    for (const [name, value] of Object.entries(savedProxies)) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
+  it("uses a dispatcher compatible with the selected fetch implementation", async () => {
+    delete process.env.HTTP_PROXY;
+    delete process.env.HTTPS_PROXY;
+    delete process.env.http_proxy;
+    delete process.env.https_proxy;
+    const server = createServer((_request, response) => response.end("ok"));
+    await new Promise<void>((resolve) =>
+      server.listen(0, "127.0.0.1", resolve),
+    );
+
+    try {
+      const address = server.address();
+      if (!address || typeof address === "string") throw new Error("No port");
+      const response = await fetchWithProxy(`http://127.0.0.1:${address.port}`);
+      expect(await response.text()).toBe("ok");
+    } finally {
+      await new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      );
+    }
+  });
+});
@@ -4,6 +4,7 @@ import {
  parseSSHKey,
  parsePublicKey,
  preparePrivateKeyForSSH2,
+  isPrivateKeyPassphraseError,
  getFriendlyKeyTypeName,
  validateKeyPair,
 } from "../../utils/ssh-key-utils.js";
@@ -97,6 +98,22 @@ describe("parseSSHKey", () => {
  });
 });

+describe("isPrivateKeyPassphraseError", () => {
+  it("recognizes missing and incorrect passphrase errors", () => {
+    expect(
+      isPrivateKeyPassphraseError(
+        new Error(
+          "Encrypted OpenSSH private key detected, but no passphrase given",
+        ),
+      ),
+    ).toBe(true);
+    expect(isPrivateKeyPassphraseError(new Error("Bad passphrase"))).toBe(true);
+    expect(
+      isPrivateKeyPassphraseError(new Error("Unsupported key format")),
+    ).toBe(false);
+  });
+});
+
 describe("getFriendlyKeyTypeName", () => {
  it("maps known key types to friendly names", () => {
    expect(getFriendlyKeyTypeName("ssh-rsa")).toBe("RSA");
@@ -0,0 +1,99 @@
+import { describe, it, expect } from "vitest";
+import {
+  parseWsMessage,
+  asObject,
+  asString,
+  toTerminalDimension,
+  WsMessageError,
+} from "../../utils/ws-message.js";
+
+const frame = (s: string) => Buffer.from(s, "utf8");
+
+describe("parseWsMessage", () => {
+  it("parses a well-formed message", () => {
+    expect(parseWsMessage(frame('{"type":"ping"}'))).toEqual({
+      type: "ping",
+      data: undefined,
+    });
+    expect(parseWsMessage(frame('{"type":"input","data":"ls"}'))).toEqual({
+      type: "input",
+      data: "ls",
+    });
+  });
+
+  it("rejects JSON that parses but cannot be destructured", () => {
+    // The original DoS: JSON.parse("null") succeeds, so it escaped the
+    // try/catch and threw a TypeError on destructure.
+    for (const payload of ["null", "123", '"str"', "[1,2]", "true"]) {
+      expect(() => parseWsMessage(frame(payload))).toThrow(WsMessageError);
+    }
+  });
+
+  it("rejects invalid JSON", () => {
+    expect(() => parseWsMessage(frame("{oops"))).toThrow(WsMessageError);
+    expect(() => parseWsMessage(frame(""))).toThrow(WsMessageError);
+  });
+
+  it("rejects a missing or non-string type", () => {
+    expect(() => parseWsMessage(frame("{}"))).toThrow(WsMessageError);
+    expect(() => parseWsMessage(frame('{"type":5}'))).toThrow(WsMessageError);
+    expect(() => parseWsMessage(frame('{"type":null}'))).toThrow(
+      WsMessageError,
+    );
+  });
+
+  it("rejects oversized frames", () => {
+    const huge = Buffer.alloc(1024 * 1024 + 1, 0x20);
+    expect(() => parseWsMessage(huge)).toThrow(WsMessageError);
+  });
+
+  it("never throws a TypeError for any malformed input", () => {
+    const payloads = [
+      "null",
+      "0",
+      "[]",
+      "{}",
+      '{"type":{}}',
+      '{"data":"x"}',
+      "undefined",
+      '{"type":"a","data":null}',
+    ];
+    for (const p of payloads) {
+      try {
+        parseWsMessage(frame(p));
+      } catch (e) {
+        expect(e).toBeInstanceOf(WsMessageError);
+      }
+    }
+  });
+});
+
+describe("asObject / asString", () => {
+  it("narrows without throwing", () => {
+    expect(asObject({ a: 1 })).toEqual({ a: 1 });
+    expect(asObject(null)).toEqual({});
+    expect(asObject([1])).toEqual({});
+    expect(asObject("x")).toEqual({});
+    expect(asString("x")).toBe("x");
+    expect(asString(5)).toBe("");
+    expect(asString(undefined)).toBe("");
+  });
+});
+
+describe("toTerminalDimension", () => {
+  it("accepts sane values", () => {
+    expect(toTerminalDimension(80)).toBe(80);
+    expect(toTerminalDimension("120")).toBe(120);
+    expect(toTerminalDimension(24.7)).toBe(24);
+  });
+
+  it("rejects values that would poison setWindow", () => {
+    for (const bad of [0, -1, NaN, Infinity, null, undefined, "abc", {}]) {
+      expect(toTerminalDimension(bad)).toBe(0);
+    }
+  });
+
+  it("clamps absurdly large values", () => {
+    expect(toTerminalDimension(1e9)).toBe(10000);
+  });
+});