release-2.7.1 (#1296)

* Add Helm and GitOps deployment setup

* fix: build better-sqlite3 from source in Docker (#1267)

* fix: preserve runtime SSL settings (#1268)

* fix: support forwarding from the memory SSH agent (#1269)

* fix: support forwarding from the memory agent

* style: format memory agent test

* fix: prompt for encrypted SFTP key passphrases (#1270)

* fix: prompt for SFTP key passphrases

* style: format SSH key utility test

* fix: include host context in automation notifications (#1271)

* fix: include host context in automation notifications

* style: format automation notification changes

* fix: reserve sidebar height for host tags (#1272)

* fix: keep host action rows stable at large font sizes (#1273)

* fix: honor certificate setting during server probe (#1274)

* fix: package standard Linux icon sizes (#1275)

* fix: avoid duplicate Docker HTTPS listener (#1276)

* Fix host status without metrics collection (#1277)

* fix: allow eight-digit secure auth codes (#1263)

Allow TOTP prompts to accept secure auth codes longer than six digits without blocking valid authentication attempts.

Generated with Codebuff 🤖

Co-authored-by: Chetan <chetan.development@gmail.com>
Co-authored-by: Codebuff <noreply@codebuff.com>

* Harden Helm deployment defaults

* Update Helm workflow action

* Exclude Helm templates from Prettier

* Fix browser RDP file drops (#1279)

* Fix Proxmox guest credential usernames (#1280)

* Add WSL local terminal option (#1281)

* refactor: split the transfer engine into focused modules (#1282)

* refactor: extract SFTP promisify helpers into sftp-promisify module

* refactor: extract transfer timing and rate stats into transfer-stats module

* refactor: extract transfer error classes and recovery checks into transfer-errors module

* refactor: extract host/path utility helpers into transfer-host-utils module

* refactor: extract SFTP directory tree helpers into transfer-sftp-dir module

* refactor: extract segment copy job builder into transfer-segment-copy module

* refactor: extract file scan and sample helpers into transfer-scan module

* refactor: move throttled progress helper into transfer-stats module

* style: format transfer modules

* perf: optimize tmux monitor aggregation (#1283)

* fix: reserve credential tag row height (#1284)

* feat: edit AI provider model settings (#1285)

* fix: clarify click-to-expand host setting (#1286)

* fix: allow portable imports on remote databases (#1287)

* fix: allow HTTPS to share the configured port (#1288)

* fix: resolve synced jump hosts on the server (#1289)

* fix: make terminal clipboard shortcuts layout independent (#1290)

* fix: use compatible fetch dispatcher for Tailscale (#1291)

* fix: add OIDC environment recovery override (#1292)

* fix: coalesce rapid mobile terminal input (#1293)

* fix: coalesce rapid mobile terminal input

* fix: support clean xterm patch installs

* fix: resolve synced remote desktop host IDs (#1295)

* feat: make the SFTP file manager path bar editable (#1294)

Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>

* feat: add passkey sign in to the login screen

* fix: remove rounded corners from the host list search bar

* fix: stop image storage settings text wrapping to one word per line

* fix: prevent malformed websocket messages from crashing the server

* chore: increment version

* fix: remove gaps between host rows in the sidebar list

Keep sub-pixel row measurements and stop wiping the size cache on hover.

* fix: Failed to connect through jump hosts (#1180)

https://github.com/Termix-SSH/Support/issues/1180

* feat: Progress bar for file downloads in the file manager (#1158)

https://github.com/Termix-SSH/Support/issues/1158

* feat: Allow setting Silent OIDC Login via ENV var (#1174)

https://github.com/Termix-SSH/Support/issues/1174

* feat: `IdentityFile` to limit the number of attempts by agents (#1165)

https://github.com/Termix-SSH/Support/issues/1165

* feat: Credentials clone (#1159)

https://github.com/Termix-SSH/Support/issues/1159

* chore: update release notes

* docs: move helm setup guide to the docs site

* fix: type errors in FilteredAgent agent identity handling

* fix: remove stale better-sqlite3 prebuilds so the source build is used

* fix: actually build better-sqlite3 from source so arm64 docker images work

* fix: credential edit pencil in host editor and add clone action to credential list

* fix: clear editingHost so the credential pencil actually opens the editor

* chore: run format and lint

* fix: folder drag and drop upload failing in the file manager

* chore: sync Crowdin translations for 2.7.1

---------

Co-authored-by: alex-ctms <alex-ctms@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
Co-authored-by: Chetan Kumar <74929596+ckloop@users.noreply.github.com>
Co-authored-by: Chetan <chetan.development@gmail.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com>
Co-authored-by: dropafterfree <maxime.bonillo@gmail.com>
Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com>

src/ui/api/credentials-api.ts

@@ -55,6 +55,21 @@ export async function updateCredential(
   }
 }
 
+export async function duplicateCredential(
+  credentialId: number,
+  data: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  try {
+    const response = await authApi.post(
+      `/credentials/${credentialId}/duplicate`,
+      data,
+    );
+    return response.data;
+  } catch (error) {
+    throw handleApiError(error, "duplicate credential");
+  }
+}
+
 export async function deleteCredential(
   credentialId: number,
 ): Promise<Record<string, unknown>> {

src/ui/api/guacamole-api.ts

@@ -6,6 +6,7 @@ import {
 } from "@/main-axios";
 import type { AxiosInstance } from "axios";
 import type { GuacamoleConfig } from "@/types/guacamole-config";
+import { resolveRemoteHostId } from "@/lib/remote-server-api";
 
 /**
  * The embedded desktop backend does not bundle guacd, which is why
@@ -185,10 +186,18 @@ export async function getGuacamoleTokenFromHost(
     password?: string;
     domain?: string;
   },
+  syncId?: string | null,
 ): Promise<GuacamoleTokenResponse> {
   try {
+    const remoteHostId = isElectron()
+      ? await resolveRemoteHostId(syncId)
+      : null;
+    if (isElectron() && syncId && remoteHostId === null) {
+      throw new Error("The synced host does not exist on the remote server");
+    }
+    const targetHostId = remoteHostId ?? hostId;
     const response = await guacamoleApi().post(
-      `/guacamole/connect-host/${hostId}`,
+      `/guacamole/connect-host/${targetHostId}`,
       {
         ...(protocol ? { protocol } : {}),
         ...(promptedCredentials?.username

src/ui/api/ssh-file-operations-api.ts

@@ -549,14 +549,26 @@ export async function downloadSSHFile(
   }
 }
 
+export interface DownloadProgressEvent {
+  loaded: number;
+  total?: number;
+}
+
 export async function downloadSSHFileStream(
   sessionId: string,
   filePath: string,
+  onProgress?: (event: DownloadProgressEvent) => void,
 ): Promise<void> {
   const response = await getFileManagerApiForSession(sessionId).post(
     "/ssh/downloadFileStream",
     { sessionId, path: filePath },
-    { responseType: "blob", timeout: 0 },
+    {
+      responseType: "blob",
+      timeout: 0,
+      onDownloadProgress: onProgress
+        ? (event) => onProgress({ loaded: event.loaded, total: event.total })
+        : undefined,
+    },
   );
   const blob = response.data as Blob;
   const fileName = filePath.split("/").pop() || "download";

src/ui/api/user-management-api.ts

@@ -257,6 +257,7 @@ export async function updateOidcAutoProvision(
 
 export async function getOidcSilentLoginDefault(): Promise<{
   enabled: boolean;
+  locked?: boolean;
 }> {
   try {
     const response = await authApi.get("/users/oidc-silent-login-default");

src/ui/api/webauthn-api.ts

@@ -1,8 +1,14 @@
 import type {
+  AuthenticationResponseJSON,
   PublicKeyCredentialCreationOptionsJSON,
+  PublicKeyCredentialRequestOptionsJSON,
   RegistrationResponseJSON,
 } from "@simplewebauthn/browser";
-import { startRegistration } from "@simplewebauthn/browser";
+import {
+  browserSupportsWebAuthn,
+  startAuthentication,
+  startRegistration,
+} from "@simplewebauthn/browser";
 import { authApi, handleApiError } from "@/main-axios";
 
 export type WebAuthnUserVerification = "discouraged" | "preferred" | "required";
@@ -23,6 +29,53 @@ type RegistrationOptionsResponse = {
   challengeId: string;
 };
 
+type AuthenticationOptionsResponse = {
+  options: PublicKeyCredentialRequestOptionsJSON;
+  challengeId: string;
+};
+
+export type PasskeyLoginResult = {
+  success: boolean;
+  requires_totp?: boolean;
+  temp_token?: string;
+  is_admin?: boolean;
+  username?: string;
+  userId?: string;
+  is_oidc?: boolean;
+  totp_enabled?: boolean;
+  token?: string;
+};
+
+export function isPasskeySupported(): boolean {
+  return browserSupportsWebAuthn();
+}
+
+export async function loginWithPasskey(
+  username?: string,
+  rememberMe = false,
+): Promise<PasskeyLoginResult> {
+  try {
+    const optionsResponse = await authApi.post<AuthenticationOptionsResponse>(
+      "/users/webauthn/authenticate/options",
+      username ? { username } : {},
+    );
+    const credential = await startAuthentication({
+      optionsJSON: optionsResponse.data.options,
+    });
+    const verifyResponse = await authApi.post<PasskeyLoginResult>(
+      "/users/webauthn/authenticate/verify",
+      {
+        challengeId: optionsResponse.data.challengeId,
+        response: credential as AuthenticationResponseJSON,
+        rememberMe,
+      },
+    );
+    return verifyResponse.data;
+  } catch (error) {
+    throw handleApiError(error, "sign in with passkey");
+  }
+}
+
 export async function listWebAuthnCredentials(): Promise<{
   credentials: WebAuthnCredentialSummary[];
 }> {