release-2.7.1 (#1296)

* Add Helm and GitOps deployment setup * fix: build better-sqlite3 from source in Docker (#1267) * fix: preserve runtime SSL settings (#1268) * fix: support forwarding from the memory SSH agent (#1269) * fix: support forwarding from the memory agent * style: format memory agent test * fix: prompt for encrypted SFTP key passphrases (#1270) * fix: prompt for SFTP key passphrases * style: format SSH key utility test * fix: include host context in automation notifications (#1271) * fix: include host context in automation notifications * style: format automation notification changes * fix: reserve sidebar height for host tags (#1272) * fix: keep host action rows stable at large font sizes (#1273) * fix: honor certificate setting during server probe (#1274) * fix: package standard Linux icon sizes (#1275) * fix: avoid duplicate Docker HTTPS listener (#1276) * Fix host status without metrics collection (#1277) * fix: allow eight-digit secure auth codes (#1263) Allow TOTP prompts to accept secure auth codes longer than six digits without blocking valid authentication attempts. Generated with Codebuff 🤖 Co-authored-by: Chetan <chetan.development@gmail.com> Co-authored-by: Codebuff <noreply@codebuff.com> * Harden Helm deployment defaults * Update Helm workflow action * Exclude Helm templates from Prettier * Fix browser RDP file drops (#1279) * Fix Proxmox guest credential usernames (#1280) * Add WSL local terminal option (#1281) * refactor: split the transfer engine into focused modules (#1282) * refactor: extract SFTP promisify helpers into sftp-promisify module * refactor: extract transfer timing and rate stats into transfer-stats module * refactor: extract transfer error classes and recovery checks into transfer-errors module * refactor: extract host/path utility helpers into transfer-host-utils module * refactor: extract SFTP directory tree helpers into transfer-sftp-dir module * refactor: extract segment copy job builder into transfer-segment-copy module * refactor: extract file scan and sample helpers into transfer-scan module * refactor: move throttled progress helper into transfer-stats module * style: format transfer modules * perf: optimize tmux monitor aggregation (#1283) * fix: reserve credential tag row height (#1284) * feat: edit AI provider model settings (#1285) * fix: clarify click-to-expand host setting (#1286) * fix: allow portable imports on remote databases (#1287) * fix: allow HTTPS to share the configured port (#1288) * fix: resolve synced jump hosts on the server (#1289) * fix: make terminal clipboard shortcuts layout independent (#1290) * fix: use compatible fetch dispatcher for Tailscale (#1291) * fix: add OIDC environment recovery override (#1292) * fix: coalesce rapid mobile terminal input (#1293) * fix: coalesce rapid mobile terminal input * fix: support clean xterm patch installs * fix: resolve synced remote desktop host IDs (#1295) * feat: make the SFTP file manager path bar editable (#1294) Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * feat: add passkey sign in to the login screen * fix: remove rounded corners from the host list search bar * fix: stop image storage settings text wrapping to one word per line * fix: prevent malformed websocket messages from crashing the server * chore: increment version * fix: remove gaps between host rows in the sidebar list Keep sub-pixel row measurements and stop wiping the size cache on hover. * fix: Failed to connect through jump hosts (#1180) https://github.com/Termix-SSH/Support/issues/1180 * feat: Progress bar for file downloads in the file manager (#1158) https://github.com/Termix-SSH/Support/issues/1158 * feat: Allow setting Silent OIDC Login via ENV var (#1174) https://github.com/Termix-SSH/Support/issues/1174 * feat: `IdentityFile` to limit the number of attempts by agents (#1165) https://github.com/Termix-SSH/Support/issues/1165 * feat: Credentials clone (#1159) https://github.com/Termix-SSH/Support/issues/1159 * chore: update release notes * docs: move helm setup guide to the docs site * fix: type errors in FilteredAgent agent identity handling * fix: remove stale better-sqlite3 prebuilds so the source build is used * fix: actually build better-sqlite3 from source so arm64 docker images work * fix: credential edit pencil in host editor and add clone action to credential list * fix: clear editingHost so the credential pencil actually opens the editor * chore: run format and lint * fix: folder drag and drop upload failing in the file manager * chore: sync Crowdin translations for 2.7.1 --------- Co-authored-by: alex-ctms <alex-ctms@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: Chetan Kumar <74929596+ckloop@users.noreply.github.com> Co-authored-by: Chetan <chetan.development@gmail.com> Co-authored-by: Codebuff <noreply@codebuff.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> Co-authored-by: dropafterfree <maxime.bonillo@gmail.com> Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com>
2026-08-29 18:31:33 +00:00 · 2026-08-22 19:47:40 -05:00
parent 566b908daf
commit 76fd9eedbf
165 changed files with 6778 additions and 2090 deletions
@@ -9,6 +9,7 @@ const remoteApiMock = vi.hoisted(() => ({
  post: vi.fn(async () => ({ data: { token: "remote-token" } })),
 }));
 const isElectronMock = vi.hoisted(() => vi.fn(() => false));
+const resolveRemoteHostIdMock = vi.hoisted(() => vi.fn());

 vi.mock("@/main-axios", () => ({
  authApi: authApiMock,
@@ -16,6 +17,9 @@ vi.mock("@/main-axios", () => ({
  isElectron: isElectronMock,
  handleApiError: (error: unknown) => error,
 }));
+vi.mock("@/lib/remote-server-api", () => ({
+  resolveRemoteHostId: resolveRemoteHostIdMock,
+}));

 import {
  getGuacdStatus,
@@ -27,6 +31,7 @@ beforeEach(() => {
  authApiMock.post.mockClear();
  remoteApiMock.get.mockClear();
  remoteApiMock.post.mockClear();
+  resolveRemoteHostIdMock.mockReset();
 });

 describe("guacamole API origin", () => {
@@ -60,15 +65,21 @@ describe("guacamole API origin", () => {

  it("sends the connect-host payload unchanged to the remote server", async () => {
    isElectronMock.mockReturnValue(true);
+    resolveRemoteHostIdMock.mockResolvedValue(41);

-    await getGuacamoleTokenFromHost(9, "rdp", {
-      username: "admin",
-      password: "secret",
-      domain: "EXAMPLE",
-    });
+    await getGuacamoleTokenFromHost(
+      9,
+      "rdp",
+      {
+        username: "admin",
+        password: "secret",
+        domain: "EXAMPLE",
+      },
+      "host-sync-id",
+    );

    expect(remoteApiMock.post).toHaveBeenCalledWith(
-      "/guacamole/connect-host/9",
+      "/guacamole/connect-host/41",
      {
        protocol: "rdp",
        promptedUsername: "admin",
@@ -76,6 +87,7 @@ describe("guacamole API origin", () => {
        promptedDomain: "EXAMPLE",
      },
    );
+    expect(resolveRemoteHostIdMock).toHaveBeenCalledWith("host-sync-id");
  });

  it("sends an empty prompted domain for local RDP accounts", async () => {
@@ -94,4 +106,14 @@ describe("guacamole API origin", () => {
      promptedDomain: "",
    });
  });
+
+  it("does not fall back to a colliding local id when sync resolution fails", async () => {
+    isElectronMock.mockReturnValue(true);
+    resolveRemoteHostIdMock.mockResolvedValue(null);
+
+    await expect(
+      getGuacamoleTokenFromHost(9, "rdp", undefined, "missing-sync-id"),
+    ).rejects.toThrow("The synced host does not exist on the remote server");
+    expect(remoteApiMock.post).not.toHaveBeenCalled();
+  });
 });
@@ -0,0 +1,121 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+
+const authApiMock = vi.hoisted(() => ({
+  get: vi.fn(async () => ({ data: {} })),
+  post: vi.fn(async () => ({ data: {} })),
+  delete: vi.fn(async () => ({ data: { success: true } })),
+}));
+
+const browserMock = vi.hoisted(() => ({
+  startAuthentication: vi.fn(async () => ({ id: "cred-1" })),
+  startRegistration: vi.fn(async () => ({ id: "cred-1" })),
+  browserSupportsWebAuthn: vi.fn(() => true),
+}));
+
+vi.mock("@/main-axios", () => ({
+  authApi: authApiMock,
+  handleApiError: (error: unknown) => error,
+}));
+
+vi.mock("@simplewebauthn/browser", () => browserMock);
+
+import { isPasskeySupported, loginWithPasskey } from "../../api/webauthn-api";
+
+beforeEach(() => {
+  authApiMock.get.mockClear();
+  authApiMock.post.mockClear();
+  authApiMock.delete.mockClear();
+  browserMock.startAuthentication.mockClear();
+  browserMock.browserSupportsWebAuthn.mockClear();
+});
+
+describe("isPasskeySupported", () => {
+  it("reports what the browser helper returns", () => {
+    browserMock.browserSupportsWebAuthn.mockReturnValueOnce(false);
+    expect(isPasskeySupported()).toBe(false);
+    browserMock.browserSupportsWebAuthn.mockReturnValueOnce(true);
+    expect(isPasskeySupported()).toBe(true);
+  });
+});
+
+describe("loginWithPasskey", () => {
+  it("passes the challenge from options through to verify", async () => {
+    authApiMock.post
+      .mockResolvedValueOnce({
+        data: { options: { challenge: "abc" }, challengeId: "chal-1" },
+      })
+      .mockResolvedValueOnce({ data: { success: true, username: "luke" } });
+
+    const result = await loginWithPasskey("luke", true);
+
+    expect(authApiMock.post).toHaveBeenNthCalledWith(
+      1,
+      "/users/webauthn/authenticate/options",
+      { username: "luke" },
+    );
+    expect(browserMock.startAuthentication).toHaveBeenCalledWith({
+      optionsJSON: { challenge: "abc" },
+    });
+    expect(authApiMock.post).toHaveBeenNthCalledWith(
+      2,
+      "/users/webauthn/authenticate/verify",
+      {
+        challengeId: "chal-1",
+        response: { id: "cred-1" },
+        rememberMe: true,
+      },
+    );
+    expect(result).toEqual({ success: true, username: "luke" });
+  });
+
+  it("omits the username so discoverable passkeys work", async () => {
+    authApiMock.post
+      .mockResolvedValueOnce({
+        data: { options: { challenge: "abc" }, challengeId: "chal-2" },
+      })
+      .mockResolvedValueOnce({ data: { success: true } });
+
+    await loginWithPasskey();
+
+    expect(authApiMock.post).toHaveBeenNthCalledWith(
+      1,
+      "/users/webauthn/authenticate/options",
+      {},
+    );
+    expect(authApiMock.post).toHaveBeenNthCalledWith(
+      2,
+      "/users/webauthn/authenticate/verify",
+      expect.objectContaining({ rememberMe: false }),
+    );
+  });
+
+  it("returns the totp challenge instead of a session", async () => {
+    authApiMock.post
+      .mockResolvedValueOnce({
+        data: { options: { challenge: "abc" }, challengeId: "chal-3" },
+      })
+      .mockResolvedValueOnce({
+        data: { success: true, requires_totp: true, temp_token: "tmp" },
+      });
+
+    const result = await loginWithPasskey("luke");
+
+    expect(result.requires_totp).toBe(true);
+    expect(result.temp_token).toBe("tmp");
+  });
+
+  it("surfaces a cancelled prompt to the caller", async () => {
+    authApiMock.post.mockResolvedValueOnce({
+      data: { options: { challenge: "abc" }, challengeId: "chal-4" },
+    });
+    const cancelled = Object.assign(new Error("cancelled"), {
+      name: "NotAllowedError",
+    });
+    browserMock.startAuthentication.mockRejectedValueOnce(cancelled);
+
+    await expect(loginWithPasskey("luke")).rejects.toMatchObject({
+      name: "NotAllowedError",
+    });
+    expect(authApiMock.post).toHaveBeenCalledTimes(1);
+  });
+});
@@ -9,7 +9,7 @@ describe("resolveProxmoxImportAuth", () => {
    expect(resolveProxmoxImportAuth("password", 42)).toEqual({
      authType: "credential",
      credentialId: 42,
-      overrideCredentialUsername: true,
+      overrideCredentialUsername: false,
    });
  });

@@ -17,7 +17,7 @@ describe("resolveProxmoxImportAuth", () => {
    expect(resolveProxmoxImportAuth("credential", 7)).toEqual({
      authType: "credential",
      credentialId: 7,
-      overrideCredentialUsername: true,
+      overrideCredentialUsername: false,
    });
  });

@@ -25,7 +25,7 @@ describe("resolveProxmoxImportAuth", () => {
    expect(resolveProxmoxImportAuth(undefined, 5)).toEqual({
      authType: "credential",
      credentialId: 5,
-      overrideCredentialUsername: true,
+      overrideCredentialUsername: false,
    });
  });

@@ -0,0 +1,85 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import type { AiProvider } from "@/api/ai-api";
+
+const api = vi.hoisted(() => ({
+  createAiProvider: vi.fn(),
+  deleteAiProvider: vi.fn(),
+  getAiProviderModels: vi.fn(),
+  probeAiModels: vi.fn(),
+  updateAiProvider: vi.fn(),
+}));
+
+vi.mock("@/api/ai-api", () => api);
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+vi.mock("sonner", () => ({
+  toast: { success: vi.fn(), error: vi.fn() },
+}));
+
+import { AiProviderSettings } from "@/features/ai/AiProviderSettings";
+
+const provider: AiProvider = {
+  id: 7,
+  providerType: "ollama",
+  label: "Local Ollama",
+  baseUrl: "http://localhost:11434",
+  apiKeyPrefix: null,
+  defaultModel: "llama3.1",
+  enabled: true,
+  createdAt: "2026-08-21T00:00:00Z",
+};
+
+beforeEach(() => {
+  api.getAiProviderModels.mockReset();
+  api.getAiProviderModels.mockResolvedValue([]);
+  api.updateAiProvider.mockReset();
+  api.updateAiProvider.mockResolvedValue(provider);
+});
+
+afterEach(cleanup);
+
+describe("AiProviderSettings", () => {
+  it("edits an existing provider name and configured model", async () => {
+    const onChanged = vi.fn();
+    render(<AiProviderSettings providers={[provider]} onChanged={onChanged} />);
+
+    expect(screen.getByText(/llama3\.1/)).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "ai.editProvider" }));
+
+    const label = screen.getByLabelText("ai.providerLabel");
+    const model = screen.getByLabelText("ai.defaultModel");
+    fireEvent.change(label, { target: { value: "Production Ollama" } });
+    fireEvent.change(model, { target: { value: "qwen3:32b" } });
+    fireEvent.click(screen.getByRole("button", { name: "ai.save" }));
+
+    await waitFor(() => {
+      expect(api.updateAiProvider).toHaveBeenCalledWith(7, {
+        label: "Production Ollama",
+        defaultModel: "qwen3:32b",
+      });
+    });
+    expect(onChanged).toHaveBeenCalledWith(7);
+  });
+
+  it("loads the saved provider model list when editing starts", async () => {
+    api.getAiProviderModels.mockResolvedValue(["llama3.1", "qwen3:32b"]);
+    render(<AiProviderSettings providers={[provider]} onChanged={() => {}} />);
+
+    fireEvent.click(screen.getByRole("button", { name: "ai.editProvider" }));
+
+    await waitFor(() => {
+      expect(api.getAiProviderModels).toHaveBeenCalledWith(7);
+    });
+    expect(
+      screen.getByRole("combobox", { name: "ai.defaultModel" }),
+    ).toBeTruthy();
+  });
+});
@@ -0,0 +1,92 @@
+import { describe, it, expect, vi } from "vitest";
+import { act, renderHook } from "@testing-library/react";
+import { useDragAndDrop } from "../../../../features/file-manager/hooks/useDragAndDrop.js";
+
+function makeEntry(name: string, isDirectory: boolean) {
+  return { name, isDirectory, isFile: !isDirectory } as FileSystemEntry;
+}
+
+function makeDropEvent(entries: FileSystemEntry[], files: File[] = []) {
+  const items = entries.map((entry) => ({
+    webkitGetAsEntry: () => entry,
+  }));
+
+  const dataTransfer = {
+    items,
+    files: Object.assign(files, { item: (i: number) => files[i] }),
+  };
+
+  return {
+    preventDefault: vi.fn(),
+    stopPropagation: vi.fn(),
+    dataTransfer,
+  } as unknown as React.DragEvent;
+}
+
+describe("useDragAndDrop", () => {
+  it("hands directory entries to onItemsDropped", () => {
+    const onItemsDropped = vi.fn();
+    const onFilesDropped = vi.fn();
+    const { result } = renderHook(() =>
+      useDragAndDrop({ onFilesDropped, onItemsDropped }),
+    );
+
+    const dir = makeEntry("myfolder", true);
+    act(() => result.current.dragHandlers.onDrop(makeDropEvent([dir])));
+
+    expect(onItemsDropped).toHaveBeenCalledWith([dir]);
+    expect(onFilesDropped).not.toHaveBeenCalled();
+  });
+
+  it("reads entries before state updates clear dataTransfer", () => {
+    const onItemsDropped = vi.fn();
+    const { result } = renderHook(() =>
+      useDragAndDrop({ onFilesDropped: vi.fn(), onItemsDropped }),
+    );
+
+    const dir = makeEntry("myfolder", true);
+    const event = makeDropEvent([dir]);
+
+    // Mimic the browser neutering dataTransfer once the handler unwinds.
+    act(() => {
+      result.current.dragHandlers.onDrop(event);
+      (event.dataTransfer as unknown as { items: unknown[] }).items = [];
+    });
+
+    expect(onItemsDropped).toHaveBeenCalledWith([dir]);
+  });
+
+  it("falls back to plain file upload when no directory is dropped", () => {
+    const onFilesDropped = vi.fn();
+    const onItemsDropped = vi.fn();
+    const { result } = renderHook(() =>
+      useDragAndDrop({ onFilesDropped, onItemsDropped }),
+    );
+
+    const file = new File(["hi"], "a.txt");
+    act(() =>
+      result.current.dragHandlers.onDrop(
+        makeDropEvent([makeEntry("a.txt", false)], [file]),
+      ),
+    );
+
+    expect(onItemsDropped).not.toHaveBeenCalled();
+    expect(onFilesDropped).toHaveBeenCalled();
+  });
+
+  it("rejects files over the size limit", () => {
+    const onError = vi.fn();
+    const onFilesDropped = vi.fn();
+    const { result } = renderHook(() =>
+      useDragAndDrop({ onFilesDropped, onError, maxFileSize: 1 }),
+    );
+
+    const big = new File(["x"], "big.bin");
+    Object.defineProperty(big, "size", { value: 5 * 1024 * 1024 });
+
+    act(() => result.current.dragHandlers.onDrop(makeDropEvent([], [big])));
+
+    expect(onFilesDropped).not.toHaveBeenCalled();
+    expect(onError).toHaveBeenCalled();
+  });
+});
@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import {
+  getFileDropDisposition,
+  hasDraggedFiles,
+} from "@/features/guacamole/guacamole-file-drop.ts";
+
+describe("Guacamole file drop", () => {
+  it("recognizes external file drags", () => {
+    expect(hasDraggedFiles(["Files"])).toBe(true);
+    expect(hasDraggedFiles(["text/plain"])).toBe(false);
+  });
+
+  it("rejects files when upload is unavailable instead of ignoring them", () => {
+    expect(getFileDropDisposition(["Files"], 1, false)).toBe("reject");
+    expect(getFileDropDisposition(["Files"], 1, true)).toBe("upload");
+  });
+});
@@ -45,4 +45,32 @@ describe("Android IME composition", () => {

    expect(input.join("")).toBe("\x7f\x7f\x7fỏa");
  });
+
+  it("coalesces rapid textarea changes without dropping or duplicating input", async () => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    terminal = new Terminal();
+    terminal.open(container);
+
+    const input: string[] = [];
+    terminal.onData((data) => input.push(data));
+
+    const textarea = terminal.textarea!;
+    const type = (value: string) => {
+      textarea.dispatchEvent(
+        new KeyboardEvent("keydown", { keyCode: 229 } as KeyboardEventInit),
+      );
+      textarea.value = value;
+      textarea.selectionStart = value.length;
+      textarea.selectionEnd = value.length;
+    };
+
+    type("t");
+    type("te");
+    type("ter");
+    type("termix");
+    await tick();
+
+    expect(input.join("")).toBe("termix");
+  });
 });
@@ -1,5 +1,8 @@
 import { describe, expect, it } from "vitest";
-import { isTabKeyEvent } from "@/features/terminal/terminal-key-event";
+import {
+  isPhysicalShortcutKey,
+  isTabKeyEvent,
+} from "@/features/terminal/terminal-key-event";

 describe("isTabKeyEvent", () => {
  it.each([
@@ -19,3 +22,26 @@ describe("isTabKeyEvent", () => {
    );
  });
 });
+
+describe("isPhysicalShortcutKey", () => {
+  it("matches copy and paste by physical code under a Cyrillic layout", () => {
+    expect(isPhysicalShortcutKey({ key: "с", code: "KeyC" }, "KeyC", "c")).toBe(
+      true,
+    );
+    expect(isPhysicalShortcutKey({ key: "м", code: "KeyV" }, "KeyV", "v")).toBe(
+      true,
+    );
+  });
+
+  it("does not confuse another physical key with a translated character", () => {
+    expect(isPhysicalShortcutKey({ key: "c", code: "KeyV" }, "KeyC", "c")).toBe(
+      false,
+    );
+  });
+
+  it("falls back to key when code is unavailable", () => {
+    expect(isPhysicalShortcutKey({ key: "C", code: "" }, "KeyC", "c")).toBe(
+      true,
+    );
+  });
+});
@@ -237,6 +237,56 @@ describe("buildHostEditorPayload auth field isolation", () => {
    expect(tc?.agentSocketPath).toBeNull();
  });

+  it("preserves agentIdentity in terminalConfig when authType is agent", () => {
+    const form = {
+      ...createHostEditorForm(null),
+      authType: "agent" as const,
+      agentIdentity: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA test-key",
+    };
+
+    const payload = buildHostEditorPayload(form, sshOnly);
+    const tc = payload.terminalConfig as unknown as Record<
+      string,
+      unknown
+    > | null;
+
+    expect(tc?.agentIdentity).toBe(
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA test-key",
+    );
+  });
+
+  it("nulls out agentIdentity when switching away from agent auth", () => {
+    const form = {
+      ...createHostEditorForm(null),
+      authType: "password" as const,
+      password: "mypass",
+      agentIdentity: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA test-key",
+    };
+
+    const payload = buildHostEditorPayload(form, sshOnly);
+    const tc = payload.terminalConfig as unknown as Record<
+      string,
+      unknown
+    > | null;
+
+    expect(tc?.agentIdentity).toBeNull();
+  });
+
+  it("keeps agentIdentity in terminalConfig for shared edits (not owner-private)", () => {
+    const form = {
+      ...createHostEditorForm(null),
+      authType: "agent" as const,
+      agentIdentity: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA test-key",
+    };
+
+    const payload = buildHostEditorPayload(form, sshOnly);
+    const sharedEdit = omitOwnerSshAuthFromSharedEdit(payload);
+
+    expect(sharedEdit.terminalConfig?.agentIdentity).toBe(
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA test-key",
+    );
+  });
+
  it("preserves sudo password autofill settings", () => {
    const form = {
      ...createHostEditorForm(null),
@@ -559,3 +609,21 @@ describe("user connection defaults", () => {
    });
  });
 });
+
+describe("createHostEditorForm credentialId", () => {
+  it("coerces a numeric credentialId to a string so credential lookups match", () => {
+    const form = createHostEditorForm({
+      credentialId: 12,
+    } as unknown as Host);
+    expect(form.credentialId).toBe("12");
+  });
+
+  it("keeps a string credentialId as is", () => {
+    const form = createHostEditorForm({ credentialId: "12" } as Host);
+    expect(form.credentialId).toBe("12");
+  });
+
+  it("falls back to an empty string when there is no credential", () => {
+    expect(createHostEditorForm(null).credentialId).toBe("");
+  });
+});
@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import { getCredentialRowHeight } from "@/sidebar/credential-tree/credential-row-height";
+
+const shapes = [
+  { alwaysShowActions: false, actionsOnly: false, isOpen: false },
+  { alwaysShowActions: false, actionsOnly: false, isOpen: true },
+  { alwaysShowActions: false, actionsOnly: true, isOpen: false },
+  { alwaysShowActions: true, actionsOnly: false, isOpen: false },
+];
+
+describe("getCredentialRowHeight", () => {
+  it.each([
+    ["comfortable", 18.5],
+    ["compact", 12.5],
+  ] as const)(
+    "reserves the %s tag row for every row shape",
+    (density, extra) => {
+      for (const shape of shapes) {
+        for (const isKey of [false, true]) {
+          const base = getCredentialRowHeight({
+            density,
+            isKey,
+            ...shape,
+            showTags: false,
+            tagCount: 1,
+          });
+          const tagged = getCredentialRowHeight({
+            density,
+            isKey,
+            ...shape,
+            showTags: true,
+            tagCount: 1,
+          });
+          expect(tagged - base).toBe(extra);
+        }
+      }
+    },
+  );
+
+  it("does not reserve space when tags are hidden or absent", () => {
+    const base = getCredentialRowHeight({
+      density: "comfortable",
+      isKey: true,
+      ...shapes[0],
+      showTags: false,
+      tagCount: 0,
+    });
+    expect(
+      getCredentialRowHeight({
+        density: "comfortable",
+        isKey: true,
+        ...shapes[0],
+        showTags: true,
+        tagCount: 0,
+      }),
+    ).toBe(base);
+  });
+});
@@ -0,0 +1,64 @@
+import { describe, it, expect } from "vitest";
+import {
+  RESOURCE_ROW_EXTRA,
+  rendersResourceRow,
+} from "@/sidebar/tree/row-metrics";
+
+const host = (
+  over: Partial<{ online: boolean; cpu: number; ram: number }>,
+) => ({
+  online: false,
+  cpu: null,
+  ram: null,
+  ...over,
+});
+
+describe("rendersResourceRow", () => {
+  it("reserves the bars for an online host reporting CPU", () => {
+    expect(
+      rendersResourceRow(host({ online: true, cpu: 42 }), true, false),
+    ).toBe(true);
+  });
+
+  it("reserves the bars for an online host reporting only RAM", () => {
+    expect(
+      rendersResourceRow(host({ online: true, ram: 70 }), true, false),
+    ).toBe(true);
+  });
+
+  // The gap this whole helper exists for: offline rows reserved bar height
+  // they never rendered, leaving dead space under every row in a long list.
+  it("reserves nothing for an offline host", () => {
+    expect(
+      rendersResourceRow(host({ online: false, cpu: 42 }), true, false),
+    ).toBe(false);
+  });
+
+  it("reserves nothing for an online host with no metrics yet", () => {
+    expect(rendersResourceRow(host({ online: true }), true, false)).toBe(false);
+  });
+
+  it("reserves nothing when cpu and ram are zero", () => {
+    expect(
+      rendersResourceRow(host({ online: true, cpu: 0, ram: 0 }), true, false),
+    ).toBe(false);
+  });
+
+  it("reserves nothing when the bars are turned off", () => {
+    expect(
+      rendersResourceRow(host({ online: true, cpu: 42 }), false, false),
+    ).toBe(false);
+  });
+
+  it("reserves nothing in compact density, which drops the row", () => {
+    expect(
+      rendersResourceRow(host({ online: true, cpu: 42 }), true, true),
+    ).toBe(false);
+  });
+});
+
+describe("RESOURCE_ROW_EXTRA", () => {
+  it("matches the measured height of the bar row", () => {
+    expect(RESOURCE_ROW_EXTRA).toBe(17.25);
+  });
+});