release-2.5.0 (#994)

* feat(sshid) - sshid.io equivalent for termix (#919) * feat(ssh-id): database schema, migrations and field encryption Adds ssh_identities, ssh_identity_keys and ssh_identity_ca tables (public keys stored plaintext for the unauthenticated resolver; CA private key registered for per-user field encryption), with UNIQUE(user_id), an index on ssh_identity_keys(identity_id), and idempotent CREATE TABLE migrations. * feat(ssh-id): backend API — resolver, key management, CA and certificates Mounts /sshid (nginx route added). Public text/plain authorized_keys resolver (+ exact /:algo filter, HTML viewer) and CA public-key endpoint; no-store + noindex headers on every resolver response including early 404s. Authenticated management: claim/rename/delete handle, add/import/generate/enable/delete keys, and a per-user CA (create/rotate/delete) with pure-Node OpenSSH certificate issuance. Audit logging on all mutations; UNIQUE races map to a precise 409. Unit tests for key parsing and certificate signing (ssh-keygen-validated). * feat(ssh-id): frontend panel, API client and i18n SSH ID panel wired into the app rail and AppShell: claim handle, resolver URL + curl one-liner, key list, generate, paste/import, CA enable/rotate/remove with server trust command, and per-key certificate issuance. API client re-exported through main-axios.ts; all strings i18n'd. * style(ssh-id): align panel and resolver page with Termix theme - Rebuild the SSH ID sidebar panel with the theme's square components (SectionCard / SettingRow / FakeSwitch) instead of rounded ad-hoc cards; use accent-brand and destructive tokens rather than raw red/green. - Fix panel scrolling: move overflow to a block scroll container so the cards keep their natural height instead of being clipped. - Restyle the public resolver HTML page (/sshid/u/:handle) to the Termix dark theme: square corners, #18181b/#303032 palette, #f59145 accent, uppercase section labels. - Tidy copy: 'Save To Credentials' label, drop the redundant generate intro, and correct the generate tooltip (the key is stored when saving to vault). * feat: rename to Termix ID, improve UI, backend inconsistencies, and general bug fixes --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> * ci(deps): bump actions/checkout from 6 to 7 in the github-actions group (#922) Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 11 updates (#923) Bumps the dev-patch-updates group with 11 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/search](https://github.com/codemirror/search) | `6.7.0` | `6.7.1` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.0` | `6.43.1` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.0` | `4.3.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.9` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.8` | `4.1.9` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.2` | `0.5.3` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.7` | `17.0.8` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` | | [sharp](https://github.com/lovell/sharp) | `0.35.1` | `0.35.2` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.0` | `4.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.9` | Updates `@codemirror/search` from 6.7.0 to 6.7.1 - [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/search/commits) Updates `@codemirror/view` from 6.43.0 to 6.43.1 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@tailwindcss/vite` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8) Updates `@vitest/ui` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/ui) Updates `eslint-plugin-react-refresh` from 0.5.2 to 0.5.3 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.2...v0.5.3) Updates `lint-staged` from 17.0.7 to 17.0.8 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](https://github.com/lint-staged/lint-staged/compare/v17.0.7...v17.0.8) Updates `prettier` from 3.8.3 to 3.8.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.8.4) Updates `sharp` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) Updates `tailwindcss` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) Updates `vitest` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: "@codemirror/search" dependency-version: 6.7.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/ui" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: lint-staged dependency-version: 17.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump nanoid in the prod-patch-updates group (#925) Bumps the prod-patch-updates group with 1 update: [nanoid](https://github.com/ai/nanoid). Updates `nanoid` from 5.1.11 to 5.1.15 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.11...5.1.15) --- updated-dependencies: - dependency-name: nanoid dependency-version: 5.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the major-updates group with 5 updates (#926) Bumps the major-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.0.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.0.0` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `10.0.3` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `10.5.0` | Updates `js-yaml` from 4.2.0 to 5.0.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...5.0.0) Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@types/node` from 25.9.2 to 26.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `concurrently` from 9.2.1 to 10.0.3 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](https://github.com/open-cli-tools/concurrently/compare/v9.2.1...v10.0.3) Updates `eslint` from 9.39.4 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v10.5.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: concurrently dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(ssh): add HashiCorp Vault SSH signer authentication * fix: small fixes to vault feature to align with Termix codebase * chore: add view docs links for vault/termix id * fix: file upload fails with 400 and missing schema migrations on upgrade (#929) Two bugs introduced in v2.4.1: 1. uploadFileStream uses fileManagerApi.post() which triggers axios's transformRequest to JSON-serialize the FormData because the instance default Content-Type is application/json. Change to postForm() which sets Content-Type: multipart/form-data so the browser XHR sends the correct multipart body with boundary. 2. Two schema items added to schema.ts were not included in migrateSchema() in db/index.ts, causing 500 errors on existing installations upgrading from v2.4.0: - user_preferences.status_color_scheme (no such column) - dashboard_service_links table (no such table) Fixes #928 Co-authored-by: sash <sash@fominykh.io> * fix: support PuTTY PPK ssh keys (#930) * fix: chunk large file manager uploads (#932) * fix: route dashboard hosts by protocol (#934) * fix: resolve tunnel endpoints reliably (#935) * Fix Electron OIDC browser auth failures (#936) * Allow RDP connections without stored credentials (#937) * Sync role credential shares for OIDC users (#938) * Fix terminal link dialog layering (#940) * Confirm large files before opening editor (#942) * Confirm closing active host connections (#943) * Preserve file path case in file manager UI (#941) * fix: preserve unicode guacamole tokens (#933) * Persist VNC authentication settings (#944) * Fix Guacamole websocket base path (#946) * Promote file manager terminals to tabs (#939) * Guard Guacamole disconnect during startup (#945) * chore: increment ver * feat: bitwarden ssh agent integration * feat: serial connections support * fix: various small bug fixes * feat: open all sessions in a folder and terminal custom theme color support * feat: cross host file manager clipboard and several small bug fixes * feat: tailscale/wireguard support and added a new status state for when backend is checking status * feat: grafana like server stats history, new alert system, ntfy/webhook support * feat: new grid and widget based homepage function * feat: new donate button in dashboard * fix: alert ui incorrectly using termix css and fixed issue with alert system not loading * chore: fix ci checks (#966) * Fix dashboard service link creation (#950) * Fix jump host SOCKS5 proxy selection (#951) * Fix jump host SOCKS5 proxy selection * fix: type jump host socks proxy config * Fix tmux detection path handling (#949) * Support GUACD_URL environment config (#952) * Retry autostart tunnel host fetches (#953) * Retry autostart tunnel host fetches * chore: format tunnel route * Fix PUID html ownership in Docker entrypoint (#954) * feat: allow custom tunnel endpoints (#977) * fix: skip metrics start for non-ssh hosts (#976) * Fix Proxmox import auth fallback (#956) * Fix Proxmox import auth fallback * chore: format proxmox import auth * Fix SSH heading syntax highlighting (#955) * Fix SSH heading syntax highlighting * chore: format terminal highlighter * Initialize auth before fullscreen terminal routes (#957) * Add WebAuthn passkey authentication (#959) * chore: add Biome tooling (#965) * chore: add biome tooling * chore: support tailwind syntax in biome * Fix VNC required argument handshake (#968) * Prioritize host results in command palette search (#969) * Prevent sidebar host hover layout shift (#970) * Add terminal font zoom with mouse wheel (#971) * Add host temperature metrics card (#972) * Make file downloads reliable in desktop app (#973) * Add app rail hover expansion setting (#974) * fix: use correct translation key for nav.close (#964) * fix(tunnel): skip endpoint credential validation for direct tunnels (#963) * fix: SSH port connection bug (#975) * fix: chunked upload for files >=1.5GB to bypass browser ArrayBuffer limit (#948) * feat: support SSH agent auth across SSH features (#960) * feat: add Podman container runtime support (#958) * chore: update readme and release notes * fix: stabilize Windows app icon (#978) * Add safe host sharing export (#979) * Add external editor support for file manager (#985) * Rework SSH credential password handling (#984) * Support password fallback for SSH key credentials * Complete SSH credential password fallback * Fix runtime base path for auth callbacks (#982) * Fix TUI terminal output highlighting (#983) Co-authored-by: LukeGus <bugattiguy527@gmail.com> * Add app fullscreen mode (#993) * Fix host metrics startup polling (#986) * chore: update release notes * fix: line chart text overlap * chore: update RELEASE_NOTES.md * chore: add donation goal to readme * chore: update readme * fix: hide full-screen button in electron app * fix: failed unit tests * chore: lint, format, and bump version to 2.5.0 * chore: remove timeout from crowdin translate * chore: sync Crowdin translations for 2.5.0 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
2026-07-16 05:13:36 +00:00 · 2026-06-29 13:28:26 -05:00
parent fd27a366d0
commit 9de904dd4c
348 changed files with 125184 additions and 76537 deletions
@@ -32,6 +32,7 @@ import { createSocks5Connection } from "../utils/socks5-helper.js";
 import { AuthManager } from "../utils/auth-manager.js";
 import { PermissionManager } from "../utils/permission-manager.js";
 import { withConnection } from "./ssh-connection-pool.js";
+import { preparePrivateKeyForSSH2 } from "../utils/ssh-key-utils.js";
 import {
  applyAuthOptions,
  bindForwardIn,
@@ -94,6 +95,66 @@ const activeTunnelProcesses = new Map<string, ChildProcess>();
 const pendingTunnelOperations = new Map<string, Promise<void>>();
 const tunnelStatusClients = new Set<Response>();

+const INTERNAL_HOST_API_BASE_URL = "http://localhost:30001/host/db/host";
+const AUTOSTART_FETCH_RETRIES = 6;
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function describeAxiosError(error: unknown): string {
+  if (axios.isAxiosError(error)) {
+    return error.response
+      ? `${error.response.status} ${error.response.statusText}`
+      : error.message;
+  }
+
+  return error instanceof Error ? error.message : "Unknown error";
+}
+
+async function fetchInternalHosts(
+  path: "internal" | "internal/all",
+  internalAuthToken: string,
+): Promise<SSHHost[]> {
+  let lastError: unknown;
+
+  for (let attempt = 1; attempt <= AUTOSTART_FETCH_RETRIES; attempt++) {
+    try {
+      const response = await axios.get(
+        `${INTERNAL_HOST_API_BASE_URL}/${path}`,
+        {
+          headers: {
+            "Content-Type": "application/json",
+            "X-Internal-Auth-Token": internalAuthToken,
+          },
+          timeout: 5000,
+        },
+      );
+      return response.data || [];
+    } catch (error) {
+      lastError = error;
+      if (attempt === AUTOSTART_FETCH_RETRIES) {
+        break;
+      }
+
+      const retryDelayMs = Math.min(500 * 2 ** (attempt - 1), 5000);
+      tunnelLogger.warn("Internal host API unavailable, retrying", {
+        operation: "tunnel_autostart_fetch_retry",
+        path,
+        attempt,
+        maxAttempts: AUTOSTART_FETCH_RETRIES,
+        retryDelayMs,
+        error: describeAxiosError(error),
+      });
+      await sleep(retryDelayMs);
+    }
+  }
+
+  throw new Error(
+    `Failed to fetch ${path} hosts after ${AUTOSTART_FETCH_RETRIES} attempts: ${describeAxiosError(lastError)}`,
+  );
+}
+
 type ActiveTunnelRuntime = {
  sourceClient: Client;
  endpointClient?: Client;
@@ -106,6 +167,24 @@ type ActiveTunnelRuntime = {

 const activeTunnelRuntimes = new Map<string, ActiveTunnelRuntime>();

+function findHostByTunnelEndpoint(
+  hosts: SSHHost[],
+  endpointHost?: string,
+): SSHHost | undefined {
+  const value = endpointHost?.trim();
+  if (!value) return undefined;
+
+  return hosts.find((host) => {
+    const userAtIp = `${host.username}@${host.ip}`;
+    return (
+      String(host.id) === value ||
+      host.name === value ||
+      host.ip === value ||
+      userAtIp === value
+    );
+  });
+}
+
 function broadcastTunnelStatus(tunnelName: string, status: TunnelStatus): void {
  if (
    status.status === CONNECTION_STATES.CONNECTED &&
@@ -550,6 +629,12 @@ function isSingleHostTunnel(tunnelConfig: TunnelConfig): boolean {
  return false;
 }

+function shouldEstablishDirectTunnel(tunnelConfig: TunnelConfig): boolean {
+  if (isSingleHostTunnel(tunnelConfig)) return true;
+  const mode = getTunnelMode(tunnelConfig);
+  return mode !== "remote" && !tunnelConfig.endpointUsername;
+}
+
 async function establishDirectTunnel(
  sourceClient: Client,
  tunnelConfig: TunnelConfig,
@@ -558,7 +643,8 @@ async function establishDirectTunnel(
  const mode = getTunnelMode(tunnelConfig);
  const bindHost = getTunnelBindHost(tunnelConfig);
  const sourcePort = tunnelConfig.sourcePort;
-  const targetHost = tunnelConfig.targetHost || "127.0.0.1";
+  const targetHost =
+    tunnelConfig.targetHost || tunnelConfig.endpointHost || "127.0.0.1";
  const targetPort = tunnelConfig.endpointPort;

  if (mode === "remote") {
@@ -993,6 +1079,7 @@ async function connectSSHTunnel(
  }

  if (
+    !shouldEstablishDirectTunnel(tunnelConfig) &&
    resolvedEndpointCredentials.authMethod === "password" &&
    !resolvedEndpointCredentials.password
  ) {
@@ -1013,6 +1100,7 @@ async function connectSSHTunnel(
  }

  if (
+    !shouldEstablishDirectTunnel(tunnelConfig) &&
    resolvedEndpointCredentials.authMethod === "key" &&
    !resolvedEndpointCredentials.sshKey
  ) {
@@ -1166,7 +1254,7 @@ async function connectSSHTunnel(
        );
      }

-      if (isSingleHostTunnel(tunnelConfig)) {
+      if (shouldEstablishDirectTunnel(tunnelConfig)) {
        await establishDirectTunnel(conn, tunnelConfig);
      } else {
        await establishManagedS2STunnel(
@@ -1300,37 +1388,33 @@ async function connectSSHTunnel(
    resolvedSourceCredentials.authMethod === "key" &&
    resolvedSourceCredentials.sshKey
  ) {
-    if (
-      !resolvedSourceCredentials.sshKey.includes("-----BEGIN") ||
-      !resolvedSourceCredentials.sshKey.includes("-----END")
-    ) {
+    try {
+      connOptions.privateKey = preparePrivateKeyForSSH2(
+        resolvedSourceCredentials.sshKey,
+        resolvedSourceCredentials.keyPassword,
+      );
+    } catch (error) {
+      const message =
+        error instanceof Error ? error.message : "Invalid SSH key format";
      tunnelLogger.error(
-        `Invalid SSH key format for tunnel '${tunnelName}'. Key should contain both BEGIN and END markers`,
+        `Invalid SSH key format for tunnel '${tunnelName}': ${message}`,
        undefined,
        {
          operation: "tunnel_invalid_ssh_key_format",
          tunnelName,
          sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
          keyType: resolvedSourceCredentials.keyType,
-          hasBeginMarker:
-            resolvedSourceCredentials.sshKey.includes("-----BEGIN"),
-          hasEndMarker: resolvedSourceCredentials.sshKey.includes("-----END"),
        },
      );
      broadcastTunnelStatus(tunnelName, {
        connected: false,
        status: CONNECTION_STATES.FAILED,
-        reason: "Invalid SSH key format",
+        reason: message,
      });
      tunnelConnecting.delete(tunnelName);
      return;
    }

-    const cleanKey = resolvedSourceCredentials.sshKey
-      .trim()
-      .replace(/\r\n/g, "\n")
-      .replace(/\r/g, "\n");
-    connOptions.privateKey = Buffer.from(cleanKey, "utf8");
    if (resolvedSourceCredentials.keyPassword) {
      connOptions.passphrase = resolvedSourceCredentials.keyPassword;
    }
@@ -1482,11 +1566,15 @@ async function killRemoteTunnelByMarker(
    resolvedSourceCredentials.authMethod === "key" &&
    resolvedSourceCredentials.sshKey
  ) {
-    if (
-      !resolvedSourceCredentials.sshKey.includes("-----BEGIN") ||
-      !resolvedSourceCredentials.sshKey.includes("-----END")
-    ) {
-      callback(new Error("Invalid SSH key format"));
+    try {
+      preparePrivateKeyForSSH2(
+        resolvedSourceCredentials.sshKey,
+        resolvedSourceCredentials.keyPassword,
+      );
+    } catch (error) {
+      callback(
+        error instanceof Error ? error : new Error("Invalid SSH key format"),
+      );
      return;
    }
  }
@@ -1542,11 +1630,10 @@ async function killRemoteTunnelByMarker(
      resolvedSourceCredentials.authMethod === "key" &&
      resolvedSourceCredentials.sshKey
    ) {
-      const cleanKey = resolvedSourceCredentials.sshKey
-        .trim()
-        .replace(/\r\n/g, "\n")
-        .replace(/\r/g, "\n");
-      connOptions.privateKey = Buffer.from(cleanKey, "utf8");
+      connOptions.privateKey = preparePrivateKeyForSSH2(
+        resolvedSourceCredentials.sshKey,
+        resolvedSourceCredentials.keyPassword,
+      );
      if (resolvedSourceCredentials.keyPassword) {
        connOptions.passphrase = resolvedSourceCredentials.keyPassword;
      }
@@ -1931,51 +2018,56 @@ app.post(
            );

            const allHosts: SSHHost[] = allHostsResponse.data || [];
-            const endpointHost = allHosts.find(
-              (h) =>
-                h.name === tunnelConfig.endpointHost ||
-                `${h.username}@${h.ip}` === tunnelConfig.endpointHost,
+            const endpointHost = findHostByTunnelEndpoint(
+              allHosts,
+              tunnelConfig.endpointHost,
            );

            if (!endpointHost) {
-              throw new Error(
-                `Endpoint host '${tunnelConfig.endpointHost}' not found in database`,
-              );
-            }
-
-            tunnelConfig.endpointIP = endpointHost.ip;
-            tunnelConfig.endpointSSHPort = endpointHost.port;
-            tunnelConfig.endpointUsername = endpointHost.username;
-            tunnelConfig.endpointAuthMethod = endpointHost.authType;
-            tunnelConfig.endpointKeyType = endpointHost.keyType;
-            tunnelConfig.endpointCredentialId = endpointHost.credentialId;
-            tunnelConfig.endpointUserId = endpointHost.userId;
-
-            // Resolve credentials server-side instead of from HTTP response
-            if (endpointHost.id && endpointHost.userId) {
-              try {
-                const { resolveHostById } = await import("./host-resolver.js");
-                const resolved = await resolveHostById(
-                  endpointHost.id,
-                  endpointHost.userId,
+              if (getTunnelMode(tunnelConfig) !== "remote") {
+                tunnelConfig.endpointIP =
+                  tunnelConfig.endpointIP || tunnelConfig.endpointHost;
+              } else {
+                throw new Error(
+                  `Endpoint host '${tunnelConfig.endpointHost}' not found in database`,
                );
-                if (resolved) {
-                  tunnelConfig.endpointPassword = resolved.password;
-                  tunnelConfig.endpointSSHKey = resolved.key;
-                  tunnelConfig.endpointKeyPassword = resolved.keyPassword;
+              }
+            } else {
+              tunnelConfig.endpointIP = endpointHost.ip;
+              tunnelConfig.endpointSSHPort = endpointHost.port;
+              tunnelConfig.endpointUsername = endpointHost.username;
+              tunnelConfig.endpointAuthMethod = endpointHost.authType;
+              tunnelConfig.endpointKeyType = endpointHost.keyType;
+              tunnelConfig.endpointCredentialId = endpointHost.credentialId;
+              tunnelConfig.endpointUserId = endpointHost.userId;
+
+              // Resolve credentials server-side instead of from HTTP response
+              if (endpointHost.id && endpointHost.userId) {
+                try {
+                  const { resolveHostById } =
+                    await import("./host-resolver.js");
+                  const resolved = await resolveHostById(
+                    endpointHost.id,
+                    endpointHost.userId,
+                  );
+                  if (resolved) {
+                    tunnelConfig.endpointPassword = resolved.password;
+                    tunnelConfig.endpointSSHKey = resolved.key;
+                    tunnelConfig.endpointKeyPassword = resolved.keyPassword;
+                  }
+                } catch (credError) {
+                  tunnelLogger.warn(
+                    "Failed to resolve endpoint credentials from DB",
+                    {
+                      operation: "tunnel_endpoint_credential_resolve",
+                      endpointHostId: endpointHost.id,
+                      error:
+                        credError instanceof Error
+                          ? credError.message
+                          : "Unknown",
+                    },
+                  );
                }
-              } catch (credError) {
-                tunnelLogger.warn(
-                  "Failed to resolve endpoint credentials from DB",
-                  {
-                    operation: "tunnel_endpoint_credential_resolve",
-                    endpointHostId: endpointHost.id,
-                    error:
-                      credError instanceof Error
-                        ? credError.message
-                        : "Unknown",
-                  },
-                );
              }
            }
          } catch (resolveError) {
@@ -2237,28 +2329,14 @@ async function initializeAutoStartTunnels(): Promise<void> {
    const systemCrypto = SystemCrypto.getInstance();
    const internalAuthToken = await systemCrypto.getInternalAuthToken();

-    const autostartResponse = await axios.get(
-      "http://localhost:30001/host/db/host/internal",
-      {
-        headers: {
-          "Content-Type": "application/json",
-          "X-Internal-Auth-Token": internalAuthToken,
-        },
-      },
+    const autostartHosts = await fetchInternalHosts(
+      "internal",
+      internalAuthToken,
    );
-
-    const allHostsResponse = await axios.get(
-      "http://localhost:30001/host/db/host/internal/all",
-      {
-        headers: {
-          "Content-Type": "application/json",
-          "X-Internal-Auth-Token": internalAuthToken,
-        },
-      },
+    const allHosts = await fetchInternalHosts(
+      "internal/all",
+      internalAuthToken,
    );
-
-    const autostartHosts: SSHHost[] = autostartResponse.data || [];
-    const allHosts: SSHHost[] = allHostsResponse.data || [];
    const autoStartTunnels: TunnelConfig[] = [];
    tunnelLogger.info(
      `Found ${autostartHosts.length} autostart hosts and ${allHosts.length} total hosts for endpointHost resolution`,
@@ -2268,13 +2346,15 @@ async function initializeAutoStartTunnels(): Promise<void> {
      if (host.enableTunnel && host.tunnelConnections) {
        for (const tunnelConnection of host.tunnelConnections) {
          if (tunnelConnection.autoStart) {
-            const endpointHost = allHosts.find(
-              (h) =>
-                h.name === tunnelConnection.endpointHost ||
-                `${h.username}@${h.ip}` === tunnelConnection.endpointHost,
+            const endpointHost = findHostByTunnelEndpoint(
+              allHosts,
+              tunnelConnection.endpointHost,
            );
+            const mode =
+              tunnelConnection.mode || tunnelConnection.tunnelType || "remote";
+            const allowDirectTarget = mode !== "remote";

-            if (endpointHost) {
+            if (endpointHost || allowDirectTarget) {
              const tunnelIndex =
                host.tunnelConnections.indexOf(tunnelConnection);
              const tunnelConfig: TunnelConfig = {
@@ -2287,10 +2367,7 @@ async function initializeAutoStartTunnels(): Promise<void> {
                  tunnelConnection.endpointPort,
                ),
                scope: tunnelConnection.scope || "s2s",
-                mode:
-                  tunnelConnection.mode ||
-                  tunnelConnection.tunnelType ||
-                  "remote",
+                mode,
                bindHost: tunnelConnection.bindHost,
                targetHost: tunnelConnection.targetHost,
                tunnelType: tunnelConnection.tunnelType || "remote",
@@ -2304,16 +2381,18 @@ async function initializeAutoStartTunnels(): Promise<void> {
                sourceKeyType: host.keyType,
                sourceCredentialId: host.credentialId,
                sourceUserId: host.userId,
-                endpointIP: endpointHost.ip,
-                endpointSSHPort: endpointHost.port,
-                endpointUsername: endpointHost.username,
+                endpointIP: endpointHost?.ip || tunnelConnection.endpointHost,
+                endpointSSHPort: endpointHost?.port || 22,
+                endpointUsername: endpointHost?.username || "",
                endpointHost: tunnelConnection.endpointHost,
                endpointAuthMethod:
-                  tunnelConnection.endpointAuthType || endpointHost.authType,
+                  tunnelConnection.endpointAuthType ||
+                  endpointHost?.authType ||
+                  "none",
                endpointKeyType:
-                  tunnelConnection.endpointKeyType || endpointHost.keyType,
-                endpointCredentialId: endpointHost.credentialId,
-                endpointUserId: endpointHost.userId,
+                  tunnelConnection.endpointKeyType || endpointHost?.keyType,
+                endpointCredentialId: endpointHost?.credentialId,
+                endpointUserId: endpointHost?.userId,
                sourcePort: tunnelConnection.sourcePort,
                endpointPort: tunnelConnection.endpointPort,
                maxRetries: tunnelConnection.maxRetries,