release-2.5.1 (#1067)

* chore(deps): bump node from 24-slim to 26-slim in /docker in the docker-major-updates group (#1021) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump node in /docker in the docker-major-updates group Bumps the docker-major-updates group in /docker with 1 update: node. Updates `node` from 24-slim to 26-slim --- updated-dependencies: - dependency-name: node dependency-version: 26-slim dependency-type: direct:production dependency-group: docker-major-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 24 updates (#1023) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps-dev): bump the dev-patch-updates group with 24 updates Bumps the dev-patch-updates group with 24 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.1` | `2.5.2` | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.3` | `6.10.4` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.1` | `6.43.5` | | [@radix-ui/react-accordion](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/accordion) | `1.2.14` | `1.2.15` | | [@radix-ui/react-alert-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/alert-dialog) | `1.1.17` | `1.1.18` | | [@radix-ui/react-checkbox](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/checkbox) | `1.3.5` | `1.3.6` | | [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.17` | `1.1.18` | | [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.18` | `2.1.19` | | [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.10` | `2.1.11` | | [@radix-ui/react-popover](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/popover) | `1.1.17` | `1.1.18` | | [@radix-ui/react-progress](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/progress) | `1.1.10` | `1.1.11` | | [@radix-ui/react-scroll-area](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/scroll-area) | `1.2.12` | `1.2.13` | | [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.3.1` | `2.3.2` | | [@radix-ui/react-separator](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/separator) | `1.1.10` | `1.1.11` | | [@radix-ui/react-slider](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slider) | `1.4.1` | `1.4.2` | | [@radix-ui/react-switch](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/switch) | `1.3.1` | `1.3.2` | | [@radix-ui/react-tabs](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tabs) | `1.1.15` | `1.1.16` | | [@radix-ui/react-tooltip](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip) | `1.2.10` | `1.2.11` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.1` | `4.3.2` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.0.3` | | [i18next](https://github.com/i18next/i18next) | `26.3.1` | `26.3.4` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.0` | `1.6.1` | | [sharp](https://github.com/lovell/sharp) | `0.35.2` | `0.35.3` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.1` | `4.3.2` | Updates `@biomejs/biome` from 2.5.1 to 2.5.2 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.2/packages/@biomejs/biome) Updates `@codemirror/commands` from 6.10.3 to 6.10.4 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@codemirror/view` from 6.43.1 to 6.43.5 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@radix-ui/react-accordion` from 1.2.14 to 1.2.15 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/accordion/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/accordion) Updates `@radix-ui/react-alert-dialog` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/alert-dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/alert-dialog) Updates `@radix-ui/react-checkbox` from 1.3.5 to 1.3.6 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/checkbox/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/checkbox) Updates `@radix-ui/react-dialog` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog) Updates `@radix-ui/react-dropdown-menu` from 2.1.18 to 2.1.19 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu) Updates `@radix-ui/react-label` from 2.1.10 to 2.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label) Updates `@radix-ui/react-popover` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/popover/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/popover) Updates `@radix-ui/react-progress` from 1.1.10 to 1.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/progress/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/progress) Updates `@radix-ui/react-scroll-area` from 1.2.12 to 1.2.13 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/scroll-area/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/scroll-area) Updates `@radix-ui/react-select` from 2.3.1 to 2.3.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select) Updates `@radix-ui/react-separator` from 1.1.10 to 1.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/separator/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/separator) Updates `@radix-ui/react-slider` from 1.4.1 to 1.4.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slider/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slider) Updates `@radix-ui/react-switch` from 1.3.1 to 1.3.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/switch/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/switch) Updates `@radix-ui/react-tabs` from 1.1.15 to 1.1.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tabs/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tabs) Updates `@radix-ui/react-tooltip` from 1.2.10 to 1.2.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tooltip/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tooltip) Updates `@tailwindcss/vite` from 4.3.1 to 4.3.2 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/@tailwindcss-vite) Updates `@vitejs/plugin-react` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react) Updates `i18next` from 26.3.1 to 26.3.4 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.1...v26.3.4) Updates `radix-ui` from 1.6.0 to 1.6.1 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui) Updates `sharp` from 0.35.2 to 0.35.3 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.2...v0.35.3) Updates `tailwindcss` from 4.3.1 to 4.3.2 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/commands" dependency-version: 6.10.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-accordion" dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-alert-dialog" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-checkbox" dependency-version: 1.3.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-dialog" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-dropdown-menu" dependency-version: 2.1.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-label" dependency-version: 2.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-popover" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-progress" dependency-version: 1.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-scroll-area" dependency-version: 1.2.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-select" dependency-version: 2.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-separator" dependency-version: 1.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-slider" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-switch" dependency-version: 1.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-tabs" dependency-version: 1.1.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-tooltip" dependency-version: 1.2.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: i18next dependency-version: 26.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: radix-ui dependency-version: 1.6.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-patch-updates group with 2 updates (#1025) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump the prod-patch-updates group with 2 updates Bumps the prod-patch-updates group with 2 updates: [axios](https://github.com/axios/axios) and [nanoid](https://github.com/ai/nanoid). Updates `axios` from 1.18.0 to 1.18.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.18.0...v1.18.1) Updates `nanoid` from 5.1.15 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.15...5.1.16) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-minor-updates group with 3 updates (#1026) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump the prod-minor-updates group with 3 updates Bumps the prod-minor-updates group with 3 updates: [js-yaml](https://github.com/nodeca/js-yaml), [motion](https://github.com/motiondivision/motion) and [undici](https://github.com/nodejs/undici). Updates `js-yaml` from 5.0.0 to 5.2.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.0.0...5.2.1) Updates `motion` from 12.40.0 to 12.42.2 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](https://github.com/motiondivision/motion/compare/v12.40.0...v12.42.2) Updates `undici` from 8.5.0 to 8.7.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v8.5.0...v8.7.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: motion dependency-version: 12.42.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: undici dependency-version: 8.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump electron from 42.4.1 to 43.0.0 in the major-updates group (#1027) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps-dev): bump electron in the major-updates group Bumps the major-updates group with 1 update: [electron](https://github.com/electron/electron). Updates `electron` from 42.4.1 to 43.0.0 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v42.4.1...v43.0.0) --- updated-dependencies: - dependency-name: electron dependency-version: 43.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Fix MC syntax highlighting artifacts (#996) * Filter dashboard status hosts (#997) * Persist dashboard service link changes (#999) * Fix snippet text overflow (#1000) * Persist remote desktop credential auth (#1001) * Guard language switching failures (#1002) * Resolve tunnel source credentials (#1003) * Support Vault auth for monitors (#1004) * Fix Windows file delete command (#1005) * Fix release artifact checkout ref (#1006) * Fix command palette escape in fullscreen (#1008) * Fix alerts and audit log data normalization (#1010) * Fix macOS VNC protocol negotiation (#1012) * Fix port knocking before SSH connect (#1013) * Allow Escape to close link confirmation (#1014) * Prevent Electron modifier wheel zoom (#1016) * Fix credential auth optional password (#1009) * Retry transient terminal DNS lookups (#1011) * Retry transient terminal DNS lookups * Apply DNS retry to SSH entry points * Fix OIDC redirect forwarded port handling (#1007) * Preserve recent open tabs on startup (#1015) * Fix fish prompt OSC highlighting (#998) * Fix terminal font selection (#1018) * fix: font legibility (#1019) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * fix: font legibility Text was entirely unreadable in places for me. Especially with themes like Catppuccin. The muted-foreground text and the tags too similiar to the background. --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: russell <git@0896c69e.com> * fix(file-manager): chunked uploads fail with 'Expected multipart/form-data request' (#1020) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * fix(file-manager): use postForm for chunked uploads so multipart content-type is sent The fileManagerApi axios instance defaults to Content-Type: application/json. Axios 1.x's default transformRequest converts a FormData body to JSON whenever the request content type is application/json, so every chunk POSTed to /ssh/uploadFileChunk arrived as a JSON body like {"chunk":{}} and the backend rejected it with 400 'Expected multipart/form-data request'. This breaks all uploads of files larger than the 1.5 GiB chunking threshold. The non-chunked path already uses postForm for /ssh/uploadFileStream; use it for the chunk path too so axios keeps the FormData intact and the browser sets the multipart boundary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: implement OIDC back-channel logout support with session management (#1028) * feat: implement OIDC back-channel logout support with session management * Fix OIDC back-channel logout handling * Require logout token replay identifiers --------- Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * Add API key host enrollment endpoint (#1029) * Fix tmux detection for non-POSIX shells (#1030) * Fix OPKSSH js-yaml ESM import (#1031) * Fix Android Vietnamese IME input (#1032) * Fix Firefox RDP clipboard paste (#1033) * Fix Proxmox discovery over HTTPS (#1041) * Fix external editor actions in file preview (#1042) * Allow pinned hosts with name sorting (#1043) * Fix Firefox desktop OIDC callback (#1044) * feat(session): add recording and replay (#1049) * Fix status checks through jump hosts (#1045) * Add terminal font size shortcuts (#1047) * feat: add Open File Manager to tab right-click menu (#1051) Co-authored-by: SankeerthNara <sankeerthnara@gmail.com> * perf: frontend request cache, poll pause, and code-split shell (#1052) Host/status caching, shell code-split, SSH pool waits, host-metrics concurrency, background-tab idle, per-host status subscriptions, homepage poll quieting, and virtualized host sidebar + file manager lists. * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * feat: save quick connect sessions as hosts (#1055) * fix: restore sudo password autofill settings (#1056) * fix: preserve file editor position on save (#1057) * fix: sync cloud preference storage mode (#1058) * fix: render RDP sessions at native pixel density (#1059) * fix: restore database import in embedded desktop mode (#1060) * Update Auto-complete.tsx (#1061) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore: donation bar reporting wrong result * feat: add Open File Manager to tab right-click menu (#1046) * Revert "feat: add Open File Manager to tab right-click menu (#1046)" (#1050) This reverts commit 0712fdd731. * Remove donation badge from README Removed donation badge from README. * Delete .github/workflows/donation-goal.yml * Update Auto-complete.tsx --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * feat(auth): opt-in OIDC DEK unlock for API-key requests (ALLOW_APIKEY_DATA_UNLOCK) (#1064) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore: donation bar reporting wrong result * feat: add Open File Manager to tab right-click menu (#1046) * Revert "feat: add Open File Manager to tab right-click menu (#1046)" (#1050) This reverts commit 0712fdd731. * Remove donation badge from README Removed donation badge from README. * Delete .github/workflows/donation-goal.yml * feat(auth): opt-in OIDC DEK unlock for API-key requests API keys authenticate but cannot touch the encrypted credential/host store ('User data not unlocked') unless the user has a live interactive session, making them unusable for headless automation. For OIDC users the DEK is server-derivable (deriveOIDCSystemKey), so handleApiKeyAuth can unlock it without a password. Gated behind ALLOW_APIKEY_DATA_UNLOCK (default off) because enabling it widens the blast radius of a leaked API key. OIDC-only; password users are untouched. Refs #1063 --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: Sankeerth Nara <sankeerthnara@gmail.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * chore: package lock sync * Add Proxmox guest auto sync (#1053) * draft: database layer refactor (#1054) * feat(sshid) - sshid.io equivalent for termix (#919) * feat(ssh-id): database schema, migrations and field encryption Adds ssh_identities, ssh_identity_keys and ssh_identity_ca tables (public keys stored plaintext for the unauthenticated resolver; CA private key registered for per-user field encryption), with UNIQUE(user_id), an index on ssh_identity_keys(identity_id), and idempotent CREATE TABLE migrations. * feat(ssh-id): backend API — resolver, key management, CA and certificates Mounts /sshid (nginx route added). Public text/plain authorized_keys resolver (+ exact /:algo filter, HTML viewer) and CA public-key endpoint; no-store + noindex headers on every resolver response including early 404s. Authenticated management: claim/rename/delete handle, add/import/generate/enable/delete keys, and a per-user CA (create/rotate/delete) with pure-Node OpenSSH certificate issuance. Audit logging on all mutations; UNIQUE races map to a precise 409. Unit tests for key parsing and certificate signing (ssh-keygen-validated). * feat(ssh-id): frontend panel, API client and i18n SSH ID panel wired into the app rail and AppShell: claim handle, resolver URL + curl one-liner, key list, generate, paste/import, CA enable/rotate/remove with server trust command, and per-key certificate issuance. API client re-exported through main-axios.ts; all strings i18n'd. * style(ssh-id): align panel and resolver page with Termix theme - Rebuild the SSH ID sidebar panel with the theme's square components (SectionCard / SettingRow / FakeSwitch) instead of rounded ad-hoc cards; use accent-brand and destructive tokens rather than raw red/green. - Fix panel scrolling: move overflow to a block scroll container so the cards keep their natural height instead of being clipped. - Restyle the public resolver HTML page (/sshid/u/:handle) to the Termix dark theme: square corners, #18181b/#303032 palette, #f59145 accent, uppercase section labels. - Tidy copy: 'Save To Credentials' label, drop the redundant generate intro, and correct the generate tooltip (the key is stored when saving to vault). * feat: rename to Termix ID, improve UI, backend inconsistencies, and general bug fixes --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> * ci(deps): bump actions/checkout from 6 to 7 in the github-actions group (#922) Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 11 updates (#923) Bumps the dev-patch-updates group with 11 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/search](https://github.com/codemirror/search) | `6.7.0` | `6.7.1` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.0` | `6.43.1` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.0` | `4.3.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.9` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.8` | `4.1.9` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.2` | `0.5.3` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.7` | `17.0.8` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` | | [sharp](https://github.com/lovell/sharp) | `0.35.1` | `0.35.2` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.0` | `4.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.9` | Updates `@codemirror/search` from 6.7.0 to 6.7.1 - [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/search/commits) Updates `@codemirror/view` from 6.43.0 to 6.43.1 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@tailwindcss/vite` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8) Updates `@vitest/ui` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/ui) Updates `eslint-plugin-react-refresh` from 0.5.2 to 0.5.3 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.2...v0.5.3) Updates `lint-staged` from 17.0.7 to 17.0.8 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](https://github.com/lint-staged/lint-staged/compare/v17.0.7...v17.0.8) Updates `prettier` from 3.8.3 to 3.8.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.8.4) Updates `sharp` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) Updates `tailwindcss` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) Updates `vitest` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: "@codemirror/search" dependency-version: 6.7.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/ui" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: lint-staged dependency-version: 17.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump nanoid in the prod-patch-updates group (#925) Bumps the prod-patch-updates group with 1 update: [nanoid](https://github.com/ai/nanoid). Updates `nanoid` from 5.1.11 to 5.1.15 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.11...5.1.15) --- updated-dependencies: - dependency-name: nanoid dependency-version: 5.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the major-updates group with 5 updates (#926) Bumps the major-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.0.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.0.0` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `10.0.3` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `10.5.0` | Updates `js-yaml` from 4.2.0 to 5.0.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...5.0.0) Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@types/node` from 25.9.2 to 26.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `concurrently` from 9.2.1 to 10.0.3 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](https://github.com/open-cli-tools/concurrently/compare/v9.2.1...v10.0.3) Updates `eslint` from 9.39.4 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v10.5.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: concurrently dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(ssh): add HashiCorp Vault SSH signer authentication * fix: small fixes to vault feature to align with Termix codebase * chore: add view docs links for vault/termix id * fix: file upload fails with 400 and missing schema migrations on upgrade (#929) Two bugs introduced in v2.4.1: 1. uploadFileStream uses fileManagerApi.post() which triggers axios's transformRequest to JSON-serialize the FormData because the instance default Content-Type is application/json. Change to postForm() which sets Content-Type: multipart/form-data so the browser XHR sends the correct multipart body with boundary. 2. Two schema items added to schema.ts were not included in migrateSchema() in db/index.ts, causing 500 errors on existing installations upgrading from v2.4.0: - user_preferences.status_color_scheme (no such column) - dashboard_service_links table (no such table) Fixes #928 Co-authored-by: sash <sash@fominykh.io> * fix: support PuTTY PPK ssh keys (#930) * fix: chunk large file manager uploads (#932) * fix: route dashboard hosts by protocol (#934) * fix: resolve tunnel endpoints reliably (#935) * Fix Electron OIDC browser auth failures (#936) * Allow RDP connections without stored credentials (#937) * Sync role credential shares for OIDC users (#938) * Fix terminal link dialog layering (#940) * Confirm large files before opening editor (#942) * Confirm closing active host connections (#943) * Preserve file path case in file manager UI (#941) * fix: preserve unicode guacamole tokens (#933) * Persist VNC authentication settings (#944) * Fix Guacamole websocket base path (#946) * Promote file manager terminals to tabs (#939) * Guard Guacamole disconnect during startup (#945) * chore: increment ver * feat: bitwarden ssh agent integration * feat: serial connections support * fix: various small bug fixes * feat: open all sessions in a folder and terminal custom theme color support * feat: cross host file manager clipboard and several small bug fixes * feat: tailscale/wireguard support and added a new status state for when backend is checking status * feat: grafana like server stats history, new alert system, ntfy/webhook support * feat: new grid and widget based homepage function * feat: new donate button in dashboard * fix: alert ui incorrectly using termix css and fixed issue with alert system not loading * chore: start database layer refactor * docs: plan database layer refactor * docs: audit database layer refactor phase zero * chore: add database runtime adapter skeleton * chore: add settings repository skeleton * chore: add user session repository skeleton * chore: add host credential repository skeleton * chore: add field encryption boundary * chore: migrate settings route slice * chore: migrate user settings routes * chore: migrate host metrics settings routes * chore: migrate acme settings route * chore: migrate terminal settings route * chore: migrate tailscale settings read * chore: migrate guacamole settings reads * chore: migrate session timeout settings reads * chore: migrate auth route settings reads * chore: migrate host metrics settings reads * chore: migrate startup settings reads * chore: migrate user settings cleanup * chore: migrate password reset settings * chore: migrate oidc legacy settings read * chore: migrate user route settings slice * chore: migrate oidc state settings * chore: migrate user login settings reads * chore: migrate user crypto settings * chore: consolidate startup settings defaults * chore: consolidate database settings import export * chore: migrate core session auth paths * chore: migrate remaining session auth paths * chore: migrate admin user routes * chore: migrate user route admin checks * chore: migrate user lifecycle routes * chore: migrate auth user lookups * chore: migrate oidc user routes * chore: migrate api key repository paths * docs: add database gray rollout guide * chore: migrate trusted device paths * chore: migrate user session route user lookups * chore: add database repository rollout guard * chore: expose repository rollout status * chore: warn on repository rollout misconfiguration * chore: migrate remaining user lookup helpers * chore: migrate ssh user lookups * chore: migrate user settings admin lookups * chore: migrate acme ssl user lookups * chore: migrate audit log admin checks * chore: migrate oidc account user updates * chore: migrate password reset user updates * chore: migrate user deletion core records * chore: migrate snippet audit user lookups * chore: migrate ldap user sync paths * chore: migrate totp user updates * chore: migrate rbac user checks * chore: migrate rbac role paths * chore: migrate permission role lookups * chore: migrate rbac access list reads * chore: migrate shared rbac reads * chore: migrate rbac access writes * chore: migrate permission host access * chore: migrate role host access lookup * chore: migrate snippet access lookup * chore: migrate shared credential access lookups * chore: migrate host access cleanup writes * chore: migrate host list access checks * chore: migrate host access cleanup routes * chore: migrate shared credential role lookups * chore: migrate user role cleanup * chore: migrate admin role sync * chore: migrate ldap role sync * chore: migrate user role assignment * chore: migrate sso provider access * chore: migrate audit log access * chore: migrate user preference access * chore: migrate open tab access * chore: migrate dismissed alert access * chore: migrate homepage layout access * chore: migrate network topology access * chore: migrate dashboard service link access * chore: migrate command history access * chore: migrate recent activity cleanup * chore: migrate ssh credential usage access * chore: migrate transfer recent access * chore: migrate file manager bookmark access * chore: migrate c2s tunnel preset access * chore: migrate homepage item access * chore: migrate session recording access * chore: migrate tmux session tag access * chore: migrate opkssh token access * chore: migrate vault token access * chore: migrate vault profile access * chore: migrate host metrics preference access * chore: migrate host health access * chore: migrate host metrics history access * chore: migrate alert persistence access * chore: route alert host lookup through repository * chore: migrate user data export reads * chore: route host metrics stats sync through repository * chore: migrate host folder persistence * chore: migrate host resolution reads * chore: route jump host resolution reads * chore: route docker console jump host reads * chore: route docker ssh resolution reads * chore: route proxmox discovery resolution reads * chore: route file manager activity host reads * chore: route host metrics resolution reads * chore: route ssh auth credential reads * chore: route tunnel endpoint credential reads * chore: route credential deployment resolution reads * chore: route command history host flag reads * chore: route snippet execution resolution reads * chore: route terminal host resolution reads * chore: route vault oidc host resolution reads * chore: route wake on lan host reads * chore: route internal host list reads * chore: route host key verification persistence * chore: route credential read paths * chore: route credential host usage reads * chore: route credential folder rename * chore: route host owner access checks * chore: route shared credential source reads * chore: route user host credential cleanup * chore: route credential delete reads * chore: route credential update reads * chore: route host credential reads * chore: route host read paths * chore: route host projection reads * chore: route host list reads * chore: route snippet read paths * chore: route snippet folder writes * chore: route snippet crud paths * chore: route snippet bulk import * chore: route rbac ownership reads * chore: route user count reads * chore: route cleanup snippets folders * chore: route shared credential persistence * chore: route dashboard activity * chore: route guacamole host reads * chore: route host bulk lookups * chore: remove unlock-only simple db ops * chore: route host autostart persistence * chore: route ldap provisioning through users * chore: route credential encrypted writes * chore: route host encrypted writes * chore: route bulk host encrypted writes * chore: route termix id credentials * chore: route termix id ca persistence * chore: route termix identity persistence * chore: route credential system migration * chore: isolate user encryption migration storage * chore: remove legacy simple db ops * chore: isolate legacy sqlite migration copy * chore: route database settings import export * chore: route database host credential export * chore: route database host credential import * chore: route database file-manager import export * chore: route database alert usage import export * chore: route database user checks * chore: isolate auth lazy migration storage * chore: route explicit database saves * chore: initialize database save boundary * chore: route migration snapshot saves * chore: isolate sqlite import constraints * chore: route import sqlite boundary * chore: route user encryption migration store * chore: centralize current repository runtime * chore: route more current repositories * chore: route activity repository runtimes * chore: route token repository runtimes * chore: route health repository runtimes * chore: route identity repository runtimes * chore: route rbac repository runtime * chore: centralize current sqlite runtime access * chore: route user deletion key cleanup * chore: route user deletion vault cleanup * chore: route user deletion homepage cleanup * chore: route user deletion health cleanup * chore: route user deletion alert cleanup * chore: route user deletion identity cleanup * chore: add database layer preupgrade backup * Fix database repository type errors * fix: complete post-merge compile fixes for database refactor Restore missing DatabaseSaveTrigger/getDb imports, session log format fallback, OIDC provider resolution, guacamole recording insert, and passwordFallbackOnly typing after merging current dev. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io> * refactor(db): collapse repository rollout scaffolding into single factory Repositories are now the only data path. Replaces the 41 current-*-repository wrapper files, the DATABASE_LAYER_REPOSITORY_ROLLOUT flag/alias map and the unused database/runtime adapter with repositories/factory.ts, a plain DatabaseContext type and an in-memory TestSqliteDatabase test harness. * refactor(db): route remaining raw DB access through repositories proxmox, session-log, oidc-utils, webauthn and guacamole recording now use repositories (new WebauthnCredentialRepository; SsoProviderRepository listEnabled; HostRepository findDecryptedByIdAs/listProxmoxEnabled). Remaining raw access: db boot code, simple-db-ops and docker.ts, which are removed/restructured in later phases. * feat(crypto): add UserKeyManager with system-wrapped per-user DEKs New utils/user-keys.ts: one random 32-byte DEK per user, wrapped AES-256-GCM under an HKDF key derived from the system ENCRYPTION_KEY (per-user info string + AAD binding, versioned v3 wrap format stored in settings). Synchronous unwrap-on-demand with a 15-minute cache so the existing DataCrypto facade keeps its sync call sites. Not wired up yet. * feat(crypto): boot-time DEK migration to system-wrapped v3 format utils/crypto-migration/dek-migration.ts carries the legacy unwrap paths (PBKDF2 password KEK, OIDC/WebAuthn system keys, hardcoded-default fallback) and migrates every server-unwrappable DEK to the v3 wrap at startup. Password-wrapped DEKs migrate at next login or from a live session via adoptRecoveredDEK. Legacy rows are kept for now; cleanup flips on once the new path is authoritative. * refactor(crypto): make system-wrapped DEKs the authoritative key path DataCrypto and AuthManager now read keys through UserKeyManager: DEKs are always unwrappable server-side, so the in-memory unlock session, DEK-in-JWT wrapping, session-expiry data locks and ALLOW_APIKEY_DATA_UNLOCK are gone. utils/user-crypto.ts is deleted; boot migration now cleans legacy wraps. A one-release shim adopts DEKs from legacy dataKeyWrap tokens so active password users migrate without re-login. Password login migrates legacy password-wrapped DEKs via migratePasswordUserAtLogin. * refactor(crypto): remove pending share queue and credential sharing key With server-unwrappable DEKs both sides of a share are always available, so the needsReEncryption queue, CREDENTIAL_SHARING_KEY and the system_* shadow columns on ssh_credentials are gone. A one-time boot cleanup re-creates legacy pending share copies where possible (dropping unresolvable ones with a warning) and drops the legacy columns. * feat(auth): non-destructive password resets and admin reset endpoint Password resets no longer destroy user data: the DEK is system-wrapped, so forgot-password and admin resets are just a hash update plus session revoke. The wipe branch survives only for accounts that never logged in since the encryption upgrade and now requires explicit confirmDataWipe (surfaced as a 409 DATA_WIPE_REQUIRED; the reset UI asks for confirmation). Adds POST /users/admin/reset-password and removes the dead re-encryption paths. * refactor(ssh): consolidate four jump-host chain copies into one module terminal, host-metrics and docker now use ssh/jump-host-chain.ts (already shared by file-manager, tmux-monitor and docker-console); docker's inline copy also drops its raw SimpleDBOps host/credential lookups in favor of repositories. * refactor(ssh): single shared createConnectionLog helper file-manager-log.ts becomes ssh/connection-log.ts; the copies in docker.ts and host-metrics-helpers.ts are gone. * refactor(ssh): split docker module into layered directory ssh/docker/{index,routes,session-manager,container-routes,console}.ts: server boot and wiring in index, HTTP handlers in routes, SSH session registry and command execution in session-manager. Code motion only; port 30007/30009 and endpoints unchanged. Swagger now scans ssh subdirectories. * refactor(ssh): split tunnel module into layered directory ssh/tunnel/{index,routes,manager}.ts: server boot in index, HTTP handlers in routes, tunnel state and engine (connect/retry/autostart) in manager. Code motion only; port 30003 and endpoints unchanged. * refactor(backend): reorganize top-level layout - ssh/ renamed to hosts/ (it covers SSH, RDP, VNC, Telnet, Docker, metrics) - serial/serial.ts and guacamole/ moved inside hosts/ - dashboard.ts and homepage.ts moved to services/ - swagger.ts moved to utils/ with adjusted scan globs Import paths and the generate:openapi script updated; ports and endpoints unchanged. * refactor(tests): move backend tests into src/backend/tests mirror tree Backend *.test.ts files (and the test-support harness) no longer sit next to source files; they live under src/backend/tests/ mirroring the source layout. Imports rewritten accordingly; CLAUDE.md convention updated. * refactor(hosts): group host modules into per-feature directories file-manager/, metrics/ (incl. widgets, managers, alert-engine), terminal/, tmux/ and tunnel/ each own their files; docker/ gains container-runtime. Genuinely shared helpers (jump-host chain, host resolver, connection pool, opkssh, vault, serial) stay at hosts/ root. Pure file moves with import path updates; mirrored test paths follow. * refactor(backend): final cleanup pass - re-register WebAuthn passkey routes (registration was dropped in the #1054 merge, breaking passkey login) and document all six endpoints - delete utils/simple-db-ops.ts (last caller migrated to DataCrypto) - starter: use the typed serverReady export, collapse the four-way version lookup to env then package.json candidates - add OpenAPI JSDoc to c2s-tunnel-presets endpoints - strip block-divider comment banners * feat: remove legacy "data_unlocked" field * feat: refactor rbac/sharing to support new permissions and auth types * feat: refactor rbac/sharing to support new permissions and auth types * feat: add "id" to user profile hide list * chore: root cleanup * feat: add more donation references and a 30-day donation reminder * chore: update readme * feat: automate beta tests * feat: add links to milestones * fix: hoist github/google SSO defaults to module scope (#1065) * fix(ssh-tools): allow clipboard paste in key recording field (#1066) The broadcast key-recording input was marked readOnly, which makes browsers block paste entirely (no context-menu Paste, Ctrl+V does nothing). handleKeyDown also called preventDefault() unconditionally, swallowing the Ctrl+V shortcut before a paste event could even fire. Let Ctrl/Cmd+V pass through in handleKeyDown, drop readOnly, and add an onPaste handler that reads the clipboard text and broadcasts it to the selected terminals like any other captured keystroke. Signed-off-by: emreumar <emreumar@users.noreply.github.com> Co-authored-by: emreumar <emreumar@users.noreply.github.com> * chore: write release notes * chore: update release notes * chore: update readmes * chore: add crypto only reminder in en.json * fix: macOS and cask errors on release workflow * chore: sync Crowdin translations for 2.5.1 --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: emreumar <emreumar@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: Russell Poovey <09.our_seekers@icloud.com> Co-authored-by: russell <git@0896c69e.com> Co-authored-by: Subedi Bibek <77529535+questbibek@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Alexander Elsner <101340634+Bensonheimer992@users.noreply.github.com> Co-authored-by: SankeerthNara <sankeerthnara@gmail.com> Co-authored-by: Stephan Groth <96803994+Kalvalax@users.noreply.github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io> Co-authored-by: lhojun <ldgs3324@gmail.com> Co-authored-by: Yunus Emre Umar <77045015+emre155@users.noreply.github.com> Co-authored-by: emreumar <emreumar@users.noreply.github.com>
2026-08-29 18:31:33 +00:00 · 2026-07-19 12:29:52 -05:00
parent fba645e92e
commit ddbdd5c437
562 changed files with 52303 additions and 23645 deletions
@@ -0,0 +1,205 @@
+import type { Client, ClientChannel } from "ssh2";
+import { sshLogger } from "../../utils/logger.js";
+
+export interface TmuxSessionInfo {
+  name: string;
+  created: number;
+  lastActivity: number;
+  windows: number;
+  attachedClients: number;
+}
+
+export interface TmuxDetectionResult {
+  available: boolean;
+  sessions: TmuxSessionInfo[];
+}
+
+const TMUX_PATH_DIRS = [
+  "/opt/homebrew/bin",
+  "/usr/local/bin",
+  "/opt/bin",
+  "/usr/pkg/bin",
+];
+
+export function withTmuxPath(command: string): string {
+  const script = `PATH=${TMUX_PATH_DIRS.join(":")}:$PATH; export PATH; ${command}`;
+  return `/bin/sh -c ${shellEscape(script)}`;
+}
+
+export function tmuxCommand(args: string): string {
+  return withTmuxPath(`tmux ${args}`);
+}
+
+/**
+ * Run a command on the remote host via a separate exec channel.
+ * Returns stdout as a string. Does not pollute the interactive shell.
+ */
+export function execCommand(conn: Client, command: string): Promise<string> {
+  return new Promise((resolve, reject) => {
+    conn.exec(command, (err, stream) => {
+      if (err) {
+        reject(err);
+        return;
+      }
+      let stdout = "";
+      let stderr = "";
+      stream.on("data", (data: Buffer) => {
+        stdout += data.toString("utf-8");
+      });
+      stream.stderr.on("data", (data: Buffer) => {
+        stderr += data.toString("utf-8");
+      });
+      stream.on("error", (err: Error) => {
+        reject(err);
+      });
+      stream.on("close", (code: number) => {
+        if (code !== 0 && stdout === "") {
+          reject(
+            new Error(stderr.trim() || `Command exited with code ${code}`),
+          );
+        } else {
+          resolve(stdout.trim());
+        }
+      });
+    });
+  });
+}
+
+/**
+ * Detect whether tmux is installed and list all existing sessions with details.
+ */
+export async function detectTmux(conn: Client): Promise<TmuxDetectionResult> {
+  try {
+    await execCommand(conn, tmuxCommand("-V"));
+  } catch {
+    return { available: false, sessions: [] };
+  }
+
+  let sessions: TmuxSessionInfo[] = [];
+  try {
+    const output = await execCommand(
+      conn,
+      tmuxCommand(
+        `list-sessions -F "#{session_name}|#{session_created}|#{session_activity}|#{session_windows}|#{session_attached}" 2>/dev/null`,
+      ),
+    );
+    if (output) {
+      sessions = output
+        .split("\n")
+        .filter((line) => line.length > 0)
+        .map((line) => {
+          const [name, created, activity, windows, attached] = line.split("|");
+          return {
+            name,
+            created: parseInt(created, 10) || 0,
+            lastActivity: parseInt(activity, 10) || 0,
+            windows: parseInt(windows, 10) || 0,
+            attachedClients: parseInt(attached, 10) || 0,
+          };
+        });
+    }
+  } catch {
+    // tmux server not running yet -- no sessions exist
+  }
+
+  return { available: true, sessions };
+}
+
+// tmux options applied on every attach/create:
+// - mouse on: enables mouse wheel / touch scrollback through tmux history
+// - history-limit: deep scrollback buffer on the remote host
+// - set-clipboard on: use OSC 52 to sync tmux selections to the client clipboard
+// - mode-keys vi: use vi-style keys in copy mode
+// - MouseDragEnd: stop the selection but keep it highlighted so the user can
+//   adjust and press Enter to copy (or drag again)
+// - Enter: copy the (possibly adjusted) selection and exit copy mode
+// - pane-mode-changed hook: on copy-mode entry, show a brief hint so users
+//   know to press Enter to copy the selection
+// Using -q on set/set-hook to suppress errors on older tmux versions that don't support
+// a particular option (e.g. set-clipboard on tmux < 2.5). Note: set-hook doesn't support -q.
+const TMUX_OPTS =
+  `set -gq mouse on` +
+  ` \\; set -gq history-limit 50000` +
+  ` \\; set -gq set-clipboard on` +
+  ` \\; set -gq aggressive-resize on` +
+  ` \\; set -gq mode-keys vi` +
+  ` \\; bind-key -T copy-mode-vi MouseDragEnd1Pane send-keys -X stop-selection` +
+  ` \\; bind-key -T copy-mode-vi Enter send-keys -X copy-selection-and-cancel` +
+  ` \\; set-hook -g pane-mode-changed` +
+  ` 'if -F "#{pane_in_mode}"` +
+  ` "display-message -d 2500 \\"Adjust selection and press Enter to copy\\""'`;
+
+/**
+ * Wait for a tmux session to appear by polling via exec channel.
+ * Returns the session name once found, or null on timeout.
+ */
+export async function waitForTmuxSession(
+  conn: Client,
+  sessionName: string,
+  timeoutMs = 5000,
+  intervalMs = 100,
+): Promise<string | null> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      await execCommand(
+        conn,
+        tmuxCommand(`has-session -t ${shellEscape(sessionName)} 2>/dev/null`),
+      );
+      return sessionName;
+    } catch {
+      // session not ready yet
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+  return null;
+}
+
+/**
+ * Write tmux attach or new-session command to the interactive shell stream.
+ * Uses && exit so the shell only closes if tmux started successfully.
+ */
+export function attachOrCreateTmuxSession(
+  stream: ClientChannel,
+  existingSessionName?: string,
+  newSessionName?: string,
+): void {
+  let command: string;
+  if (existingSessionName) {
+    command = `${tmuxCommand(`${TMUX_OPTS} \\; attach-session -t ${shellEscape(existingSessionName)}`)} && exit\r`;
+  } else {
+    const nameFlag = newSessionName ? ` -s ${shellEscape(newSessionName)}` : "";
+    command = `${tmuxCommand(`${TMUX_OPTS} \\; new-session${nameFlag}`)} && exit\r`;
+  }
+
+  sshLogger.info("Writing tmux command to shell", {
+    operation: "tmux_attach_or_create",
+    sessionName: existingSessionName || "(auto)",
+    isReattach: !!existingSessionName,
+  });
+
+  stream.write(command);
+}
+
+/**
+ * Query the name of the most recently created tmux session via exec channel.
+ */
+export async function queryNewestTmuxSession(
+  conn: Client,
+): Promise<string | null> {
+  try {
+    const output = await execCommand(
+      conn,
+      tmuxCommand(
+        `list-sessions -F "#{session_created}:#{session_name}" 2>/dev/null | sort -rn | head -1 | cut -d: -f2-`,
+      ),
+    );
+    return output || null;
+  } catch {
+    return null;
+  }
+}
+
+function shellEscape(s: string): string {
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
@@ -0,0 +1,927 @@
+import express from "express";
+import cookieParser from "cookie-parser";
+import { Client, type ConnectConfig } from "ssh2";
+import { createCorsMiddleware } from "../../utils/cors-config.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import { DataCrypto } from "../../utils/data-crypto.js";
+import {
+  createCurrentTmuxSessionTagRepository,
+  createCurrentUserRepository,
+} from "../../database/repositories/factory.js";
+import { logAudit, getRequestMeta } from "../../utils/audit-logger.js";
+import { sshLogger } from "../../utils/logger.js";
+import { SSH_ALGORITHMS } from "../../utils/ssh-algorithms.js";
+import { preparePrivateKeyForSSH2 } from "../../utils/ssh-key-utils.js";
+import { SSHHostKeyVerifier } from "../host-key-verifier.js";
+import { resolveHostById, checkHostAccess } from "../host-resolver.js";
+import type { HostAction } from "../../utils/permission-manager.js";
+import { createJumpHostChain } from "../jump-host-chain.js";
+import { applyAgentAuth } from "../terminal-auth-helpers.js";
+import {
+  createSocks5Connection,
+  type SOCKS5Config,
+} from "../../utils/socks5-helper.js";
+import { withConnection } from "../ssh-connection-pool.js";
+import { resolveSshConnectConfigHost } from "../ssh-dns.js";
+import { execCommand, tmuxCommand } from "./helper.js";
+import {
+  SEP,
+  parseSessions,
+  parseWindows,
+  parsePanes,
+  parsePsOutput,
+  parseGpuOutput,
+  buildPaneMetrics,
+  attachPanesToWindows,
+  shellEscape,
+  type RawPane,
+  type TmuxSessionSummary,
+  type TmuxWindow,
+  type PaneMetrics,
+} from "./monitor-helpers.js";
+import type { SSHHost, AuthenticatedRequest } from "../../../types/index.js";
+
+const PANE_ID_RE = /^%\d+$/;
+// tmux session names cannot contain ":" or "."; keep to a conservative
+// printable subset so the name is safe as a tmux target everywhere.
+const SESSION_NAME_RE = /^[A-Za-z0-9_@%+=-]{1,64}$/;
+const MAX_SEARCH_PANES = 100;
+const MAX_MATCHES_PER_PANE = 50;
+const SEARCH_HISTORY_LINES = 2000;
+const SEARCH_CONCURRENCY = 4;
+
+interface TmuxSessionOverview extends TmuxSessionSummary {
+  windows: TmuxWindow[];
+  tags: string[];
+}
+
+// SSH connection (lean variant of the per-module pattern used by server-stats
+// and docker; jump hosts and SOCKS5 reuse the shared helpers)
+
+async function buildSshConfig(host: SSHHost): Promise<ConnectConfig> {
+  const base: ConnectConfig = {
+    host: (host.ip || "").replace(/^\[|\]$/g, ""),
+    port: host.port,
+    username: host.username,
+    tryKeyboard: true,
+    keepaliveInterval: 30000,
+    keepaliveCountMax: 3,
+    readyTimeout: 60000,
+    hostVerifier: await SSHHostKeyVerifier.createHostVerifier(
+      host.id,
+      host.ip,
+      host.port,
+      null,
+      host.userId || "",
+      false,
+    ),
+    algorithms: SSH_ALGORITHMS,
+  } as ConnectConfig;
+
+  if (host.authType === "password") {
+    if (!host.password) {
+      throw new Error(`No password available for host ${host.ip}`);
+    }
+    base.password = host.password;
+  } else if (host.authType === "key") {
+    if (!host.key) {
+      throw new Error(`No valid SSH key available for host ${host.ip}`);
+    }
+    (base as Record<string, unknown>).privateKey = preparePrivateKeyForSSH2(
+      host.key,
+      host.keyPassword,
+    );
+    if (host.keyPassword) {
+      (base as Record<string, unknown>).passphrase = host.keyPassword;
+    }
+  } else if (host.authType === "none") {
+    // no credentials needed
+  } else if (host.authType === "vault") {
+    // cert auth setup happens in connectToHost (needs client instance)
+  } else if (host.authType === "agent") {
+    const result = await applyAgentAuth(
+      base as Record<string, unknown>,
+      host.terminalConfig as unknown as Record<string, unknown> | undefined,
+    );
+    if ("error" in result) {
+      throw new Error(result.error);
+    }
+  } else {
+    // opkssh and other interactive flows are not supported by this module
+    throw new Error(
+      `Authentication type '${host.authType}' is not supported by the tmux monitor. Open a terminal connection instead.`,
+    );
+  }
+
+  return base;
+}
+
+export function connectToHost(host: SSHHost): () => Promise<Client> {
+  return async () => {
+    const config = await buildSshConfig(host);
+    const client = new Client();
+
+    if (host.authType === "vault") {
+      const { setupVaultSshSignerAuth } =
+        await import("../vault-ssh-connect.js");
+      await setupVaultSshSignerAuth(config, client, host);
+    }
+
+    const proxyConfig: SOCKS5Config | null =
+      host.useSocks5 &&
+      (host.socks5Host ||
+        (host.socks5ProxyChain && host.socks5ProxyChain.length > 0))
+        ? {
+            useSocks5: host.useSocks5,
+            socks5Host: host.socks5Host,
+            socks5Port: host.socks5Port,
+            socks5Username: host.socks5Username,
+            socks5Password: host.socks5Password,
+            socks5ProxyChain: host.socks5ProxyChain,
+          }
+        : null;
+
+    let jumpClient: Client | null = null;
+    if (host.jumpHosts && host.jumpHosts.length > 0 && host.userId) {
+      jumpClient = await createJumpHostChain(
+        host.jumpHosts,
+        host.userId,
+        proxyConfig,
+      );
+      if (!jumpClient) {
+        throw new Error("Failed to establish jump host chain");
+      }
+    } else if (proxyConfig) {
+      const proxySocket = await createSocks5Connection(
+        host.ip,
+        host.port,
+        proxyConfig,
+      );
+      if (proxySocket) {
+        config.sock = proxySocket;
+      }
+    }
+
+    return new Promise<Client>((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        client.end();
+        jumpClient?.end();
+        reject(new Error("SSH connection timeout"));
+      }, 30000);
+
+      client.on("ready", () => {
+        clearTimeout(timeout);
+        resolve(client);
+      });
+      client.on("error", (err) => {
+        clearTimeout(timeout);
+        jumpClient?.end();
+        reject(err);
+      });
+      client.on(
+        "keyboard-interactive",
+        (_name, _instructions, _lang, prompts, finish) => {
+          finish(
+            prompts.map((p) =>
+              /password/i.test(p.prompt) ? host.password || "" : "",
+            ),
+          );
+        },
+      );
+
+      if (jumpClient) {
+        jumpClient.forwardOut(
+          "127.0.0.1",
+          0,
+          host.ip,
+          host.port,
+          (err, stream) => {
+            if (err) {
+              clearTimeout(timeout);
+              jumpClient!.end();
+              reject(
+                new Error(
+                  "Failed to forward through jump host: " + err.message,
+                ),
+              );
+              return;
+            }
+            config.sock = stream;
+            client.connect(config);
+          },
+        );
+      } else if (config.sock) {
+        client.connect(config);
+      } else {
+        resolveSshConnectConfigHost(config)
+          .then(() => {
+            client.connect(config);
+          })
+          .catch((error) => {
+            clearTimeout(timeout);
+            reject(error);
+          });
+      }
+    });
+  };
+}
+
+function getPoolKey(host: SSHHost): string {
+  const socks5Key = host.useSocks5
+    ? `:socks5:${host.socks5Host}:${host.socks5Port}`
+    : "";
+  return `tmux-monitor:${host.userId}:${host.ip}:${host.port}:${host.username}${socks5Key}`;
+}
+
+async function withHostConnection<T>(
+  host: SSHHost,
+  fn: (client: Client) => Promise<T>,
+): Promise<T> {
+  return withConnection(getPoolKey(host), connectToHost(host), fn);
+}
+
+// tmux queries
+
+async function tmuxAvailable(conn: Client): Promise<boolean> {
+  try {
+    await execCommand(conn, tmuxCommand("-V"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function runTmuxList(conn: Client, command: string): Promise<string> {
+  try {
+    return await execCommand(conn, command);
+  } catch {
+    return ""; // tmux server not running -- no sessions
+  }
+}
+
+function listSessionsCmd(): string {
+  return tmuxCommand(
+    `list-sessions -F "#{session_name}${SEP}#{session_created}${SEP}#{session_activity}${SEP}#{session_attached}" 2>/dev/null`,
+  );
+}
+
+function listWindowsCmd(): string {
+  return tmuxCommand(
+    `list-windows -a -F "#{session_name}${SEP}#{window_index}${SEP}#{window_active}${SEP}#{window_name}" 2>/dev/null`,
+  );
+}
+
+function listPanesCmd(): string {
+  return tmuxCommand(
+    `list-panes -a -F "#{session_name}${SEP}#{window_index}${SEP}#{pane_id}${SEP}#{pane_index}${SEP}#{pane_pid}${SEP}#{pane_active}${SEP}#{pane_width}${SEP}#{pane_height}${SEP}#{pane_current_command}${SEP}#{pane_current_path}${SEP}#{pane_title}" 2>/dev/null`,
+  );
+}
+
+async function listPanesRaw(conn: Client): Promise<RawPane[]> {
+  return parsePanes(await runTmuxList(conn, listPanesCmd()));
+}
+
+async function fetchSessionTags(
+  userId: string,
+  hostId: number,
+): Promise<Map<string, string[]>> {
+  return createCurrentTmuxSessionTagRepository().listByUserAndHost(
+    userId,
+    hostId,
+  );
+}
+
+async function collectPaneMetrics(
+  conn: Client,
+  panes: RawPane[],
+): Promise<PaneMetrics[]> {
+  let psOutput = "";
+  try {
+    psOutput = await execCommand(
+      conn,
+      "ps -eo pid=,ppid=,pcpu=,pmem=,rss=,comm= 2>/dev/null",
+    );
+  } catch {
+    return [];
+  }
+
+  // GPU memory per pid (best effort; nvidia-smi may not exist)
+  let gpuOutput = "";
+  try {
+    gpuOutput = await execCommand(
+      conn,
+      "command -v nvidia-smi >/dev/null 2>&1 && nvidia-smi --query-compute-apps=pid,used_gpu_memory --format=csv,noheader,nounits 2>/dev/null || true",
+    );
+  } catch {
+    // no GPU on host
+  }
+
+  return buildPaneMetrics(
+    panes,
+    parsePsOutput(psOutput),
+    parseGpuOutput(gpuOutput),
+  );
+}
+
+// Express app
+
+const app = express();
+const authManager = AuthManager.getInstance();
+
+app.use(createCorsMiddleware(["GET", "POST", "PUT", "DELETE", "OPTIONS"]));
+app.use(cookieParser());
+app.use(express.json({ limit: "1mb" }));
+app.use((_req, res, next) => {
+  res.setHeader("Cache-Control", "no-store");
+  next();
+});
+app.use(authManager.createAuthMiddleware());
+
+/**
+ * Resolve the host for a request and verify the user can access it.
+ * Sends the error response and returns null when access is denied.
+ */
+async function requireHost(
+  req: express.Request,
+  res: express.Response,
+  permission: HostAction = "connect",
+): Promise<SSHHost | null> {
+  const userId = (req as unknown as AuthenticatedRequest).userId;
+  const hostId = parseInt(String(req.params.hostId), 10);
+  if (isNaN(hostId)) {
+    res.status(400).json({ error: "Invalid host ID" });
+    return null;
+  }
+  if (DataCrypto.getUserDataKey(userId) === null) {
+    res.status(401).json({ error: "User data is locked" });
+    return null;
+  }
+
+  let host: SSHHost | null = null;
+  try {
+    host = await resolveHostById(hostId, userId);
+  } catch (err) {
+    sshLogger.error(`Failed to resolve host ${hostId} for tmux monitor`, err);
+  }
+  if (!host) {
+    res.status(404).json({ error: "Host not found" });
+    return null;
+  }
+
+  const hasAccess = await checkHostAccess(
+    hostId,
+    userId,
+    host.userId || userId,
+    permission,
+  );
+  if (!hasAccess) {
+    res.status(403).json({ error: "Access denied" });
+    return null;
+  }
+
+  // The monitor is opt-in per host (same pattern as enableDocker in
+  // docker.ts): hiding the UI is not enough, the API must refuse too.
+  if (!host.enableTmuxMonitor) {
+    res
+      .status(403)
+      .json({ error: "Tmux Monitor is not enabled for this host" });
+    return null;
+  }
+  return host;
+}
+
+function toErrorMessage(err: unknown): string {
+  return err instanceof Error ? err.message : "Unknown error";
+}
+
+// Destructive tmux actions terminate processes on the remote host, so they
+// land in the audit log like other host-level mutations (see host.ts).
+async function auditTmuxAction(
+  req: express.Request,
+  host: SSHHost,
+  action: string,
+  resourceName: string,
+  details?: Record<string, unknown>,
+): Promise<void> {
+  const userId = (req as unknown as AuthenticatedRequest).userId;
+  const { ipAddress, userAgent } = getRequestMeta(req);
+  let username = userId;
+  try {
+    const actor = await createCurrentUserRepository().findById(userId);
+    username = actor?.username ?? userId;
+  } catch {
+    // fall back to the raw user id
+  }
+  await logAudit({
+    userId,
+    username,
+    action,
+    resourceType: "host",
+    resourceId: String(host.id),
+    resourceName,
+    details: details ? JSON.stringify(details) : undefined,
+    ipAddress,
+    userAgent,
+    success: true,
+  });
+}
+
+// Typed error codes so the frontend can render a helpful state instead of a
+// raw 500 (same pattern as SESSION_EXPIRED handling in main-axios).
+type TmuxErrorCode =
+  | "TMUX_NOT_INSTALLED"
+  | "TMUX_NO_SERVER"
+  | "HOST_UNREACHABLE"
+  | "TMUX_ERROR";
+
+function classifyTmuxError(err: unknown): TmuxErrorCode {
+  const msg = err instanceof Error ? err.message : "";
+  if (/command not found|exited with code 127/i.test(msg))
+    return "TMUX_NOT_INSTALLED";
+  if (/no server running|lost server/i.test(msg)) return "TMUX_NO_SERVER";
+  if (
+    /timeout|timed out|econnrefused|ehostunreach|enotfound|enetunreach|econnreset|authentication|handshake|keepalive/i.test(
+      msg,
+    )
+  )
+    return "HOST_UNREACHABLE";
+  return "TMUX_ERROR";
+}
+
+function sendTmuxError(
+  res: express.Response,
+  err: unknown,
+  context: string,
+  hostId: number,
+): void {
+  const code = classifyTmuxError(err);
+  const status = code === "TMUX_ERROR" ? 500 : 503;
+  const error =
+    code === "TMUX_NOT_INSTALLED"
+      ? "tmux is not installed on this host"
+      : code === "TMUX_NO_SERVER"
+        ? "No tmux server is running on this host"
+        : code === "HOST_UNREACHABLE"
+          ? "Could not connect to the host"
+          : toErrorMessage(err);
+  sshLogger.error(`tmux ${context} failed for host ${hostId}`, err);
+  res.status(status).json({ error, code });
+}
+
+app.get("/tmux_monitor/:hostId/overview", async (req, res) => {
+  const userId = (req as unknown as AuthenticatedRequest).userId;
+  const host = await requireHost(req, res);
+  if (!host) return;
+
+  try {
+    const result = await withHostConnection(host, async (conn) => {
+      if (!(await tmuxAvailable(conn))) {
+        return { available: false, sessions: [] as TmuxSessionOverview[] };
+      }
+      const [sessionsOut, windowsOut, panesOut] = await Promise.all([
+        runTmuxList(conn, listSessionsCmd()),
+        runTmuxList(conn, listWindowsCmd()),
+        runTmuxList(conn, listPanesCmd()),
+      ]);
+      const sessions = parseSessions(sessionsOut);
+      const windows = parseWindows(windowsOut);
+      attachPanesToWindows(windows, parsePanes(panesOut));
+
+      const tags = await fetchSessionTags(userId, host.id);
+      const full: TmuxSessionOverview[] = sessions.map((s) => ({
+        ...s,
+        windows: windows.get(s.name) || [],
+        tags: tags.get(s.name) || [],
+      }));
+      return { available: true, sessions: full };
+    });
+    res.json(result);
+  } catch (err) {
+    sendTmuxError(res, err, "overview", host.id);
+  }
+});
+
+// Focus a pane: select its window and pane on the server so every attached
+// client (including the monitor's embedded terminal) switches to it.
+app.post("/tmux_monitor/:hostId/focus", async (req, res) => {
+  const host = await requireHost(req, res, "connect");
+  if (!host) return;
+
+  const paneId = String((req.body as { paneId?: string })?.paneId || "");
+  if (!PANE_ID_RE.test(paneId)) {
+    return res.status(400).json({ error: "Invalid pane ID" });
+  }
+
+  try {
+    await withHostConnection(host, (conn) =>
+      // A pane id is a valid window target: tmux resolves it to the window
+      // containing the pane.
+      execCommand(
+        conn,
+        tmuxCommand(
+          `select-window -t ${shellEscape(paneId)} \\; select-pane -t ${shellEscape(paneId)}`,
+        ),
+      ),
+    );
+    res.json({ ok: true });
+  } catch (err) {
+    sendTmuxError(res, err, "focus", host.id);
+  }
+});
+
+// Create a detached session. Starts the tmux server if none is running.
+app.post("/tmux_monitor/:hostId/sessions", async (req, res) => {
+  const host = await requireHost(req, res, "connect");
+  if (!host) return;
+
+  const name = String((req.body as { name?: string })?.name || "").trim();
+  if (!SESSION_NAME_RE.test(name)) {
+    return res.status(400).json({ error: "Invalid session name" });
+  }
+
+  try {
+    await withHostConnection(host, (conn) =>
+      execCommand(conn, tmuxCommand(`new-session -d -s ${shellEscape(name)}`)),
+    );
+    sshLogger.info("tmux session created", {
+      operation: "tmux_session_create",
+      hostId: host.id,
+      sessionName: name,
+    });
+    res.json({ ok: true, name });
+  } catch (err) {
+    if (/duplicate session/i.test(toErrorMessage(err))) {
+      return res
+        .status(409)
+        .json({ error: "A session with this name already exists" });
+    }
+    sendTmuxError(res, err, "create session", host.id);
+  }
+});
+
+// Create a window in an existing session. The session name comes from tmux's
+// own listing, so it is only checked for characters that would change the
+// target's meaning (":" and "." are window/pane separators in tmux targets);
+// "=" prefixes the target for an exact-name match.
+app.post("/tmux_monitor/:hostId/windows", async (req, res) => {
+  const host = await requireHost(req, res, "connect");
+  if (!host) return;
+
+  const sessionName = String(
+    (req.body as { sessionName?: string })?.sessionName || "",
+  ).trim();
+  if (!sessionName || /[:.\n]/.test(sessionName)) {
+    return res.status(400).json({ error: "Invalid session name" });
+  }
+
+  try {
+    await withHostConnection(host, (conn) =>
+      execCommand(
+        conn,
+        tmuxCommand(`new-window -t ${shellEscape(`=${sessionName}`)}`),
+      ),
+    );
+    sshLogger.info("tmux window created", {
+      operation: "tmux_window_create",
+      hostId: host.id,
+      sessionName,
+    });
+    res.json({ ok: true });
+  } catch (err) {
+    if (/can't find session|no such session/i.test(toErrorMessage(err))) {
+      return res.status(404).json({ error: "Session not found" });
+    }
+    sendTmuxError(res, err, "create window", host.id);
+  }
+});
+
+// Rename a session. Saved tags follow the session to its new name (for every
+// user — the session itself is shared on the host).
+app.post("/tmux_monitor/:hostId/rename", async (req, res) => {
+  const host = await requireHost(req, res, "connect");
+  if (!host) return;
+
+  const body = req.body as { sessionName?: string; newName?: string };
+  const sessionName = String(body?.sessionName || "").trim();
+  const newName = String(body?.newName || "").trim();
+  if (!sessionName || /[:.\n]/.test(sessionName)) {
+    return res.status(400).json({ error: "Invalid session name" });
+  }
+  if (!SESSION_NAME_RE.test(newName)) {
+    return res.status(400).json({ error: "Invalid new session name" });
+  }
+
+  try {
+    await withHostConnection(host, (conn) =>
+      execCommand(
+        conn,
+        tmuxCommand(
+          `rename-session -t ${shellEscape(`=${sessionName}`)} ${shellEscape(newName)}`,
+        ),
+      ),
+    );
+    await createCurrentTmuxSessionTagRepository().renameSessionForHost(
+      host.id,
+      sessionName,
+      newName,
+    );
+    sshLogger.info("tmux session renamed", {
+      operation: "tmux_session_rename",
+      hostId: host.id,
+      sessionName,
+      newName,
+    });
+    await auditTmuxAction(req, host, "tmux_session_rename", sessionName, {
+      newName,
+    });
+    res.json({ ok: true, name: newName });
+  } catch (err) {
+    if (/can't find session|no such session/i.test(toErrorMessage(err))) {
+      return res.status(404).json({ error: "Session not found" });
+    }
+    if (/duplicate session/i.test(toErrorMessage(err))) {
+      return res
+        .status(409)
+        .json({ error: "A session with this name already exists" });
+    }
+    sendTmuxError(res, err, "rename session", host.id);
+  }
+});
+
+// Kill a session and drop its saved tags.
+app.post("/tmux_monitor/:hostId/kill", async (req, res) => {
+  const host = await requireHost(req, res, "connect");
+  if (!host) return;
+
+  const sessionName = String(
+    (req.body as { sessionName?: string })?.sessionName || "",
+  ).trim();
+  if (!sessionName || /[:.\n]/.test(sessionName)) {
+    return res.status(400).json({ error: "Invalid session name" });
+  }
+
+  try {
+    await withHostConnection(host, (conn) =>
+      execCommand(
+        conn,
+        tmuxCommand(`kill-session -t ${shellEscape(`=${sessionName}`)}`),
+      ),
+    );
+    await createCurrentTmuxSessionTagRepository().deleteSessionForHost(
+      host.id,
+      sessionName,
+    );
+    sshLogger.info("tmux session killed", {
+      operation: "tmux_session_kill",
+      hostId: host.id,
+      sessionName,
+    });
+    await auditTmuxAction(req, host, "tmux_session_kill", sessionName);
+    res.json({ ok: true });
+  } catch (err) {
+    if (/can't find session|no such session/i.test(toErrorMessage(err))) {
+      return res.status(404).json({ error: "Session not found" });
+    }
+    sendTmuxError(res, err, "kill session", host.id);
+  }
+});
+
+// Kill a window (and every pane in it). Killing the last window of a session
+// ends the session — tmux semantics.
+app.post("/tmux_monitor/:hostId/kill-window", async (req, res) => {
+  const host = await requireHost(req, res, "connect");
+  if (!host) return;
+
+  const body = req.body as { sessionName?: string; windowIndex?: number };
+  const sessionName = String(body?.sessionName || "").trim();
+  const windowIndex = Number(body?.windowIndex);
+  if (!sessionName || /[:.\n]/.test(sessionName)) {
+    return res.status(400).json({ error: "Invalid session name" });
+  }
+  if (!Number.isInteger(windowIndex) || windowIndex < 0) {
+    return res.status(400).json({ error: "Invalid window index" });
+  }
+
+  try {
+    await withHostConnection(host, (conn) =>
+      execCommand(
+        conn,
+        tmuxCommand(
+          `kill-window -t ${shellEscape(`=${sessionName}:${windowIndex}`)}`,
+        ),
+      ),
+    );
+    sshLogger.info("tmux window killed", {
+      operation: "tmux_window_kill",
+      hostId: host.id,
+      sessionName,
+      windowIndex,
+    });
+    await auditTmuxAction(req, host, "tmux_window_kill", sessionName, {
+      windowIndex,
+    });
+    res.json({ ok: true });
+  } catch (err) {
+    if (
+      /can't find window|no such window|can't find session/i.test(
+        toErrorMessage(err),
+      )
+    ) {
+      return res.status(404).json({ error: "Window not found" });
+    }
+    sendTmuxError(res, err, "kill window", host.id);
+  }
+});
+
+// Kill a single pane. Killing the last pane of a window closes the window,
+// and the last window of a session ends the session — tmux semantics.
+app.post("/tmux_monitor/:hostId/kill-pane", async (req, res) => {
+  const host = await requireHost(req, res, "connect");
+  if (!host) return;
+
+  const paneId = String((req.body as { paneId?: string })?.paneId || "");
+  if (!PANE_ID_RE.test(paneId)) {
+    return res.status(400).json({ error: "Invalid pane ID" });
+  }
+
+  try {
+    await withHostConnection(host, (conn) =>
+      execCommand(conn, tmuxCommand(`kill-pane -t ${shellEscape(paneId)}`)),
+    );
+    sshLogger.info("tmux pane killed", {
+      operation: "tmux_pane_kill",
+      hostId: host.id,
+      paneId,
+    });
+    await auditTmuxAction(req, host, "tmux_pane_kill", paneId);
+    res.json({ ok: true });
+  } catch (err) {
+    if (/can't find pane|no such pane/i.test(toErrorMessage(err))) {
+      return res.status(404).json({ error: "Pane not found" });
+    }
+    sendTmuxError(res, err, "kill pane", host.id);
+  }
+});
+
+// Split the window containing a pane. "h" places the new pane to the right,
+// "v" below — matching tmux's own -h/-v semantics. The new pane starts in the
+// source pane's working directory.
+app.post("/tmux_monitor/:hostId/split", async (req, res) => {
+  const host = await requireHost(req, res, "connect");
+  if (!host) return;
+
+  const body = req.body as { paneId?: string; direction?: string };
+  const paneId = String(body?.paneId || "");
+  const direction = body?.direction === "v" ? "-v" : "-h";
+  if (!PANE_ID_RE.test(paneId)) {
+    return res.status(400).json({ error: "Invalid pane ID" });
+  }
+  if (body?.direction !== "h" && body?.direction !== "v") {
+    return res.status(400).json({ error: "Invalid split direction" });
+  }
+
+  try {
+    await withHostConnection(host, (conn) =>
+      execCommand(
+        conn,
+        tmuxCommand(
+          `split-window ${direction} -t ${shellEscape(paneId)} -c ${shellEscape("#{pane_current_path}")}`,
+        ),
+      ),
+    );
+    sshLogger.info("tmux pane split", {
+      operation: "tmux_pane_split",
+      hostId: host.id,
+      paneId,
+      direction: body.direction,
+    });
+    res.json({ ok: true });
+  } catch (err) {
+    sendTmuxError(res, err, "split", host.id);
+  }
+});
+
+app.get("/tmux_monitor/:hostId/search", async (req, res) => {
+  const host = await requireHost(req, res);
+  if (!host) return;
+
+  const query = String(req.query.q || "").trim();
+  if (!query) {
+    return res.status(400).json({ error: "Missing search query" });
+  }
+
+  try {
+    const results = await withHostConnection(host, async (conn) => {
+      const allPanes = await listPanesRaw(conn);
+      const panes = allPanes.slice(0, MAX_SEARCH_PANES);
+      // Flips to true whenever a limit was hit, so the UI can tell the user
+      // the results are partial instead of silently truncating.
+      let truncated = allPanes.length > MAX_SEARCH_PANES;
+      const matches: Array<{
+        paneId: string;
+        sessionName: string;
+        windowIndex: number;
+        line: number;
+        text: string;
+      }> = [];
+
+      // Bounded concurrency; each search runs capture+grep remotely so only
+      // matching lines travel back over the wire.
+      for (let i = 0; i < panes.length; i += SEARCH_CONCURRENCY) {
+        const batch = panes.slice(i, i + SEARCH_CONCURRENCY);
+        await Promise.all(
+          batch.map(async (pane) => {
+            try {
+              const output = await execCommand(
+                conn,
+                tmuxCommand(
+                  `capture-pane -p -J -t ${shellEscape(pane.id)} -S -${SEARCH_HISTORY_LINES} 2>/dev/null | grep -n -i -F -- ${shellEscape(query)} | head -${MAX_MATCHES_PER_PANE}`,
+                ),
+              );
+              const lines = output.split("\n").filter(Boolean);
+              if (lines.length >= MAX_MATCHES_PER_PANE) truncated = true;
+              for (const line of lines) {
+                const sep = line.indexOf(":");
+                if (sep === -1) continue;
+                matches.push({
+                  paneId: pane.id,
+                  sessionName: pane.sessionName,
+                  windowIndex: pane.windowIndex,
+                  line: parseInt(line.slice(0, sep), 10) || 0,
+                  text: line.slice(sep + 1).slice(0, 500),
+                });
+              }
+            } catch {
+              // grep exits non-zero when there are no matches -- not an error
+            }
+          }),
+        );
+      }
+      return { matches, truncated };
+    });
+    res.json({
+      query,
+      matches: results.matches,
+      truncated: results.truncated,
+      searchedLines: SEARCH_HISTORY_LINES,
+      maxPanes: MAX_SEARCH_PANES,
+    });
+  } catch (err) {
+    sendTmuxError(res, err, "search", host.id);
+  }
+});
+
+app.get("/tmux_monitor/:hostId/metrics", async (req, res) => {
+  const host = await requireHost(req, res);
+  if (!host) return;
+
+  try {
+    const metrics = await withHostConnection(host, async (conn) => {
+      const panes = await listPanesRaw(conn);
+      if (panes.length === 0) return [];
+      return collectPaneMetrics(conn, panes);
+    });
+    res.json({ panes: metrics });
+  } catch (err) {
+    sendTmuxError(res, err, "metrics", host.id);
+  }
+});
+
+app.put("/tmux_monitor/:hostId/tags", async (req, res) => {
+  const userId = (req as unknown as AuthenticatedRequest).userId;
+  const host = await requireHost(req, res);
+  if (!host) return;
+
+  const { sessionName, tags } = req.body as {
+    sessionName?: string;
+    tags?: string[];
+  };
+  if (!sessionName || typeof sessionName !== "string") {
+    return res.status(400).json({ error: "Missing session name" });
+  }
+  if (!Array.isArray(tags) || tags.some((t) => typeof t !== "string")) {
+    return res.status(400).json({ error: "Tags must be an array of strings" });
+  }
+  const cleanTags = [
+    ...new Set(tags.map((t) => t.trim().slice(0, 64)).filter(Boolean)),
+  ].slice(0, 20);
+
+  try {
+    await createCurrentTmuxSessionTagRepository().replaceForUserHostSession(
+      userId,
+      host.id,
+      sessionName,
+      cleanTags,
+    );
+    res.json({ sessionName, tags: cleanTags });
+  } catch (err) {
+    sshLogger.error(
+      `Failed to save tmux session tags for host ${host.id}`,
+      err,
+    );
+    res.status(500).json({ error: toErrorMessage(err) });
+  }
+});
+
+const PORT = 30010;
+app.listen(PORT, () => {});
@@ -0,0 +1,240 @@
+// Pure parsing/aggregation helpers for the tmux monitor module.
+// Kept free of SSH/Express dependencies so they can be unit-tested.
+
+// Field separator used in tmux -F format strings. Session names, pane titles
+// and paths may contain "|", and tmux sanitizes control characters (and, under
+// non-UTF-8 locales, multibyte characters) in format output to "_", so a
+// printable ASCII token is the only separator that survives everywhere.
+export const SEP = "<<TMX>>";
+
+export interface TmuxPane {
+  id: string;
+  index: number;
+  pid: number;
+  active: boolean;
+  width: number;
+  height: number;
+  command: string;
+  path: string;
+  title: string;
+}
+
+export interface TmuxWindow {
+  index: number;
+  name: string;
+  active: boolean;
+  panes: TmuxPane[];
+}
+
+export interface TmuxSessionSummary {
+  name: string;
+  created: number;
+  lastActivity: number;
+  attachedClients: number;
+}
+
+export interface RawPane extends TmuxPane {
+  sessionName: string;
+  windowIndex: number;
+}
+
+export interface ProcessInfo {
+  pid: number;
+  ppid: number;
+  cpu: number;
+  mem: number;
+  rss: number;
+  comm: string;
+}
+
+export interface PaneMetrics {
+  paneId: string;
+  sessionName: string;
+  pid: number;
+  processCount: number;
+  cpuPercent: number;
+  memRssKb: number;
+  gpuMemMb: number;
+  topCommand: string | null;
+}
+
+export function parseSessions(output: string): TmuxSessionSummary[] {
+  return output
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => {
+      const [name, created, activity, attached] = line.split(SEP);
+      return {
+        name,
+        created: parseInt(created, 10) || 0,
+        lastActivity: parseInt(activity, 10) || 0,
+        attachedClients: parseInt(attached, 10) || 0,
+      };
+    });
+}
+
+export function parseWindows(output: string): Map<string, TmuxWindow[]> {
+  const bySession = new Map<string, TmuxWindow[]>();
+  for (const line of output.split("\n").filter(Boolean)) {
+    const [session, index, active, name] = line.split(SEP);
+    if (!bySession.has(session)) bySession.set(session, []);
+    bySession.get(session)!.push({
+      index: parseInt(index, 10) || 0,
+      name: name || "",
+      active: active === "1",
+      panes: [],
+    });
+  }
+  return bySession;
+}
+
+export function parsePanes(output: string): RawPane[] {
+  return output
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => {
+      const [
+        sessionName,
+        windowIndex,
+        id,
+        index,
+        pid,
+        active,
+        width,
+        height,
+        command,
+        path,
+        title,
+      ] = line.split(SEP);
+      return {
+        sessionName,
+        windowIndex: parseInt(windowIndex, 10) || 0,
+        id,
+        index: parseInt(index, 10) || 0,
+        pid: parseInt(pid, 10) || 0,
+        active: active === "1",
+        width: parseInt(width, 10) || 0,
+        height: parseInt(height, 10) || 0,
+        command: command || "",
+        path: path || "",
+        title: title || "",
+      };
+    });
+}
+
+export function parsePsOutput(output: string): ProcessInfo[] {
+  const processes: ProcessInfo[] = [];
+  for (const line of output.split("\n")) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 6) continue;
+    const pid = parseInt(parts[0], 10);
+    const ppid = parseInt(parts[1], 10);
+    if (isNaN(pid) || isNaN(ppid)) continue;
+    processes.push({
+      pid,
+      ppid,
+      cpu: parseFloat(parts[2]) || 0,
+      mem: parseFloat(parts[3]) || 0,
+      rss: parseInt(parts[4], 10) || 0,
+      comm: parts.slice(5).join(" "),
+    });
+  }
+  return processes;
+}
+
+export function parseGpuOutput(output: string): Map<number, number> {
+  const gpuByPid = new Map<number, number>();
+  for (const line of output.split("\n").filter(Boolean)) {
+    const [pid, mem] = line.split(",").map((s) => s.trim());
+    const pidNum = parseInt(pid, 10);
+    const memNum = parseInt(mem, 10);
+    if (!isNaN(pidNum) && !isNaN(memNum)) {
+      gpuByPid.set(pidNum, (gpuByPid.get(pidNum) || 0) + memNum);
+    }
+  }
+  return gpuByPid;
+}
+
+/**
+ * Map each pane's shell pid to its descendant process tree and aggregate
+ * CPU/RAM/GPU usage per pane.
+ */
+export function buildPaneMetrics(
+  panes: RawPane[],
+  processes: ProcessInfo[],
+  gpuByPid: Map<number, number>,
+): PaneMetrics[] {
+  const byPid = new Map<number, ProcessInfo>();
+  const childrenOf = new Map<number, number[]>();
+  for (const p of processes) {
+    byPid.set(p.pid, p);
+    if (!childrenOf.has(p.ppid)) childrenOf.set(p.ppid, []);
+    childrenOf.get(p.ppid)!.push(p.pid);
+  }
+
+  return panes.map((pane) => {
+    // Walk the descendant tree starting at (and including) the pane's shell
+    const treePids: number[] = [];
+    const queue = [pane.pid];
+    const seen = new Set<number>();
+    while (queue.length > 0) {
+      const pid = queue.shift()!;
+      if (seen.has(pid)) continue;
+      seen.add(pid);
+      if (byPid.has(pid)) treePids.push(pid);
+      for (const child of childrenOf.get(pid) || []) queue.push(child);
+    }
+
+    let cpuPercent = 0;
+    let memRssKb = 0;
+    let gpuMemMb = 0;
+    let topCommand: string | null = null;
+    let topCpu = -1;
+    for (const pid of treePids) {
+      const p = byPid.get(pid)!;
+      cpuPercent += p.cpu;
+      memRssKb += p.rss;
+      gpuMemMb += gpuByPid.get(pid) || 0;
+      // The pane shell itself is rarely the interesting process
+      if (p.cpu > topCpu && pid !== pane.pid) {
+        topCpu = p.cpu;
+        topCommand = p.comm;
+      }
+    }
+    if (topCommand === null && treePids.length > 0) {
+      topCommand = byPid.get(treePids[0])!.comm;
+    }
+
+    return {
+      paneId: pane.id,
+      sessionName: pane.sessionName,
+      pid: pane.pid,
+      processCount: treePids.length,
+      cpuPercent: Math.round(cpuPercent * 10) / 10,
+      memRssKb,
+      gpuMemMb,
+      topCommand,
+    };
+  });
+}
+
+/**
+ * Group panes into their windows (mutates the window objects' pane arrays).
+ */
+export function attachPanesToWindows(
+  windows: Map<string, TmuxWindow[]>,
+  panes: RawPane[],
+): void {
+  for (const pane of panes) {
+    const sessionWindows = windows.get(pane.sessionName) || [];
+    const window = sessionWindows.find((w) => w.index === pane.windowIndex);
+    if (window) {
+      const { sessionName: _s, windowIndex: _w, ...paneFields } = pane;
+      window.panes.push(paneFields);
+    }
+  }
+}
+
+export function shellEscape(s: string): string {
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}