release-2.5.1 (#1067)

* chore(deps): bump node from 24-slim to 26-slim in /docker in the docker-major-updates group (#1021) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump node in /docker in the docker-major-updates group Bumps the docker-major-updates group in /docker with 1 update: node. Updates `node` from 24-slim to 26-slim --- updated-dependencies: - dependency-name: node dependency-version: 26-slim dependency-type: direct:production dependency-group: docker-major-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 24 updates (#1023) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps-dev): bump the dev-patch-updates group with 24 updates Bumps the dev-patch-updates group with 24 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.1` | `2.5.2` | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.3` | `6.10.4` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.1` | `6.43.5` | | [@radix-ui/react-accordion](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/accordion) | `1.2.14` | `1.2.15` | | [@radix-ui/react-alert-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/alert-dialog) | `1.1.17` | `1.1.18` | | [@radix-ui/react-checkbox](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/checkbox) | `1.3.5` | `1.3.6` | | [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.17` | `1.1.18` | | [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.18` | `2.1.19` | | [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.10` | `2.1.11` | | [@radix-ui/react-popover](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/popover) | `1.1.17` | `1.1.18` | | [@radix-ui/react-progress](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/progress) | `1.1.10` | `1.1.11` | | [@radix-ui/react-scroll-area](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/scroll-area) | `1.2.12` | `1.2.13` | | [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.3.1` | `2.3.2` | | [@radix-ui/react-separator](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/separator) | `1.1.10` | `1.1.11` | | [@radix-ui/react-slider](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slider) | `1.4.1` | `1.4.2` | | [@radix-ui/react-switch](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/switch) | `1.3.1` | `1.3.2` | | [@radix-ui/react-tabs](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tabs) | `1.1.15` | `1.1.16` | | [@radix-ui/react-tooltip](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip) | `1.2.10` | `1.2.11` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.1` | `4.3.2` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.0.3` | | [i18next](https://github.com/i18next/i18next) | `26.3.1` | `26.3.4` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.0` | `1.6.1` | | [sharp](https://github.com/lovell/sharp) | `0.35.2` | `0.35.3` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.1` | `4.3.2` | Updates `@biomejs/biome` from 2.5.1 to 2.5.2 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.2/packages/@biomejs/biome) Updates `@codemirror/commands` from 6.10.3 to 6.10.4 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@codemirror/view` from 6.43.1 to 6.43.5 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@radix-ui/react-accordion` from 1.2.14 to 1.2.15 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/accordion/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/accordion) Updates `@radix-ui/react-alert-dialog` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/alert-dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/alert-dialog) Updates `@radix-ui/react-checkbox` from 1.3.5 to 1.3.6 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/checkbox/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/checkbox) Updates `@radix-ui/react-dialog` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog) Updates `@radix-ui/react-dropdown-menu` from 2.1.18 to 2.1.19 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu) Updates `@radix-ui/react-label` from 2.1.10 to 2.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label) Updates `@radix-ui/react-popover` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/popover/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/popover) Updates `@radix-ui/react-progress` from 1.1.10 to 1.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/progress/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/progress) Updates `@radix-ui/react-scroll-area` from 1.2.12 to 1.2.13 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/scroll-area/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/scroll-area) Updates `@radix-ui/react-select` from 2.3.1 to 2.3.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select) Updates `@radix-ui/react-separator` from 1.1.10 to 1.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/separator/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/separator) Updates `@radix-ui/react-slider` from 1.4.1 to 1.4.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slider/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slider) Updates `@radix-ui/react-switch` from 1.3.1 to 1.3.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/switch/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/switch) Updates `@radix-ui/react-tabs` from 1.1.15 to 1.1.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tabs/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tabs) Updates `@radix-ui/react-tooltip` from 1.2.10 to 1.2.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tooltip/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tooltip) Updates `@tailwindcss/vite` from 4.3.1 to 4.3.2 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/@tailwindcss-vite) Updates `@vitejs/plugin-react` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react) Updates `i18next` from 26.3.1 to 26.3.4 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.1...v26.3.4) Updates `radix-ui` from 1.6.0 to 1.6.1 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui) Updates `sharp` from 0.35.2 to 0.35.3 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.2...v0.35.3) Updates `tailwindcss` from 4.3.1 to 4.3.2 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/commands" dependency-version: 6.10.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-accordion" dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-alert-dialog" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-checkbox" dependency-version: 1.3.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-dialog" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-dropdown-menu" dependency-version: 2.1.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-label" dependency-version: 2.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-popover" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-progress" dependency-version: 1.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-scroll-area" dependency-version: 1.2.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-select" dependency-version: 2.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-separator" dependency-version: 1.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-slider" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-switch" dependency-version: 1.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-tabs" dependency-version: 1.1.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-tooltip" dependency-version: 1.2.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: i18next dependency-version: 26.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: radix-ui dependency-version: 1.6.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-patch-updates group with 2 updates (#1025) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump the prod-patch-updates group with 2 updates Bumps the prod-patch-updates group with 2 updates: [axios](https://github.com/axios/axios) and [nanoid](https://github.com/ai/nanoid). Updates `axios` from 1.18.0 to 1.18.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.18.0...v1.18.1) Updates `nanoid` from 5.1.15 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.15...5.1.16) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-minor-updates group with 3 updates (#1026) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump the prod-minor-updates group with 3 updates Bumps the prod-minor-updates group with 3 updates: [js-yaml](https://github.com/nodeca/js-yaml), [motion](https://github.com/motiondivision/motion) and [undici](https://github.com/nodejs/undici). Updates `js-yaml` from 5.0.0 to 5.2.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.0.0...5.2.1) Updates `motion` from 12.40.0 to 12.42.2 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](https://github.com/motiondivision/motion/compare/v12.40.0...v12.42.2) Updates `undici` from 8.5.0 to 8.7.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v8.5.0...v8.7.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: motion dependency-version: 12.42.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: undici dependency-version: 8.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump electron from 42.4.1 to 43.0.0 in the major-updates group (#1027) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps-dev): bump electron in the major-updates group Bumps the major-updates group with 1 update: [electron](https://github.com/electron/electron). Updates `electron` from 42.4.1 to 43.0.0 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v42.4.1...v43.0.0) --- updated-dependencies: - dependency-name: electron dependency-version: 43.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Fix MC syntax highlighting artifacts (#996) * Filter dashboard status hosts (#997) * Persist dashboard service link changes (#999) * Fix snippet text overflow (#1000) * Persist remote desktop credential auth (#1001) * Guard language switching failures (#1002) * Resolve tunnel source credentials (#1003) * Support Vault auth for monitors (#1004) * Fix Windows file delete command (#1005) * Fix release artifact checkout ref (#1006) * Fix command palette escape in fullscreen (#1008) * Fix alerts and audit log data normalization (#1010) * Fix macOS VNC protocol negotiation (#1012) * Fix port knocking before SSH connect (#1013) * Allow Escape to close link confirmation (#1014) * Prevent Electron modifier wheel zoom (#1016) * Fix credential auth optional password (#1009) * Retry transient terminal DNS lookups (#1011) * Retry transient terminal DNS lookups * Apply DNS retry to SSH entry points * Fix OIDC redirect forwarded port handling (#1007) * Preserve recent open tabs on startup (#1015) * Fix fish prompt OSC highlighting (#998) * Fix terminal font selection (#1018) * fix: font legibility (#1019) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * fix: font legibility Text was entirely unreadable in places for me. Especially with themes like Catppuccin. The muted-foreground text and the tags too similiar to the background. --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: russell <git@0896c69e.com> * fix(file-manager): chunked uploads fail with 'Expected multipart/form-data request' (#1020) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * fix(file-manager): use postForm for chunked uploads so multipart content-type is sent The fileManagerApi axios instance defaults to Content-Type: application/json. Axios 1.x's default transformRequest converts a FormData body to JSON whenever the request content type is application/json, so every chunk POSTed to /ssh/uploadFileChunk arrived as a JSON body like {"chunk":{}} and the backend rejected it with 400 'Expected multipart/form-data request'. This breaks all uploads of files larger than the 1.5 GiB chunking threshold. The non-chunked path already uses postForm for /ssh/uploadFileStream; use it for the chunk path too so axios keeps the FormData intact and the browser sets the multipart boundary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: implement OIDC back-channel logout support with session management (#1028) * feat: implement OIDC back-channel logout support with session management * Fix OIDC back-channel logout handling * Require logout token replay identifiers --------- Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * Add API key host enrollment endpoint (#1029) * Fix tmux detection for non-POSIX shells (#1030) * Fix OPKSSH js-yaml ESM import (#1031) * Fix Android Vietnamese IME input (#1032) * Fix Firefox RDP clipboard paste (#1033) * Fix Proxmox discovery over HTTPS (#1041) * Fix external editor actions in file preview (#1042) * Allow pinned hosts with name sorting (#1043) * Fix Firefox desktop OIDC callback (#1044) * feat(session): add recording and replay (#1049) * Fix status checks through jump hosts (#1045) * Add terminal font size shortcuts (#1047) * feat: add Open File Manager to tab right-click menu (#1051) Co-authored-by: SankeerthNara <sankeerthnara@gmail.com> * perf: frontend request cache, poll pause, and code-split shell (#1052) Host/status caching, shell code-split, SSH pool waits, host-metrics concurrency, background-tab idle, per-host status subscriptions, homepage poll quieting, and virtualized host sidebar + file manager lists. * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * feat: save quick connect sessions as hosts (#1055) * fix: restore sudo password autofill settings (#1056) * fix: preserve file editor position on save (#1057) * fix: sync cloud preference storage mode (#1058) * fix: render RDP sessions at native pixel density (#1059) * fix: restore database import in embedded desktop mode (#1060) * Update Auto-complete.tsx (#1061) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore: donation bar reporting wrong result * feat: add Open File Manager to tab right-click menu (#1046) * Revert "feat: add Open File Manager to tab right-click menu (#1046)" (#1050) This reverts commit 0712fdd731. * Remove donation badge from README Removed donation badge from README. * Delete .github/workflows/donation-goal.yml * Update Auto-complete.tsx --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * feat(auth): opt-in OIDC DEK unlock for API-key requests (ALLOW_APIKEY_DATA_UNLOCK) (#1064) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore: donation bar reporting wrong result * feat: add Open File Manager to tab right-click menu (#1046) * Revert "feat: add Open File Manager to tab right-click menu (#1046)" (#1050) This reverts commit 0712fdd731. * Remove donation badge from README Removed donation badge from README. * Delete .github/workflows/donation-goal.yml * feat(auth): opt-in OIDC DEK unlock for API-key requests API keys authenticate but cannot touch the encrypted credential/host store ('User data not unlocked') unless the user has a live interactive session, making them unusable for headless automation. For OIDC users the DEK is server-derivable (deriveOIDCSystemKey), so handleApiKeyAuth can unlock it without a password. Gated behind ALLOW_APIKEY_DATA_UNLOCK (default off) because enabling it widens the blast radius of a leaked API key. OIDC-only; password users are untouched. Refs #1063 --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: Sankeerth Nara <sankeerthnara@gmail.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * chore: package lock sync * Add Proxmox guest auto sync (#1053) * draft: database layer refactor (#1054) * feat(sshid) - sshid.io equivalent for termix (#919) * feat(ssh-id): database schema, migrations and field encryption Adds ssh_identities, ssh_identity_keys and ssh_identity_ca tables (public keys stored plaintext for the unauthenticated resolver; CA private key registered for per-user field encryption), with UNIQUE(user_id), an index on ssh_identity_keys(identity_id), and idempotent CREATE TABLE migrations. * feat(ssh-id): backend API — resolver, key management, CA and certificates Mounts /sshid (nginx route added). Public text/plain authorized_keys resolver (+ exact /:algo filter, HTML viewer) and CA public-key endpoint; no-store + noindex headers on every resolver response including early 404s. Authenticated management: claim/rename/delete handle, add/import/generate/enable/delete keys, and a per-user CA (create/rotate/delete) with pure-Node OpenSSH certificate issuance. Audit logging on all mutations; UNIQUE races map to a precise 409. Unit tests for key parsing and certificate signing (ssh-keygen-validated). * feat(ssh-id): frontend panel, API client and i18n SSH ID panel wired into the app rail and AppShell: claim handle, resolver URL + curl one-liner, key list, generate, paste/import, CA enable/rotate/remove with server trust command, and per-key certificate issuance. API client re-exported through main-axios.ts; all strings i18n'd. * style(ssh-id): align panel and resolver page with Termix theme - Rebuild the SSH ID sidebar panel with the theme's square components (SectionCard / SettingRow / FakeSwitch) instead of rounded ad-hoc cards; use accent-brand and destructive tokens rather than raw red/green. - Fix panel scrolling: move overflow to a block scroll container so the cards keep their natural height instead of being clipped. - Restyle the public resolver HTML page (/sshid/u/:handle) to the Termix dark theme: square corners, #18181b/#303032 palette, #f59145 accent, uppercase section labels. - Tidy copy: 'Save To Credentials' label, drop the redundant generate intro, and correct the generate tooltip (the key is stored when saving to vault). * feat: rename to Termix ID, improve UI, backend inconsistencies, and general bug fixes --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> * ci(deps): bump actions/checkout from 6 to 7 in the github-actions group (#922) Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 11 updates (#923) Bumps the dev-patch-updates group with 11 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/search](https://github.com/codemirror/search) | `6.7.0` | `6.7.1` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.0` | `6.43.1` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.0` | `4.3.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.9` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.8` | `4.1.9` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.2` | `0.5.3` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.7` | `17.0.8` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` | | [sharp](https://github.com/lovell/sharp) | `0.35.1` | `0.35.2` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.0` | `4.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.9` | Updates `@codemirror/search` from 6.7.0 to 6.7.1 - [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/search/commits) Updates `@codemirror/view` from 6.43.0 to 6.43.1 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@tailwindcss/vite` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8) Updates `@vitest/ui` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/ui) Updates `eslint-plugin-react-refresh` from 0.5.2 to 0.5.3 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.2...v0.5.3) Updates `lint-staged` from 17.0.7 to 17.0.8 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](https://github.com/lint-staged/lint-staged/compare/v17.0.7...v17.0.8) Updates `prettier` from 3.8.3 to 3.8.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.8.4) Updates `sharp` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) Updates `tailwindcss` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) Updates `vitest` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: "@codemirror/search" dependency-version: 6.7.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/ui" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: lint-staged dependency-version: 17.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump nanoid in the prod-patch-updates group (#925) Bumps the prod-patch-updates group with 1 update: [nanoid](https://github.com/ai/nanoid). Updates `nanoid` from 5.1.11 to 5.1.15 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.11...5.1.15) --- updated-dependencies: - dependency-name: nanoid dependency-version: 5.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the major-updates group with 5 updates (#926) Bumps the major-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.0.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.0.0` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `10.0.3` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `10.5.0` | Updates `js-yaml` from 4.2.0 to 5.0.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...5.0.0) Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@types/node` from 25.9.2 to 26.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `concurrently` from 9.2.1 to 10.0.3 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](https://github.com/open-cli-tools/concurrently/compare/v9.2.1...v10.0.3) Updates `eslint` from 9.39.4 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v10.5.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: concurrently dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(ssh): add HashiCorp Vault SSH signer authentication * fix: small fixes to vault feature to align with Termix codebase * chore: add view docs links for vault/termix id * fix: file upload fails with 400 and missing schema migrations on upgrade (#929) Two bugs introduced in v2.4.1: 1. uploadFileStream uses fileManagerApi.post() which triggers axios's transformRequest to JSON-serialize the FormData because the instance default Content-Type is application/json. Change to postForm() which sets Content-Type: multipart/form-data so the browser XHR sends the correct multipart body with boundary. 2. Two schema items added to schema.ts were not included in migrateSchema() in db/index.ts, causing 500 errors on existing installations upgrading from v2.4.0: - user_preferences.status_color_scheme (no such column) - dashboard_service_links table (no such table) Fixes #928 Co-authored-by: sash <sash@fominykh.io> * fix: support PuTTY PPK ssh keys (#930) * fix: chunk large file manager uploads (#932) * fix: route dashboard hosts by protocol (#934) * fix: resolve tunnel endpoints reliably (#935) * Fix Electron OIDC browser auth failures (#936) * Allow RDP connections without stored credentials (#937) * Sync role credential shares for OIDC users (#938) * Fix terminal link dialog layering (#940) * Confirm large files before opening editor (#942) * Confirm closing active host connections (#943) * Preserve file path case in file manager UI (#941) * fix: preserve unicode guacamole tokens (#933) * Persist VNC authentication settings (#944) * Fix Guacamole websocket base path (#946) * Promote file manager terminals to tabs (#939) * Guard Guacamole disconnect during startup (#945) * chore: increment ver * feat: bitwarden ssh agent integration * feat: serial connections support * fix: various small bug fixes * feat: open all sessions in a folder and terminal custom theme color support * feat: cross host file manager clipboard and several small bug fixes * feat: tailscale/wireguard support and added a new status state for when backend is checking status * feat: grafana like server stats history, new alert system, ntfy/webhook support * feat: new grid and widget based homepage function * feat: new donate button in dashboard * fix: alert ui incorrectly using termix css and fixed issue with alert system not loading * chore: start database layer refactor * docs: plan database layer refactor * docs: audit database layer refactor phase zero * chore: add database runtime adapter skeleton * chore: add settings repository skeleton * chore: add user session repository skeleton * chore: add host credential repository skeleton * chore: add field encryption boundary * chore: migrate settings route slice * chore: migrate user settings routes * chore: migrate host metrics settings routes * chore: migrate acme settings route * chore: migrate terminal settings route * chore: migrate tailscale settings read * chore: migrate guacamole settings reads * chore: migrate session timeout settings reads * chore: migrate auth route settings reads * chore: migrate host metrics settings reads * chore: migrate startup settings reads * chore: migrate user settings cleanup * chore: migrate password reset settings * chore: migrate oidc legacy settings read * chore: migrate user route settings slice * chore: migrate oidc state settings * chore: migrate user login settings reads * chore: migrate user crypto settings * chore: consolidate startup settings defaults * chore: consolidate database settings import export * chore: migrate core session auth paths * chore: migrate remaining session auth paths * chore: migrate admin user routes * chore: migrate user route admin checks * chore: migrate user lifecycle routes * chore: migrate auth user lookups * chore: migrate oidc user routes * chore: migrate api key repository paths * docs: add database gray rollout guide * chore: migrate trusted device paths * chore: migrate user session route user lookups * chore: add database repository rollout guard * chore: expose repository rollout status * chore: warn on repository rollout misconfiguration * chore: migrate remaining user lookup helpers * chore: migrate ssh user lookups * chore: migrate user settings admin lookups * chore: migrate acme ssl user lookups * chore: migrate audit log admin checks * chore: migrate oidc account user updates * chore: migrate password reset user updates * chore: migrate user deletion core records * chore: migrate snippet audit user lookups * chore: migrate ldap user sync paths * chore: migrate totp user updates * chore: migrate rbac user checks * chore: migrate rbac role paths * chore: migrate permission role lookups * chore: migrate rbac access list reads * chore: migrate shared rbac reads * chore: migrate rbac access writes * chore: migrate permission host access * chore: migrate role host access lookup * chore: migrate snippet access lookup * chore: migrate shared credential access lookups * chore: migrate host access cleanup writes * chore: migrate host list access checks * chore: migrate host access cleanup routes * chore: migrate shared credential role lookups * chore: migrate user role cleanup * chore: migrate admin role sync * chore: migrate ldap role sync * chore: migrate user role assignment * chore: migrate sso provider access * chore: migrate audit log access * chore: migrate user preference access * chore: migrate open tab access * chore: migrate dismissed alert access * chore: migrate homepage layout access * chore: migrate network topology access * chore: migrate dashboard service link access * chore: migrate command history access * chore: migrate recent activity cleanup * chore: migrate ssh credential usage access * chore: migrate transfer recent access * chore: migrate file manager bookmark access * chore: migrate c2s tunnel preset access * chore: migrate homepage item access * chore: migrate session recording access * chore: migrate tmux session tag access * chore: migrate opkssh token access * chore: migrate vault token access * chore: migrate vault profile access * chore: migrate host metrics preference access * chore: migrate host health access * chore: migrate host metrics history access * chore: migrate alert persistence access * chore: route alert host lookup through repository * chore: migrate user data export reads * chore: route host metrics stats sync through repository * chore: migrate host folder persistence * chore: migrate host resolution reads * chore: route jump host resolution reads * chore: route docker console jump host reads * chore: route docker ssh resolution reads * chore: route proxmox discovery resolution reads * chore: route file manager activity host reads * chore: route host metrics resolution reads * chore: route ssh auth credential reads * chore: route tunnel endpoint credential reads * chore: route credential deployment resolution reads * chore: route command history host flag reads * chore: route snippet execution resolution reads * chore: route terminal host resolution reads * chore: route vault oidc host resolution reads * chore: route wake on lan host reads * chore: route internal host list reads * chore: route host key verification persistence * chore: route credential read paths * chore: route credential host usage reads * chore: route credential folder rename * chore: route host owner access checks * chore: route shared credential source reads * chore: route user host credential cleanup * chore: route credential delete reads * chore: route credential update reads * chore: route host credential reads * chore: route host read paths * chore: route host projection reads * chore: route host list reads * chore: route snippet read paths * chore: route snippet folder writes * chore: route snippet crud paths * chore: route snippet bulk import * chore: route rbac ownership reads * chore: route user count reads * chore: route cleanup snippets folders * chore: route shared credential persistence * chore: route dashboard activity * chore: route guacamole host reads * chore: route host bulk lookups * chore: remove unlock-only simple db ops * chore: route host autostart persistence * chore: route ldap provisioning through users * chore: route credential encrypted writes * chore: route host encrypted writes * chore: route bulk host encrypted writes * chore: route termix id credentials * chore: route termix id ca persistence * chore: route termix identity persistence * chore: route credential system migration * chore: isolate user encryption migration storage * chore: remove legacy simple db ops * chore: isolate legacy sqlite migration copy * chore: route database settings import export * chore: route database host credential export * chore: route database host credential import * chore: route database file-manager import export * chore: route database alert usage import export * chore: route database user checks * chore: isolate auth lazy migration storage * chore: route explicit database saves * chore: initialize database save boundary * chore: route migration snapshot saves * chore: isolate sqlite import constraints * chore: route import sqlite boundary * chore: route user encryption migration store * chore: centralize current repository runtime * chore: route more current repositories * chore: route activity repository runtimes * chore: route token repository runtimes * chore: route health repository runtimes * chore: route identity repository runtimes * chore: route rbac repository runtime * chore: centralize current sqlite runtime access * chore: route user deletion key cleanup * chore: route user deletion vault cleanup * chore: route user deletion homepage cleanup * chore: route user deletion health cleanup * chore: route user deletion alert cleanup * chore: route user deletion identity cleanup * chore: add database layer preupgrade backup * Fix database repository type errors * fix: complete post-merge compile fixes for database refactor Restore missing DatabaseSaveTrigger/getDb imports, session log format fallback, OIDC provider resolution, guacamole recording insert, and passwordFallbackOnly typing after merging current dev. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io> * refactor(db): collapse repository rollout scaffolding into single factory Repositories are now the only data path. Replaces the 41 current-*-repository wrapper files, the DATABASE_LAYER_REPOSITORY_ROLLOUT flag/alias map and the unused database/runtime adapter with repositories/factory.ts, a plain DatabaseContext type and an in-memory TestSqliteDatabase test harness. * refactor(db): route remaining raw DB access through repositories proxmox, session-log, oidc-utils, webauthn and guacamole recording now use repositories (new WebauthnCredentialRepository; SsoProviderRepository listEnabled; HostRepository findDecryptedByIdAs/listProxmoxEnabled). Remaining raw access: db boot code, simple-db-ops and docker.ts, which are removed/restructured in later phases. * feat(crypto): add UserKeyManager with system-wrapped per-user DEKs New utils/user-keys.ts: one random 32-byte DEK per user, wrapped AES-256-GCM under an HKDF key derived from the system ENCRYPTION_KEY (per-user info string + AAD binding, versioned v3 wrap format stored in settings). Synchronous unwrap-on-demand with a 15-minute cache so the existing DataCrypto facade keeps its sync call sites. Not wired up yet. * feat(crypto): boot-time DEK migration to system-wrapped v3 format utils/crypto-migration/dek-migration.ts carries the legacy unwrap paths (PBKDF2 password KEK, OIDC/WebAuthn system keys, hardcoded-default fallback) and migrates every server-unwrappable DEK to the v3 wrap at startup. Password-wrapped DEKs migrate at next login or from a live session via adoptRecoveredDEK. Legacy rows are kept for now; cleanup flips on once the new path is authoritative. * refactor(crypto): make system-wrapped DEKs the authoritative key path DataCrypto and AuthManager now read keys through UserKeyManager: DEKs are always unwrappable server-side, so the in-memory unlock session, DEK-in-JWT wrapping, session-expiry data locks and ALLOW_APIKEY_DATA_UNLOCK are gone. utils/user-crypto.ts is deleted; boot migration now cleans legacy wraps. A one-release shim adopts DEKs from legacy dataKeyWrap tokens so active password users migrate without re-login. Password login migrates legacy password-wrapped DEKs via migratePasswordUserAtLogin. * refactor(crypto): remove pending share queue and credential sharing key With server-unwrappable DEKs both sides of a share are always available, so the needsReEncryption queue, CREDENTIAL_SHARING_KEY and the system_* shadow columns on ssh_credentials are gone. A one-time boot cleanup re-creates legacy pending share copies where possible (dropping unresolvable ones with a warning) and drops the legacy columns. * feat(auth): non-destructive password resets and admin reset endpoint Password resets no longer destroy user data: the DEK is system-wrapped, so forgot-password and admin resets are just a hash update plus session revoke. The wipe branch survives only for accounts that never logged in since the encryption upgrade and now requires explicit confirmDataWipe (surfaced as a 409 DATA_WIPE_REQUIRED; the reset UI asks for confirmation). Adds POST /users/admin/reset-password and removes the dead re-encryption paths. * refactor(ssh): consolidate four jump-host chain copies into one module terminal, host-metrics and docker now use ssh/jump-host-chain.ts (already shared by file-manager, tmux-monitor and docker-console); docker's inline copy also drops its raw SimpleDBOps host/credential lookups in favor of repositories. * refactor(ssh): single shared createConnectionLog helper file-manager-log.ts becomes ssh/connection-log.ts; the copies in docker.ts and host-metrics-helpers.ts are gone. * refactor(ssh): split docker module into layered directory ssh/docker/{index,routes,session-manager,container-routes,console}.ts: server boot and wiring in index, HTTP handlers in routes, SSH session registry and command execution in session-manager. Code motion only; port 30007/30009 and endpoints unchanged. Swagger now scans ssh subdirectories. * refactor(ssh): split tunnel module into layered directory ssh/tunnel/{index,routes,manager}.ts: server boot in index, HTTP handlers in routes, tunnel state and engine (connect/retry/autostart) in manager. Code motion only; port 30003 and endpoints unchanged. * refactor(backend): reorganize top-level layout - ssh/ renamed to hosts/ (it covers SSH, RDP, VNC, Telnet, Docker, metrics) - serial/serial.ts and guacamole/ moved inside hosts/ - dashboard.ts and homepage.ts moved to services/ - swagger.ts moved to utils/ with adjusted scan globs Import paths and the generate:openapi script updated; ports and endpoints unchanged. * refactor(tests): move backend tests into src/backend/tests mirror tree Backend *.test.ts files (and the test-support harness) no longer sit next to source files; they live under src/backend/tests/ mirroring the source layout. Imports rewritten accordingly; CLAUDE.md convention updated. * refactor(hosts): group host modules into per-feature directories file-manager/, metrics/ (incl. widgets, managers, alert-engine), terminal/, tmux/ and tunnel/ each own their files; docker/ gains container-runtime. Genuinely shared helpers (jump-host chain, host resolver, connection pool, opkssh, vault, serial) stay at hosts/ root. Pure file moves with import path updates; mirrored test paths follow. * refactor(backend): final cleanup pass - re-register WebAuthn passkey routes (registration was dropped in the #1054 merge, breaking passkey login) and document all six endpoints - delete utils/simple-db-ops.ts (last caller migrated to DataCrypto) - starter: use the typed serverReady export, collapse the four-way version lookup to env then package.json candidates - add OpenAPI JSDoc to c2s-tunnel-presets endpoints - strip block-divider comment banners * feat: remove legacy "data_unlocked" field * feat: refactor rbac/sharing to support new permissions and auth types * feat: refactor rbac/sharing to support new permissions and auth types * feat: add "id" to user profile hide list * chore: root cleanup * feat: add more donation references and a 30-day donation reminder * chore: update readme * feat: automate beta tests * feat: add links to milestones * fix: hoist github/google SSO defaults to module scope (#1065) * fix(ssh-tools): allow clipboard paste in key recording field (#1066) The broadcast key-recording input was marked readOnly, which makes browsers block paste entirely (no context-menu Paste, Ctrl+V does nothing). handleKeyDown also called preventDefault() unconditionally, swallowing the Ctrl+V shortcut before a paste event could even fire. Let Ctrl/Cmd+V pass through in handleKeyDown, drop readOnly, and add an onPaste handler that reads the clipboard text and broadcasts it to the selected terminals like any other captured keystroke. Signed-off-by: emreumar <emreumar@users.noreply.github.com> Co-authored-by: emreumar <emreumar@users.noreply.github.com> * chore: write release notes * chore: update release notes * chore: update readmes * chore: add crypto only reminder in en.json * fix: macOS and cask errors on release workflow * chore: sync Crowdin translations for 2.5.1 --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: emreumar <emreumar@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: Russell Poovey <09.our_seekers@icloud.com> Co-authored-by: russell <git@0896c69e.com> Co-authored-by: Subedi Bibek <77529535+questbibek@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Alexander Elsner <101340634+Bensonheimer992@users.noreply.github.com> Co-authored-by: SankeerthNara <sankeerthnara@gmail.com> Co-authored-by: Stephan Groth <96803994+Kalvalax@users.noreply.github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io> Co-authored-by: lhojun <ldgs3324@gmail.com> Co-authored-by: Yunus Emre Umar <77045015+emre155@users.noreply.github.com> Co-authored-by: emreumar <emreumar@users.noreply.github.com>
2026-10-29 06:35:24 +00:00 · 2026-07-19 12:29:52 -05:00
1 parent fba645e92e
commit ddbdd5c437
@@ -0,0 +1,104 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  pickResolvedUsername,
+  pickResolvedPassword,
+  expandOidcUsername,
+} from "../../hosts/credential-username.js";
+
+describe("pickResolvedUsername", () => {
+  it("keeps the host username when one is set, even with a credential username", () => {
+    expect(pickResolvedUsername("admin", "root", false)).toBe("admin");
+  });
+
+  it("falls back to the credential username when the host has none", () => {
+    expect(pickResolvedUsername("", "root", false)).toBe("root");
+    expect(pickResolvedUsername(undefined, "root", false)).toBe("root");
+    expect(pickResolvedUsername("   ", "root", false)).toBe("root");
+  });
+
+  it("treats whitespace-only host usernames as empty", () => {
+    expect(pickResolvedUsername("  ", "deploy", false)).toBe("deploy");
+  });
+
+  it("forces the host username when overrideCredentialUsername is set", () => {
+    expect(pickResolvedUsername("admin", "root", true)).toBe("admin");
+    expect(pickResolvedUsername("", "root", true)).toBeUndefined();
+  });
+
+  it("returns undefined when neither username is usable", () => {
+    expect(pickResolvedUsername("", "", false)).toBeUndefined();
+    expect(pickResolvedUsername(undefined, undefined, false)).toBeUndefined();
+  });
+});
+
+describe("pickResolvedPassword", () => {
+  it("keeps the host-specific password ahead of the credential password", () => {
+    expect(pickResolvedPassword("host-pass", "credential-pass")).toBe(
+      "host-pass",
+    );
+  });
+
+  it("falls back to the credential password when the host has none", () => {
+    expect(pickResolvedPassword("", "credential-pass")).toBe("credential-pass");
+    expect(pickResolvedPassword(undefined, "credential-pass")).toBe(
+      "credential-pass",
+    );
+  });
+
+  it("treats whitespace-only passwords as empty", () => {
+    expect(pickResolvedPassword("   ", "credential-pass")).toBe(
+      "credential-pass",
+    );
+  });
+});
+
+describe("expandOidcUsername", () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  it("returns the username unchanged when it has no placeholder", async () => {
+    expect(await expandOidcUsername("alice", "user-1")).toBe("alice");
+    expect(await expandOidcUsername(undefined, "user-1")).toBeUndefined();
+  });
+
+  it("expands the placeholder with the user's OIDC identifier", async () => {
+    vi.doMock("../../database/repositories/factory.js", () => ({
+      createCurrentUserRepository: () => ({
+        findById: async () => ({ oidcIdentifier: "jdoe" }),
+      }),
+    }));
+
+    const { expandOidcUsername: expand } =
+      await import("../../hosts/credential-username.js");
+    expect(await expand("$oidc.preferred_username", "user-1")).toBe("jdoe");
+  });
+
+  it("leaves the placeholder as-is when the user has no OIDC identifier", async () => {
+    vi.doMock("../../database/repositories/factory.js", () => ({
+      createCurrentUserRepository: () => ({
+        findById: async () => ({ oidcIdentifier: null }),
+      }),
+    }));
+
+    const { expandOidcUsername: expand } =
+      await import("../../hosts/credential-username.js");
+    expect(await expand("$oidc.preferred_username", "user-1")).toBe(
+      "$oidc.preferred_username",
+    );
+  });
+
+  it("returns the username unchanged when the DB lookup throws", async () => {
+    vi.doMock("../../database/repositories/factory.js", () => ({
+      createCurrentUserRepository: () => {
+        throw new Error("DB unavailable");
+      },
+    }));
+
+    const { expandOidcUsername: expand } =
+      await import("../../hosts/credential-username.js");
+    expect(await expand("$oidc.preferred_username", "user-1")).toBe(
+      "$oidc.preferred_username",
+    );
+  });
+});
@@ -0,0 +1,45 @@
+import { describe, expect, it } from "vitest";
+
+import { buildDeleteCommand } from "../../../hosts/file-manager/operation-commands.js";
+
+describe("buildDeleteCommand", () => {
+  it("builds a PowerShell 5.1 compatible delete command for Windows files", () => {
+    const command = buildDeleteCommand(
+      "/C:/Users/Administrator/test.txt",
+      false,
+    );
+
+    expect(command.command).toBe(
+      "Remove-Item -LiteralPath 'C:\\Users\\Administrator\\test.txt' -Force -ErrorAction Stop",
+    );
+    expect(command.commandWithSuccess).toBe(
+      `${command.command}; if ($?) { Write-Output "SUCCESS" }`,
+    );
+    expect(command.commandWithSuccess).not.toContain("&&");
+  });
+
+  it("adds recursive deletion for Windows directories", () => {
+    const command = buildDeleteCommand("C:/Temp/Folder", true);
+
+    expect(command.command).toBe(
+      "Remove-Item -LiteralPath 'C:\\Temp\\Folder' -Recurse -Force -ErrorAction Stop",
+    );
+  });
+
+  it("escapes single quotes in Windows literal paths", () => {
+    const command = buildDeleteCommand("/C:/Temp/O'Brien.txt", false);
+
+    expect(command.command).toBe(
+      "Remove-Item -LiteralPath 'C:\\Temp\\O''Brien.txt' -Force -ErrorAction Stop",
+    );
+  });
+
+  it("keeps POSIX delete commands using shell success chaining", () => {
+    const command = buildDeleteCommand("/tmp/O'Brien.txt", false);
+
+    expect(command.command).toBe("rm -f '/tmp/O'\"'\"'Brien.txt'");
+    expect(command.commandWithSuccess).toBe(
+      `${command.command} && echo "SUCCESS"`,
+    );
+  });
+});
@@ -0,0 +1,150 @@
+import { describe, it, expect } from "vitest";
+import {
+  isExecutableFile,
+  modeToPermissions,
+  formatMtime,
+  getMimeType,
+  detectBinary,
+  parseLsDateToTimestamp,
+} from "../../../hosts/file-manager/utils.js";
+
+describe("isExecutableFile", () => {
+  it("flags scripts with execute permission", () => {
+    expect(isExecutableFile("-rwxr-xr-x", "deploy.sh")).toBe(true);
+    expect(isExecutableFile("-rwxr-xr-x", "run.py")).toBe(true);
+  });
+
+  it("flags known executable extensions with execute permission", () => {
+    expect(isExecutableFile("-rwxr-xr-x", "tool.bin")).toBe(true);
+    expect(isExecutableFile("-rwxr-xr-x", "app.exe")).toBe(true);
+  });
+
+  it("flags extensionless files with execute permission", () => {
+    expect(isExecutableFile("-rwxr-xr-x", "myprogram")).toBe(true);
+  });
+
+  it("does not flag files without execute permission", () => {
+    expect(isExecutableFile("-rw-r--r--", "deploy.sh")).toBe(false);
+    expect(isExecutableFile("-rw-r--r--", "myprogram")).toBe(false);
+  });
+
+  it("does not flag non-script data files even when executable", () => {
+    expect(isExecutableFile("-rwxr-xr-x", "notes.txt")).toBe(false);
+  });
+});
+
+describe("modeToPermissions", () => {
+  it("renders a regular file with rwxr-xr-x", () => {
+    expect(modeToPermissions(0o100755)).toBe("-rwxr-xr-x");
+  });
+
+  it("renders a directory prefix", () => {
+    expect(modeToPermissions(0o040755)).toBe("drwxr-xr-x");
+  });
+
+  it("renders a symlink prefix", () => {
+    expect(modeToPermissions(0o120777)).toBe("lrwxrwxrwx");
+  });
+
+  it("renders a read-only file", () => {
+    expect(modeToPermissions(0o100444)).toBe("-r--r--r--");
+  });
+
+  it("renders no permissions", () => {
+    expect(modeToPermissions(0o100000)).toBe("----------");
+  });
+});
+
+describe("formatMtime", () => {
+  it("uses HH:MM format for recent timestamps", () => {
+    // Within the last 6 months relative to now.
+    const recent = Math.floor(Date.now() / 1000) - 60 * 60 * 24 * 5;
+    const result = formatMtime(recent);
+    expect(result).toMatch(/^[A-Z][a-z]{2} +\d{1,2} \d{2}:\d{2}$/);
+  });
+
+  it("uses the year for old timestamps", () => {
+    // ~2 years ago is comfortably outside the 6-month window.
+    const old = Math.floor(Date.now() / 1000) - 60 * 60 * 24 * 365 * 2;
+    const result = formatMtime(old);
+    expect(result).toMatch(/^[A-Z][a-z]{2} +\d{1,2} +\d{4}$/);
+  });
+});
+
+describe("getMimeType", () => {
+  it("maps known extensions", () => {
+    expect(getMimeType("readme.txt")).toBe("text/plain");
+    expect(getMimeType("data.json")).toBe("application/json");
+    expect(getMimeType("photo.JPEG")).toBe("image/jpeg");
+    expect(getMimeType("archive.zip")).toBe("application/zip");
+  });
+
+  it("falls back to octet-stream for unknown or missing extensions", () => {
+    expect(getMimeType("mystery.xyz")).toBe("application/octet-stream");
+    expect(getMimeType("noextension")).toBe("application/octet-stream");
+  });
+});
+
+describe("parseLsDateToTimestamp", () => {
+  it("parses a year-format date string", () => {
+    const ts = parseLsDateToTimestamp("Dec 12  2025");
+    const d = new Date(ts * 1000);
+    expect(d.getFullYear()).toBe(2025);
+    expect(d.getMonth()).toBe(11);
+    expect(d.getDate()).toBe(12);
+  });
+
+  it("parses a time-format date string for a recent file", () => {
+    const now = new Date();
+    const month = [
+      "Jan",
+      "Feb",
+      "Mar",
+      "Apr",
+      "May",
+      "Jun",
+      "Jul",
+      "Aug",
+      "Sep",
+      "Oct",
+      "Nov",
+      "Dec",
+    ][now.getMonth()];
+    const day = now.getDate();
+    const ts = parseLsDateToTimestamp(`${month} ${day} 10:30`);
+    const d = new Date(ts * 1000);
+    expect(d.getHours()).toBe(10);
+    expect(d.getMinutes()).toBe(30);
+  });
+
+  it("returns 0 for an empty or invalid string", () => {
+    expect(parseLsDateToTimestamp("")).toBe(0);
+    expect(parseLsDateToTimestamp("Xyz 5 12:00")).toBe(0);
+  });
+
+  it("produces ascending order for older vs newer dates", () => {
+    const older = parseLsDateToTimestamp("Jan  1  2020");
+    const newer = parseLsDateToTimestamp("Dec 31  2024");
+    expect(older).toBeLessThan(newer);
+  });
+});
+
+describe("detectBinary", () => {
+  it("returns false for empty buffers", () => {
+    expect(detectBinary(Buffer.from([]))).toBe(false);
+  });
+
+  it("returns false for plain UTF-8 text", () => {
+    expect(detectBinary(Buffer.from("hello world\nsecond line\t tab"))).toBe(
+      false,
+    );
+  });
+
+  it("returns true when null bytes are present", () => {
+    expect(detectBinary(Buffer.from([0x48, 0x00, 0x49, 0x00]))).toBe(true);
+  });
+
+  it("allows common whitespace control characters", () => {
+    expect(detectBinary(Buffer.from("line1\r\nline2\tend"))).toBe(false);
+  });
+});
@@ -0,0 +1,68 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../../../utils/logger.js", () => ({
+  guacLogger: {
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+  },
+}));
+
+const { GuacamoleTokenService } =
+  await import("../../../hosts/guacamole/token-service.js");
+
+describe("GuacamoleTokenService", () => {
+  const tokenService = GuacamoleTokenService.getInstance();
+
+  it("disables RDP pre-authentication when no credentials are configured", () => {
+    const token = tokenService.createRdpToken("windows.example.test", "", "");
+    const decrypted = tokenService.decryptToken(token);
+
+    expect(decrypted?.connection.settings).toMatchObject({
+      hostname: "windows.example.test",
+      port: 3389,
+      "ignore-cert": true,
+      "disable-auth": true,
+    });
+    expect(decrypted?.connection.settings.username).toBeUndefined();
+    expect(decrypted?.connection.settings.password).toBeUndefined();
+  });
+
+  it("keeps normal RDP credential authentication unchanged", () => {
+    const token = tokenService.createRdpToken(
+      "windows.example.test",
+      "Administrator",
+      "secret",
+    );
+    const decrypted = tokenService.decryptToken(token);
+
+    expect(decrypted?.connection.settings).toMatchObject({
+      hostname: "windows.example.test",
+      username: "Administrator",
+      password: "secret",
+      port: 3389,
+    });
+    expect(decrypted?.connection.settings["disable-auth"]).toBeUndefined();
+  });
+
+  it("preserves recording metadata outside guacd connection settings", () => {
+    const recording = {
+      hostId: 42,
+      userId: "user-1",
+      protocol: "vnc" as const,
+      path: "recording.guac",
+      startedAt: "2026-07-14T00:00:00.000Z",
+    };
+    const token = tokenService.createVncToken(
+      "vnc.example.test",
+      "user",
+      "secret",
+      {},
+      recording,
+    );
+
+    expect(tokenService.decryptToken(token)?.recording).toEqual(recording);
+  });
+});
@@ -0,0 +1,85 @@
+import { describe, it, expect } from "vitest";
+import {
+  deriveEnabledWidgets,
+  defaultLayoutFromWidgets,
+  isMetricCardId,
+  isManagerCardId,
+  METRIC_CARD_IDS,
+} from "../../../types/host-metrics.js";
+
+describe("deriveEnabledWidgets", () => {
+  it("returns only metric ids, in canonical order, deduped", () => {
+    const slots = [
+      { id: "firewall" },
+      { id: "cpu" },
+      { id: "cpu" },
+      { id: "memory" },
+    ];
+    expect(deriveEnabledWidgets(slots)).toEqual(["cpu", "memory", "firewall"]);
+  });
+
+  it("excludes manager card ids (mobile contract: never leak managers)", () => {
+    const slots = [
+      { id: "cpu" },
+      { id: "service_manager" },
+      { id: "log_viewer" },
+      { id: "disk" },
+    ];
+    const out = deriveEnabledWidgets(slots);
+    expect(out).toEqual(["cpu", "disk"]);
+    for (const id of out) expect(isMetricCardId(id)).toBe(true);
+  });
+
+  it("output is always a subset of the 10 known WidgetTypes", () => {
+    const slots = METRIC_CARD_IDS.map((id) => ({ id })).concat([
+      { id: "user_manager" } as { id: (typeof METRIC_CARD_IDS)[number] },
+      { id: "bogus" } as { id: (typeof METRIC_CARD_IDS)[number] },
+    ]);
+    const out = deriveEnabledWidgets(slots);
+    expect(out).toEqual(METRIC_CARD_IDS);
+    expect(out.length).toBe(METRIC_CARD_IDS.length);
+  });
+
+  it("empty slots -> empty widgets", () => {
+    expect(deriveEnabledWidgets([])).toEqual([]);
+  });
+});
+
+describe("defaultLayoutFromWidgets", () => {
+  it("builds slots in canonical order with dense ordering", () => {
+    const layout = defaultLayoutFromWidgets(["disk", "cpu", "memory"]);
+    expect(layout.slots.map((s) => s.id)).toEqual(["cpu", "memory", "disk"]);
+    expect(layout.slots.map((s) => s.order)).toEqual([0, 1, 2]);
+    expect(layout.columns).toBe(3);
+  });
+
+  it("ignores unknown widget ids", () => {
+    const layout = defaultLayoutFromWidgets(["cpu", "nope", "service_manager"]);
+    expect(layout.slots.map((s) => s.id)).toEqual(["cpu"]);
+  });
+
+  it("assigns valid colSpans (1..3)", () => {
+    const layout = defaultLayoutFromWidgets([...METRIC_CARD_IDS]);
+    for (const s of layout.slots) {
+      expect([1, 2, 3]).toContain(s.colSpan);
+    }
+  });
+
+  it("round-trips: deriveEnabledWidgets(defaultLayout) === input order", () => {
+    const layout = defaultLayoutFromWidgets(["ports", "cpu", "firewall"]);
+    expect(deriveEnabledWidgets(layout.slots)).toEqual([
+      "cpu",
+      "ports",
+      "firewall",
+    ]);
+  });
+});
+
+describe("card id guards", () => {
+  it("classifies metric vs manager ids", () => {
+    expect(isMetricCardId("cpu")).toBe(true);
+    expect(isMetricCardId("service_manager")).toBe(false);
+    expect(isManagerCardId("service_manager")).toBe(true);
+    expect(isManagerCardId("cpu")).toBe(false);
+  });
+});
@@ -0,0 +1,244 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const state = vi.hoisted(() => ({
+  host: null as Record<string, unknown> | null,
+  hasAccess: true,
+  isAdminBypass: false,
+  overrideCredentialId: null as number | null,
+  credentials: new Map<string, Record<string, unknown>>(),
+  sharedSecret: null as Record<string, unknown> | null,
+  auditCalls: [] as Record<string, unknown>[],
+}));
+
+vi.mock("../../database/repositories/factory.js", () => ({
+  createCurrentHostResolutionRepository: () => ({
+    findHostOwnerId: async () => (state.host?.userId as string) ?? null,
+    findHostById: async () => (state.host ? { ...state.host } : null),
+    findOverrideCredentialId: async () => state.overrideCredentialId,
+    findCredentialByIdForUser: async (credentialId: number, userId: string) =>
+      state.credentials.get(`${credentialId}:${userId}`) ?? null,
+  }),
+  createCurrentVaultProfileRepository: () => ({
+    findById: async () => null,
+  }),
+  createCurrentUserRepository: () => ({
+    findById: async (userId: string) => ({ id: userId, username: userId }),
+  }),
+}));
+
+vi.mock("../../utils/audit-logger.js", () => ({
+  logAudit: async (params: Record<string, unknown>) => {
+    state.auditCalls.push(params);
+  },
+}));
+
+vi.mock("../../utils/permission-manager.js", () => ({
+  PermissionManager: {
+    getInstance: () => ({
+      canAccessHost: async () => ({
+        hasAccess: state.hasAccess,
+        isAdminBypass: state.isAdminBypass,
+      }),
+    }),
+  },
+}));
+
+vi.mock("../../utils/shared-host-secrets-manager.js", () => ({
+  SharedHostSecretsManager: {
+    getInstance: () => ({
+      getSecretForUser: async () => state.sharedSecret,
+    }),
+  },
+}));
+
+vi.mock("../../utils/logger.js", () => ({
+  logger: {
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+  },
+}));
+
+import { resolveHostById } from "../../hosts/host-resolver.js";
+
+function baseHost(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 42,
+    userId: "owner",
+    name: "prod",
+    ip: "10.0.0.42",
+    port: 22,
+    username: "root",
+    authType: "password",
+    password: "owner-secret",
+    key: null,
+    keyPassword: null,
+    keyType: null,
+    credentialId: null,
+    vaultProfileId: null,
+    sudoPassword: "owner-sudo",
+    autostartPassword: "auto-pass",
+    autostartKey: null,
+    autostartKeyPassword: null,
+    jumpHosts: null,
+    tunnelConnections: null,
+    statsConfig: null,
+    terminalConfig: null,
+    socks5ProxyChain: null,
+    quickActions: null,
+    overrideCredentialUsername: false,
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  state.host = baseHost();
+  state.hasAccess = true;
+  state.isAdminBypass = false;
+  state.overrideCredentialId = null;
+  state.credentials.clear();
+  state.sharedSecret = null;
+  state.auditCalls = [];
+});
+
+describe("resolveHostById", () => {
+  it("returns null when access is denied", async () => {
+    state.hasAccess = false;
+    expect(await resolveHostById(42, "stranger")).toBeNull();
+  });
+
+  it("resolves the owner's credential on the owner path", async () => {
+    // Empty host username so the credential's username is used as fallback.
+    state.host = baseHost({
+      authType: "credential",
+      credentialId: 9,
+      username: "",
+    });
+    state.credentials.set("9:owner", {
+      id: 9,
+      username: "cred-user",
+      authType: "key",
+      password: null,
+      privateKey: "PRIVATE-KEY",
+      key: null,
+      keyPassword: "kp",
+      keyType: "ssh-ed25519",
+      certPublicKey: null,
+    });
+
+    const host = (await resolveHostById(42, "owner")) as Record<
+      string,
+      unknown
+    >;
+    expect(host.key).toBe("PRIVATE-KEY");
+    expect(host.username).toBe("cred-user");
+    expect(host.authType).toBe("key");
+    expect(host.sudoPassword).toBe("owner-sudo");
+  });
+
+  it("uses the share snapshot for a non-owner and strips owner-only secrets", async () => {
+    state.host = baseHost({ username: "" });
+    state.sharedSecret = {
+      username: "shared-user",
+      authType: "password",
+      password: "shared-pass",
+    };
+
+    const host = (await resolveHostById(42, "recipient")) as Record<
+      string,
+      unknown
+    >;
+    expect(host.password).toBe("shared-pass");
+    expect(host.username).toBe("shared-user");
+    expect(host.sudoPassword).toBeNull();
+    expect(host.autostartPassword).toBeNull();
+  });
+
+  it("prefers the recipient's override credential over the snapshot", async () => {
+    state.host = baseHost({ username: "" });
+    state.overrideCredentialId = 5;
+    state.credentials.set("5:recipient", {
+      id: 5,
+      username: "my-user",
+      authType: "password",
+      password: "my-pass",
+      privateKey: null,
+      key: null,
+      keyPassword: null,
+      keyType: null,
+    });
+    state.sharedSecret = {
+      username: "shared-user",
+      authType: "password",
+      password: "shared-pass",
+    };
+
+    const host = (await resolveHostById(42, "recipient")) as Record<
+      string,
+      unknown
+    >;
+    expect(host.password).toBe("my-pass");
+    expect(host.username).toBe("my-user");
+  });
+
+  it("denies a non-owner when a secret-bearing host has no snapshot", async () => {
+    expect(await resolveHostById(42, "recipient")).toBeNull();
+  });
+
+  it("lets a non-owner through on secret-less auth types without a snapshot", async () => {
+    state.host = baseHost({ authType: "none", password: null });
+    const host = await resolveHostById(42, "recipient");
+    expect(host).not.toBeNull();
+  });
+
+  it("resolves an admin bypass like the owner, keeping owner-only secrets", async () => {
+    state.isAdminBypass = true;
+    state.host = baseHost({
+      authType: "credential",
+      credentialId: 9,
+      username: "",
+      password: null,
+    });
+    state.credentials.set("9:owner", {
+      id: 9,
+      username: "cred-user",
+      authType: "key",
+      password: null,
+      privateKey: "OWNER-PRIVATE-KEY",
+      key: null,
+      keyPassword: "kp",
+      keyType: "ssh-ed25519",
+      certPublicKey: null,
+    });
+
+    const host = (await resolveHostById(42, "adminUser")) as Record<
+      string,
+      unknown
+    >;
+    // Owner credential resolved (not the share snapshot path).
+    expect(host.key).toBe("OWNER-PRIVATE-KEY");
+    expect(host.username).toBe("cred-user");
+    // Owner-only operational secrets are NOT stripped for the admin.
+    expect(host.sudoPassword).toBe("owner-sudo");
+    expect(host.autostartPassword).toBe("auto-pass");
+  });
+
+  it("audits every admin-bypass host resolution", async () => {
+    state.isAdminBypass = true;
+    await resolveHostById(42, "adminUser");
+    expect(state.auditCalls).toHaveLength(1);
+    expect(state.auditCalls[0]).toMatchObject({
+      action: "admin_connect_host",
+      resourceType: "host",
+      resourceId: "42",
+      userId: "adminUser",
+    });
+  });
+
+  it("does not audit an ordinary owner resolution", async () => {
+    await resolveHostById(42, "owner");
+    expect(state.auditCalls).toHaveLength(0);
+  });
+});
@@ -0,0 +1,440 @@
+import { describe, it, expect } from "vitest";
+import {
+  buildSudoCommand,
+  shellSingleQuote,
+} from "../../../hosts/metrics/managers/exec-elevated.js";
+import { parsePlatformProbe } from "../../../hosts/metrics/managers/platform.js";
+import {
+  isValidSystemdUnit,
+  isValidPid,
+  isValidPort,
+  isValidPackageName,
+  isValidUsername,
+  isValidDomain,
+  isValidDnsProvider,
+  isValidSignal,
+  isValidServiceAction,
+  isAllowedPath,
+} from "../../../hosts/metrics/managers/validation.js";
+import {
+  parseServiceList,
+  buildServiceActionCommand,
+} from "../../../hosts/metrics/managers/services.js";
+import {
+  parseProcessList,
+  buildKillCommand,
+} from "../../../hosts/metrics/managers/processes.js";
+import {
+  parseDfMounts,
+  parseTopMemory,
+} from "../../../hosts/metrics/managers/simple-reads.js";
+import {
+  parseCrontab,
+  serializeCrontab,
+  isValidCronSchedule,
+  buildApplyCrontabCommand,
+} from "../../../hosts/metrics/managers/cron.js";
+import {
+  buildPackageActionCommand,
+  parseUpgradable,
+  buildListUpgradableCommand,
+} from "../../../hosts/metrics/managers/packages.js";
+import {
+  buildIssueCommand,
+  buildRenewCommand,
+  buildRevokeCommand,
+  isValidCertName,
+  parseCertbotCertificates,
+} from "../../../hosts/metrics/managers/ssl.js";
+import {
+  buildIptablesRuleCommand,
+  buildNftRuleCommand,
+} from "../../../hosts/metrics/managers/firewall.js";
+import {
+  parsePasswd,
+  parseSudoers,
+} from "../../../hosts/metrics/managers/users.js";
+import {
+  buildHealthCheckCommand,
+  parseHealthResult,
+} from "../../../hosts/metrics/managers/health.js";
+import {
+  buildTailCommand,
+  clampLines,
+} from "../../../hosts/metrics/managers/logs.js";
+
+describe("exec-elevated", () => {
+  it("single-quotes and escapes for the shell", () => {
+    expect(shellSingleQuote("abc")).toBe("'abc'");
+    expect(shellSingleQuote("a'b")).toBe(`'a'"'"'b'`);
+  });
+  it("builds the sudo -S pipeline wrapping the command in sh -c with a success marker", () => {
+    expect(buildSudoCommand("systemctl restart nginx", "pw")).toBe(
+      `echo 'pw' | sudo -S -p '' sh -c 'echo __TX_SUDO_OK__; systemctl restart nginx'`,
+    );
+  });
+  it("does not merge stderr into stdout (no 2>&1)", () => {
+    expect(buildSudoCommand("id", "pw")).not.toContain("2>&1");
+  });
+  it("escapes a password containing a quote", () => {
+    expect(buildSudoCommand("id", "p'w")).toContain(`echo 'p'"'"'w'`);
+  });
+});
+
+describe("platform probe parsing", () => {
+  it("parses capabilities and prefers dnf over yum", () => {
+    const out = [
+      "systemd=1",
+      "apt=0",
+      "dnf=1",
+      "yum=1",
+      "pacman=0",
+      "certbot=1",
+      "acmesh=0",
+      "docker=1",
+      "os=Fedora Linux 40",
+    ].join("\n");
+    const p = parsePlatformProbe(out);
+    expect(p.hasSystemd).toBe(true);
+    expect(p.pkg).toBe("dnf");
+    expect(p.hasCertbot).toBe(true);
+    expect(p.hasAcmeSh).toBe(false);
+    expect(p.hasDocker).toBe(true);
+    expect(p.osPrettyName).toBe("Fedora Linux 40");
+  });
+  it("picks apt when present", () => {
+    expect(parsePlatformProbe("apt=1\ndnf=1").pkg).toBe("apt");
+  });
+});
+
+describe("validation (injection defense)", () => {
+  it("systemd units", () => {
+    expect(isValidSystemdUnit("nginx.service")).toBe(true);
+    expect(isValidSystemdUnit("ssh.socket")).toBe(true);
+    expect(isValidSystemdUnit("nginx.service; rm -rf /")).toBe(false);
+    expect(isValidSystemdUnit("nginx")).toBe(false);
+  });
+  it("pids", () => {
+    expect(isValidPid(123)).toBe(true);
+    expect(isValidPid("123")).toBe(true);
+    expect(isValidPid(0)).toBe(false);
+    expect(isValidPid("1; reboot")).toBe(false);
+    expect(isValidPid(-5)).toBe(false);
+  });
+  it("ports", () => {
+    expect(isValidPort(443)).toBe(true);
+    expect(isValidPort(0)).toBe(false);
+    expect(isValidPort(70000)).toBe(false);
+  });
+  it("package names", () => {
+    expect(isValidPackageName("nginx")).toBe(true);
+    expect(isValidPackageName("lib-foo.bar+1")).toBe(true);
+    expect(isValidPackageName("nginx && curl evil")).toBe(false);
+    expect(isValidPackageName("-rf")).toBe(false);
+  });
+  it("usernames and domains", () => {
+    expect(isValidUsername("deploy")).toBe(true);
+    expect(isValidUsername("root; rm")).toBe(false);
+    expect(isValidDomain("example.com")).toBe(true);
+    expect(isValidDomain("*.example.com")).toBe(true);
+    expect(isValidDomain("ex ample.com")).toBe(false);
+    expect(isValidDomain("a;b.com")).toBe(false);
+  });
+  it("dns providers, signals, service actions", () => {
+    expect(isValidDnsProvider("cloudflare")).toBe(true);
+    expect(isValidDnsProvider("cf; rm")).toBe(false);
+    expect(isValidSignal("KILL")).toBe(true);
+    expect(isValidSignal("BOOM")).toBe(false);
+    expect(isValidServiceAction("restart")).toBe(true);
+    expect(isValidServiceAction("destroy")).toBe(false);
+  });
+  it("path allowlist rejects traversal and out-of-allowlist", () => {
+    expect(isAllowedPath("/var/log/syslog", ["/var/log"])).toBe(true);
+    expect(isAllowedPath("/var/log/../../etc/passwd", ["/var/log"])).toBe(
+      false,
+    );
+    expect(isAllowedPath("/etc/passwd", ["/var/log"])).toBe(false);
+    expect(isAllowedPath("relative/path", ["/var/log"])).toBe(false);
+  });
+});
+
+describe("services", () => {
+  it("parses list-units --plain", () => {
+    const out =
+      "nginx.service loaded active running A high performance web server\n" +
+      "ssh.service loaded active running OpenBSD Secure Shell server\n" +
+      "cron.service loaded inactive dead Regular background program";
+    const rows = parseServiceList(out);
+    expect(rows).toHaveLength(3);
+    expect(rows[0]).toMatchObject({ unit: "nginx.service", active: "active" });
+    expect(rows[2].active).toBe("inactive");
+  });
+  it("builds action command", () => {
+    expect(buildServiceActionCommand("nginx.service", "restart")).toBe(
+      "systemctl restart nginx.service",
+    );
+  });
+});
+
+describe("processes", () => {
+  it("parses ps output", () => {
+    const out =
+      "1234 1 root 12.5 3.2 45000 S /usr/bin/node node server.js\n" +
+      "5678 1234 deploy 0.0 1.1 12000 Sl bash -bash";
+    const rows = parseProcessList(out);
+    expect(rows[0]).toMatchObject({
+      pid: 1234,
+      user: "root",
+      cpu: 12.5,
+      command: "/usr/bin/node",
+    });
+    expect(rows[1].pid).toBe(5678);
+  });
+  it("builds kill command", () => {
+    expect(buildKillCommand(42, "TERM")).toBe("kill -TERM 42");
+  });
+});
+
+describe("simple reads", () => {
+  it("parses df -Pk and skips tmpfs", () => {
+    const out =
+      "/dev/sda1 100000 40000 60000 40% /\n" +
+      "tmpfs 8000 0 8000 0% /dev/shm\n" +
+      "/dev/sdb1 200000 100000 100000 50% /data";
+    const mounts = parseDfMounts(out);
+    expect(mounts).toHaveLength(2);
+    expect(mounts[0].mount).toBe("/");
+    expect(mounts[1].usePct).toBe(50);
+  });
+  it("parses top by memory", () => {
+    const rows = parseTopMemory("1234 root 5.5 50000 node");
+    expect(rows[0]).toMatchObject({ pid: 1234, mem: 5.5, command: "node" });
+  });
+});
+
+describe("cron", () => {
+  it("parses enabled and toggled entries", () => {
+    const out = "0 2 * * * /backup.sh\n# 30 4 * * * /old.sh\nPATH=/usr/bin";
+    const entries = parseCrontab(out);
+    expect(entries).toHaveLength(2);
+    expect(entries[0]).toMatchObject({ enabled: true, schedule: "0 2 * * *" });
+    expect(entries[1].enabled).toBe(false);
+  });
+  it("validates schedules", () => {
+    expect(isValidCronSchedule("0 2 * * *")).toBe(true);
+    expect(isValidCronSchedule("@daily")).toBe(true);
+    expect(isValidCronSchedule("not a schedule")).toBe(false);
+  });
+  it("serializes (commenting disabled entries) and round-trips", () => {
+    const body = serializeCrontab([
+      { raw: "", enabled: true, schedule: "0 2 * * *", command: "/a.sh" },
+      { raw: "", enabled: false, schedule: "@daily", command: "/b.sh" },
+    ]);
+    expect(body).toBe("0 2 * * * /a.sh\n# @daily /b.sh\n");
+    const reparsed = parseCrontab(body);
+    expect(reparsed[0].enabled).toBe(true);
+    expect(reparsed[1].enabled).toBe(false);
+  });
+  it("builds apply command piping into crontab -", () => {
+    expect(buildApplyCrontabCommand("x\n")).toBe(
+      `printf '%s' 'x\n' | crontab -`,
+    );
+  });
+});
+
+describe("packages", () => {
+  it("builds per-distro commands", () => {
+    expect(buildPackageActionCommand("apt", "install", "nginx")).toContain(
+      "apt-get -y install nginx",
+    );
+    expect(buildPackageActionCommand("pacman", "upgrade-all")).toBe(
+      "pacman -Syu --noconfirm",
+    );
+    expect(buildPackageActionCommand(null, "install", "x")).toBeNull();
+  });
+  it("lists per distro", () => {
+    expect(buildListUpgradableCommand("apt")).toContain(
+      "apt list --upgradable",
+    );
+    expect(buildListUpgradableCommand(null)).toBeNull();
+  });
+  it("parses apt upgradable", () => {
+    const out =
+      "nginx/focal-updates 1.18.0-2 amd64 [upgradable from: 1.18.0-1]";
+    const pkgs = parseUpgradable("apt", out);
+    expect(pkgs[0]).toMatchObject({
+      name: "nginx",
+      newVersion: "1.18.0-2",
+      currentVersion: "1.18.0-1",
+    });
+  });
+  it("parses pacman upgradable", () => {
+    const pkgs = parseUpgradable("pacman", "linux 6.1 -> 6.2");
+    expect(pkgs[0]).toMatchObject({ name: "linux", newVersion: "6.2" });
+  });
+});
+
+describe("ssl (dual client)", () => {
+  it("builds certbot issue for http + dns", () => {
+    expect(
+      buildIssueCommand({
+        client: "certbot",
+        domains: ["a.com"],
+        challenge: "http-standalone",
+      }),
+    ).toContain(
+      "certbot certonly --non-interactive --agree-tos --standalone -d 'a.com'",
+    );
+    expect(
+      buildIssueCommand({
+        client: "certbot",
+        domains: ["a.com"],
+        challenge: "dns",
+        dnsProvider: "cloudflare",
+      }),
+    ).toContain("--dns-cloudflare");
+  });
+  it("builds acme.sh issue", () => {
+    const cmd = buildIssueCommand({
+      client: "acme.sh",
+      domains: ["a.com", "b.com"],
+      challenge: "dns",
+      dnsProvider: "cf",
+    });
+    expect(cmd).toContain("--issue --dns dns_cf");
+    expect(cmd).toContain("-d 'a.com'");
+    expect(cmd).toContain("-d 'b.com'");
+  });
+  it("builds renew per client", () => {
+    expect(buildRenewCommand("certbot", true)).toBe("certbot renew --dry-run");
+    expect(buildRenewCommand("acme.sh", false)).toContain("--renew-all");
+  });
+  it("builds revoke per client", () => {
+    expect(buildRevokeCommand("certbot", "example.com")).toBe(
+      "certbot revoke --non-interactive --cert-name 'example.com' --delete-after-revoke",
+    );
+    const acme = buildRevokeCommand("acme.sh", "example.com");
+    expect(acme).toContain("--revoke -d 'example.com'");
+    expect(acme).toContain("--remove -d 'example.com'");
+  });
+  it("validates certificate names (rejects shell metachars)", () => {
+    expect(isValidCertName("example.com")).toBe(true);
+    expect(isValidCertName("example.com-0001")).toBe(true);
+    expect(isValidCertName("*.example.com")).toBe(true);
+    expect(isValidCertName("a.com; rm -rf /")).toBe(false);
+    expect(isValidCertName("")).toBe(false);
+    expect(isValidCertName(undefined)).toBe(false);
+  });
+  it("parses certbot certificates", () => {
+    const out = [
+      "Found the following certs:",
+      "  Certificate Name: example.com",
+      "    Domains: example.com www.example.com",
+      "    Expiry Date: 2026-09-01 12:00:00+00:00 (VALID: 80 days)",
+      "    Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem",
+    ].join("\n");
+    const certs = parseCertbotCertificates(out);
+    expect(certs[0]).toMatchObject({
+      name: "example.com",
+      client: "certbot",
+    });
+    expect(certs[0].domains).toContain("www.example.com");
+  });
+});
+
+describe("firewall", () => {
+  it("builds iptables add/delete on INPUT only", () => {
+    expect(
+      buildIptablesRuleCommand("add", {
+        protocol: "tcp",
+        port: 443,
+        target: "ACCEPT",
+      }),
+    ).toBe("iptables -A INPUT -p tcp --dport 443 -j ACCEPT");
+    expect(
+      buildIptablesRuleCommand("delete", {
+        protocol: "udp",
+        port: 53,
+        target: "DROP",
+      }),
+    ).toBe("iptables -D INPUT -p udp --dport 53 -j DROP");
+  });
+  it("builds nft rules", () => {
+    expect(
+      buildNftRuleCommand("add", {
+        protocol: "tcp",
+        port: 22,
+        target: "ACCEPT",
+      }),
+    ).toContain("add rule inet filter input tcp dport 22 accept");
+  });
+});
+
+describe("users", () => {
+  it("parses passwd for human users only", () => {
+    const out =
+      "root:x:0:0:root:/root:/bin/bash\n" +
+      "deploy:x:1000:1000:Deploy:/home/deploy:/bin/bash\n" +
+      "nobody:x:65534:65534:nobody:/:/usr/sbin/nologin";
+    const users = parsePasswd(out);
+    expect(users).toHaveLength(1);
+    expect(users[0].name).toBe("deploy");
+  });
+  it("parses sudoers membership", () => {
+    const out = "sudo:x:27:deploy,alice\nwheel:x:10:bob";
+    expect(parseSudoers(out).sort()).toEqual(["alice", "bob", "deploy"]);
+  });
+});
+
+describe("health checks", () => {
+  it("builds tcp and http commands", () => {
+    const tcp = buildHealthCheckCommand({
+      id: "1",
+      name: "ssh",
+      type: "tcp",
+      target: "localhost",
+      port: 22,
+    });
+    expect(tcp).toContain("/dev/tcp/");
+    const http = buildHealthCheckCommand({
+      id: "2",
+      name: "web",
+      type: "http",
+      target: "example.com",
+      path: "/health",
+    });
+    expect(http).toContain("curl -s -o /dev/null");
+    expect(http).toContain("http://example.com/health");
+  });
+  it("parses tcp and http results", () => {
+    const tcp = parseHealthResult(
+      { id: "1", name: "ssh", type: "tcp", target: "h", port: 22 },
+      "ok 12",
+    );
+    expect(tcp).toMatchObject({ ok: true, latencyMs: 12 });
+    const http = parseHealthResult(
+      { id: "2", name: "web", type: "http", target: "h" },
+      "200 0.045",
+    );
+    expect(http).toMatchObject({ ok: true, latencyMs: 45 });
+    const bad = parseHealthResult(
+      { id: "3", name: "web", type: "http", target: "h" },
+      "500 0.01",
+    );
+    expect(bad.ok).toBe(false);
+  });
+});
+
+describe("logs", () => {
+  it("clamps line counts", () => {
+    expect(clampLines(50)).toBe(50);
+    expect(clampLines(99999)).toBe(2000);
+    expect(clampLines("abc")).toBe(200);
+    expect(clampLines(0)).toBe(1);
+  });
+  it("builds a quoted tail command without suppressing stderr", () => {
+    expect(buildTailCommand("/var/log/syslog", 100)).toBe(
+      "tail -n 100 '/var/log/syslog'",
+    );
+  });
+});
@@ -0,0 +1,124 @@
+import type { Client } from "ssh2";
+import { describe, it, expect, vi } from "vitest";
+import {
+  supportsMetrics,
+  isTcpPingEnabled,
+  tcpPingThroughJumpHost,
+} from "../../../hosts/metrics/helpers.js";
+import { createConnectionLog } from "../../../hosts/connection-log.js";
+
+describe("supportsMetrics", () => {
+  it("supports plain ssh hosts", () => {
+    expect(
+      supportsMetrics({ connectionType: "ssh", authType: "password" }),
+    ).toBe(true);
+  });
+
+  it("defaults missing connectionType to ssh", () => {
+    expect(supportsMetrics({ authType: "key" })).toBe(true);
+  });
+
+  it("rejects non-ssh connection types", () => {
+    expect(supportsMetrics({ connectionType: "rdp" })).toBe(false);
+    expect(supportsMetrics({ connectionType: "vnc" })).toBe(false);
+    expect(supportsMetrics({ connectionType: "telnet" })).toBe(false);
+  });
+
+  it("rejects ssh hosts that cannot run shell commands", () => {
+    expect(supportsMetrics({ connectionType: "ssh", authType: "none" })).toBe(
+      false,
+    );
+    expect(supportsMetrics({ connectionType: "ssh", authType: "opkssh" })).toBe(
+      false,
+    );
+  });
+});
+
+describe("isTcpPingEnabled", () => {
+  it("is enabled when status checks are on and tcp ping is not disabled", () => {
+    expect(
+      isTcpPingEnabled({ statusCheckEnabled: true, disableTcpPing: false }),
+    ).toBe(true);
+    expect(isTcpPingEnabled({ statusCheckEnabled: true })).toBe(true);
+  });
+
+  it("is disabled when status checks are off", () => {
+    expect(isTcpPingEnabled({ statusCheckEnabled: false })).toBe(false);
+  });
+
+  it("is disabled when tcp ping is explicitly disabled", () => {
+    expect(
+      isTcpPingEnabled({ statusCheckEnabled: true, disableTcpPing: true }),
+    ).toBe(false);
+  });
+});
+
+describe("createConnectionLog", () => {
+  it("builds a log entry without id/timestamp", () => {
+    const entry = createConnectionLog("info", "connection", "Connecting", {
+      hostId: 1,
+    });
+    expect(entry).toEqual({
+      type: "info",
+      stage: "connection",
+      message: "Connecting",
+      details: { hostId: 1 },
+    });
+    expect("id" in entry).toBe(false);
+    expect("timestamp" in entry).toBe(false);
+  });
+});
+
+describe("tcpPingThroughJumpHost", () => {
+  it("reports the final destination online when forwarding succeeds", async () => {
+    const stream = { destroy: vi.fn() };
+    const jumpClient = {
+      end: vi.fn(),
+      forwardOut: vi.fn((_src, _srcPort, host, port, callback) => {
+        expect(host).toBe("private.example");
+        expect(port).toBe(22);
+        callback(undefined, stream);
+      }),
+    } as unknown as Pick<Client, "forwardOut" | "end">;
+
+    await expect(
+      tcpPingThroughJumpHost(jumpClient, "private.example", 22),
+    ).resolves.toBe(true);
+    expect(stream.destroy).toHaveBeenCalledOnce();
+    expect(jumpClient.end).toHaveBeenCalledOnce();
+  });
+
+  it("reports the final destination offline when forwarding fails", async () => {
+    const jumpClient = {
+      end: vi.fn(),
+      forwardOut: vi.fn((_src, _srcPort, _host, _port, callback) => {
+        callback(new Error("Connection refused"));
+      }),
+    } as unknown as Pick<Client, "forwardOut" | "end">;
+
+    await expect(
+      tcpPingThroughJumpHost(jumpClient, "private.example", 22),
+    ).resolves.toBe(false);
+    expect(jumpClient.end).toHaveBeenCalledOnce();
+  });
+
+  it("reports the final destination offline when forwarding times out", async () => {
+    vi.useFakeTimers();
+    const jumpClient = {
+      end: vi.fn(),
+      forwardOut: vi.fn(),
+    } as unknown as Pick<Client, "forwardOut" | "end">;
+
+    const result = tcpPingThroughJumpHost(
+      jumpClient,
+      "private.example",
+      22,
+      5000,
+    );
+    await vi.advanceTimersByTimeAsync(5000);
+
+    await expect(result).resolves.toBe(false);
+    expect(jumpClient.end).toHaveBeenCalledOnce();
+    vi.useRealTimers();
+  });
+});
@@ -0,0 +1,111 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const execCommand = vi.fn();
+vi.mock("../../../../hosts/metrics/widgets/common-utils.js", () => ({
+  execCommand: (...args: unknown[]) => execCommand(...args),
+}));
+
+import {
+  execElevated,
+  ElevationError,
+} from "../../../../hosts/metrics/managers/exec-elevated.js";
+import type { Client } from "ssh2";
+
+const fakeClient = {} as Client;
+
+function result(stdout: string, stderr = "", code: number | null = 0) {
+  return { stdout, stderr, code };
+}
+
+beforeEach(() => {
+  execCommand.mockReset();
+});
+
+describe("execElevated (no force)", () => {
+  it("returns the direct result when the command succeeds unprivileged", async () => {
+    execCommand.mockResolvedValueOnce(result("hello", "", 0));
+    const r = await execElevated(fakeClient, "echo hello", "pw");
+    expect(r.usedSudo).toBe(false);
+    expect(r.stdout).toBe("hello");
+    expect(execCommand).toHaveBeenCalledTimes(1);
+  });
+
+  it("does NOT escalate when stdout merely contains scary words", async () => {
+    // A non-zero exit whose OUTPUT contains 'permission denied' but stderr does
+    // not should be surfaced as-is, never retried under sudo.
+    execCommand.mockResolvedValueOnce(
+      result("log line: permission denied for user foo", "", 1),
+    );
+    const r = await execElevated(fakeClient, "grep denied /tmp/app.log", "pw");
+    expect(r.usedSudo).toBe(false);
+    expect(execCommand).toHaveBeenCalledTimes(1);
+  });
+
+  it("escalates when stderr indicates a permission problem", async () => {
+    execCommand
+      .mockResolvedValueOnce(result("", "Permission denied", 1))
+      .mockResolvedValueOnce(result("__TX_SUDO_OK__\nelevated output", "", 0));
+    const r = await execElevated(fakeClient, "cat /etc/shadow", "pw");
+    expect(r.usedSudo).toBe(true);
+    expect(r.stdout).toBe("elevated output");
+    expect(execCommand).toHaveBeenCalledTimes(2);
+  });
+
+  it("throws SUDO_REQUIRED when elevation is needed but no password is set", async () => {
+    execCommand.mockResolvedValueOnce(result("", "Permission denied", 1));
+    await expect(
+      execElevated(fakeClient, "cat /etc/shadow", undefined),
+    ).rejects.toMatchObject({ code: "SUDO_REQUIRED" });
+  });
+});
+
+describe("execElevated (forced)", () => {
+  it("strips the success marker from stdout", async () => {
+    execCommand.mockResolvedValueOnce(
+      result("__TX_SUDO_OK__\nthe real output\n", "", 0),
+    );
+    const r = await execElevated(fakeClient, "id", "pw", { forceSudo: true });
+    expect(r.stdout).toBe("the real output\n");
+    expect(r.usedSudo).toBe(true);
+  });
+
+  it("does NOT throw when command output contains 'incorrect password' but sudo authenticated", async () => {
+    execCommand.mockResolvedValueOnce(
+      result(
+        "__TX_SUDO_OK__\nUser entered an incorrect password earlier",
+        "",
+        0,
+      ),
+    );
+    const r = await execElevated(fakeClient, "tail /var/log/auth.log", "pw", {
+      forceSudo: true,
+    });
+    expect(r.usedSudo).toBe(true);
+    expect(r.stdout).toContain("incorrect password");
+  });
+
+  it("throws SUDO_FAILED on a real wrong-password (no marker, sudo stderr)", async () => {
+    execCommand.mockResolvedValueOnce(
+      result("", "sudo: 1 incorrect password attempt", 1),
+    );
+    await expect(
+      execElevated(fakeClient, "id", "wrong", { forceSudo: true }),
+    ).rejects.toMatchObject({ code: "SUDO_FAILED" });
+  });
+
+  it("throws NOT_SUDOER when the user is not in sudoers", async () => {
+    execCommand.mockResolvedValueOnce(
+      result("", "deploy is not in the sudoers file.", 1),
+    );
+    await expect(
+      execElevated(fakeClient, "id", "pw", { forceSudo: true }),
+    ).rejects.toMatchObject({ code: "NOT_SUDOER" });
+  });
+
+  it("throws SUDO_REQUIRED when forced without a password", async () => {
+    await expect(
+      execElevated(fakeClient, "id", undefined, { forceSudo: true }),
+    ).rejects.toBeInstanceOf(ElevationError);
+    expect(execCommand).not.toHaveBeenCalled();
+  });
+});
@@ -0,0 +1,84 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  ConcurrentLimiter,
+  HostPollCache,
+} from "../../../hosts/metrics/state.js";
+
+describe("ConcurrentLimiter", () => {
+  it("never exceeds max concurrent runners", async () => {
+    const limiter = new ConcurrentLimiter(2);
+    let peak = 0;
+    let current = 0;
+
+    const job = async () => {
+      current += 1;
+      peak = Math.max(peak, current);
+      await new Promise((r) => setTimeout(r, 30));
+      current -= 1;
+    };
+
+    await Promise.all([
+      limiter.run(job),
+      limiter.run(job),
+      limiter.run(job),
+      limiter.run(job),
+    ]);
+
+    expect(peak).toBeLessThanOrEqual(2);
+    expect(limiter.activeCount).toBe(0);
+    expect(limiter.pendingCount).toBe(0);
+  });
+
+  it("runs waiters in FIFO order after a slot frees", async () => {
+    const limiter = new ConcurrentLimiter(1);
+    const order: number[] = [];
+
+    const first = limiter.run(async () => {
+      order.push(1);
+      await new Promise((r) => setTimeout(r, 20));
+    });
+    const second = limiter.run(async () => {
+      order.push(2);
+    });
+    const third = limiter.run(async () => {
+      order.push(3);
+    });
+
+    await Promise.all([first, second, third]);
+    expect(order).toEqual([1, 2, 3]);
+  });
+
+  it("rejects invalid maxConcurrent", () => {
+    expect(() => new ConcurrentLimiter(0)).toThrow(/maxConcurrent/);
+  });
+});
+
+describe("HostPollCache", () => {
+  it("returns cached host within TTL for the same user", () => {
+    const cache = new HostPollCache<{ id: number; name: string }>(60_000);
+    cache.set(1, "user-a", { id: 1, name: "alpha" });
+    expect(cache.get(1, "user-a")).toEqual({ id: 1, name: "alpha" });
+    expect(cache.get(1, "user-b")).toBeNull();
+  });
+
+  it("expires entries after TTL", () => {
+    vi.useFakeTimers();
+    const cache = new HostPollCache<{ id: number }>(1_000);
+    cache.set(7, "u", { id: 7 });
+    expect(cache.get(7, "u")).toEqual({ id: 7 });
+    vi.advanceTimersByTime(1_001);
+    expect(cache.get(7, "u")).toBeNull();
+    vi.useRealTimers();
+  });
+
+  it("invalidate drops a host or the whole cache", () => {
+    const cache = new HostPollCache<{ id: number }>(60_000);
+    cache.set(1, "u", { id: 1 });
+    cache.set(2, "u", { id: 2 });
+    cache.invalidate(1);
+    expect(cache.get(1, "u")).toBeNull();
+    expect(cache.get(2, "u")).toEqual({ id: 2 });
+    cache.invalidate();
+    expect(cache.get(2, "u")).toBeNull();
+  });
+});
@@ -0,0 +1,32 @@
+import { describe, it, expect } from "vitest";
+import {
+  toFixedNum,
+  kibToGiB,
+} from "../../../../hosts/metrics/widgets/common-utils.js";
+
+describe("toFixedNum", () => {
+  it("rounds to the requested digit count", () => {
+    expect(toFixedNum(3.14159, 2)).toBe(3.14);
+    expect(toFixedNum(3.14159, 0)).toBe(3);
+    expect(toFixedNum(2.5, 0)).toBe(3);
+  });
+
+  it("defaults to 2 digits", () => {
+    expect(toFixedNum(1.23456)).toBe(1.23);
+  });
+
+  it("returns null for non-finite or non-number input", () => {
+    expect(toFixedNum(null)).toBeNull();
+    expect(toFixedNum(undefined)).toBeNull();
+    expect(toFixedNum(NaN)).toBeNull();
+    expect(toFixedNum(Infinity)).toBeNull();
+  });
+});
+
+describe("kibToGiB", () => {
+  it("converts kibibytes to gibibytes", () => {
+    expect(kibToGiB(1024 * 1024)).toBe(1);
+    expect(kibToGiB(0)).toBe(0);
+    expect(kibToGiB(2 * 1024 * 1024)).toBe(2);
+  });
+});
@@ -0,0 +1,29 @@
+import { describe, it, expect } from "vitest";
+import { parseCpuLine } from "../../../../hosts/metrics/widgets/cpu-collector.js";
+
+describe("parseCpuLine", () => {
+  it("parses a standard /proc/stat cpu line", () => {
+    // user nice system idle iowait irq softirq
+    const result = parseCpuLine("cpu  100 0 50 800 30 0 20");
+    expect(result).toBeDefined();
+    // idle = idle(800) + iowait(30)
+    expect(result?.idle).toBe(830);
+    // total = sum of all fields
+    expect(result?.total).toBe(100 + 0 + 50 + 800 + 30 + 0 + 20);
+  });
+
+  it("tolerates leading/trailing whitespace", () => {
+    const result = parseCpuLine("  cpu 1 2 3 4  ");
+    expect(result?.total).toBe(10);
+    expect(result?.idle).toBe(4);
+  });
+
+  it("returns undefined for non-cpu lines", () => {
+    expect(parseCpuLine("cpu0 1 2 3 4")).toBeUndefined();
+    expect(parseCpuLine("intr 12345")).toBeUndefined();
+  });
+
+  it("returns undefined when there are fewer than 4 numeric fields", () => {
+    expect(parseCpuLine("cpu 1 2 3")).toBeUndefined();
+  });
+});
@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import {
+  parseSensorsOutput,
+  parseSysfsThermalOutput,
+} from "../../../../hosts/metrics/widgets/temperature-collector.js";
+
+describe("temperature collectors", () => {
+  it("parses sysfs thermal zone output", () => {
+    const result = parseSysfsThermalOutput(
+      "x86_pkg_temp\t51000\nacpitz\t42\nbad\tnope\n",
+    );
+
+    expect(result).toEqual([
+      { label: "x86_pkg_temp", celsius: 51 },
+      { label: "acpitz", celsius: 42 },
+    ]);
+  });
+
+  it("parses lm-sensors temperature lines", () => {
+    const result = parseSensorsOutput(`
+coretemp-isa-0000
+Adapter: ISA adapter
+Package id 0:  +52.0°C  (high = +80.0°C, crit = +100.0°C)
+Core 0:        +48.5°C
+fan1:          1200 RPM
+`);
+
+    expect(result).toEqual([
+      { label: "Package id 0", celsius: 52 },
+      { label: "Core 0", celsius: 48.5 },
+    ]);
+  });
+});
@@ -0,0 +1,79 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  isRetriableDnsError,
+  resolveHostForSshConnect,
+  resolveSshConnectConfigHost,
+  shouldResolveBeforeSshConnect,
+} from "../../hosts/ssh-dns.js";
+
+describe("SSH DNS resolution", () => {
+  it("retries transient EAI_AGAIN errors before returning an address", async () => {
+    const lookup = vi
+      .fn()
+      .mockRejectedValueOnce(
+        Object.assign(new Error("try again"), { code: "EAI_AGAIN" }),
+      )
+      .mockResolvedValueOnce({ address: "10.0.0.5", family: 4 });
+    const wait = vi.fn().mockResolvedValue(undefined);
+
+    await expect(
+      resolveHostForSshConnect("alp", lookup, [10], wait),
+    ).resolves.toEqual({
+      host: "10.0.0.5",
+      resolvedAddress: "10.0.0.5",
+      attempts: 2,
+    });
+    expect(wait).toHaveBeenCalledWith(10);
+  });
+
+  it("does not retry permanent DNS failures", async () => {
+    const error = Object.assign(new Error("not found"), { code: "ENOTFOUND" });
+    const lookup = vi.fn().mockRejectedValue(error);
+    const wait = vi.fn().mockResolvedValue(undefined);
+
+    await expect(
+      resolveHostForSshConnect("missing", lookup, [10], wait),
+    ).rejects.toBe(error);
+    expect(wait).not.toHaveBeenCalled();
+  });
+
+  it("skips DNS lookup for literal IP addresses", async () => {
+    const lookup = vi.fn();
+
+    await expect(
+      resolveHostForSshConnect("192.0.2.1", lookup),
+    ).resolves.toEqual({
+      host: "192.0.2.1",
+      attempts: 0,
+    });
+    expect(lookup).not.toHaveBeenCalled();
+  });
+
+  it("detects retryable DNS errors by code or message", () => {
+    expect(isRetriableDnsError({ code: "EAI_AGAIN" })).toBe(true);
+    expect(isRetriableDnsError(new Error("getaddrinfo EAI_AGAIN alp"))).toBe(
+      true,
+    );
+    expect(isRetriableDnsError({ code: "ENOTFOUND" })).toBe(false);
+  });
+
+  it("only pre-resolves hostnames", () => {
+    expect(shouldResolveBeforeSshConnect("alp")).toBe(true);
+    expect(shouldResolveBeforeSshConnect("127.0.0.1")).toBe(false);
+    expect(shouldResolveBeforeSshConnect("[2001:db8::1]")).toBe(false);
+  });
+
+  it("updates SSH connect config hosts in place", async () => {
+    const lookup = vi
+      .fn()
+      .mockResolvedValue({ address: "10.0.0.6", family: 4 });
+    const config = { host: "alp", port: 22 };
+
+    await expect(resolveSshConnectConfigHost(config, lookup)).resolves.toEqual({
+      host: "10.0.0.6",
+      port: 22,
+      originalHost: "alp",
+      resolvedHost: "10.0.0.6",
+    });
+  });
+});
@@ -0,0 +1,103 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+const mockAccess = vi.fn();
+
+vi.mock("fs/promises", () => ({
+  access: mockAccess,
+}));
+
+import { resolveAgentSocket } from "../../hosts/terminal-auth-helpers.js";
+
+describe("resolveAgentSocket", () => {
+  const originalEnv = process.env.SSH_AUTH_SOCK;
+  const originalPlatform = process.platform;
+
+  beforeEach(() => {
+    mockAccess.mockReset();
+    delete process.env.SSH_AUTH_SOCK;
+  });
+
+  afterEach(() => {
+    if (originalEnv !== undefined) {
+      process.env.SSH_AUTH_SOCK = originalEnv;
+    } else {
+      delete process.env.SSH_AUTH_SOCK;
+    }
+    Object.defineProperty(process, "platform", { value: originalPlatform });
+  });
+
+  it("uses explicit socket path from terminalConfig over SSH_AUTH_SOCK", async () => {
+    Object.defineProperty(process, "platform", { value: "linux" });
+    process.env.SSH_AUTH_SOCK = "/tmp/ssh-env/agent.123";
+    mockAccess.mockResolvedValue(undefined);
+
+    const result = await resolveAgentSocket({
+      agentSocketPath: "/run/user/1000/gnupg/S.gpg-agent.ssh",
+    });
+
+    expect(result).toEqual({
+      socketPath: "/run/user/1000/gnupg/S.gpg-agent.ssh",
+    });
+    expect(mockAccess).toHaveBeenCalledWith(
+      "/run/user/1000/gnupg/S.gpg-agent.ssh",
+    );
+  });
+
+  it("falls back to SSH_AUTH_SOCK when no explicit path is provided", async () => {
+    Object.defineProperty(process, "platform", { value: "linux" });
+    process.env.SSH_AUTH_SOCK = "/tmp/ssh-XXXX/agent.456";
+    mockAccess.mockResolvedValue(undefined);
+
+    const result = await resolveAgentSocket({});
+
+    expect(result).toEqual({ socketPath: "/tmp/ssh-XXXX/agent.456" });
+  });
+
+  it("falls back to SSH_AUTH_SOCK when agentSocketPath is empty string", async () => {
+    Object.defineProperty(process, "platform", { value: "linux" });
+    process.env.SSH_AUTH_SOCK = "/tmp/ssh-XXXX/agent.789";
+    mockAccess.mockResolvedValue(undefined);
+
+    const result = await resolveAgentSocket({ agentSocketPath: "  " });
+
+    expect(result).toEqual({ socketPath: "/tmp/ssh-XXXX/agent.789" });
+  });
+
+  it("returns error when neither SSH_AUTH_SOCK nor explicit path is set", async () => {
+    const result = await resolveAgentSocket({});
+
+    expect(result).toHaveProperty("error");
+    expect((result as { error: string }).error).toContain("SSH_AUTH_SOCK");
+  });
+
+  it("returns error when terminalConfig is undefined and SSH_AUTH_SOCK is not set", async () => {
+    const result = await resolveAgentSocket(undefined);
+
+    expect(result).toHaveProperty("error");
+  });
+
+  it("returns error on non-Windows when socket file is missing", async () => {
+    Object.defineProperty(process, "platform", { value: "linux" });
+    process.env.SSH_AUTH_SOCK = "/tmp/missing-agent.sock";
+    mockAccess.mockRejectedValue(new Error("ENOENT"));
+
+    const result = await resolveAgentSocket({});
+
+    expect(result).toHaveProperty("error");
+    expect((result as { error: string }).error).toContain(
+      "/tmp/missing-agent.sock",
+    );
+  });
+
+  it("skips file existence check on Windows", async () => {
+    Object.defineProperty(process, "platform", { value: "win32" });
+    process.env.SSH_AUTH_SOCK = "\\\\.\\pipe\\openssh-ssh-agent";
+
+    const result = await resolveAgentSocket({});
+
+    expect(result).toEqual({
+      socketPath: "\\\\.\\pipe\\openssh-ssh-agent",
+    });
+    expect(mockAccess).not.toHaveBeenCalled();
+  });
+});
@@ -0,0 +1,57 @@
+import { EventEmitter } from "events";
+import { describe, expect, it, vi } from "vitest";
+import { performPortKnocking } from "../../hosts/terminal-auth-helpers.js";
+
+class FakeTcpSocket extends EventEmitter {
+  readonly connect = vi.fn();
+  readonly destroy = vi.fn();
+}
+
+describe("performPortKnocking", () => {
+  it("continues through TCP knock errors", async () => {
+    const first = new FakeTcpSocket();
+    const second = new FakeTcpSocket();
+    const wait = vi.fn().mockResolvedValue(undefined);
+
+    const knocking = performPortKnocking(
+      "192.0.2.10",
+      [
+        { port: 1111, protocol: "tcp", delay: 10 },
+        { port: 2222, protocol: "tcp", delay: 0 },
+      ],
+      {
+        createTcpSocket: vi
+          .fn()
+          .mockReturnValueOnce(first)
+          .mockReturnValueOnce(second),
+        wait,
+      },
+    );
+
+    first.emit("error", new Error("closed"));
+    await Promise.resolve();
+    second.emit("connect");
+    await knocking;
+
+    expect(first.connect).toHaveBeenCalledWith(1111, "192.0.2.10");
+    expect(second.connect).toHaveBeenCalledWith(2222, "192.0.2.10");
+    expect(first.destroy).toHaveBeenCalled();
+    expect(second.destroy).toHaveBeenCalled();
+    expect(wait).toHaveBeenCalledWith(10);
+  });
+
+  it("times out TCP knocks that are silently dropped", async () => {
+    const socket = new FakeTcpSocket();
+    const wait = vi.fn().mockResolvedValue(undefined);
+
+    await performPortKnocking("192.0.2.10", [{ port: 1111, delay: 0 }], {
+      createTcpSocket: () => socket as never,
+      tcpTimeoutMs: 1,
+      wait,
+    });
+
+    expect(socket.connect).toHaveBeenCalledWith(1111, "192.0.2.10");
+    expect(socket.destroy).toHaveBeenCalled();
+    expect(wait).not.toHaveBeenCalled();
+  });
+});
@@ -0,0 +1,152 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+// Stub all external imports before loading the module under test
+const mockCreate = vi.fn().mockResolvedValue({ id: 1 });
+const mockUpdateEnded = vi.fn().mockResolvedValue(undefined);
+
+vi.mock("../../../database/db/index.js", () => ({
+  getDb: () => ({}),
+}));
+
+vi.mock("../../../database/repositories/factory.js", () => ({
+  createCurrentSessionRecordingRepository: () => ({
+    create: mockCreate,
+    updateEnded: mockUpdateEnded,
+  }),
+}));
+
+vi.mock("../../../utils/logger.js", () => ({
+  sshLogger: {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+  },
+}));
+
+// Mock individual fs.promises methods via a stub object
+const mockMkdir = vi.fn().mockResolvedValue(undefined);
+const mockWriteFile = vi.fn().mockResolvedValue(undefined);
+const mockAppendFile = vi.fn().mockResolvedValue(undefined);
+const mockUnlink = vi.fn().mockResolvedValue(undefined);
+
+vi.mock("fs", () => ({
+  default: {
+    promises: {
+      mkdir: mockMkdir,
+      writeFile: mockWriteFile,
+      appendFile: mockAppendFile,
+      readFile: vi.fn(),
+      unlink: mockUnlink,
+    },
+  },
+  promises: {
+    mkdir: mockMkdir,
+    writeFile: mockWriteFile,
+    appendFile: mockAppendFile,
+    readFile: vi.fn(),
+    unlink: mockUnlink,
+  },
+}));
+
+const { sessionManager } =
+  await import("../../../hosts/terminal/session-manager.js");
+
+describe("TerminalSessionManager - session logging", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // Re-apply resolved values after clearAllMocks
+    mockMkdir.mockResolvedValue(undefined);
+    mockWriteFile.mockResolvedValue(undefined);
+    mockCreate.mockResolvedValue({ id: 1 });
+    mockUpdateEnded.mockResolvedValue(undefined);
+  });
+
+  it("createSession stores sessionLoggingEnabled=true by default", () => {
+    const id = sessionManager.createSession("u1", 1, "host", 80, 24);
+    const session = sessionManager.getSession(id);
+    expect(session?.sessionLoggingEnabled).toBe(true);
+    sessionManager.destroySession(id);
+  });
+
+  it("createSession stores sessionLoggingEnabled=false when passed", () => {
+    const id = sessionManager.createSession(
+      "u1",
+      1,
+      "host",
+      80,
+      24,
+      undefined,
+      false,
+    );
+    const session = sessionManager.getSession(id);
+    expect(session?.sessionLoggingEnabled).toBe(false);
+    sessionManager.destroySession(id);
+  });
+
+  it("does not write log file when sessionLoggingEnabled=false", async () => {
+    const id = sessionManager.createSession(
+      "u1",
+      1,
+      "host",
+      80,
+      24,
+      undefined,
+      false,
+    );
+    sessionManager.bufferOutput(id, "some output");
+    sessionManager.destroySession(id);
+    await new Promise((r) => setTimeout(r, 20));
+    expect(mockWriteFile).not.toHaveBeenCalled();
+  });
+
+  it("writes log file and inserts DB row when sessionLoggingEnabled=true", async () => {
+    const id = sessionManager.createSession(
+      "u1",
+      1,
+      "host",
+      80,
+      24,
+      undefined,
+      true,
+    );
+    sessionManager.bufferOutput(id, "terminal output data");
+    sessionManager.destroySession(id);
+    await new Promise((r) => setTimeout(r, 20));
+    expect(mockWriteFile).toHaveBeenCalledOnce();
+    expect(mockCreate).toHaveBeenCalledOnce();
+  });
+
+  it("does not write log file when buffer is empty", async () => {
+    const id = sessionManager.createSession(
+      "u1",
+      1,
+      "host",
+      80,
+      24,
+      undefined,
+      true,
+    );
+    sessionManager.destroySession(id);
+    await new Promise((r) => setTimeout(r, 20));
+    expect(mockWriteFile).not.toHaveBeenCalled();
+  });
+
+  it("bufferOutput trims old data when exceeding 512KB", () => {
+    const id = sessionManager.createSession(
+      "u1",
+      1,
+      "host",
+      80,
+      24,
+      undefined,
+      false,
+    );
+    const chunk = "x".repeat(300 * 1024);
+    sessionManager.bufferOutput(id, chunk);
+    sessionManager.bufferOutput(id, chunk);
+    const session = sessionManager.getSession(id);
+    expect(session!.outputBufferBytes).toBeLessThanOrEqual(512 * 1024);
+    sessionManager.destroySession(id);
+  });
+});
@@ -0,0 +1,56 @@
+import { EventEmitter } from "node:events";
+import type { Client } from "ssh2";
+import { describe, expect, it } from "vitest";
+import {
+  detectTmux,
+  tmuxCommand,
+  withTmuxPath,
+} from "../../../hosts/tmux/helper.js";
+
+describe("tmux command path handling", () => {
+  it("adds common non-login shell tmux paths", () => {
+    const command = withTmuxPath("command -v tmux");
+
+    expect(command).toMatch(/^\/bin\/sh -c '/);
+    expect(command).toContain("/opt/homebrew/bin");
+    expect(command).toContain("/usr/local/bin");
+    expect(command).toContain("/opt/bin");
+    expect(command).toContain("/usr/pkg/bin");
+    expect(command).toContain(":$PATH; export PATH; command -v tmux");
+  });
+
+  it("wraps tmux invocations with the same path", () => {
+    expect(tmuxCommand("list-sessions")).toMatch(
+      /^\/bin\/sh -c 'PATH=.*:\$PATH; export PATH; tmux list-sessions'$/,
+    );
+  });
+
+  it("detects suffixed tmux versions without parsing the version number", async () => {
+    const commands: string[] = [];
+    const conn = {
+      exec(command: string, callback: (error: null, stream: never) => void) {
+        commands.push(command);
+        const stream = new EventEmitter() as EventEmitter & {
+          stderr: EventEmitter;
+        };
+        stream.stderr = new EventEmitter();
+        callback(null, stream as never);
+
+        queueMicrotask(() => {
+          if (commands.length === 1) {
+            stream.emit("data", Buffer.from("tmux 3.7b\n"));
+            stream.emit("close", 0);
+            return;
+          }
+          stream.emit("close", 1);
+        });
+      },
+    } as unknown as Client;
+
+    await expect(detectTmux(conn)).resolves.toEqual({
+      available: true,
+      sessions: [],
+    });
+    expect(commands[0]).toContain("tmux -V");
+  });
+});
@@ -0,0 +1,225 @@
+import { describe, it, expect } from "vitest";
+import {
+  SEP,
+  parseSessions,
+  parseWindows,
+  parsePanes,
+  parsePsOutput,
+  parseGpuOutput,
+  buildPaneMetrics,
+  attachPanesToWindows,
+  shellEscape,
+} from "../../../hosts/tmux/monitor-helpers.js";
+
+function join(...fields: (string | number)[]): string {
+  return fields.join(SEP);
+}
+
+describe("parseSessions", () => {
+  it("parses tmux list-sessions output", () => {
+    const output = [
+      join("training", 1760000000, 1760001000, 1),
+      join("lab|with|pipes", 1760000500, 1760002000, 0),
+    ].join("\n");
+
+    const sessions = parseSessions(output);
+    expect(sessions).toHaveLength(2);
+    expect(sessions[0]).toEqual({
+      name: "training",
+      created: 1760000000,
+      lastActivity: 1760001000,
+      attachedClients: 1,
+    });
+    // Session names containing "|" survive because SEP is a multi-char token
+    expect(sessions[1].name).toBe("lab|with|pipes");
+    expect(sessions[1].attachedClients).toBe(0);
+  });
+
+  it("returns empty array for empty output", () => {
+    expect(parseSessions("")).toEqual([]);
+  });
+});
+
+describe("parseWindows", () => {
+  it("groups windows by session", () => {
+    const output = [
+      join("training", 0, 1, "vim"),
+      join("training", 1, 0, "logs"),
+      join("api", 0, 1, "server"),
+    ].join("\n");
+
+    const windows = parseWindows(output);
+    expect(windows.get("training")).toHaveLength(2);
+    expect(windows.get("training")![0]).toMatchObject({
+      index: 0,
+      name: "vim",
+      active: true,
+    });
+    expect(windows.get("api")![0].name).toBe("server");
+  });
+});
+
+describe("parsePanes", () => {
+  it("parses full pane lines including free-text fields", () => {
+    const output = join(
+      "training",
+      0,
+      "%3",
+      1,
+      12345,
+      1,
+      120,
+      40,
+      "python",
+      "/home/user/my|dir",
+      "gpu01: train.py",
+    );
+
+    const panes = parsePanes(output);
+    expect(panes).toHaveLength(1);
+    expect(panes[0]).toEqual({
+      sessionName: "training",
+      windowIndex: 0,
+      id: "%3",
+      index: 1,
+      pid: 12345,
+      active: true,
+      width: 120,
+      height: 40,
+      command: "python",
+      path: "/home/user/my|dir",
+      title: "gpu01: train.py",
+    });
+  });
+});
+
+describe("parsePsOutput", () => {
+  it("parses ps -eo pid,ppid,pcpu,pmem,rss,comm output", () => {
+    const output = [
+      "    1     0  0.0  0.1  1234 systemd",
+      "12345     1  2.5  1.0 50000 bash",
+      "12400 12345 95.3 12.5 800000 python3",
+      "garbage line",
+    ].join("\n");
+
+    const procs = parsePsOutput(output);
+    expect(procs).toHaveLength(3);
+    expect(procs[2]).toEqual({
+      pid: 12400,
+      ppid: 12345,
+      cpu: 95.3,
+      mem: 12.5,
+      rss: 800000,
+      comm: "python3",
+    });
+  });
+});
+
+describe("parseGpuOutput", () => {
+  it("parses nvidia-smi csv output and sums per pid", () => {
+    const output = ["12400, 8000", "12400, 2000", "99999, 512"].join("\n");
+    const gpu = parseGpuOutput(output);
+    expect(gpu.get(12400)).toBe(10000);
+    expect(gpu.get(99999)).toBe(512);
+  });
+
+  it("handles empty output (no GPU)", () => {
+    expect(parseGpuOutput("").size).toBe(0);
+  });
+});
+
+describe("buildPaneMetrics", () => {
+  const panes = parsePanes(
+    [
+      join("training", 0, "%1", 0, 100, 1, 80, 24, "bash", "/", "t"),
+      join("idle", 0, "%2", 0, 200, 1, 80, 24, "bash", "/", "t"),
+    ].join("\n"),
+  );
+
+  const processes = parsePsOutput(
+    [
+      // pane %1: bash(100) -> python3(110) -> worker(111)
+      "  100     1  0.1  0.1  4000 bash",
+      "  110   100 90.0 10.0 700000 python3",
+      "  111   110  9.5  2.0 100000 dataloader",
+      // pane %2: bash(200) only
+      "  200     1  0.0  0.1  4000 bash",
+      // unrelated process
+      "  300     1 50.0  5.0 200000 chrome",
+    ].join("\n"),
+  );
+
+  it("aggregates descendant trees per pane", () => {
+    const metrics = buildPaneMetrics(panes, processes, new Map());
+    const m1 = metrics.find((m) => m.paneId === "%1")!;
+    expect(m1.processCount).toBe(3);
+    expect(m1.cpuPercent).toBeCloseTo(99.6, 1);
+    expect(m1.memRssKb).toBe(804000);
+    expect(m1.topCommand).toBe("python3");
+
+    const m2 = metrics.find((m) => m.paneId === "%2")!;
+    expect(m2.processCount).toBe(1);
+    expect(m2.cpuPercent).toBe(0);
+    // Unrelated process is never attributed
+    expect(m2.memRssKb).toBe(4000);
+  });
+
+  it("attributes GPU memory through the process tree", () => {
+    const gpu = new Map([
+      [110, 8000],
+      [300, 4000],
+    ]);
+    const metrics = buildPaneMetrics(panes, processes, gpu);
+    expect(metrics.find((m) => m.paneId === "%1")!.gpuMemMb).toBe(8000);
+    expect(metrics.find((m) => m.paneId === "%2")!.gpuMemMb).toBe(0);
+  });
+
+  it("handles a pane whose pid is missing from ps output", () => {
+    const orphan = parsePanes(
+      join("gone", 0, "%9", 0, 99999, 0, 80, 24, "bash", "/", "t"),
+    );
+    const metrics = buildPaneMetrics(orphan, processes, new Map());
+    expect(metrics[0].processCount).toBe(0);
+    expect(metrics[0].cpuPercent).toBe(0);
+    expect(metrics[0].topCommand).toBeNull();
+  });
+
+  it("does not loop on cyclic ppid data", () => {
+    const cyclic = parsePsOutput(
+      ["  100   101 1.0 0.1 1000 a", "  101   100 1.0 0.1 1000 b"].join("\n"),
+    );
+    const pane = parsePanes(
+      join("s", 0, "%1", 0, 100, 1, 80, 24, "a", "/", "t"),
+    );
+    const metrics = buildPaneMetrics(pane, cyclic, new Map());
+    expect(metrics[0].processCount).toBe(2);
+  });
+});
+
+describe("attachPanesToWindows", () => {
+  it("places panes into their windows", () => {
+    const windows = parseWindows(
+      [join("s1", 0, 1, "main"), join("s1", 1, 0, "logs")].join("\n"),
+    );
+    const panes = parsePanes(
+      [
+        join("s1", 0, "%1", 0, 100, 1, 80, 24, "bash", "/", "t"),
+        join("s1", 1, "%2", 0, 200, 0, 80, 24, "tail", "/", "t"),
+        join("unknown", 5, "%3", 0, 300, 0, 80, 24, "bash", "/", "t"),
+      ].join("\n"),
+    );
+
+    attachPanesToWindows(windows, panes);
+    expect(windows.get("s1")![0].panes).toHaveLength(1);
+    expect(windows.get("s1")![0].panes[0].id).toBe("%1");
+    expect(windows.get("s1")![1].panes[0].id).toBe("%2");
+  });
+});
+
+describe("shellEscape", () => {
+  it("wraps in single quotes and escapes embedded quotes", () => {
+    expect(shellEscape("simple")).toBe("'simple'");
+    expect(shellEscape("it's")).toBe("'it'\\''s'");
+    expect(shellEscape("$(rm -rf /)")).toBe("'$(rm -rf /)'");
+  });
+});
@@ -0,0 +1,268 @@
+import { describe, it, expect, beforeAll, afterEach, vi } from "vitest";
+import { execFileSync } from "child_process";
+import { mkdtempSync, readFileSync, rmSync } from "fs";
+import os from "os";
+import path from "path";
+import ssh2Pkg from "ssh2";
+import {
+  generateEphemeralKeyPair,
+  parseCertValidBefore,
+  startVaultOidc,
+  completeVaultOidc,
+  signWithVault,
+  type VaultProfileConfig,
+} from "../../hosts/vault-signer-core.js";
+
+const { utils: ssh2Utils } = ssh2Pkg;
+
+describe("generateEphemeralKeyPair", () => {
+  for (const keyType of [
+    "ssh-ed25519",
+    "ecdsa-sha2-nistp256",
+    "ssh-rsa",
+  ] as const) {
+    it(`generates a parseable ${keyType} keypair`, () => {
+      const pair = generateEphemeralKeyPair(keyType);
+      expect(pair.privateKey).toContain("BEGIN OPENSSH PRIVATE KEY");
+      expect(pair.publicKey.split(/\s+/)[0]).toBe(keyType);
+
+      // Both halves must be parseable by the same library that signs/connects.
+      const priv = ssh2Utils.parseKey(pair.privateKey);
+      expect(priv instanceof Error).toBe(false);
+      const pub = ssh2Utils.parseKey(pair.publicKey);
+      expect(pub instanceof Error).toBe(false);
+    });
+  }
+
+  it("defaults to ed25519 for unknown key types", () => {
+    const pair = generateEphemeralKeyPair("nonsense");
+    expect(pair.publicKey.startsWith("ssh-ed25519")).toBe(true);
+  });
+});
+
+describe("parseCertValidBefore", () => {
+  let cert = "";
+  let signedAt = 0;
+  let haveSshKeygen = true;
+
+  beforeAll(() => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "vault-cert-test-"));
+    try {
+      execFileSync("ssh-keygen", [
+        "-t",
+        "ed25519",
+        "-f",
+        `${dir}/ca`,
+        "-N",
+        "",
+        "-q",
+      ]);
+      execFileSync("ssh-keygen", [
+        "-t",
+        "ed25519",
+        "-f",
+        `${dir}/user`,
+        "-N",
+        "",
+        "-q",
+      ]);
+      signedAt = Math.floor(Date.now() / 1000);
+      execFileSync("ssh-keygen", [
+        "-s",
+        `${dir}/ca`,
+        "-I",
+        "test-id",
+        "-n",
+        "root",
+        "-V",
+        "+60m",
+        `${dir}/user.pub`,
+      ]);
+      cert = readFileSync(`${dir}/user-cert.pub`, "utf8").trim();
+    } catch {
+      haveSshKeygen = false;
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("reads valid_before from a real ssh-keygen certificate", () => {
+    if (!haveSshKeygen) {
+      console.warn("ssh-keygen unavailable; skipping real-cert parse test");
+      return;
+    }
+    const validBefore = parseCertValidBefore(cert);
+    // -V +60m => valid_before is roughly signedAt + 3600 (start rounds to minute)
+    expect(validBefore).toBeGreaterThan(signedAt + 3300);
+    expect(validBefore).toBeLessThan(signedAt + 3900);
+  });
+
+  it("returns 0 for malformed input", () => {
+    expect(parseCertValidBefore("")).toBe(0);
+    expect(parseCertValidBefore("not-a-cert")).toBe(0);
+    expect(parseCertValidBefore("ssh-ed25519 AAAAnotbase64!!")).toBe(0);
+  });
+});
+
+describe("Vault HTTP flow (mocked fetch)", () => {
+  const profile: VaultProfileConfig = {
+    id: 1,
+    vaultAddr: "https://vault.example.com:8200/",
+    vaultNamespace: "team-a",
+    oidcMount: "oidc",
+    oidcRole: "developer",
+    sshMount: "ssh-client-signer",
+    sshRole: "my-role",
+    validPrincipals: "root,deploy",
+    keyType: "ssh-ed25519",
+  };
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  function mockFetch(
+    impl: (
+      url: string,
+      init: RequestInit,
+    ) => { status?: number; body: unknown },
+  ) {
+    const calls: Array<{ url: string; init: RequestInit }> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async (url: string, init: RequestInit) => {
+        calls.push({ url, init });
+        const { status = 200, body } = impl(url, init);
+        return {
+          ok: status >= 200 && status < 300,
+          status,
+          text: async () => JSON.stringify(body),
+        } as Response;
+      }),
+    );
+    return calls;
+  }
+
+  it("startVaultOidc posts auth_url and extracts state", async () => {
+    const calls = mockFetch(() => ({
+      body: {
+        data: {
+          auth_url:
+            "https://idp.example.com/authorize?client_id=x&state=ST-abc123&nonce=n",
+        },
+      },
+    }));
+
+    const result = await startVaultOidc(
+      profile,
+      "https://termix/vault/oidc/callback",
+    );
+
+    expect(result.state).toBe("ST-abc123");
+    expect(result.clientNonce).toMatch(/^[0-9a-f]{40}$/);
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe(
+      "https://vault.example.com:8200/v1/auth/oidc/oidc/auth_url",
+    );
+    expect(calls[0].init.method).toBe("POST");
+    const headers = calls[0].init.headers as Record<string, string>;
+    expect(headers["X-Vault-Namespace"]).toBe("team-a");
+    const body = JSON.parse(calls[0].init.body as string);
+    expect(body).toMatchObject({
+      role: "developer",
+      redirect_uri: "https://termix/vault/oidc/callback",
+    });
+    expect(body.client_nonce).toBe(result.clientNonce);
+  });
+
+  it("completeVaultOidc returns the client token", async () => {
+    const calls = mockFetch(() => ({
+      body: { auth: { client_token: "hvs.TESTTOKEN" } },
+    }));
+
+    const token = await completeVaultOidc(profile, {
+      state: "ST-abc123",
+      code: "auth-code",
+      clientNonce: "nonce123",
+    });
+
+    expect(token).toBe("hvs.TESTTOKEN");
+    const url = new URL(calls[0].url);
+    expect(url.pathname).toBe("/v1/auth/oidc/oidc/callback");
+    expect(url.searchParams.get("state")).toBe("ST-abc123");
+    expect(url.searchParams.get("code")).toBe("auth-code");
+    expect(url.searchParams.get("client_nonce")).toBe("nonce123");
+    expect(calls[0].init.method).toBe("GET");
+  });
+
+  it("signWithVault posts the public key and returns signed_key", async () => {
+    const calls = mockFetch(() => ({
+      body: {
+        data: { signed_key: "ssh-ed25519-cert-v01@openssh.com AAAAcert" },
+      },
+    }));
+
+    const cert = await signWithVault(
+      profile,
+      "hvs.TESTTOKEN",
+      "ssh-ed25519 AAAApub comment",
+    );
+
+    expect(cert).toBe("ssh-ed25519-cert-v01@openssh.com AAAAcert");
+    expect(calls[0].url).toBe(
+      "https://vault.example.com:8200/v1/ssh-client-signer/sign/my-role",
+    );
+    const headers = calls[0].init.headers as Record<string, string>;
+    expect(headers["X-Vault-Token"]).toBe("hvs.TESTTOKEN");
+    expect(headers["X-Vault-Namespace"]).toBe("team-a");
+    const body = JSON.parse(calls[0].init.body as string);
+    expect(body).toMatchObject({
+      public_key: "ssh-ed25519 AAAApub comment",
+      cert_type: "user",
+      valid_principals: "root,deploy",
+    });
+  });
+
+  it("surfaces Vault error messages", async () => {
+    mockFetch(() => ({
+      status: 400,
+      body: { errors: ["role not found", "permission denied"] },
+    }));
+
+    await expect(
+      signWithVault(profile, "tok", "ssh-ed25519 AAAA"),
+    ).rejects.toThrow(/role not found; permission denied/);
+  });
+});
+
+// Live integration against a real Vault (e.g. `vault server -dev` in Docker).
+// Runs only when VAULT_ADDR + VAULT_TOKEN are set and the SSH signer mount
+// (VAULT_SSH_MOUNT/VAULT_SSH_ROLE) has been configured by the test harness.
+describe("Vault live signing", () => {
+  const addr = process.env.VAULT_ADDR;
+  const token = process.env.VAULT_TOKEN;
+  const run = !!addr && !!token;
+
+  it.skipIf(!run)("signs an ephemeral key against a real Vault", async () => {
+    const profile: VaultProfileConfig = {
+      id: 99,
+      vaultAddr: addr!,
+      sshMount: process.env.VAULT_SSH_MOUNT || "ssh-client-signer",
+      sshRole: process.env.VAULT_SSH_ROLE || "my-role",
+      validPrincipals: "root",
+      keyType: "ssh-ed25519",
+    };
+
+    const pair = generateEphemeralKeyPair(profile.keyType);
+    const before = Math.floor(Date.now() / 1000);
+    const cert = await signWithVault(profile, token!, pair.publicKey);
+
+    expect(cert).toMatch(/-cert-v01@openssh\.com /);
+    // The signed cert must parse with the same library used to connect.
+    const parsed = ssh2Utils.parseKey(cert);
+    expect(parsed instanceof Error).toBe(false);
+
+    const validBefore = parseCertValidBefore(cert);
+    expect(validBefore).toBeGreaterThan(before);
+  });
+});