release-2.8.0 (#1456)

* Fix private AI custom endpoints (#1299) * Fix Proxmox credential guest imports (#1300) * Fix Fleet command results layout (#1301) * Fix synced client tunnel endpoints (#1302) * Fix Proxmox sync jump host persistence (#1303) * Fix command palette keyboard navigation (#1304) * Add accessible interface font choices (#1306) * Add selectable host temperature sensors (#1307) * Improve file manager navigation and compact layout (#1308) * Add configurable global hotkeys (#1305) * fix: restore split layout selection (#1310) * fix: support macOS VNC connections (#1311) * fix: use matching Undici fetch for private AI providers (#1309) Co-authored-by: Angad Singh <angad@singhangad.in> * feat: support additional TOTP authenticators (#1312) * feat: add VNC display zoom controls (#1314) * feat: add host context menu actions (#1315) * fix: force classic auth for macOS VNC (#1313) * fix: harden HTTP trust boundaries (#1316) * fix: harden application trust boundaries (#1317) * fix: verify OPKSSH binary integrity (#1318) * Fix remote desktop connection timeout (#1319) * chore(deps): bump node in /docker in the docker-major-updates group (#1321) Bumps the docker-major-updates group in /docker with 1 update: node. Updates `node` from 24-slim to 26-slim --- updated-dependencies: - dependency-name: node dependency-version: 26-slim dependency-type: direct:production dependency-group: docker-major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 15 updates (#1322) Bumps the dev-patch-updates group with 15 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.7` | `6.43.9` | | [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `21.2.1` | `21.2.2` | | [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `21.2.0` | `21.2.2` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `7.0.0` | `7.0.1` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.5` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.10` | `4.1.11` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `10.0.4` | `10.0.5` | | [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.0` | `3.34.1` | | [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.4` | | [react-i18next](https://github.com/i18next/react-i18next) | `17.0.11` | `17.0.12` | | [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `@codemirror/view` from 6.43.7 to 6.43.9 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@commitlint/cli` from 21.2.1 to 21.2.2 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/cli) Updates `@commitlint/config-conventional` from 21.2.0 to 21.2.2 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/config-conventional) Updates `@testing-library/jest-dom` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/jest-dom/compare/v7.0.0...v7.0.1) Updates `@testing-library/user-event` from 14.6.1 to 14.6.5 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/user-event/compare/v14.6.1...v14.6.5) Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8) Updates `@vitest/ui` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/ui) Updates `concurrently` from 10.0.4 to 10.0.5 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](https://github.com/open-cli-tools/concurrently/compare/v10.0.4...v10.0.5) Updates `cytoscape` from 3.34.0 to 3.34.1 - [Release notes](https://github.com/cytoscape/cytoscape.js/releases) - [Commits](https://github.com/cytoscape/cytoscape.js/compare/v3.34.0...v3.34.1) Updates `eslint` from 10.8.0 to 10.8.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.8.0...v10.8.1) Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.4 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.3...v0.5.4) Updates `react-i18next` from 17.0.11 to 17.0.12 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/react-i18next/compare/v17.0.11...v17.0.12) Updates `sonner` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/emilkowalski/sonner/releases) - [Commits](https://github.com/emilkowalski/sonner/compare/v2.0.7...v2.0.8) Updates `vite` from 8.2.0 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@codemirror/view" dependency-version: 6.43.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@commitlint/cli" dependency-version: 21.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@commitlint/config-conventional" dependency-version: 21.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/user-event" dependency-version: 14.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/ui" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: concurrently dependency-version: 10.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: cytoscape dependency-version: 3.34.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint dependency-version: 10.8.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: react-i18next dependency-version: 17.0.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sonner dependency-version: 2.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-patch-updates group with 5 updates (#1324) Bumps the prod-patch-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.9` | `3.14.10` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.2` | `13.0.3` | | [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.9` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.2` | `3.23.4` | | [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` | Updates `@tanstack/react-virtual` from 3.14.9 to 3.14.10 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.10/packages/react-virtual) Updates `better-sqlite3` from 13.0.2 to 13.0.3 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](https://github.com/WiseLibs/better-sqlite3/compare/v13.0.2...v13.0.3) Updates `jose` from 6.2.8 to 6.2.9 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](https://github.com/panva/jose/compare/v6.2.8...v6.2.9) Updates `mysql2` from 3.23.2 to 3.23.4 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](https://github.com/sidorares/node-mysql2/compare/v3.23.2...v3.23.4) Updates `ws` from 8.21.1 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](https://github.com/websockets/ws/compare/8.21.1...8.21.3) --- updated-dependencies: - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: better-sqlite3 dependency-version: 13.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: jose dependency-version: 6.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: mysql2 dependency-version: 3.23.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: ws dependency-version: 8.21.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump motion in the major-updates group (#1326) Bumps the major-updates group with 1 update: [motion](https://github.com/motiondivision/motion). Updates `motion` from 12.43.0 to 13.1.1 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](https://github.com/motiondivision/motion/compare/v12.43.0...v13.1.1) --- updated-dependencies: - dependency-name: motion dependency-version: 13.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add semantic motion system (#1320) * feat: add semantic motion system * feat: animate session workspace transitions * feat: refine motion accessibility and transfer feedback * feat: enforce RBAC and harden collaboration features (#1327) * feat: enforce RBAC and harden collaboration features - Mount requirePermission on hosts/snippets/credentials/automations/AI routes - Seed and backfill system role permissions on every dialect at startup - Support personal credential overrides for RDP/VNC/Telnet shared hosts - Broadcast participant presence in shared terminal sessions - Make audit log forwarding configurable from the admin panel - Add role members endpoint and snippet folder sharing * fix: enforce RBAC across split routes * fix: reject malformed Guacamole tokens safely (#1329) * fix: allow approved private notification hosts (#1330) * feat: collaboration rooms with switchable presenter (#1328) * feat: add collaboration rooms with switchable presenter Rooms are a group of members watching one stage - the live SSH/RDP/VNC session the current presenter shares. Any member can take over the stage; the host can invite, force-stop and end the meeting. Stages reuse session_shares (new room share type), so gating, recording, expiry and the global sharing toggle all apply unchanged. * feat: add stage control handoff to collaboration rooms The presenter or host can grant any member write access to the live stage and take it back; members can raise a hand to ask. SSH flips the participant's permission on the live gate; RDP/VNC re-mint the viewer's join token. Control clears on every stage switch. * feat: guest links, role invites and invite awareness for collab rooms - Anonymous guest link per room (host toggles/rotates), followed by polling the public resolve endpoint; SSH guests join over the terminal WS with roomGuestToken, guac guests get read-only join tokens - Invite by role (expands to current members, snapshot semantics) - Toast when a room you were invited to appears - Stale stages are cleared lazily when the presenter is gone - Telnet presenting, expired-tab fallback, documented single-instance and guac-kick limits - Tests for the collab routes, room hub, share access and control flip * fix: keep remote desktop collaboration read-only * fix: restore RDP clipboard paste across browsers (#1331) * fix: show the full command line in the process inspector (#1334) The CMD column rendered ps's comm field, which the kernel caps at 15 characters, so anything longer looked truncated no matter how wide the column was. The full args were already collected; show them. * fix: harden collaboration room access (#1332) * fix: harden collaboration room access * fix: confirm guest link lifecycle changes * fix: make RDP drive redirection writable on the stock deployment (#1333) * fix: make RDP drive redirection writable on the stock deployment The default drive-path was /drive on the guacd side, which the official guacd image cannot create as its non-root user, so every upload was refused with guacd's raw "FAIL (CANNOT OPEN)" ack. Default to GUACD_DRIVE_PATH (set to the shared termix-data volume in compose) with one folder per user, and explain guacd's refusal in the file browser. * style: format RDP drive settings * feat: quick connect for RDP and VNC (#1335) The Quick Connect panel gets a protocol switch. RDP/VNC quick hosts are built like SSH ones (never saved) and opened as regular remote desktop tabs; GuacamoleApp mints their token from the typed fields through the existing /guacamole/token endpoint instead of a host-row lookup. * fix: authenticate unwatched hosts during the status probe (#1337) With metrics enabled, the status probe left SSH authentication to the metrics poll - which only runs while someone is viewing the host. An unwatched host therefore never left "reachable", while a host with metrics disabled (whose probe always authenticates) showed online. The probe now authenticates whenever no metrics poll will. * feat: compact snippet list option (#1339) A "Show Commands" toggle in the snippets settings menu hides the command text under each snippet name, for people who dock the panel on the narrow right rail and only need the names. Local preference, on by default. * fix: guide users to Auto-Tmux when a persisted session expires (#1336) * fix: guide users to Auto-Tmux when a persisted session expires A timed-out terminal session silently reconnected to a fresh shell, so people running long jobs lost them with no explanation and never learned about Auto-Tmux. Explain the expiry with a one-click Enable Auto-Tmux action, let admins default it for new hosts and tune the persistence timeout from the UI, and move the setting up with copy that says what it does. The global default stays off. * style: format terminal expiry notice * feat: improve collaboration rooms (#1338) * feat: Step CA SSH certificates as a host authentication type (#1340) * feat: Step CA SSH certificates as a host authentication type Issue short-lived SSH user certificates from a smallstep CA through its OIDC provisioner, over the CA's HTTP API rather than the step binary. Everything after issuance reuses the OPKSSH plumbing: the same encrypted per-user/host token store, WebSocket dialog and ssh2 certificate injection, with the connect paths branching on a shared usesIssuedCertificate() predicate. Instance-wide CA settings live in the admin panel, with a private-host allowlist for the SSRF guard. * fix: harden Step CA callback flow * style: format Step CA changes * feat: 1Password Connect secret sources for SSH credentials (#1341) * feat: 1Password Connect secret sources for SSH credentials Hosts and credentials can hold op://vault/item/field references instead of secrets; they are resolved at connect time from the user's secret source (1Password Connect) at the single point where every subsystem receives plaintext credentials, so terminal, SFTP, Docker, metrics and tunnels all work without per-subsystem changes. Sources are per user, optionally shared, with the access token encrypted under the owner's data key; resolved values are cached briefly in memory. * style: format secret source changes * feat: share credentials with users and roles, inherit data on account deletion (#1342) * feat: share credentials with users and roles, inherit data on account deletion Credentials can be shared at "use" or "manage" level. Recipients get a copy re-encrypted under their own data key (shared_credential_secrets), kept in step with the owner's row through the same lifecycle hooks as shared host secrets. One gate, findUsableCredential(), replaces the private-namespace lookups so a shared credential works wherever a private one does. Deleting a user now hands their hosts and credentials to a successor (the deleting admin by default) instead of revoking everything they shared. * fix: harden credential ownership transfer * feat: folder shares apply to hosts added later (#1343) * feat: folder shares apply to hosts added later Sharing a folder only fanned grants out to the hosts in it at the time. The share is now also kept as a standing rule on the folder, and a host created in or moved into it (or a subfolder) inherits the same access and secret snapshots. Rules follow folder renames and can be stopped from the share dialog. * fix: stabilize folder access migrations * fix: package sharp for both macOS architectures (#1344) * fix: prompt shared RDP users for credentials (#1345) * feat: add terminal copy-on-select option (#1346) * fix: retry protected file reads with sudo (#1349) * fix: stop SSH-authenticating hosts during routine status polling (#1347) * fix: preserve omitted host protocol settings (#1350) * fix: surface remote sync reauthentication failures (#1351) * fix: harden file reads and timer cleanup (#1352) * fix: harden file reads and timer cleanup * fix: preserve literal file path escapes * fix: enforce SSH pool connection limits (#1353) * fix: enforce SSH pool connection limits * fix: discard stale pooled connections * fix: harden connection, payload, and persisted state handling (#1354) * fix: clean up Cloudflare tunnel timeouts * fix: couple tunnel socket lifecycle * fix: validate Docker console messages * fix: bound homepage proxy responses * fix: bound reconnect and response failures * fix: harden persisted and socket state * fix: support local connections to shared hosts * fix: recover expired dashboard metrics sessions (#1355) * fix: upload files to redirected RDP drives (#1356) * fix: unify connection toolbar visibility (#1357) * fix: reset host virtualizer after editing (#1358) * test: update Guacamole toolbar display mock (#1360) * fix: reflect live SSH sessions in host status (#1359) * fix: support Vault auth in file manager (#1361) * fix: allow exec on shared hosts (#1362) * fix(file-manager): align chunked upload contract (#1371) * fix(file-manager): make bulk uploads resilient (#1373) * fix(terminal): disable local echo on alternate screen (#1372) * fix(homepage): validate clock widget timezones (#1374) An invalid timezone in a clock widget's config reached toLocaleTimeString unchecked, throwing RangeError during render and taking the homepage canvas down with it. The edit dialog accepted any string, so "America/New York" - a space where IANA wants an underscore - was easy to save, and the homepage stayed broken on every later load because the value is reloaded from the database. The edit dialog now flags an unusable zone the way FolderMetadataDialog flags a duplicate folder name: inline message, aria-invalid, and a disabled Save. Whitespace is normalized to underscores on save, so the space spelling is stored as America/New_York rather than rejected. ClockWidget falls back to local time for any config already holding an invalid zone. Related to Termix-SSH/Support#1238 * fix(hosts): preserve connection origin in editor (#1376) * fix(remote-sync): expose local login notification (#1375) * fix(auth): allow passkeys in desktop login (#1378) * fix(proxmox): elevate guest discovery commands (#1379) * Fix permanent file-transfer completion toasts (#1383) * fix(file-manager): expire completed progress toasts * test(file-manager): use valid transfer status * fix(hosts): allow clearing SSH key type (#1384) * fix(terminal): suppress local echo for contextual password prompts (#1387) * fix(desktop): surface a failed embedded backend start (#1382) * fix(desktop): surface a failed embedded backend start When the embedded backend's HTTP port was already taken, the desktop app sat on the "Loading..." spinner forever with nothing in the UI to say why. The backend logged the conflict and exited 1, and startBackendServer resolved false, but that verdict never reached the renderer: the get-embedded-server-status channel was not exposed in preload and nothing called it. The renderer, by design, treats every connection failure as "the embedded backend is still booting" and retries indefinitely -- in main.tsx's verifying phase, in Auth's desktop auto-session, and in FullScreenAppWrapper. That holds while the backend is merely slow to boot, but not once the process has exited, and nothing distinguished the two. Classify why the child died from its exit code and a bounded tail of its stderr, report it through get-embedded-server-status, and have each retry loop keep waiting only while no failure is reported. A port conflict names the port, since that is what the user has to act on -- most often a Termix container on the same ports, or a backend orphaned by a hard-kill that reapOrphanedBackendProcess could not claim. A deliberate shutdown is not reported as a crash, and a backend that is only slow to start still gets retried as before. Fixes Termix-SSH/Support#1254 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(desktop): treat every unrequested backend exit as a failure The classifier exempted a clean exit and SIGTERM/SIGINT, calling those a deliberate shutdown. It has no evidence for that: its only caller already sits behind backendStopRequested, so it is reached only for exits stopBackendServer() did not ask for. A backend that exited 0 on its own, or was terminated by the OS or an external signal, therefore reported no failure at all -- leaving all three renderer loops waiting forever for a process that is gone, which is the exact hang this change set exists to remove. Every exit reaching the classifier is now a failure, port-in-use when stderr carries EADDRINUSE and crashed otherwise, with backendStopRequested left as the sole deliberate-shutdown guard. That makes the exit code and signal irrelevant to the verdict, so the classifier now takes only the stderr tail rather than carrying two parameters it no longer reads. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Add white label branding settings (#1386) * feat(admin): add white label branding settings Admins can configure a custom app name, logo and tagline from the Admin Settings panel. The values apply to the login screen and the browser tab title/favicon at runtime. * fix(admin): restore default icons on logo reset, validate upload MIME type Resetting the logo now restores the bundled favicon/apple-touch-icon instead of leaving the previous custom one until a reload. The admin upload also validates file.type up front instead of only failing later on save. * fix(admin): restore default favicons and reject invalid logo types Capture bundled icon hrefs before the first custom logo is applied so a reset does not leave the previous upload in the tab, and reject non-image uploads before they are read into branding state. * test(admin): cover branding routes and logo validation Add backend tests for the public GET, admin-only PATCH, unknown-field rejection, and parseBrandingLogoDataUrl so invalid images cannot land in settings without a failing test. * fix(backend): report port conflicts on the service ports (#1388) Express's app.listen(port, host, callback) registers that callback as the server's error handler as well as its listening handler: if (typeof args[args.length - 1] === 'function') { var done = args[args.length - 1] = once(args[args.length - 1]) server.once('error', done) } so a bind failure invoked the service's "started" callback with an EADDRINUSE error as its only argument and emitted nothing. None of the services read that argument, which made a failed bind indistinguishable from a successful one: the service logged that it had started, ran its initialisation, and served nothing. With one of 30003-30012 occupied the backend still reported backend_init_complete, the app loaded, and the affected feature was dead for the session with no error anywhere in the logs -- searching the backend log, the Electron main log and stdout for EADDRINUSE returned nothing, as did uncaughtException and unhandledRejection probes. This is also why only the main port behaved sensibly: database.ts does not use app.listen(), it builds the server and attaches a real error handler, so 30001 was the one port whose conflict was ever detected. listenOnServicePort() builds the server so that listening and error stay separate, and treats a conflict the way database.ts already does -- name the port, then exit -- rather than running on with one feature missing. Exiting also hands the desktop app the classified failure it already surfaces, so the user is told which port to free. Services that must own their server, such as the tunnel service with its WebSocket upgrade handler, get the same handler via attachServicePortConflictHandler(). Note that adding .on("error") to the services would not have worked: express consumes the event through once('error', done) before any later handler runs. The callback has to stop being passed to listen() at all. Fixes Termix-SSH/Support#1260 Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * feat(desktop): allow RDP/VNC/Telnet to originate from this device (#1389) The desktop pinned rdp/vnc/telnet to the remote server, so a host the user's own machine could reach but the Termix server could not was impossible to open: the app answered "Remote server required" even when no remote server was wanted. The embedded backend already runs the Guacamole websocket server and guacd's address is already configurable globally and per host, so what was missing was the choice. resolveConnectionOrigin now honours an explicit per-host origin for these protocols. Left on Default they still resolve to remote: they need a guacd, which the desktop does not ship, so originating locally only works once the user has pointed Termix at one of their own. Keeping that opt-in means an upgrade never moves a working connection onto a guacd that is not there. Serial and non-Electron behaviour are unchanged. Three call paths had the same assumption baked in and would have quietly ignored the setting: - The Guacamole call sites resolved the origin without passing the host's own override, so it could never take effect. - guacamole-api sent every token, connect-host and status call to the remote server whenever running under Electron, and remapped the host id onto the remote server's id -- which would address the wrong row, or fail outright with no server configured. - GuacamoleDisplay minted its token before resolving the origin, so the token could come from a different backend than the socket dialled. The origin is a required parameter on those API functions rather than a defaulted one. A default silently sent a missed call site to the remote server: the guacd status check in fetchToken was one, and it failed with a bare "Network Error" on a desktop with no server configured. Making it required means the compiler names every caller instead. That also covers CollabRoomTab, which now resolves from the host it already holds, so a locally-originated host stays local when presented into a room. Finally, the Connection Origin control was gated on SSH alone, so a host enabling only these protocols could never reach the setting. That gate is now a named predicate covering every protocol the control applies to. Verified end to end on Linux against a local guacd: with a host set to "This device", guacd accepted the connection and reached the target, which answered for itself. With guacd stopped, the guacd status check that has run before every connection since v2.3.0 -- now asking the backend the session will actually use -- reports it clearly before a socket is opened. Refs Termix-SSH/Support#1240 Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * feat(local-terminal): add copy/paste support (#1391) * feat(local-terminal): add copy/paste support Local terminal had no clipboard wiring, so selected text couldn't be copied. Extracted the SSH terminal's copy/paste shortcut and right-click handling into a shared terminal-clipboard module and wired it into both terminals, removing duplicated logic in the process. * fix(local-terminal): stop language changes from restarting the shell session The session effect that starts the local PTY depended on `t`, whose identity changes on every language switch (react-i18next). That tore down the running shell and spawned a new one just from changing the UI language. Read translations through a ref instead so localization stays decoupled from the PTY lifecycle. Also adds regression coverage for the extracted terminal-clipboard.ts helpers: copy with/without selection, explicit vs native paste, right-click preference, and Ctrl+right-click passthrough. * fix(file-manager): keep name column visible on narrow viewports in list view (#1402) Rebased onto dev-2.8.0 (the density refactor kept the same 3 list-view grid patterns). Use minmax(140px, 1fr) for the name track so it cannot collapse to 0px on narrow viewports; the table scrolls horizontally instead of hiding names and icons. Co-authored-by: inontz <inontz@users.noreply.github.com> * feat(desktop): local filesystem and transfer bridge for the file manager (#1392) * feat(desktop): local filesystem and transfer bridge for the file manager Adds the Electron main-process side of the upcoming Local | Remote dual-pane file manager, with no UI yet: - electron/local-files.cjs: IPC handlers to browse the local disk (home, list, mkdir, createFile, rename, trash, ensureDir, walk, reveal, open) and to stream files between the local disk and the file-manager backend (uploadLocalFile / downloadToLocal with progress events and cancellation). Streams go through Electron's `net` so the session cookie / remembered JWT is attached the same way as the renderer's own requests. - electron/preload.js: exposes them as `window.electronAPI.localFs` and `window.electronAPI.localTransfer`; the existing `invoke` allowlist is untouched. - src/types/electron.d.ts: typings for the new surface. - electron/main.cjs: registers the handlers. Follow-up PRs add the renderer side (local pane, drag-and-drop transfers, context menu). * fix(desktop): harden the local transfer bridge (origin allowlist, collision policy) Addresses the review on the transfer boundary: - The renderer no longer supplies a URL or headers. It sends `{ origin: "local" | "remote", route, deviceId }` and the main process resolves the target itself: fixed route allowlist (`uploadFileStream`, `downloadFileStream`), local = the embedded backend base, remote = the remote-sync config's URL (http/https only) with the stored JWT. Anything else is rejected before a request is made. `deviceId` is validated. - Downloads never rename or replace silently. The destination is checked first and `EEXIST` is returned unless the caller passes `overwrite: true`. Each transfer writes to its own `<dest>.<transferId>.termix-part` opened with `wx`, and publishes with `fs.link` / `COPYFILE_EXCL` (rename only when overwriting), so concurrent transfers to the same path cannot share or clobber a partial (`EBUSY` for the second). Partials are removed on failure or cancel. - New `local-fs:exists` handler so the renderer can ask before starting. - `createLocalFileHandlers` / `createTargetResolver` take their dependencies (net, shell, remote-sync getters) as parameters so the boundary is unit-testable without Electron. - src/backend/tests/electron/local-files.test.ts: target resolution and off-origin refusal, EEXIST / EBUSY / overwrite paths, unique partials and cleanup, upload multipart integrity (parsed with Busboy). * fix(desktop): Windows-safe replace for overwrite downloads `publishDownload()` used `rename(partial, dest)` for the explicit overwrite path. POSIX replaces the destination, but on Windows rename() onto an existing name commonly fails (EEXIST / EPERM, always while the file is open), so "Replace" did not actually work there. The overwrite path no longer renames onto an occupied name: 1. the current file is moved aside to a transfer-unique sibling (`<dest>.<transferId>.termix-replaced`) - renaming to a fresh name is safe on every platform; 2. the partial is published exclusively under the now-free name (the same `link` / `COPYFILE_EXCL` primitive the non-overwrite path uses); 3. the aside copy is deleted (retried once; if another process still holds it open on Windows it is left in place and logged rather than failing the transfer). Failure handling preserves the original: if step 1 fails (file in use) nothing has changed and the caller gets `EBUSY`; if step 2 fails the aside copy is moved back under its name and the error propagates. Replacing a folder with a file is refused with `EISDIR`; a destination that vanished mid-transfer falls back to the exclusive publish. The publish primitives take their filesystem operations as an injectable `publishFs` (default: real fs), and the tests drive them with a Windows-like fs whose rename() refuses to overwrite - so the strategy is verified without relying on POSIX rename-over-existing semantics: successful swap with no rename ever targeting an occupied name, original restored byte-for-byte when publishing fails, EBUSY with nothing touched when the file cannot be moved aside, EISDIR for folders, vanished destination, and the end-to-end overwrite through the download handler. --------- Co-authored-by: Max <maxim@cogitate.ai> * chore: update package lock * feat(file-manager): Termius-style Local | Remote dual pane with drag-and-drop transfers (desktop) Renderer side of the dual-pane file manager, built on the local filesystem bridge added in the previous PR. Desktop app only; the web build is unchanged (the toggle is hidden when `window.electronAPI.localFs` is absent). - New Local pane (LocalFilePane) next to the remote grid, toggled from the toolbar (Laptop icon); path, visibility and width are remembered in localStorage (`termix:file-manager:local-pane:*`). Grid and list views, hidden files toggle, breadcrumb navigation, New Folder. - Drag files/folders from the Local pane onto the remote grid to upload, and from the remote grid onto the Local pane to download. Both directions stream through the main process (`useLocalTransfers`) with a single progress toast per batch (speed, ETA, cancel). Finder drops onto the remote grid keep working as before. - Collision policy for downloads: destinations are checked first; if any exist the user is asked Replace / Skip for the batch. Skip, dismiss and timeout all mean skip - nothing is ever replaced without an explicit click, and the main process enforces the same rule (`EEXIST` unless `overwrite` is set). - Drag MIME contract: `application/x-termix-local-files` for local drags, `application/x-termix-remote-files` marker on the remote grid's internal drags, so each pane can tell the two apart from Finder drops. - Transfer targets are described as `{ origin, route, deviceId }` (`getSessionOrigin` in main-axios) - the renderer never hands the main process a URL. - i18n: new `fileManager.local*` keys in en.json only (other locales via Crowdin). - Tests: LocalFilePane rendering/navigation, local-transfer-utils (relative-path planning, size formatting). - Modified column uses the same `Mon DD HH:MM` / `Mon DD YYYY` (ls -l style) format as the remote grid, so both panes read alike. * docs: point security note to the docs root (old /security page is gone) (#1400) * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * chore: sync Crowdin translations * Add Hetzner logo and referral link to README Added Hetzner logo with a referral link to README. * Fix Hetzner logo URL in README.md * docs: point security note to the feature security page The old /security page is gone and the docs root redirects to /install/, which loses the encryption context the sentence promises. Point the per-user secret and database encryption note at the canonical docs.termix.site/features/authentication/security/ page instead. Applied across all README locales. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ssmurfgg04-gif <232103099+ssmurfgg04-gif@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * fix: use i18n for host status tooltip labels (#1403) * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * chore: sync Crowdin translations * fix: use i18n for host status tooltip labels (#1265) * fix: add missing hosts.status.* locale keys (fixes #1265) * fix: add hosts.status.* translation keys for i18n tooltip The buildStatusTooltip function calls t("hosts.status.available"), t("hosts.status.reachable"), t("hosts.status.offline"), and t("hosts.status.monitoringDisabled"), but the locale file only had "status": "Status" as a flat string. Replaced with a status object containing all four keys plus a "label" key preserving the original "Status" string. * fix: restore final newline in en.json Requested by ZacharyZcR in review feedback. * test: assert translated labels in buildStatusTooltip Per review feedback from ZacharyZcR: add focused tests that exercise buildStatusTooltip with a translator and assert the rendered labels rather than key paths. Covers all three status values, monitoring disabled, protocol list, and the no-key-path regression guard. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * fix(workspaces): fall back when randomUUID is unavailable (#1397) * fix(terminal): preserve macOS Alt digit characters (#1398) * fix(ssh): verify resolved server host identity (#1419) * fix: add principals to Termix ID certificates (#1421) * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * chore: sync Crowdin translations * Add Hetzner logo and referral link to README Added Hetzner logo with a referral link to README. * Fix Hetzner logo URL in README.md * chore: pull sponsor logos from the docs site * fix: add principals to Termix ID certificates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * fix(deps): resolve transitive security advisories (#1412) * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * chore: sync Crowdin translations * Add Hetzner logo and referral link to README Added Hetzner logo with a referral link to README. * Fix Hetzner logo URL in README.md * chore: pull sponsor logos from the docs site * fix(deps): resolve transitive security advisories --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> * fix(sync): map nested host parent references (#1418) * fix(metrics): surface SSH host key changes (#1404) * fix(guacamole): coalesce VNC wheel floods and label meta keys by device (#1385) High-latency proxies like Cloudflare queue guacamole-common-js scroll clicks so the desktop keeps crawling after the user stops. Cap in-flight wheel buttons, and show Super/Cmd in the VNC toolbar on non-Windows clients. Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * fix(file-manager): keep downloaded files inside the selected local folder Remote file names were turned into local destinations by splitting the relative remote path on "/" and concatenating each name with the platform separator. A POSIX file name may contain "\", ":" or end in a dot, so on Windows a remote "..\outside.txt" downloaded into C:\Downloads\selected was normalised to C:\Downloads\outside.txt - outside the folder the user picked, even with overwrite disabled. The main process only normalised destPath and never checked it against the selected root. Two independent layers now enforce containment: Renderer (local-transfer-utils.ts) - `assertSafeLocalComponent(name, separator)` validates each remote path component for the destination platform: never empty, "." or "..", never "/" or NUL; on Windows (separator "\") additionally no "\ : * ? " < > |", no control characters, no trailing dot/space, no reserved device names (CON, NUL, COM1...). Backslashes stay legal on macOS/Linux, where they are ordinary file-name characters and the result remains inside the folder. - `buildLocalDestination(localDir, relativePath, separator)` joins the validated components and asserts the result is strictly under localDir (case-insensitive on Windows). - useLocalTransfers builds every file and directory destination through it. Items that fail are skipped before any filesystem call and reported ("Skipped N item(s) whose names cannot be used on this computer"). Main process (electron/local-files.cjs) - `assertWithinRoot(rootPath, candidate, pathImpl)` resolves + normalises both paths and refuses anything that is the root itself, escapes it (".." after normalisation), is absolute relative to it (another drive, UNC) or contains empty/".." segments. `pathImpl` is injectable so the Windows rules run in tests on any OS. - downloadToLocal requires `rootPath` (the selected folder) and checks the destination before the request is made or any file is created; the ensure-dir handler applies the same check when a root is passed (used for the directory skeleton of downloaded trees). - LocalDownloadRequest / downloadSessionFileToLocal / ensureLocalDirectory carry the root. Tests - Renderer: ordinary nested folders on Windows; backslash traversal in a POSIX name; absolute, drive-qualified and UNC names; reserved names, trailing dots/spaces, control chars; POSIX traversal rejected while a POSIX-legal backslash name is kept inside the folder. - Main process (path.win32): nested destinations accepted incl. case differences; "selected\..\outside.txt" refused; other drive / UNC / sibling folder refused; missing root refused; end-to-end handler test that a POSIX "../outside.txt" download and an escaping ensure-dir are refused before any network traffic or disk write. * feat(file-manager): right-click context menu for the local pane Mirrors the remote grid's menu for the user's own disk. On an entry (or the current multi-selection): Open / Open folder, Upload to server, Reveal in Finder/Explorer, Rename (inline, F2), Copy Path, Move to Trash (confirmation toast, Del). On the background: New Folder, New File, Reveal, Show/Hide hidden files, Refresh (F5). Enter opens, Cmd/Ctrl+A selects all, Escape clears the selection. Deletion goes through shell.trashItem so it lands in the OS Trash and is recoverable; rename and create refuse names containing path separators and never overwrite an existing entry. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): resizable list-view columns in both panes Drag the boundary at the left edge of a column header (Modified, Owner, Size, Permissions on the remote grid; Modified, Size, Kind in the local pane) to change its width; the Name column takes whatever is left. Double-click a handle to reset that column. Widths are remembered per pane in localStorage. Finishing a drag over a sortable header no longer toggles the sort. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): pinned ".." parent entry in both panes Both the remote grid (list, grid and empty-folder states) and the local pane show a Termius-style ".." row pinned above the entries whenever the current folder has a parent. Double-clicking it goes up one level. It is also a drop target: local files dropped on it upload into the parent folder, remote rows dragged onto it move there, and remote items dropped on the local pane's ".." download into the parent folder. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): show/hide list-view columns from the header Right-click a list-view header (remote grid or local pane) to open a Columns menu and tick/untick Modified, Owner, Size, Permissions (remote) or Modified, Size, Kind (local). Hidden columns leave the grid template entirely so the Name column gets the space back; at least one optional column always stays on. The choice is remembered per pane alongside the column widths. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): sidebar toggle works on desktop too The toolbar's sidebar button now shows/hides the directories panel on desktop (persisted), while below md it still opens the mobile overlay. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): resizable directories sidebar The Trash/Directories sidebar can now be resized by dragging its right edge (160px minimum, up to 40% of the row); double-click the handle to restore the default 224px. The width is remembered. The same handle and persisted-width hook now also drive the local pane divider, replacing the inline implementation. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * fix(metrics): support macOS/WIN hosts in stats collection (#1430) * fix(metrics): support macOS hosts in stats collection Host metrics collectors only ever ran Linux commands (/proc/*, ip, GNU df flags), so any macOS host always reported 0%/null for cpu, memory, uptime, network and disk. Detect the host platform once per poll and use vm_stat, sysctl, top, ifconfig and netstat on Darwin hosts instead. * fix(metrics): support Windows hosts in stats collection RDP/VNC hosts running Windows hit the same problem as macOS did: no /proc, no BSD tools, not even uname. Route CPU, memory, uptime, network and disk through PowerShell (WMI/CIM) when the host is detected as Windows, using -EncodedCommand so there's no cmd.exe quoting to fight with. * fix(metrics): use real macOS df/mount for disk collection BSD df's -T flag filters by filesystem type instead of printing one like GNU df does, so the previous macOS disk path was still running a GNU-only command and coming back empty. Now uses df -Pk plus mount output to build the filesystem type/percent list, filtering out the noisy APFS system volumes and devfs/autofs mounts. Verified on an M4 MacBook running the latest macOS - disk usage now reports correctly. * feat(file-manager): Termius-style Local | Remote dual pane with drag-and-drop transfers (desktop) (#1413) Integrate the reviewed change and its maintainer fixes into dev-2.8.0. Validated with focused regression tests, type-check, lint, formatting, build, and the PR Check database jobs. * fix(terminal): persist Ctrl+/- font zoom so it survives option refreshes (#1399) Integrate the reviewed change and its maintainer fixes into dev-2.8.0. Validated with focused regression tests, type-check, lint, formatting, build, and the PR Check database jobs. * Fix macOS terminal packaging and keyboard shortcuts. (#1417) Integrate the reviewed change and its maintainer fixes into dev-2.8.0. Validated with focused regression tests, type-check, lint, formatting, build, and the PR Check database jobs. * fix(auth): skip TOTP only after verified WebAuthn user verification (#1420) Integrate the reviewed change and its maintainer fixes into dev-2.8.0. Validated with focused regression tests, type-check, lint, formatting, build, and the PR Check database jobs. * feat(hosts): add per-host Web Endpoints (direct or SSH-tunnelled web UIs) (#1416) * test: provide an in-memory localStorage for the vitest environment jsdom in this project ships without a localStorage global, so every suite that touched storage threw "Cannot read properties of undefined" during setup and failed wholesale -- 119 tests across 15 files, none of them actual product defects. Node only supplies localStorage with --localstorage-file, which persists to disk and is shared across test files. A per-process in-memory Storage is what tests want, so define one (plus sessionStorage) when the global is absent, alongside the existing matchMedia shim. Full suite goes from 15 failed files / 119 failed tests to 400 files and 2888 tests passing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fdjjsdaz6aFMyJr4h3Y6qj * feat(web-endpoints): add endpoint types and URL resolution First step of per-host Web Endpoints: a host declares web UIs it serves and opens them either directly at the host's address or through an SSH forward Termix establishes on demand. This commit is pure logic with no I/O, so it needs no mocks to test. resolveWebEndpointUrl expects an already-normalized path -- normalization is the storage boundary's job (a later commit), and duplicating it here would invite the two copies to drift. separatedTunnelHost is the one part that is a security control rather than a convenience. Cookies are keyed by host and ignore the port, and SameSite computes "site" as scheme + registrable domain -- also ignoring the port. A forward reached at the host string serving Termix is therefore same-site with Termix, which leaks the session both ways: the framed service receives the jwt cookie, and a Set-Cookie it returns lands in the jar Termix's own API calls read from. So a tunnel URL resolves to a different loopback spelling than the page's, and refuses outright when no alias exists. Only loopback literals qualify -- a same-registrable-domain alias could still answer Set-Cookie with a Domain attribute that reaches Termix. The cookie-separation tests were verified to fail against a resolver that returns the page host (4 failures), so they cannot pass vacuously. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(web-endpoints): validate and normalize endpoint config normalizeWebEndpoints is the enforcement point for values that reach an href and an iframe src, so the editor's constraints are UX rather than security. It drops any row it refuses instead of rejecting the whole host -- one bad endpoint must not make a host unsaveable or unlistable. Paths are checked for C0 controls and DEL by codepoint rather than by regex character class: "\t//evil.example" defeats a startsWith("//") guard, because the browser strips the control character and then follows the authority. bindHost lands both in a TCP listener and in a URL authority, so it is restricted to a bare host literal -- nothing carrying a scheme, port, path or credentials survives. bindHost and localPort are ignored on a direct endpoint, which never creates a forward. parseWebUiConfig never throws. A malformed stored value yields an empty endpoint list, so a half-written config cannot take out the whole host listing -- which is what dockerConfig's bare JSON.parse does today. The editor validator is a second implementation in a layer that cannot import backend route modules. Its accompanying test runs BOTH implementations over the same path and port samples, because drift here is invisible in the worst way: the editor accepts a row, the normalizer silently drops it, and the endpoint disappears on reload with no error. That agreement test was verified to fail (4 cases) when the editor's control-character check is removed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): migrate the shared_credential_secrets foreign key rename Running `npm run schema:migrations` on an UNCHANGED schema emits these, so they are pre-existing drift between schema.ts and drizzle/, not something this branch introduced. Landing them alone, before the web-endpoint columns, so the feature's own migration is reviewable without an unrelated table rebuild sitting in the middle of it. Both forms are a foreign-key constraint rename only. Postgres drops and re-adds the constraint under a shorter name. SQLite has no ALTER for that, so drizzle emits the standard table rebuild -- verified data-preserving: CREATE lists 14 columns, INSERT...SELECT copies the same 14 in the same order, and both indexes are recreated. The SQLite file is in practice dead code: runRemoteMigrations throws for sqlite, which builds its schema from db/index.ts instead. It is kept rather than hand-trimmed because drizzle derives the meta snapshot from schema.ts regardless, so trimming the .sql while the snapshot advances would make the drift permanently invisible -- no future `generate` would re-emit it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(db): add enable_web_ui and web_ui_config columns Two columns on ssh_data mirroring the Docker pair. No show_web_ui_in_sidebar: every existing showXInSidebar column is vestigial -- they appear only in defaults, the export payload and tests, and gate no rendering -- so a fourth dead column plus a migration buys nothing. web_ui_config stores an object rather than a bare array so host-level web settings can be added later without a second migration. The column has to be declared in FOUR places, not one. SQLite never runs the drizzle migrations at all (runRemoteMigrations throws for sqlite), so the live default-dialect schema comes from hand-written DDL: 1. db/schema.ts, then the two generated dialect schemas and the migrations 2. db/index.ts CREATE TABLE -- fresh databases 3. db/index.ts addColumnIfNotExists -- existing databases 4. database.ts CREATE TABLE and its positional INSERT -- encrypted export Missing 2 or 3 breaks every host write on the default dialect while the migration file sits there looking correct. Two guards, both watched failing first. bootstrap-matches-schema-columns boots a real database and compares PRAGMA table_info against the drizzle definition for every table -- it reported ssh_data.enable_web_ui and ssh_data.web_ui_config missing before item 2/3 landed. A grep-based guard could not: db/index.ts names columns as snake_case strings, never the camelCase the schema uses. export-ddl-matches-schema-columns covers database.ts, which no booted database reaches. It caught a real defect while being written: the two new columns went into the INSERT list but the VALUES list still held 53 placeholders for 55 columns. Being positional, that shifts every later value by one. The placeholder-count assertion is now permanent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(hosts): thread web endpoint config through host read and write paths A host field has to be enumerated by hand in nine places here, and "added a column, missed one update path" is this codebase's most repeated bug -- during the first attempt at this feature a field was missed at one of these points six separate times, each surfacing as a different mystery: endpoints that saved but never appeared, config that vanished on reload. Backend: host-normalizers (input type, CONNECT_LEVEL_FIELDS, boolean normalization, parse block), host.ts (create, update, both read paths, quick-connect defaults), host-bulk-routes (bulk update, import, reset). Renderer: host-export-payload, HostManagerData's sshHostToHost, tabUtils' hostToSSHHost, HostEditorData's form seed and payload builder. The three renderer mappers copy field by field, so an unlisted field is silently dropped -- which is how endpoints saved correctly and never appeared. webUiConfig is parsed with parseWebUiConfig rather than a bare JSON.parse. dockerConfig on the adjacent line uses a bare one, so a single malformed value takes out the whole host listing; that is a bug to avoid copying, not a convention to follow. All three write paths now clear webUiConfig when the feature is disabled. They disagreed before, and the export payload ships the config unconditionally -- so a host disabled without clearing still exported its endpoint list (internal hostnames, ports, paths) while the UI read as off, and re-enabling resurrected stale endpoints. webUiConfig is shared with connect-level recipients, unlike dockerConfig. A connect-level recipient is already authorized to open these tunnels, so withholding the config only breaks discovery while the flag advertises the feature. Docker's precedent does not transfer: its tab works without its config, whereas a web endpoint IS its config. The enumeration guard asserts every one of the nine files mentions the web endpoint field beside its Docker counterpart, and checks the Docker anchor is present too so it cannot pass vacuously if a file is restructured. The clear-on-disable assertion was rewritten after the first version passed with the guard deleted -- a loose regex matched unrelated sites. Both halves are now anchored on exact text and were watched failing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(tunnel): report the real bound port, support idle close, reserve web: Three changes the web endpoint open route depends on, plus the name reservation that makes the scheme safe. Real bound port. Under sourcePort 0 the kernel assigns the port, but the runtime recorded the requested value -- so it advertised 0 and any caller reusing it failed. It now records tcpServer.address().port. Idle close, behind the new tunnelConfig.idleTimeoutMs. Web endpoint tunnels are opened on demand and must not outlive their use. The timer lives inside establishDirectTunnel because the socket set is only visible from that closure, polls at min(30s, timeout) so "empty for N" means roughly that rather than "empty at the instant of one N-spaced tick", and unrefs so it cannot hold the process open. It calls cleanupTunnelResources rather than close(): close() stops the listener but leaves the entry in activeTunnelRuntimes, so the open route would keep handing out a port nothing is listening on. Reserved names skip retry. handleDisconnect returns early for a "web:" name after a forced cleanup. maxRetries: 0 would NOT achieve this -- the retry path reads `maxRetries || 3`, so 0 falls through to 3. The cleanup is forced because cleanupTunnelResources no-ops while tunnelConnecting holds the name, and a web tunnel has no retry pass to self-heal a leaked runtime. That early return carries an identity guard, which is the subtle one. sourceClient.end() only STARTS an async teardown, so the SSH "close" event lands after a reopen may already have registered a NEW runtime under the same name. Acting by name alone would tear down the successor rather than the stale tunnel -- surfacing as a 200 with a good port followed by a silent connection reset and no error anywhere. handleDisconnect now takes the closing Client and returns early when the registered runtime belongs to someone else. The idle timer carries the same guard for the same reason. /ssh/tunnel/connect now rejects a user-supplied "web:" name with 400. validateTunnelConfig is no defence here: it returns true unconditionally for any name that is not the legacy 6-part format, so an authenticated user could otherwise create a real retry-configured tunnel that collides with a live web endpoint forward and silently loses its own reconnect behaviour. The manager tests run against a real TCP listener and real timers -- mixing fake timers with real socket I/O is a known route to a hanging test. Both were watched failing: reverting the bound port fails the port test, and swapping cleanupTunnelResources for close() fails the idle test, which asserts the ENTRY is gone rather than merely that the listener stopped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(tunnel): add the web endpoint open route POST /ssh/tunnel/web-endpoint/open { hostId, endpointId } -> { port }. The host is resolved through the user-scoped resolveHostById, so an authenticated user cannot obtain a forward to a host id they do not own. The endpoint is re-normalized out of storage rather than trusted: the stored value predates any later tightening of the rules, and this is what a forward gets built from. An enabled flag is required as well as a present endpoint -- a bulk update that sends only { webUiConfig } can leave a configured endpoint on a host whose UI reads as off everywhere. Not gated to the desktop. The forward binds wherever this backend runs, as the server tunnels feature does, and the endpoint's own bindHost decides whether that is reachable from a browser. endpointHost: "127.0.0.1" is load-bearing, not cosmetic. connectSSHTunnel picks its strategy via shouldEstablishDirectTunnel -> isSingleHostTunnel, which keys on endpointHost -- setting only targetHost selects a different path and the forward never binds locally. connectSSHTunnel never rejects, and its promise resolves right after conn.connect() -- long before the SSH "ready" event populates activeTunnelRuntimes. Awaited is not connected, so waitForTunnelSettled polls the maps the manager already exports. Polling rather than adding a promise-returning variant: every existing caller is fire-and-forget by design, and changing that contract for one new caller is the larger blast radius. A probe forwardOut runs before returning 200. Without it the route succeeds the moment listen() does, and forwardOut is only attempted per inbound socket where failure is swallowed -- so the likeliest real error, nothing listening on the endpoint's port, reached the user as a blank frame and no message. Staleness is validated at open, never on save: host save lives in the database service and the runtimes live in the tunnel service, with no push between them. On reuse the route compares a fingerprint covering the endpoint's target AND the host's SSH identity, and reopens when it differs. An absent fingerprint means reuse, not staleness -- a reserved-prefixed runtime can only have been created here. Deletion, disabling and host removal then need no handling: nothing reopens the tunnel, so it idles out. Also closes an authorization gap this feature would otherwise have created. /ssh/tunnel/disconnect and /ssh/tunnel/cancel checked ownership only inside `if (config && config.sourceHostId)`, and web tunnels are deliberately absent from tunnelConfigs -- so the check never ran for them. Host ids are small sequential integers and endpoint ids are client-supplied, so the name is guessable and any authenticated user could force-close another user's tunnel. authorizeTunnelAction recovers the host id from the name and fails closed when it cannot; the tests were watched failing against the old behaviour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(hosts): add the web endpoint client and per-origin certificate allowance The client posts a path relative to tunnelApi's base, which already includes /ssh -- a leading "/ssh" here resolves to /ssh/ssh/... and 404s on every call. The test asserts that on the captured runtime argument rather than by scanning source, so quoting style and indirection cannot fool it. Backend error messages are preserved rather than collapsed. 502 is this route's likeliest real failure and carries the actionable cause -- SSH auth rejected, host unreachable, nothing listening on the target port -- and handleApiError would replace all three with "Server error occurred". It stays as the fallback for bodies that carry no string reason, so a body shaped { error: <object> } cannot reach the user as "[object Object]". openWebEndpointExternally applies the same refusal gate as the embedded tab. Opening in the real browser is not the safer path: the cookie jar is the browser's either way, so a tunnel URL on the page's own host string leaks the session exactly as a frame would. The refusal happens before the forward is opened -- binding the port and then declining to navigate would be no protection. Certificate allowance covers the one case Electron's existing handling misses: direct access to a HOSTNAME over https. isPrivateNetworkHost matches IP literals only and sshData.ip has no IP validation, so https://nas.local:8006 fails the check and renders blank inside an iframe with no click-through -- Chromium offers no proceed option for subframes. Three properties of that allowance are deliberate and now pinned by tests, because each would otherwise be undone by a reasonable-looking simplification: - it is NOT wired into isInvalidCertificateAllowedForUrl, which also governs this process's own outbound TLS via getTlsVerificationOptions; - it is https-only, in both the check and the IPC handler, since a non-TLS origin in a TLS-error allowlist is meaningless and file:/ftp: must never be storable; and - entries carry a five-minute TTL refreshed on each registration. Main has no host-database access and cannot verify the renderer's claim that an origin is a configured endpoint, so the residual risk has to be a momentary window rather than one lasting until the app restarts. The handler stores the parsed origin, never the caller's string, so a path or wildcard cannot widen the allowance. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(hosts): add the Web UI editor tab Mounted as a Web UI sub-tab inside the SSH group, beside Docker, Tunnels, Files and Host Metrics, and laid out as two SectionCards following the tunnels editor: settings first, then the list it governs. There is a deliberate asymmetry with the sidebar here. The sidebar entry will appear on enableWebUi alone, because a direct endpoint needs no SSH -- but Web UI is an SSH sub-tab, so a host with SSH disabled cannot configure endpoints at all. That is the accepted behaviour and both halves are pinned by tests, so neither gets "fixed" into agreement later. tunnelAvailable is enableSsh && originIsLocal, resolved inside HostWebUiTab rather than in HostEditor.tsx, which is already ~2600 lines. It is NOT gated on isElectron(): the forward binds wherever the backend runs, exactly as the server tunnels feature does. resolveConnectionOrigin is called with connectionType "ssh" deliberately -- a tunnel endpoint always rides SSH, and "ssh" avoids the guacamole special case that forces "remote" for RDP/VNC/Telnet. Three input details that each prevent a silent data loss: - the id generator falls back off crypto.randomUUID, which is undefined outside a secure context -- a plain-http web deployment is a first-class target for direct+external and would otherwise throw on "Add endpoint"; - a new row gets a de-duplicated label, since labels are what identify an endpoint in the sidebar picker; and - the port field commits only a value the normalizer would keep. Number("") is 0, which the normalizer rejects, so clearing the field would otherwise write an endpoint that vanishes on save with no error. The tunnel fields carry three warnings: a non-loopback bind exposes the target's web UI unauthenticated to anyone who can reach the port; a loopback bind on a remote backend cannot be reached from a browser at all; and a tunnel reached at Termix's own hostname would hand the tunnelled service this session. All three are shown while configuring rather than only when the tab fails to load. The unavailable-tunnel reason is shown whenever tunnelling is unavailable, not only once a row asks for it -- a disabled dropdown option with no stated reason reads as the control being broken. Copy is reused verbatim from the previous iteration's reviewed strings rather than reworded. One test was written and then removed rather than kept: its name promised that switching to tunnel access clears ignoreCert, but Radix Select needs pointer APIs jsdom lacks, so the body only asserted the control existed. The clearing is covered where it is enforced, in the normalizer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(hosts): open web endpoints from the sidebar and in a tab One sidebar entry per host, never one per endpoint: a host may declare up to 16, and a row of 16 identical globes is unusable. With a single endpoint the entry wears its label and acts directly; with several it carries no endpointId and the click opens a picker -- a DropdownMenu in the tray, a DropdownMenuSub in the Connect submenu. The entry is gated on enableWebUi ALONE, unlike every neighbouring action, which requires enableSsh. A direct endpoint needs no SSH; SSH matters only per-endpoint, for tunnel access, which the open route enforces. openTab gains a fourth optional parameter rather than overloading `restore`, which means something else. What was actually broken for two endpoints on one host was the LABEL -- tab ids are already `${name}-${type}-${Date.now()}`, so they never collided. All existing call sites keep working. The tab is passed the endpoint ID, not the endpoint object, so one deleted while its tab is open renders a plain message instead of throwing. Reload re-resolves and REMOUNTS. A direct endpoint's URL never changes and a live tunnel returns the same port on every open, so setUrl(resolved) would be a same-value setState that React bails out of, leaving the frame untouched -- Reload would silently do nothing in the two most common cases. A generation counter folded into the iframe key fixes that and doubles as the staleness guard for two resolutions landing out of order. The test captures the DOM node before and after, and was watched failing against a url-only key. PERSISTENT_TAB_TYPES is hoisted to module scope and exported so it can be asserted on -- it was a local const inside the component and therefore untestable. web-endpoint is deliberately excluded: an idle tunnel re-binds a fresh kernel-assigned port, so a restored tab could never hold a valid URL. Two notes on verification. `tsc -p tsconfig.json` passes vacuously in this repo -- tsconfig.json is a solution file with project references and does nothing without -b -- so `npm run type-check` (tsc -b --force) is the real check; it caught two insertions that had landed in the wrong function. And the one full-suite failure seen along the way was vault-signer-core, which passes in isolation and on re-run, is untouched by this branch, and is a flake under parallel load. Lint: 0 errors, 102 warnings, identical to the baseline on a clean tree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(tunnel): register the web endpoint route under its /ssh path Every route in routes.ts registers the full "/ssh/tunnel/..." path -- nginx proxies /ssh through with the path intact -- and the client resolves "/tunnel/web-endpoint/open" against a baseURL that already ends in /ssh. The unprefixed registration therefore 404'd every call. No handler unit test could catch this: they call handleWebEndpointOpen directly and never touch registration. It surfaced only on opening a real tunnel against a deployed build, which is why that step exists. Added a registration test that captures the paths passed to app.post, so the invariant is checked without needing a server. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(hosts): apply session-cookie isolation to direct web endpoints The cookie guard only covered tunnel access. `unreachableTunnelReason` returned null for every `access: direct` endpoint, so WebEndpointTab framed the host's own address unconditionally. With Termix served at https://termix.example/ and a direct endpoint at https://termix.example:8443/, the browser attaches Termix's `jwt` to the framed request -- cookies are keyed by host and ignore the port -- and a `Set-Cookie` from that service lands in the jar both auth middlewares read before the Authorization header. Renames the helper to `webEndpointRefusalReason` so its scope is no longer tunnel-only, and gives it the endpoint's target host. A direct endpoint is now refused in a browser when that host shares Termix's cookie site, checked BEFORE any navigation in both open paths (embedded tab and external window) -- refusing after framing would leak on the first request. `sharesCookieSiteWithPage` treats an equal host as same-site (the jwt is set host-only, so the port is irrelevant) and also a parent/sub domain, which a `Set-Cookie: Domain=` from the target crosses. The suffix test is anchored on a dot boundary so `eviltermix.example` does not pass as `termix.example`. A precise eTLD+1 test would also catch sibling subdomains, but needs a public suffix list this app does not bundle. The desktop stays exempt: its session is Bearer-only with no `jwt` in the jar. Also drops "or change this endpoint to Direct" from the tunnel refusal copy, which pointed at the path that had this same leak. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * fix(tunnel): preserve local status when remote names collide (#1431) * fix(desktop): honor remote sync certificate setting (#1432) * fix(file-manager): interpolate preview download filename (#1433) * fix(automations): dispatch SSH login events to triggers (#1434) * fix(hosts): preserve imported settings and remap jump hosts (#1435) * fix(hosts): preserve terminal switches across JSON transfer * fix(hosts): remap imported jump-host dependencies * fix(ssh): preserve agent framing after unsupported extensions (#1436) * fix(guacamole): return tokens before awaiting the client handshake (#1437) * fix(sidebar): unmount the host tree while its panel is hidden (#1438) * fix(terminal): leave macOS Option characters enabled by default (#1439) * fix(dashboard): open the enabled remote desktop protocol (#1440) * fix(version): preserve local version when update checks fail (#1441) * fix(sftp): create uploaded directories without shell access (#1442) * fix(desktop): honor explicit GPU acceleration opt-out (#1443) * fix(desktop): exclude remote-only host IDs from local tab persistence (#1444) * Enhance SFTP and terminal flows, stabilize desktop sync (#1377) * feat: add electron sftp c2s and terminal ai flows * fix: stabilize desktop sync and c2s tunnels * Improve remote tunnels and SFTP transfer feedback * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * test(sftp): verify local collection limit boundaries --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * chore: increment ver * fix: allow any origin by default when CORS_ALLOWED_ORIGINS is unset * feat(file-manager): parallel local transfers (#1446) Uploads from the Local pane (and downloads to it) ran strictly one file after another. Batches of many small files were bound by per-file latency rather than bandwidth. - `runWithConcurrency(items, limit, worker, shouldStop)`: a bounded worker pool that dispatches in order, keeps at most `limit` transfers in flight, and stops dispatching once cancelled while letting in-flight items finish. Worker errors are handled by the worker (one failure never aborts the batch). - useLocalTransfers: both directions go through the pool. Remote / local directory skeletons are still created up front, so file order does not matter. The batch runner now tracks a set of in-flight transfer ids (Cancel cancels all of them), sums bytes across in-flight transfers plus settled ones for the progress bar / speed, and shows how many files are moving at once. - New preference "Simultaneous File Transfers" (1-8, default 4) in the profile settings, stored in localStorage (`termix:file-manager:transfer-concurrency`) and part of the storage snapshot. 1 restores the previous sequential behaviour; the hint suggests lowering it for servers that limit SFTP channels. - Remote directories are created with the now-idempotent mkdir (#1442) without swallowing its errors, so a real failure stops the batch up front instead of surfacing as N per-file failures. When files do fail, the summary toast carries the first underlying reason (e.g. the backend's 401 message) instead of a bare "Upload failed". - Tests: pool never exceeds the limit and drains everything, stops on cancel, tolerates a failing item, handles empty input; preference clamping and persistence; bridge-level concurrent uploads/downloads with a mid-flight cancel leave every other file intact and no partials. Co-authored-by: Max <maxim@cogitate.ai> * fix(sftp): complete streamed uploads and stop pre-parsing chunk bodies * fix(desktop): stop setting Content-Length on local download requests * fix(file-manager): keep drop overlays in view when the list is scrolled * fix(file-manager): let remote rows be dropped on the local pane * fix(desktop): authenticate local transfers with the renderer's token * chore: update release notes * chore: remove unused gitlab ci and argocd deploy configs * chore: remove unused files * feat: improve loading animation * fix(shell): stop tab reorder from resetting terminals and tab indicator Keep the tab-content portal order stable so reordering tabs doesn't retrigger React's offscreen pass and dispose live terminals. Also stop the active tab indicator from teleporting during a drag, and fix the drag ghost's size/border mismatch. * fix(shell): hand-roll the tab indicator instead of a shared layoutId Framer's layoutId could measure the wrong tab's rect during a reorder and land on an inactive tab, or leave a stray line visible mid-drag. Now it reads the active tab's own DOM rect directly and hides while dragging. * fix(hosts): fix right-click menu position and unwanted tray expand * chore: update release notes * fix(terminal): stop autosuggestion ghost text overlapping typed input Position was computed from cursorX before server echo landed, causing a stale read that overlapped just-typed characters on fast local input. * chore: update release notes for v2.8.0 * fix(sftp): rebuild transfer tab for web, fix menu offset bug Drop the electron-only local mode and dead code, i18n all strings, fix double progress toasts and a wrong pane refresh on move. Fix context menus rendering offset due to a lingering CSS transform from the tab-switch animation. Move SFTP next to SSH Tools in the rail. * fix(file-manager): shrink oversized .. entry, navigate on single click * fix: make select2 component use rounded corners * fix: rebuild terminal AI assistant on the real backend Removes the Electron-only Agent Mode/AI Command Helper that bypassed admin/user gating and ran commands with no approval step. Replaces it with a terminal-docked panel on the same gated backend as the AI tab, adds a per-host toggle (off by default), moves it into the toolbar, and fixes proposal ordering and run-in-terminal execution. * fix(file-manager): remove duplicate borders in toolbar view toggle Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: separate registration toggle from step ca settings * fix: collab room bugs and add room deletion Accent-colored new room button, fix fullscreen guest view layout and duplicate view-only badges, self-heal stale presenter state, add delete room for persistent rooms. * refactor: move host-identity helpers to hosts core Used by docker, file-manager, and terminal alike, so it belongs at the hosts root instead of under terminal/. * refactor: move host-session-status singleton to hosts core metrics subscribed to terminal's private online/offline pub-sub module. Moved to hosts core so both sides depend on a shared module instead of metrics reaching into terminal. Marked the subscribe call with PLUGIN-EVENT for the future event bus. * refactor: split generic automation event notify out of metrics notifyAutomationInternalEvent was in hosts/metrics/automation-bridge.ts but is used by tunnel, host routes, user routes, and automations engine itself, not just metrics. Moved it to hosts/automation-events.ts so those callers depend on a shared module instead of metrics internals. Left the metrics-specific notifiers in place. * feat: add plugin system schema and repositories Adds plugins, plugin_permission_grants, plugin_registries, and plugin_install_counts tables plus their repositories. No routes or UI yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * feat: add runtime rail item and tab component registries for plugins * feat: support runtime-registered permission groups Adds register/unregister for plugin permission groups so the RBAC catalog and validation can grow beyond the static list. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * feat: add plugin-api nginx route and dispatcher stub * feat: add plugin manifest schema and validator * chore: update release notes * chore: update i18n for local/remote file manager * feat: add toggle to show/hide app rail pin button * feat(host-metrics): add NVIDIA GPU metrics card (#1452) * feat(host-metrics): add NVIDIA GPU metrics card Collect per-GPU utilization, VRAM, temperature, power, fan speed and the processes using each GPU over SSH with nvidia-smi. The collector exits immediately when nvidia-smi is missing, so hosts without a GPU pay almost nothing per poll. The GPU card is opt-in: it is available from the Add card tray but is not part of new-host defaults or any UI preset. It shows live sparklines for utilization and VRAM per GPU. Adaptive polling now also watches GPU readings and the GPU process count, so it no longer backs off on hosts where only the GPU is busy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F2ctuPwiesLzhF6XQiozm8 * fix(host-metrics): draw sparklines from the first metrics sample The first sample fetched when the tab connects was shown but never added to the sparkline history, so every sparkline (CPU, memory, disk, GPU) stayed empty until the second poll, a full metrics interval later (about 35 s with the default 30 s interval). Record the first sample like every later one, so the lines appear as soon as the tab loads. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F2ctuPwiesLzhF6XQiozm8 * Fix logical condition for memory percentage calculation Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: annotate local transfer plan type to fix CI type-check * fix: move connection toolbar settings to bottom of host editor general tab * chore: add debug logging for macOS sharp packaging failure Temporary diagnostic to find which phase drops @img/sharp-darwin-x64 from the packaged app. Revert once root cause is found. * fix: correct macOS sharp verify script for universal build layout electron-builder uses mergeASARs: false, so universal builds ship app-x64.asar.unpacked and app-arm64.asar.unpacked side by side instead of a single app.asar.unpacked. The verify script only checked the single-asar path, so it always failed on universal/mas artifacts even when packaging was correct. * fix: update sharp verify test fixtures for universal build layout The test built fake apps using the single app.asar.unpacked layout, which doesn't match how universal builds are actually packaged now (app-x64.asar.unpacked / app-arm64.asar.unpacked side by side). * chore: update readme * fix: guard against missing rooms array in collab list response * fix: distinct guac connection log stages, RDP black screen before failure * fix: proxy /collab routes in nginx configs * fix: stop tab-switch flash and host metrics/proxmox reconnect Tab DOM visibility now syncs before paint instead of after, and switching tabs no longer tears down live metrics connections. * fix: tab bar flashing, growing, and merged separators Terminal tabs no longer flash when switching, the enter animation no longer nudges layout size, and a stray transform on resting tabs no longer causes the border between tabs to vanish at some zoom levels. * fix: match select trigger height to inputs in web UI editor * chore: lint, format, and bump version to 2.8.0 * chore: sync Crowdin translations for 2.8.0 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: Angad Singh <7099405+singhangadin@users.noreply.github.com> Co-authored-by: Angad Singh <angad@singhangad.in> Co-authored-by: Neo <54811660+neooriginal@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Wali Lambert <98448225+YatoVoid@users.noreply.github.com> Co-authored-by: Nasif Rahman <44437976+nasif-naseef@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: vietanhtwdk <vietanhtruongwdk@gmail.com> Co-authored-by: inontz <inontz@icloud.com> Co-authored-by: inontz <inontz@users.noreply.github.com> Co-authored-by: Max Serov <133950708+maxser0v@users.noreply.github.com> Co-authored-by: Max <maxim@cogitate.ai> Co-authored-by: ssmurfgg04-gif <ssmurfgg04@gmail.com> Co-authored-by: ssmurfgg04-gif <232103099+ssmurfgg04-gif@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> Co-authored-by: slsgzs-cloud <slsgzs@gmail.com> Co-authored-by: anshtsolanki-sketch <anshtsolanki@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: tcezarl <tomescu.cezar.laurentiu@gmail.com> Co-authored-by: Anton Priestley <anton@priestley.me> Co-authored-by: Hakim M <hakimmarsudi@outlook.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Adel Alzubeir <14052842+Adelzu@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-10-28 06:05:24 +00:00 · 2026-09-20 14:56:39 -05:00
1 parent 9c04860821
commit fef8a5f28a
@@ -427,6 +427,7 @@ jobs:
          npm ci
          npm install --force @rollup/rollup-darwin-arm64
          npm install dmg-license
+          node scripts/install-macos-sharp.cjs

      - name: Check for Code Signing Certificates
        id: check_certs
@@ -538,6 +539,14 @@ jobs:
          fi
          npx electron-builder --mac dmg --universal --x64 --arm64 --publish never

+      - name: Verify macOS sharp packaging
+        run: |
+          artifacts=(release/termix_macos_*_dmg.dmg)
+          if [ -f release/termix_macos_universal_mas.pkg ]; then
+            artifacts+=(release/termix_macos_universal_mas.pkg)
+          fi
+          node scripts/verify-macos-sharp.cjs "${artifacts[@]}"
+
      - name: Upload macOS MAS PKG
        if: steps.check_certs.outputs.has_certs == 'true' && hashFiles('release/termix_macos_universal_mas.pkg') != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release' || inputs.artifact_destination == 'submit')
        uses: actions/upload-artifact@v7
@@ -923,6 +932,9 @@ jobs:
          echo "dmg_name=$DMG_NAME" >> $GITHUB_OUTPUT
          echo "checksum=$CHECKSUM" >> $GITHUB_OUTPUT

+      - name: Verify macOS sharp packaging
+        run: node scripts/verify-macos-sharp.cjs release_asset/termix_macos_universal_dmg.dmg
+
      - name: Prepare Homebrew submission files
        run: |
          VERSION="${{ steps.package-version.outputs.version }}"
@@ -1013,6 +1025,7 @@ jobs:
          npm ci
          npm install --force @rollup/rollup-darwin-arm64
          npm install dmg-license
+          node scripts/install-macos-sharp.cjs

      - name: Check for Code Signing Certificates
        id: check_certs
@@ -1154,6 +1167,10 @@ jobs:
          BUILD_VERSION="${{ steps.build_number.outputs.build_version || github.run_number }}"
          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"

+      - name: Verify macOS sharp packaging
+        if: steps.check_certs.outputs.has_certs == 'true'
+        run: node scripts/verify-macos-sharp.cjs release/termix_macos_universal_mas.pkg
+
      - name: Generate App Store release notes
        id: asc_notes
        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
@@ -5,13 +5,11 @@ on:
    paths:
      - "charts/**"
      - ".github/workflows/helm.yml"
-      - "deploy/**"
  push:
    branches: [main]
    paths:
      - "charts/**"
      - ".github/workflows/helm.yml"
-      - "deploy/**"
  workflow_dispatch:
    inputs:
      publish:
@@ -1,2 +0,0 @@
-include:
-  - local: deploy/gitlab/.gitlab-ci.yml
@@ -89,7 +89,7 @@ Local, remote, and dynamic SOCKS forwarding with auto reconnect and health check
 <td width="50%" valign="top">

 **File Manager:**
-Browse, edit, upload, download, rename, move, and delete files over SFTP, with sudo support. View and edit code, images, audio, and video. Copy files straight from one server to another, with the fastest route picked for you and transfers checked for integrity.
+Browse, edit, upload, download, rename, move, and delete files over SFTP, with sudo support. View and edit code, images, audio, and video. Copy files straight from one server to another in a dedicated transfer tab, with the fastest route picked for you and transfers checked for integrity. The desktop app also has a side-by-side local and remote view.

 </td>
 </tr>
@@ -111,7 +111,7 @@ Save and organize hosts with tags and nested folders you can name and color. Reu
 <td width="50%" valign="top">

 **Host Metrics:**
-CPU, memory, disk, network, temperature, uptime, processes, ports, logins, and system info on most Linux servers, with history graphs. Manager cards let you handle services, cron jobs, packages, users, firewall rules, WireGuard, Tailscale, SSL certs, logs, and health checks without leaving Termix.
+CPU, memory, disk, network, temperature, NVIDIA GPU, uptime, processes, ports, logins, and system info on most Linux servers, with history graphs. Manager cards let you handle services, cron jobs, packages, users, firewall rules, WireGuard, Tailscale, SSL certs, logs, and health checks without leaving Termix.

 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Save a set of tabs with their split layout and reopen the whole thing in one cli
 </td>
 <td width="50%" valign="top">

-**Guided Setup:**
-A short setup walks you through picking an interface preset, your theme, the features you want, and your first host. Simple mode hides what you do not use, and you can rerun setup or switch presets any time.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop Standalone and Sync:**
-The desktop app runs on its own with a local backend and database, no server needed. You can also connect it to a Termix server for two-way sync of hosts, credentials, snippets, and more, and choose whether connections start locally or through the server.
-
-</td>
-<td width="50%" valign="top">
-
 **Command Line Interface:**
 A `termix` CLI for your shell and your scripts. Open terminals, run a command on one host or a whole fleet, move files over SFTP, and manage hosts, snippets, and credentials. Install with `npm install -g @termix-cli/cli` or grab a standalone binary. See the [CLI docs](https://docs.termix.site/cli).

@@ -237,7 +223,7 @@ A `termix` CLI for your shell and your scripts. Open terminals, run a command on
 <td width="50%" valign="top">

 **Security:**
-Passwords, keys, and other secrets are encrypted per user, and the database files themselves can be encrypted on disk. See the [docs](https://docs.termix.site/security) for how it works.
+Passwords, keys, and other secrets are encrypted per user, and the database files themselves can be encrypted on disk. See the [docs](https://docs.termix.site/features/authentication/security/) for how it works.

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Around 30 languages built in, managed through [Crowdin](https://docs.termix.site
 - **Keyboard Shortcuts** - Move between tabs, close tabs, and more, all rebindable
 - **Wake-on-LAN** - Wake a machine from Termix or from an automation step
 - **Trusted Proxy Auth** - Let a reverse proxy handle sign-in and pass the user through
- **SSH Feature Rich** - Jump hosts, Warpgate, TOTP prompts, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, and more
+- **White Label** - Admins can rebrand the instance with their own name, logo, and colors
+- **Web Endpoints** - Open a host's own web UI, like a router admin page, embedded inside Termix instead of a separate tab
+- **Collaboration Rooms** - Persistent rooms where a group can jump between sessions together, with a presenter stage and invites
+- **SSH Feature Rich** - Jump hosts, Warpgate, TOTP prompts, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, Step CA, 1Password Connect, and more
 - **Termix ID** - A built-in take on sshid.io. Claim a handle, publish your public keys at a resolver URL, and issue SSH certificates from the built-in CA
+- **Command History Autosuggestions** - Inline suggestions in the terminal as you type, based on your command history
+- **Desktop Standalone and Sync** - The desktop app runs on its own with a local backend and database, and can optionally sync with a Termix server

 </details>

@@ -1,6 +1,6 @@
 <!-- SUMMARY -->

-Credential cloning, a WSL local terminal, Helm and GitOps deployment, an editable file manager path bar, download progress bars, and a large batch of connection, sync, and remote desktop fixes.
+A side-by-side local and remote file manager for desktop, a new tab for transferring files straight between two servers, collaboration rooms, Step CA and 1Password credential support, per-host Web Endpoints, credential sharing with users and roles, and a large batch of connection, sync, and remote desktop fixes.

 <!-- /SUMMARY -->

@@ -12,49 +12,102 @@ https://youtu.be/lngaePO96tM

 <!-- UPDATE_LOG -->

- Added the ability to clone an existing credential
- Added a WSL option for the local terminal
- Added Helm charts and a GitOps deployment setup
- Added an editable path bar to the file manager
- Added a progress bar for file downloads in the file manager
- Added an identity file option so agent authentication stops after the right key
- Added an environment variable to turn on silent OIDC login
- Added editable model settings for AI providers
- Improved tmux monitor performance when aggregating sessions
- Improved Linux packaging with standard icon sizes
+- Added a side-by-side local and remote view to the desktop file manager
+- Added a dedicated tab for transferring files directly between two servers
+- Added a dedicated Port Forwarding tab to the desktop app sidebar
+- Added inline autosuggestions in the terminal using command history
+- Added collaboration rooms for sharing a terminal or remote desktop session with a group
+- Added Step CA as an SSH authentication type
+- Added 1Password Connect as a credential source for SSH
+- Added the ability to share credentials with specific users and roles
+- Added automatic sharing for hosts added to an already-shared folder
+- Added per-host Web Endpoints
+- Added quick connect for RDP and VNC
+- Added a button to pin the sidebar rail open instead of it auto-collapsing
+- Added a compact snippet list option
+- Added copy/paste support to the local terminal
+- Added a terminal copy-on-select option
+- Added tab switching and command palette actions to custom keybindings
+- Added selectable host temperature sensors
+- Added accessible interface font choices
+- Added VNC display zoom controls
+- Added more actions to the host right-click context menu
+- Added white label branding for admins
+- Added support for additional TOTP authenticator apps
+- Added the ability to open RDP, VNC, and Telnet sessions directly from the desktop app
+- Improved file manager navigation
+- Improved motion and transition animations throughout the app
+- Improved macOS packaging and terminal keyboard shortcuts
+- Improved the terminal AI assistant with a toggle for terminal context
+- Began plugin backend work (cut cross feature imports, added plugin DB tables, made the rail/tab system use registries, and updated nginx and manifests for plugins)

 <!-- /UPDATE_LOG -->

 <!-- BUG_FIXES -->

- Passkey sign in not showing up on the login screen
- Connections through jump hosts failing
- Jump hosts and remote desktop hosts not resolving after a sync
- Malformed websocket messages crashing the server
- Encrypted file manager keys not prompting for a passphrase
- SSH agent forwarding not working with the in-memory agent
- Two factor prompts rejecting codes longer than six digits
- OIDC lockout with no way to recover from environment settings
- Tailscale requests failing on some setups
- Terminal clipboard shortcuts not working on non-QWERTY layouts
- Rapid mobile terminal input being sent one keystroke at a time
- HTTPS not being able to share the configured port
- Portable imports failing on remote databases
- Host status not showing when metrics collection is off
- Proxmox guest credential usernames being wrong
- File drops not working for RDP in the browser
- Duplicate Docker HTTPS listener on startup
- Remote sync server probe ignoring the certificate setting
- Runtime SSL settings not being preserved
- Automation notifications missing host details
- Connection screens crashing outside the connection log provider
- better-sqlite3 failing in Docker on some platforms
- Host action rows shifting at large font sizes
- Sidebar height jumping when hosts or credentials have tags
- Gaps between host rows in the sidebar list
- Rounded corners on the host list search bar
- Image storage settings text wrapping to one word per line
- Unclear wording on the click-to-expand host setting
- Dragging a folder into the file manager failing to upload
+- Private AI custom endpoints failing to connect
+- Proxmox credential guest imports not working correctly
+- Fleet command results layout being broken
+- Synced client tunnel endpoints not matching the source host
+- Proxmox jump host settings not persisting after a sync
+- Command palette keyboard navigation not working correctly
+- Split layout selection not being restored
+- macOS VNC connections failing to establish
+- Rapid VNC scroll wheel input queuing up and making the remote desktop keep scrolling after you stop
+- Remote desktop connections timing out unexpectedly
+- RDP clipboard paste not working across some browsers
+- Process inspector command column showing truncated commands
+- RDP drive redirection uploads failing on the default deployment
+- A terminal session that expired silently reconnected without explaining Auto-Tmux as an option
+- Host status wrongly showing as offline when nothing was actively watching it
+- Shared RDP users not being prompted for credentials when required
+- Protected file reads failing without a sudo retry
+- Host status polling unnecessarily authenticating over SSH
+- Some host protocol settings being dropped when left unset
+- Remote sync reauthentication failures not being surfaced to the user
+- Dashboard metrics sessions not recovering after expiring
+- RDP file uploads to redirected drives failing
+- Connection toolbar visibility being inconsistent
+- Host list scroll position resetting incorrectly after editing a host
+- Live SSH sessions not being reflected in host status
+- Vault authentication not working in the file manager
+- Running snippets and commands on shared hosts being blocked
+- Chunked file uploads failing due to a contract mismatch
+- Bulk uploads failing partway through
+- Local echo not being disabled on the terminal alternate screen
+- Invalid timezones in the clock widget crashing the homepage
+- Connection origin setting not being preserved when editing a host
+- Local login notifications not appearing after a remote sync
+- Passkey login not working in the desktop app
+- Proxmox guest discovery commands failing without elevated permissions
+- File transfer completion toasts staying on screen permanently
+- SSH key type not being clearable once set
+- Local echo appearing during password prompts inside other programs
+- The desktop app hanging on a loading screen with no message when the embedded backend's port was in use
+- Backend ports silently failing to bind, leaving a feature dead with no error in the logs
+- Imported host settings and jump host references being lost or broken after import
+- SSH agent forwarding breaking after certain unsupported extensions
+- Sidebar host tree continuing to render while hidden, wasting resources
+- macOS Alt+digit tab shortcuts producing characters instead of switching tabs
+- macOS Option key producing Meta/escape sequences instead of special characters by default
+- Dashboard not opening the correct remote desktop protocol
+- Version checks overwriting the local version number on failure
+- SFTP directory creation relying on shell access
+- GPU acceleration opt-out setting being ignored on desktop
+- Remote-only hosts leaking into local tab persistence on desktop
+- Host metrics not being collected correctly on macOS and Windows hosts
+- CORS rejecting requests by default when no allowed origins were configured
+- Streamed SFTP uploads not completing correctly
+- The SSH connection pool not enforcing its connection limits, letting stale connections pile up
+- Local connections to shared hosts being blocked
+- Client-to-server tunnels using the wrong bind or target address in some setups
+- SSH host key changes not being surfaced as a warning
+- Nested subhost parent references breaking after a remote sync
+- Termix ID certificates missing principals needed for some servers to accept them
+- TOTP being skipped without a fully verified WebAuthn check
+- SSH connections not verifying the resolved server's host identity
+- The OPKSSH binary not having its integrity verified before use
+- Several transitive dependency security advisories
+- Various HTTP and application trust boundary hardening (CSP, Docker, config defaults)

 <!-- /BUG_FIXES -->
@@ -3,3 +3,21 @@
 ## Reporting a Vulnerability

 Please report any vulnerabilities to [GitHub Security](https://github.com/Termix-SSH/Termix/security/advisories).
+
+## External secret storage
+
+By default, a single-container installation generates its keys in the Termix
+data directory for ease of recovery. Production deployments that keep backups
+or database files outside a trusted encrypted volume should set
+`TERMIX_REQUIRE_EXTERNAL_SECRETS=true` and provide all four keys through a
+secret manager:
+
+- `JWT_SECRET` (at least 64 characters)
+- `DATABASE_KEY` (64 hexadecimal characters)
+- `ENCRYPTION_KEY` (64 hexadecimal characters)
+- `INTERNAL_AUTH_TOKEN` (at least 32 characters)
+
+Each value can instead be mounted as a Docker or Kubernetes secret and supplied
+with its corresponding `_FILE` variable, such as `ENCRYPTION_KEY_FILE`.
+Hardened mode fails closed instead of writing a replacement key beside the
+encrypted database.
@@ -75,6 +75,7 @@ env:
  PORT: "8080"
  DATA_DIR: /app/data
  NODE_ENV: production
+  TERMIX_REQUIRE_EXTERNAL_SECRETS: "false"
  GUACD_RECORDING_PATH: /termix-data/session_recordings/guacamole
  GUACD_RECORDING_BACKEND_PATH: /app/data/session_recordings/guacamole

@@ -86,6 +87,9 @@ secrets:
  name: ""
  data:
    JWT_SECRET: ""
+    DATABASE_KEY: ""
+    ENCRYPTION_KEY: ""
+    INTERNAL_AUTH_TOKEN: ""
    DATABASE_URL: ""
    GUACAMOLE_ENCRYPTION_KEY: ""

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: termix-traefik
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/Termix-SSH/Termix.git
-    targetRevision: main
-    path: charts/termix
-    helm:
-      releaseName: termix
-      valueFiles:
-        - values-traefik.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: termix
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - PruneLast=true
@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: termix
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/Termix-SSH/Termix.git
-    targetRevision: main
-    path: charts/termix
-    helm:
-      releaseName: termix
-      valueFiles:
-        - values-gitops-example.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: termix
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - PruneLast=true
@@ -1,70 +0,0 @@
-stages:
-  - test
-  - build
-  - package
-  - deploy
-
-variables:
-  DOCKER_TLS_CERTDIR: "/certs"
-  IMAGE_TAG: "$CI_COMMIT_SHORT_SHA"
-  HELM_EXPERIMENTAL_OCI: "1"
-
-helm-lint:
-  image:
-    name: alpine/helm:3.15.4
-    entrypoint: [""]
-  stage: test
-  script:
-    - helm lint charts/termix
-    - helm template termix charts/termix --values charts/termix/values-gitops-example.yaml >/tmp/termix.yaml
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH
-
-docker-build-push:
-  image: docker:27
-  stage: build
-  services:
-    - docker:27-dind
-  before_script:
-    - echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
-  script:
-    - docker build -f docker/Dockerfile -t "$CI_REGISTRY_IMAGE:$IMAGE_TAG" -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG" .
-    - docker push "$CI_REGISTRY_IMAGE:$IMAGE_TAG"
-    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG"
-  rules:
-    - if: $CI_COMMIT_BRANCH
-
-helm-package-push:
-  image:
-    name: alpine/helm:3.15.4
-    entrypoint: [""]
-  stage: package
-  before_script:
-    - echo "$CI_REGISTRY_PASSWORD" | helm registry login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
-  script:
-    - helm dependency update charts/termix
-    - helm package charts/termix --destination .helm-packages
-    - helm push .helm-packages/termix-*.tgz "oci://$CI_REGISTRY_IMAGE/charts"
-  artifacts:
-    paths:
-      - .helm-packages/
-  rules:
-    - if: $CI_COMMIT_TAG
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-
-deploy:
-  image:
-    name: alpine/helm:3.15.4
-    entrypoint: [""]
-  stage: deploy
-  environment:
-    name: production
-  before_script:
-    - echo "$KUBE_CONFIG" | base64 -d > kubeconfig
-    - chmod 600 kubeconfig
-  script:
-    - helm upgrade --install termix charts/termix --namespace termix --create-namespace --kubeconfig kubeconfig --set image.repository="$CI_REGISTRY_IMAGE" --set image.tag="$IMAGE_TAG" --values charts/termix/values-gitops-example.yaml --atomic --timeout 10m
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: manual
@@ -1,5 +1,5 @@
 # Stage 1: Install dependencies
-FROM node:24-slim AS deps
+FROM node:26-slim AS deps
 WORKDIR /app

 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
@@ -8,10 +8,11 @@ COPY package*.json ./
 COPY .npmrc ./
 COPY vendor ./vendor

-COPY scripts/patch-guacamole-lite.cjs ./scripts/
+COPY scripts/patch-guacamole-lite.cjs scripts/patch-ssh2-agent.cjs ./scripts/

 RUN npm ci --ignore-scripts && \
    node scripts/patch-guacamole-lite.cjs && \
+    node scripts/patch-ssh2-agent.cjs && \
    npm cache clean --force

 # Stage 2: Build frontend
@@ -38,25 +39,28 @@ RUN rm -rf node_modules/better-sqlite3/prebuilds && \
 RUN npm run build:backend

 # Stage 4: Download OPKSSH binary for the target platform so the image works offline
-FROM node:24-slim AS opkssh-downloader
+FROM node:26-slim AS opkssh-downloader
 ARG TARGETARCH
 ARG OPKSSH_VERSION=v0.16.0
+ARG OPKSSH_SHA256_AMD64=c018c3e7baf98612b923e742dd87be38650bf61e3b755fb2bc90de177568b1bf
+ARG OPKSSH_SHA256_ARM64=9dd10c2b6ce99cde18e52c054877ca014134b291fd82afe71741c68db4f83d44
 WORKDIR /opkssh

 RUN apt-get update && apt-get install -y curl ca-certificates && rm -rf /var/lib/apt/lists/*

 RUN case "$TARGETARCH" in \
-      amd64) OPKSSH_ARCH=amd64 ;; \
-      arm64) OPKSSH_ARCH=arm64 ;; \
+      amd64) OPKSSH_ARCH=amd64; OPKSSH_SHA256="$OPKSSH_SHA256_AMD64" ;; \
+      arm64) OPKSSH_ARCH=arm64; OPKSSH_SHA256="$OPKSSH_SHA256_ARM64" ;; \
      *) echo "Unsupported architecture: $TARGETARCH" && exit 1 ;; \
    esac && \
    curl -fSL -o "opkssh-linux-${OPKSSH_ARCH}" \
      "https://github.com/openpubkey/opkssh/releases/download/${OPKSSH_VERSION}/opkssh-linux-${OPKSSH_ARCH}" && \
+    echo "$OPKSSH_SHA256  opkssh-linux-${OPKSSH_ARCH}" | sha256sum -c - && \
    chmod 755 "opkssh-linux-${OPKSSH_ARCH}" && \
    echo -n "$OPKSSH_VERSION" > version.txt

 # Stage 5: Production dependencies only
-FROM node:24-slim AS production-deps
+FROM node:26-slim AS production-deps
 WORKDIR /app

 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
@@ -65,10 +69,11 @@ COPY package*.json ./
 COPY .npmrc ./
 COPY vendor ./vendor

-COPY scripts/patch-guacamole-lite.cjs ./scripts/
+COPY scripts/patch-guacamole-lite.cjs scripts/patch-ssh2-agent.cjs ./scripts/

 RUN npm ci --omit=dev --ignore-scripts && \
    node scripts/patch-guacamole-lite.cjs && \
+    node scripts/patch-ssh2-agent.cjs && \
    rm -rf node_modules/better-sqlite3/prebuilds && \
    npm run build-release --prefix node_modules/better-sqlite3 && \
    test -f node_modules/better-sqlite3/build/Release/better_sqlite3.node && \
@@ -76,7 +81,7 @@ RUN npm ci --omit=dev --ignore-scripts && \
    npm cache clean --force

 # Stage 6: Final optimized image
-FROM node:24-slim
+FROM node:26-slim
 WORKDIR /app

 ENV DATA_DIR=/app/data \
@@ -106,7 +111,7 @@ COPY --chown=node:node drizzle ./drizzle

 VOLUME ["/app/data"]

-EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006 30007 30008 30009 30010 30011 30012
+EXPOSE ${PORT}

 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD wget -q -O /dev/null http://localhost:30001/health || exit 1
@@ -15,6 +15,10 @@ services:
      GUACD_HOST: "guacd-dev"
      GUACD_TUNNEL_HOST: "termix-dev"
      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
+      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
+      # REDIS_URL: "redis://redis:6379"
+      # TERMIX_REDIS_PREFIX: "termix:collab"
+      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
    depends_on:
      - guacd-dev
    networks:
@@ -12,6 +12,19 @@ services:
      GUACD_HOST: "guacd"
      GUACD_TUNNEL_HOST: "termix"
      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
+      # Where guacd stores files for RDP drive redirection (one folder per
+      # user is created underneath). Must be writable by guacd's user.
+      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
+      # Multi-instance deployments should point every backend at the same
+      # Redis. Without it, collaboration rooms keep their single-instance
+      # in-memory fallback.
+      # REDIS_URL: "redis://redis:6379"
+      # TERMIX_REDIS_PREFIX: "termix:collab"
+      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
+      # Hardened deployments can require keys from environment variables or
+      # Docker secrets mounted through JWT_SECRET_FILE, DATABASE_KEY_FILE,
+      # ENCRYPTION_KEY_FILE and INTERNAL_AUTH_TOKEN_FILE.
+      # TERMIX_REQUIRE_EXTERNAL_SECRETS: "true"
      # Trusted reverse-proxy authentication is disabled by default. When
      # enabled, do not expose this container directly to untrusted clients.
      # TRUSTED_PROXY_AUTH_ENABLED: "true"
@@ -172,7 +172,14 @@ if [ -n "$BASE_PATH" ]; then
    echo "Injecting BASE_PATH: $BASE_PATH"
    # Strip trailing slash for use as a path prefix
    CLEAN_BASE_PATH="${BASE_PATH%/}"
-    find /app/html -name "index.html" -exec sed -i "s|window.__TERMIX_BASE_PATH__ = \"\"|window.__TERMIX_BASE_PATH__ = \"$CLEAN_BASE_PATH\"|g" {} \;
+    case "$CLEAN_BASE_PATH" in
+        /*) ;;
+        *) echo "BASE_PATH must start with /" >&2; exit 1 ;;
+    esac
+    case "$CLEAN_BASE_PATH" in
+        *[!A-Za-z0-9_./~-]*) echo "BASE_PATH contains unsupported characters" >&2; exit 1 ;;
+    esac
+    find /app/html -name "index.html" -exec sed -i "s|name=\"termix-base-path\" content=\"\"|name=\"termix-base-path\" content=\"$CLEAN_BASE_PATH\"|g" {} \;
    # Patch sw.js static asset paths with the base path prefix
    find /app/html -name "sw.js" -exec sed -i "s|__TERMIX_SW_BASE_PATH__|$CLEAN_BASE_PATH|g" {} \;
 else
@@ -161,6 +161,10 @@ http {
            root /app/html;
            index index.html index.htm;
            expires off;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; connect-src 'self' http: https: ws: wss:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; frame-src http: https:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
            add_header X-Content-Type-Options nosniff always;
            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
@@ -377,6 +381,18 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/plugin-api/(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_cache_bypass $http_upgrade;
+        }
+
        location ~ ^/open-tabs(/.*)?$ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -619,6 +635,15 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/collab(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
        location /host/tunnel/ {
            proxy_pass http://127.0.0.1:30003;
            proxy_http_version 1.1;
@@ -142,6 +142,10 @@ http {
            root /app/html;
            index index.html index.htm;
            expires off;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; connect-src 'self' http: https: ws: wss:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; frame-src http: https:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
            add_header X-Content-Type-Options nosniff always;
            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
            try_files $uri $uri/ /index.html;
@@ -357,6 +361,18 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/plugin-api/(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_cache_bypass $http_upgrade;
+        }
+
        location ~ ^/open-tabs(/.*)?$ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -597,6 +613,15 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/collab(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
        location /host/tunnel/ {
            proxy_pass http://127.0.0.1:30003;
            proxy_http_version 1.1;
@@ -659,7 +684,7 @@ http {

        location /ssh/file_manager/ {
            client_max_body_size 5G;
-            client_body_timeout 300s;
+            client_body_timeout 3600s;

            add_header X-Content-Type-Options nosniff always;
            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
@@ -672,8 +697,8 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
+            proxy_send_timeout 3600s;
+            proxy_read_timeout 3600s;

            proxy_request_buffering off;
            proxy_buffering off;
@@ -681,7 +706,7 @@ http {

        location /host/file_manager/ssh/ {
            client_max_body_size 5G;
-            client_body_timeout 300s;
+            client_body_timeout 3600s;

            add_header X-Content-Type-Options nosniff always;
            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
@@ -694,8 +719,8 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
+            proxy_send_timeout 3600s;
+            proxy_read_timeout 3600s;

            proxy_request_buffering off;
            proxy_buffering off;
@@ -237,7 +237,7 @@ RDP وVNC وTelnet داخل المتصفح، في علامات تبويب وشا
 <td width="50%" valign="top">

 **الأمان:**
-تُشفَّر كلمات المرور والمفاتيح والأسرار الأخرى لكل مستخدم على حدة، ويمكن تشفير ملفات قاعدة البيانات نفسها على القرص. راجع [الوثائق](https://docs.termix.site/security) لمعرفة آلية العمل.
+تُشفَّر كلمات المرور والمفاتيح والأسرار الأخرى لكل مستخدم على حدة، ويمكن تشفير ملفات قاعدة البيانات نفسها على القرص. راجع [الوثائق](https://docs.termix.site/features/authentication/security/) لمعرفة آلية العمل.

 </td>
 <td width="50%" valign="top">
@@ -89,7 +89,7 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 <td width="50%" valign="top">

 **文件管理器:**
-通过 SFTP 浏览、编辑、上传、下载、重命名、移动和删除文件，支持 sudo。可以查看和编辑代码、图片、音频和视频。文件可以直接从一台服务器复制到另一台，系统会自动选择最快的路径并校验传输完整性。
+通过 SFTP 浏览、编辑、上传、下载、重命名、移动和删除文件，支持 sudo。可以查看和编辑代码、图片、音频和视频。在专属的传输标签页里把文件直接从一台服务器复制到另一台，系统会自动选择最快的路径并校验传输完整性。桌面端还提供本地和远程并排显示的视图。

 </td>
 </tr>
@@ -111,7 +111,7 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 <td width="50%" valign="top">

 **主机指标:**
-在大多数 Linux 服务器上查看 CPU、内存、磁盘、网络、温度、运行时间、进程、端口、登录记录和系统信息，并附带历史曲线图。管理卡片让你无需离开 Termix 就能处理服务、定时任务、软件包、用户、防火墙规则、WireGuard、Tailscale、SSL 证书、日志和健康检查。
+在大多数 Linux 服务器上查看 CPU、内存、磁盘、网络、温度、NVIDIA GPU、运行时间、进程、端口、登录记录和系统信息，并附带历史曲线图。管理卡片让你无需离开 Termix 就能处理服务、定时任务、软件包、用户、防火墙规则、WireGuard、Tailscale、SSL 证书、日志和健康检查。

 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 </td>
 <td width="50%" valign="top">

-**引导设置:**
-一个简短的引导流程会带你选择界面预设、主题、需要的功能，以及第一台主机。简洁模式会隐藏你用不到的东西，你随时可以重新运行引导或切换预设。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**桌面独立运行与同步:**
-桌面应用可以完全独立运行，自带本地后端和数据库，不需要服务器。你也可以把它连到 Termix 服务器，双向同步主机、凭据、代码片段等内容，并选择连接是在本地发起还是通过服务器发起。
-
-</td>
-<td width="50%" valign="top">
-
 **命令行工具:**
 `termix` 命令行工具，可用于你的终端和脚本。打开终端、在单台主机或整个机群上执行命令、通过 SFTP 传输文件，以及管理主机、代码片段和凭据。用 `npm install -g @termix-cli/cli` 安装，或者直接下载独立的可执行文件。详见 [CLI 文档](https://docs.termix.site/cli)。

@@ -237,7 +223,7 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 <td width="50%" valign="top">

 **安全:**
-密码、密钥和其他机密按用户加密，数据库文件本身也可以在磁盘上加密。具体原理请查看[文档](https://docs.termix.site/security)。
+密码、密钥和其他机密按用户加密，数据库文件本身也可以在磁盘上加密。具体原理请查看[文档](https://docs.termix.site/features/authentication/security/)。

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 - **键盘快捷键** - 在标签页之间切换、关闭标签页等，全部可以重新绑定
 - **网络唤醒** - 从 Termix 或自动化步骤中唤醒一台机器
 - **受信任代理认证** - 由反向代理完成登录，并把用户信息传递进来
- **丰富的 SSH 功能** - 跳板机、Warpgate、TOTP 验证、SOCKS5、主机密钥验证、密码自动填充、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、端口敲门、终端日志、代理转发、Bitwarden SSH 代理、HashiCorp Vault SSH 签名等等
+- **白标定制** - 管理员可以用自己的名称、图标和配色为实例重新品牌化
+- **Web 端点** - 在 Termix 内嵌打开主机自己的网页界面，比如路由器的管理页面，而不是另开一个标签页
+- **协作房间** - 持久化的房间，一群人可以一起在会话之间跳转，有主持人舞台和邀请功能
+- **丰富的 SSH 功能** - 跳板机、Warpgate、TOTP 验证、SOCKS5、主机密钥验证、密码自动填充、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、端口敲门、终端日志、代理转发、Bitwarden SSH 代理、HashiCorp Vault SSH 签名、Step CA、1Password Connect 等等
 - **Termix ID** - 内置的 sshid.io 式功能。认领一个用户名，在解析地址上发布你的公钥，并用内置 CA 签发 SSH 证书
+- **命令历史自动建议** - 在终端中输入时，根据你的命令历史给出行内建议
+- **桌面独立运行与同步** - 桌面应用自带本地后端和数据库可以独立运行，也可以选择和 Termix 服务器同步

 </details>

@@ -313,6 +304,9 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH

 访问 [Termix 文档](https://docs.termix.site/install) 查看所有平台的完整安装说明。

+要部署到 Kubernetes？Helm chart 在 `charts/termix` 目录下，涵盖 Ingress、Traefik、Argo CD、GitHub Actions 和 GitLab CI 的完整搭建说明见
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes)。
+
 Docker Compose 示例（如果你不打算使用远程桌面功能，可以省略 `guacd` 和相关网络配置）：

 ```yaml
@@ -352,7 +346,7 @@ networks:

 ### 命令行工具

-Termix 还提供命令行工具，你可以在终端里管理服务器，也可以把 Termix 用在自己的脚本中。
+Termix 还提供命令行工具，让你可以在终端里管理服务器，也可以把 Termix 用在自己的脚本中。

 ```bash
 npm install -g @termix-cli/cli
@@ -374,7 +368,7 @@ termix ssh 1

 Termix 每天会发送一次匿名的小型统计信息，让我了解有多少实例在运行、哪些功能被用到。内容包括一个随机的实例 ID、你有多少用户和主机、应用版本，以及过去 24 小时内使用了哪些功能（终端、文件管理器、隧道、Docker 等）。它绝不包含用户名、主机名、IP 地址、凭据，或任何能识别你和你服务器的信息。

-该功能默认开启。你可以在管理设置的“通用”中关闭它，或者在启动 Termix 之前设置 `ENABLE_TELEMETRY=false`。
+该功能默认开启。你可以在管理设置的"通用"中关闭它，或者在启动 Termix 之前设置 `ENABLE_TELEMETRY=false`。

 <br />

@@ -507,3 +501,4 @@ Termix 免费且开源，没有订阅也没有付费方案。如果你觉得它
 ## 许可证

 基于 Apache License 2.0 发布。详见 `LICENSE`。
+</content>
@@ -111,7 +111,7 @@ Hosts mit Tags und verschachtelten Ordnern ordnen, die du benennen und einfärbe
 <td width="50%" valign="top">

 **Host-Metriken:**
-CPU, Speicher, Festplatte, Netzwerk, Temperatur, Laufzeit, Prozesse, Ports, Anmeldungen und Systeminfos auf den meisten Linux-Servern, mit Verlaufsgrafiken. Über Verwaltungskarten kümmerst du dich um Dienste, Cronjobs, Pakete, Benutzer, Firewallregeln, WireGuard, Tailscale, SSL-Zertifikate, Logs und Statusprüfungen, ohne Termix zu verlassen.
+CPU, Speicher, Festplatte, Netzwerk, Temperatur, NVIDIA-GPU, Laufzeit, Prozesse, Ports, Anmeldungen und Systeminfos auf den meisten Linux-Servern, mit Verlaufsgrafiken. Über Verwaltungskarten kümmerst du dich um Dienste, Cronjobs, Pakete, Benutzer, Firewallregeln, WireGuard, Tailscale, SSL-Zertifikate, Logs und Statusprüfungen, ohne Termix zu verlassen.

 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Speichere eine Reihe von Tabs samt Aufteilung und öffne alles mit einem Klick w
 </td>
 <td width="50%" valign="top">

-**Geführte Einrichtung:**
-Eine kurze Einrichtung führt dich durch die Wahl einer Oberflächenvorlage, deines Themas, der gewünschten Funktionen und deines ersten Hosts. Der einfache Modus blendet aus, was du nicht nutzt, und du kannst die Einrichtung jederzeit erneut starten oder die Vorlage wechseln.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop eigenständig und Synchronisierung:**
-Die Desktop-App läuft eigenständig mit lokalem Backend und eigener Datenbank, ganz ohne Server. Du kannst sie auch mit einem Termix-Server verbinden, um Hosts, Zugangsdaten, Snippets und mehr in beide Richtungen abzugleichen, und wählen, ob Verbindungen lokal oder über den Server aufgebaut werden.
-
-</td>
-<td width="50%" valign="top">
-
 **Kommandozeile:**
 Ein `termix`-CLI für deine Shell und deine Skripte. Terminals öffnen, einen Befehl auf einem Host oder einer ganzen Flotte ausführen, Dateien per SFTP verschieben und Hosts, Snippets und Zugangsdaten verwalten. Installiere es mit `npm install -g @termix-cli/cli` oder nimm eine eigenständige Binärdatei. Siehe die [CLI-Dokumentation](https://docs.termix.site/cli).

@@ -237,7 +223,7 @@ Ein `termix`-CLI für deine Shell und deine Skripte. Terminals öffnen, einen Be
 <td width="50%" valign="top">

 **Sicherheit:**
-Passwörter, Schlüssel und andere Geheimnisse werden pro Benutzer verschlüsselt, und die Datenbankdateien selbst lassen sich auf der Festplatte verschlüsseln. Wie das funktioniert, steht in der [Dokumentation](https://docs.termix.site/security).
+Passwörter, Schlüssel und andere Geheimnisse werden pro Benutzer verschlüsselt, und die Datenbankdateien selbst lassen sich auf der Festplatte verschlüsseln. Wie das funktioniert, steht in der [Dokumentation](https://docs.termix.site/features/authentication/security/).

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Rund 30 Sprachen sind eingebaut, verwaltet über [Crowdin](https://docs.termix.s
 - **Tastenkürzel** - Zwischen Tabs wechseln, Tabs schließen und mehr, alles neu belegbar
 - **Wake-on-LAN** - Einen Rechner aus Termix heraus oder aus einem Automatisierungsschritt aufwecken
 - **Vertrauenswürdiger Proxy** - Einen Reverse Proxy die Anmeldung erledigen und den Benutzer durchreichen lassen
- **Viele SSH-Funktionen** - Sprunghosts, Warpgate, TOTP-Abfragen, SOCKS5, Prüfung von Hostschlüsseln, automatisches Ausfüllen von Passwörtern, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, Port Knocking, Terminalprotokolle, Agent-Weiterleitung, Bitwarden SSH-Agent, SSH-Signierung über HashiCorp Vault und mehr
+- **White Label** - Administratoren können die Instanz mit eigenem Namen, Logo und Farben versehen
+- **Web-Endpunkte** - Öffne die eigene Weboberfläche eines Hosts, etwa die Verwaltungsseite eines Routers, eingebettet in Termix statt in einem eigenen Tab
+- **Kollaborationsräume** - Feste Räume, in denen eine Gruppe gemeinsam zwischen Sitzungen wechselt, mit Präsentationsbühne und Einladungen
+- **Viele SSH-Funktionen** - Sprunghosts, Warpgate, TOTP-Abfragen, SOCKS5, Prüfung von Hostschlüsseln, automatisches Ausfüllen von Passwörtern, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, Port Knocking, Terminalprotokolle, Agent-Weiterleitung, Bitwarden SSH-Agent, SSH-Signierung über HashiCorp Vault, Step CA, 1Password Connect und mehr
 - **Termix ID** - Eine eingebaute Variante von sshid.io. Sichere dir einen Namen, veröffentliche deine öffentlichen Schlüssel unter einer Resolver-URL und stelle SSH-Zertifikate über die eingebaute CA aus
+- **Autovervollständigung im Befehlsverlauf** - Vorschläge direkt im Terminal beim Tippen, basierend auf deinem Befehlsverlauf
+- **Desktop eigenständig und Synchronisierung** - Die Desktop-App läuft eigenständig mit lokalem Backend und eigener Datenbank und kann sich optional mit einem Termix-Server synchronisieren

 </details>

@@ -313,6 +304,10 @@ Rund 30 Sprachen sind eingebaut, verwaltet über [Crowdin](https://docs.termix.s

 In der [Termix-Dokumentation](https://docs.termix.site/install) findest du die vollständigen Installationsanleitungen für alle Plattformen.

+Willst du auf Kubernetes bereitstellen? Das Helm-Chart liegt in `charts/termix`, und die Einrichtung
+für Ingress, Traefik, Argo CD, GitHub Actions und GitLab CI steht unter
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes).
+
 Beispiel für eine Docker-Compose-Datei (`guacd` und das Netzwerk kannst du weglassen, wenn du keinen Remotedesktop brauchst):

 ```yaml
@@ -111,7 +111,7 @@ Guarda y organiza hosts con etiquetas y carpetas anidadas que puedes nombrar y c
 <td width="50%" valign="top">

 **Métricas de host:**
-CPU, memoria, disco, red, temperatura, tiempo encendido, procesos, puertos, inicios de sesión e información del sistema en la mayoría de servidores Linux, con gráficas de histórico. Las tarjetas de gestión te dejan manejar servicios, tareas cron, paquetes, usuarios, reglas del cortafuegos, WireGuard, Tailscale, certificados SSL, registros y comprobaciones de estado sin salir de Termix.
+CPU, memoria, disco, red, temperatura, GPU NVIDIA, tiempo encendido, procesos, puertos, inicios de sesión e información del sistema en la mayoría de servidores Linux, con gráficas de histórico. Las tarjetas de gestión te dejan manejar servicios, tareas cron, paquetes, usuarios, reglas del cortafuegos, WireGuard, Tailscale, certificados SSL, registros y comprobaciones de estado sin salir de Termix.

 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Guarda un conjunto de pestañas con su distribución dividida y reábrelo entero
 </td>
 <td width="50%" valign="top">

-**Configuración guiada:**
-Una configuración corta te lleva por elegir un preajuste de interfaz, tu tema, las funciones que quieres y tu primer host. El modo sencillo esconde lo que no usas, y puedes repetir la configuración o cambiar de preajuste cuando quieras.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Escritorio independiente y sincronización:**
-La aplicación de escritorio funciona sola, con su backend y su base de datos locales, sin necesidad de servidor. También puedes conectarla a un servidor Termix para sincronizar en ambos sentidos hosts, credenciales, fragmentos y más, y decidir si las conexiones salen de tu equipo o pasan por el servidor.
-
-</td>
-<td width="50%" valign="top">
-
 **Línea de comandos:**
 Un CLI `termix` para tu shell y tus scripts. Abre terminales, ejecuta un comando en un host o en una flota entera, mueve archivos por SFTP y gestiona hosts, fragmentos y credenciales. Instálalo con `npm install -g @termix-cli/cli` o coge un binario independiente. Consulta la [documentación del CLI](https://docs.termix.site/cli).

@@ -237,7 +223,7 @@ Un CLI `termix` para tu shell y tus scripts. Abre terminales, ejecuta un comando
 <td width="50%" valign="top">

 **Seguridad:**
-Las contraseñas, las claves y otros secretos se cifran por usuario, y los propios archivos de la base de datos se pueden cifrar en disco. Mira la [documentación](https://docs.termix.site/security) para saber cómo funciona.
+Las contraseñas, las claves y otros secretos se cifran por usuario, y los propios archivos de la base de datos se pueden cifrar en disco. Mira la [documentación](https://docs.termix.site/features/authentication/security/) para saber cómo funciona.

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Unos 30 idiomas incluidos, gestionados a través de [Crowdin](https://docs.termi
 - **Atajos de teclado** - Moverte entre pestañas, cerrarlas y más, todo reasignable
 - **Wake-on-LAN** - Enciende una máquina desde Termix o desde un paso de automatización
 - **Proxy de confianza** - Deja que un proxy inverso gestione el acceso y pase al usuario
- **SSH muy completo** - Hosts de salto, Warpgate, peticiones TOTP, SOCKS5, verificación de claves de host, autorrelleno de contraseñas, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro del terminal, reenvío de agente, agente SSH de Bitwarden, firma SSH con HashiCorp Vault y más
+- **Marca blanca** - Los administradores pueden personalizar la instancia con su propio nombre, logo y colores
+- **Puntos de acceso web** - Abre la propia interfaz web de un host, como la página de administración de un router, integrada dentro de Termix en lugar de en una pestaña aparte
+- **Salas de colaboración** - Salas persistentes donde un grupo salta entre sesiones junto, con un escenario para presentador e invitaciones
+- **SSH muy completo** - Hosts de salto, Warpgate, peticiones TOTP, SOCKS5, verificación de claves de host, autorrelleno de contraseñas, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro del terminal, reenvío de agente, agente SSH de Bitwarden, firma SSH con HashiCorp Vault, Step CA, 1Password Connect y más
 - **Termix ID** - Una versión integrada de sshid.io. Reserva un identificador, publica tus claves públicas en una URL de resolución y emite certificados SSH desde la CA integrada
+- **Autosugerencias del historial de comandos** - Sugerencias en línea en el terminal mientras escribes, basadas en tu historial de comandos
+- **Escritorio independiente y sincronización** - La aplicación de escritorio funciona sola, con su propio backend y base de datos locales, y puede sincronizarse opcionalmente con un servidor Termix

 </details>

@@ -313,6 +304,10 @@ Unos 30 idiomas incluidos, gestionados a través de [Crowdin](https://docs.termi

 Visita la [documentación de Termix](https://docs.termix.site/install) para ver las instrucciones completas de instalación en todas las plataformas.

+¿Vas a desplegar en Kubernetes? El chart de Helm está en `charts/termix`, y las instrucciones
+de configuración para Ingress, Traefik, Argo CD, GitHub Actions y GitLab CI están en
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes).
+
 Ejemplo de archivo Docker Compose (puedes quitar `guacd` y la red si no piensas usar el escritorio remoto):

 ```yaml
@@ -111,7 +111,7 @@ Rangez vos hôtes avec des étiquettes et des dossiers imbriqués que vous pouve
 <td width="50%" valign="top">

 **Métriques des hôtes:**
-CPU, mémoire, disque, réseau, température, temps de fonctionnement, processus, ports, connexions et informations système sur la plupart des serveurs Linux, avec des graphiques d'historique. Les cartes de gestion vous permettent de gérer les services, les tâches cron, les paquets, les utilisateurs, les règles de pare-feu, WireGuard, Tailscale, les certificats SSL, les journaux et les vérifications d'état sans quitter Termix.
+CPU, mémoire, disque, réseau, température, GPU NVIDIA, temps de fonctionnement, processus, ports, connexions et informations système sur la plupart des serveurs Linux, avec des graphiques d'historique. Les cartes de gestion vous permettent de gérer les services, les tâches cron, les paquets, les utilisateurs, les règles de pare-feu, WireGuard, Tailscale, les certificats SSL, les journaux et les vérifications d'état sans quitter Termix.

 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Enregistrez un ensemble d'onglets avec leur disposition en écran divisé et rou
 </td>
 <td width="50%" valign="top">

-**Configuration guidée:**
-Une courte configuration vous aide à choisir un préréglage d'interface, votre thème, les fonctionnalités que vous voulez et votre premier hôte. Le mode simple masque ce que vous n'utilisez pas, et vous pouvez relancer la configuration ou changer de préréglage quand vous voulez.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Application de bureau autonome et synchronisation:**
-L'application de bureau fonctionne toute seule, avec son propre backend et sa base de données, sans serveur. Vous pouvez aussi la relier à un serveur Termix pour synchroniser dans les deux sens les hôtes, les identifiants, les extraits et le reste, et choisir si les connexions partent de votre machine ou passent par le serveur.
-
-</td>
-<td width="50%" valign="top">
-
 **Ligne de commande:**
 Un CLI `termix` pour votre shell et vos scripts. Ouvrez des terminaux, lancez une commande sur un hôte ou une flotte entière, déplacez des fichiers en SFTP et gérez hôtes, extraits et identifiants. Installez-le avec `npm install -g @termix-cli/cli` ou récupérez un binaire autonome. Voir la [documentation du CLI](https://docs.termix.site/cli).

@@ -237,7 +223,7 @@ Un CLI `termix` pour votre shell et vos scripts. Ouvrez des terminaux, lancez un
 <td width="50%" valign="top">

 **Sécurité:**
-Les mots de passe, les clés et les autres secrets sont chiffrés par utilisateur, et les fichiers de base de données eux-mêmes peuvent être chiffrés sur le disque. Voir la [documentation](https://docs.termix.site/security) pour le détail.
+Les mots de passe, les clés et les autres secrets sont chiffrés par utilisateur, et les fichiers de base de données eux-mêmes peuvent être chiffrés sur le disque. Voir la [documentation](https://docs.termix.site/features/authentication/security/) pour le détail.

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Une trentaine de langues intégrées, gérées via [Crowdin](https://docs.termix
 - **Raccourcis clavier** - Naviguer entre les onglets, les fermer et plus encore, tout est reconfigurable
 - **Wake-on-LAN** - Réveillez une machine depuis Termix ou depuis une étape d'automatisation
 - **Authentification par proxy de confiance** - Laissez un reverse proxy gérer la connexion et transmettre l'utilisateur
- **SSH complet** - Hôtes de rebond, Warpgate, demandes TOTP, SOCKS5, vérification des clés d'hôte, remplissage automatique des mots de passe, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, journalisation du terminal, transfert d'agent, agent SSH Bitwarden, signature SSH HashiCorp Vault et plus encore
+- **Marque blanche** - Les administrateurs peuvent personnaliser l'instance avec leur propre nom, logo et couleurs
+- **Points d'accès web** - Ouvrez l'interface web d'un hôte, comme la page d'administration d'un routeur, directement dans Termix plutôt que dans un onglet séparé
+- **Salles de collaboration** - Des salles persistantes où un groupe peut passer d'une session à l'autre ensemble, avec une scène pour le présentateur et des invitations
+- **SSH complet** - Hôtes de rebond, Warpgate, demandes TOTP, SOCKS5, vérification des clés d'hôte, remplissage automatique des mots de passe, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, journalisation du terminal, transfert d'agent, agent SSH Bitwarden, signature SSH HashiCorp Vault, Step CA, 1Password Connect et plus encore
 - **Termix ID** - Une version intégrée de sshid.io. Réservez un identifiant, publiez vos clés publiques sur une URL de résolution et émettez des certificats SSH depuis l'autorité intégrée
+- **Suggestions automatiques d'historique de commandes** - Des suggestions en ligne dans le terminal pendant que vous tapez, basées sur votre historique de commandes
+- **Application de bureau autonome et synchronisation** - L'application de bureau fonctionne toute seule, avec son propre backend et sa base de données, et peut en option se synchroniser avec un serveur Termix

 </details>

@@ -313,6 +304,8 @@ Une trentaine de langues intégrées, gérées via [Crowdin](https://docs.termix

 Consultez la [documentation Termix](https://docs.termix.site/install) pour les instructions d'installation complètes sur toutes les plateformes.

+Vous déployez sur Kubernetes ? Le chart Helm se trouve dans `charts/termix`, et les instructions de configuration couvrant Ingress, Traefik, Argo CD, GitHub Actions et GitLab CI sont sur [docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes).
+
 Exemple de fichier Docker Compose (vous pouvez retirer `guacd` et le réseau si vous ne comptez pas utiliser le bureau à distance) :

 ```yaml
@@ -237,7 +237,7 @@ CPU, मेमोरी और डिस्क जैसी होस्ट म
 <td width="50%" valign="top">

 **सुरक्षा:**
-पासवर्ड, कुंजियाँ और बाकी गोपनीय जानकारी हर उपयोगकर्ता के लिए अलग से एन्क्रिप्ट होती है, और डेटाबेस फ़ाइलें भी डिस्क पर एन्क्रिप्ट की जा सकती हैं। यह कैसे काम करता है, यह [दस्तावेज़](https://docs.termix.site/security) में देखें।
+पासवर्ड, कुंजियाँ और बाकी गोपनीय जानकारी हर उपयोगकर्ता के लिए अलग से एन्क्रिप्ट होती है, और डेटाबेस फ़ाइलें भी डिस्क पर एन्क्रिप्ट की जा सकती हैं। यह कैसे काम करता है, यह [दस्तावेज़](https://docs.termix.site/features/authentication/security/) में देखें।

 </td>
 <td width="50%" valign="top">
@@ -83,13 +83,13 @@ RDP, VNC e Telnet nel browser, in schede e schermo diviso come qualsiasi altra s
 <td width="50%" valign="top">

 **Tunnel SSH:**
-Inoltro locale, remoto e SOCKS dinamico, con riconnessione automatica e controlli di stato. I tunnel da client a server dell'app desktop restano su quella macchina, e puoi salvare delle preimpostazioni sul server per portare una configurazione su un altro computer.
+Inoltro locale, remoto e SOCKS dinamico, con riconnessione automatica e controlli di stato. I tunnel da client a server dell'app desktop restano su quella macchina, e puoi salvare delle preimpostazioni sul server per portare una configurazione su un altro client.

 </td>
 <td width="50%" valign="top">

 **Gestore file:**
-Sfoglia, modifica, carica, scarica, rinomina, sposta ed elimina file via SFTP, anche con sudo. Guarda e modifica codice, immagini, audio e video. Copia i file direttamente da un server all'altro: il percorso più veloce viene scelto per te e i trasferimenti vengono verificati.
+Sfoglia, modifica, carica, scarica, rinomina, sposta ed elimina file via SFTP, anche con sudo. Guarda e modifica codice, immagini, audio e video. Copia i file direttamente da un server all'altro in una scheda dedicata di trasferimento, con il percorso più veloce scelto per te e i trasferimenti controllati per integrità. L'app desktop ha anche una vista affiancata di locale e remoto.

 </td>
 </tr>
@@ -111,7 +111,7 @@ Salva e organizza gli host con etichette e cartelle annidate a cui puoi dare nom
 <td width="50%" valign="top">

 **Metriche host:**
-CPU, memoria, disco, rete, temperatura, tempo di accensione, processi, porte, accessi e informazioni di sistema sulla maggior parte dei server Linux, con grafici storici. Le schede di gestione ti fanno seguire servizi, cron, pacchetti, utenti, regole del firewall, WireGuard, Tailscale, certificati SSL, log e controlli di stato senza uscire da Termix.
+CPU, memoria, disco, rete, temperatura, GPU NVIDIA, tempo di accensione, processi, porte, accessi e informazioni di sistema sulla maggior parte dei server Linux, con grafici storici. Le schede di gestione ti fanno seguire servizi, cron, pacchetti, utenti, regole del firewall, WireGuard, Tailscale, certificati SSL, log e controlli di stato senza uscire da Termix.

 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Salva un insieme di schede con la loro disposizione divisa e riapri tutto con un
 </td>
 <td width="50%" valign="top">

-**Configurazione guidata:**
-Una breve configurazione ti accompagna nella scelta di una preimpostazione dell'interfaccia, del tema, delle funzionalità che vuoi e del primo host. La modalità semplice nasconde quello che non usi, e puoi rifare la configurazione o cambiare preimpostazione quando vuoi.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop autonomo e sincronizzazione:**
-L'app desktop funziona da sola, con backend e database locali, senza bisogno di un server. Puoi anche collegarla a un server Termix per sincronizzare nei due sensi host, credenziali, frammenti e altro, e scegliere se le connessioni partono dal tuo computer o passano dal server.
-
-</td>
-<td width="50%" valign="top">
-
 **Riga di comando:**
 Una CLI `termix` per la tua shell e i tuoi script. Apri terminali, esegui un comando su un host o su un'intera flotta, sposta file via SFTP e gestisci host, frammenti e credenziali. Installala con `npm install -g @termix-cli/cli` oppure prendi un binario autonomo. Vedi la [documentazione della CLI](https://docs.termix.site/cli).

@@ -237,7 +223,7 @@ Una CLI `termix` per la tua shell e i tuoi script. Apri terminali, esegui un com
 <td width="50%" valign="top">

 **Sicurezza:**
-Password, chiavi e altri segreti sono cifrati per ogni utente, e gli stessi file del database possono essere cifrati su disco. Guarda la [documentazione](https://docs.termix.site/security) per capire come funziona.
+Password, chiavi e altri segreti sono cifrati per ogni utente, e gli stessi file del database possono essere cifrati su disco. Guarda la [documentazione](https://docs.termix.site/features/authentication/security/) per capire come funziona.

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Circa 30 lingue incluse, gestite tramite [Crowdin](https://docs.termix.site/tran
 - **Scorciatoie da tastiera** - Spostarsi tra le schede, chiuderle e altro, tutto riassegnabile
 - **Wake-on-LAN** - Accendi una macchina da Termix o da un passaggio di un'automazione
 - **Autenticazione tramite proxy fidato** - Lascia che un reverse proxy gestisca l'accesso e passi l'utente
- **SSH molto completo** - Host di salto, Warpgate, richieste TOTP, SOCKS5, verifica delle chiavi host, riempimento automatico della password, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, log del terminale, inoltro dell'agente, agente SSH di Bitwarden, firma SSH con HashiCorp Vault e altro
+- **White label** - Gli amministratori possono rimarchiare l'istanza con nome, logo e colori propri
+- **Endpoint web** - Apri l'interfaccia web di un host, come la pagina di amministrazione di un router, incorporata dentro Termix invece che in una scheda separata
+- **Stanze di collaborazione** - Stanze persistenti dove un gruppo può passare insieme da una sessione all'altra, con un palco per il presentatore e inviti
+- **SSH molto completo** - Host di salto, Warpgate, richieste TOTP, SOCKS5, verifica delle chiavi host, riempimento automatico della password, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, log del terminale, inoltro dell'agente, agente SSH di Bitwarden, firma SSH con HashiCorp Vault, Step CA, 1Password Connect e altro
 - **Termix ID** - Una versione integrata di sshid.io. Prendi un identificativo, pubblica le tue chiavi pubbliche su un URL di risoluzione ed emetti certificati SSH dalla CA integrata
+- **Suggerimenti automatici nella cronologia comandi** - Suggerimenti in linea nel terminale mentre scrivi, basati sulla tua cronologia comandi
+- **Desktop autonomo e sincronizzazione** - L'app desktop funziona da sola, con backend e database locali, e può facoltativamente sincronizzarsi con un server Termix

 </details>

@@ -313,6 +304,10 @@ Circa 30 lingue incluse, gestite tramite [Crowdin](https://docs.termix.site/tran

 Vai alla [documentazione di Termix](https://docs.termix.site/install) per le istruzioni complete di installazione su tutte le piattaforme.

+Vuoi installare su Kubernetes? Il chart Helm è in `charts/termix`, e le istruzioni di configurazione
+per Ingress, Traefik, Argo CD, GitHub Actions e GitLab CI sono su
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes).
+
 Esempio di file Docker Compose (puoi togliere `guacd` e la rete se non pensi di usare il desktop remoto):

 ```yaml
@@ -364,7 +359,7 @@ Può aprire terminali, eseguire un comando su un host o su un'intera flotta, spo

 ### Hosting in cloud

-Puoi far girare il server Termix su un VPS invece che dentro la tua rete. Se Termix gira sulla rete che gestisce, un guasto se lo porta via proprio quando ti servirebbe per sistemare le cose. Fuori resta raggiungibile, ti dà un IP fisso e ci entri da ovunque senza VPN né porte aperte.
+Puoi far girare il server Termix su un VPS invece che dentro la tua rete. Se Termix gira sulla rete che gestisce, un guasto se lo porta via proprio quando ti servirebbe per sistemare le cose. Farlo girare altrove lo mantiene raggiungibile, ti dà un IP fisso e ti permette di entrare da ovunque senza VPN né porte aperte.

 [GINERNET](https://docs.termix.site/install/ginernet) sponsorizza Termix, e nella documentazione c'è una guida passo passo per il rilascio sulla loro piattaforma VPS.

@@ -507,3 +502,5 @@ Tutte le funzionalità pianificate sono su [Projects](https://github.com/orgs/Te
 ## Licenza

 Distribuito con licenza Apache versione 2.0. Vedi `LICENSE` per maggiori informazioni.
+</content>
+</invoke>
@@ -89,7 +89,7 @@ RDP、VNC、Telnet をブラウザから利用でき、他のセッションと
 <td width="50%" valign="top">

 **ファイルマネージャー:**
-SFTP でファイルの閲覧、編集、アップロード、ダウンロード、名前変更、移動、削除ができ、sudo にも対応しています。コード、画像、音声、動画を表示・編集できます。サーバー間で直接ファイルをコピーでき、最速の経路が自動で選ばれ、転送の整合性も検証されます。
+SFTP でファイルの閲覧、編集、アップロード、ダウンロード、名前変更、移動、削除ができ、sudo にも対応しています。コード、画像、音声、動画を表示・編集できます。専用の転送タブでサーバー間から直接ファイルをコピーでき、最速の経路が自動で選ばれ、転送の整合性も検証されます。デスクトップ版にはローカルとリモートを並べて表示する画面もあります。

 </td>
 </tr>
@@ -111,7 +111,7 @@ SFTP でファイルの閲覧、編集、アップロード、ダウンロード
 <td width="50%" valign="top">

 **ホストメトリクス:**
-たいていの Linux サーバーで CPU、メモリ、ディスク、ネットワーク、温度、稼働時間、プロセス、ポート、ログイン、システム情報を履歴グラフ付きで確認できます。マネージャーカードを使えば、サービス、cron、パッケージ、ユーザー、ファイアウォール、WireGuard、Tailscale、SSL 証明書、ログ、ヘルスチェックを Termix から離れずに扱えます。
+たいていの Linux サーバーで CPU、メモリ、ディスク、ネットワーク、温度、NVIDIA GPU、稼働時間、プロセス、ポート、ログイン、システム情報を履歴グラフ付きで確認できます。マネージャーカードを使えば、サービス、cron、パッケージ、ユーザー、ファイアウォール、WireGuard、Tailscale、SSL 証明書、ログ、ヘルスチェックを Termix から離れずに扱えます。

 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Proxmox のインスタンスからそのままホストを取り込めます。
 </td>
 <td width="50%" valign="top">

-**ガイド付きセットアップ:**
-短いセットアップが、画面のプリセット、テーマ、使いたい機能、最初のホストの選択を案内します。シンプルモードは使わないものを隠してくれます。セットアップはいつでもやり直せますし、プリセットも切り替えられます。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**デスクトップ単体利用と同期:**
-デスクトップアプリはローカルのバックエンドとデータベースを持ち、サーバーなしで単体で動きます。Termix サーバーにつなげば、ホスト、認証情報、スニペットなどを双方向で同期でき、接続をローカルから始めるかサーバー経由にするかも選べます。
-
-</td>
-<td width="50%" valign="top">
-
 **コマンドラインツール:**
 シェルやスクリプトから使える `termix` CLI です。ターミナルを開き、ホスト 1 台またはフリート全体でコマンドを実行し、SFTP でファイルを移動し、ホストやスニペット、認証情報を管理できます。`npm install -g @termix-cli/cli` で入れるか、単体のバイナリを使ってください。詳しくは [CLI ドキュメント](https://docs.termix.site/cli)をご覧ください。

@@ -237,7 +223,7 @@ Proxmox のインスタンスからそのままホストを取り込めます。
 <td width="50%" valign="top">

 **セキュリティ:**
-パスワードや鍵などの秘密情報はユーザーごとに暗号化され、データベースのファイル自体もディスク上で暗号化できます。仕組みは[ドキュメント](https://docs.termix.site/security)をご覧ください。
+パスワードや鍵などの秘密情報はユーザーごとに暗号化され、データベースのファイル自体もディスク上で暗号化できます。仕組みは[ドキュメント](https://docs.termix.site/features/authentication/security/)をご覧ください。

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Proxmox のインスタンスからそのままホストを取り込めます。
 - **キーボードショートカット** - タブの移動や閉じる操作など、すべて割り当て変更可能
 - **Wake-on-LAN** - Termix からでも自動化のステップからでもマシンを起動
 - **信頼済みプロキシ認証** - リバースプロキシにサインインを任せ、ユーザー情報を引き継ぎ
- **充実した SSH 機能** - 踏み台ホスト、Warpgate、TOTP の入力、SOCKS5、ホスト鍵の検証、パスワードの自動入力、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、ポートノッキング、ターミナルのログ、エージェント転送、Bitwarden SSH エージェント、HashiCorp Vault の SSH 署名など
+- **ホワイトラベル** - 管理者が自分の名前、ロゴ、配色でインスタンスをブランド変更できます
+- **Web エンドポイント** - ルーターの管理画面のようなホスト自身の Web UI を、別タブではなく Termix の中に埋め込んで開けます
+- **コラボレーションルーム** - グループでセッションを行き来できる常設ルーム。プレゼンターの表示や招待機能もあります
+- **充実した SSH 機能** - 踏み台ホスト、Warpgate、TOTP の入力、SOCKS5、ホスト鍵の検証、パスワードの自動入力、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、ポートノッキング、ターミナルのログ、エージェント転送、Bitwarden SSH エージェント、HashiCorp Vault の SSH 署名、Step CA、1Password Connect など
 - **Termix ID** - sshid.io のような仕組みを内蔵。ハンドルを取得し、公開鍵をリゾルバー URL で公開し、内蔵 CA から SSH 証明書を発行できます
+- **コマンド履歴の自動候補** - ターミナルに入力すると、コマンド履歴をもとにしたインライン候補が表示されます
+- **デスクトップ単体利用と同期** - デスクトップアプリはローカルのバックエンドとデータベースを持ち単体でも動き、Termix サーバーと同期することもできます

 </details>

@@ -313,6 +304,10 @@ Proxmox のインスタンスからそのままホストを取り込めます。

 すべてのプラットフォーム向けの詳しいインストール手順は [Termix ドキュメント](https://docs.termix.site/install)をご覧ください。

+Kubernetes にデプロイしますか？Helm chart は `charts/termix` にあり、
+Ingress、Traefik、Argo CD、GitHub Actions、GitLab CI を扱うセットアップ手順は
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes) にあります。
+
 Docker Compose の例です（リモートデスクトップ機能を使わないなら `guacd` とネットワークの部分は省略できます）:

 ```yaml
@@ -507,3 +502,4 @@ Termix は無料でオープンソースで、サブスクリプションも有
 ## ライセンス

 Apache License 2.0 のもとで配布しています。詳しくは `LICENSE` をご覧ください。
+</content>
@@ -111,7 +111,7 @@ SFTP로 파일을 살펴보고 편집하고 올리고 내려받고 이름을 바
 <td width="50%" valign="top">

 **호스트 지표:**
-대부분의 리눅스 서버에서 CPU, 메모리, 디스크, 네트워크, 온도, 가동 시간, 프로세스, 포트, 로그인, 시스템 정보를 기록 그래프와 함께 볼 수 있습니다. 관리 카드로 서비스와 cron 작업, 패키지, 사용자, 방화벽 규칙, WireGuard, Tailscale, SSL 인증서, 로그, 상태 확인을 Termix 안에서 처리할 수 있습니다.
+대부분의 리눅스 서버에서 CPU, 메모리, 디스크, 네트워크, 온도, NVIDIA GPU, 가동 시간, 프로세스, 포트, 로그인, 시스템 정보를 기록 그래프와 함께 볼 수 있습니다. 관리 카드로 서비스와 cron 작업, 패키지, 사용자, 방화벽 규칙, WireGuard, Tailscale, SSL 인증서, 로그, 상태 확인을 Termix 안에서 처리할 수 있습니다.

 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Proxmox 인스턴스에서 호스트를 바로 가져오고, 노드와 게스트
 </td>
 <td width="50%" valign="top">

-**설치 안내:**
-짧은 설정 과정이 화면 프리셋과 테마, 쓰고 싶은 기능, 첫 호스트를 고르도록 안내합니다. 간단 모드는 쓰지 않는 것을 숨겨 주고, 설정은 언제든 다시 하거나 프리셋을 바꿀 수 있습니다.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**데스크톱 단독 실행과 동기화:**
-데스크톱 앱은 자체 백엔드와 데이터베이스로 서버 없이 혼자 돌아갑니다. Termix 서버에 연결하면 호스트와 자격 증명, 스니펫 등을 양방향으로 동기화할 수 있고, 연결을 로컬에서 시작할지 서버를 거칠지도 고를 수 있습니다.
-
-</td>
-<td width="50%" valign="top">
-
 **명령줄 도구:**
 셸과 스크립트에서 쓰는 `termix` CLI입니다. 터미널을 열고, 호스트 하나나 플릿 전체에서 명령을 실행하고, SFTP로 파일을 옮기고, 호스트와 스니펫, 자격 증명을 관리할 수 있습니다. `npm install -g @termix-cli/cli`로 설치하거나 단독 실행 파일을 받으면 됩니다. [CLI 문서](https://docs.termix.site/cli)를 참고하세요.

@@ -237,7 +223,7 @@ Proxmox 인스턴스에서 호스트를 바로 가져오고, 노드와 게스트
 <td width="50%" valign="top">

 **보안:**
-비밀번호와 키를 비롯한 비밀 정보는 사용자별로 암호화되고, 데이터베이스 파일 자체도 디스크에서 암호화할 수 있습니다. 어떻게 동작하는지는 [문서](https://docs.termix.site/security)에서 볼 수 있습니다.
+비밀번호와 키를 비롯한 비밀 정보는 사용자별로 암호화되고, 데이터베이스 파일 자체도 디스크에서 암호화할 수 있습니다. 어떻게 동작하는지는 [문서](https://docs.termix.site/features/authentication/security/)에서 볼 수 있습니다.

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Proxmox 인스턴스에서 호스트를 바로 가져오고, 노드와 게스트
 - **키보드 단축키** - 탭 이동과 닫기 등, 모두 다시 지정할 수 있습니다
 - **Wake-on-LAN** - Termix에서도, 자동화 단계에서도 컴퓨터를 켜기
 - **신뢰할 수 있는 프록시 인증** - 리버스 프록시가 로그인을 처리하고 사용자 정보를 넘겨주기
- **풍부한 SSH 기능** - 점프 호스트, Warpgate, TOTP 입력, SOCKS5, 호스트 키 확인, 비밀번호 자동 입력, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, 포트 노킹, 터미널 로그, 에이전트 포워딩, Bitwarden SSH 에이전트, HashiCorp Vault SSH 서명 등
+- **화이트 라벨** - 관리자가 인스턴스를 자기 이름과 로고, 색으로 다시 꾸밀 수 있습니다
+- **웹 엔드포인트** - 라우터 관리 페이지 같은 호스트의 웹 UI를 별도 탭이 아니라 Termix 안에 그대로 띄우기
+- **협업 룸** - 발표자 화면과 초대 기능을 갖춘, 여러 명이 함께 세션을 오가는 상시 룸
+- **풍부한 SSH 기능** - 점프 호스트, Warpgate, TOTP 입력, SOCKS5, 호스트 키 확인, 비밀번호 자동 입력, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, 포트 노킹, 터미널 로그, 에이전트 포워딩, Bitwarden SSH 에이전트, HashiCorp Vault SSH 서명, Step CA, 1Password Connect 등
 - **Termix ID** - sshid.io 같은 기능을 내장했습니다. 핸들을 등록하고 리졸버 URL에 공개 키를 올리고 내장 CA에서 SSH 인증서를 발급할 수 있습니다
+- **명령 기록 자동 완성** - 입력하는 동안 명령 기록을 바탕으로 터미널에 인라인 제안을 보여줍니다
+- **데스크톱 단독 실행과 동기화** - 데스크톱 앱은 자체 백엔드와 데이터베이스로 서버 없이 혼자 돌아가며, Termix 서버와 선택적으로 동기화할 수 있습니다

 </details>

@@ -313,6 +304,8 @@ Proxmox 인스턴스에서 호스트를 바로 가져오고, 노드와 게스트

 모든 플랫폼의 자세한 설치 방법은 [Termix 문서](https://docs.termix.site/install)를 참고하세요.

+쿠버네티스에 배포하시나요? Helm 차트는 `charts/termix`에 있고, Ingress와 Traefik, Argo CD, GitHub Actions, GitLab CI를 다루는 설정 안내는 [docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes)에 있습니다.
+
 Docker Compose 예시입니다(원격 데스크톱 기능을 쓰지 않는다면 `guacd`와 네트워크 부분은 빼도 됩니다):

 ```yaml
@@ -214,20 +214,6 @@ Salva um conjunto de abas com a divisão da tela e reabre tudo com um clique. O
 </td>
 <td width="50%" valign="top">

-**Configuração guiada:**
-Uma configuração curta te leva por escolher uma predefinição de interface, o tema, as funcionalidades que queres e o teu primeiro host. O modo simples esconde o que não usas, e dá para refazer a configuração ou trocar de predefinição quando quiseres.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop independente e sincronização:**
-O aplicativo de desktop roda sozinho, com backend e banco de dados locais, sem servidor. Também dá para ligar num servidor Termix e sincronizar nos dois sentidos hosts, credenciais, trechos e mais, e escolher se as conexões saem da tua máquina ou passam pelo servidor.
-
-</td>
-<td width="50%" valign="top">
-
 **Linha de comando:**
 Um CLI `termix` para o teu shell e os teus scripts. Abre terminais, roda um comando num host ou numa frota inteira, move arquivos por SFTP e gerencia hosts, trechos e credenciais. Instala com `npm install -g @termix-cli/cli` ou pega um binário independente. Vê a [documentação do CLI](https://docs.termix.site/cli).

@@ -237,7 +223,7 @@ Um CLI `termix` para o teu shell e os teus scripts. Abre terminais, roda um coma
 <td width="50%" valign="top">

 **Segurança:**
-Senhas, chaves e outros segredos são criptografados por usuário, e os próprios arquivos do banco de dados podem ser criptografados em disco. Vê a [documentação](https://docs.termix.site/security) para entender como funciona.
+Senhas, chaves e outros segredos são criptografados por usuário, e os próprios arquivos do banco de dados podem ser criptografados em disco. Vê a [documentação](https://docs.termix.site/features/authentication/security/) para entender como funciona.

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Cerca de 30 idiomas incluídos, gerenciados pelo [Crowdin](https://docs.termix.s
 - **Atalhos de teclado** - Trocar de aba, fechar abas e mais, tudo remapeável
 - **Wake-on-LAN** - Liga uma máquina pelo Termix ou por um passo de automação
 - **Autenticação por proxy confiável** - Deixa um proxy reverso cuidar do login e repassar o usuário
- **SSH bem completo** - Hosts de salto, Warpgate, pedidos de TOTP, SOCKS5, verificação de chave de host, preenchimento automático de senha, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro do terminal, encaminhamento de agente, agente SSH do Bitwarden, assinatura SSH com HashiCorp Vault e mais
+- **Marca própria** - Os administradores podem rebatizar a instância com nome, logo e cores próprios
+- **Endpoints web** - Abre a interface web do próprio host, como a página de administração de um roteador, embutida no Termix em vez de numa aba separada
+- **Salas de colaboração** - Salas persistentes onde um grupo pode passar de uma sessão para outra junto, com um palco de apresentação e convites
+- **SSH bem completo** - Hosts de salto, Warpgate, pedidos de TOTP, SOCKS5, verificação de chave de host, preenchimento automático de senha, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro do terminal, encaminhamento de agente, agente SSH do Bitwarden, assinatura SSH com HashiCorp Vault, Step CA, 1Password Connect e mais
 - **Termix ID** - Uma versão embutida do sshid.io. Registra um identificador, publica as tuas chaves públicas numa URL de resolução e emite certificados SSH pela CA embutida
+- **Sugestões automáticas de histórico de comandos** - Sugestões dentro do terminal enquanto tu digitas, baseadas no teu histórico de comandos
+- **Desktop independente e sincronização** - O aplicativo de desktop roda sozinho, com backend e banco de dados locais, e pode opcionalmente sincronizar com um servidor Termix

 </details>

@@ -214,20 +214,6 @@ RDP, VNC и Telnet прямо в браузере, во вкладках и с
 </td>
 <td width="50%" valign="top">

-**Пошаговая настройка:**
-Короткая настройка поможет выбрать шаблон интерфейса, тему, нужные возможности и первый хост. Простой режим скрывает то, чем вы не пользуетесь, а настройку можно пройти заново или сменить шаблон в любой момент.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Автономный клиент и синхронизация:**
-Настольное приложение работает само по себе, со своим бэкендом и базой данных, без сервера. Его можно подключить к серверу Termix, чтобы в обе стороны синхронизировать хосты, учётные данные, сниппеты и остальное, и выбрать, откуда идут подключения: с вашего компьютера или через сервер.
-
-</td>
-<td width="50%" valign="top">
-
 **Командная строка:**
 CLI `termix` для вашей оболочки и ваших скриптов. Открывайте терминалы, выполняйте команду на одном хосте или на целом флоте, перемещайте файлы по SFTP и управляйте хостами, сниппетами и учётными данными. Установите через `npm install -g @termix-cli/cli` или возьмите отдельный исполняемый файл. Смотрите [документацию CLI](https://docs.termix.site/cli).

@@ -237,7 +223,7 @@ CLI `termix` для вашей оболочки и ваших скриптов.
 <td width="50%" valign="top">

 **Безопасность:**
-Пароли, ключи и другие секреты шифруются для каждого пользователя, а сами файлы базы данных можно зашифровать на диске. Как это устроено, описано в [документации](https://docs.termix.site/security).
+Пароли, ключи и другие секреты шифруются для каждого пользователя, а сами файлы базы данных можно зашифровать на диске. Как это устроено, описано в [документации](https://docs.termix.site/features/authentication/security/).

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ CLI `termix` для вашей оболочки и ваших скриптов.
 - **Сочетания клавиш** - Переход между вкладками, их закрытие и другое, всё можно переназначить
 - **Wake-on-LAN** - Разбудите машину из Termix или из шага автоматизации
 - **Доверенный прокси** - Пусть обратный прокси возьмёт вход на себя и передаст пользователя
- **Богатые возможности SSH** - Промежуточные хосты, Warpgate, запросы TOTP, SOCKS5, проверка ключей хоста, автозаполнение паролей, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, журналы терминала, проброс агента, SSH-агент Bitwarden, подпись SSH через HashiCorp Vault и другое
+- **Собственный бренд** - Администраторы могут переоформить установку под своё имя, логотип и цвета
+- **Веб-эндпоинты** - Открывайте собственный веб-интерфейс хоста, например админку роутера, прямо внутри Termix вместо отдельной вкладки
+- **Комнаты для совместной работы** - Постоянные комнаты, где группа может вместе переключаться между сессиями, с режимом докладчика и приглашениями
+- **Богатые возможности SSH** - Промежуточные хосты, Warpgate, запросы TOTP, SOCKS5, проверка ключей хоста, автозаполнение паролей, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, журналы терминала, проброс агента, SSH-агент Bitwarden, подпись SSH через HashiCorp Vault, Step CA, 1Password Connect и другое
 - **Termix ID** - Встроенный аналог sshid.io. Займите имя, опубликуйте открытые ключи по адресу распознавателя и выпускайте SSH-сертификаты через встроенный центр сертификации
+- **Автоподсказки истории команд** - Подсказки прямо в терминале по мере ввода, на основе истории ваших команд
+- **Автономный клиент и синхронизация** - Настольное приложение работает само по себе, со своим бэкендом и локальной базой данных, и может по желанию синхронизироваться с сервером Termix

 </details>

@@ -214,21 +214,7 @@ Bir sekme grubunu bölünmüş düzeniyle birlikte kaydedin ve hepsini tek tıkl
 </td>
 <td width="50%" valign="top">

-**Rehberli kurulum:**
-Kısa bir kurulum, arayüz ön ayarını, temanızı, istediğiniz özellikleri ve ilk sunucunuzu seçmenizde size yol gösterir. Basit kip kullanmadığınız şeyleri gizler; kurulumu istediğiniz zaman yeniden çalıştırabilir veya ön ayarı değiştirebilirsiniz.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Bağımsız masaüstü ve eşitleme:**
-Masaüstü uygulaması kendi arka ucu ve veritabanıyla tek başına, sunucusuz çalışır. İsterseniz bir Termix sunucusuna bağlayıp sunucuları, kimlik bilgilerini, parçacıkları ve fazlasını iki yönlü eşitleyebilir, bağlantıların kendi makinenizden mi yoksa sunucu üzerinden mi kurulacağını seçebilirsiniz.
-
-</td>
-<td width="50%" valign="top">
-
-**Komut satırı:**
+**Komut satırı arayüzü:**
 Kabuğunuz ve betikleriniz için bir `termix` CLI'ı. Terminal açın, tek bir sunucuda veya tüm filoda komut çalıştırın, SFTP ile dosya taşıyın ve sunucuları, parçacıkları ve kimlik bilgilerini yönetin. `npm install -g @termix-cli/cli` ile kurun ya da bağımsız bir çalıştırılabilir dosya edinin. [CLI belgelerine](https://docs.termix.site/cli) bakın.

 </td>
@@ -237,7 +223,7 @@ Kabuğunuz ve betikleriniz için bir `termix` CLI'ı. Terminal açın, tek bir s
 <td width="50%" valign="top">

 **Güvenlik:**
-Parolalar, anahtarlar ve diğer gizli bilgiler kullanıcı bazında şifrelenir, veritabanı dosyalarının kendisi de diskte şifrelenebilir. Nasıl çalıştığı için [belgelere](https://docs.termix.site/security) bakın.
+Parolalar, anahtarlar ve diğer gizli bilgiler kullanıcı bazında şifrelenir, veritabanı dosyalarının kendisi de diskte şifrelenebilir. Nasıl çalıştığı için [belgelere](https://docs.termix.site/features/authentication/security/) bakın.

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Yaklaşık 30 dil yerleşik olarak gelir, [Crowdin](https://docs.termix.site/tra
 - **Klavye kısayolları** - Sekmeler arasında geçiş, sekme kapatma ve dahası, hepsi yeniden atanabilir
 - **Wake-on-LAN** - Bir makineyi Termix'ten ya da bir otomasyon adımından uyandırın
 - **Güvenilir vekil doğrulaması** - Girişi ters vekil sunucu halletsin ve kullanıcıyı aktarsın
- **Zengin SSH desteği** - Atlama sunucuları, Warpgate, TOTP istekleri, SOCKS5, sunucu anahtarı doğrulama, parola otomatik doldurma, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal günlüğü, aracı yönlendirme, Bitwarden SSH aracısı, HashiCorp Vault ile SSH imzalama ve dahası
+- **Beyaz etiket** - Yöneticiler kurulumu kendi adı, logosu ve renkleriyle yeniden markalayabilir
+- **Web uç noktaları** - Bir sunucunun kendi web arayüzünü, örneğin bir yönlendirici yönetim sayfasını, ayrı bir sekme yerine Termix içine gömülü açın
+- **İşbirliği odaları** - Bir grubun oturumlar arasında birlikte geçiş yapabildiği kalıcı odalar; sunum kürsüsü ve davetlerle
+- **Zengin SSH desteği** - Atlama sunucuları, Warpgate, TOTP istekleri, SOCKS5, sunucu anahtarı doğrulama, parola otomatik doldurma, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal günlüğü, aracı yönlendirme, Bitwarden SSH aracısı, HashiCorp Vault ile SSH imzalama, Step CA, 1Password Connect ve dahası
 - **Termix ID** - sshid.io'nun yerleşik hali. Bir kullanıcı adı alın, açık anahtarlarınızı bir çözümleyici adresinde yayımlayın ve yerleşik CA ile SSH sertifikaları çıkarın
+- **Komut geçmişi önerileri** - Yazarken komut geçmişinize dayalı satır içi öneriler
+- **Bağımsız masaüstü ve eşitleme** - Masaüstü uygulaması kendi arka ucu ve veritabanıyla tek başına çalışır, isteğe bağlı olarak bir Termix sunucusuyla eşitlenebilir

 </details>

@@ -214,20 +214,6 @@ Lưu một bộ thẻ cùng cách chia màn hình rồi mở lại toàn bộ ch
 </td>
 <td width="50%" valign="top">

-**Cài đặt có hướng dẫn:**
-Một phần cài đặt ngắn sẽ hướng bạn chọn kiểu giao diện, chủ đề, những tính năng bạn muốn và máy chủ đầu tiên. Chế độ đơn giản ẩn bớt những gì bạn không dùng, và bạn có thể chạy lại phần cài đặt hoặc đổi kiểu bất cứ lúc nào.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Ứng dụng máy tính độc lập và đồng bộ:**
-Ứng dụng máy tính chạy độc lập với backend và cơ sở dữ liệu riêng, không cần máy chủ. Bạn cũng có thể nối nó với một máy chủ Termix để đồng bộ hai chiều máy chủ, thông tin đăng nhập, đoạn lệnh và nhiều thứ khác, và chọn kết nối xuất phát từ máy của bạn hay đi qua máy chủ.
-
-</td>
-<td width="50%" valign="top">
-
 **Dòng lệnh:**
 Công cụ `termix` cho shell và các script của bạn. Mở terminal, chạy một lệnh trên một máy chủ hoặc cả một nhóm, chuyển tệp qua SFTP, và quản lý máy chủ, đoạn lệnh và thông tin đăng nhập. Cài bằng `npm install -g @termix-cli/cli` hoặc tải bản chạy độc lập. Xem [tài liệu CLI](https://docs.termix.site/cli).

@@ -237,7 +223,7 @@ Công cụ `termix` cho shell và các script của bạn. Mở terminal, chạy
 <td width="50%" valign="top">

 **Bảo mật:**
-Mật khẩu, khoá và các thông tin bí mật khác được mã hoá theo từng người dùng, và bản thân các tệp cơ sở dữ liệu cũng có thể mã hoá trên ổ đĩa. Xem [tài liệu](https://docs.termix.site/security) để biết cách hoạt động.
+Mật khẩu, khoá và các thông tin bí mật khác được mã hoá theo từng người dùng, và bản thân các tệp cơ sở dữ liệu cũng có thể mã hoá trên ổ đĩa. Xem [tài liệu](https://docs.termix.site/features/authentication/security/) để biết cách hoạt động.

 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Có sẵn khoảng 30 ngôn ngữ, quản lý qua [Crowdin](https://docs.termix.
 - **Phím tắt** - Chuyển giữa các thẻ, đóng thẻ và nhiều thao tác khác, đều gán lại được
 - **Wake-on-LAN** - Đánh thức một máy từ Termix hoặc từ một bước tự động hoá
 - **Xác thực qua proxy tin cậy** - Để reverse proxy lo phần đăng nhập rồi chuyển thông tin người dùng vào
- **SSH nhiều tính năng** - Máy chủ trung gian, Warpgate, hỏi mã TOTP, SOCKS5, kiểm tra khoá máy chủ, tự điền mật khẩu, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, ghi nhật ký terminal, chuyển tiếp agent, SSH agent của Bitwarden, ký SSH bằng HashiCorp Vault và nhiều thứ khác
+- **Nhãn trắng** - Quản trị viên có thể đổi thương hiệu hệ thống với tên, logo và màu sắc riêng
+- **Điểm cuối web** - Mở giao diện web riêng của một máy chủ, chẳng hạn trang quản trị router, ngay trong Termix thay vì mở một thẻ riêng
+- **Phòng cộng tác** - Phòng lâu dài để cả nhóm cùng chuyển qua lại giữa các phiên, có sân khấu người trình bày và lời mời
+- **SSH nhiều tính năng** - Máy chủ trung gian, Warpgate, hỏi mã TOTP, SOCKS5, kiểm tra khoá máy chủ, tự điền mật khẩu, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, ghi nhật ký terminal, chuyển tiếp agent, SSH agent của Bitwarden, ký SSH bằng HashiCorp Vault, Step CA, 1Password Connect và nhiều thứ khác
 - **Termix ID** - Bản dựng sẵn theo kiểu sshid.io. Đăng ký một tên, công bố khoá công khai của bạn tại một địa chỉ phân giải, và cấp chứng chỉ SSH từ CA tích hợp
+- **Gợi ý lịch sử lệnh** - Gợi ý ngay trong terminal khi bạn gõ, dựa trên lịch sử lệnh của bạn
+- **Ứng dụng máy tính độc lập và đồng bộ** - Ứng dụng máy tính chạy độc lập với backend và cơ sở dữ liệu riêng, có thể đồng bộ tuỳ chọn với một máy chủ Termix

 </details>

@@ -0,0 +1,34 @@
+CREATE TABLE `collab_room_members` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`room_id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`room_role` text NOT NULL DEFAULT ('member'),
+	`added_by` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `collab_room_members_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_collab_room_members_room_user` UNIQUE(`room_id`,`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `collab_rooms` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`persistent` boolean NOT NULL DEFAULT false,
+	`presenter_user_id` varchar(255),
+	`stage_protocol` text,
+	`stage_host_id` int,
+	`stage_share_id` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`ended_at` text,
+	CONSTRAINT `collab_rooms_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_room_id_collab_rooms_id_fk` FOREIGN KEY (`room_id`) REFERENCES `collab_rooms`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_added_by_users_id_fk` FOREIGN KEY (`added_by`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_presenter_user_id_users_id_fk` FOREIGN KEY (`presenter_user_id`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_stage_host_id_ssh_data_id_fk` FOREIGN KEY (`stage_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_stage_share_id_session_shares_id_fk` FOREIGN KEY (`stage_share_id`) REFERENCES `session_shares`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_collab_room_members_user` ON `collab_room_members` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_collab_rooms_owner` ON `collab_rooms` (`owner_user_id`);
@@ -0,0 +1,2 @@
+ALTER TABLE `collab_rooms` ADD `guest_link_token` varchar(255);--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `idx_collab_rooms_guest_token` UNIQUE(`guest_link_token`);
@@ -0,0 +1,15 @@
+CREATE TABLE `secret_sources` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`kind` text NOT NULL DEFAULT ('onepassword-connect'),
+	`base_url` text NOT NULL,
+	`token` text NOT NULL,
+	`shared` boolean NOT NULL DEFAULT false,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `secret_sources_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `secret_sources` ADD CONSTRAINT `secret_sources_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_secret_sources_user` ON `secret_sources` (`user_id`);
@@ -0,0 +1,42 @@
+CREATE TABLE `credential_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_id` int NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('use'),
+	`expires_at` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `credential_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `shared_credential_secrets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_access_id` int NOT NULL,
+	`target_user_id` varchar(255) NOT NULL,
+	`credential_id` int NOT NULL,
+	`encrypted_username` text,
+	`auth_type` text NOT NULL DEFAULT ('password'),
+	`encrypted_password` text,
+	`encrypted_key` text,
+	`encrypted_key_password` text,
+	`key_type` text,
+	`public_key` text,
+	`cert_public_key` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `shared_credential_secrets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_shared_credential_secrets_scope` UNIQUE(`credential_access_id`,`target_user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_cred_secrets_access_id_fk` FOREIGN KEY (`credential_access_id`) REFERENCES `credential_access`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_credential_secrets_target_user_id_users_id_fk` FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_credential_secrets_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_credential_access_user_id` ON `credential_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_role_id` ON `credential_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_credential_id` ON `credential_access` (`credential_id`);--> statement-breakpoint
+CREATE INDEX `idx_shared_credential_secrets_target` ON `shared_credential_secrets` (`target_user_id`,`credential_id`);
@@ -0,0 +1,22 @@
+CREATE TABLE `folder_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`folder` varchar(255) NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('connect'),
+	`expires_at` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `folder_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `snippets` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `vault_profiles` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_folder_access_owner_folder` ON `folder_access` (`owner_user_id`,`folder`);
@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `enable_web_ui` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `web_ui_config` text;
@@ -0,0 +1 @@
+ALTER TABLE `ssh_data` ADD `enable_ai_assistant` boolean DEFAULT false NOT NULL;
@@ -0,0 +1,51 @@
+CREATE TABLE `plugin_install_counts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`registry_id` varchar(255) NOT NULL,
+	`count` int NOT NULL DEFAULT 0,
+	`source` text NOT NULL DEFAULT ('aggregate-telemetry'),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_install_counts_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_install_counts_plugin_registry` UNIQUE(`plugin_id`,`registry_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugin_permission_grants` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`capability` varchar(255) NOT NULL,
+	`granted_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`granted_by` varchar(255) NOT NULL,
+	CONSTRAINT `plugin_permission_grants_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_permission_grants_plugin_capability` UNIQUE(`plugin_id`,`capability`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugin_registries` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`url` text NOT NULL,
+	`kind` text NOT NULL DEFAULT ('community'),
+	`enabled` boolean NOT NULL DEFAULT true,
+	`signing_key` text,
+	`last_checked_at` text,
+	`last_index_hash` text,
+	CONSTRAINT `plugin_registries_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugins` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`version` text NOT NULL,
+	`tier` text NOT NULL DEFAULT ('available'),
+	`source` text NOT NULL DEFAULT ('community'),
+	`registry_id` varchar(255),
+	`state` text NOT NULL DEFAULT ('disabled'),
+	`installed_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`auto_update` boolean NOT NULL DEFAULT false,
+	`manifest_json` text NOT NULL,
+	CONSTRAINT `plugins_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_permission_grants` ADD CONSTRAINT `plugin_permission_grants_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `plugin_permission_grants` ADD CONSTRAINT `plugin_permission_grants_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_plugins_registry_id` ON `plugins` (`registry_id`);
@@ -0,0 +1 @@
+ALTER TABLE `user_preferences` ADD `show_pin_app_rail_button` boolean;
@@ -106,6 +106,69 @@
      "when": 1786757023790,
      "tag": "0014_bitter_nextwave",
      "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "5",
+      "when": 1787576997080,
+      "tag": "0015_red_cobalt_man",
+      "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "5",
+      "when": 1787581983770,
+      "tag": "0016_unusual_tyrannus",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "5",
+      "when": 1787596414390,
+      "tag": "0017_spicy_proteus",
+      "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "5",
+      "when": 1787600445146,
+      "tag": "0018_fancy_barracuda",
+      "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "5",
+      "when": 1787602480861,
+      "tag": "0019_certain_archangel",
+      "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "5",
+      "when": 1788856825810,
+      "tag": "0020_wise_green_goblin",
+      "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "5",
+      "when": 1789677308051,
+      "tag": "0021_thick_galactus",
+      "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "5",
+      "when": 1789744021971,
+      "tag": "0022_secret_blacklash",
+      "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "5",
+      "when": 1789751455875,
+      "tag": "0023_even_beast",
+      "breakpoints": true
    }
  ]
 }
@@ -0,0 +1,32 @@
+CREATE TABLE "collab_room_members" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"room_id" varchar(255) NOT NULL,
+	"user_id" varchar(255) NOT NULL,
+	"room_role" text DEFAULT 'member' NOT NULL,
+	"added_by" varchar(255),
+	"created_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "collab_rooms" (
+	"id" varchar(255) PRIMARY KEY NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"owner_user_id" varchar(255) NOT NULL,
+	"persistent" boolean DEFAULT false NOT NULL,
+	"presenter_user_id" varchar(255),
+	"stage_protocol" text,
+	"stage_host_id" integer,
+	"stage_share_id" varchar(255),
+	"created_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	"ended_at" text
+);
+--> statement-breakpoint
+ALTER TABLE "collab_room_members" ADD CONSTRAINT "collab_room_members_room_id_collab_rooms_id_fk" FOREIGN KEY ("room_id") REFERENCES "public"."collab_rooms"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "collab_room_members" ADD CONSTRAINT "collab_room_members_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "collab_room_members" ADD CONSTRAINT "collab_room_members_added_by_users_id_fk" FOREIGN KEY ("added_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "collab_rooms" ADD CONSTRAINT "collab_rooms_owner_user_id_users_id_fk" FOREIGN KEY ("owner_user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "collab_rooms" ADD CONSTRAINT "collab_rooms_presenter_user_id_users_id_fk" FOREIGN KEY ("presenter_user_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "collab_rooms" ADD CONSTRAINT "collab_rooms_stage_host_id_ssh_data_id_fk" FOREIGN KEY ("stage_host_id") REFERENCES "public"."ssh_data"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "collab_rooms" ADD CONSTRAINT "collab_rooms_stage_share_id_session_shares_id_fk" FOREIGN KEY ("stage_share_id") REFERENCES "public"."session_shares"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "idx_collab_room_members_room_user" ON "collab_room_members" USING btree ("room_id","user_id");--> statement-breakpoint
+CREATE INDEX "idx_collab_room_members_user" ON "collab_room_members" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "idx_collab_rooms_owner" ON "collab_rooms" USING btree ("owner_user_id");
@@ -0,0 +1,2 @@
+ALTER TABLE "collab_rooms" ADD COLUMN "guest_link_token" varchar(255);--> statement-breakpoint
+CREATE UNIQUE INDEX "idx_collab_rooms_guest_token" ON "collab_rooms" USING btree ("guest_link_token");
@@ -0,0 +1,14 @@
+CREATE TABLE "secret_sources" (
+	"id" varchar(255) PRIMARY KEY NOT NULL,
+	"user_id" varchar(255) NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"kind" text DEFAULT 'onepassword-connect' NOT NULL,
+	"base_url" text NOT NULL,
+	"token" text NOT NULL,
+	"shared" boolean DEFAULT false NOT NULL,
+	"created_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	"updated_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "secret_sources" ADD CONSTRAINT "secret_sources_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_secret_sources_user" ON "secret_sources" USING btree ("user_id");
@@ -0,0 +1,40 @@
+CREATE TABLE "credential_access" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"credential_id" integer NOT NULL,
+	"user_id" varchar(255),
+	"role_id" integer,
+	"granted_by" varchar(255) NOT NULL,
+	"permission_level" text DEFAULT 'use' NOT NULL,
+	"expires_at" varchar(255),
+	"created_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "shared_credential_secrets" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"credential_access_id" integer NOT NULL,
+	"target_user_id" varchar(255) NOT NULL,
+	"credential_id" integer NOT NULL,
+	"encrypted_username" text,
+	"auth_type" text DEFAULT 'password' NOT NULL,
+	"encrypted_password" text,
+	"encrypted_key" text,
+	"encrypted_key_password" text,
+	"key_type" text,
+	"public_key" text,
+	"cert_public_key" text,
+	"created_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	"updated_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "credential_access" ADD CONSTRAINT "credential_access_credential_id_ssh_credentials_id_fk" FOREIGN KEY ("credential_id") REFERENCES "public"."ssh_credentials"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "credential_access" ADD CONSTRAINT "credential_access_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "credential_access" ADD CONSTRAINT "credential_access_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "credential_access" ADD CONSTRAINT "credential_access_granted_by_users_id_fk" FOREIGN KEY ("granted_by") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "shared_credential_secrets" ADD CONSTRAINT "shared_credential_secrets_credential_access_id_credential_access_id_fk" FOREIGN KEY ("credential_access_id") REFERENCES "public"."credential_access"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "shared_credential_secrets" ADD CONSTRAINT "shared_credential_secrets_target_user_id_users_id_fk" FOREIGN KEY ("target_user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "shared_credential_secrets" ADD CONSTRAINT "shared_credential_secrets_credential_id_ssh_credentials_id_fk" FOREIGN KEY ("credential_id") REFERENCES "public"."ssh_credentials"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_credential_access_user_id" ON "credential_access" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "idx_credential_access_role_id" ON "credential_access" USING btree ("role_id");--> statement-breakpoint
+CREATE INDEX "idx_credential_access_credential_id" ON "credential_access" USING btree ("credential_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "idx_shared_credential_secrets_scope" ON "shared_credential_secrets" USING btree ("credential_access_id","target_user_id");--> statement-breakpoint
+CREATE INDEX "idx_shared_credential_secrets_target" ON "shared_credential_secrets" USING btree ("target_user_id","credential_id");
@@ -0,0 +1,21 @@
+CREATE TABLE "folder_access" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"owner_user_id" varchar(255) NOT NULL,
+	"folder" varchar(255) NOT NULL,
+	"user_id" varchar(255),
+	"role_id" integer,
+	"granted_by" varchar(255) NOT NULL,
+	"permission_level" text DEFAULT 'connect' NOT NULL,
+	"expires_at" varchar(255),
+	"created_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "ssh_data" ALTER COLUMN "folder" SET DATA TYPE varchar(255);--> statement-breakpoint
+ALTER TABLE "snippets" ALTER COLUMN "folder" SET DATA TYPE varchar(255);--> statement-breakpoint
+ALTER TABLE "ssh_credentials" ALTER COLUMN "folder" SET DATA TYPE varchar(255);--> statement-breakpoint
+ALTER TABLE "vault_profiles" ALTER COLUMN "folder" SET DATA TYPE varchar(255);--> statement-breakpoint
+ALTER TABLE "folder_access" ADD CONSTRAINT "folder_access_owner_user_id_users_id_fk" FOREIGN KEY ("owner_user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "folder_access" ADD CONSTRAINT "folder_access_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "folder_access" ADD CONSTRAINT "folder_access_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "folder_access" ADD CONSTRAINT "folder_access_granted_by_users_id_fk" FOREIGN KEY ("granted_by") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_folder_access_owner_folder" ON "folder_access" USING btree ("owner_user_id","folder");
@@ -0,0 +1,3 @@
+ALTER TABLE "shared_credential_secrets" DROP CONSTRAINT "shared_credential_secrets_credential_access_id_credential_access_id_fk";
+--> statement-breakpoint
+ALTER TABLE "shared_credential_secrets" ADD CONSTRAINT "shared_cred_secrets_access_id_fk" FOREIGN KEY ("credential_access_id") REFERENCES "public"."credential_access"("id") ON DELETE cascade ON UPDATE no action;
@@ -0,0 +1,2 @@
+ALTER TABLE "ssh_data" ADD COLUMN "enable_web_ui" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "ssh_data" ADD COLUMN "web_ui_config" text;
@@ -0,0 +1 @@
+ALTER TABLE "ssh_data" ADD COLUMN "enable_ai_assistant" boolean DEFAULT false NOT NULL;
@@ -0,0 +1,47 @@
+CREATE TABLE "plugin_install_counts" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"plugin_id" varchar(255) NOT NULL,
+	"registry_id" varchar(255) NOT NULL,
+	"count" integer DEFAULT 0 NOT NULL,
+	"source" text DEFAULT 'aggregate-telemetry' NOT NULL,
+	"updated_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "plugin_permission_grants" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"plugin_id" varchar(255) NOT NULL,
+	"capability" varchar(255) NOT NULL,
+	"granted_at" text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	"granted_by" varchar(255) NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "plugin_registries" (
+	"id" varchar(255) PRIMARY KEY NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"url" text NOT NULL,
+	"kind" text DEFAULT 'community' NOT NULL,
+	"enabled" boolean DEFAULT true NOT NULL,
+	"signing_key" text,
+	"last_checked_at" text,
+	"last_index_hash" text
+);
+--> statement-breakpoint
+CREATE TABLE "plugins" (
+	"id" varchar(255) PRIMARY KEY NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"version" text NOT NULL,
+	"tier" text DEFAULT 'available' NOT NULL,
+	"source" text DEFAULT 'community' NOT NULL,
+	"registry_id" varchar(255),
+	"state" text DEFAULT 'disabled' NOT NULL,
+	"installed_at" text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	"updated_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	"auto_update" boolean DEFAULT false NOT NULL,
+	"manifest_json" text NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "plugin_permission_grants" ADD CONSTRAINT "plugin_permission_grants_plugin_id_plugins_id_fk" FOREIGN KEY ("plugin_id") REFERENCES "public"."plugins"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "plugin_permission_grants" ADD CONSTRAINT "plugin_permission_grants_granted_by_users_id_fk" FOREIGN KEY ("granted_by") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "idx_plugin_install_counts_plugin_registry" ON "plugin_install_counts" USING btree ("plugin_id","registry_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "idx_plugin_permission_grants_plugin_capability" ON "plugin_permission_grants" USING btree ("plugin_id","capability");--> statement-breakpoint
+CREATE INDEX "idx_plugins_registry_id" ON "plugins" USING btree ("registry_id");
@@ -0,0 +1 @@
+ALTER TABLE "user_preferences" ADD COLUMN "show_pin_app_rail_button" boolean;
@@ -106,6 +106,76 @@
      "when": 1786757021444,
      "tag": "0014_unusual_maelstrom",
      "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "7",
+      "when": 1787576994553,
+      "tag": "0015_early_spitfire",
+      "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "7",
+      "when": 1787581981251,
+      "tag": "0016_slippery_anita_blake",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1787596411353,
+      "tag": "0017_curved_pet_avengers",
+      "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "7",
+      "when": 1787600442827,
+      "tag": "0018_puzzling_night_nurse",
+      "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "7",
+      "when": 1787602478567,
+      "tag": "0019_oval_puff_adder",
+      "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "7",
+      "when": 1788856769070,
+      "tag": "0020_mean_slipstream",
+      "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "7",
+      "when": 1788856825316,
+      "tag": "0021_modern_ultron",
+      "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "7",
+      "when": 1789677307514,
+      "tag": "0022_demonic_microchip",
+      "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "7",
+      "when": 1789744021429,
+      "tag": "0023_curvy_meggan",
+      "breakpoints": true
+    },
+    {
+      "idx": 24,
+      "version": "7",
+      "when": 1789751455415,
+      "tag": "0024_flimsy_forge",
+      "breakpoints": true
    }
  ]
 }
@@ -0,0 +1,32 @@
+CREATE TABLE `collab_room_members` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`room_id` text NOT NULL,
+	`user_id` text NOT NULL,
+	`room_role` text DEFAULT 'member' NOT NULL,
+	`added_by` text,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	FOREIGN KEY (`room_id`) REFERENCES `collab_rooms`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`added_by`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `idx_collab_room_members_room_user` ON `collab_room_members` (`room_id`,`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_collab_room_members_user` ON `collab_room_members` (`user_id`);--> statement-breakpoint
+CREATE TABLE `collab_rooms` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`owner_user_id` text NOT NULL,
+	`persistent` integer DEFAULT false NOT NULL,
+	`presenter_user_id` text,
+	`stage_protocol` text,
+	`stage_host_id` integer,
+	`stage_share_id` text,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`ended_at` text,
+	FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`presenter_user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`stage_host_id`) REFERENCES `ssh_data`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`stage_share_id`) REFERENCES `session_shares`(`id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+CREATE INDEX `idx_collab_rooms_owner` ON `collab_rooms` (`owner_user_id`);
@@ -0,0 +1,2 @@
+ALTER TABLE `collab_rooms` ADD `guest_link_token` text;--> statement-breakpoint
+CREATE UNIQUE INDEX `idx_collab_rooms_guest_token` ON `collab_rooms` (`guest_link_token`);
@@ -0,0 +1,14 @@
+CREATE TABLE `secret_sources` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`name` text NOT NULL,
+	`kind` text DEFAULT 'onepassword-connect' NOT NULL,
+	`base_url` text NOT NULL,
+	`token` text NOT NULL,
+	`shared` integer DEFAULT false NOT NULL,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_secret_sources_user` ON `secret_sources` (`user_id`);
@@ -0,0 +1,40 @@
+CREATE TABLE `credential_access` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`credential_id` integer NOT NULL,
+	`user_id` text,
+	`role_id` integer,
+	`granted_by` text NOT NULL,
+	`permission_level` text DEFAULT 'use' NOT NULL,
+	`expires_at` text,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_credential_access_user_id` ON `credential_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_role_id` ON `credential_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_credential_id` ON `credential_access` (`credential_id`);--> statement-breakpoint
+CREATE TABLE `shared_credential_secrets` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`credential_access_id` integer NOT NULL,
+	`target_user_id` text NOT NULL,
+	`credential_id` integer NOT NULL,
+	`encrypted_username` text,
+	`auth_type` text DEFAULT 'password' NOT NULL,
+	`encrypted_password` text,
+	`encrypted_key` text(16384),
+	`encrypted_key_password` text,
+	`key_type` text,
+	`public_key` text(4096),
+	`cert_public_key` text(8192),
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	FOREIGN KEY (`credential_access_id`) REFERENCES `credential_access`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `idx_shared_credential_secrets_scope` ON `shared_credential_secrets` (`credential_access_id`,`target_user_id`);--> statement-breakpoint
+CREATE INDEX `idx_shared_credential_secrets_target` ON `shared_credential_secrets` (`target_user_id`,`credential_id`);
@@ -0,0 +1,17 @@
+CREATE TABLE `folder_access` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`owner_user_id` text NOT NULL,
+	`folder` text NOT NULL,
+	`user_id` text,
+	`role_id` integer,
+	`granted_by` text NOT NULL,
+	`permission_level` text DEFAULT 'connect' NOT NULL,
+	`expires_at` text,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_folder_access_owner_folder` ON `folder_access` (`owner_user_id`,`folder`);
@@ -0,0 +1,27 @@
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_shared_credential_secrets` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`credential_access_id` integer NOT NULL,
+	`target_user_id` text NOT NULL,
+	`credential_id` integer NOT NULL,
+	`encrypted_username` text,
+	`auth_type` text DEFAULT 'password' NOT NULL,
+	`encrypted_password` text,
+	`encrypted_key` text(16384),
+	`encrypted_key_password` text,
+	`key_type` text,
+	`public_key` text(4096),
+	`cert_public_key` text(8192),
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`credential_access_id`) REFERENCES `credential_access`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+INSERT INTO `__new_shared_credential_secrets`("id", "credential_access_id", "target_user_id", "credential_id", "encrypted_username", "auth_type", "encrypted_password", "encrypted_key", "encrypted_key_password", "key_type", "public_key", "cert_public_key", "created_at", "updated_at") SELECT "id", "credential_access_id", "target_user_id", "credential_id", "encrypted_username", "auth_type", "encrypted_password", "encrypted_key", "encrypted_key_password", "key_type", "public_key", "cert_public_key", "created_at", "updated_at" FROM `shared_credential_secrets`;--> statement-breakpoint
+DROP TABLE `shared_credential_secrets`;--> statement-breakpoint
+ALTER TABLE `__new_shared_credential_secrets` RENAME TO `shared_credential_secrets`;--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+CREATE UNIQUE INDEX `idx_shared_credential_secrets_scope` ON `shared_credential_secrets` (`credential_access_id`,`target_user_id`);--> statement-breakpoint
+CREATE INDEX `idx_shared_credential_secrets_target` ON `shared_credential_secrets` (`target_user_id`,`credential_id`);
@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `enable_web_ui` integer DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `web_ui_config` text;
@@ -0,0 +1 @@
+ALTER TABLE `ssh_data` ADD `enable_ai_assistant` integer DEFAULT false NOT NULL;
@@ -0,0 +1,47 @@
+CREATE TABLE `plugin_install_counts` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`plugin_id` text NOT NULL,
+	`registry_id` text NOT NULL,
+	`count` integer DEFAULT 0 NOT NULL,
+	`source` text DEFAULT 'aggregate-telemetry' NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `idx_plugin_install_counts_plugin_registry` ON `plugin_install_counts` (`plugin_id`,`registry_id`);--> statement-breakpoint
+CREATE TABLE `plugin_permission_grants` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`plugin_id` text NOT NULL,
+	`capability` text NOT NULL,
+	`granted_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`granted_by` text NOT NULL,
+	FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `idx_plugin_permission_grants_plugin_capability` ON `plugin_permission_grants` (`plugin_id`,`capability`);--> statement-breakpoint
+CREATE TABLE `plugin_registries` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`url` text NOT NULL,
+	`kind` text DEFAULT 'community' NOT NULL,
+	`enabled` integer DEFAULT true NOT NULL,
+	`signing_key` text,
+	`last_checked_at` text,
+	`last_index_hash` text
+);
+--> statement-breakpoint
+CREATE TABLE `plugins` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`version` text NOT NULL,
+	`tier` text DEFAULT 'available' NOT NULL,
+	`source` text DEFAULT 'community' NOT NULL,
+	`registry_id` text,
+	`state` text DEFAULT 'disabled' NOT NULL,
+	`installed_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`auto_update` integer DEFAULT false NOT NULL,
+	`manifest_json` text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `idx_plugins_registry_id` ON `plugins` (`registry_id`);
@@ -0,0 +1 @@
+ALTER TABLE `user_preferences` ADD `show_pin_app_rail_button` integer;
@@ -78,6 +78,76 @@
      "when": 1786757019248,
      "tag": "0010_mean_queen_noir",
      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1787576992255,
+      "tag": "0011_wakeful_titanium_man",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1787581978969,
+      "tag": "0012_yellow_firedrake",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1787596405780,
+      "tag": "0013_tranquil_master_mold",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "6",
+      "when": 1787600440707,
+      "tag": "0014_lean_doctor_octopus",
+      "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "6",
+      "when": 1787602476319,
+      "tag": "0015_glossy_shotgun",
+      "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "6",
+      "when": 1788856768522,
+      "tag": "0016_clever_umar",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1788856824791,
+      "tag": "0017_quick_the_hood",
+      "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "6",
+      "when": 1789677306965,
+      "tag": "0018_free_rockslide",
+      "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "6",
+      "when": 1789744020871,
+      "tag": "0019_magenta_mongoose",
+      "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "6",
+      "when": 1789751454932,
+      "tag": "0020_moaning_fat_cobra",
+      "breakpoints": true
    }
  ]
 }
@@ -0,0 +1,46 @@
+// The embedded backend is a forked child process, so the only evidence the
+// main process gets when it dies is whatever it wrote to stderr on the way
+// out. A port conflict is by far the most common cause (a leftover backend
+// from a hard-killed session, a Termix container bound to the same ports,
+// or an unrelated service on 30001) and it is also the only one the user
+// can actually act on, so it is classified separately from a generic crash
+// and reported with the port that was taken.
+//
+// Every exit reaching here is a failure. Whether the child exited 0, was
+// killed by a signal, or crashed makes no difference to the renderer: the
+// backend process is gone, nothing restarts it, and retrying can never
+// succeed. Only stopBackendServer() knows a shutdown was intentional, and
+// it guards this call rather than encoding that verdict here -- an exit
+// code cannot distinguish "we asked for this" from "something else killed
+// it", and treating a clean-looking exit as benign would leave the
+// renderer waiting forever, which is the failure this classification
+// exists to prevent.
+
+function parseConflictingPort(stderr) {
+  // Node's EADDRINUSE error prints the port twice: once inside the message
+  // ("address already in use :::30001") and once as a numeric `port` field
+  // on the error object. Either is enough, but stderr arrives in chunks and
+  // the tail can be cut off, so both are tried.
+  const fromErrorField = stderr.match(/\bport:\s*(\d{1,5})\b/);
+  if (fromErrorField) return Number(fromErrorField[1]);
+
+  const fromMessage = stderr.match(/address already in use\s+\S*?:(\d{1,5})\b/);
+  if (fromMessage) return Number(fromMessage[1]);
+
+  return null;
+}
+
+/**
+ * Classifies why the embedded backend process ended, from the tail of its
+ * stderr. Always returns a failure -- see the note above on why every exit
+ * that reaches this point counts as one.
+ */
+function classifyBackendFailure(stderr = "") {
+  if (stderr.includes("EADDRINUSE")) {
+    return { reason: "port-in-use", port: parseConflictingPort(stderr) };
+  }
+
+  return { reason: "crashed", port: null };
+}
+
+module.exports = { classifyBackendFailure };
@@ -1,8 +1,36 @@
 const { contextBridge, ipcRenderer } = require("electron");

+const ALLOWED_INVOKE_CHANNELS = new Set([
+  "check-electron-update",
+  "clear-remote-sync-config",
+  "get-desktop-settings",
+  "get-legacy-server-config",
+  "get-remote-sync-config",
+  "get-remote-sync-jwt",
+  "get-remote-sync-status",
+  "get-remote-sync-user-info",
+  "notify-local-login",
+  "remote-sync-now",
+  "save-desktop-settings",
+  "save-remote-sync-config",
+  "save-remote-sync-jwt",
+  "test-server-connection",
+  "allow-invalid-certificate-for-origin",
+  "open-isolated-web-endpoint",
+]);
+
+function invokeAllowed(channel, ...args) {
+  if (!ALLOWED_INVOKE_CHANNELS.has(channel)) {
+    return Promise.reject(new Error(`IPC channel is not allowed: ${channel}`));
+  }
+  return ipcRenderer.invoke(channel, ...args);
+}
+
 contextBridge.exposeInMainWorld("electronAPI", {
  getAppVersion: () => ipcRenderer.invoke("get-app-version"),
  getPlatform: () => ipcRenderer.invoke("get-platform"),
+  getEmbeddedServerStatus: () =>
+    ipcRenderer.invoke("get-embedded-server-status"),
  openNativeRdp: (options) => ipcRenderer.invoke("open-native-rdp", options),

  removeAllListeners: (channel) => ipcRenderer.removeAllListeners(channel),
@@ -18,10 +46,10 @@ contextBridge.exposeInMainWorld("electronAPI", {
    ipcRenderer.invoke("check-local-port-available", host, port),
  getC2STunnelPresetDefaultName: () =>
    ipcRenderer.invoke("get-c2s-tunnel-preset-default-name"),
-  startC2STunnel: (tunnel, index) =>
-    ipcRenderer.invoke("start-c2s-tunnel", tunnel, index),
-  testC2STunnel: (tunnel, index) =>
-    ipcRenderer.invoke("test-c2s-tunnel", tunnel, index),
+  startC2STunnel: (tunnel, index, authToken) =>
+    ipcRenderer.invoke("start-c2s-tunnel", tunnel, index, authToken),
+  testC2STunnel: (tunnel, index, authToken) =>
+    ipcRenderer.invoke("test-c2s-tunnel", tunnel, index, authToken),
  stopC2STunnel: (tunnelName) =>
    ipcRenderer.invoke("stop-c2s-tunnel", tunnelName),
  getC2STunnelStatuses: () => ipcRenderer.invoke("get-c2s-tunnel-statuses"),
@@ -72,6 +100,20 @@ contextBridge.exposeInMainWorld("electronAPI", {

  showSaveDialog: (options) => ipcRenderer.invoke("show-save-dialog", options),
  showOpenDialog: (options) => ipcRenderer.invoke("show-open-dialog", options),
+  getLocalHomeDirectory: () => ipcRenderer.invoke("get-local-home-directory"),
+  listLocalDirectory: (dirPath) =>
+    ipcRenderer.invoke("list-local-directory", dirPath),
+  statLocalPaths: (paths) => ipcRenderer.invoke("stat-local-paths", paths),
+  collectLocalFiles: (paths) =>
+    ipcRenderer.invoke("collect-local-files", paths),
+  createLocalFolder: (parentPath, folderName) =>
+    ipcRenderer.invoke("create-local-folder", parentPath, folderName),
+  renameLocalPath: (entryPath, newName) =>
+    ipcRenderer.invoke("rename-local-path", entryPath, newName),
+  trashLocalPath: (entryPath) =>
+    ipcRenderer.invoke("trash-local-path", entryPath),
+  chmodLocalPath: (entryPath, permissions) =>
+    ipcRenderer.invoke("chmod-local-path", entryPath, permissions),
  createTempFile: (fileData) =>
    ipcRenderer.invoke("create-temp-file", fileData),
  createTempFolder: (folderData) =>
@@ -103,7 +145,39 @@ contextBridge.exposeInMainWorld("electronAPI", {
    return () => ipcRenderer.removeListener(channel, listener);
  },

-  invoke: (channel, ...args) => ipcRenderer.invoke(channel, ...args),
+  // Dual-pane file manager: local disk browsing and streamed transfers.
+  localFs: {
+    home: () => ipcRenderer.invoke("local-fs:home"),
+    list: (dirPath) => ipcRenderer.invoke("local-fs:list", dirPath),
+    mkdir: (parentPath, name) =>
+      ipcRenderer.invoke("local-fs:mkdir", parentPath, name),
+    createFile: (parentPath, name) =>
+      ipcRenderer.invoke("local-fs:create-file", parentPath, name),
+    rename: (oldPath, newName) =>
+      ipcRenderer.invoke("local-fs:rename", oldPath, newName),
+    trash: (paths) => ipcRenderer.invoke("local-fs:trash", paths),
+    ensureDir: (dirPath, rootPath) =>
+      ipcRenderer.invoke("local-fs:ensure-dir", dirPath, rootPath),
+    exists: (paths) => ipcRenderer.invoke("local-fs:exists", paths),
+    walk: (paths) => ipcRenderer.invoke("local-fs:walk", paths),
+    reveal: (targetPath) => ipcRenderer.invoke("local-fs:reveal", targetPath),
+    open: (targetPath) => ipcRenderer.invoke("local-fs:open", targetPath),
+  },
+  localTransfer: {
+    upload: (options) => ipcRenderer.invoke("local-transfer:upload", options),
+    download: (options) =>
+      ipcRenderer.invoke("local-transfer:download", options),
+    cancel: (transferId) =>
+      ipcRenderer.invoke("local-transfer:cancel", transferId),
+    onProgress: (callback) => {
+      const listener = (_event, payload) => callback(payload);
+      ipcRenderer.on("local-transfer:progress", listener);
+      return () =>
+        ipcRenderer.removeListener("local-transfer:progress", listener);
+    },
+  },
+
+  invoke: invokeAllowed,
 });

 contextBridge.exposeInMainWorld("electronClipboard", {
@@ -0,0 +1,27 @@
+const { Agent, fetch: undiciFetch } = require("undici");
+
+function createRemoteSyncFetch(getConfig) {
+  let invalidCertificateAgent;
+  return function fetchRemoteSync(url, options = {}) {
+    const config = getConfig();
+    const target = new URL(url);
+    const allowInvalidCertificate =
+      config?.allowInvalidCertificate === true &&
+      config.serverUrl &&
+      target.protocol === "https:" &&
+      target.origin === new URL(config.serverUrl).origin;
+    if (!allowInvalidCertificate) return fetch(url, options);
+
+    invalidCertificateAgent ??= new Agent({
+      connect: { rejectUnauthorized: false },
+    });
+    return undiciFetch(url, {
+      ...options,
+      dispatcher: invalidCertificateAgent,
+      // A redirected request must not inherit the configured origin's TLS exception.
+      redirect: "error",
+    });
+  };
+}
+
+module.exports = { createRemoteSyncFetch };
@@ -14,8 +14,12 @@
 const { app, safeStorage } = require("electron");
 const fs = require("fs");
 const path = require("path");
+const { orderSyncWrites } = require("./sync-write-order.cjs");
 const { SYNCED_ENTITY_TYPES } = require("./remote-sync-entities.cjs");

+const { createRemoteSyncFetch } = require("./remote-sync-fetch.cjs");
+const fetchRemoteSync = createRemoteSyncFetch(getRemoteSyncConfig);
+
 const SYNC_INTERVAL_MS = 90 * 1000;
 const EMBEDDED_BASE_URL = "http://127.0.0.1:30001";

@@ -37,7 +41,20 @@ function writeJson(filePath, value) {
  if (!fs.existsSync(userDataPath)) {
    fs.mkdirSync(userDataPath, { recursive: true });
  }
-  fs.writeFileSync(filePath, JSON.stringify(value, null, 2));
+  const temporaryPath = `${filePath}.${process.pid}-${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(temporaryPath, JSON.stringify(value, null, 2), {
+      mode: 0o600,
+    });
+    fs.renameSync(temporaryPath, filePath);
+  } catch (error) {
+    try {
+      fs.unlinkSync(temporaryPath);
+    } catch {
+      // already absent
+    }
+    throw error;
+  }
 }

 function getDesktopSettingsPath() {
@@ -141,13 +158,13 @@ async function getRemoteSyncUserInfo() {
  }

  const baseUrl = config.serverUrl.replace(/\/$/, "");
-  const userResponse = await fetch(`${baseUrl}/users/me`, {
+  const userResponse = await fetchRemoteSync(`${baseUrl}/users/me`, {
    headers: { Authorization: `Bearer ${token}`, "X-Electron-App": "true" },
  });
  if (!userResponse.ok) return null;

  const user = await userResponse.json();
-  const rolesResponse = await fetch(
+  const rolesResponse = await fetchRemoteSync(
    `${baseUrl}/rbac/users/${encodeURIComponent(user.userId)}/roles`,
    {
      headers: { Authorization: `Bearer ${token}`, "X-Electron-App": "true" },
@@ -191,6 +208,7 @@ class RemoteSyncEngine {
    this.getMainWindow = getMainWindow;
    this.localJwt = null;
    this.timer = null;
+    this.startupTimer = null;
    this.syncing = false;
    this.status = {
      connected: false,
@@ -220,11 +238,15 @@ class RemoteSyncEngine {
    const config = getRemoteSyncConfig();
    this.status.connected = !!config?.serverUrl;
    if (this.timer) clearInterval(this.timer);
+    if (this.startupTimer) clearTimeout(this.startupTimer);
    this.timer = setInterval(() => this.syncNow(), SYNC_INTERVAL_MS);
    if (config?.serverUrl) {
      // Fire an initial sync shortly after startup rather than waiting a
      // full interval, but don't block app boot on it.
-      setTimeout(() => this.syncNow(), 5000);
+      this.startupTimer = setTimeout(() => {
+        this.startupTimer = null;
+        this.syncNow();
+      }, 5000);
    }
  }

@@ -233,6 +255,10 @@ class RemoteSyncEngine {
      clearInterval(this.timer);
      this.timer = null;
    }
+    if (this.startupTimer) {
+      clearTimeout(this.startupTimer);
+      this.startupTimer = null;
+    }
  }

  async syncNow() {
@@ -349,7 +375,7 @@ class RemoteSyncEngine {
  }

  async fetchJson(url, token, options = {}) {
-    const res = await fetch(url, {
+    const res = await fetchRemoteSync(url, {
      ...options,
      headers: {
        "Content-Type": "application/json",
@@ -467,36 +493,33 @@ class RemoteSyncEngine {
        ...remoteBySyncId.keys(),
      ]);

+      const writes = [];
      for (const syncId of allSyncIds) {
        if (tombstonedSyncIds.has(syncId)) continue;
-
        const localRow = localBySyncId.get(syncId);
        const remoteRow = remoteBySyncId.get(syncId);
-
-        if (localRow && !remoteRow) {
-          await this.pushRow(remoteBaseUrl, remoteJwt, entityType, localRow);
-        } else if (remoteRow && !localRow) {
-          await this.pushRow(
-            EMBEDDED_BASE_URL,
-            this.localJwt,
-            entityType,
-            remoteRow,
-          );
-        } else if (localRow && remoteRow) {
-          const localUpdatedAt = new Date(localRow.updatedAt || 0).getTime();
-          const remoteUpdatedAt = new Date(remoteRow.updatedAt || 0).getTime();
-          if (localUpdatedAt > remoteUpdatedAt) {
-            await this.pushRow(remoteBaseUrl, remoteJwt, entityType, localRow);
-          } else if (remoteUpdatedAt > localUpdatedAt) {
-            await this.pushRow(
-              EMBEDDED_BASE_URL,
-              this.localJwt,
-              entityType,
-              remoteRow,
-            );
-          }
+        const localTime = new Date(localRow?.updatedAt || 0).getTime();
+        const remoteTime = new Date(remoteRow?.updatedAt || 0).getTime();
+        if (localRow && (!remoteRow || localTime > remoteTime)) {
+          writes.push({
+            baseUrl: remoteBaseUrl,
+            token: remoteJwt,
+            row: localRow,
+          });
+        } else if (remoteRow && (!localRow || remoteTime > localTime)) {
+          writes.push({
+            baseUrl: EMBEDDED_BASE_URL,
+            token: this.localJwt,
+            row: remoteRow,
+          });
        }
      }
+      for (const { baseUrl, token, row } of orderSyncWrites(
+        entityType,
+        writes,
+      )) {
+        await this.pushRow(baseUrl, token, entityType, row);
+      }

      // Apply tombstones to whichever side hasn't already deleted the row.
      //
@@ -0,0 +1,22 @@
+const fs = require("node:fs");
+
+function renameLocalPath(source, target) {
+  if (source === target) return;
+  try {
+    fs.lstatSync(target);
+    const error = new Error("A file or folder with that name already exists");
+    error.code = "EEXIST";
+    throw error;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (fs.lstatSync(source).isDirectory()) {
+    fs.renameSync(source, target);
+    return;
+  }
+  // link is exclusive: a destination created concurrently is never replaced.
+  fs.linkSync(source, target);
+  fs.unlinkSync(source);
+}
+
+module.exports = { renameLocalPath };
@@ -0,0 +1,31 @@
+// Sort writes per destination: response order is lost when both sides are merged.
+function orderSyncWrites(entityType, writes) {
+  if (entityType !== "hosts") return writes;
+  const destinations = new Map();
+  for (const write of writes) {
+    if (!destinations.has(write.baseUrl)) {
+      destinations.set(write.baseUrl, new Map());
+    }
+    destinations.get(write.baseUrl).set(write.row.syncId, write);
+  }
+  const ordered = [];
+  const visited = new Set();
+  const visiting = new Set();
+  const visit = (write) => {
+    if (visited.has(write)) return;
+    if (visiting.has(write))
+      throw new Error("Cyclic parent host sync dependency");
+    visiting.add(write);
+    const parent = destinations
+      .get(write.baseUrl)
+      .get(write.row.parentHostSyncId);
+    if (parent) visit(parent);
+    visiting.delete(write);
+    visited.add(write);
+    ordered.push(write);
+  };
+  writes.forEach(visit);
+  return ordered;
+}
+
+module.exports = { orderSyncWrites };
@@ -0,0 +1,128 @@
+const { randomUUID } = require("node:crypto");
+
+function webUrl(value) {
+  const url = new URL(value);
+  if (
+    !["http:", "https:"].includes(url.protocol) ||
+    url.username ||
+    url.password
+  ) {
+    throw new Error(
+      "Web endpoints require an HTTP(S) URL without embedded credentials",
+    );
+  }
+  return url;
+}
+
+function createWebEndpointWindows({ BrowserWindow, session, getMainWindow }) {
+  const certificates = new WeakMap();
+  async function open(event, options = {}) {
+    const main = getMainWindow();
+    if (
+      !main ||
+      event.sender !== main.webContents ||
+      event.senderFrame !== main.webContents.mainFrame
+    ) {
+      throw new Error("Only the main Termix window can open web endpoints");
+    }
+    const url = webUrl(options.url);
+    const isolated = session.fromPartition(`web-endpoint-${randomUUID()}`, {
+      cache: false,
+    });
+    isolated.setPermissionRequestHandler((_contents, _permission, callback) =>
+      callback(false),
+    );
+    isolated.setPermissionCheckHandler(() => false);
+    isolated.on("will-download", (event) => event.preventDefault());
+    isolated.webRequest.onBeforeRequest((details, callback) => {
+      const protocol = new URL(details.url).protocol;
+      callback({
+        cancel: !["http:", "https:", "ws:", "wss:"].includes(protocol),
+      });
+    });
+    const preferences = {
+      session: isolated,
+      sandbox: true,
+      contextIsolation: true,
+      nodeIntegration: false,
+      webviewTag: false,
+      webSecurity: true,
+    };
+    const windows = new Set();
+    const allowedCertificateOrigin =
+      options.ignoreCert === true ? url.origin : null;
+    const configure = (win) => {
+      windows.add(win);
+      certificates.set(win.webContents, allowedCertificateOrigin);
+      win.setMenu(null);
+      const canNavigate = (target) => {
+        try {
+          return target === "about:blank" || !!webUrl(target);
+        } catch {
+          return false;
+        }
+      };
+      for (const name of ["will-navigate", "will-redirect"]) {
+        win.webContents.on(name, (event, target) => {
+          if (!canNavigate(target)) event.preventDefault();
+        });
+      }
+      win.webContents.setWindowOpenHandler(({ url: target }) =>
+        canNavigate(target)
+          ? {
+              action: "allow",
+              overrideBrowserWindowOptions: { webPreferences: preferences },
+            }
+          : { action: "deny" },
+      );
+      win.webContents.on("did-create-window", configure);
+      win.on("closed", () => {
+        windows.delete(win);
+        if (windows.size === 0) {
+          void Promise.allSettled([
+            isolated.clearStorageData(),
+            isolated.clearCache(),
+            isolated.closeAllConnections(),
+          ]);
+        }
+      });
+    };
+    const win = new BrowserWindow({
+      width: 1100,
+      height: 800,
+      title: `Web endpoint — ${url.hostname}`,
+      webPreferences: preferences,
+    });
+    configure(win);
+    const close = () => {
+      for (const child of [...windows])
+        if (!child.isDestroyed()) child.destroy();
+    };
+    main.once("closed", close);
+    win.once("closed", () => {
+      main.removeListener("closed", close);
+      close();
+    });
+    try {
+      await win.loadURL(url.href);
+    } catch (error) {
+      close();
+      throw error;
+    }
+    return { success: true };
+  }
+  function handleCertificateError(event, contents, url, callback) {
+    if (!certificates.has(contents)) return false;
+    event.preventDefault();
+    let allowed = false;
+    try {
+      allowed = certificates.get(contents) === new URL(url).origin;
+    } catch {
+      /* malformed URL is refused */
+    }
+    callback(allowed);
+    return true;
+  }
+  return { open, handleCertificateError };
+}
+module.exports = { createWebEndpointWindows, webUrl };
@@ -9,6 +9,7 @@
    />

    <meta name="theme-color" content="#09090b" />
+    <meta name="termix-base-path" content="" />
    <meta name="apple-mobile-web-app-capable" content="yes" />
    <meta
      name="apple-mobile-web-app-status-bar-style"
@@ -68,9 +69,6 @@
    </style>
  </head>
  <body>
-    <script>
-      window.__TERMIX_BASE_PATH__ = "";
-    </script>
    <div id="root"></div>
    <script type="module" src="/src/main.tsx"></script>
  </body>
				`@@ -0,0 +1 @@`
				ALTER TABLE `ssh_data` ADD `enable_ai_assistant` boolean DEFAULT false NOT NULL;
				`@@ -0,0 +1 @@`
				ALTER TABLE `user_preferences` ADD `show_pin_app_rail_button` boolean;
				`@@ -0,0 +1 @@`
				`ALTER TABLE "ssh_data" ADD COLUMN "enable_ai_assistant" boolean DEFAULT false NOT NULL;`
				`@@ -0,0 +1 @@`
				`ALTER TABLE "user_preferences" ADD COLUMN "show_pin_app_rail_button" boolean;`