release-2.8.0 (#1456)

* Fix private AI custom endpoints (#1299) * Fix Proxmox credential guest imports (#1300) * Fix Fleet command results layout (#1301) * Fix synced client tunnel endpoints (#1302) * Fix Proxmox sync jump host persistence (#1303) * Fix command palette keyboard navigation (#1304) * Add accessible interface font choices (#1306) * Add selectable host temperature sensors (#1307) * Improve file manager navigation and compact layout (#1308) * Add configurable global hotkeys (#1305) * fix: restore split layout selection (#1310) * fix: support macOS VNC connections (#1311) * fix: use matching Undici fetch for private AI providers (#1309) Co-authored-by: Angad Singh <angad@singhangad.in> * feat: support additional TOTP authenticators (#1312) * feat: add VNC display zoom controls (#1314) * feat: add host context menu actions (#1315) * fix: force classic auth for macOS VNC (#1313) * fix: harden HTTP trust boundaries (#1316) * fix: harden application trust boundaries (#1317) * fix: verify OPKSSH binary integrity (#1318) * Fix remote desktop connection timeout (#1319) * chore(deps): bump node in /docker in the docker-major-updates group (#1321) Bumps the docker-major-updates group in /docker with 1 update: node. Updates `node` from 24-slim to 26-slim --- updated-dependencies: - dependency-name: node dependency-version: 26-slim dependency-type: direct:production dependency-group: docker-major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 15 updates (#1322) Bumps the dev-patch-updates group with 15 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.7` | `6.43.9` | | [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `21.2.1` | `21.2.2` | | [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `21.2.0` | `21.2.2` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `7.0.0` | `7.0.1` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.5` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.10` | `4.1.11` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `10.0.4` | `10.0.5` | | [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.0` | `3.34.1` | | [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.4` | | [react-i18next](https://github.com/i18next/react-i18next) | `17.0.11` | `17.0.12` | | [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `@codemirror/view` from 6.43.7 to 6.43.9 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@commitlint/cli` from 21.2.1 to 21.2.2 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/cli) Updates `@commitlint/config-conventional` from 21.2.0 to 21.2.2 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/config-conventional) Updates `@testing-library/jest-dom` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/jest-dom/compare/v7.0.0...v7.0.1) Updates `@testing-library/user-event` from 14.6.1 to 14.6.5 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/user-event/compare/v14.6.1...v14.6.5) Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8) Updates `@vitest/ui` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/ui) Updates `concurrently` from 10.0.4 to 10.0.5 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](https://github.com/open-cli-tools/concurrently/compare/v10.0.4...v10.0.5) Updates `cytoscape` from 3.34.0 to 3.34.1 - [Release notes](https://github.com/cytoscape/cytoscape.js/releases) - [Commits](https://github.com/cytoscape/cytoscape.js/compare/v3.34.0...v3.34.1) Updates `eslint` from 10.8.0 to 10.8.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.8.0...v10.8.1) Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.4 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.3...v0.5.4) Updates `react-i18next` from 17.0.11 to 17.0.12 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/react-i18next/compare/v17.0.11...v17.0.12) Updates `sonner` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/emilkowalski/sonner/releases) - [Commits](https://github.com/emilkowalski/sonner/compare/v2.0.7...v2.0.8) Updates `vite` from 8.2.0 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@codemirror/view" dependency-version: 6.43.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@commitlint/cli" dependency-version: 21.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@commitlint/config-conventional" dependency-version: 21.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/user-event" dependency-version: 14.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/ui" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: concurrently dependency-version: 10.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: cytoscape dependency-version: 3.34.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint dependency-version: 10.8.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: react-i18next dependency-version: 17.0.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sonner dependency-version: 2.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-patch-updates group with 5 updates (#1324) Bumps the prod-patch-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.9` | `3.14.10` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.2` | `13.0.3` | | [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.9` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.2` | `3.23.4` | | [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` | Updates `@tanstack/react-virtual` from 3.14.9 to 3.14.10 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.10/packages/react-virtual) Updates `better-sqlite3` from 13.0.2 to 13.0.3 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](https://github.com/WiseLibs/better-sqlite3/compare/v13.0.2...v13.0.3) Updates `jose` from 6.2.8 to 6.2.9 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](https://github.com/panva/jose/compare/v6.2.8...v6.2.9) Updates `mysql2` from 3.23.2 to 3.23.4 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](https://github.com/sidorares/node-mysql2/compare/v3.23.2...v3.23.4) Updates `ws` from 8.21.1 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](https://github.com/websockets/ws/compare/8.21.1...8.21.3) --- updated-dependencies: - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: better-sqlite3 dependency-version: 13.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: jose dependency-version: 6.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: mysql2 dependency-version: 3.23.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: ws dependency-version: 8.21.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump motion in the major-updates group (#1326) Bumps the major-updates group with 1 update: [motion](https://github.com/motiondivision/motion). Updates `motion` from 12.43.0 to 13.1.1 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](https://github.com/motiondivision/motion/compare/v12.43.0...v13.1.1) --- updated-dependencies: - dependency-name: motion dependency-version: 13.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add semantic motion system (#1320) * feat: add semantic motion system * feat: animate session workspace transitions * feat: refine motion accessibility and transfer feedback * feat: enforce RBAC and harden collaboration features (#1327) * feat: enforce RBAC and harden collaboration features - Mount requirePermission on hosts/snippets/credentials/automations/AI routes - Seed and backfill system role permissions on every dialect at startup - Support personal credential overrides for RDP/VNC/Telnet shared hosts - Broadcast participant presence in shared terminal sessions - Make audit log forwarding configurable from the admin panel - Add role members endpoint and snippet folder sharing * fix: enforce RBAC across split routes * fix: reject malformed Guacamole tokens safely (#1329) * fix: allow approved private notification hosts (#1330) * feat: collaboration rooms with switchable presenter (#1328) * feat: add collaboration rooms with switchable presenter Rooms are a group of members watching one stage - the live SSH/RDP/VNC session the current presenter shares. Any member can take over the stage; the host can invite, force-stop and end the meeting. Stages reuse session_shares (new room share type), so gating, recording, expiry and the global sharing toggle all apply unchanged. * feat: add stage control handoff to collaboration rooms The presenter or host can grant any member write access to the live stage and take it back; members can raise a hand to ask. SSH flips the participant's permission on the live gate; RDP/VNC re-mint the viewer's join token. Control clears on every stage switch. * feat: guest links, role invites and invite awareness for collab rooms - Anonymous guest link per room (host toggles/rotates), followed by polling the public resolve endpoint; SSH guests join over the terminal WS with roomGuestToken, guac guests get read-only join tokens - Invite by role (expands to current members, snapshot semantics) - Toast when a room you were invited to appears - Stale stages are cleared lazily when the presenter is gone - Telnet presenting, expired-tab fallback, documented single-instance and guac-kick limits - Tests for the collab routes, room hub, share access and control flip * fix: keep remote desktop collaboration read-only * fix: restore RDP clipboard paste across browsers (#1331) * fix: show the full command line in the process inspector (#1334) The CMD column rendered ps's comm field, which the kernel caps at 15 characters, so anything longer looked truncated no matter how wide the column was. The full args were already collected; show them. * fix: harden collaboration room access (#1332) * fix: harden collaboration room access * fix: confirm guest link lifecycle changes * fix: make RDP drive redirection writable on the stock deployment (#1333) * fix: make RDP drive redirection writable on the stock deployment The default drive-path was /drive on the guacd side, which the official guacd image cannot create as its non-root user, so every upload was refused with guacd's raw "FAIL (CANNOT OPEN)" ack. Default to GUACD_DRIVE_PATH (set to the shared termix-data volume in compose) with one folder per user, and explain guacd's refusal in the file browser. * style: format RDP drive settings * feat: quick connect for RDP and VNC (#1335) The Quick Connect panel gets a protocol switch. RDP/VNC quick hosts are built like SSH ones (never saved) and opened as regular remote desktop tabs; GuacamoleApp mints their token from the typed fields through the existing /guacamole/token endpoint instead of a host-row lookup. * fix: authenticate unwatched hosts during the status probe (#1337) With metrics enabled, the status probe left SSH authentication to the metrics poll - which only runs while someone is viewing the host. An unwatched host therefore never left "reachable", while a host with metrics disabled (whose probe always authenticates) showed online. The probe now authenticates whenever no metrics poll will. * feat: compact snippet list option (#1339) A "Show Commands" toggle in the snippets settings menu hides the command text under each snippet name, for people who dock the panel on the narrow right rail and only need the names. Local preference, on by default. * fix: guide users to Auto-Tmux when a persisted session expires (#1336) * fix: guide users to Auto-Tmux when a persisted session expires A timed-out terminal session silently reconnected to a fresh shell, so people running long jobs lost them with no explanation and never learned about Auto-Tmux. Explain the expiry with a one-click Enable Auto-Tmux action, let admins default it for new hosts and tune the persistence timeout from the UI, and move the setting up with copy that says what it does. The global default stays off. * style: format terminal expiry notice * feat: improve collaboration rooms (#1338) * feat: Step CA SSH certificates as a host authentication type (#1340) * feat: Step CA SSH certificates as a host authentication type Issue short-lived SSH user certificates from a smallstep CA through its OIDC provisioner, over the CA's HTTP API rather than the step binary. Everything after issuance reuses the OPKSSH plumbing: the same encrypted per-user/host token store, WebSocket dialog and ssh2 certificate injection, with the connect paths branching on a shared usesIssuedCertificate() predicate. Instance-wide CA settings live in the admin panel, with a private-host allowlist for the SSRF guard. * fix: harden Step CA callback flow * style: format Step CA changes * feat: 1Password Connect secret sources for SSH credentials (#1341) * feat: 1Password Connect secret sources for SSH credentials Hosts and credentials can hold op://vault/item/field references instead of secrets; they are resolved at connect time from the user's secret source (1Password Connect) at the single point where every subsystem receives plaintext credentials, so terminal, SFTP, Docker, metrics and tunnels all work without per-subsystem changes. Sources are per user, optionally shared, with the access token encrypted under the owner's data key; resolved values are cached briefly in memory. * style: format secret source changes * feat: share credentials with users and roles, inherit data on account deletion (#1342) * feat: share credentials with users and roles, inherit data on account deletion Credentials can be shared at "use" or "manage" level. Recipients get a copy re-encrypted under their own data key (shared_credential_secrets), kept in step with the owner's row through the same lifecycle hooks as shared host secrets. One gate, findUsableCredential(), replaces the private-namespace lookups so a shared credential works wherever a private one does. Deleting a user now hands their hosts and credentials to a successor (the deleting admin by default) instead of revoking everything they shared. * fix: harden credential ownership transfer * feat: folder shares apply to hosts added later (#1343) * feat: folder shares apply to hosts added later Sharing a folder only fanned grants out to the hosts in it at the time. The share is now also kept as a standing rule on the folder, and a host created in or moved into it (or a subfolder) inherits the same access and secret snapshots. Rules follow folder renames and can be stopped from the share dialog. * fix: stabilize folder access migrations * fix: package sharp for both macOS architectures (#1344) * fix: prompt shared RDP users for credentials (#1345) * feat: add terminal copy-on-select option (#1346) * fix: retry protected file reads with sudo (#1349) * fix: stop SSH-authenticating hosts during routine status polling (#1347) * fix: preserve omitted host protocol settings (#1350) * fix: surface remote sync reauthentication failures (#1351) * fix: harden file reads and timer cleanup (#1352) * fix: harden file reads and timer cleanup * fix: preserve literal file path escapes * fix: enforce SSH pool connection limits (#1353) * fix: enforce SSH pool connection limits * fix: discard stale pooled connections * fix: harden connection, payload, and persisted state handling (#1354) * fix: clean up Cloudflare tunnel timeouts * fix: couple tunnel socket lifecycle * fix: validate Docker console messages * fix: bound homepage proxy responses * fix: bound reconnect and response failures * fix: harden persisted and socket state * fix: support local connections to shared hosts * fix: recover expired dashboard metrics sessions (#1355) * fix: upload files to redirected RDP drives (#1356) * fix: unify connection toolbar visibility (#1357) * fix: reset host virtualizer after editing (#1358) * test: update Guacamole toolbar display mock (#1360) * fix: reflect live SSH sessions in host status (#1359) * fix: support Vault auth in file manager (#1361) * fix: allow exec on shared hosts (#1362) * fix(file-manager): align chunked upload contract (#1371) * fix(file-manager): make bulk uploads resilient (#1373) * fix(terminal): disable local echo on alternate screen (#1372) * fix(homepage): validate clock widget timezones (#1374) An invalid timezone in a clock widget's config reached toLocaleTimeString unchecked, throwing RangeError during render and taking the homepage canvas down with it. The edit dialog accepted any string, so "America/New York" - a space where IANA wants an underscore - was easy to save, and the homepage stayed broken on every later load because the value is reloaded from the database. The edit dialog now flags an unusable zone the way FolderMetadataDialog flags a duplicate folder name: inline message, aria-invalid, and a disabled Save. Whitespace is normalized to underscores on save, so the space spelling is stored as America/New_York rather than rejected. ClockWidget falls back to local time for any config already holding an invalid zone. Related to Termix-SSH/Support#1238 * fix(hosts): preserve connection origin in editor (#1376) * fix(remote-sync): expose local login notification (#1375) * fix(auth): allow passkeys in desktop login (#1378) * fix(proxmox): elevate guest discovery commands (#1379) * Fix permanent file-transfer completion toasts (#1383) * fix(file-manager): expire completed progress toasts * test(file-manager): use valid transfer status * fix(hosts): allow clearing SSH key type (#1384) * fix(terminal): suppress local echo for contextual password prompts (#1387) * fix(desktop): surface a failed embedded backend start (#1382) * fix(desktop): surface a failed embedded backend start When the embedded backend's HTTP port was already taken, the desktop app sat on the "Loading..." spinner forever with nothing in the UI to say why. The backend logged the conflict and exited 1, and startBackendServer resolved false, but that verdict never reached the renderer: the get-embedded-server-status channel was not exposed in preload and nothing called it. The renderer, by design, treats every connection failure as "the embedded backend is still booting" and retries indefinitely -- in main.tsx's verifying phase, in Auth's desktop auto-session, and in FullScreenAppWrapper. That holds while the backend is merely slow to boot, but not once the process has exited, and nothing distinguished the two. Classify why the child died from its exit code and a bounded tail of its stderr, report it through get-embedded-server-status, and have each retry loop keep waiting only while no failure is reported. A port conflict names the port, since that is what the user has to act on -- most often a Termix container on the same ports, or a backend orphaned by a hard-kill that reapOrphanedBackendProcess could not claim. A deliberate shutdown is not reported as a crash, and a backend that is only slow to start still gets retried as before. Fixes Termix-SSH/Support#1254 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(desktop): treat every unrequested backend exit as a failure The classifier exempted a clean exit and SIGTERM/SIGINT, calling those a deliberate shutdown. It has no evidence for that: its only caller already sits behind backendStopRequested, so it is reached only for exits stopBackendServer() did not ask for. A backend that exited 0 on its own, or was terminated by the OS or an external signal, therefore reported no failure at all -- leaving all three renderer loops waiting forever for a process that is gone, which is the exact hang this change set exists to remove. Every exit reaching the classifier is now a failure, port-in-use when stderr carries EADDRINUSE and crashed otherwise, with backendStopRequested left as the sole deliberate-shutdown guard. That makes the exit code and signal irrelevant to the verdict, so the classifier now takes only the stderr tail rather than carrying two parameters it no longer reads. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Add white label branding settings (#1386) * feat(admin): add white label branding settings Admins can configure a custom app name, logo and tagline from the Admin Settings panel. The values apply to the login screen and the browser tab title/favicon at runtime. * fix(admin): restore default icons on logo reset, validate upload MIME type Resetting the logo now restores the bundled favicon/apple-touch-icon instead of leaving the previous custom one until a reload. The admin upload also validates file.type up front instead of only failing later on save. * fix(admin): restore default favicons and reject invalid logo types Capture bundled icon hrefs before the first custom logo is applied so a reset does not leave the previous upload in the tab, and reject non-image uploads before they are read into branding state. * test(admin): cover branding routes and logo validation Add backend tests for the public GET, admin-only PATCH, unknown-field rejection, and parseBrandingLogoDataUrl so invalid images cannot land in settings without a failing test. * fix(backend): report port conflicts on the service ports (#1388) Express's app.listen(port, host, callback) registers that callback as the server's error handler as well as its listening handler: if (typeof args[args.length - 1] === 'function') { var done = args[args.length - 1] = once(args[args.length - 1]) server.once('error', done) } so a bind failure invoked the service's "started" callback with an EADDRINUSE error as its only argument and emitted nothing. None of the services read that argument, which made a failed bind indistinguishable from a successful one: the service logged that it had started, ran its initialisation, and served nothing. With one of 30003-30012 occupied the backend still reported backend_init_complete, the app loaded, and the affected feature was dead for the session with no error anywhere in the logs -- searching the backend log, the Electron main log and stdout for EADDRINUSE returned nothing, as did uncaughtException and unhandledRejection probes. This is also why only the main port behaved sensibly: database.ts does not use app.listen(), it builds the server and attaches a real error handler, so 30001 was the one port whose conflict was ever detected. listenOnServicePort() builds the server so that listening and error stay separate, and treats a conflict the way database.ts already does -- name the port, then exit -- rather than running on with one feature missing. Exiting also hands the desktop app the classified failure it already surfaces, so the user is told which port to free. Services that must own their server, such as the tunnel service with its WebSocket upgrade handler, get the same handler via attachServicePortConflictHandler(). Note that adding .on("error") to the services would not have worked: express consumes the event through once('error', done) before any later handler runs. The callback has to stop being passed to listen() at all. Fixes Termix-SSH/Support#1260 Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * feat(desktop): allow RDP/VNC/Telnet to originate from this device (#1389) The desktop pinned rdp/vnc/telnet to the remote server, so a host the user's own machine could reach but the Termix server could not was impossible to open: the app answered "Remote server required" even when no remote server was wanted. The embedded backend already runs the Guacamole websocket server and guacd's address is already configurable globally and per host, so what was missing was the choice. resolveConnectionOrigin now honours an explicit per-host origin for these protocols. Left on Default they still resolve to remote: they need a guacd, which the desktop does not ship, so originating locally only works once the user has pointed Termix at one of their own. Keeping that opt-in means an upgrade never moves a working connection onto a guacd that is not there. Serial and non-Electron behaviour are unchanged. Three call paths had the same assumption baked in and would have quietly ignored the setting: - The Guacamole call sites resolved the origin without passing the host's own override, so it could never take effect. - guacamole-api sent every token, connect-host and status call to the remote server whenever running under Electron, and remapped the host id onto the remote server's id -- which would address the wrong row, or fail outright with no server configured. - GuacamoleDisplay minted its token before resolving the origin, so the token could come from a different backend than the socket dialled. The origin is a required parameter on those API functions rather than a defaulted one. A default silently sent a missed call site to the remote server: the guacd status check in fetchToken was one, and it failed with a bare "Network Error" on a desktop with no server configured. Making it required means the compiler names every caller instead. That also covers CollabRoomTab, which now resolves from the host it already holds, so a locally-originated host stays local when presented into a room. Finally, the Connection Origin control was gated on SSH alone, so a host enabling only these protocols could never reach the setting. That gate is now a named predicate covering every protocol the control applies to. Verified end to end on Linux against a local guacd: with a host set to "This device", guacd accepted the connection and reached the target, which answered for itself. With guacd stopped, the guacd status check that has run before every connection since v2.3.0 -- now asking the backend the session will actually use -- reports it clearly before a socket is opened. Refs Termix-SSH/Support#1240 Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * feat(local-terminal): add copy/paste support (#1391) * feat(local-terminal): add copy/paste support Local terminal had no clipboard wiring, so selected text couldn't be copied. Extracted the SSH terminal's copy/paste shortcut and right-click handling into a shared terminal-clipboard module and wired it into both terminals, removing duplicated logic in the process. * fix(local-terminal): stop language changes from restarting the shell session The session effect that starts the local PTY depended on `t`, whose identity changes on every language switch (react-i18next). That tore down the running shell and spawned a new one just from changing the UI language. Read translations through a ref instead so localization stays decoupled from the PTY lifecycle. Also adds regression coverage for the extracted terminal-clipboard.ts helpers: copy with/without selection, explicit vs native paste, right-click preference, and Ctrl+right-click passthrough. * fix(file-manager): keep name column visible on narrow viewports in list view (#1402) Rebased onto dev-2.8.0 (the density refactor kept the same 3 list-view grid patterns). Use minmax(140px, 1fr) for the name track so it cannot collapse to 0px on narrow viewports; the table scrolls horizontally instead of hiding names and icons. Co-authored-by: inontz <inontz@users.noreply.github.com> * feat(desktop): local filesystem and transfer bridge for the file manager (#1392) * feat(desktop): local filesystem and transfer bridge for the file manager Adds the Electron main-process side of the upcoming Local | Remote dual-pane file manager, with no UI yet: - electron/local-files.cjs: IPC handlers to browse the local disk (home, list, mkdir, createFile, rename, trash, ensureDir, walk, reveal, open) and to stream files between the local disk and the file-manager backend (uploadLocalFile / downloadToLocal with progress events and cancellation). Streams go through Electron's `net` so the session cookie / remembered JWT is attached the same way as the renderer's own requests. - electron/preload.js: exposes them as `window.electronAPI.localFs` and `window.electronAPI.localTransfer`; the existing `invoke` allowlist is untouched. - src/types/electron.d.ts: typings for the new surface. - electron/main.cjs: registers the handlers. Follow-up PRs add the renderer side (local pane, drag-and-drop transfers, context menu). * fix(desktop): harden the local transfer bridge (origin allowlist, collision policy) Addresses the review on the transfer boundary: - The renderer no longer supplies a URL or headers. It sends `{ origin: "local" | "remote", route, deviceId }` and the main process resolves the target itself: fixed route allowlist (`uploadFileStream`, `downloadFileStream`), local = the embedded backend base, remote = the remote-sync config's URL (http/https only) with the stored JWT. Anything else is rejected before a request is made. `deviceId` is validated. - Downloads never rename or replace silently. The destination is checked first and `EEXIST` is returned unless the caller passes `overwrite: true`. Each transfer writes to its own `<dest>.<transferId>.termix-part` opened with `wx`, and publishes with `fs.link` / `COPYFILE_EXCL` (rename only when overwriting), so concurrent transfers to the same path cannot share or clobber a partial (`EBUSY` for the second). Partials are removed on failure or cancel. - New `local-fs:exists` handler so the renderer can ask before starting. - `createLocalFileHandlers` / `createTargetResolver` take their dependencies (net, shell, remote-sync getters) as parameters so the boundary is unit-testable without Electron. - src/backend/tests/electron/local-files.test.ts: target resolution and off-origin refusal, EEXIST / EBUSY / overwrite paths, unique partials and cleanup, upload multipart integrity (parsed with Busboy). * fix(desktop): Windows-safe replace for overwrite downloads `publishDownload()` used `rename(partial, dest)` for the explicit overwrite path. POSIX replaces the destination, but on Windows rename() onto an existing name commonly fails (EEXIST / EPERM, always while the file is open), so "Replace" did not actually work there. The overwrite path no longer renames onto an occupied name: 1. the current file is moved aside to a transfer-unique sibling (`<dest>.<transferId>.termix-replaced`) - renaming to a fresh name is safe on every platform; 2. the partial is published exclusively under the now-free name (the same `link` / `COPYFILE_EXCL` primitive the non-overwrite path uses); 3. the aside copy is deleted (retried once; if another process still holds it open on Windows it is left in place and logged rather than failing the transfer). Failure handling preserves the original: if step 1 fails (file in use) nothing has changed and the caller gets `EBUSY`; if step 2 fails the aside copy is moved back under its name and the error propagates. Replacing a folder with a file is refused with `EISDIR`; a destination that vanished mid-transfer falls back to the exclusive publish. The publish primitives take their filesystem operations as an injectable `publishFs` (default: real fs), and the tests drive them with a Windows-like fs whose rename() refuses to overwrite - so the strategy is verified without relying on POSIX rename-over-existing semantics: successful swap with no rename ever targeting an occupied name, original restored byte-for-byte when publishing fails, EBUSY with nothing touched when the file cannot be moved aside, EISDIR for folders, vanished destination, and the end-to-end overwrite through the download handler. --------- Co-authored-by: Max <maxim@cogitate.ai> * chore: update package lock * feat(file-manager): Termius-style Local | Remote dual pane with drag-and-drop transfers (desktop) Renderer side of the dual-pane file manager, built on the local filesystem bridge added in the previous PR. Desktop app only; the web build is unchanged (the toggle is hidden when `window.electronAPI.localFs` is absent). - New Local pane (LocalFilePane) next to the remote grid, toggled from the toolbar (Laptop icon); path, visibility and width are remembered in localStorage (`termix:file-manager:local-pane:*`). Grid and list views, hidden files toggle, breadcrumb navigation, New Folder. - Drag files/folders from the Local pane onto the remote grid to upload, and from the remote grid onto the Local pane to download. Both directions stream through the main process (`useLocalTransfers`) with a single progress toast per batch (speed, ETA, cancel). Finder drops onto the remote grid keep working as before. - Collision policy for downloads: destinations are checked first; if any exist the user is asked Replace / Skip for the batch. Skip, dismiss and timeout all mean skip - nothing is ever replaced without an explicit click, and the main process enforces the same rule (`EEXIST` unless `overwrite` is set). - Drag MIME contract: `application/x-termix-local-files` for local drags, `application/x-termix-remote-files` marker on the remote grid's internal drags, so each pane can tell the two apart from Finder drops. - Transfer targets are described as `{ origin, route, deviceId }` (`getSessionOrigin` in main-axios) - the renderer never hands the main process a URL. - i18n: new `fileManager.local*` keys in en.json only (other locales via Crowdin). - Tests: LocalFilePane rendering/navigation, local-transfer-utils (relative-path planning, size formatting). - Modified column uses the same `Mon DD HH:MM` / `Mon DD YYYY` (ls -l style) format as the remote grid, so both panes read alike. * docs: point security note to the docs root (old /security page is gone) (#1400) * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * chore: sync Crowdin translations * Add Hetzner logo and referral link to README Added Hetzner logo with a referral link to README. * Fix Hetzner logo URL in README.md * docs: point security note to the feature security page The old /security page is gone and the docs root redirects to /install/, which loses the encryption context the sentence promises. Point the per-user secret and database encryption note at the canonical docs.termix.site/features/authentication/security/ page instead. Applied across all README locales. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ssmurfgg04-gif <232103099+ssmurfgg04-gif@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * fix: use i18n for host status tooltip labels (#1403) * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * chore: sync Crowdin translations * fix: use i18n for host status tooltip labels (#1265) * fix: add missing hosts.status.* locale keys (fixes #1265) * fix: add hosts.status.* translation keys for i18n tooltip The buildStatusTooltip function calls t("hosts.status.available"), t("hosts.status.reachable"), t("hosts.status.offline"), and t("hosts.status.monitoringDisabled"), but the locale file only had "status": "Status" as a flat string. Replaced with a status object containing all four keys plus a "label" key preserving the original "Status" string. * fix: restore final newline in en.json Requested by ZacharyZcR in review feedback. * test: assert translated labels in buildStatusTooltip Per review feedback from ZacharyZcR: add focused tests that exercise buildStatusTooltip with a translator and assert the rendered labels rather than key paths. Covers all three status values, monitoring disabled, protocol list, and the no-key-path regression guard. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * fix(workspaces): fall back when randomUUID is unavailable (#1397) * fix(terminal): preserve macOS Alt digit characters (#1398) * fix(ssh): verify resolved server host identity (#1419) * fix: add principals to Termix ID certificates (#1421) * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * chore: sync Crowdin translations * Add Hetzner logo and referral link to README Added Hetzner logo with a referral link to README. * Fix Hetzner logo URL in README.md * chore: pull sponsor logos from the docs site * fix: add principals to Termix ID certificates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * fix(deps): resolve transitive security advisories (#1412) * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * chore: sync Crowdin translations * Add Hetzner logo and referral link to README Added Hetzner logo with a referral link to README. * Fix Hetzner logo URL in README.md * chore: pull sponsor logos from the docs site * fix(deps): resolve transitive security advisories --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> * fix(sync): map nested host parent references (#1418) * fix(metrics): surface SSH host key changes (#1404) * fix(guacamole): coalesce VNC wheel floods and label meta keys by device (#1385) High-latency proxies like Cloudflare queue guacamole-common-js scroll clicks so the desktop keeps crawling after the user stops. Cap in-flight wheel buttons, and show Super/Cmd in the VNC toolbar on non-Windows clients. Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * fix(file-manager): keep downloaded files inside the selected local folder Remote file names were turned into local destinations by splitting the relative remote path on "/" and concatenating each name with the platform separator. A POSIX file name may contain "\", ":" or end in a dot, so on Windows a remote "..\outside.txt" downloaded into C:\Downloads\selected was normalised to C:\Downloads\outside.txt - outside the folder the user picked, even with overwrite disabled. The main process only normalised destPath and never checked it against the selected root. Two independent layers now enforce containment: Renderer (local-transfer-utils.ts) - `assertSafeLocalComponent(name, separator)` validates each remote path component for the destination platform: never empty, "." or "..", never "/" or NUL; on Windows (separator "\") additionally no "\ : * ? " < > |", no control characters, no trailing dot/space, no reserved device names (CON, NUL, COM1...). Backslashes stay legal on macOS/Linux, where they are ordinary file-name characters and the result remains inside the folder. - `buildLocalDestination(localDir, relativePath, separator)` joins the validated components and asserts the result is strictly under localDir (case-insensitive on Windows). - useLocalTransfers builds every file and directory destination through it. Items that fail are skipped before any filesystem call and reported ("Skipped N item(s) whose names cannot be used on this computer"). Main process (electron/local-files.cjs) - `assertWithinRoot(rootPath, candidate, pathImpl)` resolves + normalises both paths and refuses anything that is the root itself, escapes it (".." after normalisation), is absolute relative to it (another drive, UNC) or contains empty/".." segments. `pathImpl` is injectable so the Windows rules run in tests on any OS. - downloadToLocal requires `rootPath` (the selected folder) and checks the destination before the request is made or any file is created; the ensure-dir handler applies the same check when a root is passed (used for the directory skeleton of downloaded trees). - LocalDownloadRequest / downloadSessionFileToLocal / ensureLocalDirectory carry the root. Tests - Renderer: ordinary nested folders on Windows; backslash traversal in a POSIX name; absolute, drive-qualified and UNC names; reserved names, trailing dots/spaces, control chars; POSIX traversal rejected while a POSIX-legal backslash name is kept inside the folder. - Main process (path.win32): nested destinations accepted incl. case differences; "selected\..\outside.txt" refused; other drive / UNC / sibling folder refused; missing root refused; end-to-end handler test that a POSIX "../outside.txt" download and an escaping ensure-dir are refused before any network traffic or disk write. * feat(file-manager): right-click context menu for the local pane Mirrors the remote grid's menu for the user's own disk. On an entry (or the current multi-selection): Open / Open folder, Upload to server, Reveal in Finder/Explorer, Rename (inline, F2), Copy Path, Move to Trash (confirmation toast, Del). On the background: New Folder, New File, Reveal, Show/Hide hidden files, Refresh (F5). Enter opens, Cmd/Ctrl+A selects all, Escape clears the selection. Deletion goes through shell.trashItem so it lands in the OS Trash and is recoverable; rename and create refuse names containing path separators and never overwrite an existing entry. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): resizable list-view columns in both panes Drag the boundary at the left edge of a column header (Modified, Owner, Size, Permissions on the remote grid; Modified, Size, Kind in the local pane) to change its width; the Name column takes whatever is left. Double-click a handle to reset that column. Widths are remembered per pane in localStorage. Finishing a drag over a sortable header no longer toggles the sort. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): pinned ".." parent entry in both panes Both the remote grid (list, grid and empty-folder states) and the local pane show a Termius-style ".." row pinned above the entries whenever the current folder has a parent. Double-clicking it goes up one level. It is also a drop target: local files dropped on it upload into the parent folder, remote rows dragged onto it move there, and remote items dropped on the local pane's ".." download into the parent folder. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): show/hide list-view columns from the header Right-click a list-view header (remote grid or local pane) to open a Columns menu and tick/untick Modified, Owner, Size, Permissions (remote) or Modified, Size, Kind (local). Hidden columns leave the grid template entirely so the Name column gets the space back; at least one optional column always stays on. The choice is remembered per pane alongside the column widths. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): sidebar toggle works on desktop too The toolbar's sidebar button now shows/hides the directories panel on desktop (persisted), while below md it still opens the mobile overlay. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * feat(file-manager): resizable directories sidebar The Trash/Directories sidebar can now be resized by dragging its right edge (160px minimum, up to 40% of the row); double-click the handle to restore the default 224px. The width is remembered. The same handle and persisted-width hook now also drive the local pane divider, replacing the inline implementation. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Bn6K6xNAihgWZ5fMVWt1W * fix(metrics): support macOS/WIN hosts in stats collection (#1430) * fix(metrics): support macOS hosts in stats collection Host metrics collectors only ever ran Linux commands (/proc/*, ip, GNU df flags), so any macOS host always reported 0%/null for cpu, memory, uptime, network and disk. Detect the host platform once per poll and use vm_stat, sysctl, top, ifconfig and netstat on Darwin hosts instead. * fix(metrics): support Windows hosts in stats collection RDP/VNC hosts running Windows hit the same problem as macOS did: no /proc, no BSD tools, not even uname. Route CPU, memory, uptime, network and disk through PowerShell (WMI/CIM) when the host is detected as Windows, using -EncodedCommand so there's no cmd.exe quoting to fight with. * fix(metrics): use real macOS df/mount for disk collection BSD df's -T flag filters by filesystem type instead of printing one like GNU df does, so the previous macOS disk path was still running a GNU-only command and coming back empty. Now uses df -Pk plus mount output to build the filesystem type/percent list, filtering out the noisy APFS system volumes and devfs/autofs mounts. Verified on an M4 MacBook running the latest macOS - disk usage now reports correctly. * feat(file-manager): Termius-style Local | Remote dual pane with drag-and-drop transfers (desktop) (#1413) Integrate the reviewed change and its maintainer fixes into dev-2.8.0. Validated with focused regression tests, type-check, lint, formatting, build, and the PR Check database jobs. * fix(terminal): persist Ctrl+/- font zoom so it survives option refreshes (#1399) Integrate the reviewed change and its maintainer fixes into dev-2.8.0. Validated with focused regression tests, type-check, lint, formatting, build, and the PR Check database jobs. * Fix macOS terminal packaging and keyboard shortcuts. (#1417) Integrate the reviewed change and its maintainer fixes into dev-2.8.0. Validated with focused regression tests, type-check, lint, formatting, build, and the PR Check database jobs. * fix(auth): skip TOTP only after verified WebAuthn user verification (#1420) Integrate the reviewed change and its maintainer fixes into dev-2.8.0. Validated with focused regression tests, type-check, lint, formatting, build, and the PR Check database jobs. * feat(hosts): add per-host Web Endpoints (direct or SSH-tunnelled web UIs) (#1416) * test: provide an in-memory localStorage for the vitest environment jsdom in this project ships without a localStorage global, so every suite that touched storage threw "Cannot read properties of undefined" during setup and failed wholesale -- 119 tests across 15 files, none of them actual product defects. Node only supplies localStorage with --localstorage-file, which persists to disk and is shared across test files. A per-process in-memory Storage is what tests want, so define one (plus sessionStorage) when the global is absent, alongside the existing matchMedia shim. Full suite goes from 15 failed files / 119 failed tests to 400 files and 2888 tests passing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fdjjsdaz6aFMyJr4h3Y6qj * feat(web-endpoints): add endpoint types and URL resolution First step of per-host Web Endpoints: a host declares web UIs it serves and opens them either directly at the host's address or through an SSH forward Termix establishes on demand. This commit is pure logic with no I/O, so it needs no mocks to test. resolveWebEndpointUrl expects an already-normalized path -- normalization is the storage boundary's job (a later commit), and duplicating it here would invite the two copies to drift. separatedTunnelHost is the one part that is a security control rather than a convenience. Cookies are keyed by host and ignore the port, and SameSite computes "site" as scheme + registrable domain -- also ignoring the port. A forward reached at the host string serving Termix is therefore same-site with Termix, which leaks the session both ways: the framed service receives the jwt cookie, and a Set-Cookie it returns lands in the jar Termix's own API calls read from. So a tunnel URL resolves to a different loopback spelling than the page's, and refuses outright when no alias exists. Only loopback literals qualify -- a same-registrable-domain alias could still answer Set-Cookie with a Domain attribute that reaches Termix. The cookie-separation tests were verified to fail against a resolver that returns the page host (4 failures), so they cannot pass vacuously. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(web-endpoints): validate and normalize endpoint config normalizeWebEndpoints is the enforcement point for values that reach an href and an iframe src, so the editor's constraints are UX rather than security. It drops any row it refuses instead of rejecting the whole host -- one bad endpoint must not make a host unsaveable or unlistable. Paths are checked for C0 controls and DEL by codepoint rather than by regex character class: "\t//evil.example" defeats a startsWith("//") guard, because the browser strips the control character and then follows the authority. bindHost lands both in a TCP listener and in a URL authority, so it is restricted to a bare host literal -- nothing carrying a scheme, port, path or credentials survives. bindHost and localPort are ignored on a direct endpoint, which never creates a forward. parseWebUiConfig never throws. A malformed stored value yields an empty endpoint list, so a half-written config cannot take out the whole host listing -- which is what dockerConfig's bare JSON.parse does today. The editor validator is a second implementation in a layer that cannot import backend route modules. Its accompanying test runs BOTH implementations over the same path and port samples, because drift here is invisible in the worst way: the editor accepts a row, the normalizer silently drops it, and the endpoint disappears on reload with no error. That agreement test was verified to fail (4 cases) when the editor's control-character check is removed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): migrate the shared_credential_secrets foreign key rename Running `npm run schema:migrations` on an UNCHANGED schema emits these, so they are pre-existing drift between schema.ts and drizzle/, not something this branch introduced. Landing them alone, before the web-endpoint columns, so the feature's own migration is reviewable without an unrelated table rebuild sitting in the middle of it. Both forms are a foreign-key constraint rename only. Postgres drops and re-adds the constraint under a shorter name. SQLite has no ALTER for that, so drizzle emits the standard table rebuild -- verified data-preserving: CREATE lists 14 columns, INSERT...SELECT copies the same 14 in the same order, and both indexes are recreated. The SQLite file is in practice dead code: runRemoteMigrations throws for sqlite, which builds its schema from db/index.ts instead. It is kept rather than hand-trimmed because drizzle derives the meta snapshot from schema.ts regardless, so trimming the .sql while the snapshot advances would make the drift permanently invisible -- no future `generate` would re-emit it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(db): add enable_web_ui and web_ui_config columns Two columns on ssh_data mirroring the Docker pair. No show_web_ui_in_sidebar: every existing showXInSidebar column is vestigial -- they appear only in defaults, the export payload and tests, and gate no rendering -- so a fourth dead column plus a migration buys nothing. web_ui_config stores an object rather than a bare array so host-level web settings can be added later without a second migration. The column has to be declared in FOUR places, not one. SQLite never runs the drizzle migrations at all (runRemoteMigrations throws for sqlite), so the live default-dialect schema comes from hand-written DDL: 1. db/schema.ts, then the two generated dialect schemas and the migrations 2. db/index.ts CREATE TABLE -- fresh databases 3. db/index.ts addColumnIfNotExists -- existing databases 4. database.ts CREATE TABLE and its positional INSERT -- encrypted export Missing 2 or 3 breaks every host write on the default dialect while the migration file sits there looking correct. Two guards, both watched failing first. bootstrap-matches-schema-columns boots a real database and compares PRAGMA table_info against the drizzle definition for every table -- it reported ssh_data.enable_web_ui and ssh_data.web_ui_config missing before item 2/3 landed. A grep-based guard could not: db/index.ts names columns as snake_case strings, never the camelCase the schema uses. export-ddl-matches-schema-columns covers database.ts, which no booted database reaches. It caught a real defect while being written: the two new columns went into the INSERT list but the VALUES list still held 53 placeholders for 55 columns. Being positional, that shifts every later value by one. The placeholder-count assertion is now permanent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(hosts): thread web endpoint config through host read and write paths A host field has to be enumerated by hand in nine places here, and "added a column, missed one update path" is this codebase's most repeated bug -- during the first attempt at this feature a field was missed at one of these points six separate times, each surfacing as a different mystery: endpoints that saved but never appeared, config that vanished on reload. Backend: host-normalizers (input type, CONNECT_LEVEL_FIELDS, boolean normalization, parse block), host.ts (create, update, both read paths, quick-connect defaults), host-bulk-routes (bulk update, import, reset). Renderer: host-export-payload, HostManagerData's sshHostToHost, tabUtils' hostToSSHHost, HostEditorData's form seed and payload builder. The three renderer mappers copy field by field, so an unlisted field is silently dropped -- which is how endpoints saved correctly and never appeared. webUiConfig is parsed with parseWebUiConfig rather than a bare JSON.parse. dockerConfig on the adjacent line uses a bare one, so a single malformed value takes out the whole host listing; that is a bug to avoid copying, not a convention to follow. All three write paths now clear webUiConfig when the feature is disabled. They disagreed before, and the export payload ships the config unconditionally -- so a host disabled without clearing still exported its endpoint list (internal hostnames, ports, paths) while the UI read as off, and re-enabling resurrected stale endpoints. webUiConfig is shared with connect-level recipients, unlike dockerConfig. A connect-level recipient is already authorized to open these tunnels, so withholding the config only breaks discovery while the flag advertises the feature. Docker's precedent does not transfer: its tab works without its config, whereas a web endpoint IS its config. The enumeration guard asserts every one of the nine files mentions the web endpoint field beside its Docker counterpart, and checks the Docker anchor is present too so it cannot pass vacuously if a file is restructured. The clear-on-disable assertion was rewritten after the first version passed with the guard deleted -- a loose regex matched unrelated sites. Both halves are now anchored on exact text and were watched failing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(tunnel): report the real bound port, support idle close, reserve web: Three changes the web endpoint open route depends on, plus the name reservation that makes the scheme safe. Real bound port. Under sourcePort 0 the kernel assigns the port, but the runtime recorded the requested value -- so it advertised 0 and any caller reusing it failed. It now records tcpServer.address().port. Idle close, behind the new tunnelConfig.idleTimeoutMs. Web endpoint tunnels are opened on demand and must not outlive their use. The timer lives inside establishDirectTunnel because the socket set is only visible from that closure, polls at min(30s, timeout) so "empty for N" means roughly that rather than "empty at the instant of one N-spaced tick", and unrefs so it cannot hold the process open. It calls cleanupTunnelResources rather than close(): close() stops the listener but leaves the entry in activeTunnelRuntimes, so the open route would keep handing out a port nothing is listening on. Reserved names skip retry. handleDisconnect returns early for a "web:" name after a forced cleanup. maxRetries: 0 would NOT achieve this -- the retry path reads `maxRetries || 3`, so 0 falls through to 3. The cleanup is forced because cleanupTunnelResources no-ops while tunnelConnecting holds the name, and a web tunnel has no retry pass to self-heal a leaked runtime. That early return carries an identity guard, which is the subtle one. sourceClient.end() only STARTS an async teardown, so the SSH "close" event lands after a reopen may already have registered a NEW runtime under the same name. Acting by name alone would tear down the successor rather than the stale tunnel -- surfacing as a 200 with a good port followed by a silent connection reset and no error anywhere. handleDisconnect now takes the closing Client and returns early when the registered runtime belongs to someone else. The idle timer carries the same guard for the same reason. /ssh/tunnel/connect now rejects a user-supplied "web:" name with 400. validateTunnelConfig is no defence here: it returns true unconditionally for any name that is not the legacy 6-part format, so an authenticated user could otherwise create a real retry-configured tunnel that collides with a live web endpoint forward and silently loses its own reconnect behaviour. The manager tests run against a real TCP listener and real timers -- mixing fake timers with real socket I/O is a known route to a hanging test. Both were watched failing: reverting the bound port fails the port test, and swapping cleanupTunnelResources for close() fails the idle test, which asserts the ENTRY is gone rather than merely that the listener stopped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(tunnel): add the web endpoint open route POST /ssh/tunnel/web-endpoint/open { hostId, endpointId } -> { port }. The host is resolved through the user-scoped resolveHostById, so an authenticated user cannot obtain a forward to a host id they do not own. The endpoint is re-normalized out of storage rather than trusted: the stored value predates any later tightening of the rules, and this is what a forward gets built from. An enabled flag is required as well as a present endpoint -- a bulk update that sends only { webUiConfig } can leave a configured endpoint on a host whose UI reads as off everywhere. Not gated to the desktop. The forward binds wherever this backend runs, as the server tunnels feature does, and the endpoint's own bindHost decides whether that is reachable from a browser. endpointHost: "127.0.0.1" is load-bearing, not cosmetic. connectSSHTunnel picks its strategy via shouldEstablishDirectTunnel -> isSingleHostTunnel, which keys on endpointHost -- setting only targetHost selects a different path and the forward never binds locally. connectSSHTunnel never rejects, and its promise resolves right after conn.connect() -- long before the SSH "ready" event populates activeTunnelRuntimes. Awaited is not connected, so waitForTunnelSettled polls the maps the manager already exports. Polling rather than adding a promise-returning variant: every existing caller is fire-and-forget by design, and changing that contract for one new caller is the larger blast radius. A probe forwardOut runs before returning 200. Without it the route succeeds the moment listen() does, and forwardOut is only attempted per inbound socket where failure is swallowed -- so the likeliest real error, nothing listening on the endpoint's port, reached the user as a blank frame and no message. Staleness is validated at open, never on save: host save lives in the database service and the runtimes live in the tunnel service, with no push between them. On reuse the route compares a fingerprint covering the endpoint's target AND the host's SSH identity, and reopens when it differs. An absent fingerprint means reuse, not staleness -- a reserved-prefixed runtime can only have been created here. Deletion, disabling and host removal then need no handling: nothing reopens the tunnel, so it idles out. Also closes an authorization gap this feature would otherwise have created. /ssh/tunnel/disconnect and /ssh/tunnel/cancel checked ownership only inside `if (config && config.sourceHostId)`, and web tunnels are deliberately absent from tunnelConfigs -- so the check never ran for them. Host ids are small sequential integers and endpoint ids are client-supplied, so the name is guessable and any authenticated user could force-close another user's tunnel. authorizeTunnelAction recovers the host id from the name and fails closed when it cannot; the tests were watched failing against the old behaviour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(hosts): add the web endpoint client and per-origin certificate allowance The client posts a path relative to tunnelApi's base, which already includes /ssh -- a leading "/ssh" here resolves to /ssh/ssh/... and 404s on every call. The test asserts that on the captured runtime argument rather than by scanning source, so quoting style and indirection cannot fool it. Backend error messages are preserved rather than collapsed. 502 is this route's likeliest real failure and carries the actionable cause -- SSH auth rejected, host unreachable, nothing listening on the target port -- and handleApiError would replace all three with "Server error occurred". It stays as the fallback for bodies that carry no string reason, so a body shaped { error: <object> } cannot reach the user as "[object Object]". openWebEndpointExternally applies the same refusal gate as the embedded tab. Opening in the real browser is not the safer path: the cookie jar is the browser's either way, so a tunnel URL on the page's own host string leaks the session exactly as a frame would. The refusal happens before the forward is opened -- binding the port and then declining to navigate would be no protection. Certificate allowance covers the one case Electron's existing handling misses: direct access to a HOSTNAME over https. isPrivateNetworkHost matches IP literals only and sshData.ip has no IP validation, so https://nas.local:8006 fails the check and renders blank inside an iframe with no click-through -- Chromium offers no proceed option for subframes. Three properties of that allowance are deliberate and now pinned by tests, because each would otherwise be undone by a reasonable-looking simplification: - it is NOT wired into isInvalidCertificateAllowedForUrl, which also governs this process's own outbound TLS via getTlsVerificationOptions; - it is https-only, in both the check and the IPC handler, since a non-TLS origin in a TLS-error allowlist is meaningless and file:/ftp: must never be storable; and - entries carry a five-minute TTL refreshed on each registration. Main has no host-database access and cannot verify the renderer's claim that an origin is a configured endpoint, so the residual risk has to be a momentary window rather than one lasting until the app restarts. The handler stores the parsed origin, never the caller's string, so a path or wildcard cannot widen the allowance. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(hosts): add the Web UI editor tab Mounted as a Web UI sub-tab inside the SSH group, beside Docker, Tunnels, Files and Host Metrics, and laid out as two SectionCards following the tunnels editor: settings first, then the list it governs. There is a deliberate asymmetry with the sidebar here. The sidebar entry will appear on enableWebUi alone, because a direct endpoint needs no SSH -- but Web UI is an SSH sub-tab, so a host with SSH disabled cannot configure endpoints at all. That is the accepted behaviour and both halves are pinned by tests, so neither gets "fixed" into agreement later. tunnelAvailable is enableSsh && originIsLocal, resolved inside HostWebUiTab rather than in HostEditor.tsx, which is already ~2600 lines. It is NOT gated on isElectron(): the forward binds wherever the backend runs, exactly as the server tunnels feature does. resolveConnectionOrigin is called with connectionType "ssh" deliberately -- a tunnel endpoint always rides SSH, and "ssh" avoids the guacamole special case that forces "remote" for RDP/VNC/Telnet. Three input details that each prevent a silent data loss: - the id generator falls back off crypto.randomUUID, which is undefined outside a secure context -- a plain-http web deployment is a first-class target for direct+external and would otherwise throw on "Add endpoint"; - a new row gets a de-duplicated label, since labels are what identify an endpoint in the sidebar picker; and - the port field commits only a value the normalizer would keep. Number("") is 0, which the normalizer rejects, so clearing the field would otherwise write an endpoint that vanishes on save with no error. The tunnel fields carry three warnings: a non-loopback bind exposes the target's web UI unauthenticated to anyone who can reach the port; a loopback bind on a remote backend cannot be reached from a browser at all; and a tunnel reached at Termix's own hostname would hand the tunnelled service this session. All three are shown while configuring rather than only when the tab fails to load. The unavailable-tunnel reason is shown whenever tunnelling is unavailable, not only once a row asks for it -- a disabled dropdown option with no stated reason reads as the control being broken. Copy is reused verbatim from the previous iteration's reviewed strings rather than reworded. One test was written and then removed rather than kept: its name promised that switching to tunnel access clears ignoreCert, but Radix Select needs pointer APIs jsdom lacks, so the body only asserted the control existed. The clearing is covered where it is enforced, in the normalizer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(hosts): open web endpoints from the sidebar and in a tab One sidebar entry per host, never one per endpoint: a host may declare up to 16, and a row of 16 identical globes is unusable. With a single endpoint the entry wears its label and acts directly; with several it carries no endpointId and the click opens a picker -- a DropdownMenu in the tray, a DropdownMenuSub in the Connect submenu. The entry is gated on enableWebUi ALONE, unlike every neighbouring action, which requires enableSsh. A direct endpoint needs no SSH; SSH matters only per-endpoint, for tunnel access, which the open route enforces. openTab gains a fourth optional parameter rather than overloading `restore`, which means something else. What was actually broken for two endpoints on one host was the LABEL -- tab ids are already `${name}-${type}-${Date.now()}`, so they never collided. All existing call sites keep working. The tab is passed the endpoint ID, not the endpoint object, so one deleted while its tab is open renders a plain message instead of throwing. Reload re-resolves and REMOUNTS. A direct endpoint's URL never changes and a live tunnel returns the same port on every open, so setUrl(resolved) would be a same-value setState that React bails out of, leaving the frame untouched -- Reload would silently do nothing in the two most common cases. A generation counter folded into the iframe key fixes that and doubles as the staleness guard for two resolutions landing out of order. The test captures the DOM node before and after, and was watched failing against a url-only key. PERSISTENT_TAB_TYPES is hoisted to module scope and exported so it can be asserted on -- it was a local const inside the component and therefore untestable. web-endpoint is deliberately excluded: an idle tunnel re-binds a fresh kernel-assigned port, so a restored tab could never hold a valid URL. Two notes on verification. `tsc -p tsconfig.json` passes vacuously in this repo -- tsconfig.json is a solution file with project references and does nothing without -b -- so `npm run type-check` (tsc -b --force) is the real check; it caught two insertions that had landed in the wrong function. And the one full-suite failure seen along the way was vault-signer-core, which passes in isolation and on re-run, is untouched by this branch, and is a flake under parallel load. Lint: 0 errors, 102 warnings, identical to the baseline on a clean tree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(tunnel): register the web endpoint route under its /ssh path Every route in routes.ts registers the full "/ssh/tunnel/..." path -- nginx proxies /ssh through with the path intact -- and the client resolves "/tunnel/web-endpoint/open" against a baseURL that already ends in /ssh. The unprefixed registration therefore 404'd every call. No handler unit test could catch this: they call handleWebEndpointOpen directly and never touch registration. It surfaced only on opening a real tunnel against a deployed build, which is why that step exists. Added a registration test that captures the paths passed to app.post, so the invariant is checked without needing a server. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(hosts): apply session-cookie isolation to direct web endpoints The cookie guard only covered tunnel access. `unreachableTunnelReason` returned null for every `access: direct` endpoint, so WebEndpointTab framed the host's own address unconditionally. With Termix served at https://termix.example/ and a direct endpoint at https://termix.example:8443/, the browser attaches Termix's `jwt` to the framed request -- cookies are keyed by host and ignore the port -- and a `Set-Cookie` from that service lands in the jar both auth middlewares read before the Authorization header. Renames the helper to `webEndpointRefusalReason` so its scope is no longer tunnel-only, and gives it the endpoint's target host. A direct endpoint is now refused in a browser when that host shares Termix's cookie site, checked BEFORE any navigation in both open paths (embedded tab and external window) -- refusing after framing would leak on the first request. `sharesCookieSiteWithPage` treats an equal host as same-site (the jwt is set host-only, so the port is irrelevant) and also a parent/sub domain, which a `Set-Cookie: Domain=` from the target crosses. The suffix test is anchored on a dot boundary so `eviltermix.example` does not pass as `termix.example`. A precise eTLD+1 test would also catch sibling subdomains, but needs a public suffix list this app does not bundle. The desktop stays exempt: its session is Bearer-only with no `jwt` in the jar. Also drops "or change this endpoint to Direct" from the tunnel refusal copy, which pointed at the path that had this same leak. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * fix(tunnel): preserve local status when remote names collide (#1431) * fix(desktop): honor remote sync certificate setting (#1432) * fix(file-manager): interpolate preview download filename (#1433) * fix(automations): dispatch SSH login events to triggers (#1434) * fix(hosts): preserve imported settings and remap jump hosts (#1435) * fix(hosts): preserve terminal switches across JSON transfer * fix(hosts): remap imported jump-host dependencies * fix(ssh): preserve agent framing after unsupported extensions (#1436) * fix(guacamole): return tokens before awaiting the client handshake (#1437) * fix(sidebar): unmount the host tree while its panel is hidden (#1438) * fix(terminal): leave macOS Option characters enabled by default (#1439) * fix(dashboard): open the enabled remote desktop protocol (#1440) * fix(version): preserve local version when update checks fail (#1441) * fix(sftp): create uploaded directories without shell access (#1442) * fix(desktop): honor explicit GPU acceleration opt-out (#1443) * fix(desktop): exclude remote-only host IDs from local tab persistence (#1444) * Enhance SFTP and terminal flows, stabilize desktop sync (#1377) * feat: add electron sftp c2s and terminal ai flows * fix: stabilize desktop sync and c2s tunnels * Improve remote tunnels and SFTP transfer feedback * chore: sync Crowdin translations * chore(deps): bump the prod-minor-updates group across 1 directory with 3 updates (#1325) Bumps the prod-minor-updates group with 3 updates in the / directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [js-yaml](https://github.com/nodeca/js-yaml) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg). Updates `@anthropic-ai/sdk` from 0.116.0 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.120.0) Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-minor-updates group across 1 directory with 10 updates (#1323) Bumps the dev-minor-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.85.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `electron` from 43.2.0 to 43.4.1 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.2.0...v43.4.1) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `i18next` from 26.3.6 to 26.4.0 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0) Updates `lucide-react` from 1.28.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react-hook-form` from 7.84.0 to 7.85.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.84.0...v7.85.0) Updates `react-pdf` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: electron dependency-version: 43.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-hook-form dependency-version: 7.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: react-pdf dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: sync Crowdin translations * Update redirect-issues workflow configuration Updated the workflow to change the runner and modify the issue response message. * test(sftp): verify local collection limit boundaries --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> * chore: increment ver * fix: allow any origin by default when CORS_ALLOWED_ORIGINS is unset * feat(file-manager): parallel local transfers (#1446) Uploads from the Local pane (and downloads to it) ran strictly one file after another. Batches of many small files were bound by per-file latency rather than bandwidth. - `runWithConcurrency(items, limit, worker, shouldStop)`: a bounded worker pool that dispatches in order, keeps at most `limit` transfers in flight, and stops dispatching once cancelled while letting in-flight items finish. Worker errors are handled by the worker (one failure never aborts the batch). - useLocalTransfers: both directions go through the pool. Remote / local directory skeletons are still created up front, so file order does not matter. The batch runner now tracks a set of in-flight transfer ids (Cancel cancels all of them), sums bytes across in-flight transfers plus settled ones for the progress bar / speed, and shows how many files are moving at once. - New preference "Simultaneous File Transfers" (1-8, default 4) in the profile settings, stored in localStorage (`termix:file-manager:transfer-concurrency`) and part of the storage snapshot. 1 restores the previous sequential behaviour; the hint suggests lowering it for servers that limit SFTP channels. - Remote directories are created with the now-idempotent mkdir (#1442) without swallowing its errors, so a real failure stops the batch up front instead of surfacing as N per-file failures. When files do fail, the summary toast carries the first underlying reason (e.g. the backend's 401 message) instead of a bare "Upload failed". - Tests: pool never exceeds the limit and drains everything, stops on cancel, tolerates a failing item, handles empty input; preference clamping and persistence; bridge-level concurrent uploads/downloads with a mid-flight cancel leave every other file intact and no partials. Co-authored-by: Max <maxim@cogitate.ai> * fix(sftp): complete streamed uploads and stop pre-parsing chunk bodies * fix(desktop): stop setting Content-Length on local download requests * fix(file-manager): keep drop overlays in view when the list is scrolled * fix(file-manager): let remote rows be dropped on the local pane * fix(desktop): authenticate local transfers with the renderer's token * chore: update release notes * chore: remove unused gitlab ci and argocd deploy configs * chore: remove unused files * feat: improve loading animation * fix(shell): stop tab reorder from resetting terminals and tab indicator Keep the tab-content portal order stable so reordering tabs doesn't retrigger React's offscreen pass and dispose live terminals. Also stop the active tab indicator from teleporting during a drag, and fix the drag ghost's size/border mismatch. * fix(shell): hand-roll the tab indicator instead of a shared layoutId Framer's layoutId could measure the wrong tab's rect during a reorder and land on an inactive tab, or leave a stray line visible mid-drag. Now it reads the active tab's own DOM rect directly and hides while dragging. * fix(hosts): fix right-click menu position and unwanted tray expand * chore: update release notes * fix(terminal): stop autosuggestion ghost text overlapping typed input Position was computed from cursorX before server echo landed, causing a stale read that overlapped just-typed characters on fast local input. * chore: update release notes for v2.8.0 * fix(sftp): rebuild transfer tab for web, fix menu offset bug Drop the electron-only local mode and dead code, i18n all strings, fix double progress toasts and a wrong pane refresh on move. Fix context menus rendering offset due to a lingering CSS transform from the tab-switch animation. Move SFTP next to SSH Tools in the rail. * fix(file-manager): shrink oversized .. entry, navigate on single click * fix: make select2 component use rounded corners * fix: rebuild terminal AI assistant on the real backend Removes the Electron-only Agent Mode/AI Command Helper that bypassed admin/user gating and ran commands with no approval step. Replaces it with a terminal-docked panel on the same gated backend as the AI tab, adds a per-host toggle (off by default), moves it into the toolbar, and fixes proposal ordering and run-in-terminal execution. * fix(file-manager): remove duplicate borders in toolbar view toggle Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: separate registration toggle from step ca settings * fix: collab room bugs and add room deletion Accent-colored new room button, fix fullscreen guest view layout and duplicate view-only badges, self-heal stale presenter state, add delete room for persistent rooms. * refactor: move host-identity helpers to hosts core Used by docker, file-manager, and terminal alike, so it belongs at the hosts root instead of under terminal/. * refactor: move host-session-status singleton to hosts core metrics subscribed to terminal's private online/offline pub-sub module. Moved to hosts core so both sides depend on a shared module instead of metrics reaching into terminal. Marked the subscribe call with PLUGIN-EVENT for the future event bus. * refactor: split generic automation event notify out of metrics notifyAutomationInternalEvent was in hosts/metrics/automation-bridge.ts but is used by tunnel, host routes, user routes, and automations engine itself, not just metrics. Moved it to hosts/automation-events.ts so those callers depend on a shared module instead of metrics internals. Left the metrics-specific notifiers in place. * feat: add plugin system schema and repositories Adds plugins, plugin_permission_grants, plugin_registries, and plugin_install_counts tables plus their repositories. No routes or UI yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * feat: add runtime rail item and tab component registries for plugins * feat: support runtime-registered permission groups Adds register/unregister for plugin permission groups so the RBAC catalog and validation can grow beyond the static list. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * feat: add plugin-api nginx route and dispatcher stub * feat: add plugin manifest schema and validator * chore: update release notes * chore: update i18n for local/remote file manager * feat: add toggle to show/hide app rail pin button * feat(host-metrics): add NVIDIA GPU metrics card (#1452) * feat(host-metrics): add NVIDIA GPU metrics card Collect per-GPU utilization, VRAM, temperature, power, fan speed and the processes using each GPU over SSH with nvidia-smi. The collector exits immediately when nvidia-smi is missing, so hosts without a GPU pay almost nothing per poll. The GPU card is opt-in: it is available from the Add card tray but is not part of new-host defaults or any UI preset. It shows live sparklines for utilization and VRAM per GPU. Adaptive polling now also watches GPU readings and the GPU process count, so it no longer backs off on hosts where only the GPU is busy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F2ctuPwiesLzhF6XQiozm8 * fix(host-metrics): draw sparklines from the first metrics sample The first sample fetched when the tab connects was shown but never added to the sparkline history, so every sparkline (CPU, memory, disk, GPU) stayed empty until the second poll, a full metrics interval later (about 35 s with the default 30 s interval). Record the first sample like every later one, so the lines appear as soon as the tab loads. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F2ctuPwiesLzhF6XQiozm8 * Fix logical condition for memory percentage calculation Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: annotate local transfer plan type to fix CI type-check * fix: move connection toolbar settings to bottom of host editor general tab * chore: add debug logging for macOS sharp packaging failure Temporary diagnostic to find which phase drops @img/sharp-darwin-x64 from the packaged app. Revert once root cause is found. * fix: correct macOS sharp verify script for universal build layout electron-builder uses mergeASARs: false, so universal builds ship app-x64.asar.unpacked and app-arm64.asar.unpacked side by side instead of a single app.asar.unpacked. The verify script only checked the single-asar path, so it always failed on universal/mas artifacts even when packaging was correct. * fix: update sharp verify test fixtures for universal build layout The test built fake apps using the single app.asar.unpacked layout, which doesn't match how universal builds are actually packaged now (app-x64.asar.unpacked / app-arm64.asar.unpacked side by side). * chore: update readme * fix: guard against missing rooms array in collab list response * fix: distinct guac connection log stages, RDP black screen before failure * fix: proxy /collab routes in nginx configs * fix: stop tab-switch flash and host metrics/proxmox reconnect Tab DOM visibility now syncs before paint instead of after, and switching tabs no longer tears down live metrics connections. * fix: tab bar flashing, growing, and merged separators Terminal tabs no longer flash when switching, the enter animation no longer nudges layout size, and a stray transform on resting tabs no longer causes the border between tabs to vanish at some zoom levels. * fix: match select trigger height to inputs in web UI editor * chore: lint, format, and bump version to 2.8.0 * chore: sync Crowdin translations for 2.8.0 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: Angad Singh <7099405+singhangadin@users.noreply.github.com> Co-authored-by: Angad Singh <angad@singhangad.in> Co-authored-by: Neo <54811660+neooriginal@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Wali Lambert <98448225+YatoVoid@users.noreply.github.com> Co-authored-by: Nasif Rahman <44437976+nasif-naseef@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: vietanhtwdk <vietanhtruongwdk@gmail.com> Co-authored-by: inontz <inontz@icloud.com> Co-authored-by: inontz <inontz@users.noreply.github.com> Co-authored-by: Max Serov <133950708+maxser0v@users.noreply.github.com> Co-authored-by: Max <maxim@cogitate.ai> Co-authored-by: ssmurfgg04-gif <ssmurfgg04@gmail.com> Co-authored-by: ssmurfgg04-gif <232103099+ssmurfgg04-gif@users.noreply.github.com> Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com> Co-authored-by: slsgzs-cloud <slsgzs@gmail.com> Co-authored-by: anshtsolanki-sketch <anshtsolanki@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: tcezarl <tomescu.cezar.laurentiu@gmail.com> Co-authored-by: Anton Priestley <anton@priestley.me> Co-authored-by: Hakim M <hakimmarsudi@outlook.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Adel Alzubeir <14052842+Adelzu@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-10-31 15:45:23 +00:00 · 2026-09-20 14:56:39 -05:00
1 parent 9c04860821
commit fef8a5f28a
@@ -114,6 +114,32 @@
    "cloneCredentialAction": "자격 증명 복제",
    "clonedCredential": "복제됨 {{name}}",
    "clonedCredentialName": "{{name}} (복사)",
+    "shareCredentialAction": "자격 증명 공유",
+    "sharedBadge": "공유됨",
+    "sharedBy": "{{owner}}님이 공유함",
+    "share": {
+      "title": "\"{{name}} \" 공유",
+      "description": "수신자는 암호화된 비밀 정보 사본을 받게 됩니다. 이 사본은 자격 증명이 변경될 때마다 갱신되고 공유가 취소되면 삭제됩니다.",
+      "users": "사용자",
+      "roles": "역할",
+      "searchPlaceholder": "찾다...",
+      "permission": "허가",
+      "levelUse": "사용",
+      "levelManage": "관리하다",
+      "levelUseDesc": "사용 방법: 자격 증명을 호스트에 연결하고 접속하세요. 비밀 키 자체는 숨겨진 상태로 유지됩니다.",
+      "levelManageDesc": "관리: 자격 증명을 편집하고 다른 사람과 공유할 수도 있습니다.",
+      "expires": "만료됨",
+      "expiry": {
+        "never": "절대",
+        "oneDay": "1일",
+        "sevenDays": "7일",
+        "thirtyDays": "30일"
+      },
+      "currentAccess": "공유됨",
+      "revoke": "취소",
+      "shared": "자격 증명 공유됨",
+      "shareButton": "공유하다"
+    },
    "deleteCredentialAction": "자격 증명 삭제",
    "editCredentialAction": "자격 증명 수정",
    "failedToCloneCredential": "자격 증명 복제에 실패했습니다.",
@@ -201,6 +227,7 @@
    "icon": "아이콘",
    "expanded": "기본적으로 확장됨",
    "timezone": "시간대",
+    "invalidTimezone": "잘못된 시간대입니다. America/New_York와 같은 IANA 이름을 사용하십시오.",
    "showSeconds": "초 표시",
    "format12h": "12시간",
    "format24h": "24시간",
@@ -474,6 +501,8 @@
    "disconnectButton": "연결을 끊으세요",
    "syncNowButton": "지금 동기화하세요",
    "syncing": "동기화 중...",
+    "syncSuccess": "원격 동기화가 완료되었습니다.",
+    "syncUnavailable": "원격 동기화를 시작할 수 없습니다.",
    "serverUrl": "서버 URL",
    "enterServerUrl": "서버 URL을 입력해 주세요.",
    "mustIncludeProtocol": "서버 URL은 http:// 또는 https://로 시작해야 합니다.",
@@ -662,6 +691,7 @@
    "aiNote": "공급자를 추가하고 메시지를 보내기 전까지는 아무것도 전송되지 않습니다."
  },
  "nav": {
+    "collab": "회의",
    "home": "홈",
    "terminal": "터미널",
    "localTerminal": "로컬 터미널",
@@ -714,9 +744,13 @@
    "workspaces": "작업 공간",
    "hostManager": "호스트 관리자",
    "credentials": "자격 증명",
+    "portForwarding": "전송",
+    "sftp": "SFTP",
    "connections": "연결",
    "alerts": "알림",
    "serial": "시리얼",
+    "keepSideMenuOpen": "메뉴를 열어 두세요",
+    "collapseSideMenu": "메뉴 접기",
    "roleAdministrator": "관리자",
    "roleUser": "사용자",
    "ai": "일체 포함"
@@ -776,7 +810,13 @@
    "tunnel": "터널",
    "fileManager": "파일 관리자",
    "serverStats": "호스트 메트릭",
-    "status": "상태",
+    "status": {
+      "available": "사용 가능",
+      "reachable": "접근 가능하지만 인증되지 않았습니다.",
+      "offline": "오프라인",
+      "monitoringDisabled": "모니터링이 비활성화되었습니다.",
+      "label": "상태"
+    },
    "folderRenamed": "폴더 \"{{oldName}}\"이(가) \"{{newName}}\"(으)로 성공적으로 이름이 변경되었습니다.",
    "failedToRenameFolder": "폴더 이름 변경에 실패했습니다.",
    "unsavedChangesDescription": "호스트 변경 사항이 저장되지 않았습니다. 변경 내용을 삭제하시겠습니까?",
@@ -862,7 +902,8 @@
    "useSocks5Proxy": "SOCKS5 프록시 사용",
    "useSocks5ProxyDesc": "프록시 서버를 통해 연결 라우팅",
    "connectionOrigin": "연결 출처",
-    "connectionOriginDesc": "이 호스트의 SSH 연결이 시작된 위치입니다. 데스크톱 앱의 전역 기본값을 재정의합니다.",
+    "connectionOriginDesc": "이 호스트의 연결이 시작된 위치입니다. 데스크톱 앱의 전역 기본값을 재정의합니다.",
+    "connectionOriginGuacamoleNote": "RDP, VNC, Telnet은 \"이 장치\"를 선택하지 않는 한 원격 서버를 사용합니다. \"이 장치\"를 선택하려면 해당 장치가 연결할 수 있는 guacd가 필요합니다. guacd URL 설정 또는 guacd 프록시 설정에서 호스트별로 guacd를 설정하십시오.",
    "connectionOriginDefault": "기본값을 사용합니다",
    "connectionOriginLocal": "이 장치(로컬 네트워크)",
    "connectionOriginRemote": "원격 서버",
@@ -887,6 +928,22 @@
    "selectAVaultProfile": "Vault 프로필 선택...",
    "vaultProfileHint": "설정은 공유 프로필에서 가져옵니다. 연결 시 OIDC를 통해 Vault에 로그인하게 됩니다. 비밀은 저장되지 않습니다.",
    "vaultNewProfile": "새 프로필",
+    "secretRefHint": "비밀 키 대신 1Password 참조(op://vault/item/field)를 붙여넣을 수 있습니다. 연결 시 비밀 키 소스에서 참조가 자동으로 가져와집니다.",
+    "secretSourcesManage": "비밀 소스를 관리하세요",
+    "secretSourcesTitle": "비밀 정보원",
+    "secretSourcesDesc": "Termix는 외부 암호 관리자(현재 1Password Connect(자체 호스팅))에서 연결 시 비밀 키를 읽어옵니다. 액세스 토큰은 데이터 키로 암호화되어 저장됩니다.",
+    "secretSourceNew": "새로운 소스",
+    "secretSourceUrlLabel": "서버 URL에 연결",
+    "secretSourceTokenLabel": "연결 액세스 토큰",
+    "secretSourceTokenKeep": "현재 토큰을 유지하려면 비워 두십시오.",
+    "secretSourceSharedLabel": "모든 사용자와 공유 (관리자만 가능, 로그인 상태에서 해결됨)",
+    "secretSourceShared": "공유됨",
+    "secretSourceTest": "시험",
+    "secretSourceTestOk": "연결됨 — {{count}} 금고(들)가 보입니다",
+    "secretSourceTestFailed": "연결 테스트 실패",
+    "secretSourceRequired": "이름, 서버 URL 및 토큰은 필수 입력 사항입니다.",
+    "secretSourceSaved": "비밀 소스 저장됨",
+    "secretSourceDeleted": "비밀 소스 삭제됨",
    "vaultManageProfiles": "Vault 프로필 관리",
    "vaultAddrLabel": "Vault 주소",
    "vaultNamespaceLabel": "네임스페이스",
@@ -919,6 +976,9 @@
    "keyPassphraseSaved": "암호가 저장되었습니다. 변경하려면 입력하세요.",
    "replaceKey": "키 교체",
    "docsLink": "문서 보기",
+    "stepcaLabel": "스텝 CA",
+    "stepcaDesc": "ID 공급자를 통해 로그인하고 Step CA에서 이 호스트에 대한 단기 SSH 인증서를 발급받으세요. CA URL, 루트 지문 및 OIDC 프로비저너는 관리자가 관리자 설정에서 설정합니다.",
+    "authTypeStepca": "스텝 CA",
    "opksshLabel": "OPKSSH",
    "opksshDesc": "비밀번호나 키 대신 ID 공급자로 이 호스트에 로그인합니다. 서버에 OPKSSH가 설정되어 있어야 합니다.",
    "warpgateLabel": "Warpgate 게이트웨이",
@@ -1026,7 +1086,7 @@
    "enableAutoMosh": "Auto-Mosh 활성화",
    "enableAutoMoshDesc": "사용 가능한 경우 SSH보다 Mosh를 우선합니다",
    "enableAutoTmux": "Auto-Tmux 활성화",
-    "enableAutoTmuxDesc": "tmux 세션을 자동으로 시작하거나 연결합니다",
+    "enableAutoTmuxDesc": "tmux 내부에서 실행하면 연결이 끊기거나 브라우저가 다시 시작되더라도 셸과 그 안에서 실행 중인 모든 작업이 계속 유지됩니다(호스트에 tmux가 설치되어 있어야 함).",
    "enableSessionLogging": "세션 로깅",
    "enableSessionLoggingDesc": "나중에 검토할 수 있도록 터미널 세션 출력을 기록합니다",
    "allowSessionSharing": "세션 공유 허용",
@@ -1094,6 +1154,11 @@
    "enableTmuxMonitorDesc": "Tmux 모니터에 이 호스트를 표시하고 tmux 작업을 사이드바에 추가합니다.",
    "enableTerminalToolbar": "터미널 툴바 활성화",
    "enableTerminalToolbarDesc": "현재 활성화된 터미널에 도킹된 빠른 액세스 툴바를 표시하여 해당 호스트의 도구 및 실시간 통계를 볼 수 있도록 합니다.",
+    "connectionToolbar": "연결 도구 모음",
+    "showConnectionToolbar": "연결 도구 모음 표시",
+    "showConnectionToolbarDesc": "이 호스트의 SSH, RDP, VNC 및 Telnet 세션에 툴바를 표시합니다. 툴바 자체에서 툴바를 일시적으로 숨길 수도 있습니다.",
+    "enableAiAssistant": "AI 어시스턴트 활성화",
+    "enableAiAssistantDesc": "이 호스트의 터미널에서 AI 도우미의 도움을 받을 수 있도록 허용합니다. 기본적으로 비활성화되어 있으며, 계정에 AI 기능이 활성화되어 있어야 합니다.",
    "tabProxmox": "Proxmox",
    "proxmoxIntegration": "Proxmox 통합",
    "enableProxmox": "Proxmox 활성화",
@@ -1502,6 +1567,7 @@
    "filterAuthCredential": "인증 정보",
    "filterAuthNone": "없음",
    "filterAuthOpkssh": "OPKSSH",
+    "filterAuthStepca": "스텝 CA",
    "filterProtocolGroup": "프로토콜",
    "filterProtocolSsh": "SSH",
    "filterProtocolRdp": "RDP",
@@ -1564,6 +1630,9 @@
      "shareWithCount": "공유 ({{count}})",
      "currentAccess": "현재 접근 권한",
      "noAccessEntries": "이 호스트는 아직 공유되지 않았습니다",
+      "folderRulesTitle": "나중에 추가된 호스트에 적용됩니다.",
+      "folderRulesHint": "이러한 공유는 폴더에 유지됩니다. 해당 폴더(또는 하위 폴더)에서 호스트를 생성하거나 이동하면 자동으로 동일한 액세스 권한을 얻습니다. 규칙을 제거해도 향후 상속만 중지됩니다.",
+      "folderRuleRemove": "상속을 중단하세요",
      "folderShareSummary": "이 폴더에 있는 {{shared}} 호스트 중 {{total}} 호스트가 공유되었습니다.",
      "grantedBy": "공유자",
      "expires": "만료",
@@ -1580,7 +1649,9 @@
      "ownerAuthPrivate": "호스트 소유자의 SSH 인증은 비공개입니다. 호스트 메뉴에서 \"개인 SSH 인증 설정\"을 사용하여 사용자 고유의 자격 증명을 선택하십시오.",
      "ownerAuthShared": "호스트 소유자가 이 호스트에 대한 SSH 인증 정보를 공유했습니다. 해당 정보를 사용하거나 \"개인 SSH 인증 설정\"에서 사용자 고유의 자격 증명을 선택할 수 있습니다.",
      "authOverrideAction": "개인 SSH 인증 설정",
+      "authOverrideActionProtocol": "개인 {{protocol}} 인증 설정",
      "authOverrideTitle": "개인 SSH 인증",
+      "authOverrideTitleProtocol": "개인 {{protocol}} 인증",
      "authOverrideDescriptionPrivate": "호스트 소유자의 SSH 자격 증명은 비공개로 유지됩니다. {{host}}에 연결하려면 저장된 자격 증명 중 하나를 선택하십시오.",
      "authOverrideDescriptionShared": "호스트 소유자가 공유한 인증을 사용하거나 {{host}}에 연결하기 위해 저장된 자격 증명 중 하나로 대체하세요.",
      "authOverrideCredentialLabel": "인증 자격 증명",
@@ -1742,7 +1813,45 @@
    },
    "arrangeUnlockedSwitchedToManual": "주문 순서가 유지되도록 수동 정렬로 전환했습니다.",
    "dragToRearrange": "드래그하여 순서를 변경하세요",
-    "arrangeUnlocked": "드래그하여 순서를 재배열하세요."
+    "arrangeUnlocked": "드래그하여 순서를 재배열하세요.",
+    "tabWebUi": "웹 UI",
+    "webUiEndpointLabel": "엔드포인트 {{number}}",
+    "webUiIntegration": "웹 UI",
+    "webUiEndpointsSection": "엔드포인트",
+    "webUiRequirementsText": "브라우저에서 직접 엔드포인트가 열리므로 해당 포트에 브라우저에서 접근할 수 있어야 합니다. Termix는 이 호스트의 SSH 연결을 통해 SSH 터널을 열므로 해당 포트는 호스트에서만 접근할 수 있으면 됩니다.",
+    "enableWebUi": "웹 엔드포인트를 활성화합니다.",
+    "enableWebUiDesc": "사이드바에서 이 호스트의 웹 인터페이스를 엽니다.",
+    "webUiAddEndpoint": "엔드포인트 추가",
+    "webUiAddress": "주소",
+    "webUiOpening": "열기",
+    "webUiBindHostDesc": "백엔드가 포워드를 바인딩하는 위치입니다. 127.0.0.1은 Termix가 실행되는 머신만 접근할 수 있으므로 비워 두십시오.",
+    "webUiBindHostExposed": "이 주소는 Termix 장비 외에서도 접근 가능하므로, 해당 포트에 접속할 수 있는 사람은 누구나 로그인 없이 이 웹 UI에 접속할 수 있습니다.",
+    "webUiBindHostUnreachable": "브라우저가 Termix가 실행되는 컴퓨터의 127.0.0.1에 연결할 수 없으므로 이 엔드포인트가 로드되지 않습니다. 해당 컴퓨터가 응답하는 주소(예: 0.0.0.0)를 사용하십시오.",
+    "webUiBindHostSharesSessionCookie": "이 브라우저에서 포워딩을 시도하면 Termix가 제공되는 호스트 이름과 동일한 호스트 이름으로 연결되므로 터널링된 서비스가 Termix 세션을 수신하게 됩니다. 쿠키는 포트 번호를 무시합니다. 이 엔드포인트는 여기에서 열리지 않지만, Termix 데스크톱 앱이나 Termix를 localhost에서 열었을 때는 정상적으로 작동합니다.",
+    "webUiLocalPort": "현지 항구",
+    "webUiLocalPortAuto": "오토매틱",
+    "webUiLocalPortDesc": "포트 포워딩이 수신 대기할 포트를 지정합니다. 시스템에서 자동으로 선택하도록 하려면 비워 두거나, 포트를 미리 알아야 하는 컨테이너(예: 포트를 공개하는 컨테이너)의 경우 포트를 설정하십시오.",
+    "webUiNewEndpointLabel": "새로운 엔드포인트",
+    "webUiErrorLabelRequired": "엔드포인트 {{row}} 에 레이블이 필요합니다.",
+    "webUiErrorLabelDuplicate": "각 엔드포인트에는 서로 다른 이름이 필요합니다.",
+    "webUiErrorPortRange": "엔드포인트 {{row}} 에는 1에서 65535 사이의 포트가 필요합니다.",
+    "webUiErrorPathInvalid": "엔드포인트 {{row}} 의 경로가 잘못되었습니다. /admin과 같은 경로를 사용하세요.",
+    "webUiLabel": "상표",
+    "webUiScheme": "계획",
+    "webUiPort": "포트",
+    "webUiPath": "길",
+    "webUiAccess": "입장",
+    "webUiAccessDirect": "직접",
+    "webUiAccessTunnel": "SSH 터널",
+    "webUiAccessTunnelUnavailable": "SSH 터널을 사용하려면 해당 호스트에서 SSH가 활성화되어 있어야 하고 연결 시작 장치가 이 장치여야 합니다.",
+    "webUiRender": "열기",
+    "webUiRenderExternal": "격리된 데스크톱 창",
+    "webUiRenderEmbedded": "터믹스 탭",
+    "webUiRenderEmbeddedDesc": "임베딩은 최선을 다하는 방식입니다. 일부 웹 인터페이스는 프레임 내에서 로드되지 않을 수 있으며, 동일 사이트 쿠키에 의존하는 로그인은 무한 루프에 빠질 수 있습니다. 외부 브라우저는 항상 정상적으로 작동합니다.",
+    "webUiIgnoreCert": "유효하지 않은 인증서를 허용합니다",
+    "webUiIgnoreCertDesc": "직접 연결 엔드포인트에만 적용됩니다. 루프백은 이미 제외되어 있으므로 터널 엔드포인트에는 영향을 미치지 않습니다.",
+    "webUiRemoveEndpoint": "엔드포인트를 제거합니다.",
+    "webUiOpenFailed": "웹 엔드포인트를 열 수 없습니다."
  },
  "commandPalette": {
    "searchPlaceholder": "호스트, 명령 또는 설정 검색...",
@@ -1793,7 +1902,7 @@
    "reopenTab": "다시 열기",
    "sectionOpen": "열림",
    "sectionBackground": "백그라운드",
-    "backgroundDesc": "세션은 연결 해제 후 30분간 유지되며 다시 연결할 수 있습니다.",
+    "backgroundDesc": "연결이 끊어진 후에도 세션은 {{minutes}} 분 동안 유지되며 다시 연결할 수 있습니다.",
    "persisted": "백그라운드에 유지됨",
    "expiresIn": "{{duration}} 후 만료",
    "search": "연결 검색...",
@@ -1804,13 +1913,96 @@
    "join": "가입하다",
    "sharedSessionLabel": "{{hostName}} (공유됨)"
  },
+  "collab": {
+    "createRoom": "새로운 방",
+    "roomName": "객실 이름",
+    "persistentRoom": "지속적인 방",
+    "persistentRoomHint": "회의가 끝난 후에도 지정된 회의실 목록에 남아 재사용할 수 있습니다.",
+    "noRooms": "아직 회의실이 없습니다. 회의를 시작하려면 회의실을 만드세요.",
+    "openRoom": "열려 있는",
+    "endRoom": "회의 종료",
+    "leaveRoom": "떠나다",
+    "deleteMember": "제거하다",
+    "removeMember": "{{name}}를 제거하세요",
+    "removeMemberTitle": "이 회원을 삭제하시겠습니까?",
+    "removeMemberDescription": "{{name}} 사용자는 즉시 이 방에 대한 접근 권한을 잃게 됩니다. 활성화된 SSH 뷰어는 모두 연결이 끊어집니다.",
+    "invite": "초대하다",
+    "inviteTitle": "회원 초대",
+    "members": "회원들",
+    "membersPanel": "회의실 구성원 및 제어 요청",
+    "membersWithCount": "멤버({{count}})",
+    "online": "온라인",
+    "offline": "오프라인",
+    "you": "(너)",
+    "hostBadge": "주인",
+    "presenterBadge": "소개합니다",
+    "present": "현재의",
+    "presentTitle": "무대에 오르세요",
+    "presentHost": "주인",
+    "searchHosts": "호스트 검색",
+    "noHostsFound": "사용 가능한 호스트를 찾을 수 없습니다.",
+    "presentProtocol": "규약",
+    "stopPresenting": "프레젠테이션을 중단하세요",
+    "takeOver": "인수하세요",
+    "takeOverConfirmTitle": "현재 프레젠테이션을 교체하시겠습니까?",
+    "takeOverDescription": "{{name}} 님이 현재 발표 중입니다. 발표를 이어받으면 해당 무대에서 모든 사용자의 연결이 끊어집니다.",
+    "emptyStage": "발표자가 없습니다. 무대에 올라 세션을 공유해 보세요.",
+    "stageLoading": "무대와 연결 중...",
+    "stageEnded": "프레젠테이션이 끝났습니다.",
+    "roomEnded": "이 회의는 종료되었습니다.",
+    "presenterLabel": "{{name}} 가 발표합니다",
+    "guestLink": "게스트 링크",
+    "guestLinkOn": "게스트 링크가 활성화되었습니다. 링크만 있으면 누구나 무대를 시청할 수 있습니다.",
+    "guestLinkOff": "게스트 링크가 꺼져 있습니다.",
+    "copyLink": "링크 복사",
+    "rotateLink": "링크를 회전하세요",
+    "disableLink": "링크 비활성화",
+    "rotateLinkConfirmTitle": "게스트 링크를 변경하시겠습니까?",
+    "rotateLinkDescription": "현재 연결은 즉시 작동을 멈춥니다. 연결된 SSH 게스트는 연결이 끊어집니다.",
+    "disableLinkConfirmTitle": "게스트 링크를 비활성화하시겠습니까?",
+    "disableLinkDescription": "익명 SSH 뷰어는 즉시 연결이 끊어지고 현재 링크가 작동을 멈춥니다.",
+    "linkCopied": "링크 복사됨",
+    "roles": "역할",
+    "users": "사용자",
+    "searchUsers": "검색 사용자",
+    "endConfirmTitle": "이 회의를 종료하시겠습니까?",
+    "endDescription": "{{name}} 는 모든 사용자에게 종료되며 다시 열 수 없습니다.",
+    "endPersistentDescription": "{{name}} 에서 진행 중이던 프레젠테이션이 종료됩니다. 해당 공간은 재사용 가능합니다.",
+    "deleteRoom": "방 삭제",
+    "deleteConfirmTitle": "이 방을 삭제하시겠습니까?",
+    "deleteDescription": "{{name}} 는 모든 사용자에게 영구적으로 삭제되며 되돌릴 수 없습니다.",
+    "invitedTo": "당신은 \"{{name}} \"에 초대되었습니다.",
+    "guest": {
+      "title": "회의",
+      "waiting": "발표자를 기다리는 중...",
+      "linkInvalid": "게스트 링크가 유효하지 않거나 회의가 종료되었습니다."
+    },
+    "reopenFromPanel": "이 회의 탭이 만료되었습니다. 회의 패널에서 회의실을 다시 여세요.",
+    "requestControl": "요청 제어",
+    "cancelControlRequest": "취소 요청",
+    "controlQueue": "제어 요청",
+    "noControlRequests": "보류 중인 요청이 없습니다.",
+    "grantControlTo": "{{name}}에 제어권을 넘겨주세요",
+    "dismissControlRequest": "{{name}}의 제어 요청을 기각합니다.",
+    "releaseControl": "릴리스 컨트롤",
+    "grantControl": "제어권을 넘겨주세요",
+    "revokeControl": "주도권을 되찾으세요",
+    "controlRequestedBy": "{{name}} 제어권을 요청했습니다.",
+    "grant": "승인하다",
+    "controlBadge": "통제하에",
+    "youArePresenting": "다른 탭에서 프레젠테이션을 진행하고 계십니다. 프레젠테이션을 중지하고 다음 사람에게 넘겨주세요.",
+    "created": "방이 생성되었습니다",
+    "invited": "회원 초대",
+    "roomTab": "회의"
+  },
  "sessionSharing": {
    "guestView": {
      "loading": "공유 세션에 연결 중...",
      "linkInvalid": "이 공유 링크는 유효하지 않거나, 만료되었거나, 취소되었습니다.",
      "rateLimited": "시도 횟수가 너무 많습니다. 잠시 후 다시 시도해 주세요.",
      "sessionEnded": "이번 세션이 종료되었습니다.",
-      "readOnlyBadge": "보기 전용"
+      "readOnlyBadge": "보기 전용",
+      "ownerLabel": "호스트 소유자"
    },
    "modalTitle": "공유 세션",
    "shareButton": "공유하다",
@@ -1855,6 +2047,11 @@
  },
  "guacamole": {
    "connecting": "{{type}} 세션에 연결 중...",
+    "checkingGuacd": "원격 데스크톱 서비스를 확인하는 중...",
+    "requestingToken": "{{type}} 연결 토큰을 요청하는 중...",
+    "openingSession": "{{type}} 세션을 여는 중...",
+    "negotiating": "협상 중 {{type}} 악수...",
+    "sessionReady": "{{type}} 세션 준비 완료",
    "connectionError": "연결 오류",
    "connectionFailed": "연결 실패",
    "failedToConnect": "연결 토큰을 가져오지 못했습니다.",
@@ -1881,12 +2078,19 @@
      "uploadFailed": "{{name}} 업로드에 실패했습니다.",
      "uploadDisabled": "이 연결에서는 업로드가 비활성화되어 있습니다.",
      "driveUnavailable": "파일을 업로드하기 전에 RDP 드라이브 리디렉션을 활성화하십시오.",
+      "driveNotWritable": "guacd가 드라이브 폴더에 쓰기 권한이 없습니다. GUACD_DRIVE_PATH(또는 호스트의 드라이브 경로)와 해당 권한을 확인하십시오.",
      "dropToUpload": "업로드할 파일을 드롭하세요"
    },
    "toolbar": {
      "ctrlAltDel": "Ctrl+Alt+Del",
      "winL": "Win+L (화면 잠금)",
      "winKey": "Windows 키",
+      "superL": "Super+L (잠금 화면)",
+      "superKey": "슈퍼 키",
+      "super": "감독자",
+      "cmdL": "Cmd+L (화면 잠금)",
+      "cmdKey": "명령 키",
+      "cmd": "명령",
      "ctrl": "Ctrl",
      "alt": "Alt",
      "shift": "Shift",
@@ -1908,11 +2112,21 @@
      "collapse": "도구 모음 접기",
      "expand": "도구 모음 펼치기",
      "dragHandle": "드래그하여 위치 이동",
+      "hide": "이번 세션 동안에는 숨깁니다. 영구적으로 비활성화하려면 호스트 설정 → 일반 → 연결 도구 모음을 여세요.",
+      "zoomIn": "확대",
+      "zoomOut": "축소하기",
+      "resetZoom": "확대/축소 초기화",
+      "fitToScreen": "화면에 맞추기",
      "switchToTrackpad": "트랙패드 모드로 전환하세요 (드래그하여 커서 이동, 탭하여 클릭).",
      "switchToTouch": "터치 모드로 전환하세요 (클릭하려는 위치를 직접 탭하세요)."
    }
  },
  "terminal": {
+    "sessionExpiredNotice": "{{host}} 호스트에서 진행 중이던 이전 세션이 {{minutes}} 분 후 연결이 끊어지면서 만료되었습니다. 셸과 셸에서 실행 중이던 모든 항목이 종료되었습니다. 세션을 유지하려면 이 호스트에서 자동 Tmux를 활성화하십시오.",
+    "sessionExpiredNoticeNoMinutes": "{{host}} 에서 이전 세션이 연결이 끊긴 상태에서 만료되었습니다. 셸과 그 안에서 실행 중이던 모든 항목이 사라졌습니다. 세션을 유지하려면 이 호스트에서 자동 Tmux를 활성화하십시오.",
+    "enableAutoTmuxAction": "자동 Tmux 활성화",
+    "autoTmuxEnabled": "{{host}}에 대해 자동 Tmux가 활성화되었습니다. 이는 다음 연결부터 적용됩니다.",
+    "autoTmuxEnableFailed": "자동 Tmux를 활성화하는 데 실패했습니다.",
    "connect": "호스트에 연결",
    "clear": "지우기",
    "paste": "붙여넣기",
@@ -1975,6 +2189,7 @@
    "warpgateAuthUrl": "인증 URL",
    "warpgateOpenBrowser": "브라우저에서 열기",
    "warpgateContinue": "인증 완료",
+    "certAuthRequired": "{{provider}} 로그인 필요",
    "opksshAuthRequired": "OPKSSH 인증 필요",
    "opksshAuthDescription": "브라우저에서 인증을 완료하여 계속 진행하세요. 이 세션은 24시간 동안 유지됩니다.",
    "opksshOpenBrowser": "브라우저로 인증하기",
@@ -2069,6 +2284,58 @@
    "sudoOperationFailed": "Sudo 작업 실패",
    "sudoAuthFailed": "Sudo 인증 실패",
    "dragFilesToUpload": "업로드할 파일을 여기에 놓으세요",
+    "dropToUploadHere": "여기에 드롭하여 업로드하세요",
+    "dropToDownloadHere": "여기를 클릭하여 다운로드하세요",
+    "localFiles": "현지의",
+    "showLocalFiles": "로컬 파일 표시(분할 화면)",
+    "hideLocalFiles": "로컬 파일 숨기기",
+    "localHome": "홈 폴더",
+    "localPathPlaceholder": "로컬 폴더 경로",
+    "localShowHidden": "숨겨진 파일 표시",
+    "localHideHidden": "숨겨진 파일 숨기기",
+    "localRevealInFileManager": "시스템 파일 관리자에서 보기",
+    "localCannotOpenFolder": "폴더를 열 수 없습니다",
+    "localItemCount": "{{count}} 항목",
+    "localSelectedCount": "{{count}} 선택됨",
+    "back": "뒤쪽에",
+    "forward": "앞으로",
+    "up": "위로",
+    "kind": "친절한",
+    "localUploadingProgress": "{{current}} 의 {{total}}를 업로드 중입니다.",
+    "localDownloadingProgress": "{{current}} 의 {{total}} 다운로드 중",
+    "localTransferInFlight": "{{count}} 즉시",
+    "localPreparingDownload": "다운로드 준비 중...",
+    "localTransferCancelled": "이적 취소됨",
+    "localNothingToTransfer": "이체할 내용이 없습니다",
+    "localUploadComplete": "{{count}} 개의 파일을 업로드했습니다.",
+    "localUploadFailed": "업로드 실패",
+    "localUploadPartial": "업로드된 파일 {{done}} 개, {{failed}} 개에 실패했습니다.",
+    "localDownloadComplete": "{{count}} 파일을 다운로드했습니다.",
+    "localDownloadFailed": "다운로드 실패",
+    "localDownloadPartial": "{{done}} 파일 다운로드 실패, {{failed}}",
+    "localReplaceExistingPrompt": "이 폴더에 {{count}} 항목이 이미 있습니다. 바꾸시겠습니까?",
+    "localReplace": "바꾸다",
+    "localSkipExisting": "건너뛰다",
+    "localSkippedExisting": "기존 항목 {{count}} 개를 건너뛰었습니다.",
+    "localUnsafeNamesSkipped": "이 컴퓨터에서 사용할 수 없는 이름을 가진 {{count}} 항목을 건너뛰었습니다.",
+    "localOpen": "열려 있는",
+    "localOpenFolder": "폴더 열기",
+    "localUploadToRemote": "서버에 업로드",
+    "localUploadToRemoteMany": "{{count}} 아이템을 서버에 업로드하세요",
+    "localMoveToTrash": "쓰레기통으로 이동",
+    "localMoveToTrashMany": "{{count}} 항목을 휴지통으로 이동",
+    "localTrashConfirmSingle": "\"{{name}}\"를 휴지통으로 옮기시겠습니까?",
+    "localTrashConfirmFolder": "폴더 \"{{name}}\"와 그 안의 모든 내용을 휴지통으로 옮기시겠습니까?",
+    "localTrashConfirmMany": "{{count}} 항목을 휴지통으로 옮기시겠습니까?",
+    "localTrashed": "{{count}} 항목을 휴지통으로 이동했습니다.",
+    "localTrashFailed": "쓰레기통으로 옮길 수 없었습니다",
+    "localRenameFailed": "이름 변경 실패",
+    "localCreateFailed": "항목을 생성할 수 없습니다.",
+    "goToParentFolder": "상위 폴더로 이동",
+    "resizeSidebar": "드래그하여 사이드바 크기를 조절하세요 (더블 클릭하면 원래 크기로 돌아갑니다).",
+    "resizeLocalPane": "드래그하여 로컬 창의 크기를 조정하세요(두 번 클릭하면 원래 크기로 돌아갑니다).",
+    "columns": "컬럼",
+    "columnsHint": "마우스 오른쪽 버튼을 클릭하여 열을 선택하세요.",
    "emptyFolder": "이 폴더는 비어 있습니다",
    "searchFiles": "파일 검색...",
    "upload": "업로드",
@@ -2283,6 +2550,8 @@
    "used": "사용",
    "of": "중",
    "toggleSidebar": "사이드바 표시/숨기기",
+    "compactLayout": "간결한 레이아웃을 사용하세요",
+    "comfortableLayout": "편안한 레이아웃을 사용하세요",
    "cannotLoadPdf": "PDF를 로드할 수 없습니다",
    "pdfLoadError": "이 PDF 파일을 로드하는 중 오류가 발생했습니다.",
    "loadingPdf": "PDF 로드 중...",
@@ -2393,6 +2662,50 @@
    "retryTransferError": "재시도 실패",
    "transferFailedRetryHint": "대상에 부분 데이터가 유지되었습니다. 연결이 복구되면 다시 시도하면 이어서 전송됩니다."
  },
+  "sftpTransfer": {
+    "title": "SFTP",
+    "description": "두 SSH 호스트 간에 파일을 전송합니다.",
+    "sourceServer": "소스 서버",
+    "destinationServer": "대상 서버",
+    "selectHost": "호스트를 선택하세요",
+    "noHostSelected": "호스트가 선택되지 않았습니다.",
+    "move": "이동하다",
+    "copy": "복사",
+    "upload": "업로드",
+    "itemsSelected": "{{count}} 항목이 선택되었습니다",
+    "itemsSelected_other": "{{count}} 항목이 선택되었습니다",
+    "ready": "준비가 된",
+    "loadingHosts": "호스트를 불러오는 중...",
+    "name": "이름",
+    "modified": "수정됨",
+    "size": "크기",
+    "noFiles": "파일 없음",
+    "open": "열려 있는",
+    "up": "위로",
+    "refresh": "새로 고치다",
+    "copyToTarget": "대상 디렉터리로 복사",
+    "rename": "이름 변경",
+    "delete": "삭제",
+    "editPermissions": "편집 권한",
+    "createNewFolder": "새 폴더 만들기",
+    "deleteSelectedItems": "선택한 항목 삭제",
+    "deleteConfirm": "선택한 항목 {{count}} 을 삭제하시겠습니까?",
+    "deleteConfirm_other": "선택한 항목 {{count}} 을 삭제하시겠습니까?",
+    "cancel": "취소",
+    "save": "구하다",
+    "folderCreated": "폴더가 생성되었습니다",
+    "itemRenamed": "항목 이름이 변경됨",
+    "actionFailed": "작업이 실패했습니다",
+    "itemsDeleted": "{{count}} 항목이 삭제되었습니다",
+    "itemsDeleted_other": "{{count}} 항목이 삭제되었습니다",
+    "deleteFailed": "삭제 실패",
+    "permissionsUpdated": "권한이 업데이트되었습니다",
+    "noRemoteSessionConnected": "원격 세션이 연결되지 않았습니다.",
+    "failedToListFiles": "파일 목록을 불러오는 데 실패했습니다.",
+    "failedToRefresh": "새로 고침에 실패했습니다",
+    "destinationInsideSource": "대상 경로는 선택한 소스 경로 내에 있을 수 없습니다.",
+    "sameHostNoOp": "원본 폴더와 대상 폴더가 동일합니다."
+  },
  "tunnels": {
    "noSshTunnels": "SSH 터널 없음",
    "createFirstTunnelMessage": "아직 SSH 터널을 생성하지 않았습니다. 시작하려면 호스트 관리자에서 터널 연결을 구성하세요.",
@@ -2407,9 +2720,15 @@
    "port": "포트",
    "localPort": "로컬 포트",
    "remotePort": "원격 포트",
+    "destinationPort": "목적지 항구",
    "currentHostPort": "현재 호스트 포트",
    "endpointPort": "엔드포인트 포트",
    "bindIp": "로컬 IP",
+    "localAddress": "지역 주소",
+    "remoteAddress": "원격 주소",
+    "destinationAddress": "목적지 주소",
+    "remoteBindAddress": "원격 바인딩 주소",
+    "intermediateHost": "중간 호스트",
    "endpointSshConfig": "엔드포인트 SSH 설정",
    "endpointSshHost": "엔드포인트 SSH 호스트",
    "endpointSshHostPlaceholder": "설정된 호스트 선택",
@@ -2434,6 +2753,7 @@
    "localSaveError": "로컬 클라이언트 터널 저장 실패",
    "invalidBindIp": "로컬 IP는 유효한 IPv4 주소여야 합니다.",
    "invalidLocalTargetIp": "로컬 대상 IP는 유효한 IPv4 주소여야 합니다.",
+    "invalidRemoteAddress": "원격 주소가 필요합니다.",
    "invalidLocalPort": "로컬 포트는 1에서 65535 사이여야 합니다.",
    "invalidRemotePort": "원격 포트는 1에서 65535 사이여야 합니다.",
    "invalidLocalTargetPort": "로컬 대상 포트는 1에서 65535 사이여야 합니다.",
@@ -2460,8 +2780,8 @@
    "forwardDescriptionClientLocal": "로컬 {{sourcePort}} → 원격 {{endpointPort}}.",
    "forwardDescriptionClientRemote": "원격 {{sourcePort}} → 로컬 {{endpointPort}}.",
    "forwardDescriptionClientDynamic": "로컬 포트 {{sourcePort}}에서 SOCKS.",
-    "summaryClientLocal": "{{localHost}}:{{localPort}} → {{endpoint}}:{{remotePort}}",
-    "summaryClientRemote": "{{endpoint}}:{{remotePort}} → {{localHost}}:{{localPort}}",
+    "summaryClientLocal": "{{localHost}}:{{localPort}} → {{remoteHost}}:{{remotePort}} (경유: {{endpoint}})",
+    "summaryClientRemote": "{{remoteHost}}:{{remotePort}} on {{endpoint}} → {{localHost}}:{{localPort}}",
    "summaryClientDynamic": "{{localHost}}:{{localPort}} → SOCKS ({{endpoint}} 경유)",
    "autoNameClientLocal": "로컬 {{localPort}} → {{endpoint}} {{remotePort}}",
    "autoNameClientRemote": "{{endpoint}} {{remotePort}} → 로컬 {{localPort}}",
@@ -2511,6 +2831,19 @@
    "selectFilesystem": "파일 시스템을 선택하세요",
    "temperature": "온도",
    "highestTemperature": "최고 온도",
+    "primaryTemperatureSensor": "1차 센서",
+    "gpu": {
+      "title": "GPU",
+      "noDevice": "NVIDIA GPU가 감지되지 않았습니다. NVIDIA 드라이버를 설치하세요(드라이버에는 nvidia-smi가 포함되어 있습니다). 그러면 GPU 메트릭을 확인할 수 있습니다.",
+      "driver": "드라이버 {{version}}",
+      "utilization": "이용",
+      "memory": "VRAM",
+      "temperature": "임시",
+      "power": "힘",
+      "fan": "팬",
+      "processes": "GPU 프로세스",
+      "noProcesses": "GPU를 사용하는 프로세스가 없습니다."
+    },
    "failedToFetchHostConfig": "호스트 구성 가져오기 실패",
    "serverOffline": "서버 오프라인",
    "cannotFetchMetrics": "오프라인 서버에서 메트릭 가져오기 불가",
@@ -2799,6 +3132,7 @@
  },
  "errors": {
    "databaseConnection": "데이터베이스에 연결할 수 없습니다",
+    "embeddedServerFailed": "Termix의 로컬 서버를 시작할 수 없습니다.",
    "unknownError": "알 수 없는 오류",
    "loginFailed": "로그인 실패",
    "failedPasswordReset": "비밀번호 재설정 시작 실패",
@@ -2820,6 +3154,8 @@
    "resetCodeRateLimited": "속도 제한: 인증 시도가 너무 많습니다. 나중에 다시 시도하세요.",
    "resetCodeRateLimitedWithTime": "속도 제한: 너무 많은 인증 시도가 있었습니다. 다시 시도하기 전에 {{time}}초 동안 기다려 주세요.",
    "authTokenSaveFailed": "인증 토큰 저장에 실패했습니다.",
+    "authTokenMissing": "서버에서 새 인증 토큰을 반환하지 않았습니다. 다시 로그인해 주세요.",
+    "authTokenRejected": "원격 서버에서 새 인증 토큰을 거부했습니다.",
    "keyringUnavailable": "로그인은 되었지만 세션을 저장할 수 없습니다. 이 시스템에는 세션을 암호화하는 데 사용할 수 있는 키링이 없습니다. gnome-keyring 또는 KWallet과 같은 비밀 서비스(Secret Service)를 시작하고 다시 로그인하세요.",
    "failedToLoadServer": "서버를 불러오지 못했습니다.",
    "remoteServerRequired": "원격 서버가 필요합니다. 이 연결 유형을 사용하려면 설정에서 원격 서버를 연결하세요."
@@ -2828,6 +3164,9 @@
    "registrationDisabled": "현재 관리자가 신규 계정 등록을 비활성화했습니다. 로그인하거나 관리자에게 문의하세요.",
    "userNotAllowed": "계정에 등록 권한이 없습니다. 관리자에게 문의하세요.",
    "databaseConnectionFailed": "데이터베이스 서버 연결에 실패했습니다.",
+    "embeddedServerPortInUse": "포트 {{port}} 이 이미 다른 프로그램에서 사용 중입니다. 일반적으로 Termix Docker 컨테이너 또는 이전 세션에서 남은 Termix 프로세스입니다. 해당 프로세스를 종료한 다음 Termix를 다시 시작하십시오.",
+    "embeddedServerPortInUseUnknownPort": "Termix에 필요한 포트 중 하나가 이미 다른 프로그램에서 사용 중입니다. 해당 포트를 사용 중인 프로그램을 종료한 다음 Termix를 다시 시작하십시오.",
+    "embeddedServerCrashed": "로컬 서버가 예기치 않게 중지되었습니다. Termix를 다시 시작하고, 문제가 계속 발생하면 데스크톱 로그를 확인하십시오.",
    "resetCodeSent": "재설정 코드가 Docker 로그로 전송되었습니다.",
    "codeVerified": "코드가 성공적으로 확인되었습니다.",
    "passwordResetSuccess": "비밀번호가 성공적으로 재설정되었습니다.",
@@ -2861,6 +3200,8 @@
    "pastePrivateKey": "여기에 개인 키를 붙여넣으세요...",
    "localListenerHost": "127.0.0.1 (로컬에서 수신 대기)",
    "localTargetHost": "127.0.0.1 (이 컴퓨터의 대상)",
+    "remoteTargetHost": "127.0.0.1 (엔드포인트에서 대상 주소)",
+    "remoteBindHost": "127.0.0.1 (엔드포인트에서 수신 대기)",
    "socksListenerHost": "127.0.0.1 (SOCKS 리스너)",
    "enterPassword": "비밀번호를 입력하세요",
    "defaultPort": "22",
@@ -3208,6 +3549,18 @@
    "imageStorageSelectedModeUnavailable": "없는",
    "imageStorageTestLocalVisible": "로컬 디렉터리는 연결된 호스트에서 볼 수 있습니다.",
    "imageStorageTestLocalNotVisible": "로컬 디렉터리는 연결된 호스트에서 볼 수 없습니다.",
+    "sectionBranding": "화이트 라벨",
+    "brandingAppName": "애플리케이션 이름",
+    "brandingAppNameDesc": "로그인 화면과 브라우저 탭에 표시됩니다. \"Termix\"를 사용하려면 비워 두십시오.",
+    "brandingTagline": "슬로건",
+    "brandingTaglineDesc": "로그인 화면에서 애플리케이션 이름 아래에 표시됩니다. 기본 슬로건을 사용하려면 비워 두십시오.",
+    "brandingLogo": "심벌 마크",
+    "brandingLogoDesc": "PNG, JPEG 또는 WEBP 형식, 최대 750KB. 로그인 화면과 브라우저 탭의 기본 아이콘을 대체합니다.",
+    "brandingLogoUpload": "로고 업로드",
+    "brandingLogoReset": "기본 설정으로 재설정",
+    "brandingLogoInvalid": "잘못된 이미지입니다. 750KB 이하의 PNG, JPEG 또는 WEBP 파일을 사용하세요.",
+    "brandingSaved": "브랜딩 설정이 저장되었습니다.",
+    "brandingSaveFailed": "브랜딩 설정을 저장하는 데 실패했습니다.",
    "sslDescription": "Let's Encrypt에서 신뢰할 수 있는 SSL 인증서를 자동으로 발급 및 갱신합니다. 공개 도메인과 포트 80 또는 DNS 액세스가 필요합니다.",
    "sslDocsLink": "SSL 문서 보기",
    "sslDomain": "도메인",
@@ -3284,6 +3637,13 @@
    "analyticsEnabledLockedDesc": "이 설정은 ENABLE_TELEMETRY 환경 변수에 의해 잠겨 있으므로 여기에서 변경할 수 없습니다.",
    "updateAnalyticsFailed": "분석 설정 업데이트에 실패했습니다.",
    "sessionSharingGloballyEnabled": "세션 공유 허용",
+    "auditForwardingTitle": "SIEM으로 전달",
+    "auditForwardingDesc": "모든 감사 항목의 사본을 NDJSON 형식으로 외부 수집기에 전송합니다. 로컬 로그가 원본 데이터의 원천으로 유지됩니다.",
+    "auditForwardingEnvNotice": "환경 변수를 통해 포워딩을 설정할 수도 있으며, 여기에 저장된 URL이 우선 적용됩니다.",
+    "auditForwardingToken": "베어러 토큰(선택 사항)",
+    "auditForwardingTokenStored": "베어러 토큰(저장됨)",
+    "auditForwardingSaved": "감사 전달 설정이 저장되었습니다.",
+    "auditForwardingSaveError": "감사 전달 설정을 저장하는 데 실패했습니다.",
    "sessionSharingGloballyEnabledDesc": "라이브 터미널, RDP, VNC 및 Telnet 세션을 인스턴스 전체에서 공유할 수 있도록 허용합니다. 이 기능을 비활성화하면 호스트별 공유 설정이 모두 무시됩니다.",
    "updateSessionSharingFailed": "세션 공유 설정 업데이트에 실패했습니다.",
    "sessionTimeout": "세션 타임아웃",
@@ -3529,6 +3889,10 @@
    "snippetDeletedSuccess": "스니펫이 삭제되었습니다",
    "snippetDeleteFailed": "스니펫 삭제에 실패했습니다",
    "noSessionsForUser": "활성 세션이 없습니다",
+    "deleteSuccessorLabel": "호스트와 자격 증명을 전달하세요",
+    "deleteSuccessorMe": "나 (삭제 관리자)",
+    "deleteSuccessorNone": "아무도 — 삭제하세요",
+    "deleteSuccessorDesc": "이 사용자가 공유한 모든 항목은 새 소유자에게도 계속 작동합니다. '아무도 선택하지 않음'을 선택하면 호스트, 자격 증명 및 공유 항목이 모두 삭제됩니다.",
    "deleteUserDangerDesc": "{{username}}님과 모든 데이터(호스트, 자격 증명, 스니펫, 기록)를 영구적으로 삭제합니다. 이 작업은 취소할 수 없습니다.",
    "deleteUserConfirm": "{{username}}님과 모든 데이터를 영구적으로 삭제하시겠습니까?",
    "deleteUserAdminBlocked": "이 사용자를 삭제하기 전에 관리자 권한을 제거하세요.",
@@ -3559,6 +3923,14 @@
    "hostDefaultsStatusCheckEnabled": "상태 확인 활성화",
    "hostDefaultsStatusCheckEnabledDesc": "기본적으로 새 호스트의 온라인/오프라인 상태 확인",
    "hostDefaultsTerminal": "터미널",
+    "hostDefaultsAutoTmux": "자동 Tmux",
+    "hostDefaultsAutoTmuxDesc": "새 호스트의 터미널을 tmux 내에서 실행하여 연결이 끊어져도 세션이 유지되도록 합니다(호스트에 tmux가 설치되어 있어야 함).",
+    "terminalSessionTimeout": "터미널 세션 지속성",
+    "terminalSessionTimeoutDesc": "연결이 끊긴 터미널이 서버에서 종료되기 전까지 유지되는 시간입니다. 최소 1분, 최대 1440분. 이 시간보다 오래 세션을 유지해야 하는 경우 호스트에서 자동 Tmux를 활성화하십시오.",
+    "terminalSessionTimeoutRange": "1분에서 1440분 사이의 값을 입력하세요.",
+    "terminalSessionTimeoutSaved": "터미널 세션이 저장되었습니다.",
+    "terminalSessionTimeoutSaveFailed": "터미널 세션 지속성 저장에 실패했습니다.",
+    "minutes": "분",
    "hostDefaultsSessionLogging": "세션 로깅",
    "hostDefaultsSessionLoggingDesc": "기본적으로 새 호스트에서 터미널 세션 기록",
    "hostDefaultsCommandHistory": "명령어 히스토리",
@@ -3578,6 +3950,21 @@
    "aiGloballyEnabledDesc": "사용자가 AI 비서를 켜고 끌 수 있도록 하세요. AI 비서가 꺼져 있으면 모든 사용자에게 비서 기능이 숨겨지고 차단됩니다.",
    "aiPrivateEndpoints": "개인 AI 호스트 허용",
    "aiPrivateEndpointsDesc": "사용자가 공급자에게 연결할 수 있는 개인 네트워크의 호스트(예: 자체 호스팅 Ollama)를 나열하세요. 호스트는 쉼표로 구분하세요.",
+    "stepCa": "스텝 CA",
+    "stepCaDesc": "SmallStep CA에서 단기 SSH 인증서를 발급합니다. CA URL, 루트 지문(step ca bootstrap 명령으로 확인 가능) 및 OIDC 프로비저너 이름을 입력하고 호스트 인증 유형으로 \"Step CA\"를 선택합니다. 세 항목을 모두 비워두면 해당 기능을 비활성화할 수 있습니다.",
+    "stepCaFingerprint": "루트 지문(SHA-256)",
+    "stepCaProvisioner": "OIDC 프로비저너 이름",
+    "stepCaSaved": "단계 CA 설정이 저장되었습니다",
+    "stepCaSaveFailed": "Step CA 설정을 저장하는 데 실패했습니다.",
+    "secretSourcePrivateEndpoints": "허용된 개인 비밀 소스 호스트",
+    "secretSourcePrivateEndpointsDesc": "비밀 소스(1Password Connect)가 연결할 수 있는 비공개 호스트를 나열하세요. 쉼표로 구분하세요.",
+    "updateSecretSourceEndpointsFailed": "비밀 소스 엔드포인트 허용 목록 업데이트에 실패했습니다.",
+    "stepCaPrivateEndpoints": "허용된 개인 Step CA 호스트",
+    "stepCaPrivateEndpointsDesc": "Step CA 인증서 흐름이 접촉할 수 있는 개인 호스트는 CA 자체와 (내부 호스트인 경우) ID 공급자입니다. 이들을 쉼표로 구분하세요.",
+    "updateStepCaEndpointsFailed": "Step CA 엔드포인트 허용 목록 업데이트에 실패했습니다.",
+    "notificationPrivateEndpoints": "허용된 개인 알림 호스트",
+    "notificationPrivateEndpointsDesc": "알림 채널이 연락할 수 있는 정확한 비공개 호스트를 입력하세요. 쉼표로 구분하세요.",
+    "updateNotificationEndpointsFailed": "알림 엔드포인트 허용 목록 업데이트에 실패했습니다.",
    "updateAiEnabledFailed": "AI 설정을 업데이트할 수 없습니다.",
    "updateAiEndpointsFailed": "허용된 호스트를 업데이트할 수 없습니다."
  },
@@ -3597,6 +3984,11 @@
        "privateKeyPlaceholder": "개인 키 붙여넣기...",
        "credentialLabel": "인증 정보",
        "credentialPlaceholder": "저장된 인증 정보 선택...",
+        "protocolLabel": "규약",
+        "domainLabel": "도메인",
+        "domainPlaceholder": "선택 과목",
+        "connectToRdp": "RDP를 통해 연결",
+        "connectToVnc": "VNC를 통해 연결",
        "connectToTerminal": "터미널에 연결",
        "connectToFiles": "파일에 연결"
      },
@@ -3623,7 +4015,8 @@
        "stopRecording": "기록 중지",
        "startRecording": "기록 시작",
        "settingsTitle": "설정",
-        "enableRightClickCopyPaste": "오른쪽 클릭 복사/붙여넣기 활성화"
+        "enableRightClickCopyPaste": "오른쪽 클릭 복사/붙여넣기 활성화",
+        "copyOnSelect": "선택한 텍스트를 자동으로 복사합니다"
      },
      "splitScreen": {
        "layoutTitle": "레이아웃",
@@ -4054,6 +4447,9 @@
        "actionSendControlCode": "Ctrl+문자 신호를 보내세요",
        "actionSendText": "문자 보내기",
        "actionRunSnippet": "기존 코드 조각을 실행하세요",
+        "actionNextTab": "다음 탭으로 이동",
+        "actionPreviousTab": "이전 탭으로 이동",
+        "actionOpenCommandPalette": "빠른 검색 열기",
        "controlCodeLabel": "편지",
        "textLabel": "보낼 텍스트",
        "appendEnterLabel": "전송 후 Enter 키를 누르세요.",
@@ -4150,6 +4546,8 @@
        "languageLabel": "언어",
        "themeLabel": "테마",
        "fontSizeLabel": "글자 크기",
+        "interfaceFontLabel": "인터페이스 글꼴",
+        "interfaceFontDescription": "애플리케이션 인터페이스의 글꼴을 변경합니다. 터미널 프로필은 자체 글꼴 설정을 유지합니다.",
        "accentColorLabel": "강조 색상",
        "settingsTerminal": "터미널",
        "commandAutocomplete": "명령어 자동 완성",
@@ -4169,6 +4567,8 @@
        "reopenTabsOnLoginDesc": "로그인하거나 페이지를 새로 고칠 때 다른 기기에서 열었던 탭을 포함하여 열려 있던 모든 탭을 복원합니다.",
        "confirmTabClose": "탭 닫기 확인",
        "confirmTabCloseDesc": "터미널 탭을 닫기 전에 확인",
+        "transferConcurrency": "동시 파일 전송",
+        "transferConcurrencyDesc": "로컬/원격 파일 관리자가 동시에 업로드 또는 다운로드할 수 있는 파일 수를 지정합니다. 서버에서 SFTP 채널 수를 제한하는 경우 이 값을 낮추십시오.",
        "settingsAppRail": "앱 레일",
        "sidebarSettingsMoved": "호스트 사이드바 표시 설정이 호스트 도구 모음에서 열리는 '사이드바 사용자 지정' 패널로 이동했습니다.",
        "showHostTags": "호스트 태그 표시",
@@ -4185,8 +4585,12 @@
        "exitFullscreenSettings": "전체 화면 설정 종료",
        "expandAppRailOnHover": "마우스 오버 시 앱 레일 확장",
        "expandAppRailOnHoverDesc": "포인터를 올리면 왼쪽 사이드바 앱 레일이 확장되도록 허용합니다.",
+        "showPinAppRailButton": "핀 앱 레일 버튼 표시",
+        "showPinAppRailButtonDesc": "앱 사이드바에 앱을 고정하여 열어둘 수 있는 버튼을 표시합니다. 기본적으로는 비활성화되어 있습니다.",
        "settingsNavigation": "탐색",
        "navigationTabsDesc": "앱 레일에 표시할 탭 선택",
+        "showSnippetCommands": "명령 표시",
+        "showSnippetCommandsDesc": "각 코드 조각의 명령어를 이름 아래에 표시합니다. 목록을 간략하게 표시하려면 이 옵션을 끄세요.",
        "foldersCollapsed": "폴더 접기",
        "foldersCollapsedDesc": "기본적으로 폴더 접기",
        "confirmExecution": "실행 확인",
@@ -4197,6 +4601,13 @@
        "totpAuthenticator": "TOTP 인증기",
        "totpEnabled": "2FA가 활성화되었습니다",
        "totpDisabled": "추가 로그인 보안을 설정하세요",
+        "totpAddAuthenticator": "기기 추가",
+        "totpAddTitle": "인증 장치 추가",
+        "totpAddDescription": "본인 인증을 완료하면 동일한 보안 TOTP 키를 사용하여 다른 인증자를 등록할 수 있습니다.",
+        "totpAddInputRequired": "TOTP 코드 또는 비밀번호를 입력하세요",
+        "totpAddFailed": "인증자 추가에 실패했습니다.",
+        "totpAddScanInstructions": "추가 인증 수단으로 이 QR 코드를 스캔하세요. 기존 인증 수단도 계속 사용할 수 있습니다.",
+        "totpAddSuccess": "추가 인증자가 등록되었습니다",
        "disable": "비활성화",
        "enable": "활성화",
        "setupTotp": "TOTP 설정",
@@ -4571,7 +4982,13 @@
    "modelRefresh": "목록 새로 고침",
    "modelPlaceholder": "모델을 선택하거나 입력하세요.",
    "attachHint": "호스트, 코드 조각 또는 자동화를 참조하려면 @를 입력하세요. 승인을 위해 변경 사항이 제안됩니다.",
-    "runCommandTitle": "명령어를 실행하세요"
+    "runCommandTitle": "명령어를 실행하세요",
+    "assistant": "AI 어시스턴트",
+    "terminalPanelEmpty": "이 호스트에 대해 담당자에게 문의하십시오. 상태가 변경되는 모든 사항은 먼저 사용자의 승인이 필요합니다.",
+    "terminalPanelPlaceholder": "이 호스트에 대해 문의해 보세요...",
+    "noProvidersConfigured": "아직 AI 제공업체가 구성되지 않았습니다. AI 도우미 탭에서 추가하세요.",
+    "runsInOpenTerminal": "열려 있는 터미널 세션에서 실행됩니다.",
+    "runInTerminal": "달리다"
  },
  "macros": {
    "title": "매크로",
@@ -4667,5 +5084,21 @@
    },
    "seconds": "초",
    "secondsShort": "{{count}}s"
+  },
+  "webEndpoint": {
+    "noHostSelected": "호스트가 선택되지 않았습니다.",
+    "notFound": "이 엔드포인트는 더 이상 존재하지 않습니다.",
+    "tunnelUnreachableFromBrowser": "이 엔드포인트는 브라우저에서 접근할 수 없는 Termix 실행 머신의 127.0.0.1 주소로 터널링합니다. 엔드포인트의 바인드 호스트를 해당 머신이 응답하는 주소(예: 0.0.0.0)로 설정하고 고정된 로컬 포트를 지정하십시오.",
+    "tunnelSharesSessionCookie": "이 터널을 열면 브라우저가 Termix가 제공되는 호스트 이름과 동일한 호스트 이름으로 접속하게 되므로 Termix 세션이 터널링된 서비스로 전송됩니다. 쿠키는 포트 번호를 무시하므로 둘을 구분할 수 없습니다. Termix 데스크톱 앱을 사용하거나 localhost에서 Termix를 실행하세요.",
+    "directSharesSessionCookie": "이 엔드포인트를 열면 브라우저가 Termix가 제공되는 동일한 사이트에서 해당 엔드포인트에 접속하기 때문에 Termix 세션이 해당 엔드포인트로 전송됩니다. 쿠키는 포트 번호를 무시하므로 다른 포트 번호를 사용한다고 해서 다른 ID를 의미하는 것은 아닙니다. Termix 데스크톱 앱을 사용하거나 다른 호스트 이름에서 이 웹 UI를 제공하십시오.",
+    "retry": "다시 해 보다",
+    "reload": "재장전",
+    "copyUrl": "URL 복사",
+    "urlCopied": "URL이 복사되었습니다",
+    "copyFailed": "URL 복사에 실패했습니다",
+    "openExternally": "외부에서 열기",
+    "isolationUnavailable": "이 브라우저는 웹 엔드포인트를 Termix 세션에서 분리할 수 없습니다. 자격 증명 없이 iframe을 지원하는 브라우저를 사용하십시오.",
+    "isolationNotice": "내장 페이지는 격리된 세션을 사용합니다. 저장 공간이나 팝업 로그인이 필요한 페이지의 경우 데스크톱 앱에서 격리된 창을 사용하십시오.",
+    "openIsolatedWindow": "격리된 창을 엽니다"
  }
 }