New Crowdin updates (#525 )

* New translations en.json (Romanian) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Afrikaans) * New translations en.json (Arabic) * New translations en.json (Catalan) * New translations en.json (Czech) * New translations en.json (Danish) * New translations en.json (German) * New translations en.json (Greek) * New translations en.json (Finnish) * New translations en.json (Hebrew) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Japanese) * New translations en.json (Korean) * New translations en.json (Dutch) * New translations en.json (Norwegian) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Serbian (Cyrillic)) * New translations en.json (Swedish) * New translations en.json (Turkish) * New translations en.json (Ukrainian) * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Traditional) * New translations en.json (Vietnamese) * New translations en.json (Portuguese, Brazilian) * New translations en.json (Bulgarian) * New translations en.json (Indonesian) * New translations en.json (Hindi) * New translations en.json (Bengali) * New translations en.json (Thai)
New Crowdin updates (#524 )
2026-07-15 04:43:36 +00:00 · 2026-01-24 20:05:32 -06:00 · 2026-01-24 20:02:20 -06:00 · 2026-01-24 19:49:42 -06:00 · 2026-01-24 03:03:34 -06:00 · 2026-01-02 03:21:45 -06:00
175 changed files with 88958 additions and 47604 deletions
@@ -29,3 +29,4 @@ _(Optional: add before/after screenshots, GIFs, or console output)_
 - [ ] Code follows project style guidelines
 - [ ] Supports mobile and desktop UI/app (if applicable)
 - [ ] I have read [Contributing.md](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)
+- [ ] This is not a translation request. See [docs](https://docs.termix.site/translations)
@@ -17,7 +17,7 @@ on:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
@@ -356,7 +356,7 @@ jobs:

  build-macos:
    runs-on: macos-latest
-    if: github.event.inputs.build_type == 'macos' || github.event.inputs.build_type == 'all'
+    if: (github.event.inputs.build_type == 'macos' || github.event.inputs.build_type == 'all') && github.event.inputs.artifact_destination != 'submit'
    needs: []
    permissions:
      contents: write
@@ -584,7 +584,7 @@ jobs:

  submit-to-chocolatey:
    runs-on: windows-latest
-    if: github.event.inputs.artifact_destination == 'submit'
+    if: github.event.inputs.artifact_destination == 'submit' && (github.event.inputs.build_type == 'all' || github.event.inputs.build_type == 'windows' || github.event.inputs.build_type == '')
    permissions:
      contents: read

@@ -688,8 +688,8 @@ jobs:
          retention-days: 30

  submit-to-flatpak:
-    runs-on: ubuntu-latest
-    if: github.event.inputs.artifact_destination == 'submit'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    if: github.event.inputs.artifact_destination == 'submit' && (github.event.inputs.build_type == 'all' || github.event.inputs.build_type == 'linux' || github.event.inputs.build_type == '')
    needs: []
    permissions:
      contents: read
@@ -776,7 +776,7 @@ jobs:

  submit-to-homebrew:
    runs-on: macos-latest
-    if: github.event.inputs.artifact_destination == 'submit'
+    if: github.event.inputs.artifact_destination == 'submit' && (github.event.inputs.build_type == 'all' || github.event.inputs.build_type == 'macos')
    needs: []
    permissions:
      contents: read
@@ -801,11 +801,20 @@ jobs:
          URL="https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$DMG_NAME"

          mkdir -p release_asset
-          PATH="release_asset/$DMG_NAME"
+          DOWNLOAD_PATH="release_asset/$DMG_NAME"
          echo "Downloading DMG from $URL"
-          curl -L -o "$PATH" "$URL"

-          CHECKSUM=$(shasum -a 256 "$PATH" | awk '{print $1}')
+          if command -v curl &> /dev/null; then
+            curl -L -o "$DOWNLOAD_PATH" "$URL"
+          elif command -v wget &> /dev/null; then
+            wget -O "$DOWNLOAD_PATH" "$URL"
+          else
+            echo "Neither curl nor wget is available, installing curl"
+            brew install curl
+            curl -L -o "$DOWNLOAD_PATH" "$URL"
+          fi
+
+          CHECKSUM=$(shasum -a 256 "$DOWNLOAD_PATH" | awk '{print $1}')

          echo "dmg_name=$DMG_NAME" >> $GITHUB_OUTPUT
          echo "checksum=$CHECKSUM" >> $GITHUB_OUTPUT
@@ -872,7 +881,7 @@ jobs:

  submit-to-testflight:
    runs-on: macos-latest
-    if: github.event.inputs.artifact_destination == 'submit'
+    if: github.event.inputs.artifact_destination == 'submit' && (github.event.inputs.build_type == 'all' || github.event.inputs.build_type == 'macos')
    needs: []
    permissions:
      contents: write
@@ -977,7 +986,7 @@ jobs:
      - name: Deploy to App Store Connect (TestFlight)
        if: steps.check_asc_creds.outputs.has_credentials == 'true'
        run: |
-          PKG_FILE=$(find artifact-mas -name "*.pkg" -type f | head -n 1)
+          PKG_FILE=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
          if [ -z "$PKG_FILE" ]; then
            echo "PKG file not found, exiting."
            exit 1
@@ -0,0 +1,32 @@
+name: Generate OpenAPI Specification
+
+on:
+  workflow_dispatch:
+
+jobs:
+  generate-openapi:
+    name: Generate OpenAPI JSON
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Generate OpenAPI specification
+        run: npm run generate:openapi
+
+      - name: Upload OpenAPI artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: openapi-spec
+          path: openapi.json
+          retention-days: 90
@@ -6,7 +6,7 @@ on:

 jobs:
  lint-and-build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404

    steps:
      - name: Checkout code
@@ -1,437 +0,0 @@
-name: Auto Translate
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  translate-zh:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t zh --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-zh
-          path: src/locales/zh.json
-        continue-on-error: true
-
-  translate-ru:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ru --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ru
-          path: src/locales/ru.json
-        continue-on-error: true
-
-  translate-pt:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t pt --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-pt
-          path: src/locales/pt.json
-        continue-on-error: true
-
-  translate-fr:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t fr --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-fr
-          path: src/locales/fr.json
-        continue-on-error: true
-
-  translate-es:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t es --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-es
-          path: src/locales/es.json
-        continue-on-error: true
-
-  translate-de:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t de --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-de
-          path: src/locales/de.json
-        continue-on-error: true
-
-  translate-hi:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t hi --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-hi
-          path: src/locales/hi.json
-        continue-on-error: true
-
-  translate-bn:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t bn --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-bn
-          path: src/locales/bn.json
-        continue-on-error: true
-
-  translate-ja:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ja --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ja
-          path: src/locales/ja.json
-        continue-on-error: true
-
-  translate-vi:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t vi --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-vi
-          path: src/locales/vi.json
-        continue-on-error: true
-
-  translate-tr:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t tr --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-tr
-          path: src/locales/tr.json
-        continue-on-error: true
-
-  translate-ko:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ko --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ko
-          path: src/locales/ko.json
-        continue-on-error: true
-
-  translate-it:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t it --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-it
-          path: src/locales/it.json
-        continue-on-error: true
-
-  translate-he:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t he --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-he
-          path: src/locales/he.json
-        continue-on-error: true
-
-  translate-ar:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ar --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ar
-          path: src/locales/ar.json
-        continue-on-error: true
-
-  translate-pl:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t pl --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-pl
-          path: src/locales/pl.json
-        continue-on-error: true
-
-  translate-nl:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t nl --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-nl
-          path: src/locales/nl.json
-        continue-on-error: true
-
-  translate-sv:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t sv --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-sv
-          path: src/locales/sv.json
-        continue-on-error: true
-
-  translate-id:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t id --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-id
-          path: src/locales/id.json
-        continue-on-error: true
-
-  translate-th:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t th --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-th
-          path: src/locales/th.json
-        continue-on-error: true
-
-  translate-uk:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t uk --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-uk
-          path: src/locales/uk.json
-        continue-on-error: true
-
-  translate-cs:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t cs --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-cs
-          path: src/locales/cs.json
-        continue-on-error: true
-
-  translate-ro:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ro --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ro
-          path: src/locales/ro.json
-        continue-on-error: true
-
-  translate-el:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t el --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-el
-          path: src/locales/el.json
-        continue-on-error: true
-
-  translate-nb:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t nb --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-nb
-          path: src/locales/nb.json
-        continue-on-error: true
-
-  create-pr:
-    needs:
-      [
-        translate-zh,
-        translate-ru,
-        translate-pt,
-        translate-fr,
-        translate-es,
-        translate-de,
-        translate-hi,
-        translate-bn,
-        translate-ja,
-        translate-vi,
-        translate-tr,
-        translate-ko,
-        translate-it,
-        translate-he,
-        translate-ar,
-        translate-pl,
-        translate-nl,
-        translate-sv,
-        translate-id,
-        translate-th,
-        translate-uk,
-        translate-cs,
-        translate-ro,
-        translate-el,
-        translate-nb,
-      ]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: translations-temp
-
-      - name: Move translations to src/locales
-        run: |
-          cp translations-temp/translations-zh/zh.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ru/ru.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-pt/pt.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-fr/fr.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-es/es.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-de/de.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-hi/hi.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-bn/bn.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ja/ja.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-vi/vi.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-tr/tr.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ko/ko.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-it/it.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-he/he.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ar/ar.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-pl/pl.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-nl/nl.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-sv/sv.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-id/id.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-th/th.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-uk/uk.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-cs/cs.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ro/ro.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-el/el.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-nb/nb.json src/locales/ 2>/dev/null || true
-          rm -rf translations-temp
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GHCR_TOKEN }}
-          commit-message: "chore: auto-translate to multiple languages"
-          branch: translations-update
-          delete-branch: true
-          title: "chore: Update translations for all languages"
@@ -1,6 +1,6 @@
 cask "termix" do
-  version "1.9.0"
-  sha256 "8fedd242b3cae1ebfd0c391a36f1c246a26ecac258b02478ee8dea2f33cd6d96"
+  version "1.10.0"
+  sha256 "327c5026006c949f992447835aa6754113f731065b410bedbfa5da5af7cb2386"

  url "https://github.com/Termix-SSH/Termix/releases/download/release-#{version}-tag/termix_macos_universal_dmg.dmg"
  name "Termix"
@@ -16,17 +16,6 @@
  <small style="color: #666;">2025年9月1日获得</small>
 </p>

-#### 核心技术
-
-[![React Badge](https://img.shields.io/badge/-React-61DBFB?style=flat-square&labelColor=black&logo=react&logoColor=61DBFB)](#)
-[![TypeScript Badge](https://img.shields.io/badge/-TypeScript-3178C6?style=flat-square&labelColor=black&logo=typescript&logoColor=3178C6)](#)
-[![Node.js Badge](https://img.shields.io/badge/-Node.js-3C873A?style=flat-square&labelColor=black&logo=node.js&logoColor=3C873A)](#)
-[![Vite Badge](https://img.shields.io/badge/-Vite-646CFF?style=flat-square&labelColor=black&logo=vite&logoColor=646CFF)](#)
-[![Tailwind CSS Badge](https://img.shields.io/badge/-TailwindCSS-38B2AC?style=flat-square&labelColor=black&logo=tailwindcss&logoColor=38B2AC)](#)
-[![Docker Badge](https://img.shields.io/badge/-Docker-2496ED?style=flat-square&labelColor=black&logo=docker&logoColor=2496ED)](#)
-[![SQLite Badge](https://img.shields.io/badge/-SQLite-003B57?style=flat-square&labelColor=black&logo=sqlite&logoColor=003B57)](#)
-[![Radix UI Badge](https://img.shields.io/badge/-Radix%20UI-161618?style=flat-square&labelColor=black&logo=radixui&logoColor=161618)](#)
-
 <br />
 <p align="center">
  <a href="https://github.com/Termix-SSH/Termix">
@@ -61,12 +50,14 @@ Termix 是一个开源、永久免费、自托管的一体化服务器管理平
 - **数据导出/导入** - 导出和导入 SSH 主机、凭据和文件管理器数据
 - **自动 SSL 设置** - 内置 SSL 证书生成和管理，支持 HTTPS 重定向
 - **现代用户界面** - 使用 React、Tailwind CSS 和 Shadcn 构建的简洁的桌面/移动设备友好界面。可选择基于深色或浅色模式的用户界面。
- **语言** - 内置支持约 30 种语言（通过 Google 翻译批量翻译，结果可能有所不同）
- **平台支持** - 可作为 Web 应用程序、桌面应用程序（Windows、Linux 和 macOS）以及适用于 iOS 和 Android 的专用移动/平板电脑应用程序。
+- **语言** - 内置支持约 30 种语言（由 [Crowdin](https://docs.termix.site/translations) 管理）
+- **平台支持** - 可作为 Web 应用程序、桌面应用程序（Windows、Linux 和 macOS）、PWA 以及适用于 iOS 和 Android 的专用移动/平板电脑应用程序。
 - **SSH 工具** - 创建可重用的命令片段，单击即可执行。在多个打开的终端上同时运行一个命令。
 - **命令历史** - 自动完成并查看以前运行的 SSH 命令
+- **快速连接** - 无需保存连接数据即可连接到服务器
 - **命令面板** - 双击左 Shift 键可快速使用键盘访问 SSH 连接
- **SSH 功能丰富** - 支持跳板机、warpgate、基于 TOTP 的连接、SOCKS5、密码自动填充等。
+- **SSH 功能丰富** - 支持跳板机、Warpgate、基于 TOTP 的连接、SOCKS5、密码自动填充等。
+- **网络图** - 自定义您的仪表板，根据您的 SSH 连接可视化您的家庭实验室，支持状态显示

 # 计划功能

@@ -76,20 +67,21 @@ Termix 是一个开源、永久免费、自托管的一体化服务器管理平

 支持的设备：

- 网站（任何平台上的任何现代浏览器，如 Chrome、Safari 和 Firefox）
+- 网站（任何平台上的任何现代浏览器，如 Chrome、Safari 和 Firefox）（包括 PWA 支持）
 - Windows（x64/ia32）
  - 便携版
  - MSI 安装程序
-  - Chocolatey 软件包管理器（即将推出）
+  - Chocolatey 软件包管理器
 - Linux（x64/ia32）
  - 便携版
+  - AUR
  - AppImage
  - Deb
-  - Flatpak（即将推出）
+  - Flatpak
 - macOS（x64/ia32 on v12.0+）
-  - Apple App Store（即将推出）
+  - Apple App Store
  - DMG
-  - Homebrew（即将推出）
+  - Homebrew
 - iOS/iPadOS（v15.1+）
  - Apple App Store
  - ISO
@@ -117,6 +109,22 @@ volumes:
    driver: local
 ```

+# 赞助商
+
+<p align="left">
+  <a href="https://www.digitalocean.com/">
+    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="50" alt="DigitalOcean">
+  </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://crowdin.com/">
+    <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="50" alt="Crowdin">
+  </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://www.blacksmith.sh/">
+    <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="50" alt="Crowdin">
+  </a>
+</p>
+
 # 支持

 如果你需要 Termix 的帮助或想要请求功能，请访问 [Issues](https://github.com/Termix-SSH/Support/issues) 页面，登录并点击 `New Issue`。
@@ -125,6 +133,8 @@ volumes:

 # 展示

+[![](https://utfs.io/f/nGnSqDveMsqxqiKJF5EnObSopHatulx93N0E1KVsP7hvjMfF)](https://www.youtube.com/watch?v=j1_I1mkhUkE)
+
 <p align="center">
  <img src="./repo-images/Image 1.png" width="400" alt="Termix Demo 1"/>
  <img src="./repo-images/Image 2.png" width="400" alt="Termix Demo 2"/>
@@ -147,14 +157,14 @@ volumes:

 <p align="center">
  <img src="./repo-images/Image 9.png" width="400" alt="Termix Demo 9"/>
-  <img src="./repo-images/Image 10.png" width="400" alt="Termix Demo 110"/>
+  <img src="./repo-images/Image 10.png" width="400" alt="Termix Demo 10"/>
 </p>

 <p align="center">
-  <video src="https://github.com/user-attachments/assets/88936e0d-2399-4122-8eee-c255c25da48c" width="800" controls>
-    你的浏览器不支持 video 标签。
-  </video>
+  <img src="./repo-images/Image 11.png" width="400" alt="Termix Demo 11"/>
+  <img src="./repo-images/Image 12.png" width="400" alt="Termix Demo 12"/>
 </p>
+
 某些视频和图像可能已过时或可能无法完美展示功能。

 # 许可证
@@ -16,17 +16,6 @@
  <small style="color: #666;">Achieved on September 1st, 2025</small>
 </p>

-#### Top Technologies
-
-[![React Badge](https://img.shields.io/badge/-React-61DBFB?style=flat-square&labelColor=black&logo=react&logoColor=61DBFB)](#)
-[![TypeScript Badge](https://img.shields.io/badge/-TypeScript-3178C6?style=flat-square&labelColor=black&logo=typescript&logoColor=3178C6)](#)
-[![Node.js Badge](https://img.shields.io/badge/-Node.js-3C873A?style=flat-square&labelColor=black&logo=node.js&logoColor=3C873A)](#)
-[![Vite Badge](https://img.shields.io/badge/-Vite-646CFF?style=flat-square&labelColor=black&logo=vite&logoColor=646CFF)](#)
-[![Tailwind CSS Badge](https://img.shields.io/badge/-TailwindCSS-38B2AC?style=flat-square&labelColor=black&logo=tailwindcss&logoColor=38B2AC)](#)
-[![Docker Badge](https://img.shields.io/badge/-Docker-2496ED?style=flat-square&labelColor=black&logo=docker&logoColor=2496ED)](#)
-[![SQLite Badge](https://img.shields.io/badge/-SQLite-003B57?style=flat-square&labelColor=black&logo=sqlite&logoColor=003B57)](#)
-[![Radix UI Badge](https://img.shields.io/badge/-Radix%20UI-161618?style=flat-square&labelColor=black&logo=radixui&logoColor=161618)](#)
-
 <br />
 <p align="center">
  <a href="https://github.com/Termix-SSH/Termix">
@@ -51,24 +40,26 @@ free and self-hosted alternative to Termius available for all platforms.
 # Features

 - **SSH Terminal Access** - Full-featured terminal with split-screen support (up to 4 panels) with a browser-like tab system. Includes support for customizing the terminal including common terminal themes, fonts, and other components
- **SSH Tunnel Management** - Create and manage SSH tunnels with automatic reconnection and health monitoring
- **Remote File Manager** - Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly
+- **SSH Tunnel Management** - Create and manage SSH tunnels with automatic reconnection and health monitoring and support for -l or -r connections
+- **Remote File Manager** - Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly with sudo support.
 - **Docker Management** - Start, stop, pause, remove containers. View container stats. Control container using docker exec terminal. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.
 - **SSH Host Manager** - Save, organize, and manage your SSH connections with tags and folders, and easily save reusable login info while being able to automate the deployment of SSH keys
- **Server Stats** - View CPU, memory, and disk usage along with network, uptime, and system information on any SSH server
+- **Server Stats** - View CPU, memory, and disk usage along with network, uptime, system information, firewall, port monitor, on most Linux based servers
 - **Dashboard** - View server information at a glance on your dashboard
 - **RBAC** - Create roles and share hosts across users/roles
 - **User Authentication** - Secure user management with admin controls and OIDC and 2FA (TOTP) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together.
 - **Database Encryption** - Backend stored as encrypted SQLite database files. View [docs](https://docs.termix.site/security) for more.
 - **Data Export/Import** - Export and import SSH hosts, credentials, and file manager data
 - **Automatic SSL Setup** - Built-in SSL certificate generation and management with HTTPS redirects
- **Modern UI** - Clean desktop/mobile-friendly interface built with React, Tailwind CSS, and Shadcn. Choose between dark or light mode based UI.
- **Languages** - Built-in support ~30 languages (bulk translated via Google Translate, results may vary ofc)
- **Platform Support** - Available as a web app, desktop application (Windows, Linux, and macOS), and dedicated mobile/tablet app for iOS and Android.
+- **Modern UI** - Clean desktop/mobile-friendly interface built with React, Tailwind CSS, and Shadcn. Choose between dark or light mode based UI. Use URL routes to open any connection in full-screen.
+- **Languages** - Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/translations))
+- **Platform Support** - Available as a web app, desktop application (Windows, Linux, and macOS), PWA, and dedicated mobile/tablet app for iOS and Android.
 - **SSH Tools** - Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.
 - **Command History** - Auto-complete and view previously ran SSH commands
+- **Quick Connect** - Connect to a server without having to save the connection data
 - **Command Palette** - Double tap left shift to quickly access SSH connections with your keyboard
- **SSH Feature Rich** - Supports jump hosts, warpgate, TOTP based connections, SOCKS5, password autofill, etc.
+- **SSH Feature Rich** - Supports jump hosts, Warpgate, TOTP based connections, SOCKS5, password autofill, etc.
+- **Network Graph** - Customize your Dashboard to visualize your homelab based off your SSH connections with status support

 # Planned Features

@@ -78,13 +69,14 @@ See [Projects](https://github.com/orgs/Termix-SSH/projects/2) for all planned fe

 Supported Devices:

- Website (any modern browser on any platform like Chrome, Safari, and Firefox)
+- Website (any modern browser on any platform like Chrome, Safari, and Firefox) (includes PWA support)
 - Windows (x64/ia32)
  - Portable
  - MSI Installer
  - Chocolatey Package Manager
 - Linux (x64/ia32)
  - Portable
+  - AUR
  - AppImage
  - Deb
  - Flatpak
@@ -120,6 +112,22 @@ volumes:
    driver: local
 ```

+# Sponsors
+
+<p align="left">
+  <a href="https://www.digitalocean.com/">
+    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="50" alt="DigitalOcean">
+  </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://crowdin.com/">
+    <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="50" alt="Crowdin">
+  </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://www.blacksmith.sh/">
+    <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="50" alt="Crowdin">
+  </a>
+</p>
+
 # Support

 If you need help or want to request a feature with Termix, visit the [Issues](https://github.com/Termix-SSH/Support/issues) page, log in, and press `New Issue`.
@@ -128,6 +136,8 @@ channel, however, response times may be longer.

 # Screenshots

+[![](https://utfs.io/f/nGnSqDveMsqxqiKJF5EnObSopHatulx93N0E1KVsP7hvjMfF)](https://www.youtube.com/watch?v=j1_I1mkhUkE)
+
 <p align="center">
  <img src="./repo-images/Image 1.png" width="400" alt="Termix Demo 1"/>
  <img src="./repo-images/Image 2.png" width="400" alt="Termix Demo 2"/>
@@ -150,14 +160,14 @@ channel, however, response times may be longer.

 <p align="center">
  <img src="./repo-images/Image 9.png" width="400" alt="Termix Demo 9"/>
-  <img src="./repo-images/Image 10.png" width="400" alt="Termix Demo 110"/>
+  <img src="./repo-images/Image 10.png" width="400" alt="Termix Demo 10"/>
 </p>

 <p align="center">
-  <video src="https://github.com/user-attachments/assets/88936e0d-2399-4122-8eee-c255c25da48c" width="800" controls>
-    Your browser does not support the video tag.
-  </video>
+  <img src="./repo-images/Image 11.png" width="400" alt="Termix Demo 11"/>
+  <img src="./repo-images/Image 12.png" width="400" alt="Termix Demo 12"/>
 </p>
+
 Some videos and images may be out of date or may not perfectly showcase features.

 # License
@@ -0,0 +1,3 @@
+files:
+  - source: /src/locales/en.json
+    translation: /src/locales/translated/%two_letters_code%.json
@@ -19,7 +19,7 @@ COPY . .
 RUN find public/fonts -name "*.ttf" ! -name "*Regular.ttf" ! -name "*Bold.ttf" ! -name "*Italic.ttf" -delete

 RUN npm cache clean --force && \
-    npm run build
+    NODE_OPTIONS="--max-old-space-size=3072" npm run build

 # Stage 3: Build backend
 FROM deps AS backend-builder
@@ -74,6 +74,9 @@ VOLUME ["/app/data"]

 EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006

+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
+    CMD node -e "require('http').get('http://localhost:30001/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"
+
 COPY docker/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh

@@ -1,3 +1,5 @@
+worker_processes 1;
+master_process off;
 pid /app/nginx/nginx.pid;
 error_log /app/nginx/logs/error.log warn;

@@ -199,6 +201,18 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location /ssh/quick-connect {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection 'upgrade';
+            proxy_set_header Host $host;
+            proxy_cache_bypass $http_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /ssh/ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -267,6 +281,15 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location /ssh/file_manager/sudo-password {
+            proxy_pass http://127.0.0.1:30004;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /ssh/file_manager/ssh/ {
            client_max_body_size 5G;
            client_body_timeout 300s;
@@ -286,6 +309,15 @@ http {
            proxy_buffering off;
        }

+        location ~ ^/network-topology(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /health {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -335,6 +367,15 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location ~ ^/dashboard/preferences(/.*)?$ {
+            proxy_pass http://127.0.0.1:30006;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location ^~ /docker/console/ {
            proxy_pass http://127.0.0.1:30008/;
            proxy_http_version 1.1;
@@ -1,3 +1,5 @@
+worker_processes 1;
+master_process off;
 pid /app/nginx/nginx.pid;
 error_log /app/nginx/logs/error.log warn;

@@ -188,6 +190,18 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location /ssh/quick-connect {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection 'upgrade';
+            proxy_set_header Host $host;
+            proxy_cache_bypass $http_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /ssh/ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -256,6 +270,15 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location /ssh/file_manager/sudo-password {
+            proxy_pass http://127.0.0.1:30004;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /ssh/file_manager/ssh/ {
            client_max_body_size 5G;
            client_body_timeout 300s;
@@ -275,6 +298,15 @@ http {
            proxy_buffering off;
        }

+        location ~ ^/network-topology(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /health {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -324,6 +356,15 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location ~ ^/dashboard/preferences(/.*)?$ {
+            proxy_pass http://127.0.0.1:30006;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location ^~ /docker/console/ {
            proxy_pass http://127.0.0.1:30008/;
            proxy_http_version 1.1;
@@ -4,6 +4,16 @@
    <meta charset="UTF-8" />
    <link rel="icon" type="image/svg+xml" href="/favicon.ico" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <!-- PWA Meta Tags -->
+    <meta name="theme-color" content="#09090b" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta
+      name="apple-mobile-web-app-status-bar-style"
+      content="black-translucent"
+    />
+    <meta name="apple-mobile-web-app-title" content="Termix" />
+    <link rel="apple-touch-icon" href="/icons/512x512.png" />
+    <link rel="manifest" href="/manifest.json" />
    <title>Termix</title>
    <style>
      .hide-scrollbar {
@@ -1,12 +1,12 @@
 {
  "name": "termix",
-  "version": "1.10.0",
+  "version": "1.11.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "termix",
-      "version": "1.10.0",
+      "version": "1.11.0",
      "dependencies": {
        "@codemirror/autocomplete": "^6.18.7",
        "@codemirror/commands": "^6.3.3",
@@ -34,9 +34,11 @@
        "@tailwindcss/vite": "^4.1.14",
        "@types/bcryptjs": "^2.4.6",
        "@types/cookie-parser": "^1.4.9",
+        "@types/cytoscape": "^3.21.9",
        "@types/jszip": "^3.4.0",
        "@types/multer": "^2.0.0",
        "@types/qrcode": "^1.5.5",
+        "@types/react-grid-layout": "^1.3.6",
        "@types/speakeasy": "^2.0.10",
        "@uiw/codemirror-extensions-langs": "^4.24.1",
        "@uiw/codemirror-theme-github": "^4.25.4",
@@ -56,6 +58,7 @@
        "cmdk": "^1.1.1",
        "cookie-parser": "^1.4.7",
        "cors": "^2.8.5",
+        "cytoscape": "^3.33.1",
        "dotenv": "^17.2.0",
        "drizzle-orm": "^0.44.3",
        "express": "^5.1.0",
@@ -72,7 +75,9 @@
        "node-fetch": "^3.3.2",
        "qrcode": "^1.5.4",
        "react": "^19.1.0",
+        "react-cytoscapejs": "^2.0.0",
        "react-dom": "^19.1.0",
+        "react-grid-layout": "^2.2.2",
        "react-h5-audio-player": "^3.10.1",
        "react-hook-form": "^7.60.0",
        "react-i18next": "^15.7.3",
@@ -122,11 +127,60 @@
        "husky": "^9.1.7",
        "lint-staged": "^16.2.3",
        "prettier": "3.6.2",
+        "swagger-jsdoc": "^6.2.8",
        "typescript": "~5.9.2",
        "typescript-eslint": "^8.40.0",
        "vite": "^7.1.5"
      }
    },
+    "node_modules/@apidevtools/json-schema-ref-parser": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/@apidevtools/json-schema-ref-parser/-/json-schema-ref-parser-9.1.2.tgz",
+      "integrity": "sha512-r1w81DpR+KyRWd3f+rk6TNqMgedmAxZP5v5KWlXQWlgMUUtyEJch0DKEci1SorPMiSeM8XPl7MZ3miJ60JIpQg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jsdevtools/ono": "^7.1.3",
+        "@types/json-schema": "^7.0.6",
+        "call-me-maybe": "^1.0.1",
+        "js-yaml": "^4.1.0"
+      }
+    },
+    "node_modules/@apidevtools/openapi-schemas": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@apidevtools/openapi-schemas/-/openapi-schemas-2.1.0.tgz",
+      "integrity": "sha512-Zc1AlqrJlX3SlpupFGpiLi2EbteyP7fXmUOGup6/DnkRgjP9bgMM/ag+n91rsv0U1Gpz0H3VILA/o3bW7Ua6BQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@apidevtools/swagger-methods": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@apidevtools/swagger-methods/-/swagger-methods-3.0.2.tgz",
+      "integrity": "sha512-QAkD5kK2b1WfjDS/UQn/qQkbwF31uqRjPTrsCs5ZG9BQGAkjwvqGFjjPqAuzac/IYzpPtRzjCP1WrTuAIjMrXg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@apidevtools/swagger-parser": {
+      "version": "10.0.3",
+      "resolved": "https://registry.npmjs.org/@apidevtools/swagger-parser/-/swagger-parser-10.0.3.tgz",
+      "integrity": "sha512-sNiLY51vZOmSPFZA5TF35KZ2HbgYklQnTSDnkghamzLb3EkNtcQnrBQEj5AOCxHpTtXpqMCRM1CrmV2rG6nw4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@apidevtools/json-schema-ref-parser": "^9.0.6",
+        "@apidevtools/openapi-schemas": "^2.0.4",
+        "@apidevtools/swagger-methods": "^3.0.2",
+        "@jsdevtools/ono": "^7.1.3",
+        "call-me-maybe": "^1.0.1",
+        "z-schema": "^5.0.1"
+      },
+      "peerDependencies": {
+        "openapi-types": ">=7"
+      }
+    },
    "node_modules/@babel/code-frame": {
      "version": "7.27.1",
      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",
@@ -158,6 +212,7 @@
      "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/code-frame": "^7.27.1",
        "@babel/generator": "^7.28.5",
@@ -443,6 +498,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/autocomplete/-/autocomplete-6.19.1.tgz",
      "integrity": "sha512-q6NenYkEy2fn9+JyjIxMWcNjzTL/IhwqfzOut1/G3PrIFkrbl4AL7Wkse5tLrQUUyqGoAKU5+Pi5jnnXxH5HGw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/language": "^6.0.0",
        "@codemirror/state": "^6.0.0",
@@ -491,6 +547,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/lang-css/-/lang-css-6.3.1.tgz",
      "integrity": "sha512-kr5fwBGiGtmz6l0LSJIbno9QrifNMUusivHbnA1H6Dmqy4HZFte3UAICix1VuKo0lMPKQr2rqB+0BkKi/S3Ejg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/autocomplete": "^6.0.0",
        "@codemirror/language": "^6.0.0",
@@ -517,6 +574,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/lang-html/-/lang-html-6.4.11.tgz",
      "integrity": "sha512-9NsXp7Nwp891pQchI7gPdTwBuSuT3K65NGTHWHNJ55HjYcHLllr0rbIZNdOzas9ztc1EUVBlHou85FFZS4BNnw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/autocomplete": "^6.0.0",
        "@codemirror/lang-css": "^6.0.0",
@@ -544,6 +602,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/lang-javascript/-/lang-javascript-6.2.4.tgz",
      "integrity": "sha512-0WVmhp1QOqZ4Rt6GlVGwKJN3KW7Xh4H2q8ZZNGZaP6lRdxXJzmjm4FqvmOojVj6khWJHIb9sp7U/72W7xQgqAA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/autocomplete": "^6.0.0",
        "@codemirror/language": "^6.6.0",
@@ -744,6 +803,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.11.3.tgz",
      "integrity": "sha512-9HBM2XnwDj7fnu0551HkGdrUrrqmYq/WC5iv6nbY2WdicXdGbhR/gfbZOH73Aqj4351alY1+aoG9rCNfiwS1RA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/state": "^6.0.0",
        "@codemirror/view": "^6.23.0",
@@ -820,6 +880,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.5.2.tgz",
      "integrity": "sha512-FVqsPqtPWKVVL3dPSxy8wEF/ymIEuVzF1PK3VbUgrxXpJUSHQWWZz4JMToquRxnkw+36LTamCZG2iua2Ptq0fA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@marijn/find-cluster-break": "^1.0.0"
      }
@@ -841,6 +902,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.38.6.tgz",
      "integrity": "sha512-qiS0z1bKs5WOvHIAC0Cybmv4AJSkAXgX5aD6Mqd2epSLlVJsQl8NG23jCVouIgkh4All/mrbdsf2UOLFnJw0tw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/state": "^6.5.0",
        "crelt": "^1.0.6",
@@ -1168,6 +1230,7 @@
      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "fast-deep-equal": "^3.1.1",
        "fast-json-stable-stringify": "^2.0.0",
@@ -1554,7 +1617,6 @@
      "dev": true,
      "license": "BSD-2-Clause",
      "optional": true,
-      "peer": true,
      "dependencies": {
        "cross-dirname": "^0.1.0",
        "debug": "^4.3.4",
@@ -1576,7 +1638,6 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
-      "peer": true,
      "dependencies": {
        "graceful-fs": "^4.2.0",
        "jsonfile": "^6.0.1",
@@ -2619,11 +2680,19 @@
        "url": "https://opencollective.com/js-sdsl"
      }
    },
+    "node_modules/@jsdevtools/ono": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/@jsdevtools/ono/-/ono-7.1.3.tgz",
+      "integrity": "sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/@lezer/common": {
      "version": "1.3.0",
      "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.3.0.tgz",
      "integrity": "sha512-L9X8uHCYU310o99L3/MpJKYxPzXPOS7S0NmBaM7UO/x2Kb2WbmMLSkfvdr1KxRIFYOpbY0Jhn7CfLSUDzL8arQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
    },
    "node_modules/@lezer/cpp": {
      "version": "1.1.3",
@@ -2663,6 +2732,7 @@
      "resolved": "https://registry.npmjs.org/@lezer/highlight/-/highlight-1.2.3.tgz",
      "integrity": "sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@lezer/common": "^1.3.0"
      }
@@ -2694,6 +2764,7 @@
      "resolved": "https://registry.npmjs.org/@lezer/javascript/-/javascript-1.5.4.tgz",
      "integrity": "sha512-vvYx3MhWqeZtGPwDStM2dwgljd5smolYD2lR2UyFcHfxbBQebqx8yjmFmxtJ/E6nN6u1D9srOiVWm3Rb4tmcUA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@lezer/common": "^1.2.0",
        "@lezer/highlight": "^1.1.3",
@@ -2716,6 +2787,7 @@
      "resolved": "https://registry.npmjs.org/@lezer/lr/-/lr-1.4.2.tgz",
      "integrity": "sha512-pu0K1jCIdnQ12aWNaAVU5bzi7Bd1w54J3ECgANPmYLtQKP0HBj2cE/5coBD66MT10xbtIuUr7tg0Shbsvk0mDA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@lezer/common": "^1.0.0"
      }
@@ -5163,6 +5235,7 @@
      "integrity": "sha512-NMv9ASNARoKksWtsq/SHakpYAYnhBrQgGD8zkLYk/jaK8jUGn08CfEdTRgYhMypUQAfzSP8W6gNLe0q19/t4VA==",
      "devOptional": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/node": "*"
      }
@@ -5228,6 +5301,12 @@
        "@types/node": "*"
      }
    },
+    "node_modules/@types/cytoscape": {
+      "version": "3.21.9",
+      "resolved": "https://registry.npmjs.org/@types/cytoscape/-/cytoscape-3.21.9.tgz",
+      "integrity": "sha512-JyrG4tllI6jvuISPjHK9j2Xv/LTbnLekLke5otGStjFluIyA9JjgnvgZrSBsp8cEDpiTjwgZUZwpPv8TSBcoLw==",
+      "license": "MIT"
+    },
    "node_modules/@types/d3-array": {
      "version": "3.2.2",
      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
@@ -5320,6 +5399,7 @@
      "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.5.tgz",
      "integrity": "sha512-LuIQOcb6UmnF7C1PCFmEU1u2hmiHL43fgFQX67sN3H4Z+0Yk0Neo++mFsBjhOAuLzvlQeqAAkeDOZrJs9rzumQ==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/body-parser": "*",
        "@types/express-serve-static-core": "^5.0.0",
@@ -5442,6 +5522,7 @@
      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.9.2.tgz",
      "integrity": "sha512-uWN8YqxXxqFMX2RqGOrumsKeti4LlmIMIyV0lgut4jx7KQBcBiW6vkDtIBvHnHIquwNfJhk8v2OtmO8zXWHfPA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "undici-types": "~7.16.0"
      }
@@ -5484,6 +5565,7 @@
      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.2.tgz",
      "integrity": "sha512-6mDvHUFSjyT2B2yeNx2nUgMxh9LtOWvkhIU3uePn2I2oyNymUAX1NIsdgviM4CH+JSrp2D2hsMvJOkxY+0wNRA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "csstype": "^3.0.2"
      }
@@ -5494,10 +5576,20 @@
      "integrity": "sha512-9KQPoO6mZCi7jcIStSnlOWn2nEF3mNmyr3rIAsGnAbQKYbRLyqmeSc39EVgtxXVia+LMT8j3knZLAZAh+xLmrw==",
      "devOptional": true,
      "license": "MIT",
+      "peer": true,
      "peerDependencies": {
        "@types/react": "^19.2.0"
      }
    },
+    "node_modules/@types/react-grid-layout": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@types/react-grid-layout/-/react-grid-layout-1.3.6.tgz",
+      "integrity": "sha512-Cw7+sb3yyjtmxwwJiXtEXcu5h4cgs+sCGkHwHXsFmPyV30bf14LeD/fa2LwQovuD2HWxCcjIdNhDlcYGj95qGA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*"
+      }
+    },
    "node_modules/@types/responselike": {
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/@types/responselike/-/responselike-1.0.3.tgz",
@@ -5661,6 +5753,7 @@
      "integrity": "sha512-BnOroVl1SgrPLywqxyqdJ4l3S2MsKVLDVxZvjI1Eoe8ev2r3kGDo+PcMihNmDE+6/KjkTubSJnmqGZZjQSBq/g==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@typescript-eslint/scope-manager": "8.46.2",
        "@typescript-eslint/types": "8.46.2",
@@ -6068,7 +6161,8 @@
      "version": "5.5.0",
      "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-5.5.0.tgz",
      "integrity": "sha512-hqJHYaQb5OptNunnyAnkHyM8aCjZ1MEIDTQu1iIbbTD/xops91NB5yq1ZK/dC2JDbVWtF23zUtl9JE2NqwT87A==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
    },
    "node_modules/7zip-bin": {
      "version": "5.2.0",
@@ -6103,6 +6197,7 @@
      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "bin": {
        "acorn": "bin/acorn"
      },
@@ -6530,6 +6625,7 @@
      "integrity": "sha512-3yVdyZhklTiNrtg+4WqHpJpFDd+WHTg2oM7UcR80GqL05AOV0xEJzc6qNvFYoEtE+hRp1n9MpN6/+4yhlGkDXQ==",
      "hasInstallScript": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "bindings": "^1.5.0",
        "prebuild-install": "^7.1.1"
@@ -6672,6 +6768,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.8.19",
        "caniuse-lite": "^1.0.30001751",
@@ -6958,6 +7055,13 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
+    "node_modules/call-me-maybe": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-me-maybe/-/call-me-maybe-1.0.2.tgz",
+      "integrity": "sha512-HpX65o1Hnr9HH25ojC1YGs7HCQLq0GCOibSaWER0eNpgJ/Z1MZv2mTc7+xh6WOPxbRVcmgbv4hGU+uSQ/2xFZQ==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/callsites": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
@@ -7671,6 +7775,7 @@
      "integrity": "sha512-itvL5h8RETACmOTFc4UfIyB2RfEHi71Ax6E/PivVxq9NseKbOWpeyHEOIbmAw1rs8Ak0VursQNww7lf7YtUwzg==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "env-paths": "^2.2.1",
        "import-fresh": "^3.3.0",
@@ -7747,8 +7852,7 @@
      "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
      "dev": true,
      "license": "MIT",
-      "optional": true,
-      "peer": true
+      "optional": true
    },
    "node_modules/cross-spawn": {
      "version": "7.0.6",
@@ -7776,6 +7880,15 @@
      "integrity": "sha512-cjrsQufETwxjvwZbYbKBCJNvmQ2++G9AvT45zDi7NXL9k2PdVcs2h0jQz96J6G4TMKRCcEsoJ+QTgQD00Igtjw==",
      "license": "MIT"
    },
+    "node_modules/cytoscape": {
+      "version": "3.33.1",
+      "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.33.1.tgz",
+      "integrity": "sha512-iJc4TwyANnOGR1OmWhsS9ayRS3s+XQ185FmuHObThD+5AeJCakAAbWv8KimMTt08xCCLNgneQwFp+JRJOr9qGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
    "node_modules/d3-array": {
      "version": "3.2.4",
      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
@@ -8211,6 +8324,7 @@
      "integrity": "sha512-59CAAjAhTaIMCN8y9kD573vDkxbs1uhDcrFLHSgutYdPcGOU35Rf95725snvzEOy4BFB7+eLJ8djCNPmGwG67w==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "app-builder-lib": "26.0.12",
        "builder-util": "26.0.11",
@@ -8304,12 +8418,24 @@
      "license": "MIT",
      "optional": true
    },
+    "node_modules/doctrine": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
+      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "esutils": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
    "node_modules/dompurify": {
      "version": "3.1.7",
      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.1.7.tgz",
      "integrity": "sha512-VaTstWtsneJY8xzy7DekmYWEOZcmzIe3Qb3zPd4STve1OBTa+e+WmS1ITQec1fZYXI3HCsOZZiSMpG6oxoWMWQ==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "peer": true
+      "license": "(MPL-2.0 OR Apache-2.0)"
    },
    "node_modules/dot-prop": {
      "version": "5.3.0",
@@ -8684,7 +8810,6 @@
      "dev": true,
      "hasInstallScript": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@electron/asar": "^3.2.1",
        "debug": "^4.1.1",
@@ -8705,7 +8830,6 @@
      "integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "graceful-fs": "^4.1.2",
        "jsonfile": "^4.0.0",
@@ -8721,7 +8845,6 @@
      "integrity": "sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "optionalDependencies": {
        "graceful-fs": "^4.1.6"
      }
@@ -8732,7 +8855,6 @@
      "integrity": "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "engines": {
        "node": ">= 4.0.0"
      }
@@ -8994,6 +9116,7 @@
      "integrity": "sha512-iy2GE3MHrYTL5lrCtMZ0X1KLEKKUjmK0kzwcnefhR66txcEmXZD2YWgR5GNdcEwkNx3a0siYkSvl0vIC+Svjmg==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.8.0",
        "@eslint-community/regexpp": "^4.12.1",
@@ -9498,6 +9621,12 @@
      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
      "license": "MIT"
    },
+    "node_modules/fast-equals": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/fast-equals/-/fast-equals-4.0.3.tgz",
+      "integrity": "sha512-G3BSX9cfKttjr+2o1O22tYMLq0DPluZnYtq1rXumE1SpL/F/SLIfHx08WYQoWSIpeMYf8sRbJ8++71+v6Pnxfg==",
+      "license": "MIT"
+    },
    "node_modules/fast-glob": {
      "version": "3.3.3",
      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
@@ -11005,6 +11134,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/runtime": "^7.27.6"
      },
@@ -12195,6 +12325,14 @@
      "integrity": "sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==",
      "license": "MIT"
    },
+    "node_modules/lodash.get": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
+      "integrity": "sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==",
+      "deprecated": "This package is deprecated. Use the optional chaining (?.) operator instead.",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/lodash.includes": {
      "version": "4.3.0",
      "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
@@ -12207,6 +12345,14 @@
      "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
      "license": "MIT"
    },
+    "node_modules/lodash.isequal": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/lodash.isequal/-/lodash.isequal-4.5.0.tgz",
+      "integrity": "sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==",
+      "deprecated": "This package is deprecated. Use require('node:util').isDeepStrictEqual instead.",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/lodash.isinteger": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
@@ -12571,7 +12717,6 @@
      "resolved": "https://registry.npmjs.org/marked/-/marked-14.0.0.tgz",
      "integrity": "sha512-uIj4+faQ+MgHgwUW1l2PsPglZLOLOT1uErt06dAPtx2kjteLAkbsd/0FiYg/MGS+i7ZKLb7w2WClxHkzOOuryQ==",
      "license": "MIT",
-      "peer": true,
      "bin": {
        "marked": "bin/marked.js"
      },
@@ -14068,6 +14213,14 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/openapi-types": {
+      "version": "12.1.3",
+      "resolved": "https://registry.npmjs.org/openapi-types/-/openapi-types-12.1.3.tgz",
+      "integrity": "sha512-N4YtSYJqghVu4iek2ZUvcN/0aqH1kRDuNqzcycDxhOUpg7GdvLa2F3DgS6yBNhInhv2r/6I0Flkn7CqL8+nIcw==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
    "node_modules/optionator": {
      "version": "0.9.4",
      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -14601,7 +14754,6 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
-      "peer": true,
      "dependencies": {
        "commander": "^9.4.0"
      },
@@ -14619,7 +14771,6 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
-      "peer": true,
      "engines": {
        "node": "^12.20.0 || >=14"
      }
@@ -15105,15 +15256,30 @@
      "resolved": "https://registry.npmjs.org/react/-/react-19.2.0.tgz",
      "integrity": "sha512-tmbWg6W31tQLeB5cdIBOicJDJRR2KzXsV7uSK9iNfLWQ5bIZfxuPEHp7M8wiHyHnn0DD1i7w3Zmin0FtkrwoCQ==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=0.10.0"
      }
    },
+    "node_modules/react-cytoscapejs": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/react-cytoscapejs/-/react-cytoscapejs-2.0.0.tgz",
+      "integrity": "sha512-t3SSl1DQy7+JQjN+8QHi1anEJlM3i3aAeydHTsJwmjo/isyKK7Rs7oCvU6kZsB9NwZidzZQR21Vm2PcBLG/Tjg==",
+      "license": "MIT",
+      "dependencies": {
+        "prop-types": "^15.8.1"
+      },
+      "peerDependencies": {
+        "cytoscape": "^3.2.19",
+        "react": ">=15.0.0"
+      }
+    },
    "node_modules/react-dom": {
      "version": "19.2.0",
      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.0.tgz",
      "integrity": "sha512-UlbRu4cAiGaIewkPyiRGJk0imDN2T3JjieT6spoL2UeSf5od4n5LB/mQ4ejmxhCFT1tYe8IvaFulzynWovsEFQ==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "scheduler": "^0.27.0"
      },
@@ -15121,6 +15287,38 @@
        "react": "^19.2.0"
      }
    },
+    "node_modules/react-draggable": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/react-draggable/-/react-draggable-4.5.0.tgz",
+      "integrity": "sha512-VC+HBLEZ0XJxnOxVAZsdRi8rD04Iz3SiiKOoYzamjylUcju/hP9np/aZdLHf/7WOD268WMoNJMvYfB5yAK45cw==",
+      "license": "MIT",
+      "dependencies": {
+        "clsx": "^2.1.1",
+        "prop-types": "^15.8.1"
+      },
+      "peerDependencies": {
+        "react": ">= 16.3.0",
+        "react-dom": ">= 16.3.0"
+      }
+    },
+    "node_modules/react-grid-layout": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/react-grid-layout/-/react-grid-layout-2.2.2.tgz",
+      "integrity": "sha512-yNo9pxQWoxHWRAwHGSVT4DEGELYPyQ7+q9lFclb5jcqeFzva63/2F72CryS/jiTIr/SBIlTaDdyjqH+ODg8oBw==",
+      "license": "MIT",
+      "dependencies": {
+        "clsx": "^2.1.1",
+        "fast-equals": "^4.0.3",
+        "prop-types": "^15.8.1",
+        "react-draggable": "^4.4.6",
+        "react-resizable": "^3.0.5",
+        "resize-observer-polyfill": "^1.5.1"
+      },
+      "peerDependencies": {
+        "react": ">= 16.3.0",
+        "react-dom": ">= 16.3.0"
+      }
+    },
    "node_modules/react-h5-audio-player": {
      "version": "3.10.1",
      "resolved": "https://registry.npmjs.org/react-h5-audio-player/-/react-h5-audio-player-3.10.1.tgz",
@@ -15140,6 +15338,7 @@
      "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.66.0.tgz",
      "integrity": "sha512-xXBqsWGKrY46ZqaHDo+ZUYiMUgi8suYu5kdrS20EG8KiL7VRQitEbNjm+UcrDYrNi1YLyfpmAeGjCZYXLT9YBw==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=18.0.0"
      },
@@ -15287,6 +15486,7 @@
      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.2.0.tgz",
      "integrity": "sha512-ROY9fvHhwOD9ySfrF0wmvu//bKCQ6AeZZq1nJNtbDC+kk5DuSuNX/n6YWYF/SYy7bSba4D4FSz8DJeKY/S/r+g==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/use-sync-external-store": "^0.0.6",
        "use-sync-external-store": "^1.4.0"
@@ -15362,6 +15562,20 @@
        }
      }
    },
+    "node_modules/react-resizable": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/react-resizable/-/react-resizable-3.1.3.tgz",
+      "integrity": "sha512-liJBNayhX7qA4tBJiBD321FDhJxgGTJ07uzH5zSORXoE8h7PyEZ8mLqmosST7ppf6C4zUsbd2gzDMmBCfFp9Lw==",
+      "license": "MIT",
+      "dependencies": {
+        "prop-types": "15.x",
+        "react-draggable": "^4.5.0"
+      },
+      "peerDependencies": {
+        "react": ">= 16.3",
+        "react-dom": ">= 16.3"
+      }
+    },
    "node_modules/react-resizable-panels": {
      "version": "3.0.6",
      "resolved": "https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-3.0.6.tgz",
@@ -15495,7 +15709,8 @@
      "version": "5.0.1",
      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
    },
    "node_modules/redux-thunk": {
      "version": "3.1.0",
@@ -15737,6 +15952,12 @@
      "integrity": "sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w==",
      "license": "MIT"
    },
+    "node_modules/resize-observer-polyfill": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/resize-observer-polyfill/-/resize-observer-polyfill-1.5.1.tgz",
+      "integrity": "sha512-LwZrotdHOo12nQuZlHEmtuXdqGoOD0OhaxopaNFxWzInpEgaLWoVuAMbTzixuosCx2nEG58ngzW3vxdWoxIgdg==",
+      "license": "MIT"
+    },
    "node_modules/resolve-alpn": {
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.2.1.tgz",
@@ -16717,6 +16938,95 @@
        "node": ">=8"
      }
    },
+    "node_modules/swagger-jsdoc": {
+      "version": "6.2.8",
+      "resolved": "https://registry.npmjs.org/swagger-jsdoc/-/swagger-jsdoc-6.2.8.tgz",
+      "integrity": "sha512-VPvil1+JRpmJ55CgAtn8DIcpBs0bL5L3q5bVQvF4tAW/k/9JYSj7dCpaYCAv5rufe0vcCbBRQXGvzpkWjvLklQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "commander": "6.2.0",
+        "doctrine": "3.0.0",
+        "glob": "7.1.6",
+        "lodash.mergewith": "^4.6.2",
+        "swagger-parser": "^10.0.3",
+        "yaml": "2.0.0-1"
+      },
+      "bin": {
+        "swagger-jsdoc": "bin/swagger-jsdoc.js"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/swagger-jsdoc/node_modules/commander": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-6.2.0.tgz",
+      "integrity": "sha512-zP4jEKbe8SHzKJYQmq8Y9gYjtO/POJLgIdKgV7B9qNmABVFVc+ctqSX6iXh4mCpJfRBOabiZ2YKPg8ciDw6C+Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/swagger-jsdoc/node_modules/glob": {
+      "version": "7.1.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.6.tgz",
+      "integrity": "sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==",
+      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.0.4",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/swagger-jsdoc/node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/swagger-jsdoc/node_modules/yaml": {
+      "version": "2.0.0-1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.0.0-1.tgz",
+      "integrity": "sha512-W7h5dEhywMKenDJh2iX/LABkbFnBxasD27oyXWDS/feDsxiw0dD5ncXdYXgkvAsXIY2MpW/ZKkr9IU30DBdMNQ==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/swagger-parser": {
+      "version": "10.0.3",
+      "resolved": "https://registry.npmjs.org/swagger-parser/-/swagger-parser-10.0.3.tgz",
+      "integrity": "sha512-nF7oMeL4KypldrQhac8RyHerJeGPD1p2xDh900GPvc+Nk7nWP6jX2FcC7WmkinMoAmoO774+AFXcWsW8gMWEIg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@apidevtools/swagger-parser": "10.0.3"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
    "node_modules/tailwind-merge": {
      "version": "3.3.1",
      "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.3.1.tgz",
@@ -16885,7 +17195,6 @@
      "integrity": "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "mkdirp": "^0.5.1",
        "rimraf": "~2.6.2"
@@ -16926,7 +17235,6 @@
      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "minimist": "^1.2.6"
      },
@@ -16941,7 +17249,6 @@
      "deprecated": "Rimraf versions prior to v4 are no longer supported",
      "dev": true,
      "license": "ISC",
-      "peer": true,
      "dependencies": {
        "glob": "^7.1.3"
      },
@@ -17046,6 +17353,7 @@
      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=12"
      },
@@ -17251,6 +17559,7 @@
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "devOptional": true,
      "license": "Apache-2.0",
+      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -17566,6 +17875,16 @@
      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
      "license": "MIT"
    },
+    "node_modules/validator": {
+      "version": "13.15.26",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.26.tgz",
+      "integrity": "sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
    "node_modules/vary": {
      "version": "1.1.2",
      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
@@ -17663,6 +17982,7 @@
      "resolved": "https://registry.npmjs.org/vite/-/vite-7.1.12.tgz",
      "integrity": "sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "esbuild": "^0.25.0",
        "fdir": "^6.5.0",
@@ -17754,6 +18074,7 @@
      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=12"
      },
@@ -18120,6 +18441,38 @@
      "integrity": "sha512-YHDIOAqgRpfl1Ois9HcB8UFtWOxK8KJrV5TXpImj4BKYP1rWT04f/fMM9tQ9SYZlBKukT7NR+9wcI3UpB5BMDQ==",
      "license": "MIT"
    },
+    "node_modules/z-schema": {
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/z-schema/-/z-schema-5.0.5.tgz",
+      "integrity": "sha512-D7eujBWkLa3p2sIpJA0d1pr7es+a7m0vFAnZLlCEKq/Ij2k0MLi9Br2UPxoxdYystm5K1yeBGzub0FlYUEWj2Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lodash.get": "^4.4.2",
+        "lodash.isequal": "^4.5.0",
+        "validator": "^13.7.0"
+      },
+      "bin": {
+        "z-schema": "bin/z-schema"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      },
+      "optionalDependencies": {
+        "commander": "^9.4.1"
+      }
+    },
+    "node_modules/z-schema/node_modules/commander": {
+      "version": "9.5.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-9.5.0.tgz",
+      "integrity": "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": "^12.20.0 || >=14"
+      }
+    },
    "node_modules/zod": {
      "version": "4.1.12",
      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.12.tgz",
@@ -1,7 +1,7 @@
 {
  "name": "termix",
  "private": true,
-  "version": "1.10.0",
+  "version": "1.11.0",
  "description": "A web-based server management platform with SSH terminal, tunneling, and file editing capabilities",
  "author": "Karmaa",
  "main": "electron/main.cjs",
@@ -17,6 +17,7 @@
    "build": "vite build && tsc -p tsconfig.node.json",
    "build:backend": "tsc -p tsconfig.node.json",
    "dev:backend": "tsc -p tsconfig.node.json && node ./dist/backend/backend/starter.js",
+    "generate:openapi": "tsc -p tsconfig.node.json && node ./dist/backend/backend/swagger.js",
    "preview": "vite preview",
    "electron:dev": "concurrently \"npm run dev\" \"powershell -c \\\"Start-Sleep -Seconds 5\\\" && electron .\"",
    "build:win-portable": "npm run build && electron-builder --win --dir",
@@ -53,9 +54,11 @@
    "@tailwindcss/vite": "^4.1.14",
    "@types/bcryptjs": "^2.4.6",
    "@types/cookie-parser": "^1.4.9",
+    "@types/cytoscape": "^3.21.9",
    "@types/jszip": "^3.4.0",
    "@types/multer": "^2.0.0",
    "@types/qrcode": "^1.5.5",
+    "@types/react-grid-layout": "^1.3.6",
    "@types/speakeasy": "^2.0.10",
    "@uiw/codemirror-extensions-langs": "^4.24.1",
    "@uiw/codemirror-theme-github": "^4.25.4",
@@ -75,6 +78,7 @@
    "cmdk": "^1.1.1",
    "cookie-parser": "^1.4.7",
    "cors": "^2.8.5",
+    "cytoscape": "^3.33.1",
    "dotenv": "^17.2.0",
    "drizzle-orm": "^0.44.3",
    "express": "^5.1.0",
@@ -91,7 +95,9 @@
    "node-fetch": "^3.3.2",
    "qrcode": "^1.5.4",
    "react": "^19.1.0",
+    "react-cytoscapejs": "^2.0.0",
    "react-dom": "^19.1.0",
+    "react-grid-layout": "^2.2.2",
    "react-h5-audio-player": "^3.10.1",
    "react-hook-form": "^7.60.0",
    "react-i18next": "^15.7.3",
@@ -141,6 +147,7 @@
    "husky": "^9.1.7",
    "lint-staged": "^16.2.3",
    "prettier": "3.6.2",
+    "swagger-jsdoc": "^6.2.8",
    "typescript": "~5.9.2",
    "typescript-eslint": "^8.40.0",
    "vite": "^7.1.5"
@@ -0,0 +1,40 @@
+{
+  "name": "Termix",
+  "short_name": "Termix",
+  "description": "A web-based server management platform with SSH terminal, tunneling, and file editing capabilities",
+  "theme_color": "#09090b",
+  "background_color": "#09090b",
+  "display": "standalone",
+  "orientation": "any",
+  "scope": "/",
+  "start_url": "/",
+  "icons": [
+    {
+      "src": "/icons/48x48.png",
+      "sizes": "48x48",
+      "type": "image/png"
+    },
+    {
+      "src": "/icons/64x64.png",
+      "sizes": "64x64",
+      "type": "image/png"
+    },
+    {
+      "src": "/icons/128x128.png",
+      "sizes": "128x128",
+      "type": "image/png"
+    },
+    {
+      "src": "/icons/256x256.png",
+      "sizes": "256x256",
+      "type": "image/png"
+    },
+    {
+      "src": "/icons/512x512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any maskable"
+    }
+  ],
+  "categories": ["utilities", "developer", "productivity"]
+}
@@ -0,0 +1,98 @@
+const CACHE_NAME = "termix-v1";
+const STATIC_ASSETS = [
+  "/",
+  "/index.html",
+  "/manifest.json",
+  "/favicon.ico",
+  "/icons/48x48.png",
+  "/icons/128x128.png",
+  "/icons/256x256.png",
+  "/icons/512x512.png",
+];
+
+self.addEventListener("install", (event) => {
+  event.waitUntil(
+    caches
+      .open(CACHE_NAME)
+      .then((cache) => {
+        return cache.addAll(STATIC_ASSETS);
+      })
+      .then(() => {
+        return self.skipWaiting();
+      }),
+  );
+});
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    caches
+      .keys()
+      .then((cacheNames) => {
+        return Promise.all(
+          cacheNames
+            .filter((name) => name !== CACHE_NAME)
+            .map((name) => {
+              return caches.delete(name);
+            }),
+        );
+      })
+      .then(() => {
+        return self.clients.claim();
+      }),
+  );
+});
+
+self.addEventListener("fetch", (event) => {
+  const { request } = event;
+  const url = new URL(request.url);
+
+  if (request.method !== "GET") {
+    return;
+  }
+
+  if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/ws")) {
+    return;
+  }
+
+  if (url.origin !== self.location.origin) {
+    return;
+  }
+
+  if (request.mode === "navigate") {
+    event.respondWith(
+      fetch(request)
+        .then((response) => {
+          const responseClone = response.clone();
+          caches.open(CACHE_NAME).then((cache) => {
+            cache.put(request, responseClone);
+          });
+          return response;
+        })
+        .catch(() => {
+          return caches.match("/index.html");
+        }),
+    );
+    return;
+  }
+
+  event.respondWith(
+    caches.match(request).then((cachedResponse) => {
+      if (cachedResponse) {
+        return cachedResponse;
+      }
+
+      return fetch(request).then((response) => {
+        if (!response || response.status !== 200 || response.type !== "basic") {
+          return response;
+        }
+
+        const responseClone = response.clone();
+        caches.open(CACHE_NAME).then((cache) => {
+          cache.put(request, responseClone);
+        });
+
+        return response;
+      });
+    }),
+  );
+});
@@ -1,9 +1,14 @@
 import express from "express";
 import cors from "cors";
 import cookieParser from "cookie-parser";
-import { getDb } from "./database/db/index.js";
-import { recentActivity, sshData, hostAccess } from "./database/db/schema.js";
-import { eq, and, desc, or } from "drizzle-orm";
+import { getDb, DatabaseSaveTrigger } from "./database/db/index.js";
+import {
+  recentActivity,
+  sshData,
+  hostAccess,
+  dashboardPreferences,
+} from "./database/db/schema.js";
+import { eq, and, desc, or, sql } from "drizzle-orm";
 import { dashboardLogger } from "./utils/logger.js";
 import { SimpleDBOps } from "./utils/simple-db-ops.js";
 import { AuthManager } from "./utils/auth-manager.js";
@@ -58,6 +63,31 @@ app.use(express.json({ limit: "1mb" }));

 app.use(authManager.createAuthMiddleware());

+/**
+ * @openapi
+ * /uptime:
+ *   get:
+ *     summary: Get server uptime
+ *     description: Returns the uptime of the server in various formats.
+ *     tags:
+ *       - Dashboard
+ *     responses:
+ *       200:
+ *         description: Server uptime information.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 uptimeMs:
+ *                   type: number
+ *                 uptimeSeconds:
+ *                   type: number
+ *                 formatted:
+ *                   type: string
+ *       500:
+ *         description: Failed to get uptime.
+ */
 app.get("/uptime", async (req, res) => {
  try {
    const uptimeMs = Date.now() - serverStartTime;
@@ -77,6 +107,28 @@ app.get("/uptime", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /activity/recent:
+ *   get:
+ *     summary: Get recent activity
+ *     description: Fetches the most recent activities for the authenticated user.
+ *     tags:
+ *       - Dashboard
+ *     parameters:
+ *       - in: query
+ *         name: limit
+ *         schema:
+ *           type: integer
+ *         description: The maximum number of activities to return.
+ *     responses:
+ *       200:
+ *         description: A list of recent activities.
+ *       401:
+ *         description: Session expired.
+ *       500:
+ *         description: Failed to get recent activity.
+ */
 app.get("/activity/recent", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -108,6 +160,40 @@ app.get("/activity/recent", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /activity/log:
+ *   post:
+ *     summary: Log a new activity
+ *     description: Logs a new user activity, such as accessing a terminal or file manager. This endpoint is rate-limited.
+ *     tags:
+ *       - Dashboard
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               type:
+ *                 type: string
+ *                 enum: [terminal, file_manager, server_stats, tunnel, docker]
+ *               hostId:
+ *                 type: integer
+ *               hostName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Activity logged successfully or rate-limited.
+ *       400:
+ *         description: Invalid request body.
+ *       401:
+ *         description: Session expired.
+ *       404:
+ *         description: Host not found or access denied.
+ *       500:
+ *         description: Failed to log activity.
+ */
 app.post("/activity/log", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -224,6 +310,22 @@ app.post("/activity/log", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /activity/reset:
+ *   delete:
+ *     summary: Reset recent activity
+ *     description: Clears all recent activity for the authenticated user.
+ *     tags:
+ *       - Dashboard
+ *     responses:
+ *       200:
+ *         description: Recent activity cleared.
+ *       401:
+ *         description: Session expired.
+ *       500:
+ *         description: Failed to reset activity.
+ */
 app.delete("/activity/reset", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -253,6 +355,160 @@ app.delete("/activity/reset", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /dashboard/preferences:
+ *   get:
+ *     summary: Get dashboard layout preferences
+ *     description: Returns the user's customized dashboard layout settings. If no preferences exist, returns default layout.
+ *     tags:
+ *       - Dashboard
+ *     responses:
+ *       200:
+ *         description: Dashboard preferences retrieved
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 cards:
+ *                   type: array
+ *                   items:
+ *                     type: object
+ *                     properties:
+ *                       id:
+ *                         type: string
+ *                       enabled:
+ *                         type: boolean
+ *                       order:
+ *                         type: integer
+ *       401:
+ *         description: Session expired
+ *       500:
+ *         description: Failed to get preferences
+ */
+app.get("/dashboard/preferences", async (req, res) => {
+  try {
+    const userId = (req as AuthenticatedRequest).userId;
+
+    if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+      return res.status(401).json({
+        error: "Session expired - please log in again",
+        code: "SESSION_EXPIRED",
+      });
+    }
+
+    const preferences = await getDb()
+      .select()
+      .from(dashboardPreferences)
+      .where(eq(dashboardPreferences.userId, userId));
+
+    if (preferences.length === 0) {
+      const defaultLayout = {
+        cards: [
+          { id: "server_overview", enabled: true, order: 1 },
+          { id: "recent_activity", enabled: true, order: 2 },
+          { id: "network_graph", enabled: false, order: 3 },
+          { id: "quick_actions", enabled: true, order: 4 },
+          { id: "server_stats", enabled: true, order: 5 },
+        ],
+      };
+      return res.json(defaultLayout);
+    }
+
+    const layout = JSON.parse(preferences[0].layout as string);
+    res.json(layout);
+  } catch (err) {
+    dashboardLogger.error("Failed to get dashboard preferences", err);
+    res.status(500).json({ error: "Failed to get dashboard preferences" });
+  }
+});
+
+/**
+ * @openapi
+ * /dashboard/preferences:
+ *   post:
+ *     summary: Save dashboard layout preferences
+ *     description: Saves or updates the user's customized dashboard layout settings.
+ *     tags:
+ *       - Dashboard
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               cards:
+ *                 type: array
+ *                 items:
+ *                   type: object
+ *                   properties:
+ *                     id:
+ *                       type: string
+ *                     enabled:
+ *                       type: boolean
+ *                     order:
+ *                       type: integer
+ *     responses:
+ *       200:
+ *         description: Preferences saved successfully
+ *       400:
+ *         description: Invalid request body
+ *       401:
+ *         description: Session expired
+ *       500:
+ *         description: Failed to save preferences
+ */
+app.post("/dashboard/preferences", async (req, res) => {
+  try {
+    const userId = (req as AuthenticatedRequest).userId;
+
+    if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+      return res.status(401).json({
+        error: "Session expired - please log in again",
+        code: "SESSION_EXPIRED",
+      });
+    }
+
+    const { cards } = req.body;
+
+    if (!cards || !Array.isArray(cards)) {
+      return res.status(400).json({
+        error: "Invalid request body. Expected { cards: Array }",
+      });
+    }
+
+    const layout = JSON.stringify({ cards });
+
+    const existing = await getDb()
+      .select()
+      .from(dashboardPreferences)
+      .where(eq(dashboardPreferences.userId, userId));
+
+    if (existing.length > 0) {
+      await getDb()
+        .update(dashboardPreferences)
+        .set({ layout, updatedAt: sql`CURRENT_TIMESTAMP` })
+        .where(eq(dashboardPreferences.userId, userId));
+    } else {
+      await getDb().insert(dashboardPreferences).values({ userId, layout });
+    }
+
+    await DatabaseSaveTrigger.triggerSave("dashboard_preferences_updated");
+
+    dashboardLogger.success("Dashboard preferences saved", {
+      operation: "save_dashboard_preferences",
+      userId,
+    });
+
+    res.json({ success: true, message: "Dashboard preferences saved" });
+  } catch (err) {
+    dashboardLogger.error("Failed to save dashboard preferences", err);
+    res.status(500).json({ error: "Failed to save dashboard preferences" });
+  }
+});
+
 const PORT = 30006;
 app.listen(PORT, async () => {
  try {
@@ -8,6 +8,7 @@ import alertRoutes from "./routes/alerts.js";
 import credentialsRoutes from "./routes/credentials.js";
 import snippetsRoutes from "./routes/snippets.js";
 import terminalRoutes from "./routes/terminal.js";
+import networkTopologyRoutes from "./routes/network-topology.js";
 import rbacRoutes from "./routes/rbac.js";
 import cors from "cors";
 import fetch from "node-fetch";
@@ -205,10 +206,46 @@ app.use(bodyParser.urlencoded({ limit: "1gb", extended: true }));
 app.use(bodyParser.raw({ limit: "5gb", type: "application/octet-stream" }));
 app.use(cookieParser());

+/**
+ * @openapi
+ * /health:
+ *   get:
+ *     summary: Health check
+ *     description: Returns the health status of the server.
+ *     tags:
+ *       - General
+ *     responses:
+ *       200:
+ *         description: Server is healthy.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 status:
+ *                   type: string
+ *                   example: ok
+ */
 app.get("/health", (req, res) => {
  res.json({ status: "ok" });
 });

+/**
+ * @openapi
+ * /version:
+ *   get:
+ *     summary: Get version information
+ *     description: Returns the local and remote version of the application.
+ *     tags:
+ *       - General
+ *     responses:
+ *       200:
+ *         description: Version information.
+ *       404:
+ *         description: Local version not set.
+ *       500:
+ *         description: Fetch error.
+ */
 app.get("/version", authenticateJWT, async (req, res) => {
  let localVersion = process.env.VERSION;

@@ -307,6 +344,31 @@ app.get("/version", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /releases/rss:
+ *   get:
+ *     summary: Get releases in RSS format
+ *     description: Returns the latest releases from the GitHub repository in an RSS-like JSON format.
+ *     tags:
+ *       - General
+ *     parameters:
+ *       - in: query
+ *         name: page
+ *         schema:
+ *           type: integer
+ *         description: The page number of the releases to fetch.
+ *       - in: query
+ *         name: per_page
+ *         schema:
+ *           type: integer
+ *         description: The number of releases to fetch per page.
+ *     responses:
+ *       200:
+ *         description: Releases in RSS format.
+ *       500:
+ *         description: Failed to generate RSS format.
+ */
 app.get("/releases/rss", authenticateJWT, async (req, res) => {
  try {
    const page = parseInt(req.query.page as string) || 1;
@@ -363,6 +425,20 @@ app.get("/releases/rss", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /encryption/status:
+ *   get:
+ *     summary: Get encryption status
+ *     description: Returns the security status of the application.
+ *     tags:
+ *       - Encryption
+ *     responses:
+ *       200:
+ *         description: Security status.
+ *       500:
+ *         description: Failed to get security status.
+ */
 app.get("/encryption/status", requireAdmin, async (req, res) => {
  try {
    const securityStatus = {
@@ -384,6 +460,20 @@ app.get("/encryption/status", requireAdmin, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /encryption/initialize:
+ *   post:
+ *     summary: Initialize security system
+ *     description: Initializes the security system for the application.
+ *     tags:
+ *       - Encryption
+ *     responses:
+ *       200:
+ *         description: Security system initialized successfully.
+ *       500:
+ *         description: Failed to initialize security system.
+ */
 app.post("/encryption/initialize", requireAdmin, async (req, res) => {
  try {
    const authManager = AuthManager.getInstance();
@@ -407,6 +497,20 @@ app.post("/encryption/initialize", requireAdmin, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /encryption/regenerate:
+ *   post:
+ *     summary: Regenerate JWT secret
+ *     description: Regenerates the system JWT secret. This will invalidate all existing JWT tokens.
+ *     tags:
+ *       - Encryption
+ *     responses:
+ *       200:
+ *         description: System JWT secret regenerated.
+ *       500:
+ *         description: Failed to regenerate JWT secret.
+ */
 app.post("/encryption/regenerate", requireAdmin, async (req, res) => {
  try {
    apiLogger.warn("System JWT secret regenerated via API", {
@@ -428,6 +532,20 @@ app.post("/encryption/regenerate", requireAdmin, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /encryption/regenerate-jwt:
+ *   post:
+ *     summary: Regenerate JWT secret
+ *     description: Regenerates the JWT secret. This will invalidate all existing JWT tokens.
+ *     tags:
+ *       - Encryption
+ *     responses:
+ *       200:
+ *         description: New JWT secret generated.
+ *       500:
+ *         description: Failed to regenerate JWT secret.
+ */
 app.post("/encryption/regenerate-jwt", requireAdmin, async (req, res) => {
  try {
    apiLogger.warn("JWT secret regenerated via API", {
@@ -448,6 +566,33 @@ app.post("/encryption/regenerate-jwt", requireAdmin, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /database/export:
+ *   post:
+ *     summary: Export user data
+ *     description: Exports the user's data as a SQLite database file.
+ *     tags:
+ *       - Database
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               password:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: User data exported successfully.
+ *       400:
+ *         description: Password required for export.
+ *       401:
+ *         description: Invalid password.
+ *       500:
+ *         description: Failed to export user data.
+ */
 app.post("/database/export", authenticateJWT, async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -898,6 +1043,36 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /database/import:
+ *   post:
+ *     summary: Import user data
+ *     description: Imports user data from a SQLite database file.
+ *     tags:
+ *       - Database
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         multipart/form-data:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               file:
+ *                 type: string
+ *                 format: binary
+ *               password:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Incremental import completed successfully.
+ *       400:
+ *         description: No file uploaded or password required for import.
+ *       401:
+ *         description: Invalid password.
+ *       500:
+ *         description: Failed to import SQLite data.
+ */
 app.post(
  "/database/import",
  authenticateJWT,
@@ -1362,6 +1537,31 @@ app.post(
  },
 );

+/**
+ * @openapi
+ * /database/export/preview:
+ *   post:
+ *     summary: Preview user data export
+ *     description: Generates a preview of the user data export, including statistics about the data.
+ *     tags:
+ *       - Database
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               scope:
+ *                 type: string
+ *               includeCredentials:
+ *                 type: boolean
+ *     responses:
+ *       200:
+ *         description: Export preview generated successfully.
+ *       500:
+ *         description: Failed to generate export preview.
+ */
 app.post("/database/export/preview", authenticateJWT, async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -1397,6 +1597,33 @@ app.post("/database/export/preview", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /database/restore:
+ *   post:
+ *     summary: Restore database from backup
+ *     description: Restores the database from an encrypted backup file.
+ *     tags:
+ *       - Database
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               backupPath:
+ *                 type: string
+ *               targetPath:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Database restored successfully.
+ *       400:
+ *         description: Backup path is required or invalid encrypted backup file.
+ *       500:
+ *         description: Database restore failed.
+ */
 app.post("/database/restore", requireAdmin, async (req, res) => {
  try {
    const { backupPath, targetPath } = req.body;
@@ -1437,6 +1664,7 @@ app.use("/alerts", alertRoutes);
 app.use("/credentials", credentialsRoutes);
 app.use("/snippets", snippetsRoutes);
 app.use("/terminal", terminalRoutes);
+app.use("/network-topology", networkTopologyRoutes);
 app.use("/rbac", rbacRoutes);

 app.use(
@@ -1477,6 +1705,20 @@ async function initializeSecurity() {
  }
 }

+/**
+ * @openapi
+ * /database/migration/status:
+ *   get:
+ *     summary: Get database migration status
+ *     description: Returns the status of the database migration.
+ *     tags:
+ *       - Database
+ *     responses:
+ *       200:
+ *         description: Migration status.
+ *       500:
+ *         description: Failed to get migration status.
+ */
 app.get(
  "/database/migration/status",
  authenticateJWT,
@@ -1530,6 +1772,20 @@ app.get(
  },
 );

+/**
+ * @openapi
+ * /database/migration/history:
+ *   get:
+ *     summary: Get database migration history
+ *     description: Returns the history of database migrations.
+ *     tags:
+ *       - Database
+ *     responses:
+ *       200:
+ *         description: Migration history.
+ *       500:
+ *         description: Failed to get migration history.
+ */
 app.get(
  "/database/migration/history",
  authenticateJWT,
@@ -585,6 +585,32 @@ const migrateSchema = () => {
  addColumnIfNotExists("ssh_data", "socks5_password", "TEXT");
  addColumnIfNotExists("ssh_data", "socks5_proxy_chain", "TEXT");

+  addColumnIfNotExists(
+    "ssh_data",
+    "show_terminal_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 1",
+  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_file_manager_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_tunnel_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_docker_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_server_stats_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
+
  addColumnIfNotExists("ssh_credentials", "private_key", "TEXT");
  addColumnIfNotExists("ssh_credentials", "public_key", "TEXT");
  addColumnIfNotExists("ssh_credentials", "detected_key_type", "TEXT");
@@ -653,6 +679,54 @@ const migrateSchema = () => {
    }
  }

+  try {
+    sqlite
+      .prepare("SELECT id FROM network_topology LIMIT 1")
+      .get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS network_topology (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          topology TEXT,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create network_topology table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite
+      .prepare("SELECT id FROM dashboard_preferences LIMIT 1")
+      .get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS dashboard_preferences (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL UNIQUE,
+          layout TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create dashboard_preferences table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
  try {
    sqlite.prepare("SELECT id FROM host_access LIMIT 1").get();
  } catch {
@@ -90,6 +90,21 @@ export const sshData = sqliteTable("ssh_data", {
  enableDocker: integer("enable_docker", { mode: "boolean" })
    .notNull()
    .default(false),
+  showTerminalInSidebar: integer("show_terminal_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(true),
+  showFileManagerInSidebar: integer("show_file_manager_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(false),
+  showTunnelInSidebar: integer("show_tunnel_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(false),
+  showDockerInSidebar: integer("show_docker_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(false),
+  showServerStatsInSidebar: integer("show_server_stats_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(false),
  defaultPath: text("default_path"),
  statsConfig: text("stats_config"),
  terminalConfig: text("terminal_config"),
@@ -295,6 +310,35 @@ export const commandHistory = sqliteTable("command_history", {
    .default(sql`CURRENT_TIMESTAMP`),
 });

+export const networkTopology = sqliteTable("network_topology", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  topology: text("topology"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const dashboardPreferences = sqliteTable("dashboard_preferences", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .unique()
+    .references(() => users.id, { onDelete: "cascade" }),
+  layout: text("layout").notNull(),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
 export const hostAccess = sqliteTable("host_access", {
  id: integer("id").primaryKey({ autoIncrement: true }),
  hostId: integer("host_id")
@@ -99,8 +99,20 @@ const router = express.Router();
 const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();

-// Route: Get alerts for the authenticated user (excluding dismissed ones)
-// GET /alerts
+/**
+ * @openapi
+ * /alerts:
+ *   get:
+ *     summary: Get active alerts
+ *     description: Fetches active alerts for the authenticated user, excluding those that have been dismissed.
+ *     tags:
+ *      - Alerts
+ *     responses:
+ *       200:
+ *         description: A list of active alerts.
+ *       500:
+ *         description: Failed to fetch alerts.
+ */
 router.get("/", authenticateJWT, async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -131,8 +143,33 @@ router.get("/", authenticateJWT, async (req, res) => {
  }
 });

-// Route: Dismiss an alert for the authenticated user
-// POST /alerts/dismiss
+/**
+ * @openapi
+ * /alerts/dismiss:
+ *   post:
+ *     summary: Dismiss an alert
+ *     description: Marks an alert as dismissed for the authenticated user.
+ *     tags:
+ *      - Alerts
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               alertId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Alert dismissed successfully.
+ *       400:
+ *         description: Alert ID is required.
+ *       409:
+ *         description: Alert already dismissed.
+ *       500:
+ *         description: Failed to dismiss alert.
+ */
 router.post("/dismiss", authenticateJWT, async (req, res) => {
  try {
    const { alertId } = req.body;
@@ -170,8 +207,20 @@ router.post("/dismiss", authenticateJWT, async (req, res) => {
  }
 });

-// Route: Get dismissed alerts for a user
-// GET /alerts/dismissed/:userId
+/**
+ * @openapi
+ * /alerts/dismissed:
+ *   get:
+ *     summary: Get dismissed alerts
+ *     description: Fetches a list of alerts that have been dismissed by the authenticated user.
+ *     tags:
+ *      - Alerts
+ *     responses:
+ *       200:
+ *         description: A list of dismissed alerts.
+ *       500:
+ *         description: Failed to fetch dismissed alerts.
+ */
 router.get("/dismissed", authenticateJWT, async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -194,8 +243,33 @@ router.get("/dismissed", authenticateJWT, async (req, res) => {
  }
 });

-// Route: Undismiss an alert for the authenticated user (remove from dismissed list)
-// DELETE /alerts/dismiss
+/**
+ * @openapi
+ * /alerts/dismiss:
+ *   delete:
+ *     summary: Undismiss an alert
+ *     description: Removes an alert from the dismissed list for the authenticated user.
+ *     tags:
+ *      - Alerts
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               alertId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Alert undismissed successfully.
+ *       400:
+ *         description: Alert ID is required.
+ *       404:
+ *         description: Dismissed alert not found.
+ *       500:
+ *         description: Failed to undismiss alert.
+ */
 router.delete("/dismiss", authenticateJWT, async (req, res) => {
  try {
    const { alertId } = req.body;
@@ -84,8 +84,52 @@ const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 const requireDataAccess = authManager.createDataAccessMiddleware();

-// Create a new credential
-// POST /credentials
+/**
+ * @openapi
+ * /credentials:
+ *   post:
+ *     summary: Create a new credential
+ *     description: Creates a new SSH credential for the authenticated user.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *               folder:
+ *                 type: string
+ *               tags:
+ *                 type: array
+ *                 items:
+ *                   type: string
+ *               authType:
+ *                 type: string
+ *                 enum: [password, key]
+ *               username:
+ *                 type: string
+ *               password:
+ *                 type: string
+ *               key:
+ *                 type: string
+ *               keyPassword:
+ *                 type: string
+ *               keyType:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Credential created successfully.
+ *       400:
+ *         description: Invalid request body.
+ *       500:
+ *         description: Failed to create credential.
+ */
 router.post(
  "/",
  authenticateJWT,
@@ -231,8 +275,22 @@ router.post(
  },
 );

-// Get all credentials for the authenticated user
-// GET /credentials
+/**
+ * @openapi
+ * /credentials:
+ *   get:
+ *     summary: Get all credentials
+ *     description: Retrieves all SSH credentials for the authenticated user.
+ *     tags:
+ *       - Credentials
+ *     responses:
+ *       200:
+ *         description: A list of credentials.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to fetch credentials.
+ */
 router.get(
  "/",
  authenticateJWT,
@@ -264,8 +322,22 @@ router.get(
  },
 );

-// Get all unique credential folders for the authenticated user
-// GET /credentials/folders
+/**
+ * @openapi
+ * /credentials/folders:
+ *   get:
+ *     summary: Get credential folders
+ *     description: Retrieves all unique credential folders for the authenticated user.
+ *     tags:
+ *       - Credentials
+ *     responses:
+ *       200:
+ *         description: A list of folder names.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to fetch credential folders.
+ */
 router.get(
  "/folders",
  authenticateJWT,
@@ -302,15 +374,37 @@ router.get(
  },
 );

-// Get a specific credential by ID (with plain text secrets)
-// GET /credentials/:id
+/**
+ * @openapi
+ * /credentials/{id}:
+ *   get:
+ *     summary: Get a specific credential
+ *     description: Retrieves a specific credential by its ID, including secrets.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: The requested credential.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Credential not found.
+ *       500:
+ *         description: Failed to fetch credential.
+ */
 router.get(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;

    if (!isNonEmptyString(userId) || !id) {
      authLogger.warn("Invalid request for credential fetch");
@@ -366,15 +460,48 @@ router.get(
  },
 );

-// Update a credential
-// PUT /credentials/:id
+/**
+ * @openapi
+ * /credentials/{id}:
+ *   put:
+ *     summary: Update a credential
+ *     description: Updates a specific credential by its ID.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: The updated credential.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Credential not found.
+ *       500:
+ *         description: Failed to update credential.
+ */
 router.put(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const updateData = req.body;

    if (!isNonEmptyString(userId) || !id) {
@@ -510,15 +637,37 @@ router.put(
  },
 );

-// Delete a credential
-// DELETE /credentials/:id
+/**
+ * @openapi
+ * /credentials/{id}:
+ *   delete:
+ *     summary: Delete a credential
+ *     description: Deletes a specific credential by its ID.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Credential deleted successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Credential not found.
+ *       500:
+ *         description: Failed to delete credential.
+ */
 router.delete(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;

    if (!isNonEmptyString(userId) || !id) {
      authLogger.warn("Invalid request for credential deletion");
@@ -626,14 +775,46 @@ router.delete(
  },
 );

-// Apply a credential to an SSH host (for quick application)
-// POST /credentials/:id/apply-to-host/:hostId
+/**
+ * @openapi
+ * /credentials/{id}/apply-to-host/{hostId}:
+ *   post:
+ *     summary: Apply a credential to a host
+ *     description: Applies a credential to an SSH host for quick application.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *       - in: path
+ *         name: hostId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Credential applied to host successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Credential not found.
+ *       500:
+ *         description: Failed to apply credential to host.
+ */
 router.post(
  "/:id/apply-to-host/:hostId",
  authenticateJWT,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id: credentialId, hostId } = req.params;
+    const credentialId = Array.isArray(req.params.id)
+      ? req.params.id[0]
+      : req.params.id;
+    const hostId = Array.isArray(req.params.hostId)
+      ? req.params.hostId[0]
+      : req.params.hostId;

    if (!isNonEmptyString(userId) || !credentialId || !hostId) {
      authLogger.warn("Invalid request for credential application");
@@ -705,14 +886,36 @@ router.post(
  },
 );

-// Get hosts using a specific credential
-// GET /credentials/:id/hosts
+/**
+ * @openapi
+ * /credentials/{id}/hosts:
+ *   get:
+ *     summary: Get hosts using a credential
+ *     description: Retrieves a list of hosts that are using a specific credential.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: A list of hosts.
+ *       400:
+ *         description: Invalid request.
+ *       500:
+ *         description: Failed to fetch hosts using credential.
+ */
 router.get(
  "/:id/hosts",
  authenticateJWT,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id: credentialId } = req.params;
+    const credentialId = Array.isArray(req.params.id)
+      ? req.params.id[0]
+      : req.params.id;

    if (!isNonEmptyString(userId) || !credentialId) {
      authLogger.warn("Invalid request for credential hosts fetch");
@@ -800,8 +1003,33 @@ function formatSSHHostOutput(
  };
 }

-// Rename a credential folder
-// PUT /credentials/folders/rename
+/**
+ * @openapi
+ * /credentials/folders/rename:
+ *   put:
+ *     summary: Rename a credential folder
+ *     description: Renames a credential folder for the authenticated user.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               oldName:
+ *                 type: string
+ *               newName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Folder renamed successfully.
+ *       400:
+ *         description: Both oldName and newName are required.
+ *       500:
+ *         description: Failed to rename folder.
+ */
 router.put(
  "/folders/rename",
  authenticateJWT,
@@ -840,8 +1068,33 @@ router.put(
  },
 );

-// Detect SSH key type endpoint
-// POST /credentials/detect-key-type
+/**
+ * @openapi
+ * /credentials/detect-key-type:
+ *   post:
+ *     summary: Detect SSH key type
+ *     description: Detects the type of an SSH private key.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               privateKey:
+ *                 type: string
+ *               keyPassword:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Key type detection result.
+ *       400:
+ *         description: Private key is required.
+ *       500:
+ *         description: Failed to detect key type.
+ */
 router.post(
  "/detect-key-type",
  authenticateJWT,
@@ -874,8 +1127,31 @@ router.post(
  },
 );

-// Detect SSH public key type endpoint
-// POST /credentials/detect-public-key-type
+/**
+ * @openapi
+ * /credentials/detect-public-key-type:
+ *   post:
+ *     summary: Detect SSH public key type
+ *     description: Detects the type of an SSH public key.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               publicKey:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Key type detection result.
+ *       400:
+ *         description: Public key is required.
+ *       500:
+ *         description: Failed to detect public key type.
+ */
 router.post(
  "/detect-public-key-type",
  authenticateJWT,
@@ -909,8 +1185,35 @@ router.post(
  },
 );

-// Validate SSH key pair endpoint
-// POST /credentials/validate-key-pair
+/**
+ * @openapi
+ * /credentials/validate-key-pair:
+ *   post:
+ *     summary: Validate SSH key pair
+ *     description: Validates if a given SSH private key and public key match.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               privateKey:
+ *                 type: string
+ *               publicKey:
+ *                 type: string
+ *               keyPassword:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Key pair validation result.
+ *       400:
+ *         description: Private key and public key are required.
+ *       500:
+ *         description: Failed to validate key pair.
+ */
 router.post(
  "/validate-key-pair",
  authenticateJWT,
@@ -953,8 +1256,32 @@ router.post(
  },
 );

-// Generate new SSH key pair endpoint
-// POST /credentials/generate-key-pair
+/**
+ * @openapi
+ * /credentials/generate-key-pair:
+ *   post:
+ *     summary: Generate new SSH key pair
+ *     description: Generates a new SSH key pair.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               keyType:
+ *                 type: string
+ *               keySize:
+ *                 type: integer
+ *               passphrase:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: The new key pair.
+ *       500:
+ *         description: Failed to generate SSH key pair.
+ */
 router.post(
  "/generate-key-pair",
  authenticateJWT,
@@ -996,8 +1323,33 @@ router.post(
  },
 );

-// Generate public key from private key endpoint
-// POST /credentials/generate-public-key
+/**
+ * @openapi
+ * /credentials/generate-public-key:
+ *   post:
+ *     summary: Generate public key from private key
+ *     description: Generates a public key from a given private key.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               privateKey:
+ *                 type: string
+ *               keyPassword:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: The generated public key.
+ *       400:
+ *         description: Private key is required.
+ *       500:
+ *         description: Failed to generate public key.
+ */
 router.post(
  "/generate-public-key",
  authenticateJWT,
@@ -1283,7 +1635,7 @@ async function deploySSHKeyToHost(
            .replace(/'/g, "'\\''");

          conn.exec(
-            `printf '%s\\n' '${escapedKey} ${credData.name}@Termix' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys`,
+            `printf '%s\n' '${escapedKey} ${credData.name}@Termix' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys`,
            (err, stream) => {
              if (err) {
                clearTimeout(addTimeout);
@@ -1502,13 +1854,47 @@ async function deploySSHKeyToHost(
  });
 }

-// Deploy SSH Key to Host endpoint
-// POST /credentials/:id/deploy-to-host
+/**
+ * @openapi
+ * /credentials/{id}/deploy-to-host:
+ *   post:
+ *     summary: Deploy SSH key to a host
+ *     description: Deploys an SSH public key to a target host's authorized_keys file.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               targetHostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: SSH key deployed successfully.
+ *       400:
+ *         description: Credential ID and target host ID are required.
+ *       401:
+ *         description: Authentication required.
+ *       404:
+ *         description: Credential or target host not found.
+ *       500:
+ *         description: Failed to deploy SSH key.
+ */
 router.post(
  "/:id/deploy-to-host",
  authenticateJWT,
  async (req: Request, res: Response) => {
-    const credentialId = parseInt(req.params.id);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const credentialId = parseInt(id);
    const { targetHostId } = req.body;

    if (!credentialId || !targetHostId) {
@@ -0,0 +1,188 @@
+import express from "express";
+import { eq } from "drizzle-orm";
+import { getDb } from "../db/index.js";
+import { networkTopology } from "../db/schema.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import type { AuthenticatedRequest } from "../../../types/index.js";
+
+const router = express.Router();
+const authManager = AuthManager.getInstance();
+const authenticateJWT = authManager.createAuthMiddleware();
+
+/**
+ * @openapi
+ * /network-topology:
+ *   get:
+ *     summary: Get network topology for authenticated user
+ *     description: Retrieves the saved network topology graph (nodes and edges) for the current user. Returns null if no topology exists.
+ *     tags:
+ *       - Network Topology
+ *     security:
+ *       - bearerAuth: []
+ *     responses:
+ *       200:
+ *         description: Network topology retrieved successfully
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               nullable: true
+ *               properties:
+ *                 nodes:
+ *                   type: array
+ *                   description: Array of graph nodes (hosts and groups)
+ *                   items:
+ *                     type: object
+ *                     properties:
+ *                       data:
+ *                         type: object
+ *                         description: Node data including id, label, type, etc.
+ *                       position:
+ *                         type: object
+ *                         description: Node position coordinates
+ *                         properties:
+ *                           x:
+ *                             type: number
+ *                           y:
+ *                             type: number
+ *                 edges:
+ *                   type: array
+ *                   description: Array of graph edges (connections)
+ *                   items:
+ *                     type: object
+ *                     properties:
+ *                       data:
+ *                         type: object
+ *                         description: Edge data including source and target node ids
+ *       401:
+ *         description: User not authenticated
+ *       500:
+ *         description: Server error
+ */
+router.get(
+  "/",
+  authenticateJWT,
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const userId = (req as AuthenticatedRequest).userId;
+      if (!userId) {
+        return res.status(401).json({ error: "User not authenticated" });
+      }
+
+      const db = getDb();
+      const result = await db
+        .select()
+        .from(networkTopology)
+        .where(eq(networkTopology.userId, userId));
+
+      if (result.length > 0) {
+        const topologyStr = result[0].topology;
+        const topology = topologyStr ? JSON.parse(topologyStr) : null;
+        return res.json(topology);
+      } else {
+        return res.json(null);
+      }
+    } catch (error) {
+      console.error("Error fetching network topology:", error);
+      return res.status(500).json({
+        error: "Failed to fetch network topology",
+        details: (error as Error).message,
+      });
+    }
+  },
+);
+
+/**
+ * @openapi
+ * /network-topology:
+ *   post:
+ *     summary: Save network topology for authenticated user
+ *     description: Saves or updates the network topology graph. Uses upsert logic - creates new record if none exists, updates existing record otherwise.
+ *     tags:
+ *       - Network Topology
+ *     security:
+ *       - bearerAuth: []
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             required:
+ *               - topology
+ *             properties:
+ *               topology:
+ *                 type: object
+ *                 description: Network topology data containing nodes and edges
+ *                 properties:
+ *                   nodes:
+ *                     type: array
+ *                     description: Array of graph nodes (hosts and groups)
+ *                   edges:
+ *                     type: array
+ *                     description: Array of graph edges (connections)
+ *     responses:
+ *       200:
+ *         description: Topology saved successfully
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 success:
+ *                   type: boolean
+ *       400:
+ *         description: Invalid topology data
+ *       401:
+ *         description: User not authenticated
+ *       500:
+ *         description: Server error
+ */
+router.post(
+  "/",
+  authenticateJWT,
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const userId = (req as AuthenticatedRequest).userId;
+      if (!userId) {
+        return res.status(401).json({ error: "User not authenticated" });
+      }
+
+      const { topology } = req.body;
+      if (!topology) {
+        return res.status(400).json({ error: "Topology data is required" });
+      }
+
+      const db = getDb();
+
+      const topologyStr =
+        typeof topology === "string" ? topology : JSON.stringify(topology);
+
+      const existing = await db
+        .select()
+        .from(networkTopology)
+        .where(eq(networkTopology.userId, userId));
+
+      if (existing.length > 0) {
+        await db
+          .update(networkTopology)
+          .set({ topology: topologyStr })
+          .where(eq(networkTopology.userId, userId));
+      } else {
+        await db
+          .insert(networkTopology)
+          .values({ userId, topology: topologyStr });
+      }
+
+      return res.json({ success: true });
+    } catch (error) {
+      console.error("Error saving network topology:", error);
+      return res.status(500).json({
+        error: "Failed to save network topology",
+        details: (error as Error).message,
+      });
+    }
+  },
+);
+
+export default router;
@@ -27,13 +27,57 @@ function isNonEmptyString(value: unknown): value is string {
  return typeof value === "string" && value.trim().length > 0;
 }

-//Share a host with a user or role
-//POST /rbac/host/:id/share
+/**
+ * @openapi
+ * /rbac/host/{id}/share:
+ *   post:
+ *     summary: Share a host
+ *     description: Shares a host with a user or a role.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               targetType:
+ *                 type: string
+ *                 enum: [user, role]
+ *               targetUserId:
+ *                 type: string
+ *               targetRoleId:
+ *                 type: integer
+ *               durationHours:
+ *                 type: number
+ *               permissionLevel:
+ *                 type: string
+ *                 enum: [view]
+ *     responses:
+ *       200:
+ *         description: Host shared successfully.
+ *       400:
+ *         description: Invalid request body.
+ *       403:
+ *         description: Not host owner.
+ *       404:
+ *         description: Target user or role not found.
+ *       500:
+ *         description: Failed to share host.
+ */
 router.post(
  "/host/:id/share",
  authenticateJWT,
  async (req: AuthenticatedRequest, res: Response) => {
-    const hostId = parseInt(req.params.id, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const hostId = parseInt(id, 10);
    const userId = req.userId!;

    if (isNaN(hostId)) {
@@ -227,14 +271,45 @@ router.post(
  },
 );

-// Revoke host access
-// DELETE /rbac/host/:id/access/:accessId
+/**
+ * @openapi
+ * /rbac/host/{id}/access/{accessId}:
+ *   delete:
+ *     summary: Revoke host access
+ *     description: Revokes a user's or role's access to a host.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *       - in: path
+ *         name: accessId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Access revoked successfully.
+ *       400:
+ *         description: Invalid ID.
+ *       403:
+ *         description: Not host owner.
+ *       500:
+ *         description: Failed to revoke access.
+ */
 router.delete(
  "/host/:id/access/:accessId",
  authenticateJWT,
  async (req: AuthenticatedRequest, res: Response) => {
-    const hostId = parseInt(req.params.id, 10);
-    const accessId = parseInt(req.params.accessId, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const accessIdParam = Array.isArray(req.params.accessId)
+      ? req.params.accessId[0]
+      : req.params.accessId;
+    const hostId = parseInt(id, 10);
+    const accessId = parseInt(accessIdParam, 10);
    const userId = req.userId!;

    if (isNaN(hostId) || isNaN(accessId)) {
@@ -267,13 +342,36 @@ router.delete(
  },
 );

-// Get host access list
-// GET /rbac/host/:id/access
+/**
+ * @openapi
+ * /rbac/host/{id}/access:
+ *   get:
+ *     summary: Get host access list
+ *     description: Retrieves the list of users and roles that have access to a host.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: The access list for the host.
+ *       400:
+ *         description: Invalid host ID.
+ *       403:
+ *         description: Not host owner.
+ *       500:
+ *         description: Failed to get access list.
+ */
 router.get(
  "/host/:id/access",
  authenticateJWT,
  async (req: AuthenticatedRequest, res: Response) => {
-    const hostId = parseInt(req.params.id, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const hostId = parseInt(id, 10);
    const userId = req.userId!;

    if (isNaN(hostId)) {
@@ -338,8 +436,20 @@ router.get(
  },
 );

-// Get user's shared hosts (hosts shared WITH this user)
-// GET /rbac/shared-hosts
+/**
+ * @openapi
+ * /rbac/shared-hosts:
+ *   get:
+ *     summary: Get shared hosts
+ *     description: Retrieves the list of hosts that have been shared with the authenticated user.
+ *     tags:
+ *       - RBAC
+ *     responses:
+ *       200:
+ *         description: A list of shared hosts.
+ *       500:
+ *         description: Failed to get shared hosts.
+ */
 router.get(
  "/shared-hosts",
  authenticateJWT,
@@ -385,8 +495,20 @@ router.get(
  },
 );

-// Get all roles
-// GET /rbac/roles
+/**
+ * @openapi
+ * /rbac/roles:
+ *   get:
+ *     summary: Get all roles
+ *     description: Retrieves a list of all roles.
+ *     tags:
+ *       - RBAC
+ *     responses:
+ *       200:
+ *         description: A list of roles.
+ *       500:
+ *         description: Failed to get roles.
+ */
 router.get(
  "/roles",
  authenticateJWT,
@@ -413,8 +535,20 @@ router.get(
  },
 );

-// Get all roles
-// GET /rbac/roles
+/**
+ * @openapi
+ * /rbac/roles:
+ *   get:
+ *     summary: Get all roles
+ *     description: Retrieves a list of all roles.
+ *     tags:
+ *       - RBAC
+ *     responses:
+ *       200:
+ *         description: A list of roles.
+ *       500:
+ *         description: Failed to get roles.
+ */
 router.get(
  "/roles",
  authenticateJWT,
@@ -443,8 +577,37 @@ router.get(
  },
 );

-// Create new role
-// POST /rbac/roles
+/**
+ * @openapi
+ * /rbac/roles:
+ *   post:
+ *     summary: Create a new role
+ *     description: Creates a new role.
+ *     tags:
+ *       - RBAC
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               displayName:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Role created successfully.
+ *       400:
+ *         description: Invalid request body.
+ *       409:
+ *         description: A role with this name already exists.
+ *       500:
+ *         description: Failed to create role.
+ */
 router.post(
  "/roles",
  authenticateJWT,
@@ -503,14 +666,48 @@ router.post(
  },
 );

-// Update role
-// PUT /rbac/roles/:id
+/**
+ * @openapi
+ * /rbac/roles/{id}:
+ *   put:
+ *     summary: Update a role
+ *     description: Updates a role by its ID.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               displayName:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Role updated successfully.
+ *       400:
+ *         description: Invalid request body or role ID.
+ *       404:
+ *         description: Role not found.
+ *       500:
+ *         description: Failed to update role.
+ */
 router.put(
  "/roles/:id",
  authenticateJWT,
  permissionManager.requireAdmin(),
  async (req: AuthenticatedRequest, res: Response) => {
-    const roleId = parseInt(req.params.id, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const roleId = parseInt(id, 10);
    const { displayName, description } = req.body;

    if (isNaN(roleId)) {
@@ -570,14 +767,39 @@ router.put(
  },
 );

-// Delete role
-// DELETE /rbac/roles/:id
+/**
+ * @openapi
+ * /rbac/roles/{id}:
+ *   delete:
+ *     summary: Delete a role
+ *     description: Deletes a role by its ID.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Role deleted successfully.
+ *       400:
+ *         description: Invalid role ID.
+ *       403:
+ *         description: Cannot delete system roles.
+ *       404:
+ *         description: Role not found.
+ *       500:
+ *         description: Failed to delete role.
+ */
 router.delete(
  "/roles/:id",
  authenticateJWT,
  permissionManager.requireAdmin(),
  async (req: AuthenticatedRequest, res: Response) => {
-    const roleId = parseInt(req.params.id, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const roleId = parseInt(id, 10);

    if (isNaN(roleId)) {
      return res.status(400).json({ error: "Invalid role ID" });
@@ -634,14 +856,51 @@ router.delete(
  },
 );

-// Assign role to user
-// POST /rbac/users/:userId/roles
+/**
+ * @openapi
+ * /rbac/users/{userId}/roles:
+ *   post:
+ *     summary: Assign a role to a user
+ *     description: Assigns a role to a user.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: userId
+ *         required: true
+ *         schema:
+ *           type: string
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               roleId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Role assigned successfully.
+ *       400:
+ *         description: Role ID is required.
+ *       403:
+ *         description: System roles cannot be manually assigned.
+ *       404:
+ *         description: User or role not found.
+ *       409:
+ *         description: Role already assigned.
+ *       500:
+ *         description: Failed to assign role.
+ */
 router.post(
  "/users/:userId/roles",
  authenticateJWT,
  permissionManager.requireAdmin(),
  async (req: AuthenticatedRequest, res: Response) => {
-    const targetUserId = req.params.userId;
+    const targetUserId = Array.isArray(req.params.userId)
+      ? req.params.userId[0]
+      : req.params.userId;
    const currentUserId = req.userId!;

    try {
@@ -746,15 +1005,49 @@ router.post(
  },
 );

-// Remove role from user
-// DELETE /rbac/users/:userId/roles/:roleId
+/**
+ * @openapi
+ * /rbac/users/{userId}/roles/{roleId}:
+ *   delete:
+ *     summary: Remove a role from a user
+ *     description: Removes a role from a user.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: userId
+ *         required: true
+ *         schema:
+ *           type: string
+ *       - in: path
+ *         name: roleId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Role removed successfully.
+ *       400:
+ *         description: Invalid role ID.
+ *       403:
+ *         description: System roles cannot be removed.
+ *       404:
+ *         description: Role not found.
+ *       500:
+ *         description: Failed to remove role.
+ */
 router.delete(
  "/users/:userId/roles/:roleId",
  authenticateJWT,
  permissionManager.requireAdmin(),
  async (req: AuthenticatedRequest, res: Response) => {
-    const targetUserId = req.params.userId;
-    const roleId = parseInt(req.params.roleId, 10);
+    const targetUserId = Array.isArray(req.params.userId)
+      ? req.params.userId[0]
+      : req.params.userId;
+    const roleIdParam = Array.isArray(req.params.roleId)
+      ? req.params.roleId[0]
+      : req.params.roleId;
+    const roleId = parseInt(roleIdParam, 10);

    if (isNaN(roleId)) {
      return res.status(400).json({ error: "Invalid role ID" });
@@ -805,13 +1098,35 @@ router.delete(
  },
 );

-// Get user's roles
-// GET /rbac/users/:userId/roles
+/**
+ * @openapi
+ * /rbac/users/{userId}/roles:
+ *   get:
+ *     summary: Get user's roles
+ *     description: Retrieves a list of roles for a specific user.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: userId
+ *         required: true
+ *         schema:
+ *           type: string
+ *     responses:
+ *       200:
+ *         description: A list of roles.
+ *       403:
+ *         description: Access denied.
+ *       500:
+ *         description: Failed to get user roles.
+ */
 router.get(
  "/users/:userId/roles",
  authenticateJWT,
  async (req: AuthenticatedRequest, res: Response) => {
-    const targetUserId = req.params.userId;
+    const targetUserId = Array.isArray(req.params.userId)
+      ? req.params.userId[0]
+      : req.params.userId;
    const currentUserId = req.userId!;

    if (
@@ -17,8 +17,22 @@ const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 const requireDataAccess = authManager.createDataAccessMiddleware();

-// Get all snippet folders
-// GET /snippets/folders
+/**
+ * @openapi
+ * /snippets/folders:
+ *   get:
+ *     summary: Get all snippet folders
+ *     description: Retrieves all snippet folders for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     responses:
+ *       200:
+ *         description: A list of snippet folders.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to fetch snippet folders.
+ */
 router.get(
  "/folders",
  authenticateJWT,
@@ -46,8 +60,37 @@ router.get(
  },
 );

-// Create a new snippet folder
-// POST /snippets/folders
+/**
+ * @openapi
+ * /snippets/folders:
+ *   post:
+ *     summary: Create a new snippet folder
+ *     description: Creates a new snippet folder for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               color:
+ *                 type: string
+ *               icon:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Snippet folder created successfully.
+ *       400:
+ *         description: Folder name is required.
+ *       409:
+ *         description: Folder with this name already exists.
+ *       500:
+ *         description: Failed to create snippet folder.
+ */
 router.post(
  "/folders",
  authenticateJWT,
@@ -110,15 +153,50 @@ router.post(
  },
 );

-// Update snippet folder metadata (color, icon)
-// PUT /snippets/folders/:name/metadata
+/**
+ * @openapi
+ * /snippets/folders/{name}/metadata:
+ *   put:
+ *     summary: Update snippet folder metadata
+ *     description: Updates the metadata (color, icon) of a snippet folder.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: name
+ *         required: true
+ *         schema:
+ *           type: string
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               color:
+ *                 type: string
+ *               icon:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Snippet folder metadata updated successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Folder not found.
+ *       500:
+ *         description: Failed to update snippet folder metadata.
+ */
 router.put(
  "/folders/:name/metadata",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { name } = req.params;
+    const name = Array.isArray(req.params.name)
+      ? req.params.name[0]
+      : req.params.name;
    const { color, icon } = req.body;

    if (!isNonEmptyString(userId) || !name) {
@@ -194,8 +272,37 @@ router.put(
  },
 );

-// Rename snippet folder
-// PUT /snippets/folders/rename
+/**
+ * @openapi
+ * /snippets/folders/rename:
+ *   put:
+ *     summary: Rename a snippet folder
+ *     description: Renames a snippet folder for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               oldName:
+ *                 type: string
+ *               newName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Folder renamed successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Folder not found.
+ *       409:
+ *         description: Folder with new name already exists.
+ *       500:
+ *         description: Failed to rename snippet folder.
+ */
 router.put(
  "/folders/rename",
  authenticateJWT,
@@ -282,15 +389,37 @@ router.put(
  },
 );

-// Delete snippet folder
-// DELETE /snippets/folders/:name
+/**
+ * @openapi
+ * /snippets/folders/{name}:
+ *   delete:
+ *     summary: Delete a snippet folder
+ *     description: Deletes a snippet folder and moves its snippets to the root.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: name
+ *         required: true
+ *         schema:
+ *           type: string
+ *     responses:
+ *       200:
+ *         description: Snippet folder deleted successfully.
+ *       400:
+ *         description: Invalid request.
+ *       500:
+ *         description: Failed to delete snippet folder.
+ */
 router.delete(
  "/folders/:name",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { name } = req.params;
+    const name = Array.isArray(req.params.name)
+      ? req.params.name[0]
+      : req.params.name;

    if (!isNonEmptyString(userId) || !name) {
      authLogger.warn("Invalid request for snippet folder delete");
@@ -338,8 +467,40 @@ router.delete(
  },
 );

-// Reorder snippets (bulk update)
-// PUT /snippets/reorder
+/**
+ * @openapi
+ * /snippets/reorder:
+ *   put:
+ *     summary: Reorder snippets
+ *     description: Bulk updates the order and folder of snippets.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               snippets:
+ *                 type: array
+ *                 items:
+ *                   type: object
+ *                   properties:
+ *                     id:
+ *                       type: integer
+ *                     order:
+ *                       type: integer
+ *                     folder:
+ *                       type: string
+ *     responses:
+ *       200:
+ *         description: Snippets reordered successfully.
+ *       400:
+ *         description: Invalid request.
+ *       500:
+ *         description: Failed to reorder snippets.
+ */
 router.put(
  "/reorder",
  authenticateJWT,
@@ -405,8 +566,35 @@ router.put(
  },
 );

-// Execute a snippet on a host
-// POST /snippets/execute
+/**
+ * @openapi
+ * /snippets/execute:
+ *   post:
+ *     summary: Execute a snippet on a host
+ *     description: Executes a snippet on a specified host.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               snippetId:
+ *                 type: integer
+ *               hostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Snippet executed successfully.
+ *       400:
+ *         description: Snippet ID and Host ID are required.
+ *       404:
+ *         description: Snippet or host not found.
+ *       500:
+ *         description: Failed to execute snippet.
+ */
 router.post(
  "/execute",
  authenticateJWT,
@@ -662,8 +850,22 @@ router.post(
  },
 );

-// Get all snippets for the authenticated user
-// GET /snippets
+/**
+ * @openapi
+ * /snippets:
+ *   get:
+ *     summary: Get all snippets
+ *     description: Retrieves all snippets for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     responses:
+ *       200:
+ *         description: A list of snippets.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to fetch snippets.
+ */
 router.get(
  "/",
  authenticateJWT,
@@ -696,15 +898,37 @@ router.get(
  },
 );

-// Get a specific snippet by ID
-// GET /snippets/:id
+/**
+ * @openapi
+ * /snippets/{id}:
+ *   get:
+ *     summary: Get a specific snippet
+ *     description: Retrieves a specific snippet by its ID.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: The requested snippet.
+ *       400:
+ *         description: Invalid request parameters.
+ *       404:
+ *         description: Snippet not found.
+ *       500:
+ *         description: Failed to fetch snippet.
+ */
 router.get(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const snippetId = parseInt(id, 10);

    if (!isNonEmptyString(userId) || isNaN(snippetId)) {
@@ -735,8 +959,39 @@ router.get(
  },
 );

-// Create a new snippet
-// POST /snippets
+/**
+ * @openapi
+ * /snippets:
+ *   post:
+ *     summary: Create a new snippet
+ *     description: Creates a new snippet for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               content:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *               folder:
+ *                 type: string
+ *               order:
+ *                 type: integer
+ *     responses:
+ *       201:
+ *         description: Snippet created successfully.
+ *       400:
+ *         description: Name and content are required.
+ *       500:
+ *         description: Failed to create snippet.
+ */
 router.post(
  "/",
  authenticateJWT,
@@ -806,15 +1061,54 @@ router.post(
  },
 );

-// Update a snippet
-// PUT /snippets/:id
+/**
+ * @openapi
+ * /snippets/{id}:
+ *   put:
+ *     summary: Update a snippet
+ *     description: Updates a specific snippet by its ID.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               content:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *               folder:
+ *                 type: string
+ *               order:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: The updated snippet.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Snippet not found.
+ *       500:
+ *         description: Failed to update snippet.
+ */
 router.put(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const updateData = req.body;

    if (!isNonEmptyString(userId) || !id) {
@@ -883,15 +1177,37 @@ router.put(
  },
 );

-// Delete a snippet
-// DELETE /snippets/:id
+/**
+ * @openapi
+ * /snippets/{id}:
+ *   delete:
+ *     summary: Delete a snippet
+ *     description: Deletes a specific snippet by its ID.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Snippet deleted successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Snippet not found.
+ *       500:
+ *         description: Failed to delete snippet.
+ */
 router.delete(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;

    if (!isNonEmptyString(userId) || !id) {
      authLogger.warn("Invalid request for snippet delete");
@@ -17,8 +17,33 @@ const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 const requireDataAccess = authManager.createDataAccessMiddleware();

-// Save command to history
-// POST /terminal/command_history
+/**
+ * @openapi
+ * /terminal/command_history:
+ *   post:
+ *     summary: Save command to history
+ *     description: Saves a command to the command history for a specific host.
+ *     tags:
+ *       - Terminal
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *               command:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Command saved successfully.
+ *       400:
+ *         description: Missing required parameters.
+ *       500:
+ *         description: Failed to save command.
+ */
 router.post(
  "/command_history",
  authenticateJWT,
@@ -59,15 +84,37 @@ router.post(
  },
 );

-// Get command history for a specific host
-// GET /terminal/command_history/:hostId
+/**
+ * @openapi
+ * /terminal/command_history/{hostId}:
+ *   get:
+ *     summary: Get command history
+ *     description: Retrieves the command history for a specific host.
+ *     tags:
+ *       - Terminal
+ *     parameters:
+ *       - in: path
+ *         name: hostId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: A list of commands.
+ *       400:
+ *         description: Invalid request parameters.
+ *       500:
+ *         description: Failed to fetch history.
+ */
 router.get(
  "/command_history/:hostId",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { hostId } = req.params;
+    const hostId = Array.isArray(req.params.hostId)
+      ? req.params.hostId[0]
+      : req.params.hostId;
    const hostIdNum = parseInt(hostId, 10);

    if (!isNonEmptyString(userId) || isNaN(hostIdNum)) {
@@ -107,8 +154,33 @@ router.get(
  },
 );

-// Delete a specific command from history
-// POST /terminal/command_history/delete
+/**
+ * @openapi
+ * /terminal/command_history/delete:
+ *   post:
+ *     summary: Delete a specific command from history
+ *     description: Deletes a specific command from the history of a host.
+ *     tags:
+ *       - Terminal
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *               command:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Command deleted successfully.
+ *       400:
+ *         description: Missing required parameters.
+ *       500:
+ *         description: Failed to delete command.
+ */
 router.post(
  "/command_history/delete",
  authenticateJWT,
@@ -150,15 +222,37 @@ router.post(
  },
 );

-// Clear command history for a specific host (optional feature)
-// DELETE /terminal/command_history/:hostId
+/**
+ * @openapi
+ * /terminal/command_history/{hostId}:
+ *   delete:
+ *     summary: Clear command history
+ *     description: Clears the entire command history for a specific host.
+ *     tags:
+ *       - Terminal
+ *     parameters:
+ *       - in: path
+ *         name: hostId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Command history cleared successfully.
+ *       400:
+ *         description: Invalid request.
+ *       500:
+ *         description: Failed to clear history.
+ */
 router.delete(
  "/command_history/:hostId",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { hostId } = req.params;
+    const hostId = Array.isArray(req.params.hostId)
+      ? req.params.hostId[0]
+      : req.params.hostId;
    const hostIdNum = parseInt(hostId, 10);

    if (!isNonEmptyString(userId) || isNaN(hostIdNum)) {
@@ -0,0 +1,382 @@
+import { Client } from "ssh2";
+import type { WebSocket } from "ws";
+import { sshLogger } from "../utils/logger.js";
+import { getDb } from "../database/db/index.js";
+import { sshCredentials, sshData } from "../database/db/schema.js";
+import { eq, and } from "drizzle-orm";
+import { SimpleDBOps } from "../utils/simple-db-ops.js";
+import { UserCrypto } from "../utils/user-crypto.js";
+
+interface ResolvedCredentials {
+  username: string;
+  password?: string;
+  key?: Buffer;
+  keyPassword?: string;
+  authType?: string;
+}
+
+interface HostConfig {
+  id: number;
+  ip: string;
+  port: number;
+  username: string;
+  password?: string;
+  key?: string;
+  keyPassword?: string;
+  keyType?: string;
+  authType?: string;
+  credentialId?: number;
+  userId?: string;
+  forceKeyboardInteractive?: boolean;
+}
+
+interface AuthContext {
+  userId: string;
+  ws: WebSocket;
+  hostId: number;
+  isKeyboardInteractive: boolean;
+  keyboardInteractiveResponded: boolean;
+  keyboardInteractiveFinish: ((responses: string[]) => void) | null;
+  totpPromptSent: boolean;
+  warpgateAuthPromptSent: boolean;
+  totpTimeout: NodeJS.Timeout | null;
+  warpgateAuthTimeout: NodeJS.Timeout | null;
+  totpAttempts: number;
+}
+
+const userCrypto = UserCrypto.getInstance();
+const MAX_TOTP_ATTEMPTS = 3;
+
+export class SSHAuthManager {
+  public context: AuthContext;
+
+  constructor(context: AuthContext) {
+    this.context = context;
+  }
+
+  async resolveCredentials(
+    hostConfig: HostConfig,
+  ): Promise<ResolvedCredentials> {
+    let resolvedCredentials: ResolvedCredentials = {
+      username: hostConfig.username,
+      authType: hostConfig.authType || "none",
+    };
+
+    if (hostConfig.credentialId) {
+      const credentials = await SimpleDBOps.select(
+        getDb()
+          .select()
+          .from(sshCredentials)
+          .where(
+            and(
+              eq(sshCredentials.id, hostConfig.credentialId),
+              eq(sshCredentials.userId, this.context.userId),
+            ),
+          ),
+        "ssh_credentials",
+        this.context.userId,
+      );
+
+      if (credentials.length > 0) {
+        const cred = credentials[0];
+        resolvedCredentials = {
+          username: (cred.username as string) || hostConfig.username,
+          password: (cred.password as string) || undefined,
+          key: cred.privateKey
+            ? Buffer.from(cred.privateKey as string)
+            : undefined,
+          keyPassword: (cred.passphrase as string) || undefined,
+          authType: (cred.authType as string) || "none",
+        };
+      }
+    } else {
+      if (hostConfig.password) {
+        resolvedCredentials.password = hostConfig.password;
+        resolvedCredentials.authType = "password";
+      }
+
+      if (hostConfig.key) {
+        resolvedCredentials.key = Buffer.from(hostConfig.key, "utf8");
+        resolvedCredentials.authType = "key";
+
+        if (hostConfig.keyPassword) {
+          resolvedCredentials.keyPassword = hostConfig.keyPassword;
+        }
+      }
+    }
+
+    return resolvedCredentials;
+  }
+
+  handleKeyboardInteractive(
+    name: string,
+    instructions: string,
+    instructionsLang: string,
+    prompts: Array<{ prompt: string; echo: boolean }>,
+    finish: (responses: string[]) => void,
+    resolvedCredentials: ResolvedCredentials,
+  ): void {
+    this.context.isKeyboardInteractive = true;
+    const promptTexts = prompts.map((p) => p.prompt);
+
+    const warpgatePattern = /warpgate\s+authentication/i;
+    const isWarpgate =
+      warpgatePattern.test(name) ||
+      warpgatePattern.test(instructions) ||
+      promptTexts.some((p) => warpgatePattern.test(p));
+
+    if (isWarpgate) {
+      this.handleWarpgateAuth(name, instructions, promptTexts, finish);
+      return;
+    }
+
+    const totpPromptIndex = prompts.findIndex((p) =>
+      /verification code|verification_code|token|otp|2fa|authenticator|google.*auth/i.test(
+        p.prompt,
+      ),
+    );
+
+    if (totpPromptIndex !== -1) {
+      this.handleTotpAuth(
+        prompts,
+        totpPromptIndex,
+        finish,
+        resolvedCredentials,
+      );
+      return;
+    }
+
+    this.handlePasswordAuth(prompts, finish, resolvedCredentials);
+  }
+
+  private handleWarpgateAuth(
+    name: string,
+    instructions: string,
+    promptTexts: string[],
+    finish: (responses: string[]) => void,
+  ): void {
+    const fullText = `${name}\n${instructions}\n${promptTexts.join("\n")}`;
+
+    const urlMatch = fullText.match(/https?:\/\/[^\s\n]+/i);
+    const keyMatch = fullText.match(
+      /security key[:\s]+([a-z0-9](?:\s+[a-z0-9]){3}|[a-z0-9]{4})/i,
+    );
+
+    if (urlMatch) {
+      this.context.keyboardInteractiveFinish = (responses: string[]) => {
+        finish([""]);
+      };
+
+      this.context.warpgateAuthPromptSent = true;
+
+      this.sendLog("auth", "info", "Warpgate authentication required");
+
+      this.context.ws.send(
+        JSON.stringify({
+          type: "warpgate_auth_required",
+          url: urlMatch[0],
+          securityKey: keyMatch ? keyMatch[1] : "N/A",
+          instructions: instructions,
+        }),
+      );
+
+      this.context.warpgateAuthTimeout = setTimeout(() => {
+        if (this.context.keyboardInteractiveFinish) {
+          this.context.keyboardInteractiveFinish = null;
+          this.context.warpgateAuthPromptSent = false;
+          sshLogger.warn("Warpgate authentication timeout", {
+            operation: "warpgate_timeout",
+            hostId: this.context.hostId,
+          });
+          this.context.ws.send(
+            JSON.stringify({
+              type: "error",
+              message: "Warpgate authentication timeout. Please reconnect.",
+            }),
+          );
+        }
+      }, 300000);
+    }
+  }
+
+  private handleTotpAuth(
+    prompts: Array<{ prompt: string; echo: boolean }>,
+    totpPromptIndex: number,
+    finish: (responses: string[]) => void,
+    resolvedCredentials: ResolvedCredentials,
+  ): void {
+    if (this.context.totpPromptSent) {
+      sshLogger.warn("TOTP prompt asked again - invalid code", {
+        operation: "ssh_keyboard_interactive_totp_retry",
+        hostId: this.context.hostId,
+      });
+
+      this.sendLog("auth", "warning", "Invalid TOTP code");
+
+      this.context.ws.send(
+        JSON.stringify({
+          type: "totp_retry",
+        }),
+      );
+      return;
+    }
+
+    this.context.totpPromptSent = true;
+    this.context.keyboardInteractiveResponded = true;
+
+    this.context.keyboardInteractiveFinish = (totpResponses: string[]) => {
+      const totpCode = (totpResponses[0] || "").trim();
+
+      const responses = prompts.map((p, index) => {
+        if (index === totpPromptIndex) {
+          return totpCode;
+        }
+        if (/password/i.test(p.prompt) && resolvedCredentials.password) {
+          return resolvedCredentials.password;
+        }
+        return "";
+      });
+
+      finish(responses);
+    };
+
+    if (this.context.totpTimeout) {
+      clearTimeout(this.context.totpTimeout);
+    }
+
+    this.context.totpTimeout = setTimeout(() => {
+      if (this.context.keyboardInteractiveFinish) {
+        this.context.keyboardInteractiveFinish = null;
+        this.context.totpPromptSent = false;
+        sshLogger.warn("TOTP prompt timeout", {
+          operation: "totp_timeout",
+          hostId: this.context.hostId,
+        });
+        this.context.ws.send(
+          JSON.stringify({
+            type: "error",
+            message: "TOTP verification timeout. Please reconnect.",
+          }),
+        );
+      }
+    }, 180000);
+
+    this.sendLog("auth", "info", "TOTP verification required");
+
+    this.context.ws.send(
+      JSON.stringify({
+        type: "totp_required",
+        prompt: prompts[totpPromptIndex].prompt,
+      }),
+    );
+  }
+
+  private handlePasswordAuth(
+    prompts: Array<{ prompt: string; echo: boolean }>,
+    finish: (responses: string[]) => void,
+    resolvedCredentials: ResolvedCredentials,
+  ): void {
+    const hasStoredPassword =
+      resolvedCredentials.password && resolvedCredentials.authType !== "none";
+
+    const passwordPromptIndex = prompts.findIndex((p) =>
+      /password/i.test(p.prompt),
+    );
+
+    if (!hasStoredPassword && passwordPromptIndex !== -1) {
+      if (this.context.keyboardInteractiveResponded) {
+        return;
+      }
+      this.context.keyboardInteractiveResponded = true;
+
+      this.context.keyboardInteractiveFinish = (userResponses: string[]) => {
+        const userInput = (userResponses[0] || "").trim();
+
+        const responses = prompts.map((p, index) => {
+          if (index === passwordPromptIndex) {
+            return userInput;
+          }
+          return "";
+        });
+
+        finish(responses);
+      };
+
+      if (this.context.totpTimeout) {
+        clearTimeout(this.context.totpTimeout);
+      }
+
+      this.context.totpTimeout = setTimeout(() => {
+        if (this.context.keyboardInteractiveFinish) {
+          this.context.keyboardInteractiveFinish = null;
+          this.context.keyboardInteractiveResponded = false;
+          sshLogger.warn("Password prompt timeout", {
+            operation: "password_timeout",
+            hostId: this.context.hostId,
+          });
+          this.context.ws.send(
+            JSON.stringify({
+              type: "error",
+              message: "Password verification timeout. Please reconnect.",
+            }),
+          );
+        }
+      }, 180000);
+
+      this.sendLog("auth", "info", "Password authentication required");
+
+      this.context.ws.send(
+        JSON.stringify({
+          type: "password_required",
+          prompt: prompts[passwordPromptIndex].prompt,
+        }),
+      );
+      return;
+    }
+
+    const responses = prompts.map((p) => {
+      if (/password/i.test(p.prompt) && resolvedCredentials.password) {
+        return resolvedCredentials.password;
+      }
+      return "";
+    });
+
+    finish(responses);
+  }
+
+  sendLog(
+    stage: string,
+    level: string,
+    message: string,
+    details?: Record<string, any>,
+  ): void {
+    this.context.ws.send(
+      JSON.stringify({
+        type: "connection_log",
+        data: {
+          stage,
+          level,
+          message,
+          details,
+        },
+      }),
+    );
+  }
+
+  cleanup(): void {
+    if (this.context.totpTimeout) {
+      clearTimeout(this.context.totpTimeout);
+      this.context.totpTimeout = null;
+    }
+
+    if (this.context.warpgateAuthTimeout) {
+      clearTimeout(this.context.warpgateAuthTimeout);
+      this.context.warpgateAuthTimeout = null;
+    }
+
+    this.context.keyboardInteractiveFinish = null;
+    this.context.totpPromptSent = false;
+    this.context.warpgateAuthPromptSent = false;
+    this.context.keyboardInteractiveResponded = false;
+  }
+}
@@ -11,6 +11,7 @@ import { SimpleDBOps } from "../utils/simple-db-ops.js";
 import { AuthManager } from "../utils/auth-manager.js";
 import { PermissionManager } from "../utils/permission-manager.js";
 import type { AuthenticatedRequest, ProxyNode } from "../../types/index.js";
+import type { LogEntry, ConnectionStage } from "../../types/connection-log.js";
 import { collectCpuMetrics } from "./widgets/cpu-collector.js";
 import { collectMemoryMetrics } from "./widgets/memory-collector.js";
 import { collectDiskMetrics } from "./widgets/disk-collector.js";
@@ -19,8 +20,24 @@ import { collectUptimeMetrics } from "./widgets/uptime-collector.js";
 import { collectProcessesMetrics } from "./widgets/processes-collector.js";
 import { collectSystemMetrics } from "./widgets/system-collector.js";
 import { collectLoginStats } from "./widgets/login-stats-collector.js";
+import { collectPortsMetrics } from "./widgets/ports-collector.js";
+import { collectFirewallMetrics } from "./widgets/firewall-collector.js";
 import { createSocks5Connection } from "../utils/socks5-helper.js";

+function createConnectionLog(
+  type: "info" | "success" | "warning" | "error",
+  stage: ConnectionStage,
+  message: string,
+  details?: Record<string, any>,
+): Omit<LogEntry, "id" | "timestamp"> {
+  return {
+    type,
+    stage,
+    message,
+    details,
+  };
+}
+
 async function resolveJumpHost(
  hostId: number,
  userId: string,
@@ -1283,12 +1300,6 @@ class PollingManager {

    for (const [sessionId, viewer] of this.viewerDetails.entries()) {
      if (now - viewer.lastHeartbeat > maxInactivity) {
-        statsLogger.warn("Cleaning up inactive viewer", {
-          operation: "cleanup_inactive_viewer",
-          sessionId,
-          hostId: viewer.hostId,
-          inactiveFor: Math.floor((now - viewer.lastHeartbeat) / 1000),
-        });
        this.unregisterViewer(viewer.hostId, sessionId);
      }
    }
@@ -1782,6 +1793,62 @@ async function collectMetrics(host: SSHHostWithCredentials): Promise<{
          login_stats = await collectLoginStats(client);
        } catch (e) {}

+        let ports: {
+          source: "ss" | "netstat" | "none";
+          ports: Array<{
+            protocol: "tcp" | "udp";
+            localAddress: string;
+            localPort: number;
+            state?: string;
+            pid?: number;
+            process?: string;
+          }>;
+        } = {
+          source: "none",
+          ports: [],
+        };
+        try {
+          ports = await collectPortsMetrics(client);
+        } catch (e) {
+          statsLogger.debug("Failed to collect ports metrics", {
+            operation: "ports_metrics_failed",
+            error: e instanceof Error ? e.message : String(e),
+          });
+        }
+
+        let firewall: {
+          type: "iptables" | "nftables" | "none";
+          status: "active" | "inactive" | "unknown";
+          chains: Array<{
+            name: string;
+            policy: string;
+            rules: Array<{
+              chain: string;
+              target: string;
+              protocol: string;
+              source: string;
+              destination: string;
+              dport?: string;
+              sport?: string;
+              state?: string;
+              interface?: string;
+              extra?: string;
+            }>;
+          }>;
+        } = {
+          type: "none",
+          status: "unknown",
+          chains: [],
+        };
+        try {
+          firewall = await collectFirewallMetrics(client);
+        } catch (e) {
+          statsLogger.debug("Failed to collect firewall metrics", {
+            operation: "firewall_metrics_failed",
+            error: e instanceof Error ? e.message : String(e),
+          });
+        }
+
        const result = {
          cpu,
          memory,
@@ -1791,6 +1858,8 @@ async function collectMetrics(host: SSHHostWithCredentials): Promise<{
          processes,
          system,
          login_stats,
+          ports,
+          firewall,
        };

        metricsCache.set(host.id, result);
@@ -1864,6 +1933,20 @@ function tcpPing(
  });
 }

+/**
+ * @openapi
+ * /status:
+ *   get:
+ *     summary: Get all host statuses
+ *     description: Retrieves the status of all hosts for the authenticated user.
+ *     tags:
+ *       - Server Stats
+ *     responses:
+ *       200:
+ *         description: A map of host IDs to their status entries.
+ *       401:
+ *         description: Session expired - please log in again.
+ */
 app.get("/status", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;

@@ -1886,6 +1969,28 @@ app.get("/status", async (req, res) => {
  res.json(result);
 });

+/**
+ * @openapi
+ * /status/{id}:
+ *   get:
+ *     summary: Get host status by ID
+ *     description: Retrieves the status of a specific host by its ID.
+ *     tags:
+ *       - Server Stats
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Host status entry.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Status not available.
+ */
 app.get("/status/:id", validateHostId, async (req, res) => {
  const id = Number(req.params.id);
  const userId = (req as AuthenticatedRequest).userId;
@@ -1910,6 +2015,20 @@ app.get("/status/:id", validateHostId, async (req, res) => {
  res.json(statusEntry);
 });

+/**
+ * @openapi
+ * /clear-connections:
+ *   post:
+ *     summary: Clear all SSH connections
+ *     description: Clears all SSH connections from the connection pool.
+ *     tags:
+ *       - Server Stats
+ *     responses:
+ *       200:
+ *         description: All SSH connections cleared.
+ *       401:
+ *         description: Session expired - please log in again.
+ */
 app.post("/clear-connections", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;

@@ -1924,6 +2043,20 @@ app.post("/clear-connections", async (req, res) => {
  res.json({ message: "All SSH connections cleared" });
 });

+/**
+ * @openapi
+ * /refresh:
+ *   post:
+ *     summary: Refresh polling
+ *     description: Clears all SSH connections and refreshes host polling.
+ *     tags:
+ *       - Server Stats
+ *     responses:
+ *       200:
+ *         description: Polling refreshed.
+ *       401:
+ *         description: Session expired - please log in again.
+ */
 app.post("/refresh", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;

@@ -1940,6 +2073,35 @@ app.post("/refresh", async (req, res) => {
  res.json({ message: "Polling refreshed" });
 });

+/**
+ * @openapi
+ * /host-updated:
+ *   post:
+ *     summary: Start polling for updated host
+ *     description: Starts polling for a specific host after it has been updated.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Host polling started.
+ *       400:
+ *         description: Invalid hostId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Host not found.
+ *       500:
+ *         description: Failed to start polling.
+ */
 app.post("/host-updated", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;
  const { hostId } = req.body;
@@ -1975,6 +2137,33 @@ app.post("/host-updated", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /host-deleted:
+ *   post:
+ *     summary: Stop polling for deleted host
+ *     description: Stops polling for a specific host after it has been deleted.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Host polling stopped.
+ *       400:
+ *         description: Invalid hostId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       500:
+ *         description: Failed to stop polling.
+ */
 app.post("/host-deleted", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;
  const { hostId } = req.body;
@@ -2003,6 +2192,28 @@ app.post("/host-deleted", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/{id}:
+ *   get:
+ *     summary: Get host metrics
+ *     description: Retrieves current metrics for a specific host including CPU, memory, disk, network, processes, and system information.
+ *     tags:
+ *       - Server Stats
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Host metrics data.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Metrics not available.
+ */
 app.get("/metrics/:id", validateHostId, async (req, res) => {
  const id = Number(req.params.id);
  const userId = (req as AuthenticatedRequest).userId;
@@ -2040,28 +2251,102 @@ app.get("/metrics/:id", validateHostId, async (req, res) => {
  });
 });

+/**
+ * @openapi
+ * /metrics/start/{id}:
+ *   post:
+ *     summary: Start metrics collection
+ *     description: Establishes an SSH connection and starts collecting metrics for a specific host.
+ *     tags:
+ *       - Server Stats
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Metrics collection started successfully, or TOTP required.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Host not found.
+ *       500:
+ *         description: Failed to start metrics collection.
+ */
 app.post("/metrics/start/:id", validateHostId, async (req, res) => {
  const id = Number(req.params.id);
  const userId = (req as AuthenticatedRequest).userId;

+  const connectionLogs: Array<Omit<LogEntry, "id" | "timestamp">> = [];
+
  if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+    connectionLogs.push(
+      createConnectionLog("error", "stats_connecting", "Session expired"),
+    );
    return res.status(401).json({
      error: "Session expired - please log in again",
      code: "SESSION_EXPIRED",
+      connectionLogs,
    });
  }

  try {
    const host = await fetchHostById(id, userId);
    if (!host) {
-      return res.status(404).json({ error: "Host not found" });
+      connectionLogs.push(
+        createConnectionLog("error", "stats_connecting", "Host not found"),
+      );
+      return res.status(404).json({ error: "Host not found", connectionLogs });
+    }
+
+    connectionLogs.push(
+      createConnectionLog(
+        "info",
+        "stats_connecting",
+        "Starting metrics collection",
+      ),
+    );
+
+    connectionLogs.push(
+      createConnectionLog("info", "dns", `Resolving DNS for ${host.ip}`),
+    );
+
+    connectionLogs.push(
+      createConnectionLog(
+        "info",
+        "tcp",
+        `Connecting to ${host.ip}:${host.port}`,
+      ),
+    );
+
+    connectionLogs.push(
+      createConnectionLog("info", "handshake", "Initiating SSH handshake"),
+    );
+
+    if (host.authType === "password") {
+      connectionLogs.push(
+        createConnectionLog("info", "auth", "Authenticating with password"),
+      );
+    } else if (host.authType === "key") {
+      connectionLogs.push(
+        createConnectionLog("info", "auth", "Authenticating with SSH key"),
+      );
    }

    const sessionKey = getSessionKey(host.id, userId);

    const existingSession = metricsSessions[sessionKey];
    if (existingSession && existingSession.isConnected) {
-      return res.json({ success: true });
+      connectionLogs.push(
+        createConnectionLog(
+          "success",
+          "stats_polling",
+          "Using existing metrics session",
+        ),
+      );
+      return res.json({ success: true, connectionLogs });
    }

    const config = buildSshConfig(host);
@@ -2113,6 +2398,14 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
              totpAttempts: 0,
            };

+            connectionLogs.push(
+              createConnectionLog(
+                "info",
+                "stats_totp",
+                "TOTP verification required",
+              ),
+            );
+
            clearTimeout(timeout);
            if (!isResolved) {
              isResolved = true;
@@ -2141,6 +2434,22 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
        if (!isResolved) {
          isResolved = true;

+          connectionLogs.push(
+            createConnectionLog(
+              "success",
+              "connected",
+              "SSH connection established successfully",
+            ),
+          );
+
+          connectionLogs.push(
+            createConnectionLog(
+              "success",
+              "stats_polling",
+              "Metrics session established",
+            ),
+          );
+
          metricsSessions[sessionKey] = {
            client,
            isConnected: true,
@@ -2162,10 +2471,73 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
        clearTimeout(timeout);
        if (!isResolved) {
          isResolved = true;
+
+          const errorMessage =
+            error instanceof Error ? error.message : String(error);
+          let errorStage: ConnectionStage = "error";
+
+          if (
+            errorMessage.includes("ENOTFOUND") ||
+            errorMessage.includes("getaddrinfo")
+          ) {
+            errorStage = "dns";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `DNS resolution failed: ${errorMessage}`,
+              ),
+            );
+          } else if (
+            errorMessage.includes("ECONNREFUSED") ||
+            errorMessage.includes("ETIMEDOUT")
+          ) {
+            errorStage = "tcp";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `TCP connection failed: ${errorMessage}`,
+              ),
+            );
+          } else if (
+            errorMessage.includes("handshake") ||
+            errorMessage.includes("key exchange")
+          ) {
+            errorStage = "handshake";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `SSH handshake failed: ${errorMessage}`,
+              ),
+            );
+          } else if (
+            errorMessage.includes("authentication") ||
+            errorMessage.includes("Authentication")
+          ) {
+            errorStage = "auth";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `Authentication failed: ${errorMessage}`,
+              ),
+            );
+          } else {
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                "error",
+                `SSH connection failed: ${errorMessage}`,
+              ),
+            );
+          }
+
          statsLogger.error("SSH connection error in metrics/start", {
            operation: "metrics_start_ssh_error",
            hostId: host.id,
-            error: error instanceof Error ? error.message : String(error),
+            error: errorMessage,
          });
          reject(error);
        }
@@ -2176,6 +2548,9 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
        (host.socks5Host ||
          (host.socks5ProxyChain && host.socks5ProxyChain.length > 0))
      ) {
+        connectionLogs.push(
+          createConnectionLog("info", "proxy", "Connecting via SOCKS5 proxy"),
+        );
        createSocks5Connection(host.ip, host.port, {
          useSocks5: host.useSocks5,
          socks5Host: host.socks5Host,
@@ -2194,6 +2569,13 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
            if (!isResolved) {
              isResolved = true;
              clearTimeout(timeout);
+              connectionLogs.push(
+                createConnectionLog(
+                  "error",
+                  "proxy",
+                  `SOCKS5 proxy connection failed: ${error instanceof Error ? error.message : "Unknown error"}`,
+                ),
+              );
              reject(error);
            }
          });
@@ -2203,22 +2585,61 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
    });

    const result = await connectionPromise;
-    res.json(result);
+    res.json({ ...result, connectionLogs });
  } catch (error) {
    statsLogger.error("Failed to start metrics collection", {
      operation: "metrics_start_error",
      hostId: id,
      error: error instanceof Error ? error.message : String(error),
    });
+    connectionLogs.push(
+      createConnectionLog(
+        "error",
+        "stats_connecting",
+        `Failed to start metrics: ${error instanceof Error ? error.message : "Unknown error"}`,
+      ),
+    );
    res.status(500).json({
      error:
        error instanceof Error
          ? error.message
          : "Failed to start metrics collection",
+      connectionLogs,
    });
  }
 });

+/**
+ * @openapi
+ * /metrics/stop/{id}:
+ *   post:
+ *     summary: Stop metrics collection
+ *     description: Stops metrics collection for a specific host and cleans up the SSH session.
+ *     tags:
+ *       - Server Stats
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: false
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               viewerSessionId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Metrics collection stopped successfully.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       500:
+ *         description: Failed to stop metrics collection.
+ */
 app.post("/metrics/stop/:id", validateHostId, async (req, res) => {
  const id = Number(req.params.id);
  const userId = (req as AuthenticatedRequest).userId;
@@ -2261,6 +2682,37 @@ app.post("/metrics/stop/:id", validateHostId, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/connect-totp:
+ *   post:
+ *     summary: Complete TOTP verification for metrics
+ *     description: Verifies the TOTP code and completes the metrics SSH connection.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               sessionId:
+ *                 type: string
+ *               totpCode:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: TOTP verified, metrics connection established.
+ *       400:
+ *         description: Missing sessionId or totpCode.
+ *       401:
+ *         description: Session expired or invalid TOTP code.
+ *       404:
+ *         description: TOTP session not found or expired.
+ *       500:
+ *         description: Failed to verify TOTP.
+ */
 app.post("/metrics/connect-totp", async (req, res) => {
  const { sessionId, totpCode } = req.body;
  const userId = (req as AuthenticatedRequest).userId;
@@ -2396,6 +2848,35 @@ app.post("/metrics/connect-totp", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/heartbeat:
+ *   post:
+ *     summary: Update viewer heartbeat
+ *     description: Updates the heartbeat timestamp for a metrics viewer session to keep it alive.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               viewerSessionId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Heartbeat updated successfully.
+ *       400:
+ *         description: Invalid viewerSessionId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Viewer session not found.
+ *       500:
+ *         description: Failed to update heartbeat.
+ */
 app.post("/metrics/heartbeat", async (req, res) => {
  const { viewerSessionId } = req.body;
  const userId = (req as AuthenticatedRequest).userId;
@@ -2428,6 +2909,33 @@ app.post("/metrics/heartbeat", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/register-viewer:
+ *   post:
+ *     summary: Register metrics viewer
+ *     description: Registers a new viewer session for a host to track who is viewing metrics.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Viewer registered successfully.
+ *       400:
+ *         description: Invalid hostId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       500:
+ *         description: Failed to register viewer.
+ */
 app.post("/metrics/register-viewer", async (req, res) => {
  const { hostId } = req.body;
  const userId = (req as AuthenticatedRequest).userId;
@@ -2458,6 +2966,35 @@ app.post("/metrics/register-viewer", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/unregister-viewer:
+ *   post:
+ *     summary: Unregister metrics viewer
+ *     description: Unregisters a viewer session when they stop viewing metrics for a host.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *               viewerSessionId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Viewer unregistered successfully.
+ *       400:
+ *         description: Invalid hostId or viewerSessionId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       500:
+ *         description: Failed to unregister viewer.
+ */
 app.post("/metrics/unregister-viewer", async (req, res) => {
  const { hostId, viewerSessionId } = req.body;
  const userId = (req as AuthenticatedRequest).userId;
@@ -15,6 +15,7 @@ import { SimpleDBOps } from "../utils/simple-db-ops.js";
 import { AuthManager } from "../utils/auth-manager.js";
 import { UserCrypto } from "../utils/user-crypto.js";
 import { createSocks5Connection } from "../utils/socks5-helper.js";
+import { SSHAuthManager } from "./auth-manager.js";

 interface ConnectToHostData {
  cols: number;
@@ -331,7 +332,6 @@ wss.on("connection", async (ws: WebSocket, req) => {
  let sshStream: ClientChannel | null = null;
  let keyboardInteractiveFinish: ((responses: string[]) => void) | null = null;
  let totpPromptSent = false;
-  let totpAttempts = 0;
  let totpTimeout: NodeJS.Timeout | null = null;
  let isKeyboardInteractive = false;
  let keyboardInteractiveResponded = false;
@@ -339,6 +339,9 @@ wss.on("connection", async (ws: WebSocket, req) => {
  let isConnected = false;
  let isCleaningUp = false;
  let isShellInitializing = false;
+  let warpgateAuthPromptSent = false;
+  let warpgateAuthTimeout: NodeJS.Timeout | null = null;
+  let isAwaitingAuthCredentials = false;

  ws.on("close", () => {
    const userWs = userConnections.get(userId);
@@ -454,7 +457,6 @@ wss.on("connection", async (ws: WebSocket, req) => {
            totpTimeout = null;
          }
          const totpCode = totpData.code;
-          totpAttempts++;
          keyboardInteractiveFinish([totpCode]);
          keyboardInteractiveFinish = null;
          totpPromptSent = false;
@@ -505,6 +507,19 @@ wss.on("connection", async (ws: WebSocket, req) => {
        break;
      }

+      case "warpgate_auth_continue": {
+        if (keyboardInteractiveFinish) {
+          if (warpgateAuthTimeout) {
+            clearTimeout(warpgateAuthTimeout);
+            warpgateAuthTimeout = null;
+          }
+          keyboardInteractiveFinish([""]);
+          keyboardInteractiveFinish = null;
+          warpgateAuthPromptSent = false;
+        }
+        break;
+      }
+
      case "reconnect_with_credentials": {
        const credentialsData = data as {
          cols: number;
@@ -525,6 +540,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
          credentialsData.hostConfig.authType = "key";
        }

+        isAwaitingAuthCredentials = false;
        cleanupSSH();

        const reconnectData: ConnectToHostData = {
@@ -576,6 +592,20 @@ wss.on("connection", async (ws: WebSocket, req) => {
      credentialId,
    } = hostConfig;

+    const sendLog = (
+      stage: string,
+      level: string,
+      message: string,
+      details?: Record<string, any>,
+    ) => {
+      ws.send(
+        JSON.stringify({
+          type: "connection_log",
+          data: { stage, level, message, details },
+        }),
+      );
+    };
+
    if (!username || typeof username !== "string" || username.trim() === "") {
      sshLogger.error("Invalid username provided", undefined, {
        operation: "ssh_connect",
@@ -634,6 +664,9 @@ wss.on("connection", async (ws: WebSocket, req) => {
    isConnecting = true;
    sshConn = new Client();

+    sendLog("dns", "info", `Starting address resolution of ${ip}`);
+    sendLog("tcp", "info", `Connecting to ${ip} port ${port}`);
+
    const connectionTimeout = setTimeout(() => {
      if (sshConn && isConnecting && !isConnected) {
        sshLogger.error("SSH connection timeout", undefined, {
@@ -648,7 +681,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
        );
        cleanupSSH(connectionTimeout);
      }
-    }, 30000);
+    }, 120000);

    let resolvedCredentials = { password, key, keyPassword, keyType, authType };
    let authMethodNotAvailable = false;
@@ -713,6 +746,10 @@ wss.on("connection", async (ws: WebSocket, req) => {
    sshConn.on("ready", () => {
      clearTimeout(connectionTimeout);

+      sendLog("handshake", "success", "SSH handshake completed");
+      sendLog("auth", "success", `Authentication successful for ${username}`);
+      sendLog("connected", "success", "Connection established");
+
      const conn = sshConn;

      if (!conn || isCleaningUp || !sshConn) {
@@ -761,6 +798,36 @@ wss.on("connection", async (ws: WebSocket, req) => {
        return;
      }

+      sshLogger.info("Creating shell", {
+        operation: "ssh_shell_start",
+        hostId: id,
+        ip,
+        port,
+        username,
+      });
+
+      let shellCallbackReceived = false;
+      const shellTimeout = setTimeout(() => {
+        if (!shellCallbackReceived && isShellInitializing) {
+          sshLogger.error("Shell creation timeout - no response from server", {
+            operation: "ssh_shell_timeout",
+            hostId: id,
+            ip,
+            port,
+            username,
+          });
+          isShellInitializing = false;
+          ws.send(
+            JSON.stringify({
+              type: "error",
+              message:
+                "Shell creation timeout. The server may not support interactive shells or the connection was interrupted.",
+            }),
+          );
+          cleanupSSH(connectionTimeout);
+        }
+      }, 15000);
+
      conn.shell(
        {
          rows: data.rows,
@@ -768,6 +835,8 @@ wss.on("connection", async (ws: WebSocket, req) => {
          term: "xterm-256color",
        } as PseudoTtyOptions,
        (err, stream) => {
+          shellCallbackReceived = true;
+          clearTimeout(shellTimeout);
          isShellInitializing = false;

          if (err) {
@@ -784,6 +853,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
                message: "Shell error: " + err.message,
              }),
            );
+            cleanupSSH(connectionTimeout);
            return;
          }

@@ -902,21 +972,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
    sshConn.on("error", (err: Error) => {
      clearTimeout(connectionTimeout);

-      if (
-        (authMethodNotAvailable && resolvedCredentials.authType === "none") ||
-        (resolvedCredentials.authType === "none" &&
-          err.message.includes("All configured authentication methods failed"))
-      ) {
-        ws.send(
-          JSON.stringify({
-            type: "auth_method_not_available",
-            message:
-              "The server does not support keyboard-interactive authentication. Please provide credentials.",
-          }),
-        );
-        cleanupSSH(connectionTimeout);
-        return;
-      }
+      sendLog("error", "error", `Connection error: ${err.message}`);

      sshLogger.error("SSH connection error", err, {
        operation: "ssh_connect",
@@ -925,8 +981,99 @@ wss.on("connection", async (ws: WebSocket, req) => {
        port,
        username,
        authType: resolvedCredentials.authType,
+        warpgateAuthPromptSent,
+        isKeyboardInteractive,
+        hasKeyboardInteractiveFinish: !!keyboardInteractiveFinish,
+        keyboardInteractiveResponded,
      });

+      if (
+        authMethodNotAvailable &&
+        resolvedCredentials.authType === "none" &&
+        !isKeyboardInteractive
+      ) {
+        sendLog(
+          "auth",
+          "error",
+          "Server does not support keyboard-interactive authentication",
+        );
+        clearTimeout(connectionTimeout);
+        isAwaitingAuthCredentials = true;
+        if (sshConn) {
+          try {
+            sshConn.end();
+          } catch (e) {}
+          sshConn = null;
+        }
+        isConnecting = false;
+        isConnected = false;
+        ws.send(
+          JSON.stringify({
+            type: "auth_method_not_available",
+            message:
+              "The server does not support keyboard-interactive authentication. Please provide credentials.",
+          }),
+        );
+        return;
+      }
+
+      if (
+        resolvedCredentials.authType === "none" &&
+        err.message.includes("All configured authentication methods failed") &&
+        !isKeyboardInteractive &&
+        !keyboardInteractiveResponded
+      ) {
+        clearTimeout(connectionTimeout);
+        isAwaitingAuthCredentials = true;
+        if (sshConn) {
+          try {
+            sshConn.end();
+          } catch (e) {}
+          sshConn = null;
+        }
+        isConnecting = false;
+        isConnected = false;
+        ws.send(
+          JSON.stringify({
+            type: "auth_method_not_available",
+            message:
+              "The server does not support keyboard-interactive authentication. Please provide credentials.",
+          }),
+        );
+        return;
+      }
+
+      if (
+        isKeyboardInteractive &&
+        keyboardInteractiveFinish &&
+        err.message.includes("All configured authentication methods failed")
+      ) {
+        sshLogger.warn(
+          "Authentication error during keyboard-interactive - SKIPPING cleanup, waiting for user response",
+          {
+            operation: "ssh_error_during_keyboard_interactive_skip_cleanup",
+            hostId: id,
+            error: err.message,
+          },
+        );
+        return;
+      }
+
+      sshLogger.error("Proceeding with cleanup after error", {
+        operation: "ssh_error_cleanup",
+        hostId: id,
+        error: err.message,
+      });
+
+      if (
+        err.message.includes("authentication") ||
+        err.message.includes("Authentication")
+      ) {
+        sendLog("auth", "error", `Authentication failed: ${err.message}`);
+      } else {
+        sendLog("error", "error", `Connection failed: ${err.message}`);
+      }
+
      let errorMessage = "SSH error: " + err.message;
      if (err.message.includes("No matching key exchange algorithm")) {
        errorMessage =
@@ -969,9 +1116,54 @@ wss.on("connection", async (ws: WebSocket, req) => {

    sshConn.on("close", () => {
      clearTimeout(connectionTimeout);
+
+      if (isAwaitingAuthCredentials) {
+        cleanupSSH(connectionTimeout);
+        return;
+      }
+
+      if (isShellInitializing || (isConnected && !sshStream)) {
+        sshLogger.warn("SSH connection closed during shell initialization", {
+          operation: "ssh_close_during_init",
+          hostId: id,
+          ip,
+          port,
+          username,
+          isShellInitializing,
+          hasStream: !!sshStream,
+        });
+        ws.send(
+          JSON.stringify({
+            type: "error",
+            message:
+              "Connection closed during shell initialization. The server may have rejected the shell request.",
+          }),
+        );
+      } else if (!sshStream) {
+        ws.send(
+          JSON.stringify({
+            type: "disconnected",
+            message: "Connection closed",
+          }),
+        );
+      }
      cleanupSSH(connectionTimeout);
    });

+    const sshAuthManager = new SSHAuthManager({
+      userId,
+      ws,
+      hostId: id || 0,
+      isKeyboardInteractive,
+      keyboardInteractiveResponded,
+      keyboardInteractiveFinish,
+      totpPromptSent,
+      warpgateAuthPromptSent,
+      totpTimeout,
+      warpgateAuthTimeout,
+      totpAttempts: 0,
+    });
+
    sshConn.on(
      "keyboard-interactive",
      (
@@ -981,130 +1173,28 @@ wss.on("connection", async (ws: WebSocket, req) => {
        prompts: Array<{ prompt: string; echo: boolean }>,
        finish: (responses: string[]) => void,
      ) => {
-        isKeyboardInteractive = true;
-        const promptTexts = prompts.map((p) => p.prompt);
-        const totpPromptIndex = prompts.findIndex((p) =>
-          /verification code|verification_code|token|otp|2fa|authenticator|google.*auth/i.test(
-            p.prompt,
-          ),
+        if (connectionTimeout) {
+          clearTimeout(connectionTimeout);
+        }
+
+        sshAuthManager.handleKeyboardInteractive(
+          name,
+          instructions,
+          instructionsLang,
+          prompts,
+          finish,
+          resolvedCredentials as any,
        );

-        if (totpPromptIndex !== -1) {
-          if (totpPromptSent) {
-            sshLogger.warn("TOTP prompt asked again - ignoring duplicate", {
-              operation: "ssh_keyboard_interactive_totp_duplicate",
-              hostId: id,
-              prompts: promptTexts,
-            });
-            return;
-          }
-          totpPromptSent = true;
-          keyboardInteractiveResponded = true;
-
-          keyboardInteractiveFinish = (totpResponses: string[]) => {
-            const totpCode = (totpResponses[0] || "").trim();
-
-            const responses = prompts.map((p, index) => {
-              if (index === totpPromptIndex) {
-                return totpCode;
-              }
-              if (/password/i.test(p.prompt) && resolvedCredentials.password) {
-                return resolvedCredentials.password;
-              }
-              return "";
-            });
-
-            finish(responses);
-          };
-
-          totpTimeout = setTimeout(() => {
-            if (keyboardInteractiveFinish) {
-              keyboardInteractiveFinish = null;
-              totpPromptSent = false;
-              sshLogger.warn("TOTP prompt timeout", {
-                operation: "totp_timeout",
-                hostId: id,
-              });
-              ws.send(
-                JSON.stringify({
-                  type: "error",
-                  message: "TOTP verification timeout. Please reconnect.",
-                }),
-              );
-              cleanupSSH(connectionTimeout);
-            }
-          }, 180000);
-
-          ws.send(
-            JSON.stringify({
-              type: "totp_required",
-              prompt: prompts[totpPromptIndex].prompt,
-            }),
-          );
-        } else {
-          const hasStoredPassword =
-            resolvedCredentials.password &&
-            resolvedCredentials.authType !== "none";
-
-          const passwordPromptIndex = prompts.findIndex((p) =>
-            /password/i.test(p.prompt),
-          );
-
-          if (!hasStoredPassword && passwordPromptIndex !== -1) {
-            if (keyboardInteractiveResponded) {
-              return;
-            }
-            keyboardInteractiveResponded = true;
-
-            keyboardInteractiveFinish = (userResponses: string[]) => {
-              const userInput = (userResponses[0] || "").trim();
-
-              const responses = prompts.map((p, index) => {
-                if (index === passwordPromptIndex) {
-                  return userInput;
-                }
-                return "";
-              });
-
-              finish(responses);
-            };
-
-            totpTimeout = setTimeout(() => {
-              if (keyboardInteractiveFinish) {
-                keyboardInteractiveFinish = null;
-                keyboardInteractiveResponded = false;
-                sshLogger.warn("Password prompt timeout", {
-                  operation: "password_timeout",
-                  hostId: id,
-                });
-                ws.send(
-                  JSON.stringify({
-                    type: "error",
-                    message: "Password verification timeout. Please reconnect.",
-                  }),
-                );
-                cleanupSSH(connectionTimeout);
-              }
-            }, 180000);
-
-            ws.send(
-              JSON.stringify({
-                type: "password_required",
-                prompt: prompts[passwordPromptIndex].prompt,
-              }),
-            );
-            return;
-          }
-
-          const responses = prompts.map((p) => {
-            if (/password/i.test(p.prompt) && resolvedCredentials.password) {
-              return resolvedCredentials.password;
-            }
-            return "";
-          });
-
-          finish(responses);
-        }
+        isKeyboardInteractive = sshAuthManager.context.isKeyboardInteractive;
+        keyboardInteractiveResponded =
+          sshAuthManager.context.keyboardInteractiveResponded;
+        keyboardInteractiveFinish =
+          sshAuthManager.context.keyboardInteractiveFinish;
+        totpPromptSent = sshAuthManager.context.totpPromptSent;
+        warpgateAuthPromptSent = sshAuthManager.context.warpgateAuthPromptSent;
+        totpTimeout = sshAuthManager.context.totpTimeout;
+        warpgateAuthTimeout = sshAuthManager.context.warpgateAuthTimeout;
      },
    );

@@ -1115,10 +1205,10 @@ wss.on("connection", async (ws: WebSocket, req) => {
      tryKeyboard: true,
      keepaliveInterval: 30000,
      keepaliveCountMax: 3,
-      readyTimeout: 30000,
+      readyTimeout: 120000,
      tcpKeepAlive: true,
      tcpKeepAliveInitialDelay: 30000,
-      timeout: 30000,
+      timeout: 120000,
      env: {
        TERM: "xterm-256color",
        LANG: "en_US.UTF-8",
@@ -1195,10 +1285,12 @@ wss.on("connection", async (ws: WebSocket, req) => {
      }

      connectConfig.password = resolvedCredentials.password;
+      sendLog("auth", "info", "Using password authentication");
    } else if (
      resolvedCredentials.authType === "key" &&
      resolvedCredentials.key
    ) {
+      sendLog("auth", "info", "Using SSH key authentication");
      try {
        if (
          !resolvedCredentials.key.includes("-----BEGIN") ||
@@ -1228,6 +1320,11 @@ wss.on("connection", async (ws: WebSocket, req) => {
        return;
      }
    } else if (resolvedCredentials.authType === "key") {
+      sendLog(
+        "auth",
+        "error",
+        "SSH key authentication requested but no key provided",
+      );
      sshLogger.error("SSH key authentication requested but no key provided");
      ws.send(
        JSON.stringify({
@@ -1237,6 +1334,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
      );
      return;
    } else {
+      sendLog("auth", "info", "Using keyboard-interactive authentication");
      sshLogger.error("No valid authentication method provided");
      ws.send(
        JSON.stringify({
@@ -1333,6 +1431,12 @@ wss.on("connection", async (ws: WebSocket, req) => {
          }

          connectConfig.sock = stream;
+          sendLog(
+            "handshake",
+            "info",
+            "Starting SSH session through jump host",
+          );
+          sendLog("auth", "info", `Authenticating as ${username}`);
          sshConn.connect(connectConfig);
        });
      } catch (error) {
@@ -1350,6 +1454,8 @@ wss.on("connection", async (ws: WebSocket, req) => {
        return;
      }
    } else {
+      sendLog("handshake", "info", "Starting SSH session");
+      sendLog("auth", "info", `Authenticating as ${username}`);
      sshConn.connect(connectConfig);
    }
  }
@@ -1391,6 +1497,11 @@ wss.on("connection", async (ws: WebSocket, req) => {
      totpTimeout = null;
    }

+    if (warpgateAuthTimeout) {
+      clearTimeout(warpgateAuthTimeout);
+      warpgateAuthTimeout = null;
+    }
+
    if (sshStream) {
      try {
        sshStream.end();
@@ -1416,13 +1527,14 @@ wss.on("connection", async (ws: WebSocket, req) => {
    }

    totpPromptSent = false;
-    totpAttempts = 0;
+    warpgateAuthPromptSent = false;
    isKeyboardInteractive = false;
    keyboardInteractiveResponded = false;
    keyboardInteractiveFinish = null;
    isConnecting = false;
    isConnected = false;
    isCleaningUp = false;
+    isAwaitingAuthCredentials = false;
  }

  // Note: PTY-level keepalive (writing \x00 to the stream) was removed.
@@ -548,9 +548,16 @@ async function connectSSHTunnel(
    !tunnelConfig.sourceUsername ||
    !tunnelConfig.sourceSSHPort
  ) {
-    tunnelLogger.error("Invalid tunnel connection details", {
-      operation: "tunnel_connect",
+    const missingFields = [];
+    if (!tunnelConfig) missingFields.push("tunnelConfig");
+    if (!tunnelConfig?.sourceIP) missingFields.push("sourceIP");
+    if (!tunnelConfig?.sourceUsername) missingFields.push("sourceUsername");
+    if (!tunnelConfig?.sourceSSHPort) missingFields.push("sourceSSHPort");
+
+    tunnelLogger.error("Invalid tunnel connection details", undefined, {
+      operation: "tunnel_connect_validation_failed",
      tunnelName,
+      missingFields: missingFields.join(", "),
      hasSourceIP: !!tunnelConfig?.sourceIP,
      hasSourceUsername: !!tunnelConfig?.sourceUsername,
      hasSourceSSHPort: !!tunnelConfig?.sourceSSHPort,
@@ -560,6 +567,7 @@ async function connectSSHTunnel(
      status: CONNECTION_STATES.FAILED,
      reason: "Missing required connection details",
    });
+    tunnelConnecting.delete(tunnelName);
    return;
  }

@@ -600,12 +608,19 @@ async function connectSSHTunnel(
            };
          } else {
            const errorMessage = `Cannot connect tunnel '${tunnelName}': shared credentials not available`;
-            tunnelLogger.error(errorMessage);
+            tunnelLogger.error(errorMessage, undefined, {
+              operation: "tunnel_shared_credentials_unavailable",
+              tunnelName,
+              requestingUserId: tunnelConfig.requestingUserId,
+              sourceUserId: tunnelConfig.sourceUserId,
+              sourceHostId: tunnelConfig.sourceHostId,
+            });
            broadcastTunnelStatus(tunnelName, {
              connected: false,
              status: CONNECTION_STATES.FAILED,
              reason: errorMessage,
            });
+            tunnelConnecting.delete(tunnelName);
            return;
          }
        }
@@ -662,12 +677,18 @@ async function connectSSHTunnel(
    !resolvedEndpointCredentials.password
  ) {
    const errorMessage = `Cannot connect tunnel '${tunnelName}': endpoint host requires password authentication but no plaintext password available. Enable autostart for endpoint host or configure credentials in tunnel connection.`;
-    tunnelLogger.error(errorMessage);
+    tunnelLogger.error(errorMessage, undefined, {
+      operation: "tunnel_endpoint_password_unavailable",
+      tunnelName,
+      endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+      endpointAuthMethod: resolvedEndpointCredentials.authMethod,
+    });
    broadcastTunnelStatus(tunnelName, {
      connected: false,
      status: CONNECTION_STATES.FAILED,
      reason: errorMessage,
    });
+    tunnelConnecting.delete(tunnelName);
    return;
  }

@@ -676,12 +697,18 @@ async function connectSSHTunnel(
    !resolvedEndpointCredentials.sshKey
  ) {
    const errorMessage = `Cannot connect tunnel '${tunnelName}': endpoint host requires key authentication but no plaintext key available. Enable autostart for endpoint host or configure credentials in tunnel connection.`;
-    tunnelLogger.error(errorMessage);
+    tunnelLogger.error(errorMessage, undefined, {
+      operation: "tunnel_endpoint_key_unavailable",
+      tunnelName,
+      endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+      endpointAuthMethod: resolvedEndpointCredentials.authMethod,
+    });
    broadcastTunnelStatus(tunnelName, {
      connected: false,
      status: CONNECTION_STATES.FAILED,
      reason: errorMessage,
    });
+    tunnelConnecting.delete(tunnelName);
    return;
  }

@@ -745,6 +772,19 @@ async function connectSSHTunnel(
        return;
      }

+      tunnelLogger.error(
+        `Tunnel connection timeout after 60 seconds for '${tunnelName}'`,
+        undefined,
+        {
+          operation: "tunnel_connection_timeout",
+          tunnelName,
+          sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+          endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+          retryAttempt,
+          usingSocks5: tunnelConfig.useSocks5 || false,
+        },
+      );
+
      try {
        conn.end();
      } catch (error) {}
@@ -763,7 +803,22 @@ async function connectSSHTunnel(

  conn.on("error", (err) => {
    clearTimeout(connectionTimeout);
-    tunnelLogger.error(`SSH error for '${tunnelName}': ${err.message}`);
+
+    const errorType = classifyError(err.message);
+
+    tunnelLogger.error(`Tunnel connection failed for '${tunnelName}'`, err, {
+      operation: "tunnel_connect_error",
+      tunnelName,
+      errorType,
+      errorMessage: err.message,
+      sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+      endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+      tunnelType: tunnelConfig.tunnelType || "remote",
+      sourcePort: tunnelConfig.sourcePort,
+      retryAttempt,
+      usingSocks5: tunnelConfig.useSocks5 || false,
+      authMethod: tunnelConfig.sourceAuthMethod,
+    });

    tunnelConnecting.delete(tunnelName);

@@ -771,8 +826,6 @@ async function connectSSHTunnel(
      return;
    }

-    const errorType = classifyError(err.message);
-
    if (!manualDisconnects.has(tunnelName)) {
      broadcastTunnelStatus(tunnelName, {
        connected: false,
@@ -828,28 +881,49 @@ async function connectSSHTunnel(
      return;
    }

+    const tunnelType = tunnelConfig.tunnelType || "remote";
+    const tunnelFlag = tunnelType === "local" ? "-L" : "-R";
+    const portMapping =
+      tunnelType === "local"
+        ? `${tunnelConfig.sourcePort}:${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`
+        : `${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort}`;
+
    let tunnelCmd: string;
    if (
      resolvedEndpointCredentials.authMethod === "key" &&
      resolvedEndpointCredentials.sshKey
    ) {
      const keyFilePath = `/tmp/tunnel_key_${tunnelName.replace(/[^a-zA-Z0-9]/g, "_")}`;
-      tunnelCmd = `echo '${resolvedEndpointCredentials.sshKey}' > ${keyFilePath} && chmod 600 ${keyFilePath} && exec -a "${tunnelMarker}" ssh -i ${keyFilePath} -N -o StrictHostKeyChecking=no -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes -R ${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort} ${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP} && rm -f ${keyFilePath}`;
+      tunnelCmd = `echo '${resolvedEndpointCredentials.sshKey}' > ${keyFilePath} && chmod 600 ${keyFilePath} && exec -a "${tunnelMarker}" ssh -i ${keyFilePath} -N -o StrictHostKeyChecking=no -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes ${tunnelFlag} ${portMapping} ${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP} && rm -f ${keyFilePath}`;
    } else {
-      tunnelCmd = `exec -a "${tunnelMarker}" sshpass -p '${resolvedEndpointCredentials.password || ""}' ssh -N -o StrictHostKeyChecking=no -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes -R ${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort} ${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}`;
+      tunnelCmd = `exec -a "${tunnelMarker}" sshpass -p '${resolvedEndpointCredentials.password || ""}' ssh -N -o StrictHostKeyChecking=no -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes ${tunnelFlag} ${portMapping} ${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}`;
    }

    conn.exec(tunnelCmd, (err, stream) => {
      if (err) {
+        const errorType = classifyError(err.message);
+
        tunnelLogger.error(
-          `Connection error for '${tunnelName}': ${err.message}`,
+          `Failed to execute tunnel command for '${tunnelName}'`,
+          err,
+          {
+            operation: "tunnel_exec_error",
+            tunnelName,
+            errorType,
+            errorMessage: err.message,
+            sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+            endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+            tunnelType: tunnelConfig.tunnelType || "remote",
+            sourcePort: tunnelConfig.sourcePort,
+            endpointPort: tunnelConfig.endpointPort,
+            retryAttempt,
+          },
        );

        conn.end();

        activeTunnels.delete(tunnelName);

-        const errorType = classifyError(err.message);
        const shouldNotRetry =
          errorType === "AUTHENTICATION_FAILED" ||
          errorType === "CONNECTION_FAILED";
@@ -1079,12 +1153,23 @@ async function connectSSHTunnel(
    ) {
      tunnelLogger.error(
        `Invalid SSH key format for tunnel '${tunnelName}'. Key should contain both BEGIN and END markers`,
+        undefined,
+        {
+          operation: "tunnel_invalid_ssh_key_format",
+          tunnelName,
+          sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+          keyType: resolvedSourceCredentials.keyType,
+          hasBeginMarker:
+            resolvedSourceCredentials.sshKey.includes("-----BEGIN"),
+          hasEndMarker: resolvedSourceCredentials.sshKey.includes("-----END"),
+        },
      );
      broadcastTunnelStatus(tunnelName, {
        connected: false,
        status: CONNECTION_STATES.FAILED,
        reason: "Invalid SSH key format",
      });
+      tunnelConnecting.delete(tunnelName);
      return;
    }

@@ -1105,12 +1190,20 @@ async function connectSSHTunnel(
  } else if (resolvedSourceCredentials.authMethod === "key") {
    tunnelLogger.error(
      `SSH key authentication requested but no key provided for tunnel '${tunnelName}'`,
+      undefined,
+      {
+        operation: "tunnel_ssh_key_missing",
+        tunnelName,
+        sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+        authMethod: resolvedSourceCredentials.authMethod,
+      },
    );
    broadcastTunnelStatus(tunnelName, {
      connected: false,
      status: CONNECTION_STATES.FAILED,
      reason: "SSH key authentication requested but no key provided",
    });
+    tunnelConnecting.delete(tunnelName);
    return;
  } else {
    connOptions.password = resolvedSourceCredentials.password;
@@ -1152,10 +1245,16 @@ async function connectSSHTunnel(
      }
    } catch (socks5Error) {
      tunnelLogger.error("SOCKS5 connection failed for tunnel", socks5Error, {
-        operation: "socks5_connect",
+        operation: "tunnel_socks5_connection_failed",
        tunnelName,
+        sourceHost: `${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
        proxyHost: tunnelConfig.socks5Host,
        proxyPort: tunnelConfig.socks5Port || 1080,
+        hasProxyAuth: !!(
+          tunnelConfig.socks5Username && tunnelConfig.socks5Password
+        ),
+        errorMessage:
+          socks5Error instanceof Error ? socks5Error.message : "Unknown error",
      });
      broadcastTunnelStatus(tunnelName, {
        connected: false,
@@ -1166,6 +1265,7 @@ async function connectSSHTunnel(
            ? socks5Error.message
            : "Unknown error"),
      });
+      tunnelConnecting.delete(tunnelName);
      return;
    }
  }
@@ -1302,7 +1402,9 @@ async function killRemoteTunnelByMarker(
  }

  conn.on("ready", () => {
-    const checkCmd = `ps aux | grep -E '(${tunnelMarker}|ssh.*-R.*${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort}.*${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}|sshpass.*ssh.*-R.*${tunnelConfig.endpointPort})' | grep -v grep`;
+    const tunnelType = tunnelConfig.tunnelType || "remote";
+    const tunnelFlag = tunnelType === "local" ? "-L" : "-R";
+    const checkCmd = `ps aux | grep -E '(${tunnelMarker}|ssh.*${tunnelFlag}.*${tunnelConfig.endpointPort}:.*:${tunnelConfig.sourcePort}.*${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}|sshpass.*ssh.*${tunnelFlag})' | grep -v grep`;

    conn.exec(checkCmd, (_err, stream) => {
      let foundProcesses = false;
@@ -1323,8 +1425,8 @@ async function killRemoteTunnelByMarker(

        const killCmds = [
          `pkill -TERM -f '${tunnelMarker}'`,
-          `sleep 1 && pkill -f 'ssh.*-R.*${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort}.*${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}'`,
-          `sleep 1 && pkill -f 'sshpass.*ssh.*-R.*${tunnelConfig.endpointPort}'`,
+          `sleep 1 && pkill -f 'ssh.*${tunnelFlag}.*${tunnelConfig.endpointPort}:.*:${tunnelConfig.sourcePort}.*${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}'`,
+          `sleep 1 && pkill -f 'sshpass.*ssh.*${tunnelFlag}.*${tunnelConfig.endpointPort}'`,
          `sleep 2 && pkill -9 -f '${tunnelMarker}'`,
        ];

@@ -1450,10 +1552,42 @@ async function killRemoteTunnelByMarker(
  }
 }

+/**
+ * @openapi
+ * /ssh/tunnel/status:
+ *   get:
+ *     summary: Get all tunnel statuses
+ *     description: Retrieves the status of all SSH tunnels.
+ *     tags:
+ *       - SSH Tunnels
+ *     responses:
+ *       200:
+ *         description: A list of all tunnel statuses.
+ */
 app.get("/ssh/tunnel/status", (req, res) => {
  res.json(getAllTunnelStatus());
 });

+/**
+ * @openapi
+ * /ssh/tunnel/status/{tunnelName}:
+ *   get:
+ *     summary: Get tunnel status by name
+ *     description: Retrieves the status of a specific SSH tunnel by its name.
+ *     tags:
+ *       - SSH Tunnels
+ *     parameters:
+ *       - in: path
+ *         name: tunnelName
+ *         required: true
+ *         schema:
+ *           type: string
+ *     responses:
+ *       200:
+ *         description: Tunnel status.
+ *       404:
+ *         description: Tunnel not found.
+ */
 app.get("/ssh/tunnel/status/:tunnelName", (req, res) => {
  const { tunnelName } = req.params;
  const status = connectionStatus.get(tunnelName);
@@ -1465,6 +1599,39 @@ app.get("/ssh/tunnel/status/:tunnelName", (req, res) => {
  res.json({ name: tunnelName, status });
 });

+/**
+ * @openapi
+ * /ssh/tunnel/connect:
+ *   post:
+ *     summary: Connect SSH tunnel
+ *     description: Establishes an SSH tunnel connection with the specified configuration.
+ *     tags:
+ *       - SSH Tunnels
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               sourceHostId:
+ *                 type: integer
+ *               tunnelIndex:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Connection request received.
+ *       400:
+ *         description: Invalid tunnel configuration.
+ *       401:
+ *         description: Authentication required.
+ *       403:
+ *         description: Access denied to this host.
+ *       500:
+ *         description: Failed to connect tunnel.
+ */
 app.post(
  "/ssh/tunnel/connect",
  authenticateJWT,
@@ -1619,6 +1786,35 @@ app.post(
  },
 );

+/**
+ * @openapi
+ * /ssh/tunnel/disconnect:
+ *   post:
+ *     summary: Disconnect SSH tunnel
+ *     description: Disconnects an active SSH tunnel.
+ *     tags:
+ *       - SSH Tunnels
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               tunnelName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Disconnect request received.
+ *       400:
+ *         description: Tunnel name required.
+ *       401:
+ *         description: Authentication required.
+ *       403:
+ *         description: Access denied.
+ *       500:
+ *         description: Failed to disconnect tunnel.
+ */
 app.post(
  "/ssh/tunnel/disconnect",
  authenticateJWT,
@@ -1683,6 +1879,35 @@ app.post(
  },
 );

+/**
+ * @openapi
+ * /ssh/tunnel/cancel:
+ *   post:
+ *     summary: Cancel tunnel retry
+ *     description: Cancels the retry mechanism for a failed SSH tunnel connection.
+ *     tags:
+ *       - SSH Tunnels
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               tunnelName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Cancel request received.
+ *       400:
+ *         description: Tunnel name required.
+ *       401:
+ *         description: Authentication required.
+ *       403:
+ *         description: Access denied.
+ *       500:
+ *         description: Failed to cancel tunnel retry.
+ */
 app.post(
  "/ssh/tunnel/cancel",
  authenticateJWT,
@@ -1806,6 +2031,7 @@ async function initializeAutoStartTunnels(): Promise<void> {
                  tunnelConnection.endpointHost,
                  tunnelConnection.endpointPort,
                ),
+                tunnelType: tunnelConnection.tunnelType || "remote",
                sourceHostId: host.id,
                tunnelIndex: tunnelIndex,
                hostName: host.name || `${host.username}@${host.ip}`,
@@ -0,0 +1,254 @@
+import type { Client } from "ssh2";
+import { execCommand } from "./common-utils.js";
+import type {
+  FirewallMetrics,
+  FirewallChain,
+  FirewallRule,
+} from "../../../types/stats-widgets.js";
+
+function parseIptablesRule(line: string): FirewallRule | null {
+  if (!line.startsWith("-A ")) return null;
+
+  const rule: FirewallRule = {
+    chain: "",
+    target: "",
+    protocol: "all",
+    source: "0.0.0.0/0",
+    destination: "0.0.0.0/0",
+  };
+
+  const chainMatch = line.match(/^-A\s+(\S+)/);
+  if (chainMatch) {
+    rule.chain = chainMatch[1];
+  }
+
+  const targetMatch = line.match(/-j\s+(\S+)/);
+  if (targetMatch) {
+    rule.target = targetMatch[1];
+  }
+
+  const protocolMatch = line.match(/-p\s+(\S+)/);
+  if (protocolMatch) {
+    rule.protocol = protocolMatch[1];
+  }
+
+  const sourceMatch = line.match(/-s\s+(\S+)/);
+  if (sourceMatch) {
+    rule.source = sourceMatch[1];
+  }
+
+  const destMatch = line.match(/-d\s+(\S+)/);
+  if (destMatch) {
+    rule.destination = destMatch[1];
+  }
+
+  const dportMatch = line.match(/--dport\s+(\S+)/);
+  if (dportMatch) {
+    rule.dport = dportMatch[1];
+  }
+
+  const sportMatch = line.match(/--sport\s+(\S+)/);
+  if (sportMatch) {
+    rule.sport = sportMatch[1];
+  }
+
+  const stateMatch = line.match(/--state\s+(\S+)/);
+  if (stateMatch) {
+    rule.state = stateMatch[1];
+  }
+
+  const interfaceMatch = line.match(/-i\s+(\S+)/);
+  if (interfaceMatch) {
+    rule.interface = interfaceMatch[1];
+  }
+
+  return rule;
+}
+
+function parseIptablesOutput(output: string): FirewallChain[] {
+  const chains: Map<string, FirewallChain> = new Map();
+  const lines = output.split("\n");
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+
+    const policyMatch = trimmed.match(/^:(\S+)\s+(\S+)/);
+    if (policyMatch) {
+      const [, chainName, policy] = policyMatch;
+      chains.set(chainName, {
+        name: chainName,
+        policy: policy,
+        rules: [],
+      });
+      continue;
+    }
+
+    const rule = parseIptablesRule(trimmed);
+    if (rule) {
+      let chain = chains.get(rule.chain);
+      if (!chain) {
+        chain = {
+          name: rule.chain,
+          policy: "ACCEPT",
+          rules: [],
+        };
+        chains.set(rule.chain, chain);
+      }
+      chain.rules.push(rule);
+    }
+  }
+
+  return Array.from(chains.values());
+}
+
+function parseNftablesOutput(output: string): FirewallChain[] {
+  const chains: FirewallChain[] = [];
+  let currentChain: FirewallChain | null = null;
+
+  const lines = output.split("\n");
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+
+    const chainMatch = trimmed.match(
+      /chain\s+(\S+)\s*\{?\s*(?:type\s+\S+\s+hook\s+(\S+))?/,
+    );
+    if (chainMatch) {
+      if (currentChain) {
+        chains.push(currentChain);
+      }
+      currentChain = {
+        name: chainMatch[1].toUpperCase(),
+        policy: "ACCEPT",
+        rules: [],
+      };
+      continue;
+    }
+
+    if (currentChain && trimmed.startsWith("policy ")) {
+      const policyMatch = trimmed.match(/policy\s+(\S+)/);
+      if (policyMatch) {
+        currentChain.policy = policyMatch[1].toUpperCase();
+      }
+      continue;
+    }
+
+    if (currentChain && trimmed && !trimmed.startsWith("}")) {
+      const rule: FirewallRule = {
+        chain: currentChain.name,
+        target: "",
+        protocol: "all",
+        source: "0.0.0.0/0",
+        destination: "0.0.0.0/0",
+      };
+
+      if (trimmed.includes("accept")) rule.target = "ACCEPT";
+      else if (trimmed.includes("drop")) rule.target = "DROP";
+      else if (trimmed.includes("reject")) rule.target = "REJECT";
+
+      const tcpMatch = trimmed.match(/tcp\s+dport\s+(\S+)/);
+      if (tcpMatch) {
+        rule.protocol = "tcp";
+        rule.dport = tcpMatch[1];
+      }
+
+      const udpMatch = trimmed.match(/udp\s+dport\s+(\S+)/);
+      if (udpMatch) {
+        rule.protocol = "udp";
+        rule.dport = udpMatch[1];
+      }
+
+      const saddrMatch = trimmed.match(/saddr\s+(\S+)/);
+      if (saddrMatch) {
+        rule.source = saddrMatch[1];
+      }
+
+      const daddrMatch = trimmed.match(/daddr\s+(\S+)/);
+      if (daddrMatch) {
+        rule.destination = daddrMatch[1];
+      }
+
+      const iifMatch = trimmed.match(/iif\s+"?(\S+)"?/);
+      if (iifMatch) {
+        rule.interface = iifMatch[1].replace(/"/g, "");
+      }
+
+      const ctStateMatch = trimmed.match(/ct\s+state\s+(\S+)/);
+      if (ctStateMatch) {
+        rule.state = ctStateMatch[1].toUpperCase();
+      }
+
+      if (rule.target) {
+        currentChain.rules.push(rule);
+      }
+    }
+
+    if (trimmed === "}") {
+      if (currentChain) {
+        chains.push(currentChain);
+        currentChain = null;
+      }
+    }
+  }
+
+  if (currentChain) {
+    chains.push(currentChain);
+  }
+
+  return chains;
+}
+
+export async function collectFirewallMetrics(
+  client: Client,
+): Promise<FirewallMetrics> {
+  try {
+    const iptablesResult = await execCommand(
+      client,
+      "iptables-save 2>/dev/null",
+      15000,
+    );
+
+    if (iptablesResult.stdout && iptablesResult.stdout.includes("*filter")) {
+      const chains = parseIptablesOutput(iptablesResult.stdout);
+      const hasRules = chains.some((c) => c.rules.length > 0);
+
+      return {
+        type: "iptables",
+        status: hasRules ? "active" : "inactive",
+        chains: chains.filter(
+          (c) =>
+            c.name === "INPUT" || c.name === "OUTPUT" || c.name === "FORWARD",
+        ),
+      };
+    }
+
+    const nftResult = await execCommand(
+      client,
+      "nft list ruleset 2>/dev/null",
+      15000,
+    );
+
+    if (nftResult.stdout && nftResult.stdout.trim()) {
+      const chains = parseNftablesOutput(nftResult.stdout);
+      const hasRules = chains.some((c) => c.rules.length > 0);
+
+      return {
+        type: "nftables",
+        status: hasRules ? "active" : "inactive",
+        chains,
+      };
+    }
+
+    return {
+      type: "none",
+      status: "unknown",
+      chains: [],
+    };
+  } catch {
+    return {
+      type: "none",
+      status: "unknown",
+      chains: [],
+    };
+  }
+}
@@ -0,0 +1,154 @@
+import type { Client } from "ssh2";
+import { execCommand } from "./common-utils.js";
+import type {
+  PortsMetrics,
+  ListeningPort,
+} from "../../../types/stats-widgets.js";
+
+function parseSsOutput(output: string): ListeningPort[] {
+  const ports: ListeningPort[] = [];
+  const lines = output.split("\n").slice(1);
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+
+    const parts = trimmed.split(/\s+/);
+    if (parts.length < 5) continue;
+
+    const protocol = parts[0]?.toLowerCase();
+    if (protocol !== "tcp" && protocol !== "udp") continue;
+
+    const state = parts[1];
+    const localAddr = parts[4];
+
+    if (!localAddr) continue;
+
+    const lastColon = localAddr.lastIndexOf(":");
+    if (lastColon === -1) continue;
+
+    const address = localAddr.substring(0, lastColon);
+    const portStr = localAddr.substring(lastColon + 1);
+    const port = parseInt(portStr, 10);
+
+    if (isNaN(port)) continue;
+
+    const portEntry: ListeningPort = {
+      protocol: protocol as "tcp" | "udp",
+      localAddress: address.replace(/^\[|\]$/g, ""),
+      localPort: port,
+      state: protocol === "tcp" ? state : undefined,
+    };
+
+    const processInfo = parts[6];
+    if (processInfo && processInfo.startsWith("users:")) {
+      const pidMatch = processInfo.match(/pid=(\d+)/);
+      const nameMatch = processInfo.match(/\("([^"]+)"/);
+      if (pidMatch) portEntry.pid = parseInt(pidMatch[1], 10);
+      if (nameMatch) portEntry.process = nameMatch[1];
+    }
+
+    ports.push(portEntry);
+  }
+
+  return ports;
+}
+
+function parseNetstatOutput(output: string): ListeningPort[] {
+  const ports: ListeningPort[] = [];
+  const lines = output.split("\n");
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+
+    const parts = trimmed.split(/\s+/);
+    if (parts.length < 4) continue;
+
+    const proto = parts[0]?.toLowerCase();
+    if (!proto) continue;
+
+    let protocol: "tcp" | "udp";
+    if (proto.startsWith("tcp")) {
+      protocol = "tcp";
+    } else if (proto.startsWith("udp")) {
+      protocol = "udp";
+    } else {
+      continue;
+    }
+
+    const localAddr = parts[3];
+    if (!localAddr) continue;
+
+    const lastColon = localAddr.lastIndexOf(":");
+    if (lastColon === -1) continue;
+
+    const address = localAddr.substring(0, lastColon);
+    const portStr = localAddr.substring(lastColon + 1);
+    const port = parseInt(portStr, 10);
+
+    if (isNaN(port)) continue;
+
+    const portEntry: ListeningPort = {
+      protocol,
+      localAddress: address,
+      localPort: port,
+    };
+
+    if (protocol === "tcp" && parts.length >= 6) {
+      portEntry.state = parts[5];
+    }
+
+    const pidProgram = parts[parts.length - 1];
+    if (pidProgram && pidProgram.includes("/")) {
+      const [pidStr, process] = pidProgram.split("/");
+      const pid = parseInt(pidStr, 10);
+      if (!isNaN(pid)) portEntry.pid = pid;
+      if (process) portEntry.process = process;
+    }
+
+    ports.push(portEntry);
+  }
+
+  return ports;
+}
+
+export async function collectPortsMetrics(
+  client: Client,
+): Promise<PortsMetrics> {
+  try {
+    const ssResult = await execCommand(client, "ss -tulnp 2>/dev/null", 15000);
+
+    if (ssResult.stdout && ssResult.stdout.includes("Local")) {
+      const ports = parseSsOutput(ssResult.stdout);
+      return {
+        source: "ss",
+        ports: ports.sort((a, b) => a.localPort - b.localPort),
+      };
+    }
+
+    const netstatResult = await execCommand(
+      client,
+      "netstat -tulnp 2>/dev/null",
+      15000,
+    );
+
+    if (netstatResult.stdout && netstatResult.stdout.includes("Local")) {
+      const ports = parseNetstatOutput(netstatResult.stdout);
+      return {
+        source: "netstat",
+        ports: ports.sort((a, b) => a.localPort - b.localPort),
+      };
+    }
+
+    return {
+      source: "none",
+      ports: [],
+    };
+  } catch {
+    return {
+      source: "none",
+      ports: [],
+    };
+  }
+}
@@ -0,0 +1,145 @@
+import swaggerJSDoc from "swagger-jsdoc";
+import path from "path";
+import { fileURLToPath } from "url";
+import { promises as fs } from "fs";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const projectRoot = path.join(__dirname, "..", "..", "..");
+
+const swaggerOptions: swaggerJSDoc.Options = {
+  definition: {
+    openapi: "3.0.3",
+    info: {
+      title: "Termix API",
+      version: "0.0.0",
+      description: "Termix Backend API Reference",
+    },
+    servers: [
+      {
+        url: "http://localhost:30001",
+        description: "Main database and authentication server",
+      },
+      {
+        url: "http://localhost:30003",
+        description: "SSH tunnel management server",
+      },
+      {
+        url: "http://localhost:30004",
+        description: "SSH file manager server",
+      },
+      {
+        url: "http://localhost:30005",
+        description: "Server statistics and monitoring server",
+      },
+      {
+        url: "http://localhost:30006",
+        description: "Dashboard server",
+      },
+      {
+        url: "http://localhost:30007",
+        description: "Docker management server",
+      },
+    ],
+    components: {
+      securitySchemes: {
+        bearerAuth: {
+          type: "http",
+          scheme: "bearer",
+          bearerFormat: "JWT",
+        },
+      },
+      schemas: {
+        Error: {
+          type: "object",
+          properties: {
+            error: { type: "string" },
+            details: { type: "string" },
+          },
+        },
+      },
+    },
+    security: [
+      {
+        bearerAuth: [],
+      },
+    ],
+    tags: [
+      {
+        name: "Alerts",
+        description: "System alerts and notifications management",
+      },
+      {
+        name: "Credentials",
+        description: "SSH credential management",
+      },
+      {
+        name: "Network Topology",
+        description: "Network topology visualization and management",
+      },
+      {
+        name: "RBAC",
+        description: "Role-based access control for host sharing",
+      },
+      {
+        name: "Snippets",
+        description: "Command snippet management",
+      },
+      {
+        name: "Terminal",
+        description: "Terminal command history",
+      },
+      {
+        name: "Users",
+        description: "User management and authentication",
+      },
+      {
+        name: "Dashboard",
+        description: "Dashboard statistics and activity",
+      },
+      {
+        name: "Docker",
+        description: "Docker container management",
+      },
+      {
+        name: "SSH Tunnels",
+        description: "SSH tunnel connection management",
+      },
+      {
+        name: "Server Stats",
+        description: "Server status monitoring and metrics collection",
+      },
+      {
+        name: "File Manager",
+        description: "SSH file management operations",
+      },
+    ],
+  },
+  apis: [
+    path.join(projectRoot, "src", "backend", "database", "routes", "*.ts"),
+    path.join(projectRoot, "src", "backend", "dashboard.ts"),
+    path.join(projectRoot, "src", "backend", "ssh", "*.ts"),
+  ],
+};
+
+async function generateOpenAPISpec() {
+  try {
+    const swaggerSpec = swaggerJSDoc(swaggerOptions);
+
+    const outputPath = path.join(projectRoot, "openapi.json");
+
+    await fs.writeFile(
+      outputPath,
+      JSON.stringify(swaggerSpec, null, 2),
+      "utf-8",
+    );
+  } catch (error) {
+    console.error("Failed to generate OpenAPI specification:", error);
+    process.exit(1);
+  }
+}
+
+generateOpenAPISpec();
+
+export { swaggerOptions, generateOpenAPISpec };
@@ -125,7 +125,7 @@ class DataCrypto {
        if (needsUpdate) {
          const updateQuery = `
            UPDATE ssh_data
-            SET password = ?, key = ?, key_password = ?, key_type = ?, autostart_password = ?, autostart_key = ?, autostart_key_password = ?, updated_at = CURRENT_TIMESTAMP
+            SET password = ?, key = ?, key_password = ?, key_type = ?, autostart_password = ?, autostart_key = ?, autostart_key_password = ?, sudo_password = ?, updated_at = CURRENT_TIMESTAMP
            WHERE id = ?
          `;
          db.prepare(updateQuery).run(
@@ -136,6 +136,7 @@ class DataCrypto {
            updatedRecord.autostartPassword || null,
            updatedRecord.autostartKey || null,
            updatedRecord.autostartKeyPassword || null,
+            updatedRecord.sudoPassword || null,
            record.id,
          );

@@ -476,10 +477,6 @@ class DataCrypto {
    }
  }

-  /**
-   * Encrypt sensitive credential fields with system key for offline sharing
-   * Returns an object with systemPassword, systemKey, systemKeyPassword fields
-   */
  static async encryptRecordWithSystemKey<T extends Record<string, unknown>>(
    tableName: string,
    record: T,
@@ -32,10 +32,10 @@ class FieldCrypto {
      "key",
      "key_password",
      "keyPassword",
-      "keyType",
      "autostartPassword",
      "autostartKey",
      "autostartKeyPassword",
+      "sudoPassword",
    ]),
    ssh_credentials: new Set([
      "password",
@@ -46,7 +46,6 @@ class FieldCrypto {
      "key",
      "public_key",
      "publicKey",
-      "keyType",
    ]),
  };

@@ -7,11 +7,21 @@ interface LoginAttempt {
 class LoginRateLimiter {
  private ipAttempts = new Map<string, LoginAttempt>();
  private usernameAttempts = new Map<string, LoginAttempt>();
+  private totpAttempts = new Map<string, LoginAttempt>();
+  private resetCodeAttempts = new Map<string, LoginAttempt>();

  private readonly MAX_ATTEMPTS = 5;
  private readonly WINDOW_MS = 10 * 60 * 1000;
  private readonly LOCKOUT_MS = 10 * 60 * 1000;

+  private readonly TOTP_MAX_ATTEMPTS = 5;
+  private readonly TOTP_WINDOW_MS = 1 * 60 * 1000;
+  private readonly TOTP_LOCKOUT_MS = 5 * 60 * 1000;
+
+  private readonly RESET_CODE_MAX_ATTEMPTS = 5;
+  private readonly RESET_CODE_WINDOW_MS = 1 * 60 * 1000;
+  private readonly RESET_CODE_LOCKOUT_MS = 5 * 60 * 1000;
+
  constructor() {
    setInterval(() => this.cleanup(), 5 * 60 * 1000);
  }
@@ -40,6 +50,28 @@ class LoginRateLimiter {
        this.usernameAttempts.delete(username);
      }
    }
+
+    for (const [userId, attempt] of this.totpAttempts.entries()) {
+      if (attempt.lockedUntil && attempt.lockedUntil < now) {
+        this.totpAttempts.delete(userId);
+      } else if (
+        !attempt.lockedUntil &&
+        now - attempt.firstAttempt > this.TOTP_WINDOW_MS
+      ) {
+        this.totpAttempts.delete(userId);
+      }
+    }
+
+    for (const [username, attempt] of this.resetCodeAttempts.entries()) {
+      if (attempt.lockedUntil && attempt.lockedUntil < now) {
+        this.resetCodeAttempts.delete(username);
+      } else if (
+        !attempt.lockedUntil &&
+        now - attempt.firstAttempt > this.RESET_CODE_WINDOW_MS
+      ) {
+        this.resetCodeAttempts.delete(username);
+      }
+    }
  }

  recordFailedAttempt(ip: string, username?: string): void {
@@ -141,6 +173,114 @@ class LoginRateLimiter {

    return minRemaining;
  }
+
+  recordFailedTOTPAttempt(userId: string): void {
+    const now = Date.now();
+
+    const totpAttempt = this.totpAttempts.get(userId);
+    if (!totpAttempt) {
+      this.totpAttempts.set(userId, {
+        count: 1,
+        firstAttempt: now,
+      });
+    } else if (now - totpAttempt.firstAttempt > this.TOTP_WINDOW_MS) {
+      this.totpAttempts.set(userId, {
+        count: 1,
+        firstAttempt: now,
+      });
+    } else {
+      totpAttempt.count++;
+      if (totpAttempt.count >= this.TOTP_MAX_ATTEMPTS) {
+        totpAttempt.lockedUntil = now + this.TOTP_LOCKOUT_MS;
+      }
+    }
+  }
+
+  resetTOTPAttempts(userId: string): void {
+    this.totpAttempts.delete(userId);
+  }
+
+  isTOTPLocked(userId: string): { locked: boolean; remainingTime?: number } {
+    const now = Date.now();
+
+    const totpAttempt = this.totpAttempts.get(userId);
+    if (totpAttempt?.lockedUntil && totpAttempt.lockedUntil > now) {
+      return {
+        locked: true,
+        remainingTime: Math.ceil((totpAttempt.lockedUntil - now) / 1000),
+      };
+    }
+
+    return { locked: false };
+  }
+
+  getRemainingTOTPAttempts(userId: string): number {
+    const now = Date.now();
+
+    const totpAttempt = this.totpAttempts.get(userId);
+    if (totpAttempt && now - totpAttempt.firstAttempt <= this.TOTP_WINDOW_MS) {
+      return Math.max(0, this.TOTP_MAX_ATTEMPTS - totpAttempt.count);
+    }
+
+    return this.TOTP_MAX_ATTEMPTS;
+  }
+
+  recordResetCodeAttempt(username: string): void {
+    const now = Date.now();
+
+    const resetAttempt = this.resetCodeAttempts.get(username);
+    if (!resetAttempt) {
+      this.resetCodeAttempts.set(username, {
+        count: 1,
+        firstAttempt: now,
+      });
+    } else if (now - resetAttempt.firstAttempt > this.RESET_CODE_WINDOW_MS) {
+      this.resetCodeAttempts.set(username, {
+        count: 1,
+        firstAttempt: now,
+      });
+    } else {
+      resetAttempt.count++;
+      if (resetAttempt.count >= this.RESET_CODE_MAX_ATTEMPTS) {
+        resetAttempt.lockedUntil = now + this.RESET_CODE_LOCKOUT_MS;
+      }
+    }
+  }
+
+  resetResetCodeAttempts(username: string): void {
+    this.resetCodeAttempts.delete(username);
+  }
+
+  isResetCodeLocked(username: string): {
+    locked: boolean;
+    remainingTime?: number;
+  } {
+    const now = Date.now();
+
+    const resetAttempt = this.resetCodeAttempts.get(username);
+    if (resetAttempt?.lockedUntil && resetAttempt.lockedUntil > now) {
+      return {
+        locked: true,
+        remainingTime: Math.ceil((resetAttempt.lockedUntil - now) / 1000),
+      };
+    }
+
+    return { locked: false };
+  }
+
+  getRemainingResetCodeAttempts(username: string): number {
+    const now = Date.now();
+
+    const resetAttempt = this.resetCodeAttempts.get(username);
+    if (
+      resetAttempt &&
+      now - resetAttempt.firstAttempt <= this.RESET_CODE_WINDOW_MS
+    ) {
+      return Math.max(0, this.RESET_CODE_MAX_ATTEMPTS - resetAttempt.count);
+    }
+
+    return this.RESET_CODE_MAX_ATTEMPTS;
+  }
 }

 export const loginRateLimiter = new LoginRateLimiter();
@@ -63,9 +63,6 @@ class PermissionManager {
    return this.instance;
  }

-  /**
-   * Clean up expired host access entries
-   */
  private async cleanupExpiredAccess(): Promise<void> {
    try {
      const now = new Date().toISOString();
@@ -85,23 +82,14 @@ class PermissionManager {
    }
  }

-  /**
-   * Clear permission cache
-   */
  private clearPermissionCache(): void {
    this.permissionCache.clear();
  }

-  /**
-   * Invalidate permission cache for a specific user
-   */
  invalidateUserPermissionCache(userId: string): void {
    this.permissionCache.delete(userId);
  }

-  /**
-   * Get user permissions from roles
-   */
  async getUserPermissions(userId: string): Promise<string[]> {
    const cached = this.permissionCache.get(userId);
    if (cached && Date.now() - cached.timestamp < this.CACHE_TTL) {
@@ -150,10 +138,6 @@ class PermissionManager {
    }
  }

-  /**
-   * Check if user has a specific permission
-   * Supports wildcards: "hosts.*", "*"
-   */
  async hasPermission(userId: string, permission: string): Promise<boolean> {
    const userPermissions = await this.getUserPermissions(userId);

@@ -176,9 +160,6 @@ class PermissionManager {
    return false;
  }

-  /**
-   * Check if user can access a specific host
-   */
  async canAccessHost(
    userId: string,
    hostId: number,
@@ -229,6 +210,20 @@ class PermissionManager {
      if (sharedAccess.length > 0) {
        const access = sharedAccess[0];

+        const hostOwnerCheck = await db
+          .select({ ownerId: sshData.userId })
+          .from(sshData)
+          .where(eq(sshData.id, hostId))
+          .limit(1);
+
+        if (hostOwnerCheck.length > 0 && hostOwnerCheck[0].ownerId === userId) {
+          return {
+            hasAccess: true,
+            isOwner: true,
+            isShared: false,
+          };
+        }
+
        if (action === "write" || action === "delete") {
          return {
            hasAccess: false,
@@ -282,9 +277,6 @@ class PermissionManager {
    }
  }

-  /**
-   * Check if user is admin (backward compatibility)
-   */
  async isAdmin(userId: string): Promise<boolean> {
    try {
      const user = await db
@@ -318,9 +310,6 @@ class PermissionManager {
    }
  }

-  /**
-   * Middleware: Require specific permission
-   */
  requirePermission(permission: string) {
    return async (
      req: AuthenticatedRequest,
@@ -353,9 +342,6 @@ class PermissionManager {
    };
  }

-  /**
-   * Middleware: Require host access
-   */
  requireHostAccess(
    hostIdParam: string = "id",
    action: "read" | "write" | "execute" | "delete" | "share" = "read",
@@ -371,7 +357,10 @@ class PermissionManager {
        return res.status(401).json({ error: "Not authenticated" });
      }

-      const hostId = parseInt(req.params[hostIdParam], 10);
+      const hostIdValue = Array.isArray(req.params[hostIdParam])
+        ? req.params[hostIdParam][0]
+        : req.params[hostIdParam];
+      const hostId = parseInt(hostIdValue, 10);

      if (isNaN(hostId)) {
        return res.status(400).json({ error: "Invalid host ID" });
@@ -400,9 +389,6 @@ class PermissionManager {
    };
  }

-  /**
-   * Middleware: Require admin role (backward compatible)
-   */
  requireAdmin() {
    return async (
      req: AuthenticatedRequest,
@@ -21,11 +21,6 @@ interface CredentialData {
  keyType?: string;
 }

-/**
- * Manages shared credentials for RBAC host sharing.
- * Creates per-user encrypted credential copies to enable credential sharing
- * without requiring the credential owner to be online.
- */
 class SharedCredentialManager {
  private static instance: SharedCredentialManager;

@@ -38,10 +33,6 @@ class SharedCredentialManager {
    return this.instance;
  }

-  /**
-   * Create shared credential for a specific user
-   * Called when sharing a host with a user
-   */
  async createSharedCredentialForUser(
    hostAccessId: number,
    originalCredentialId: number,
@@ -121,10 +112,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Create shared credentials for all users in a role
-   * Called when sharing a host with a role
-   */
  async createSharedCredentialsForRole(
    hostAccessId: number,
    originalCredentialId: number,
@@ -172,10 +159,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Get credential data for a shared user
-   * Called when a shared user connects to a host
-   */
  async getSharedCredentialForUser(
    hostId: number,
    userId: string,
@@ -230,10 +213,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Update all shared credentials when original credential is updated
-   * Called when credential owner updates credential
-   */
  async updateSharedCredentialsForOriginal(
    credentialId: number,
    ownerId: string,
@@ -310,10 +289,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Delete shared credentials when original credential is deleted
-   * Called from credential deletion route
-   */
  async deleteSharedCredentialsForOriginal(
    credentialId: number,
  ): Promise<void> {
@@ -330,10 +305,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Re-encrypt pending shared credentials for a user when they log in
-   * Called during user login
-   */
  async reEncryptPendingCredentialsForUser(userId: string): Promise<void> {
    try {
      const userDEK = DataCrypto.getUserDataKey(userId);
@@ -405,9 +376,6 @@ class SharedCredentialManager {
    };
  }

-  /**
-   * Decrypt credential using system key (for offline sharing when owner is offline)
-   */
  private async getDecryptedCredentialViaSystemKey(
    credentialId: number,
  ): Promise<CredentialData> {
@@ -13,13 +13,6 @@ export interface SOCKS5Config {
  socks5ProxyChain?: ProxyNode[];
 }

-/**
- * Creates a SOCKS5 connection through a single proxy or a chain of proxies
- * @param targetHost - Target SSH server hostname/IP
- * @param targetPort - Target SSH server port
- * @param socks5Config - SOCKS5 proxy configuration
- * @returns Promise with connected socket or null if SOCKS5 is not enabled
- */
 export async function createSocks5Connection(
  targetHost: string,
  targetPort: number,
@@ -47,9 +40,6 @@ export async function createSocks5Connection(
  return null;
 }

-/**
- * Creates a connection through a single SOCKS proxy
- */
 async function createSingleProxyConnection(
  targetHost: string,
  targetPort: number,
@@ -87,10 +77,6 @@ async function createSingleProxyConnection(
  }
 }

-/**
- * Creates a connection through a chain of SOCKS proxies
- * Each proxy in the chain connects through the previous one
- */
 async function createProxyChainConnection(
  targetHost: string,
  targetPort: number,
@@ -177,30 +177,57 @@ class UserDataImport {
          continue;
        }

-        const tempId = `import-ssh-${targetUserId}-${Date.now()}-${imported}`;
-        const newHostData = {
+        const existing = await getDb()
+          .select()
+          .from(sshData)
+          .where(
+            and(
+              eq(sshData.userId, targetUserId),
+              eq(sshData.ip, host.ip as string),
+              eq(sshData.port, host.port as number),
+              eq(sshData.username, host.username as string),
+            ),
+          );
+
+        if (existing.length > 0 && !options.replaceExisting) {
+          skipped++;
+          continue;
+        }
+
+        const newHostData: any = {
          ...host,
-          id: tempId,
          userId: targetUserId,
-          createdAt: new Date().toISOString(),
          updatedAt: new Date().toISOString(),
        };

-        let processedHostData = newHostData;
+        if (existing.length === 0) {
+          newHostData.createdAt = new Date().toISOString();
+        }
+
+        let processedHostData: any = newHostData;
        if (options.userDataKey) {
          processedHostData = DataCrypto.encryptRecord(
            "ssh_data",
            newHostData,
            targetUserId,
            options.userDataKey,
-          );
+          ) as Record<string, unknown>;
        }

        delete processedHostData.id;

-        await getDb()
-          .insert(sshData)
-          .values(processedHostData as unknown as typeof sshData.$inferInsert);
+        if (existing.length > 0 && options.replaceExisting) {
+          await getDb()
+            .update(sshData)
+            .set(processedHostData as unknown as typeof sshData.$inferInsert)
+            .where(eq(sshData.id, existing[0].id));
+        } else {
+          await getDb()
+            .insert(sshData)
+            .values(
+              processedHostData as unknown as typeof sshData.$inferInsert,
+            );
+        }
        imported++;
      } catch (error) {
        errors.push(
@@ -233,34 +260,59 @@ class UserDataImport {
          continue;
        }

-        const tempCredId = `import-cred-${targetUserId}-${Date.now()}-${imported}`;
-        const newCredentialData = {
+        const existing = await getDb()
+          .select()
+          .from(sshCredentials)
+          .where(
+            and(
+              eq(sshCredentials.userId, targetUserId),
+              eq(sshCredentials.name, credential.name as string),
+            ),
+          );
+
+        if (existing.length > 0 && !options.replaceExisting) {
+          skipped++;
+          continue;
+        }
+
+        const newCredentialData: any = {
          ...credential,
-          id: tempCredId,
          userId: targetUserId,
-          usageCount: 0,
-          lastUsed: null,
-          createdAt: new Date().toISOString(),
          updatedAt: new Date().toISOString(),
        };

-        let processedCredentialData = newCredentialData;
+        if (existing.length === 0) {
+          newCredentialData.usageCount = 0;
+          newCredentialData.lastUsed = null;
+          newCredentialData.createdAt = new Date().toISOString();
+        }
+
+        let processedCredentialData: any = newCredentialData;
        if (options.userDataKey) {
          processedCredentialData = DataCrypto.encryptRecord(
            "ssh_credentials",
            newCredentialData,
            targetUserId,
            options.userDataKey,
-          );
+          ) as Record<string, unknown>;
        }

        delete processedCredentialData.id;

-        await getDb()
-          .insert(sshCredentials)
-          .values(
-            processedCredentialData as unknown as typeof sshCredentials.$inferInsert,
-          );
+        if (existing.length > 0 && options.replaceExisting) {
+          await getDb()
+            .update(sshCredentials)
+            .set(
+              processedCredentialData as unknown as typeof sshCredentials.$inferInsert,
+            )
+            .where(eq(sshCredentials.id, existing[0].id));
+        } else {
+          await getDb()
+            .insert(sshCredentials)
+            .values(
+              processedCredentialData as unknown as typeof sshCredentials.$inferInsert,
+            );
+        }
        imported++;
      } catch (error) {
        errors.push(
@@ -36,7 +36,7 @@ function TooltipTrigger({

 function TooltipContent({
  className,
-  sideOffset = 0,
+  sideOffset = 4,
  children,
  ...props
 }: React.ComponentProps<typeof TooltipPrimitive.Content>) {
@@ -46,7 +46,7 @@ function TooltipContent({
        data-slot="tooltip-content"
        sideOffset={sideOffset}
        className={cn(
-          "bg-primary text-primary-foreground animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs text-balance",
+          "bg-elevated text-foreground border border-edge-medium shadow-lg animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs text-balance",
          className,
        )}
        {...props}
@@ -745,7 +745,7 @@ export const DEFAULT_TERMINAL_CONFIG = {
  fontSize: 14,
  fontFamily: "Caskaydia Cove Nerd Font Mono",
  letterSpacing: 0,
-  lineHeight: 1.2,
+  lineHeight: 1.0,
  theme: "termix",

  scrollback: 10000,
@@ -1,4 +1,4 @@
-import { useState } from "react";
+import { useState, useEffect, useCallback } from "react";
 import { toast } from "sonner";

 interface ConfirmationOptions {
@@ -9,10 +9,56 @@ interface ConfirmationOptions {
  variant?: "default" | "destructive";
 }

+interface ToastConfirmOptions {
+  confirmOnEnter?: boolean;
+  duration?: number;
+}
+
 export function useConfirmation() {
  const [isOpen, setIsOpen] = useState(false);
  const [options, setOptions] = useState<ConfirmationOptions | null>(null);
  const [onConfirm, setOnConfirm] = useState<(() => void) | null>(null);
+  const [activeToastId, setActiveToastId] = useState<string | number | null>(
+    null,
+  );
+  const [pendingConfirmCallback, setPendingConfirmCallback] = useState<
+    (() => void) | null
+  >(null);
+  const [pendingResolve, setPendingResolve] = useState<
+    ((value: boolean) => void) | null
+  >(null);
+
+  const handleEnterKey = useCallback(
+    (event: KeyboardEvent) => {
+      if (event.key === "Enter" && activeToastId !== null) {
+        event.preventDefault();
+        event.stopPropagation();
+
+        if (pendingConfirmCallback) {
+          pendingConfirmCallback();
+        }
+        if (pendingResolve) {
+          pendingResolve(true);
+        }
+
+        toast.dismiss(activeToastId);
+        setActiveToastId(null);
+        setPendingConfirmCallback(null);
+        setPendingResolve(null);
+      }
+    },
+    [activeToastId, pendingConfirmCallback, pendingResolve],
+  );
+
+  useEffect(() => {
+    if (activeToastId !== null) {
+      // Use capture phase to intercept Enter before terminal receives it
+      window.addEventListener("keydown", handleEnterKey, true);
+      return () => {
+        window.removeEventListener("keydown", handleEnterKey, true);
+      };
+    }
+  }, [activeToastId, handleEnterKey]);

  const confirm = (opts: ConfirmationOptions, callback: () => void) => {
    setOptions(opts);
@@ -40,6 +86,7 @@ export function useConfirmation() {
    callback?: () => void,
    variantOrConfirmLabel: "default" | "destructive" | string = "Confirm",
    cancelLabel: string = "Cancel",
+    toastOptions: ToastConfirmOptions = { confirmOnEnter: false },
  ): Promise<boolean> => {
    return new Promise((resolve) => {
      const isVariant =
@@ -47,43 +94,64 @@ export function useConfirmation() {
        variantOrConfirmLabel === "destructive";
      const confirmLabel = isVariant ? "Confirm" : variantOrConfirmLabel;

-      if (typeof opts === "string") {
-        toast(opts, {
-          action: {
-            label: confirmLabel,
-            onClick: () => {
-              if (callback) callback();
-              resolve(true);
-            },
-          },
-          cancel: {
-            label: cancelLabel,
-            onClick: () => {
-              resolve(false);
-            },
-          },
-        } as any);
-      } else if (typeof opts === "object") {
-        const actualConfirmLabel = opts.confirmText || confirmLabel;
-        const actualCancelLabel = opts.cancelText || cancelLabel;
+      const { confirmOnEnter = false, duration = 8000 } = toastOptions;

-        toast(opts.description, {
-          action: {
-            label: actualConfirmLabel,
-            onClick: () => {
-              if (callback) callback();
-              resolve(true);
-            },
-          },
-          cancel: {
-            label: actualCancelLabel,
-            onClick: () => {
-              resolve(false);
-            },
-          },
-        } as any);
-      } else {
+      const handleToastConfirm = () => {
+        if (callback) callback();
+        resolve(true);
+        setActiveToastId(null);
+        setPendingConfirmCallback(null);
+        setPendingResolve(null);
+      };
+
+      const handleToastCancel = () => {
        resolve(false);
+        setActiveToastId(null);
+        setPendingConfirmCallback(null);
+        setPendingResolve(null);
+      };
+
+      const message = typeof opts === "string" ? opts : opts.description;
+      const actualConfirmLabel =
+        typeof opts === "object" && opts.confirmText
+          ? opts.confirmText
+          : confirmLabel;
+      const actualCancelLabel =
+        typeof opts === "object" && opts.cancelText
+          ? opts.cancelText
+          : cancelLabel;
+
+      const toastId = toast(message, {
+        duration,
+        action: {
+          label: confirmOnEnter
+            ? `${actualConfirmLabel} ↵`
+            : actualConfirmLabel,
+          onClick: handleToastConfirm,
+        },
+        cancel: {
+          label: actualCancelLabel,
+          onClick: handleToastCancel,
+        },
+        onDismiss: () => {
+          setActiveToastId(null);
+          setPendingConfirmCallback(null);
+          setPendingResolve(null);
+        },
+        onAutoClose: () => {
+          resolve(false);
+          setActiveToastId(null);
+          setPendingConfirmCallback(null);
+          setPendingResolve(null);
+        },
+      } as any);
+
+      if (confirmOnEnter) {
+        setActiveToastId(toastId);
+        setPendingConfirmCallback(() => () => {
+          if (callback) callback();
+        });
+        setPendingResolve(() => resolve);
      }
    });
  };
@@ -0,0 +1,64 @@
+import { useEffect, useState, useCallback } from "react";
+import { isElectron } from "@/ui/main-axios";
+
+interface ServiceWorkerState {
+  isSupported: boolean;
+  isRegistered: boolean;
+  updateAvailable: boolean;
+}
+
+export function useServiceWorker(): ServiceWorkerState {
+  const [state, setState] = useState<ServiceWorkerState>({
+    isSupported: false,
+    isRegistered: false,
+    updateAvailable: false,
+  });
+
+  const handleUpdateFound = useCallback(
+    (registration: ServiceWorkerRegistration) => {
+      const newWorker = registration.installing;
+      if (!newWorker) return;
+
+      newWorker.addEventListener("statechange", () => {
+        if (
+          newWorker.state === "installed" &&
+          navigator.serviceWorker.controller
+        ) {
+          setState((prev) => ({ ...prev, updateAvailable: true }));
+        }
+      });
+    },
+    [],
+  );
+
+  useEffect(() => {
+    const isSupported =
+      "serviceWorker" in navigator && !isElectron() && import.meta.env.PROD;
+
+    setState((prev) => ({ ...prev, isSupported }));
+
+    if (!isSupported) return;
+
+    const registerSW = async () => {
+      try {
+        const registration = await navigator.serviceWorker.register("/sw.js");
+        setState((prev) => ({ ...prev, isRegistered: true }));
+
+        registration.addEventListener("updatefound", () =>
+          handleUpdateFound(registration),
+        );
+      } catch (error) {
+        console.error("[SW] Registration failed:", error);
+      }
+    };
+
+    if (document.readyState === "complete") {
+      registerSW();
+    } else {
+      window.addEventListener("load", registerSW);
+      return () => window.removeEventListener("load", registerSW);
+    }
+  }, [handleUpdateFound]);
+
+  return state;
+}
@@ -3,31 +3,38 @@ import { initReactI18next } from "react-i18next";
 import LanguageDetector from "i18next-browser-languagedetector";

 import enTranslation from "../locales/en.json";
-import zhTranslation from "../locales/zh.json";
-import deTranslation from "../locales/de.json";
-import ptTranslation from "../locales/pt.json";
-import ruTranslation from "../locales/ru.json";
-import frTranslation from "../locales/fr.json";
-import koTranslation from "../locales/ko.json";
-import itTranslation from "../locales/it.json";
-import esTranslation from "../locales/es.json";
-import hiTranslation from "../locales/hi.json";
-import bnTranslation from "../locales/bn.json";
-import jaTranslation from "../locales/ja.json";
-import viTranslation from "../locales/vi.json";
-import trTranslation from "../locales/tr.json";
-import heTranslation from "../locales/he.json";
-import arTranslation from "../locales/ar.json";
-import plTranslation from "../locales/pl.json";
-import nlTranslation from "../locales/nl.json";
-import svTranslation from "../locales/sv.json";
-import idTranslation from "../locales/id.json";
-import thTranslation from "../locales/th.json";
-import ukTranslation from "../locales/uk.json";
-import csTranslation from "../locales/cs.json";
-import roTranslation from "../locales/ro.json";
-import elTranslation from "../locales/el.json";
-import nbTranslation from "../locales/nb.json";
+import afTranslation from "../locales/translated/af.json";
+import arTranslation from "../locales/translated/ar.json";
+import bnTranslation from "../locales/translated/bn.json";
+import bgTranslation from "../locales/translated/bg.json";
+import caTranslation from "../locales/translated/ca.json";
+import csTranslation from "../locales/translated/cs.json";
+import daTranslation from "../locales/translated/da.json";
+import deTranslation from "../locales/translated/de.json";
+import elTranslation from "../locales/translated/el.json";
+import esTranslation from "../locales/translated/es.json";
+import fiTranslation from "../locales/translated/fi.json";
+import frTranslation from "../locales/translated/fr.json";
+import heTranslation from "../locales/translated/he.json";
+import hiTranslation from "../locales/translated/hi.json";
+import huTranslation from "../locales/translated/hu.json";
+import idTranslation from "../locales/translated/id.json";
+import itTranslation from "../locales/translated/it.json";
+import jaTranslation from "../locales/translated/ja.json";
+import koTranslation from "../locales/translated/ko.json";
+import nlTranslation from "../locales/translated/nl.json";
+import noTranslation from "../locales/translated/no.json";
+import plTranslation from "../locales/translated/pl.json";
+import ptTranslation from "../locales/translated/pt.json";
+import roTranslation from "../locales/translated/ro.json";
+import ruTranslation from "../locales/translated/ru.json";
+import srTranslation from "../locales/translated/sr.json";
+import svTranslation from "../locales/translated/sv.json";
+import thTranslation from "../locales/translated/th.json";
+import trTranslation from "../locales/translated/tr.json";
+import ukTranslation from "../locales/translated/uk.json";
+import viTranslation from "../locales/translated/vi.json";
+import zhTranslation from "../locales/translated/zh.json";

 i18n
  .use(LanguageDetector)
@@ -35,31 +42,38 @@ i18n
  .init({
    supportedLngs: [
      "en",
-      "zh",
-      "de",
-      "pt",
-      "ru",
-      "fr",
-      "ko",
-      "it",
-      "es",
-      "hi",
-      "bn",
-      "ja",
-      "vi",
-      "tr",
-      "he",
+      "af",
      "ar",
-      "pl",
-      "nl",
-      "sv",
-      "id",
-      "th",
-      "uk",
+      "bn",
+      "bg",
+      "ca",
      "cs",
-      "ro",
+      "da",
+      "de",
      "el",
-      "nb",
+      "es",
+      "fi",
+      "fr",
+      "he",
+      "hi",
+      "hu",
+      "id",
+      "it",
+      "ja",
+      "ko",
+      "nl",
+      "no",
+      "pl",
+      "pt",
+      "ro",
+      "ru",
+      "sr",
+      "sv",
+      "th",
+      "tr",
+      "uk",
+      "vi",
+      "zh",
    ],
    fallbackLng: "en",
    debug: false,
@@ -76,80 +90,101 @@ i18n
      en: {
        translation: enTranslation,
      },
-      zh: {
-        translation: zhTranslation,
-      },
-      de: {
-        translation: deTranslation,
-      },
-      pt: {
-        translation: ptTranslation,
-      },
-      ru: {
-        translation: ruTranslation,
-      },
-      fr: {
-        translation: frTranslation,
-      },
-      ko: {
-        translation: koTranslation,
-      },
-      it: {
-        translation: itTranslation,
-      },
-      es: {
-        translation: esTranslation,
-      },
-      hi: {
-        translation: hiTranslation,
-      },
-      bn: {
-        translation: bnTranslation,
-      },
-      ja: {
-        translation: jaTranslation,
-      },
-      vi: {
-        translation: viTranslation,
-      },
-      tr: {
-        translation: trTranslation,
-      },
-      he: {
-        translation: heTranslation,
+      af: {
+        translation: afTranslation,
      },
      ar: {
        translation: arTranslation,
      },
-      pl: {
-        translation: plTranslation,
+      bn: {
+        translation: bnTranslation,
      },
-      nl: {
-        translation: nlTranslation,
+      bg: {
+        translation: bgTranslation,
      },
-      sv: {
-        translation: svTranslation,
-      },
-      id: {
-        translation: idTranslation,
-      },
-      th: {
-        translation: thTranslation,
-      },
-      uk: {
-        translation: ukTranslation,
+      ca: {
+        translation: caTranslation,
      },
      cs: {
        translation: csTranslation,
      },
-      ro: {
-        translation: roTranslation,
+      da: {
+        translation: daTranslation,
+      },
+      de: {
+        translation: deTranslation,
      },
      el: {
        translation: elTranslation,
      },
-      nb: {
-        translation: nbTranslation,
+      es: {
+        translation: esTranslation,
+      },
+      fi: {
+        translation: fiTranslation,
+      },
+      fr: {
+        translation: frTranslation,
+      },
+      he: {
+        translation: heTranslation,
+      },
+      hi: {
+        translation: hiTranslation,
+      },
+      hu: {
+        translation: huTranslation,
+      },
+      id: {
+        translation: idTranslation,
+      },
+      it: {
+        translation: itTranslation,
+      },
+      ja: {
+        translation: jaTranslation,
+      },
+      ko: {
+        translation: koTranslation,
+      },
+      nl: {
+        translation: nlTranslation,
+      },
+      no: {
+        translation: noTranslation,
+      },
+      pl: {
+        translation: plTranslation,
+      },
+      pt: {
+        translation: ptTranslation,
+      },
+      ro: {
+        translation: roTranslation,
+      },
+      ru: {
+        translation: ruTranslation,
+      },
+      sr: {
+        translation: srTranslation,
+      },
+      sv: {
+        translation: svTranslation,
+      },
+      th: {
+        translation: thTranslation,
+      },
+      tr: {
+        translation: trTranslation,
+      },
+      uk: {
+        translation: ukTranslation,
+      },
+      vi: {
+        translation: viTranslation,
+      },
+      zh: {
+        translation: zhTranslation,
      },
    },

@@ -0,0 +1,104 @@
+type EventListener = (...args: any[]) => void;
+
+class DatabaseHealthMonitor {
+  private static instance: DatabaseHealthMonitor;
+  private dbHealthy: boolean = true;
+  private lastCheckTime: number = 0;
+  private checkInProgress: boolean = false;
+  private listeners: Map<string, EventListener[]> = new Map();
+
+  private constructor() {}
+
+  static getInstance(): DatabaseHealthMonitor {
+    if (!DatabaseHealthMonitor.instance) {
+      DatabaseHealthMonitor.instance = new DatabaseHealthMonitor();
+    }
+    return DatabaseHealthMonitor.instance;
+  }
+
+  on(event: string, listener: EventListener): void {
+    if (!this.listeners.has(event)) {
+      this.listeners.set(event, []);
+    }
+    this.listeners.get(event)!.push(listener);
+  }
+
+  off(event: string, listener: EventListener): void {
+    const eventListeners = this.listeners.get(event);
+    if (eventListeners) {
+      const index = eventListeners.indexOf(listener);
+      if (index !== -1) {
+        eventListeners.splice(index, 1);
+      }
+    }
+  }
+
+  private emit(event: string, ...args: any[]): void {
+    const eventListeners = this.listeners.get(event);
+    if (eventListeners) {
+      eventListeners.forEach((listener) => listener(...args));
+    }
+  }
+
+  reportDatabaseError(error: any, wasAuthenticated: boolean = false) {
+    const errorMessage = error?.response?.data?.error || error?.message || "";
+    const errorCode = error?.response?.data?.code || error?.code;
+    const httpStatus = error?.response?.status;
+
+    const isDatabaseError =
+      errorMessage.toLowerCase().includes("database") ||
+      errorMessage.toLowerCase().includes("sqlite") ||
+      errorMessage.toLowerCase().includes("drizzle") ||
+      errorCode === "DATABASE_ERROR" ||
+      errorCode === "DB_CONNECTION_FAILED";
+
+    const isBackendUnreachable =
+      errorCode === "ERR_NETWORK" ||
+      errorCode === "ECONNREFUSED" ||
+      (errorMessage.toLowerCase().includes("network error") &&
+        error?.response === undefined);
+
+    const isAuthenticationLost =
+      wasAuthenticated &&
+      httpStatus === 401 &&
+      (errorCode === "AUTH_REQUIRED" ||
+        errorCode === "SESSION_EXPIRED" ||
+        errorCode === "SESSION_NOT_FOUND" ||
+        errorMessage === "Missing authentication token" ||
+        errorMessage === "Invalid token" ||
+        errorMessage === "Authentication required");
+
+    if (
+      (isDatabaseError || isBackendUnreachable || isAuthenticationLost) &&
+      this.dbHealthy
+    ) {
+      this.dbHealthy = false;
+      this.emit("database-connection-lost", {
+        error: errorMessage || "Backend server unreachable",
+        code: errorCode,
+        timestamp: Date.now(),
+      });
+    }
+  }
+
+  reportDatabaseSuccess() {
+    if (!this.dbHealthy) {
+      this.dbHealthy = true;
+      this.emit("database-connection-restored", {
+        timestamp: Date.now(),
+      });
+    }
+  }
+
+  isDatabaseHealthy(): boolean {
+    return this.dbHealthy;
+  }
+
+  reset() {
+    this.dbHealthy = true;
+    this.lastCheckTime = 0;
+    this.checkInProgress = false;
+  }
+}
+
+export const dbHealthMonitor = DatabaseHealthMonitor.getInstance();
@@ -0,0 +1,3 @@
+# DO NOT MODIFY TRANSLATED FILES DIRECTLY
+
+Instead, use Crowdsin. See [docs](https://docs.termix.site/translations).
@@ -44,6 +44,8 @@
    "passwordRequired": "Password is required",
    "sshKeyRequired": "SSH key is required",
    "credentialAddedSuccessfully": "Credential \"{{name}}\" added successfully",
+    "savingCredential": "Saving credential...",
+    "updatingCredential": "Updating credential...",
    "general": "General",
    "description": "Description",
    "folder": "Folder",
@@ -184,6 +186,32 @@
    "renameFolder": "Rename folder",
    "idLabel": "ID:"
  },
+  "quickConnect": {
+    "title": "Quick Connect",
+    "description": "Connect directly to a terminal or file manager session without saving a host configuration",
+    "ipAddress": "IP Address or Hostname",
+    "port": "Port",
+    "username": "Username",
+    "password": "Password",
+    "key": "SSH Private Key",
+    "keyPassword": "Key Password (Optional)",
+    "keyType": "Key Type",
+    "uploadFile": "Upload File",
+    "pasteKey": "Paste Key",
+    "credential": "Credential",
+    "overrideUsername": "Override Credential Username",
+    "overrideUsernameDesc": "Use a different username than the one stored in the credential",
+    "connectTerminal": "Connect to Terminal",
+    "connectFileManager": "Connect to File Manager",
+    "cancel": "Cancel",
+    "passwordRequired": "Password is required",
+    "keyRequired": "SSH key is required",
+    "credentialRequired": "Credential selection is required",
+    "connectionEstablished": "Connection established successfully",
+    "connectionFailed": "Failed to establish connection",
+    "autoDetect": "Auto Detect",
+    "authentication": "Authentication"
+  },
  "dragIndicator": {
    "error": "Error: {{error}}",
    "dragging": "Dragging {{fileName}}",
@@ -387,6 +415,7 @@
    "sshPath": "SSH Path",
    "localPath": "Local Path",
    "appName": "Termix",
+    "openInNewTab": "Open in New Tab",
    "resetSidebarWidth": "Reset sidebar width",
    "dragToResizeSidebar": "Drag to resize sidebar",
    "noAuthCredentials": "No authentication credentials available for this SSH host",
@@ -464,10 +493,12 @@
    "retry": "Retry",
    "checking": "Checking...",
    "checkingDatabase": "Checking database connection...",
+    "checkingAuthentication": "Checking authentication...",
    "actions": "Actions",
    "remove": "Remove",
    "revoke": "Revoke",
-    "create": "Create"
+    "create": "Create",
+    "update": "Update"
  },
  "nav": {
    "home": "Home",
@@ -489,7 +520,12 @@
    "hostManager": "Host Manager",
    "cannotSplitTab": "Cannot split this tab",
    "tabNavigation": "Tab Navigation",
-    "hostTabTitle": "{{username}}@{{ip}}:{{port}}"
+    "hostTabTitle": "{{username}}@{{ip}}:{{port}}",
+    "copyPassword": "Copy Password",
+    "copySudoPassword": "Copy Sudo Password",
+    "passwordCopied": "Password copied to clipboard",
+    "sudoPasswordCopied": "Sudo password copied to clipboard",
+    "noPasswordAvailable": "No password available"
  },
  "admin": {
    "title": "Admin Settings",
@@ -537,6 +573,7 @@
    "userRegistration": "User Registration",
    "allowNewAccountRegistration": "Allow new account registration",
    "allowPasswordLogin": "Allow username/password login",
+    "allowPasswordReset": "Allow password reset via reset code",
    "missingRequiredFields": "Missing required fields: {{fields}}",
    "oidcConfigurationUpdated": "OIDC configuration updated successfully!",
    "failedToFetchOidcConfig": "Failed to fetch OIDC configuration",
@@ -856,6 +893,13 @@
    "autoStartContainer": "Auto Start on Container Launch",
    "autoStartDesc": "Automatically start this tunnel when the container launches",
    "addConnection": "Add Tunnel Connection",
+    "tunnelType": "Tunnel Type",
+    "tunnelTypeLocal": "Local (-L)",
+    "tunnelTypeRemote": "Remote (-R)",
+    "tunnelTypeLocalDesc": "Forward local port to remote endpoint",
+    "tunnelTypeRemoteDesc": "Forward remote port to local machine",
+    "tunnelForwardDescriptionLocal": "This tunnel will forward traffic from local port {{sourcePort}} to port {{endpointPort}} on the endpoint machine.",
+    "tunnelForwardDescriptionRemote": "This tunnel will forward traffic from port {{sourcePort}} on the source machine (current connection details in general tab) to port {{endpointPort}} on the endpoint machine.",
    "sshpassRequired": "Sshpass Required For Password Authentication",
    "sshpassRequiredDesc": "For password authentication in tunnels, sshpass must be installed on the system.",
    "otherInstallMethods": "Other installation methods:",
@@ -863,13 +907,16 @@
    "or": "or",
    "centosRhelFedora": "CentOS/RHEL/Fedora",
    "macos": "macOS",
-    "windows": "Windows",
+    "windows": "Windows (WSL, no official binary)",
    "sshServerConfigRequired": "SSH Server Configuration Required",
    "sshServerConfigDesc": "For tunnel connections, the SSH server must be configured to allow port forwarding:",
    "gatewayPortsYes": "to bind remote ports to all interfaces",
    "allowTcpForwardingYes": "to enable port forwarding",
    "permitRootLoginYes": "if using root user for tunneling",
-    "editSshConfig": "Edit /etc/ssh/sshd_config and restart SSH: sudo systemctl restart sshd",
+    "editSshConfig": "Edit the SSH configuration file:",
+    "sshConfigPath": "/etc/ssh/sshd_config",
+    "restartSshService": "Then restart the SSH service:",
+    "restartSshCommand": "sudo systemctl restart sshd",
    "upload": "Upload",
    "authentication": "Authentication",
    "password": "Password",
@@ -1106,6 +1153,19 @@
    "quickActionName": "Action name",
    "noSnippetFound": "No snippet found",
    "quickActionsOrder": "Quick action buttons will appear in the order listed above on the Server Stats page",
+    "sidebarCustomization": "Sidebar Button Customization",
+    "sidebarCustomizationDesc": "Choose which actions appear as quick buttons in the sidebar. Actions not shown as buttons will appear in the dropdown menu.",
+    "showTerminalInSidebar": "Show Terminal Button",
+    "showTerminalInSidebarDesc": "Display terminal as a quick button in the sidebar",
+    "showFileManagerInSidebar": "Show File Manager Button",
+    "showFileManagerInSidebarDesc": "Display file manager as a quick button in the sidebar",
+    "showTunnelInSidebar": "Show Tunnel Button",
+    "showTunnelInSidebarDesc": "Display tunnel management as a quick button in the sidebar",
+    "showDockerInSidebar": "Show Docker Button",
+    "showDockerInSidebarDesc": "Display docker management as a quick button in the sidebar",
+    "showServerStatsInSidebar": "Show Server Stats Button",
+    "showServerStatsInSidebarDesc": "Display server statistics as a quick button in the sidebar",
+    "atLeastOneActionRequired": "At least one enabled action must be shown in the sidebar",
    "advancedAuthSettings": "Advanced Authentication Settings",
    "sudoPasswordAutoFill": "Sudo Password Auto-Fill",
    "sudoPasswordAutoFillDesc": "Automatically offer to insert SSH password when sudo prompts for password",
@@ -1125,6 +1185,15 @@
    "addVariable": "Add Variable",
    "docker": "Docker",
    "openDocker": "Open Docker",
+    "copyFullScreenUrl": "Copy Full-Screen URL",
+    "fullScreenUrlCopied": "Full-screen URL copied to clipboard",
+    "failedToCopyUrl": "Failed to copy URL to clipboard",
+    "copyTerminalUrl": "Copy Terminal URL",
+    "copyFileManagerUrl": "Copy File Manager URL",
+    "copyTunnelUrl": "Copy Tunnel URL",
+    "copyServerStatsUrl": "Copy Server Stats URL",
+    "copyDockerUrl": "Copy Docker URL",
+    "fullScreenUrlTooltip": "Copy URL to open this app in full-screen mode",
    "notEnabled": "Docker is not enabled for this host. Enable it in Host Settings to use Docker features.",
    "validating": "Validating Docker...",
    "error": "Error",
@@ -1274,10 +1343,34 @@
    "totpCodeLabel": "Verification Code",
    "totpPlaceholder": "000000",
    "totpVerify": "Verify",
+    "warpgateAuthRequired": "Warpgate Authentication Required",
+    "warpgateSecurityKey": "Security Key",
+    "warpgateAuthUrl": "Authentication URL",
+    "warpgateOpenBrowser": "Open in Browser",
+    "warpgateContinue": "I've Completed Authentication",
+    "warpgateTimeout": "Warpgate authentication timeout. Please reconnect.",
    "sudoPasswordPopupTitle": "Insert Password?",
    "sudoPasswordPopupHint": "Press Enter to insert, Esc to dismiss",
    "sudoPasswordPopupConfirm": "Insert",
-    "sudoPasswordPopupDismiss": "Dismiss"
+    "sudoPasswordPopupDismiss": "Dismiss",
+    "websocketAbnormalClose": "Connection closed unexpectedly. This may be due to a reverse proxy or SSL configuration issue. Please check server logs.",
+    "totpInvalid": "Invalid code. Please try again.",
+    "authMethodFallback": "{{method}} authentication failed. Trying alternative method...",
+    "authenticationRequired": "Authentication required",
+    "connectionLogTitle": "Connection Log",
+    "connectionLogCopy": "Copy logs to clipboard",
+    "connectionLogClear": "Clear logs",
+    "connectionLogEmpty": "No connection logs yet",
+    "connectionLogConnecting": "Connecting to host...",
+    "connectionLogCopied": "Connection logs copied to clipboard",
+    "connectionLogCopyFailed": "Failed to copy logs to clipboard",
+    "allAuthMethodsFailed": "All authentication methods failed. Please check your credentials.",
+    "methodNotSupported": "Server does not support {{method}} authentication. Available methods: {{available}}",
+    "retryWithMethod": "Retry with {{method}}",
+    "automaticFallback": "Automatically trying {{method}} authentication...",
+    "totpTimeout": "TOTP verification timeout. Please reconnect.",
+    "passwordTimeout": "Password verification timeout. Please reconnect.",
+    "connectionRejected": "Connection rejected by server. Please check your authentication and network configuration."
  },
  "fileManager": {
    "title": "File Manager",
@@ -1360,6 +1453,12 @@
    "itemDeletedSuccessfully": "{{type}} deleted successfully",
    "itemsDeletedSuccessfully": "{{count}} items deleted successfully",
    "failedToDeleteItems": "Failed to delete items",
+    "sudoPasswordRequired": "Administrator Password Required",
+    "enterSudoPassword": "Enter sudo password to continue this operation",
+    "sudoPassword": "Sudo password",
+    "sudoOperationFailed": "Sudo operation failed",
+    "sudoAuthFailed": "Sudo authentication failed",
+    "deleteOperation": "Delete files/folders",
    "dragFilesToUpload": "Drop files here to upload",
    "emptyFolder": "This folder is empty",
    "itemCount": "{{count}} items",
@@ -1564,9 +1663,11 @@
    "fileTooLarge": "File too large: {{error}}",
    "sshConnectionFailed": "SSH connection failed. Please check your connection to {{name}} ({{ip}}:{{port}})",
    "loadFileFailed": "Failed to load file: {{error}}",
+    "connecting": "Connecting...",
    "connectedSuccessfully": "Connected successfully",
    "totpVerificationFailed": "TOTP verification failed",
-    "sshConnectionFailed": "SSH connection failed. Please check your connection to {{name}} ({{ip}}:{{port}})",
+    "warpgateVerificationFailed": "Warpgate authentication failed",
+    "authenticationFailed": "Authentication failed",
    "verificationCodePrompt": "Verification code:",
    "newFolderDefault": "NewFolder",
    "newFileDefault": "NewFile.txt",
@@ -1673,6 +1774,8 @@
    "refreshStatus": "Refresh Status",
    "fileManagerAlreadyOpen": "File Manager already open for this host",
    "openFileManager": "Open File Manager",
+    "connecting": "Connecting...",
+    "connectionFailed": "Failed to connect to server",
    "cpuCores_one": "{{count}} CPU",
    "cpuCores_other": "{{count}} CPUs",
    "naCpus": "N/A CPU(s)",
@@ -1731,7 +1834,34 @@
    "executingQuickAction": "Executing {{name}}...",
    "quickActionSuccess": "{{name}} completed successfully",
    "quickActionFailed": "{{name}} failed",
-    "quickActionError": "Failed to execute {{name}}"
+    "quickActionError": "Failed to execute {{name}}",
+    "ports": {
+      "title": "Listening Ports",
+      "protocol": "Protocol",
+      "port": "Port",
+      "address": "Address",
+      "state": "State",
+      "process": "Process",
+      "noData": "No listening ports data"
+    },
+    "firewall": {
+      "title": "Firewall",
+      "active": "Active",
+      "inactive": "Inactive",
+      "notDetected": "Not Detected",
+      "policy": "Policy",
+      "rules": "rules",
+      "noRules": "No rules",
+      "noData": "No firewall data available",
+      "action": "Action",
+      "protocol": "Proto",
+      "port": "Port",
+      "source": "Source",
+      "accept": "ACCEPT",
+      "drop": "DROP",
+      "reject": "REJECT",
+      "anywhere": "Anywhere"
+    }
  },
  "auth": {
    "tagline": "SSH SERVER MANAGER",
@@ -1873,7 +2003,11 @@
    "emailExists": "Email already exists",
    "loadFailed": "Failed to load data",
    "saveError": "Failed to save",
-    "sessionExpired": "Session expired - please log in again"
+    "sessionExpired": "Session expired - please log in again",
+    "totpRateLimited": "Rate limited: Too many TOTP verification attempts. Please try again later.",
+    "totpRateLimitedWithTime": "Rate limited: Too many TOTP verification attempts. Please wait {{time}} seconds before trying again.",
+    "resetCodeRateLimited": "Rate limited: Too many verification attempts. Please try again later.",
+    "resetCodeRateLimitedWithTime": "Rate limited: Too many verification attempts. Please wait {{time}} seconds before trying again."
  },
  "messages": {
    "saveSuccess": "Saved successfully",
@@ -1931,6 +2065,9 @@
    "terminalSettings": "Terminal",
    "hostSidebarSettings": "Host & Sidebar",
    "snippetsSettings": "Snippets",
+    "updateSettings": "Updates",
+    "disableUpdateCheck": "Disable Update Check",
+    "disableUpdateCheckDesc": "Stop checking for new versions on startup and dashboard. Reduces network requests.",
    "currentPassword": "Current Password",
    "passwordChangedSuccess": "Password changed successfully! Please log in again.",
    "failedToChangePassword": "Failed to change password. Please check your current password and try again.",
@@ -1939,7 +2076,9 @@
    "themeDark": "Dark",
    "themeSystem": "System",
    "appearanceDesc": "Select the color theme for the application",
-    "terminalSyntaxHighlightingDesc": "Automatically highlight commands, paths, IPs, and log levels in terminal output"
+    "terminalSyntaxHighlightingDesc": "Automatically highlight commands, paths, IPs, and log levels in terminal output",
+    "enableCommandPaletteShortcut": "Enable Command Palette Shortcut",
+    "enableCommandPaletteShortcutDesc": "Double-tap left Shift to open the Command Palette for quick access to hosts"
  },
  "user": {
    "failedToLoadVersionInfo": "Failed to load version information"
@@ -2134,6 +2273,7 @@
  },
  "dashboard": {
    "title": "Dashboard",
+    "loading": "Loading dashboard...",
    "github": "GitHub",
    "support": "Support",
    "discord": "Discord",
@@ -2163,7 +2303,88 @@
    "noServerData": "No server data available",
    "cpu": "CPU",
    "ram": "RAM",
-    "notAvailable": "N/A"
+    "notAvailable": "N/A",
+    "customizeLayout": "Customize Dashboard",
+    "dashboardSettings": "Dashboard Settings",
+    "enableDisableCards": "Enable/Disable Cards",
+    "resetLayout": "Reset to Default",
+    "serverOverviewCard": "Server Overview",
+    "recentActivityCard": "Recent Activity",
+    "networkGraphCard": "Network Graph",
+    "networkGraph": "Network Graph",
+    "quickActionsCard": "Quick Actions",
+    "serverStatsCard": "Server Stats"
+  },
+  "networkGraph": {
+    "title": "Network Graph",
+    "addHost": "Add Host",
+    "addGroup": "Add Group",
+    "addLink": "Add Link",
+    "deleteSelected": "Delete Selected",
+    "zoomIn": "Zoom In",
+    "zoomOut": "Zoom Out",
+    "resetView": "Reset View",
+    "exportJson": "Export JSON",
+    "importJson": "Import JSON",
+    "selectHost": "Select Host",
+    "chooseHost": "Choose a host...",
+    "parentGroup": "Parent Group",
+    "noGroup": "No Group",
+    "groupName": "Group Name",
+    "color": "Color",
+    "source": "Source",
+    "target": "Target",
+    "moveToGroup": "Move to Group",
+    "selectGroup": "Select group...",
+    "addConnection": "Add Connection",
+    "hostDetails": "Host Details",
+    "connectToHost": "Connect to Host",
+    "openTerminal": "Open Terminal",
+    "openFileManager": "Open File Manager",
+    "openTunnel": "Open Tunnels",
+    "openDocker": "Open Docker",
+    "openServerStats": "Open Server Details",
+    "moveToGroupAction": "Move to Group",
+    "removeFromGroup": "Remove from Group",
+    "addHostHere": "Add Host Here",
+    "editGroup": "Edit Group",
+    "delete": "Delete",
+    "cancel": "Cancel",
+    "add": "Add",
+    "create": "Create",
+    "update": "Update",
+    "move": "Move",
+    "connect": "Connect",
+    "close": "Close",
+    "createGroup": "Create Group",
+    "noAvailableHosts": "No available hosts",
+    "selectSourcePlaceholder": "Select Source...",
+    "selectTargetPlaceholder": "Select Target...",
+    "invalidFile": "Invalid File",
+    "hostAlreadyExists": "Host is already in the topology",
+    "sourceTargetMustDiffer": "Source and target must be different",
+    "connectionExists": "Connection already exists",
+    "unknown": "Unknown",
+    "name": "Name",
+    "ip": "IP",
+    "status": "Status",
+    "id": "ID",
+    "failedToLoadData": "Failed to load network topology data",
+    "failedToAddNode": "Failed to add node",
+    "sourceDifferentFromTarget": "Source and target must be different",
+    "exportJSON": "Export JSON",
+    "importJSON": "Import JSON",
+    "searchHost": "Search hosts...",
+    "noHostFound": "No hosts found",
+    "searchGroup": "Search groups...",
+    "noGroupFound": "No groups found",
+    "searchNode": "Search nodes...",
+    "noNodeFound": "No nodes found",
+    "terminal": "Terminal",
+    "fileManager": "File Manager",
+    "tunnel": "Tunnel",
+    "docker": "Docker",
+    "serverStats": "Server Stats"
  },
  "rbac": {
    "shareHost": "Share Host",
@@ -2356,9 +2577,15 @@
    "notEnabled": "Docker is not enabled for this host",
    "validating": "Validating Docker...",
    "connectingToHost": "Connecting to host...",
+    "connecting": "Connecting...",
    "error": "Error",
    "errorCode": "Error code: {{code}}",
    "version": "Docker {{version}}",
+    "connectionFailed": "Failed to connect to Docker",
+    "totpVerificationFailed": "TOTP verification failed",
+    "warpgateVerificationFailed": "Warpgate verification failed",
+    "verificationCodePrompt": "Enter verification code",
+    "loadingContainers": "Loading containers...",
    "containerStarted": "Container {{name}} started",
    "failedToStartContainer": "Failed to start container {{name}}",
    "containerStopped": "Container {{name}} stopped",
@@ -2422,6 +2649,7 @@
    "authenticationRequired": "Authentication required",
    "verificationCodePrompt": "Enter verification code",
    "totpVerificationFailed": "TOTP verification failed. Please try again.",
+    "warpgateVerificationFailed": "Warpgate authentication failed. Please try again.",
    "connectedTo": "Connected to {{containerName}}",
    "disconnected": "Disconnected",
    "consoleError": "Console error",
@@ -2443,7 +2671,51 @@
    "logs": "Logs",
    "stats": "Stats",
    "consoleTab": "Console",
-    "startContainerToAccess": "Start the container to access the console"
+    "startContainerToAccess": "Start the container to access the console",
+    "log": {
+      "connecting": "Connecting to Docker host...",
+      "authStarted": "Resolving authentication credentials...",
+      "totpRequired": "TOTP verification required",
+      "warpgateRequired": "Warpgate authentication required",
+      "sessionCreated": "Docker SSH session established",
+      "sessionReady": "Ready for Docker operations",
+      "error": "Docker connection failed: {{error}}"
+    }
+  },
+  "stats": {
+    "log": {
+      "connecting": "Starting metrics collection...",
+      "existingSession": "Using existing metrics session",
+      "totpVerifying": "TOTP verification required",
+      "sessionEstablished": "Metrics session established",
+      "collecting": "Collecting server metrics",
+      "heartbeat": "Keeping connection alive",
+      "stopped": "Metrics collection stopped",
+      "error": "Metrics collection failed: {{error}}"
+    }
+  },
+  "tunnel": {
+    "log": {
+      "connecting": "Establishing tunnel connection...",
+      "sourceConnecting": "Connecting to source host {{host}}...",
+      "sourceConnected": "Connected to source host",
+      "endpointResolving": "Resolving endpoint host {{host}}...",
+      "endpointResolved": "Endpoint host resolved",
+      "forwarding": "Setting up port forwarding {{localPort}} → {{remotePort}}...",
+      "connected": "Tunnel established successfully",
+      "retrying": "Connection failed, retrying in {{countdown}}s (attempt {{attempt}}/{{max}})...",
+      "retryExhausted": "Max retry attempts reached",
+      "error": "Tunnel connection failed: {{error}}"
+    }
+  },
+  "sftp": {
+    "log": {
+      "connecting": "Connecting to SFTP server...",
+      "jumpHost": "Connecting via jump host {{host}}...",
+      "connected": "SFTP connection established",
+      "authFailed": "Authentication failed",
+      "error": "SFTP operation failed: {{error}}"
+    }
  },
  "theme": {
    "switchToLight": "Switch to Light",
--- a/Show More
+++ b/Show More