New Crowdin updates (#568 )

* New translations en.json (Chinese Simplified) * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Traditional) * New translations en.json (Chinese Traditional) * New translations en.json (Chinese Traditional) * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Traditional) * New translations en.json (Romanian) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Afrikaans) * New translations en.json (Arabic) * New translations en.json (Bulgarian) * New translations en.json (Catalan) * New translations en.json (Czech) * New translations en.json (Danish) * New translations en.json (German) * New translations en.json (Greek) * New translations en.json (Finnish) * New translations en.json (Hebrew) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Japanese) * New translations en.json (Korean) * New translations en.json (Dutch) * New translations en.json (Norwegian) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Serbian (Cyrillic)) * New translations en.json (Swedish) * New translations en.json (Turkish) * New translations en.json (Ukrainian) * New translations en.json (Vietnamese) * New translations en.json (Portuguese, Brazilian) * New translations en.json (Indonesian) * New translations en.json (Bengali) * New translations en.json (Thai) * New translations en.json (Hindi) * Delete src/locales/translated directory * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Traditional) * New translations en.json (Romanian) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Afrikaans) * New translations en.json (Arabic) * New translations en.json (Bulgarian) * New translations en.json (Catalan) * New translations en.json (Czech) * New translations en.json (Danish) * New translations en.json (German) * New translations en.json (Greek) * New translations en.json (Finnish) * New translations en.json (Hebrew) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Japanese) * New translations en.json (Korean) * New translations en.json (Dutch) * New translations en.json (Norwegian) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Serbian (Cyrillic)) * New translations en.json (Swedish) * New translations en.json (Turkish) * New translations en.json (Ukrainian) * New translations en.json (Vietnamese) * New translations en.json (Portuguese, Brazilian) * New translations en.json (Indonesian) * New translations en.json (Bengali) * New translations en.json (Thai) * New translations en.json (Hindi) * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Traditional) * New translations en.json (Romanian) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Afrikaans) * New translations en.json (Arabic) * New translations en.json (Bulgarian) * New translations en.json (Catalan) * New translations en.json (Czech) * New translations en.json (Danish) * New translations en.json (German) * New translations en.json (Greek) * New translations en.json (Finnish) * New translations en.json (Hebrew) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Japanese) * New translations en.json (Korean) * New translations en.json (Dutch) * New translations en.json (Norwegian) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Serbian (Cyrillic)) * New translations en.json (Swedish) * New translations en.json (Turkish) * New translations en.json (Ukrainian) * New translations en.json (Vietnamese) * New translations en.json (Portuguese, Brazilian) * New translations en.json (Indonesian) * New translations en.json (Bengali) * New translations en.json (Thai) * New translations en.json (Hindi) * Update source file en.json * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Traditional) * New translations en.json (Romanian) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Afrikaans) * New translations en.json (Arabic) * New translations en.json (Bulgarian) * New translations en.json (Catalan) * New translations en.json (Czech) * New translations en.json (Danish) * New translations en.json (German) * New translations en.json (Greek) * New translations en.json (Finnish) * New translations en.json (Hebrew) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Japanese) * New translations en.json (Korean) * New translations en.json (Dutch) * New translations en.json (Norwegian) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Serbian (Cyrillic)) * New translations en.json (Swedish) * New translations en.json (Turkish) * New translations en.json (Ukrainian) * New translations en.json (Vietnamese) * New translations en.json (Portuguese, Brazilian) * New translations en.json (Indonesian) * New translations en.json (Bengali) * New translations en.json (Thai) * New translations en.json (Hindi)
chore: remove translations
2026-07-15 04:43:36 +00:00 · 2026-02-12 22:42:36 -06:00 · 2026-02-12 22:42:23 -06:00 · 2026-02-12 22:28:13 -06:00 · 2026-02-09 20:40:54 -06:00 · 2026-01-26 23:06:34 -06:00
208 changed files with 97899 additions and 46849 deletions
@@ -29,3 +29,4 @@ _(Optional: add before/after screenshots, GIFs, or console output)_
 - [ ] Code follows project style guidelines
 - [ ] Supports mobile and desktop UI/app (if applicable)
 - [ ] I have read [Contributing.md](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)
+- [ ] This is not a translation request. See [docs](https://docs.termix.site/translations)
@@ -17,7 +17,7 @@ on:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
@@ -356,7 +356,7 @@ jobs:

  build-macos:
    runs-on: macos-latest
-    if: github.event.inputs.build_type == 'macos' || github.event.inputs.build_type == 'all'
+    if: (github.event.inputs.build_type == 'macos' || github.event.inputs.build_type == 'all') && github.event.inputs.artifact_destination != 'submit'
    needs: []
    permissions:
      contents: write
@@ -584,7 +584,7 @@ jobs:

  submit-to-chocolatey:
    runs-on: windows-latest
-    if: github.event.inputs.artifact_destination == 'submit'
+    if: github.event.inputs.artifact_destination == 'submit' && (github.event.inputs.build_type == 'all' || github.event.inputs.build_type == 'windows' || github.event.inputs.build_type == '')
    permissions:
      contents: read

@@ -688,8 +688,8 @@ jobs:
          retention-days: 30

  submit-to-flatpak:
-    runs-on: ubuntu-latest
-    if: github.event.inputs.artifact_destination == 'submit'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    if: github.event.inputs.artifact_destination == 'submit' && (github.event.inputs.build_type == 'all' || github.event.inputs.build_type == 'linux' || github.event.inputs.build_type == '')
    needs: []
    permissions:
      contents: read
@@ -776,7 +776,7 @@ jobs:

  submit-to-homebrew:
    runs-on: macos-latest
-    if: github.event.inputs.artifact_destination == 'submit'
+    if: github.event.inputs.artifact_destination == 'submit' && (github.event.inputs.build_type == 'all' || github.event.inputs.build_type == 'macos')
    needs: []
    permissions:
      contents: read
@@ -801,11 +801,20 @@ jobs:
          URL="https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$DMG_NAME"

          mkdir -p release_asset
-          PATH="release_asset/$DMG_NAME"
+          DOWNLOAD_PATH="release_asset/$DMG_NAME"
          echo "Downloading DMG from $URL"
-          curl -L -o "$PATH" "$URL"

-          CHECKSUM=$(shasum -a 256 "$PATH" | awk '{print $1}')
+          if command -v curl &> /dev/null; then
+            curl -L -o "$DOWNLOAD_PATH" "$URL"
+          elif command -v wget &> /dev/null; then
+            wget -O "$DOWNLOAD_PATH" "$URL"
+          else
+            echo "Neither curl nor wget is available, installing curl"
+            brew install curl
+            curl -L -o "$DOWNLOAD_PATH" "$URL"
+          fi
+
+          CHECKSUM=$(shasum -a 256 "$DOWNLOAD_PATH" | awk '{print $1}')

          echo "dmg_name=$DMG_NAME" >> $GITHUB_OUTPUT
          echo "checksum=$CHECKSUM" >> $GITHUB_OUTPUT
@@ -872,7 +881,7 @@ jobs:

  submit-to-testflight:
    runs-on: macos-latest
-    if: github.event.inputs.artifact_destination == 'submit'
+    if: github.event.inputs.artifact_destination == 'submit' && (github.event.inputs.build_type == 'all' || github.event.inputs.build_type == 'macos')
    needs: []
    permissions:
      contents: write
@@ -977,7 +986,7 @@ jobs:
      - name: Deploy to App Store Connect (TestFlight)
        if: steps.check_asc_creds.outputs.has_credentials == 'true'
        run: |
-          PKG_FILE=$(find artifact-mas -name "*.pkg" -type f | head -n 1)
+          PKG_FILE=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
          if [ -z "$PKG_FILE" ]; then
            echo "PKG file not found, exiting."
            exit 1
@@ -0,0 +1,32 @@
+name: Generate OpenAPI Specification
+
+on:
+  workflow_dispatch:
+
+jobs:
+  generate-openapi:
+    name: Generate OpenAPI JSON
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Generate OpenAPI specification
+        run: npm run generate:openapi
+
+      - name: Upload OpenAPI artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: openapi-spec
+          path: openapi.json
+          retention-days: 90
@@ -6,7 +6,7 @@ on:

 jobs:
  lint-and-build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404

    steps:
      - name: Checkout code
@@ -1,437 +0,0 @@
-name: Auto Translate
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  translate-zh:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t zh --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-zh
-          path: src/locales/zh.json
-        continue-on-error: true
-
-  translate-ru:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ru --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ru
-          path: src/locales/ru.json
-        continue-on-error: true
-
-  translate-pt:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t pt --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-pt
-          path: src/locales/pt.json
-        continue-on-error: true
-
-  translate-fr:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t fr --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-fr
-          path: src/locales/fr.json
-        continue-on-error: true
-
-  translate-es:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t es --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-es
-          path: src/locales/es.json
-        continue-on-error: true
-
-  translate-de:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t de --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-de
-          path: src/locales/de.json
-        continue-on-error: true
-
-  translate-hi:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t hi --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-hi
-          path: src/locales/hi.json
-        continue-on-error: true
-
-  translate-bn:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t bn --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-bn
-          path: src/locales/bn.json
-        continue-on-error: true
-
-  translate-ja:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ja --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ja
-          path: src/locales/ja.json
-        continue-on-error: true
-
-  translate-vi:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t vi --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-vi
-          path: src/locales/vi.json
-        continue-on-error: true
-
-  translate-tr:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t tr --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-tr
-          path: src/locales/tr.json
-        continue-on-error: true
-
-  translate-ko:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ko --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ko
-          path: src/locales/ko.json
-        continue-on-error: true
-
-  translate-it:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t it --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-it
-          path: src/locales/it.json
-        continue-on-error: true
-
-  translate-he:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t he --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-he
-          path: src/locales/he.json
-        continue-on-error: true
-
-  translate-ar:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ar --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ar
-          path: src/locales/ar.json
-        continue-on-error: true
-
-  translate-pl:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t pl --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-pl
-          path: src/locales/pl.json
-        continue-on-error: true
-
-  translate-nl:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t nl --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-nl
-          path: src/locales/nl.json
-        continue-on-error: true
-
-  translate-sv:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t sv --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-sv
-          path: src/locales/sv.json
-        continue-on-error: true
-
-  translate-id:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t id --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-id
-          path: src/locales/id.json
-        continue-on-error: true
-
-  translate-th:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t th --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-th
-          path: src/locales/th.json
-        continue-on-error: true
-
-  translate-uk:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t uk --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-uk
-          path: src/locales/uk.json
-        continue-on-error: true
-
-  translate-cs:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t cs --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-cs
-          path: src/locales/cs.json
-        continue-on-error: true
-
-  translate-ro:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t ro --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-ro
-          path: src/locales/ro.json
-        continue-on-error: true
-
-  translate-el:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t el --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-el
-          path: src/locales/el.json
-        continue-on-error: true
-
-  translate-nb:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - run: npx i18n-auto-translation -k ${{ secrets.GOOGLE_TRANSLATE_API_KEY }} -d "src/locales" -f en -t nb --maxLinesPerRequest 1
-      - uses: actions/upload-artifact@v4
-        with:
-          name: translations-nb
-          path: src/locales/nb.json
-        continue-on-error: true
-
-  create-pr:
-    needs:
-      [
-        translate-zh,
-        translate-ru,
-        translate-pt,
-        translate-fr,
-        translate-es,
-        translate-de,
-        translate-hi,
-        translate-bn,
-        translate-ja,
-        translate-vi,
-        translate-tr,
-        translate-ko,
-        translate-it,
-        translate-he,
-        translate-ar,
-        translate-pl,
-        translate-nl,
-        translate-sv,
-        translate-id,
-        translate-th,
-        translate-uk,
-        translate-cs,
-        translate-ro,
-        translate-el,
-        translate-nb,
-      ]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: translations-temp
-
-      - name: Move translations to src/locales
-        run: |
-          cp translations-temp/translations-zh/zh.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ru/ru.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-pt/pt.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-fr/fr.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-es/es.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-de/de.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-hi/hi.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-bn/bn.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ja/ja.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-vi/vi.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-tr/tr.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ko/ko.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-it/it.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-he/he.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ar/ar.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-pl/pl.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-nl/nl.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-sv/sv.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-id/id.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-th/th.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-uk/uk.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-cs/cs.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-ro/ro.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-el/el.json src/locales/ 2>/dev/null || true
-          cp translations-temp/translations-nb/nb.json src/locales/ 2>/dev/null || true
-          rm -rf translations-temp
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GHCR_TOKEN }}
-          commit-message: "chore: auto-translate to multiple languages"
-          branch: translations-update
-          delete-branch: true
-          title: "chore: Update translations for all languages"
@@ -1,6 +1,6 @@
 cask "termix" do
-  version "1.9.0"
-  sha256 "8fedd242b3cae1ebfd0c391a36f1c246a26ecac258b02478ee8dea2f33cd6d96"
+  version "1.11.0"
+  sha256 "c62ea2c3097f466229edcbd65a5ea49d898028a716a3023704c5f644d973c70d"

  url "https://github.com/Termix-SSH/Termix/releases/download/release-#{version}-tag/termix_macos_universal_dmg.dmg"
  name "Termix"
@@ -16,17 +16,6 @@
  <small style="color: #666;">2025年9月1日获得</small>
 </p>

-#### 核心技术
-
-[![React Badge](https://img.shields.io/badge/-React-61DBFB?style=flat-square&labelColor=black&logo=react&logoColor=61DBFB)](#)
-[![TypeScript Badge](https://img.shields.io/badge/-TypeScript-3178C6?style=flat-square&labelColor=black&logo=typescript&logoColor=3178C6)](#)
-[![Node.js Badge](https://img.shields.io/badge/-Node.js-3C873A?style=flat-square&labelColor=black&logo=node.js&logoColor=3C873A)](#)
-[![Vite Badge](https://img.shields.io/badge/-Vite-646CFF?style=flat-square&labelColor=black&logo=vite&logoColor=646CFF)](#)
-[![Tailwind CSS Badge](https://img.shields.io/badge/-TailwindCSS-38B2AC?style=flat-square&labelColor=black&logo=tailwindcss&logoColor=38B2AC)](#)
-[![Docker Badge](https://img.shields.io/badge/-Docker-2496ED?style=flat-square&labelColor=black&logo=docker&logoColor=2496ED)](#)
-[![SQLite Badge](https://img.shields.io/badge/-SQLite-003B57?style=flat-square&labelColor=black&logo=sqlite&logoColor=003B57)](#)
-[![Radix UI Badge](https://img.shields.io/badge/-Radix%20UI-161618?style=flat-square&labelColor=black&logo=radixui&logoColor=161618)](#)
-
 <br />
 <p align="center">
  <a href="https://github.com/Termix-SSH/Termix">
@@ -61,12 +50,14 @@ Termix 是一个开源、永久免费、自托管的一体化服务器管理平
 - **数据导出/导入** - 导出和导入 SSH 主机、凭据和文件管理器数据
 - **自动 SSL 设置** - 内置 SSL 证书生成和管理，支持 HTTPS 重定向
 - **现代用户界面** - 使用 React、Tailwind CSS 和 Shadcn 构建的简洁的桌面/移动设备友好界面。可选择基于深色或浅色模式的用户界面。
- **语言** - 内置支持约 30 种语言（通过 Google 翻译批量翻译，结果可能有所不同）
- **平台支持** - 可作为 Web 应用程序、桌面应用程序（Windows、Linux 和 macOS）以及适用于 iOS 和 Android 的专用移动/平板电脑应用程序。
+- **语言** - 内置支持约 30 种语言（由 [Crowdin](https://docs.termix.site/translations) 管理）
+- **平台支持** - 可作为 Web 应用程序、桌面应用程序（Windows、Linux 和 macOS）、PWA 以及适用于 iOS 和 Android 的专用移动/平板电脑应用程序。
 - **SSH 工具** - 创建可重用的命令片段，单击即可执行。在多个打开的终端上同时运行一个命令。
 - **命令历史** - 自动完成并查看以前运行的 SSH 命令
+- **快速连接** - 无需保存连接数据即可连接到服务器
 - **命令面板** - 双击左 Shift 键可快速使用键盘访问 SSH 连接
- **SSH 功能丰富** - 支持跳板机、warpgate、基于 TOTP 的连接、SOCKS5、密码自动填充等。
+- **SSH 功能丰富** - 支持跳板机、Warpgate、基于 TOTP 的连接、SOCKS5、密码自动填充等。
+- **网络图** - 自定义您的仪表板，根据您的 SSH 连接可视化您的家庭实验室，支持状态显示

 # 计划功能

@@ -76,20 +67,21 @@ Termix 是一个开源、永久免费、自托管的一体化服务器管理平

 支持的设备：

- 网站（任何平台上的任何现代浏览器，如 Chrome、Safari 和 Firefox）
+- 网站（任何平台上的任何现代浏览器，如 Chrome、Safari 和 Firefox）（包括 PWA 支持）
 - Windows（x64/ia32）
  - 便携版
  - MSI 安装程序
-  - Chocolatey 软件包管理器（即将推出）
+  - Chocolatey 软件包管理器
 - Linux（x64/ia32）
  - 便携版
+  - AUR
  - AppImage
  - Deb
-  - Flatpak（即将推出）
+  - Flatpak
 - macOS（x64/ia32 on v12.0+）
-  - Apple App Store（即将推出）
+  - Apple App Store
  - DMG
-  - Homebrew（即将推出）
+  - Homebrew
 - iOS/iPadOS（v15.1+）
  - Apple App Store
  - ISO
@@ -117,6 +109,22 @@ volumes:
    driver: local
 ```

+# 赞助商
+
+<p align="left">
+  <a href="https://www.digitalocean.com/">
+    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="50" alt="DigitalOcean">
+  </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://crowdin.com/">
+    <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="50" alt="Crowdin">
+  </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://www.blacksmith.sh/">
+    <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="50" alt="Crowdin">
+  </a>
+</p>
+
 # 支持

 如果你需要 Termix 的帮助或想要请求功能，请访问 [Issues](https://github.com/Termix-SSH/Support/issues) 页面，登录并点击 `New Issue`。
@@ -125,6 +133,8 @@ volumes:

 # 展示

+[![](https://utfs.io/f/nGnSqDveMsqxqiKJF5EnObSopHatulx93N0E1KVsP7hvjMfF)](https://www.youtube.com/watch?v=j1_I1mkhUkE)
+
 <p align="center">
  <img src="./repo-images/Image 1.png" width="400" alt="Termix Demo 1"/>
  <img src="./repo-images/Image 2.png" width="400" alt="Termix Demo 2"/>
@@ -147,14 +157,14 @@ volumes:

 <p align="center">
  <img src="./repo-images/Image 9.png" width="400" alt="Termix Demo 9"/>
-  <img src="./repo-images/Image 10.png" width="400" alt="Termix Demo 110"/>
+  <img src="./repo-images/Image 10.png" width="400" alt="Termix Demo 10"/>
 </p>

 <p align="center">
-  <video src="https://github.com/user-attachments/assets/88936e0d-2399-4122-8eee-c255c25da48c" width="800" controls>
-    你的浏览器不支持 video 标签。
-  </video>
+  <img src="./repo-images/Image 11.png" width="400" alt="Termix Demo 11"/>
+  <img src="./repo-images/Image 12.png" width="400" alt="Termix Demo 12"/>
 </p>
+
 某些视频和图像可能已过时或可能无法完美展示功能。

 # 许可证
@@ -16,17 +16,6 @@
  <small style="color: #666;">Achieved on September 1st, 2025</small>
 </p>

-#### Top Technologies
-
-[![React Badge](https://img.shields.io/badge/-React-61DBFB?style=flat-square&labelColor=black&logo=react&logoColor=61DBFB)](#)
-[![TypeScript Badge](https://img.shields.io/badge/-TypeScript-3178C6?style=flat-square&labelColor=black&logo=typescript&logoColor=3178C6)](#)
-[![Node.js Badge](https://img.shields.io/badge/-Node.js-3C873A?style=flat-square&labelColor=black&logo=node.js&logoColor=3C873A)](#)
-[![Vite Badge](https://img.shields.io/badge/-Vite-646CFF?style=flat-square&labelColor=black&logo=vite&logoColor=646CFF)](#)
-[![Tailwind CSS Badge](https://img.shields.io/badge/-TailwindCSS-38B2AC?style=flat-square&labelColor=black&logo=tailwindcss&logoColor=38B2AC)](#)
-[![Docker Badge](https://img.shields.io/badge/-Docker-2496ED?style=flat-square&labelColor=black&logo=docker&logoColor=2496ED)](#)
-[![SQLite Badge](https://img.shields.io/badge/-SQLite-003B57?style=flat-square&labelColor=black&logo=sqlite&logoColor=003B57)](#)
-[![Radix UI Badge](https://img.shields.io/badge/-Radix%20UI-161618?style=flat-square&labelColor=black&logo=radixui&logoColor=161618)](#)
-
 <br />
 <p align="center">
  <a href="https://github.com/Termix-SSH/Termix">
@@ -51,24 +40,26 @@ free and self-hosted alternative to Termius available for all platforms.
 # Features

 - **SSH Terminal Access** - Full-featured terminal with split-screen support (up to 4 panels) with a browser-like tab system. Includes support for customizing the terminal including common terminal themes, fonts, and other components
- **SSH Tunnel Management** - Create and manage SSH tunnels with automatic reconnection and health monitoring
- **Remote File Manager** - Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly
+- **SSH Tunnel Management** - Create and manage SSH tunnels with automatic reconnection and health monitoring and support for -l or -r connections
+- **Remote File Manager** - Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly with sudo support.
 - **Docker Management** - Start, stop, pause, remove containers. View container stats. Control container using docker exec terminal. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.
 - **SSH Host Manager** - Save, organize, and manage your SSH connections with tags and folders, and easily save reusable login info while being able to automate the deployment of SSH keys
- **Server Stats** - View CPU, memory, and disk usage along with network, uptime, and system information on any SSH server
+- **Server Stats** - View CPU, memory, and disk usage along with network, uptime, system information, firewall, port monitor, on most Linux based servers
 - **Dashboard** - View server information at a glance on your dashboard
 - **RBAC** - Create roles and share hosts across users/roles
 - **User Authentication** - Secure user management with admin controls and OIDC and 2FA (TOTP) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together.
 - **Database Encryption** - Backend stored as encrypted SQLite database files. View [docs](https://docs.termix.site/security) for more.
 - **Data Export/Import** - Export and import SSH hosts, credentials, and file manager data
 - **Automatic SSL Setup** - Built-in SSL certificate generation and management with HTTPS redirects
- **Modern UI** - Clean desktop/mobile-friendly interface built with React, Tailwind CSS, and Shadcn. Choose between dark or light mode based UI.
- **Languages** - Built-in support ~30 languages (bulk translated via Google Translate, results may vary ofc)
- **Platform Support** - Available as a web app, desktop application (Windows, Linux, and macOS), and dedicated mobile/tablet app for iOS and Android.
+- **Modern UI** - Clean desktop/mobile-friendly interface built with React, Tailwind CSS, and Shadcn. Choose between dark or light mode based UI. Use URL routes to open any connection in full-screen.
+- **Languages** - Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/translations))
+- **Platform Support** - Available as a web app, desktop application (Windows, Linux, and macOS), PWA, and dedicated mobile/tablet app for iOS and Android.
 - **SSH Tools** - Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.
 - **Command History** - Auto-complete and view previously ran SSH commands
+- **Quick Connect** - Connect to a server without having to save the connection data
 - **Command Palette** - Double tap left shift to quickly access SSH connections with your keyboard
- **SSH Feature Rich** - Supports jump hosts, warpgate, TOTP based connections, SOCKS5, password autofill, etc.
+- **SSH Feature Rich** - Supports jump hosts, Warpgate, TOTP based connections, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), etc.
+- **Network Graph** - Customize your Dashboard to visualize your homelab based off your SSH connections with status support

 # Planned Features

@@ -78,13 +69,14 @@ See [Projects](https://github.com/orgs/Termix-SSH/projects/2) for all planned fe

 Supported Devices:

- Website (any modern browser on any platform like Chrome, Safari, and Firefox)
+- Website (any modern browser on any platform like Chrome, Safari, and Firefox) (includes PWA support)
 - Windows (x64/ia32)
  - Portable
  - MSI Installer
  - Chocolatey Package Manager
 - Linux (x64/ia32)
  - Portable
+  - AUR
  - AppImage
  - Deb
  - Flatpak
@@ -120,6 +112,22 @@ volumes:
    driver: local
 ```

+# Sponsors
+
+<p align="left">
+  <a href="https://www.digitalocean.com/">
+    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="50" alt="DigitalOcean">
+  </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://crowdin.com/">
+    <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="50" alt="Crowdin">
+  </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://www.blacksmith.sh/">
+    <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="50" alt="Crowdin">
+  </a>
+</p>
+
 # Support

 If you need help or want to request a feature with Termix, visit the [Issues](https://github.com/Termix-SSH/Support/issues) page, log in, and press `New Issue`.
@@ -128,6 +136,8 @@ channel, however, response times may be longer.

 # Screenshots

+[![YouTube](./repo-images/YouTube.png)](https://youtu.be/8OYCPwS7ciA)
+
 <p align="center">
  <img src="./repo-images/Image 1.png" width="400" alt="Termix Demo 1"/>
  <img src="./repo-images/Image 2.png" width="400" alt="Termix Demo 2"/>
@@ -150,14 +160,14 @@ channel, however, response times may be longer.

 <p align="center">
  <img src="./repo-images/Image 9.png" width="400" alt="Termix Demo 9"/>
-  <img src="./repo-images/Image 10.png" width="400" alt="Termix Demo 110"/>
+  <img src="./repo-images/Image 10.png" width="400" alt="Termix Demo 10"/>
 </p>

 <p align="center">
-  <video src="https://github.com/user-attachments/assets/88936e0d-2399-4122-8eee-c255c25da48c" width="800" controls>
-    Your browser does not support the video tag.
-  </video>
+  <img src="./repo-images/Image 11.png" width="400" alt="Termix Demo 11"/>
+  <img src="./repo-images/Image 12.png" width="400" alt="Termix Demo 12"/>
 </p>
+
 Some videos and images may be out of date or may not perfectly showcase features.

 # License
@@ -0,0 +1,3 @@
+files:
+  - source: /src/locales/en.json
+    translation: /src/locales/translated/%locale_with_underscore%.json
@@ -19,7 +19,7 @@ COPY . .
 RUN find public/fonts -name "*.ttf" ! -name "*Regular.ttf" ! -name "*Bold.ttf" ! -name "*Italic.ttf" -delete

 RUN npm cache clean --force && \
-    npm run build
+    NODE_OPTIONS="--max-old-space-size=3072" npm run build

 # Stage 3: Build backend
 FROM deps AS backend-builder
@@ -51,11 +51,12 @@ ENV DATA_DIR=/app/data \
    PORT=8080 \
    NODE_ENV=production

-RUN apt-get update && apt-get install -y nginx gettext-base openssl && \
+RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu && \
+    update-ca-certificates && \
    rm -rf /var/lib/apt/lists/* && \
-    mkdir -p /app/data /app/uploads /app/nginx /app/nginx/logs /app/nginx/cache /app/nginx/client_body && \
+    mkdir -p /app/data /app/uploads /app/data/.opk /app/nginx /app/nginx/logs /app/nginx/cache /app/nginx/client_body && \
    chown -R node:node /app && \
-    chmod 755 /app/data /app/uploads /app/nginx && \
+    chmod 755 /app/data /app/uploads /app/data/.opk /app/nginx && \
    touch /app/nginx/nginx.conf && \
    chown node:node /app/nginx/nginx.conf

@@ -74,9 +75,10 @@ VOLUME ["/app/data"]

 EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006

+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
+    CMD node -e "require('http').get('http://localhost:30001/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"
+
 COPY docker/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh

-USER node
-
 CMD ["/entrypoint.sh"]
@@ -1,6 +1,22 @@
 #!/bin/sh
 set -e

+PUID=${PUID:-1000}
+PGID=${PGID:-1000}
+
+if [ "$(id -u)" = "0" ]; then
+    echo "Setting up user permissions (PUID: $PUID, PGID: $PGID)..."
+
+    groupmod -o -g "$PGID" node 2>/dev/null || true
+    usermod -o -u "$PUID" node 2>/dev/null || true
+
+    chown -R node:node /app/data /app/uploads /app/nginx 2>/dev/null || true
+
+    echo "User node is now UID: $PUID, GID: $PGID"
+
+    exec gosu node:node "$0" "$@"
+fi
+
 export PORT=${PORT:-8080}
 export ENABLE_SSL=${ENABLE_SSL:-false}
 export SSL_PORT=${SSL_PORT:-8443}
@@ -19,8 +35,26 @@ fi

 envsubst '${PORT} ${SSL_PORT} ${SSL_CERT_PATH} ${SSL_KEY_PATH}' < $NGINX_CONF_SOURCE > /app/nginx/nginx.conf

-mkdir -p /app/data /app/uploads
-chmod 755 /app/data /app/uploads 2>/dev/null || true
+mkdir -p /app/data /app/uploads /app/data/.opk
+chmod 755 /app/data /app/uploads /app/data/.opk 2>/dev/null || true
+
+if [ -w /app/data ]; then
+    echo "Data directory is writable"
+else
+    echo "WARNING: Data directory is not writable. OPKSSH may fail."
+    ls -ld /app/data
+fi
+
+if [ -w /app/data/.opk ]; then
+    echo "OPKSSH directory is writable"
+else
+    echo "WARNING: OPKSSH directory is not writable. OPKSSH authentication will fail."
+    ls -ld /app/data/.opk
+fi
+
+if [ ! -d "/app/opkssh" ]; then
+    echo "WARNING: OPKSSH binary directory not found at /app/opkssh"
+fi

 if [ "$ENABLE_SSL" = "true" ]; then
    echo "Checking SSL certificate configuration..."
@@ -1,3 +1,5 @@
+worker_processes 1;
+master_process off;
 pid /app/nginx/nginx.pid;
 error_log /app/nginx/logs/error.log warn;

@@ -199,6 +201,40 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location /ssh/quick-connect {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection 'upgrade';
+            proxy_set_header Host $host;
+            proxy_cache_bypass $http_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/ssh/opkssh-chooser(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001/ssh/opkssh-chooser$1$is_args$args;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $server_port;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/ssh/opkssh-callback(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001/ssh/opkssh-callback$1$is_args$args;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $server_port;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /ssh/ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -214,6 +250,10 @@ http {

            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $server_port;
+            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Host $host;
            proxy_cache_bypass $http_upgrade;

@@ -267,10 +307,21 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location /ssh/file_manager/sudo-password {
+            proxy_pass http://127.0.0.1:30004;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /ssh/file_manager/ssh/ {
            client_max_body_size 5G;
            client_body_timeout 300s;

+            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+
            proxy_pass http://127.0.0.1:30004;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
@@ -286,6 +337,15 @@ http {
            proxy_buffering off;
        }

+        location ~ ^/network-topology(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /health {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -335,6 +395,15 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location ~ ^/dashboard/preferences(/.*)?$ {
+            proxy_pass http://127.0.0.1:30006;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location ^~ /docker/console/ {
            proxy_pass http://127.0.0.1:30008/;
            proxy_http_version 1.1;
@@ -1,3 +1,5 @@
+worker_processes 1;
+master_process off;
 pid /app/nginx/nginx.pid;
 error_log /app/nginx/logs/error.log warn;

@@ -188,6 +190,40 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location /ssh/quick-connect {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection 'upgrade';
+            proxy_set_header Host $host;
+            proxy_cache_bypass $http_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/ssh/opkssh-chooser(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001/ssh/opkssh-chooser$1$is_args$args;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $server_port;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/ssh/opkssh-callback(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001/ssh/opkssh-callback$1$is_args$args;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $server_port;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /ssh/ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -203,7 +239,10 @@ http {

            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $host;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $server_port;
+            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_cache_bypass $http_upgrade;

            proxy_set_header X-Real-IP $remote_addr;
@@ -256,10 +295,21 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location /ssh/file_manager/sudo-password {
+            proxy_pass http://127.0.0.1:30004;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /ssh/file_manager/ssh/ {
            client_max_body_size 5G;
            client_body_timeout 300s;

+            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+
            proxy_pass http://127.0.0.1:30004;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
@@ -275,6 +325,15 @@ http {
            proxy_buffering off;
        }

+        location ~ ^/network-topology(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location /health {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -324,6 +383,15 @@ http {
            proxy_set_header X-Forwarded-Proto $scheme;
        }

+        location ~ ^/dashboard/preferences(/.*)?$ {
+            proxy_pass http://127.0.0.1:30006;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location ^~ /docker/console/ {
            proxy_pass http://127.0.0.1:30008/;
            proxy_http_version 1.1;
@@ -4,6 +4,16 @@
    <meta charset="UTF-8" />
    <link rel="icon" type="image/svg+xml" href="/favicon.ico" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+
+    <meta name="theme-color" content="#09090b" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta
+      name="apple-mobile-web-app-status-bar-style"
+      content="black-translucent"
+    />
+    <meta name="apple-mobile-web-app-title" content="Termix" />
+    <link rel="apple-touch-icon" href="/icons/512x512.png" />
+    <link rel="manifest" href="/manifest.json" />
    <title>Termix</title>
    <style>
      .hide-scrollbar {
@@ -1,12 +1,12 @@
 {
  "name": "termix",
-  "version": "1.10.0",
+  "version": "1.11.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "termix",
-      "version": "1.10.0",
+      "version": "1.11.1",
      "dependencies": {
        "@codemirror/autocomplete": "^6.18.7",
        "@codemirror/commands": "^6.3.3",
@@ -34,9 +34,11 @@
        "@tailwindcss/vite": "^4.1.14",
        "@types/bcryptjs": "^2.4.6",
        "@types/cookie-parser": "^1.4.9",
+        "@types/cytoscape": "^3.21.9",
        "@types/jszip": "^3.4.0",
        "@types/multer": "^2.0.0",
        "@types/qrcode": "^1.5.5",
+        "@types/react-grid-layout": "^1.3.6",
        "@types/speakeasy": "^2.0.10",
        "@uiw/codemirror-extensions-langs": "^4.24.1",
        "@uiw/codemirror-theme-github": "^4.25.4",
@@ -56,9 +58,11 @@
        "cmdk": "^1.1.1",
        "cookie-parser": "^1.4.7",
        "cors": "^2.8.5",
+        "cytoscape": "^3.33.1",
        "dotenv": "^17.2.0",
        "drizzle-orm": "^0.44.3",
        "express": "^5.1.0",
+        "https-proxy-agent": "^7.0.6",
        "i18n-auto-translation": "^2.2.3",
        "i18next": "^25.4.2",
        "i18next-browser-languagedetector": "^8.2.0",
@@ -72,7 +76,9 @@
        "node-fetch": "^3.3.2",
        "qrcode": "^1.5.4",
        "react": "^19.1.0",
+        "react-cytoscapejs": "^2.0.0",
        "react-dom": "^19.1.0",
+        "react-grid-layout": "^2.2.2",
        "react-h5-audio-player": "^3.10.1",
        "react-hook-form": "^7.60.0",
        "react-i18next": "^15.7.3",
@@ -122,11 +128,60 @@
        "husky": "^9.1.7",
        "lint-staged": "^16.2.3",
        "prettier": "3.6.2",
+        "swagger-jsdoc": "^6.2.8",
        "typescript": "~5.9.2",
        "typescript-eslint": "^8.40.0",
        "vite": "^7.1.5"
      }
    },
+    "node_modules/@apidevtools/json-schema-ref-parser": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/@apidevtools/json-schema-ref-parser/-/json-schema-ref-parser-9.1.2.tgz",
+      "integrity": "sha512-r1w81DpR+KyRWd3f+rk6TNqMgedmAxZP5v5KWlXQWlgMUUtyEJch0DKEci1SorPMiSeM8XPl7MZ3miJ60JIpQg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jsdevtools/ono": "^7.1.3",
+        "@types/json-schema": "^7.0.6",
+        "call-me-maybe": "^1.0.1",
+        "js-yaml": "^4.1.0"
+      }
+    },
+    "node_modules/@apidevtools/openapi-schemas": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@apidevtools/openapi-schemas/-/openapi-schemas-2.1.0.tgz",
+      "integrity": "sha512-Zc1AlqrJlX3SlpupFGpiLi2EbteyP7fXmUOGup6/DnkRgjP9bgMM/ag+n91rsv0U1Gpz0H3VILA/o3bW7Ua6BQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@apidevtools/swagger-methods": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@apidevtools/swagger-methods/-/swagger-methods-3.0.2.tgz",
+      "integrity": "sha512-QAkD5kK2b1WfjDS/UQn/qQkbwF31uqRjPTrsCs5ZG9BQGAkjwvqGFjjPqAuzac/IYzpPtRzjCP1WrTuAIjMrXg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@apidevtools/swagger-parser": {
+      "version": "10.0.3",
+      "resolved": "https://registry.npmjs.org/@apidevtools/swagger-parser/-/swagger-parser-10.0.3.tgz",
+      "integrity": "sha512-sNiLY51vZOmSPFZA5TF35KZ2HbgYklQnTSDnkghamzLb3EkNtcQnrBQEj5AOCxHpTtXpqMCRM1CrmV2rG6nw4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@apidevtools/json-schema-ref-parser": "^9.0.6",
+        "@apidevtools/openapi-schemas": "^2.0.4",
+        "@apidevtools/swagger-methods": "^3.0.2",
+        "@jsdevtools/ono": "^7.1.3",
+        "call-me-maybe": "^1.0.1",
+        "z-schema": "^5.0.1"
+      },
+      "peerDependencies": {
+        "openapi-types": ">=7"
+      }
+    },
    "node_modules/@babel/code-frame": {
      "version": "7.27.1",
      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",
@@ -158,6 +213,7 @@
      "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/code-frame": "^7.27.1",
        "@babel/generator": "^7.28.5",
@@ -443,6 +499,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/autocomplete/-/autocomplete-6.19.1.tgz",
      "integrity": "sha512-q6NenYkEy2fn9+JyjIxMWcNjzTL/IhwqfzOut1/G3PrIFkrbl4AL7Wkse5tLrQUUyqGoAKU5+Pi5jnnXxH5HGw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/language": "^6.0.0",
        "@codemirror/state": "^6.0.0",
@@ -491,6 +548,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/lang-css/-/lang-css-6.3.1.tgz",
      "integrity": "sha512-kr5fwBGiGtmz6l0LSJIbno9QrifNMUusivHbnA1H6Dmqy4HZFte3UAICix1VuKo0lMPKQr2rqB+0BkKi/S3Ejg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/autocomplete": "^6.0.0",
        "@codemirror/language": "^6.0.0",
@@ -517,6 +575,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/lang-html/-/lang-html-6.4.11.tgz",
      "integrity": "sha512-9NsXp7Nwp891pQchI7gPdTwBuSuT3K65NGTHWHNJ55HjYcHLllr0rbIZNdOzas9ztc1EUVBlHou85FFZS4BNnw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/autocomplete": "^6.0.0",
        "@codemirror/lang-css": "^6.0.0",
@@ -544,6 +603,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/lang-javascript/-/lang-javascript-6.2.4.tgz",
      "integrity": "sha512-0WVmhp1QOqZ4Rt6GlVGwKJN3KW7Xh4H2q8ZZNGZaP6lRdxXJzmjm4FqvmOojVj6khWJHIb9sp7U/72W7xQgqAA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/autocomplete": "^6.0.0",
        "@codemirror/language": "^6.6.0",
@@ -744,6 +804,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.11.3.tgz",
      "integrity": "sha512-9HBM2XnwDj7fnu0551HkGdrUrrqmYq/WC5iv6nbY2WdicXdGbhR/gfbZOH73Aqj4351alY1+aoG9rCNfiwS1RA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/state": "^6.0.0",
        "@codemirror/view": "^6.23.0",
@@ -820,6 +881,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.5.2.tgz",
      "integrity": "sha512-FVqsPqtPWKVVL3dPSxy8wEF/ymIEuVzF1PK3VbUgrxXpJUSHQWWZz4JMToquRxnkw+36LTamCZG2iua2Ptq0fA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@marijn/find-cluster-break": "^1.0.0"
      }
@@ -841,6 +903,7 @@
      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.38.6.tgz",
      "integrity": "sha512-qiS0z1bKs5WOvHIAC0Cybmv4AJSkAXgX5aD6Mqd2epSLlVJsQl8NG23jCVouIgkh4All/mrbdsf2UOLFnJw0tw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@codemirror/state": "^6.5.0",
        "crelt": "^1.0.6",
@@ -1168,6 +1231,7 @@
      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "fast-deep-equal": "^3.1.1",
        "fast-json-stable-stringify": "^2.0.0",
@@ -1554,7 +1618,6 @@
      "dev": true,
      "license": "BSD-2-Clause",
      "optional": true,
-      "peer": true,
      "dependencies": {
        "cross-dirname": "^0.1.0",
        "debug": "^4.3.4",
@@ -1576,7 +1639,6 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
-      "peer": true,
      "dependencies": {
        "graceful-fs": "^4.2.0",
        "jsonfile": "^6.0.1",
@@ -2619,11 +2681,19 @@
        "url": "https://opencollective.com/js-sdsl"
      }
    },
+    "node_modules/@jsdevtools/ono": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/@jsdevtools/ono/-/ono-7.1.3.tgz",
+      "integrity": "sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/@lezer/common": {
      "version": "1.3.0",
      "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.3.0.tgz",
      "integrity": "sha512-L9X8uHCYU310o99L3/MpJKYxPzXPOS7S0NmBaM7UO/x2Kb2WbmMLSkfvdr1KxRIFYOpbY0Jhn7CfLSUDzL8arQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
    },
    "node_modules/@lezer/cpp": {
      "version": "1.1.3",
@@ -2663,6 +2733,7 @@
      "resolved": "https://registry.npmjs.org/@lezer/highlight/-/highlight-1.2.3.tgz",
      "integrity": "sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@lezer/common": "^1.3.0"
      }
@@ -2694,6 +2765,7 @@
      "resolved": "https://registry.npmjs.org/@lezer/javascript/-/javascript-1.5.4.tgz",
      "integrity": "sha512-vvYx3MhWqeZtGPwDStM2dwgljd5smolYD2lR2UyFcHfxbBQebqx8yjmFmxtJ/E6nN6u1D9srOiVWm3Rb4tmcUA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@lezer/common": "^1.2.0",
        "@lezer/highlight": "^1.1.3",
@@ -2716,6 +2788,7 @@
      "resolved": "https://registry.npmjs.org/@lezer/lr/-/lr-1.4.2.tgz",
      "integrity": "sha512-pu0K1jCIdnQ12aWNaAVU5bzi7Bd1w54J3ECgANPmYLtQKP0HBj2cE/5coBD66MT10xbtIuUr7tg0Shbsvk0mDA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@lezer/common": "^1.0.0"
      }
@@ -5163,6 +5236,7 @@
      "integrity": "sha512-NMv9ASNARoKksWtsq/SHakpYAYnhBrQgGD8zkLYk/jaK8jUGn08CfEdTRgYhMypUQAfzSP8W6gNLe0q19/t4VA==",
      "devOptional": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/node": "*"
      }
@@ -5228,6 +5302,12 @@
        "@types/node": "*"
      }
    },
+    "node_modules/@types/cytoscape": {
+      "version": "3.21.9",
+      "resolved": "https://registry.npmjs.org/@types/cytoscape/-/cytoscape-3.21.9.tgz",
+      "integrity": "sha512-JyrG4tllI6jvuISPjHK9j2Xv/LTbnLekLke5otGStjFluIyA9JjgnvgZrSBsp8cEDpiTjwgZUZwpPv8TSBcoLw==",
+      "license": "MIT"
+    },
    "node_modules/@types/d3-array": {
      "version": "3.2.2",
      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
@@ -5320,6 +5400,7 @@
      "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.5.tgz",
      "integrity": "sha512-LuIQOcb6UmnF7C1PCFmEU1u2hmiHL43fgFQX67sN3H4Z+0Yk0Neo++mFsBjhOAuLzvlQeqAAkeDOZrJs9rzumQ==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/body-parser": "*",
        "@types/express-serve-static-core": "^5.0.0",
@@ -5442,6 +5523,7 @@
      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.9.2.tgz",
      "integrity": "sha512-uWN8YqxXxqFMX2RqGOrumsKeti4LlmIMIyV0lgut4jx7KQBcBiW6vkDtIBvHnHIquwNfJhk8v2OtmO8zXWHfPA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "undici-types": "~7.16.0"
      }
@@ -5484,6 +5566,7 @@
      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.2.tgz",
      "integrity": "sha512-6mDvHUFSjyT2B2yeNx2nUgMxh9LtOWvkhIU3uePn2I2oyNymUAX1NIsdgviM4CH+JSrp2D2hsMvJOkxY+0wNRA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "csstype": "^3.0.2"
      }
@@ -5494,10 +5577,20 @@
      "integrity": "sha512-9KQPoO6mZCi7jcIStSnlOWn2nEF3mNmyr3rIAsGnAbQKYbRLyqmeSc39EVgtxXVia+LMT8j3knZLAZAh+xLmrw==",
      "devOptional": true,
      "license": "MIT",
+      "peer": true,
      "peerDependencies": {
        "@types/react": "^19.2.0"
      }
    },
+    "node_modules/@types/react-grid-layout": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@types/react-grid-layout/-/react-grid-layout-1.3.6.tgz",
+      "integrity": "sha512-Cw7+sb3yyjtmxwwJiXtEXcu5h4cgs+sCGkHwHXsFmPyV30bf14LeD/fa2LwQovuD2HWxCcjIdNhDlcYGj95qGA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*"
+      }
+    },
    "node_modules/@types/responselike": {
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/@types/responselike/-/responselike-1.0.3.tgz",
@@ -5661,6 +5754,7 @@
      "integrity": "sha512-BnOroVl1SgrPLywqxyqdJ4l3S2MsKVLDVxZvjI1Eoe8ev2r3kGDo+PcMihNmDE+6/KjkTubSJnmqGZZjQSBq/g==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@typescript-eslint/scope-manager": "8.46.2",
        "@typescript-eslint/types": "8.46.2",
@@ -6068,7 +6162,8 @@
      "version": "5.5.0",
      "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-5.5.0.tgz",
      "integrity": "sha512-hqJHYaQb5OptNunnyAnkHyM8aCjZ1MEIDTQu1iIbbTD/xops91NB5yq1ZK/dC2JDbVWtF23zUtl9JE2NqwT87A==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
    },
    "node_modules/7zip-bin": {
      "version": "5.2.0",
@@ -6103,6 +6198,7 @@
      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "bin": {
        "acorn": "bin/acorn"
      },
@@ -6530,6 +6626,7 @@
      "integrity": "sha512-3yVdyZhklTiNrtg+4WqHpJpFDd+WHTg2oM7UcR80GqL05AOV0xEJzc6qNvFYoEtE+hRp1n9MpN6/+4yhlGkDXQ==",
      "hasInstallScript": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "bindings": "^1.5.0",
        "prebuild-install": "^7.1.1"
@@ -6672,6 +6769,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.8.19",
        "caniuse-lite": "^1.0.30001751",
@@ -6958,6 +7056,13 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
+    "node_modules/call-me-maybe": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-me-maybe/-/call-me-maybe-1.0.2.tgz",
+      "integrity": "sha512-HpX65o1Hnr9HH25ojC1YGs7HCQLq0GCOibSaWER0eNpgJ/Z1MZv2mTc7+xh6WOPxbRVcmgbv4hGU+uSQ/2xFZQ==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/callsites": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
@@ -7671,6 +7776,7 @@
      "integrity": "sha512-itvL5h8RETACmOTFc4UfIyB2RfEHi71Ax6E/PivVxq9NseKbOWpeyHEOIbmAw1rs8Ak0VursQNww7lf7YtUwzg==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "env-paths": "^2.2.1",
        "import-fresh": "^3.3.0",
@@ -7747,8 +7853,7 @@
      "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
      "dev": true,
      "license": "MIT",
-      "optional": true,
-      "peer": true
+      "optional": true
    },
    "node_modules/cross-spawn": {
      "version": "7.0.6",
@@ -7776,6 +7881,16 @@
      "integrity": "sha512-cjrsQufETwxjvwZbYbKBCJNvmQ2++G9AvT45zDi7NXL9k2PdVcs2h0jQz96J6G4TMKRCcEsoJ+QTgQD00Igtjw==",
      "license": "MIT"
    },
+    "node_modules/cytoscape": {
+      "version": "3.33.1",
+      "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.33.1.tgz",
+      "integrity": "sha512-iJc4TwyANnOGR1OmWhsS9ayRS3s+XQ185FmuHObThD+5AeJCakAAbWv8KimMTt08xCCLNgneQwFp+JRJOr9qGQ==",
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
    "node_modules/d3-array": {
      "version": "3.2.4",
      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
@@ -8211,6 +8326,7 @@
      "integrity": "sha512-59CAAjAhTaIMCN8y9kD573vDkxbs1uhDcrFLHSgutYdPcGOU35Rf95725snvzEOy4BFB7+eLJ8djCNPmGwG67w==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "app-builder-lib": "26.0.12",
        "builder-util": "26.0.11",
@@ -8304,12 +8420,24 @@
      "license": "MIT",
      "optional": true
    },
+    "node_modules/doctrine": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
+      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "esutils": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
    "node_modules/dompurify": {
      "version": "3.1.7",
      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.1.7.tgz",
      "integrity": "sha512-VaTstWtsneJY8xzy7DekmYWEOZcmzIe3Qb3zPd4STve1OBTa+e+WmS1ITQec1fZYXI3HCsOZZiSMpG6oxoWMWQ==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "peer": true
+      "license": "(MPL-2.0 OR Apache-2.0)"
    },
    "node_modules/dot-prop": {
      "version": "5.3.0",
@@ -8684,7 +8812,6 @@
      "dev": true,
      "hasInstallScript": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@electron/asar": "^3.2.1",
        "debug": "^4.1.1",
@@ -8705,7 +8832,6 @@
      "integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "graceful-fs": "^4.1.2",
        "jsonfile": "^4.0.0",
@@ -8721,7 +8847,6 @@
      "integrity": "sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "optionalDependencies": {
        "graceful-fs": "^4.1.6"
      }
@@ -8732,7 +8857,6 @@
      "integrity": "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "engines": {
        "node": ">= 4.0.0"
      }
@@ -8994,6 +9118,7 @@
      "integrity": "sha512-iy2GE3MHrYTL5lrCtMZ0X1KLEKKUjmK0kzwcnefhR66txcEmXZD2YWgR5GNdcEwkNx3a0siYkSvl0vIC+Svjmg==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.8.0",
        "@eslint-community/regexpp": "^4.12.1",
@@ -9498,6 +9623,12 @@
      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
      "license": "MIT"
    },
+    "node_modules/fast-equals": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/fast-equals/-/fast-equals-4.0.3.tgz",
+      "integrity": "sha512-G3BSX9cfKttjr+2o1O22tYMLq0DPluZnYtq1rXumE1SpL/F/SLIfHx08WYQoWSIpeMYf8sRbJ8++71+v6Pnxfg==",
+      "license": "MIT"
+    },
    "node_modules/fast-glob": {
      "version": "3.3.3",
      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
@@ -11005,6 +11136,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/runtime": "^7.27.6"
      },
@@ -12195,6 +12327,14 @@
      "integrity": "sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==",
      "license": "MIT"
    },
+    "node_modules/lodash.get": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
+      "integrity": "sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==",
+      "deprecated": "This package is deprecated. Use the optional chaining (?.) operator instead.",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/lodash.includes": {
      "version": "4.3.0",
      "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
@@ -12207,6 +12347,14 @@
      "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
      "license": "MIT"
    },
+    "node_modules/lodash.isequal": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/lodash.isequal/-/lodash.isequal-4.5.0.tgz",
+      "integrity": "sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==",
+      "deprecated": "This package is deprecated. Use require('node:util').isDeepStrictEqual instead.",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/lodash.isinteger": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
@@ -12571,7 +12719,6 @@
      "resolved": "https://registry.npmjs.org/marked/-/marked-14.0.0.tgz",
      "integrity": "sha512-uIj4+faQ+MgHgwUW1l2PsPglZLOLOT1uErt06dAPtx2kjteLAkbsd/0FiYg/MGS+i7ZKLb7w2WClxHkzOOuryQ==",
      "license": "MIT",
-      "peer": true,
      "bin": {
        "marked": "bin/marked.js"
      },
@@ -14068,6 +14215,14 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/openapi-types": {
+      "version": "12.1.3",
+      "resolved": "https://registry.npmjs.org/openapi-types/-/openapi-types-12.1.3.tgz",
+      "integrity": "sha512-N4YtSYJqghVu4iek2ZUvcN/0aqH1kRDuNqzcycDxhOUpg7GdvLa2F3DgS6yBNhInhv2r/6I0Flkn7CqL8+nIcw==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
    "node_modules/optionator": {
      "version": "0.9.4",
      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -14601,7 +14756,6 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
-      "peer": true,
      "dependencies": {
        "commander": "^9.4.0"
      },
@@ -14619,7 +14773,6 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
-      "peer": true,
      "engines": {
        "node": "^12.20.0 || >=14"
      }
@@ -15105,15 +15258,30 @@
      "resolved": "https://registry.npmjs.org/react/-/react-19.2.0.tgz",
      "integrity": "sha512-tmbWg6W31tQLeB5cdIBOicJDJRR2KzXsV7uSK9iNfLWQ5bIZfxuPEHp7M8wiHyHnn0DD1i7w3Zmin0FtkrwoCQ==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=0.10.0"
      }
    },
+    "node_modules/react-cytoscapejs": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/react-cytoscapejs/-/react-cytoscapejs-2.0.0.tgz",
+      "integrity": "sha512-t3SSl1DQy7+JQjN+8QHi1anEJlM3i3aAeydHTsJwmjo/isyKK7Rs7oCvU6kZsB9NwZidzZQR21Vm2PcBLG/Tjg==",
+      "license": "MIT",
+      "dependencies": {
+        "prop-types": "^15.8.1"
+      },
+      "peerDependencies": {
+        "cytoscape": "^3.2.19",
+        "react": ">=15.0.0"
+      }
+    },
    "node_modules/react-dom": {
      "version": "19.2.0",
      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.0.tgz",
      "integrity": "sha512-UlbRu4cAiGaIewkPyiRGJk0imDN2T3JjieT6spoL2UeSf5od4n5LB/mQ4ejmxhCFT1tYe8IvaFulzynWovsEFQ==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "scheduler": "^0.27.0"
      },
@@ -15121,6 +15289,38 @@
        "react": "^19.2.0"
      }
    },
+    "node_modules/react-draggable": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/react-draggable/-/react-draggable-4.5.0.tgz",
+      "integrity": "sha512-VC+HBLEZ0XJxnOxVAZsdRi8rD04Iz3SiiKOoYzamjylUcju/hP9np/aZdLHf/7WOD268WMoNJMvYfB5yAK45cw==",
+      "license": "MIT",
+      "dependencies": {
+        "clsx": "^2.1.1",
+        "prop-types": "^15.8.1"
+      },
+      "peerDependencies": {
+        "react": ">= 16.3.0",
+        "react-dom": ">= 16.3.0"
+      }
+    },
+    "node_modules/react-grid-layout": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/react-grid-layout/-/react-grid-layout-2.2.2.tgz",
+      "integrity": "sha512-yNo9pxQWoxHWRAwHGSVT4DEGELYPyQ7+q9lFclb5jcqeFzva63/2F72CryS/jiTIr/SBIlTaDdyjqH+ODg8oBw==",
+      "license": "MIT",
+      "dependencies": {
+        "clsx": "^2.1.1",
+        "fast-equals": "^4.0.3",
+        "prop-types": "^15.8.1",
+        "react-draggable": "^4.4.6",
+        "react-resizable": "^3.0.5",
+        "resize-observer-polyfill": "^1.5.1"
+      },
+      "peerDependencies": {
+        "react": ">= 16.3.0",
+        "react-dom": ">= 16.3.0"
+      }
+    },
    "node_modules/react-h5-audio-player": {
      "version": "3.10.1",
      "resolved": "https://registry.npmjs.org/react-h5-audio-player/-/react-h5-audio-player-3.10.1.tgz",
@@ -15140,6 +15340,7 @@
      "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.66.0.tgz",
      "integrity": "sha512-xXBqsWGKrY46ZqaHDo+ZUYiMUgi8suYu5kdrS20EG8KiL7VRQitEbNjm+UcrDYrNi1YLyfpmAeGjCZYXLT9YBw==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=18.0.0"
      },
@@ -15287,6 +15488,7 @@
      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.2.0.tgz",
      "integrity": "sha512-ROY9fvHhwOD9ySfrF0wmvu//bKCQ6AeZZq1nJNtbDC+kk5DuSuNX/n6YWYF/SYy7bSba4D4FSz8DJeKY/S/r+g==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/use-sync-external-store": "^0.0.6",
        "use-sync-external-store": "^1.4.0"
@@ -15362,6 +15564,20 @@
        }
      }
    },
+    "node_modules/react-resizable": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/react-resizable/-/react-resizable-3.1.3.tgz",
+      "integrity": "sha512-liJBNayhX7qA4tBJiBD321FDhJxgGTJ07uzH5zSORXoE8h7PyEZ8mLqmosST7ppf6C4zUsbd2gzDMmBCfFp9Lw==",
+      "license": "MIT",
+      "dependencies": {
+        "prop-types": "15.x",
+        "react-draggable": "^4.5.0"
+      },
+      "peerDependencies": {
+        "react": ">= 16.3",
+        "react-dom": ">= 16.3"
+      }
+    },
    "node_modules/react-resizable-panels": {
      "version": "3.0.6",
      "resolved": "https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-3.0.6.tgz",
@@ -15495,7 +15711,8 @@
      "version": "5.0.1",
      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
    },
    "node_modules/redux-thunk": {
      "version": "3.1.0",
@@ -15737,6 +15954,12 @@
      "integrity": "sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w==",
      "license": "MIT"
    },
+    "node_modules/resize-observer-polyfill": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/resize-observer-polyfill/-/resize-observer-polyfill-1.5.1.tgz",
+      "integrity": "sha512-LwZrotdHOo12nQuZlHEmtuXdqGoOD0OhaxopaNFxWzInpEgaLWoVuAMbTzixuosCx2nEG58ngzW3vxdWoxIgdg==",
+      "license": "MIT"
+    },
    "node_modules/resolve-alpn": {
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.2.1.tgz",
@@ -16717,6 +16940,95 @@
        "node": ">=8"
      }
    },
+    "node_modules/swagger-jsdoc": {
+      "version": "6.2.8",
+      "resolved": "https://registry.npmjs.org/swagger-jsdoc/-/swagger-jsdoc-6.2.8.tgz",
+      "integrity": "sha512-VPvil1+JRpmJ55CgAtn8DIcpBs0bL5L3q5bVQvF4tAW/k/9JYSj7dCpaYCAv5rufe0vcCbBRQXGvzpkWjvLklQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "commander": "6.2.0",
+        "doctrine": "3.0.0",
+        "glob": "7.1.6",
+        "lodash.mergewith": "^4.6.2",
+        "swagger-parser": "^10.0.3",
+        "yaml": "2.0.0-1"
+      },
+      "bin": {
+        "swagger-jsdoc": "bin/swagger-jsdoc.js"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/swagger-jsdoc/node_modules/commander": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-6.2.0.tgz",
+      "integrity": "sha512-zP4jEKbe8SHzKJYQmq8Y9gYjtO/POJLgIdKgV7B9qNmABVFVc+ctqSX6iXh4mCpJfRBOabiZ2YKPg8ciDw6C+Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/swagger-jsdoc/node_modules/glob": {
+      "version": "7.1.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.6.tgz",
+      "integrity": "sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==",
+      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.0.4",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/swagger-jsdoc/node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/swagger-jsdoc/node_modules/yaml": {
+      "version": "2.0.0-1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.0.0-1.tgz",
+      "integrity": "sha512-W7h5dEhywMKenDJh2iX/LABkbFnBxasD27oyXWDS/feDsxiw0dD5ncXdYXgkvAsXIY2MpW/ZKkr9IU30DBdMNQ==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/swagger-parser": {
+      "version": "10.0.3",
+      "resolved": "https://registry.npmjs.org/swagger-parser/-/swagger-parser-10.0.3.tgz",
+      "integrity": "sha512-nF7oMeL4KypldrQhac8RyHerJeGPD1p2xDh900GPvc+Nk7nWP6jX2FcC7WmkinMoAmoO774+AFXcWsW8gMWEIg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@apidevtools/swagger-parser": "10.0.3"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
    "node_modules/tailwind-merge": {
      "version": "3.3.1",
      "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.3.1.tgz",
@@ -16885,7 +17197,6 @@
      "integrity": "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "mkdirp": "^0.5.1",
        "rimraf": "~2.6.2"
@@ -16926,7 +17237,6 @@
      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "minimist": "^1.2.6"
      },
@@ -16941,7 +17251,6 @@
      "deprecated": "Rimraf versions prior to v4 are no longer supported",
      "dev": true,
      "license": "ISC",
-      "peer": true,
      "dependencies": {
        "glob": "^7.1.3"
      },
@@ -17046,6 +17355,7 @@
      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=12"
      },
@@ -17251,6 +17561,7 @@
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "devOptional": true,
      "license": "Apache-2.0",
+      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -17566,6 +17877,16 @@
      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
      "license": "MIT"
    },
+    "node_modules/validator": {
+      "version": "13.15.26",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.26.tgz",
+      "integrity": "sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
    "node_modules/vary": {
      "version": "1.1.2",
      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
@@ -17663,6 +17984,7 @@
      "resolved": "https://registry.npmjs.org/vite/-/vite-7.1.12.tgz",
      "integrity": "sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "esbuild": "^0.25.0",
        "fdir": "^6.5.0",
@@ -17754,6 +18076,7 @@
      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=12"
      },
@@ -18120,6 +18443,38 @@
      "integrity": "sha512-YHDIOAqgRpfl1Ois9HcB8UFtWOxK8KJrV5TXpImj4BKYP1rWT04f/fMM9tQ9SYZlBKukT7NR+9wcI3UpB5BMDQ==",
      "license": "MIT"
    },
+    "node_modules/z-schema": {
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/z-schema/-/z-schema-5.0.5.tgz",
+      "integrity": "sha512-D7eujBWkLa3p2sIpJA0d1pr7es+a7m0vFAnZLlCEKq/Ij2k0MLi9Br2UPxoxdYystm5K1yeBGzub0FlYUEWj2Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lodash.get": "^4.4.2",
+        "lodash.isequal": "^4.5.0",
+        "validator": "^13.7.0"
+      },
+      "bin": {
+        "z-schema": "bin/z-schema"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      },
+      "optionalDependencies": {
+        "commander": "^9.4.1"
+      }
+    },
+    "node_modules/z-schema/node_modules/commander": {
+      "version": "9.5.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-9.5.0.tgz",
+      "integrity": "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": "^12.20.0 || >=14"
+      }
+    },
    "node_modules/zod": {
      "version": "4.1.12",
      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.12.tgz",
@@ -1,7 +1,7 @@
 {
  "name": "termix",
  "private": true,
-  "version": "1.10.0",
+  "version": "1.11.1",
  "description": "A web-based server management platform with SSH terminal, tunneling, and file editing capabilities",
  "author": "Karmaa",
  "main": "electron/main.cjs",
@@ -17,6 +17,9 @@
    "build": "vite build && tsc -p tsconfig.node.json",
    "build:backend": "tsc -p tsconfig.node.json",
    "dev:backend": "tsc -p tsconfig.node.json && node ./dist/backend/backend/starter.js",
+    "dev:docker": "docker stop termix-dev 2>nul & docker rm termix-dev 2>nul & docker build -f docker/Dockerfile -t termix:dev --no-cache . && docker run -d --name termix-dev -p 3000:3000 -p 8080:8080 -p 30001-30006:30001-30006 -v \"%cd%\\db\\data:/app/data\" termix:dev",
+    "dev:docker:restart": "docker stop termix-dev 2>nul & docker rm termix-dev 2>nul & docker run -d --name termix-dev -p 8080:8080 -p 30001-30006:30001-30006 -v \"%cd%\\db\\data:/app/data\" termix:dev",
+    "generate:openapi": "tsc -p tsconfig.node.json && node ./dist/backend/backend/swagger.js",
    "preview": "vite preview",
    "electron:dev": "concurrently \"npm run dev\" \"powershell -c \\\"Start-Sleep -Seconds 5\\\" && electron .\"",
    "build:win-portable": "npm run build && electron-builder --win --dir",
@@ -53,9 +56,11 @@
    "@tailwindcss/vite": "^4.1.14",
    "@types/bcryptjs": "^2.4.6",
    "@types/cookie-parser": "^1.4.9",
+    "@types/cytoscape": "^3.21.9",
    "@types/jszip": "^3.4.0",
    "@types/multer": "^2.0.0",
    "@types/qrcode": "^1.5.5",
+    "@types/react-grid-layout": "^1.3.6",
    "@types/speakeasy": "^2.0.10",
    "@uiw/codemirror-extensions-langs": "^4.24.1",
    "@uiw/codemirror-theme-github": "^4.25.4",
@@ -75,9 +80,11 @@
    "cmdk": "^1.1.1",
    "cookie-parser": "^1.4.7",
    "cors": "^2.8.5",
+    "cytoscape": "^3.33.1",
    "dotenv": "^17.2.0",
    "drizzle-orm": "^0.44.3",
    "express": "^5.1.0",
+    "https-proxy-agent": "^7.0.6",
    "i18n-auto-translation": "^2.2.3",
    "i18next": "^25.4.2",
    "i18next-browser-languagedetector": "^8.2.0",
@@ -91,7 +98,9 @@
    "node-fetch": "^3.3.2",
    "qrcode": "^1.5.4",
    "react": "^19.1.0",
+    "react-cytoscapejs": "^2.0.0",
    "react-dom": "^19.1.0",
+    "react-grid-layout": "^2.2.2",
    "react-h5-audio-player": "^3.10.1",
    "react-hook-form": "^7.60.0",
    "react-i18next": "^15.7.3",
@@ -141,6 +150,7 @@
    "husky": "^9.1.7",
    "lint-staged": "^16.2.3",
    "prettier": "3.6.2",
+    "swagger-jsdoc": "^6.2.8",
    "typescript": "~5.9.2",
    "typescript-eslint": "^8.40.0",
    "vite": "^7.1.5"
@@ -0,0 +1,40 @@
+{
+  "name": "Termix",
+  "short_name": "Termix",
+  "description": "A web-based server management platform with SSH terminal, tunneling, and file editing capabilities",
+  "theme_color": "#09090b",
+  "background_color": "#09090b",
+  "display": "standalone",
+  "orientation": "any",
+  "scope": "./",
+  "start_url": "./",
+  "icons": [
+    {
+      "src": "./icons/48x48.png",
+      "sizes": "48x48",
+      "type": "image/png"
+    },
+    {
+      "src": "./icons/64x64.png",
+      "sizes": "64x64",
+      "type": "image/png"
+    },
+    {
+      "src": "./icons/128x128.png",
+      "sizes": "128x128",
+      "type": "image/png"
+    },
+    {
+      "src": "./icons/256x256.png",
+      "sizes": "256x256",
+      "type": "image/png"
+    },
+    {
+      "src": "./icons/512x512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any maskable"
+    }
+  ],
+  "categories": ["utilities", "developer", "productivity"]
+}
@@ -0,0 +1,99 @@
+const CACHE_NAME = "termix-v1";
+const STATIC_ASSETS = [
+  "/",
+  "/index.html",
+  "/manifest.json",
+  "/favicon.ico",
+  "/icons/48x48.png",
+  "/icons/128x128.png",
+  "/icons/256x256.png",
+  "/icons/512x512.png",
+];
+
+self.addEventListener("install", (event) => {
+  event.waitUntil(
+    caches
+      .open(CACHE_NAME)
+      .then((cache) => {
+        return cache.addAll(STATIC_ASSETS);
+      })
+      .then(() => {
+        return self.skipWaiting();
+      }),
+  );
+});
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    caches
+      .keys()
+      .then((cacheNames) => {
+        return Promise.all(
+          cacheNames
+            .filter((name) => name !== CACHE_NAME)
+            .map((name) => {
+              return caches.delete(name);
+            }),
+        );
+      })
+      .then(() => {
+        return self.clients.claim();
+      }),
+  );
+});
+
+self.addEventListener("fetch", (event) => {
+  const { request } = event;
+  const url = new URL(request.url);
+
+  if (request.method !== "GET") {
+    return;
+  }
+
+  if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/ws")) {
+    return;
+  }
+
+  if (url.origin !== self.location.origin) {
+    return;
+  }
+
+  if (request.mode === "navigate") {
+    event.respondWith(
+      fetch(request).catch(() => {
+        return caches.match("/index.html");
+      }),
+    );
+    return;
+  }
+
+  const isStaticAsset = STATIC_ASSETS.some((asset) => {
+    if (asset === "/") return url.pathname === "/";
+    return url.pathname === asset || url.pathname.startsWith("/assets/");
+  });
+
+  if (!isStaticAsset) {
+    return;
+  }
+
+  event.respondWith(
+    caches.match(request).then((cachedResponse) => {
+      if (cachedResponse) {
+        return cachedResponse;
+      }
+
+      return fetch(request).then((response) => {
+        if (!response || response.status !== 200 || response.type !== "basic") {
+          return response;
+        }
+
+        const responseClone = response.clone();
+        caches.open(CACHE_NAME).then((cache) => {
+          cache.put(request, responseClone);
+        });
+
+        return response;
+      });
+    }),
+  );
+});
@@ -1,9 +1,14 @@
 import express from "express";
 import cors from "cors";
 import cookieParser from "cookie-parser";
-import { getDb } from "./database/db/index.js";
-import { recentActivity, sshData, hostAccess } from "./database/db/schema.js";
-import { eq, and, desc, or } from "drizzle-orm";
+import { getDb, DatabaseSaveTrigger } from "./database/db/index.js";
+import {
+  recentActivity,
+  sshData,
+  hostAccess,
+  dashboardPreferences,
+} from "./database/db/schema.js";
+import { eq, and, desc, or, sql } from "drizzle-orm";
 import { dashboardLogger } from "./utils/logger.js";
 import { SimpleDBOps } from "./utils/simple-db-ops.js";
 import { AuthManager } from "./utils/auth-manager.js";
@@ -22,12 +27,7 @@ app.use(
    origin: (origin, callback) => {
      if (!origin) return callback(null, true);

-      const allowedOrigins = [
-        "http://localhost:5173",
-        "http://localhost:3000",
-        "http://127.0.0.1:5173",
-        "http://127.0.0.1:3000",
-      ];
+      const allowedOrigins = ["http://localhost:5173", "http://127.0.0.1:5173"];

      if (allowedOrigins.includes(origin)) {
        return callback(null, true);
@@ -58,8 +58,36 @@ app.use(express.json({ limit: "1mb" }));

 app.use(authManager.createAuthMiddleware());

+/**
+ * @openapi
+ * /uptime:
+ *   get:
+ *     summary: Get server uptime
+ *     description: Returns the uptime of the server in various formats.
+ *     tags:
+ *       - Dashboard
+ *     responses:
+ *       200:
+ *         description: Server uptime information.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 uptimeMs:
+ *                   type: number
+ *                 uptimeSeconds:
+ *                   type: number
+ *                 formatted:
+ *                   type: string
+ *       500:
+ *         description: Failed to get uptime.
+ */
 app.get("/uptime", async (req, res) => {
  try {
+    const startTime = Date.now();
+    const userId = (req as AuthenticatedRequest).userId;
+
    const uptimeMs = Date.now() - serverStartTime;
    const uptimeSeconds = Math.floor(uptimeMs / 1000);
    const days = Math.floor(uptimeSeconds / 86400);
@@ -77,6 +105,28 @@ app.get("/uptime", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /activity/recent:
+ *   get:
+ *     summary: Get recent activity
+ *     description: Fetches the most recent activities for the authenticated user.
+ *     tags:
+ *       - Dashboard
+ *     parameters:
+ *       - in: query
+ *         name: limit
+ *         schema:
+ *           type: integer
+ *         description: The maximum number of activities to return.
+ *     responses:
+ *       200:
+ *         description: A list of recent activities.
+ *       401:
+ *         description: Session expired.
+ *       500:
+ *         description: Failed to get recent activity.
+ */
 app.get("/activity/recent", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -108,6 +158,40 @@ app.get("/activity/recent", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /activity/log:
+ *   post:
+ *     summary: Log a new activity
+ *     description: Logs a new user activity, such as accessing a terminal or file manager. This endpoint is rate-limited.
+ *     tags:
+ *       - Dashboard
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               type:
+ *                 type: string
+ *                 enum: [terminal, file_manager, server_stats, tunnel, docker]
+ *               hostId:
+ *                 type: integer
+ *               hostName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Activity logged successfully or rate-limited.
+ *       400:
+ *         description: Invalid request body.
+ *       401:
+ *         description: Session expired.
+ *       404:
+ *         description: Host not found or access denied.
+ *       500:
+ *         description: Failed to log activity.
+ */
 app.post("/activity/log", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -224,6 +308,22 @@ app.post("/activity/log", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /activity/reset:
+ *   delete:
+ *     summary: Reset recent activity
+ *     description: Clears all recent activity for the authenticated user.
+ *     tags:
+ *       - Dashboard
+ *     responses:
+ *       200:
+ *         description: Recent activity cleared.
+ *       401:
+ *         description: Session expired.
+ *       500:
+ *         description: Failed to reset activity.
+ */
 app.delete("/activity/reset", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -253,6 +353,160 @@ app.delete("/activity/reset", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /dashboard/preferences:
+ *   get:
+ *     summary: Get dashboard layout preferences
+ *     description: Returns the user's customized dashboard layout settings. If no preferences exist, returns default layout.
+ *     tags:
+ *       - Dashboard
+ *     responses:
+ *       200:
+ *         description: Dashboard preferences retrieved
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 cards:
+ *                   type: array
+ *                   items:
+ *                     type: object
+ *                     properties:
+ *                       id:
+ *                         type: string
+ *                       enabled:
+ *                         type: boolean
+ *                       order:
+ *                         type: integer
+ *       401:
+ *         description: Session expired
+ *       500:
+ *         description: Failed to get preferences
+ */
+app.get("/dashboard/preferences", async (req, res) => {
+  try {
+    const userId = (req as AuthenticatedRequest).userId;
+
+    if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+      return res.status(401).json({
+        error: "Session expired - please log in again",
+        code: "SESSION_EXPIRED",
+      });
+    }
+
+    const preferences = await getDb()
+      .select()
+      .from(dashboardPreferences)
+      .where(eq(dashboardPreferences.userId, userId));
+
+    if (preferences.length === 0) {
+      const defaultLayout = {
+        cards: [
+          { id: "server_overview", enabled: true, order: 1 },
+          { id: "recent_activity", enabled: true, order: 2 },
+          { id: "network_graph", enabled: false, order: 3 },
+          { id: "quick_actions", enabled: true, order: 4 },
+          { id: "server_stats", enabled: true, order: 5 },
+        ],
+      };
+      return res.json(defaultLayout);
+    }
+
+    const layout = JSON.parse(preferences[0].layout as string);
+    res.json(layout);
+  } catch (err) {
+    dashboardLogger.error("Failed to get dashboard preferences", err);
+    res.status(500).json({ error: "Failed to get dashboard preferences" });
+  }
+});
+
+/**
+ * @openapi
+ * /dashboard/preferences:
+ *   post:
+ *     summary: Save dashboard layout preferences
+ *     description: Saves or updates the user's customized dashboard layout settings.
+ *     tags:
+ *       - Dashboard
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               cards:
+ *                 type: array
+ *                 items:
+ *                   type: object
+ *                   properties:
+ *                     id:
+ *                       type: string
+ *                     enabled:
+ *                       type: boolean
+ *                     order:
+ *                       type: integer
+ *     responses:
+ *       200:
+ *         description: Preferences saved successfully
+ *       400:
+ *         description: Invalid request body
+ *       401:
+ *         description: Session expired
+ *       500:
+ *         description: Failed to save preferences
+ */
+app.post("/dashboard/preferences", async (req, res) => {
+  try {
+    const userId = (req as AuthenticatedRequest).userId;
+
+    if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+      return res.status(401).json({
+        error: "Session expired - please log in again",
+        code: "SESSION_EXPIRED",
+      });
+    }
+
+    const { cards } = req.body;
+
+    if (!cards || !Array.isArray(cards)) {
+      return res.status(400).json({
+        error: "Invalid request body. Expected { cards: Array }",
+      });
+    }
+
+    const layout = JSON.stringify({ cards });
+
+    const existing = await getDb()
+      .select()
+      .from(dashboardPreferences)
+      .where(eq(dashboardPreferences.userId, userId));
+
+    if (existing.length > 0) {
+      await getDb()
+        .update(dashboardPreferences)
+        .set({ layout, updatedAt: sql`CURRENT_TIMESTAMP` })
+        .where(eq(dashboardPreferences.userId, userId));
+    } else {
+      await getDb().insert(dashboardPreferences).values({ userId, layout });
+    }
+
+    await DatabaseSaveTrigger.triggerSave("dashboard_preferences_updated");
+
+    dashboardLogger.success("Dashboard preferences saved", {
+      operation: "save_dashboard_preferences",
+      userId,
+    });
+
+    res.json({ success: true, message: "Dashboard preferences saved" });
+  } catch (err) {
+    dashboardLogger.error("Failed to save dashboard preferences", err);
+    res.status(500).json({ error: "Failed to save dashboard preferences" });
+  }
+});
+
 const PORT = 30006;
 app.listen(PORT, async () => {
  try {
@@ -8,6 +8,7 @@ import alertRoutes from "./routes/alerts.js";
 import credentialsRoutes from "./routes/credentials.js";
 import snippetsRoutes from "./routes/snippets.js";
 import terminalRoutes from "./routes/terminal.js";
+import networkTopologyRoutes from "./routes/network-topology.js";
 import rbacRoutes from "./routes/rbac.js";
 import cors from "cors";
 import fetch from "node-fetch";
@@ -24,6 +25,7 @@ import { UserDataExport } from "../utils/user-data-export.js";
 import { AutoSSLSetup } from "../utils/auto-ssl-setup.js";
 import { eq, and } from "drizzle-orm";
 import { parseUserAgent } from "../utils/user-agent-parser.js";
+import { getProxyAgent } from "../utils/proxy-agent.js";
 import {
  users,
  sshData,
@@ -41,7 +43,7 @@ import type {
  GitHubAPIResponse,
  AuthenticatedRequest,
 } from "../../types/index.js";
-import { getDb } from "./db/index.js";
+import { getDb, DatabaseSaveTrigger } from "./db/index.js";
 import Database from "better-sqlite3";

 const app = express();
@@ -56,12 +58,7 @@ app.use(
    origin: (origin, callback) => {
      if (!origin) return callback(null, true);

-      const allowedOrigins = [
-        "http://localhost:5173",
-        "http://localhost:3000",
-        "http://127.0.0.1:5173",
-        "http://127.0.0.1:3000",
-      ];
+      const allowedOrigins = ["http://localhost:5173", "http://127.0.0.1:5173"];

      if (allowedOrigins.includes(origin)) {
        return callback(null, true);
@@ -165,12 +162,14 @@ async function fetchGitHubAPI<T>(
  }

  try {
-    const response = await fetch(`${GITHUB_API_BASE}${endpoint}`, {
+    const url = `${GITHUB_API_BASE}${endpoint}`;
+    const response = await fetch(url, {
      headers: {
        Accept: "application/vnd.github+json",
        "User-Agent": "TermixUpdateChecker/1.0",
        "X-GitHub-Api-Version": "2022-11-28",
      },
+      agent: getProxyAgent(url),
    });

    if (!response.ok) {
@@ -205,10 +204,46 @@ app.use(bodyParser.urlencoded({ limit: "1gb", extended: true }));
 app.use(bodyParser.raw({ limit: "5gb", type: "application/octet-stream" }));
 app.use(cookieParser());

+/**
+ * @openapi
+ * /health:
+ *   get:
+ *     summary: Health check
+ *     description: Returns the health status of the server.
+ *     tags:
+ *       - General
+ *     responses:
+ *       200:
+ *         description: Server is healthy.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 status:
+ *                   type: string
+ *                   example: ok
+ */
 app.get("/health", (req, res) => {
  res.json({ status: "ok" });
 });

+/**
+ * @openapi
+ * /version:
+ *   get:
+ *     summary: Get version information
+ *     description: Returns the local and remote version of the application.
+ *     tags:
+ *       - General
+ *     responses:
+ *       200:
+ *         description: Version information.
+ *       404:
+ *         description: Local version not set.
+ *       500:
+ *         description: Fetch error.
+ */
 app.get("/version", authenticateJWT, async (req, res) => {
  let localVersion = process.env.VERSION;

@@ -307,6 +342,31 @@ app.get("/version", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /releases/rss:
+ *   get:
+ *     summary: Get releases in RSS format
+ *     description: Returns the latest releases from the GitHub repository in an RSS-like JSON format.
+ *     tags:
+ *       - General
+ *     parameters:
+ *       - in: query
+ *         name: page
+ *         schema:
+ *           type: integer
+ *         description: The page number of the releases to fetch.
+ *       - in: query
+ *         name: per_page
+ *         schema:
+ *           type: integer
+ *         description: The number of releases to fetch per page.
+ *     responses:
+ *       200:
+ *         description: Releases in RSS format.
+ *       500:
+ *         description: Failed to generate RSS format.
+ */
 app.get("/releases/rss", authenticateJWT, async (req, res) => {
  try {
    const page = parseInt(req.query.page as string) || 1;
@@ -363,6 +423,20 @@ app.get("/releases/rss", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /encryption/status:
+ *   get:
+ *     summary: Get encryption status
+ *     description: Returns the security status of the application.
+ *     tags:
+ *       - Encryption
+ *     responses:
+ *       200:
+ *         description: Security status.
+ *       500:
+ *         description: Failed to get security status.
+ */
 app.get("/encryption/status", requireAdmin, async (req, res) => {
  try {
    const securityStatus = {
@@ -384,6 +458,20 @@ app.get("/encryption/status", requireAdmin, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /encryption/initialize:
+ *   post:
+ *     summary: Initialize security system
+ *     description: Initializes the security system for the application.
+ *     tags:
+ *       - Encryption
+ *     responses:
+ *       200:
+ *         description: Security system initialized successfully.
+ *       500:
+ *         description: Failed to initialize security system.
+ */
 app.post("/encryption/initialize", requireAdmin, async (req, res) => {
  try {
    const authManager = AuthManager.getInstance();
@@ -407,6 +495,20 @@ app.post("/encryption/initialize", requireAdmin, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /encryption/regenerate:
+ *   post:
+ *     summary: Regenerate JWT secret
+ *     description: Regenerates the system JWT secret. This will invalidate all existing JWT tokens.
+ *     tags:
+ *       - Encryption
+ *     responses:
+ *       200:
+ *         description: System JWT secret regenerated.
+ *       500:
+ *         description: Failed to regenerate JWT secret.
+ */
 app.post("/encryption/regenerate", requireAdmin, async (req, res) => {
  try {
    apiLogger.warn("System JWT secret regenerated via API", {
@@ -428,6 +530,20 @@ app.post("/encryption/regenerate", requireAdmin, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /encryption/regenerate-jwt:
+ *   post:
+ *     summary: Regenerate JWT secret
+ *     description: Regenerates the JWT secret. This will invalidate all existing JWT tokens.
+ *     tags:
+ *       - Encryption
+ *     responses:
+ *       200:
+ *         description: New JWT secret generated.
+ *       500:
+ *         description: Failed to regenerate JWT secret.
+ */
 app.post("/encryption/regenerate-jwt", requireAdmin, async (req, res) => {
  try {
    apiLogger.warn("JWT secret regenerated via API", {
@@ -448,6 +564,33 @@ app.post("/encryption/regenerate-jwt", requireAdmin, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /database/export:
+ *   post:
+ *     summary: Export user data
+ *     description: Exports the user's data as a SQLite database file.
+ *     tags:
+ *       - Database
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               password:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: User data exported successfully.
+ *       400:
+ *         description: Password required for export.
+ *       401:
+ *         description: Invalid password.
+ *       500:
+ *         description: Failed to export user data.
+ */
 app.post("/database/export", authenticateJWT, async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -551,19 +694,39 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
          tags TEXT,
          pin INTEGER NOT NULL DEFAULT 0,
          auth_type TEXT NOT NULL,
+          force_keyboard_interactive TEXT,
          password TEXT,
          key TEXT,
          key_password TEXT,
          key_type TEXT,
+          sudo_password TEXT,
          autostart_password TEXT,
          autostart_key TEXT,
          autostart_key_password TEXT,
          credential_id INTEGER,
+          override_credential_username INTEGER,
          enable_terminal INTEGER NOT NULL DEFAULT 1,
          enable_tunnel INTEGER NOT NULL DEFAULT 1,
          tunnel_connections TEXT,
+          jump_hosts TEXT,
          enable_file_manager INTEGER NOT NULL DEFAULT 1,
+          enable_docker INTEGER NOT NULL DEFAULT 0,
+          show_terminal_in_sidebar INTEGER NOT NULL DEFAULT 1,
+          show_file_manager_in_sidebar INTEGER NOT NULL DEFAULT 0,
+          show_tunnel_in_sidebar INTEGER NOT NULL DEFAULT 0,
+          show_docker_in_sidebar INTEGER NOT NULL DEFAULT 0,
+          show_server_stats_in_sidebar INTEGER NOT NULL DEFAULT 0,
          default_path TEXT,
+          stats_config TEXT,
+          terminal_config TEXT,
+          quick_actions TEXT,
+          notes TEXT,
+          use_socks5 INTEGER,
+          socks5_host TEXT,
+          socks5_port INTEGER,
+          socks5_username TEXT,
+          socks5_password TEXT,
+          socks5_proxy_chain TEXT,
          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
        );
@@ -663,8 +826,8 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
        .from(sshData)
        .where(eq(sshData.userId, userId));
      const insertHost = exportDb.prepare(`
-        INSERT INTO ssh_data (id, user_id, name, ip, port, username, folder, tags, pin, auth_type, password, key, key_password, key_type, autostart_password, autostart_key, autostart_key_password, credential_id, enable_terminal, enable_tunnel, tunnel_connections, enable_file_manager, default_path, created_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        INSERT INTO ssh_data (id, user_id, name, ip, port, username, folder, tags, pin, auth_type, force_keyboard_interactive, password, key, key_password, key_type, sudo_password, autostart_password, autostart_key, autostart_key_password, credential_id, override_credential_username, enable_terminal, enable_tunnel, tunnel_connections, jump_hosts, enable_file_manager, enable_docker, show_terminal_in_sidebar, show_file_manager_in_sidebar, show_tunnel_in_sidebar, show_docker_in_sidebar, show_server_stats_in_sidebar, default_path, stats_config, terminal_config, quick_actions, notes, use_socks5, socks5_host, socks5_port, socks5_username, socks5_password, socks5_proxy_chain, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
      `);

      for (const host of sshHosts) {
@@ -685,19 +848,39 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
          decrypted.tags || null,
          decrypted.pin ? 1 : 0,
          decrypted.authType,
+          decrypted.forceKeyboardInteractive || null,
          decrypted.password || null,
          decrypted.key || null,
          decrypted.key_password || null,
          decrypted.keyType || null,
+          decrypted.sudoPassword || null,
          decrypted.autostartPassword || null,
          decrypted.autostartKey || null,
          decrypted.autostartKeyPassword || null,
          decrypted.credentialId || null,
-          decrypted.enableTerminal ? 1 : 0,
-          decrypted.enableTunnel ? 1 : 0,
+          Boolean(decrypted.overrideCredentialUsername) ? 1 : 0,
+          Boolean(decrypted.enableTerminal) ? 1 : 0,
+          Boolean(decrypted.enableTunnel) ? 1 : 0,
          decrypted.tunnelConnections || null,
-          decrypted.enableFileManager ? 1 : 0,
+          decrypted.jumpHosts || null,
+          Boolean(decrypted.enableFileManager) ? 1 : 0,
+          Boolean(decrypted.enableDocker) ? 1 : 0,
+          Boolean(decrypted.showTerminalInSidebar) ? 1 : 0,
+          Boolean(decrypted.showFileManagerInSidebar) ? 1 : 0,
+          Boolean(decrypted.showTunnelInSidebar) ? 1 : 0,
+          Boolean(decrypted.showDockerInSidebar) ? 1 : 0,
+          Boolean(decrypted.showServerStatsInSidebar) ? 1 : 0,
          decrypted.defaultPath || null,
+          decrypted.statsConfig || null,
+          decrypted.terminalConfig || null,
+          decrypted.quickActions || null,
+          decrypted.notes || null,
+          Boolean(decrypted.useSocks5) ? 1 : 0,
+          decrypted.socks5Host || null,
+          decrypted.socks5Port || null,
+          decrypted.socks5Username || null,
+          decrypted.socks5Password || null,
+          decrypted.socks5ProxyChain || null,
          decrypted.createdAt,
          decrypted.updatedAt,
        );
@@ -898,6 +1081,36 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /database/import:
+ *   post:
+ *     summary: Import user data
+ *     description: Imports user data from a SQLite database file.
+ *     tags:
+ *       - Database
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         multipart/form-data:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               file:
+ *                 type: string
+ *                 format: binary
+ *               password:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Incremental import completed successfully.
+ *       400:
+ *         description: No file uploaded or password required for import.
+ *       401:
+ *         description: Invalid password.
+ *       500:
+ *         description: Failed to import SQLite data.
+ */
 app.post(
  "/database/import",
  authenticateJWT,
@@ -1056,19 +1269,45 @@ app.post(
                tags: host.tags,
                pin: Boolean(host.pin),
                authType: host.auth_type,
+                forceKeyboardInteractive: host.force_keyboard_interactive,
                password: host.password,
                key: host.key,
                keyPassword: host.key_password,
                keyType: host.key_type,
+                sudoPassword: host.sudo_password,
                autostartPassword: host.autostart_password,
                autostartKey: host.autostart_key,
                autostartKeyPassword: host.autostart_key_password,
-                credentialId: null,
+                credentialId: host.credential_id || null,
+                overrideCredentialUsername: Boolean(
+                  host.override_credential_username,
+                ),
                enableTerminal: Boolean(host.enable_terminal),
                enableTunnel: Boolean(host.enable_tunnel),
                tunnelConnections: host.tunnel_connections,
+                jumpHosts: host.jump_hosts,
                enableFileManager: Boolean(host.enable_file_manager),
+                enableDocker: Boolean(host.enable_docker),
+                showTerminalInSidebar: Boolean(host.show_terminal_in_sidebar),
+                showFileManagerInSidebar: Boolean(
+                  host.show_file_manager_in_sidebar,
+                ),
+                showTunnelInSidebar: Boolean(host.show_tunnel_in_sidebar),
+                showDockerInSidebar: Boolean(host.show_docker_in_sidebar),
+                showServerStatsInSidebar: Boolean(
+                  host.show_server_stats_in_sidebar,
+                ),
                defaultPath: host.default_path,
+                statsConfig: host.stats_config,
+                terminalConfig: host.terminal_config,
+                quickActions: host.quick_actions,
+                notes: host.notes,
+                useSocks5: Boolean(host.use_socks5),
+                socks5Host: host.socks5_host,
+                socks5Port: host.socks5_port,
+                socks5Username: host.socks5_username,
+                socks5Password: host.socks5_password,
+                socks5ProxyChain: host.socks5_proxy_chain,
                createdAt: host.created_at || new Date().toISOString(),
                updatedAt: new Date().toISOString(),
              };
@@ -1308,6 +1547,19 @@ app.post(
        }

        result.success = true;
+
+        try {
+          await DatabaseSaveTrigger.forceSave("database_import");
+        } catch (saveError) {
+          apiLogger.error(
+            "Failed to persist imported data to disk",
+            saveError,
+            {
+              operation: "import_force_save_failed",
+              userId,
+            },
+          );
+        }
      } finally {
        if (importDb) {
          importDb.close();
@@ -1362,6 +1614,31 @@ app.post(
  },
 );

+/**
+ * @openapi
+ * /database/export/preview:
+ *   post:
+ *     summary: Preview user data export
+ *     description: Generates a preview of the user data export, including statistics about the data.
+ *     tags:
+ *       - Database
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               scope:
+ *                 type: string
+ *               includeCredentials:
+ *                 type: boolean
+ *     responses:
+ *       200:
+ *         description: Export preview generated successfully.
+ *       500:
+ *         description: Failed to generate export preview.
+ */
 app.post("/database/export/preview", authenticateJWT, async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -1397,6 +1674,33 @@ app.post("/database/export/preview", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /database/restore:
+ *   post:
+ *     summary: Restore database from backup
+ *     description: Restores the database from an encrypted backup file.
+ *     tags:
+ *       - Database
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               backupPath:
+ *                 type: string
+ *               targetPath:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Database restored successfully.
+ *       400:
+ *         description: Backup path is required or invalid encrypted backup file.
+ *       500:
+ *         description: Database restore failed.
+ */
 app.post("/database/restore", requireAdmin, async (req, res) => {
  try {
    const { backupPath, targetPath } = req.body;
@@ -1437,6 +1741,7 @@ app.use("/alerts", alertRoutes);
 app.use("/credentials", credentialsRoutes);
 app.use("/snippets", snippetsRoutes);
 app.use("/terminal", terminalRoutes);
+app.use("/network-topology", networkTopologyRoutes);
 app.use("/rbac", rbacRoutes);

 app.use(
@@ -1477,6 +1782,20 @@ async function initializeSecurity() {
  }
 }

+/**
+ * @openapi
+ * /database/migration/status:
+ *   get:
+ *     summary: Get database migration status
+ *     description: Returns the status of the database migration.
+ *     tags:
+ *       - Database
+ *     responses:
+ *       200:
+ *         description: Migration status.
+ *       500:
+ *         description: Failed to get migration status.
+ */
 app.get(
  "/database/migration/status",
  authenticateJWT,
@@ -1530,6 +1849,20 @@ app.get(
  },
 );

+/**
+ * @openapi
+ * /database/migration/history:
+ *   get:
+ *     summary: Get database migration history
+ *     description: Returns the history of database migrations.
+ *     tags:
+ *       - Database
+ *     responses:
+ *       200:
+ *         description: Migration history.
+ *       500:
+ *         description: Failed to get migration history.
+ */
 app.get(
  "/database/migration/history",
  authenticateJWT,
@@ -270,7 +270,7 @@ async function initializeCompleteDatabase(): Promise<void> {
        folder TEXT,
        tags TEXT,
        auth_type TEXT NOT NULL,
-        username TEXT NOT NULL,
+        username TEXT,
        password TEXT,
        key TEXT,
        key_password TEXT,
@@ -414,9 +414,11 @@ async function initializeCompleteDatabase(): Promise<void> {
 `);

  try {
-    sqlite.prepare("DELETE FROM sessions").run();
+    sqlite
+      .prepare("DELETE FROM sessions WHERE expires_at < datetime('now')")
+      .run();
  } catch (e) {
-    databaseLogger.warn("Could not clear sessions on startup", {
+    databaseLogger.warn("Could not clear expired sessions on startup", {
      operation: "db_init_session_cleanup_failed",
      error: e,
    });
@@ -585,6 +587,39 @@ const migrateSchema = () => {
  addColumnIfNotExists("ssh_data", "socks5_password", "TEXT");
  addColumnIfNotExists("ssh_data", "socks5_proxy_chain", "TEXT");

+  addColumnIfNotExists("ssh_data", "host_key_fingerprint", "TEXT");
+  addColumnIfNotExists("ssh_data", "host_key_type", "TEXT");
+  addColumnIfNotExists("ssh_data", "host_key_algorithm", "TEXT DEFAULT 'sha256'");
+  addColumnIfNotExists("ssh_data", "host_key_first_seen", "TEXT");
+  addColumnIfNotExists("ssh_data", "host_key_last_verified", "TEXT");
+  addColumnIfNotExists("ssh_data", "host_key_changed_count", "INTEGER DEFAULT 0");
+
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_terminal_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 1",
+  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_file_manager_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_tunnel_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_docker_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "show_server_stats_in_sidebar",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
+
  addColumnIfNotExists("ssh_credentials", "private_key", "TEXT");
  addColumnIfNotExists("ssh_credentials", "public_key", "TEXT");
  addColumnIfNotExists("ssh_credentials", "detected_key_type", "TEXT");
@@ -593,6 +628,68 @@ const migrateSchema = () => {
  addColumnIfNotExists("ssh_credentials", "system_key", "TEXT");
  addColumnIfNotExists("ssh_credentials", "system_key_password", "TEXT");

+  try {
+    const tableInfo = sqlite.prepare("PRAGMA table_info(ssh_credentials)").all() as Array<{
+      cid: number;
+      name: string;
+      type: string;
+      notnull: number;
+      dflt_value: string | null;
+      pk: number;
+    }>;
+    const usernameCol = tableInfo.find((col) => col.name === "username");
+
+    if (usernameCol && usernameCol.notnull === 1) {
+      const tempTableName = "ssh_credentials_temp_migration";
+      const allColumns = tableInfo.map((col) => col.name).join(", ");
+
+      sqlite.exec(`PRAGMA foreign_keys = OFF`);
+      sqlite.exec(`
+        CREATE TABLE ${tempTableName} (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          name TEXT NOT NULL,
+          description TEXT,
+          folder TEXT,
+          tags TEXT,
+          auth_type TEXT NOT NULL,
+          username TEXT,
+          password TEXT,
+          key TEXT,
+          key_password TEXT,
+          key_type TEXT,
+          usage_count INTEGER NOT NULL DEFAULT 0,
+          last_used TEXT,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          private_key TEXT,
+          public_key TEXT,
+          detected_key_type TEXT,
+          system_password TEXT,
+          system_key TEXT,
+          system_key_password TEXT,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+
+        INSERT INTO ${tempTableName} SELECT ${allColumns} FROM ssh_credentials;
+
+        DROP TABLE ssh_credentials;
+
+        ALTER TABLE ${tempTableName} RENAME TO ssh_credentials;
+      `);
+      sqlite.exec(`PRAGMA foreign_keys = ON`);
+
+      databaseLogger.info("Successfully migrated ssh_credentials table to remove username NOT NULL constraint", {
+        operation: "schema_migration_username_nullable",
+      });
+    }
+  } catch (migrationError) {
+    databaseLogger.warn("Failed to migrate ssh_credentials username column", {
+      operation: "schema_migration",
+      error: migrationError,
+    });
+  }
+
  addColumnIfNotExists("file_manager_recent", "host_id", "INTEGER NOT NULL");
  addColumnIfNotExists("file_manager_pinned", "host_id", "INTEGER NOT NULL");
  addColumnIfNotExists("file_manager_shortcuts", "host_id", "INTEGER NOT NULL");
@@ -653,6 +750,54 @@ const migrateSchema = () => {
    }
  }

+  try {
+    sqlite
+      .prepare("SELECT id FROM network_topology LIMIT 1")
+      .get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS network_topology (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          topology TEXT,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create network_topology table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite
+      .prepare("SELECT id FROM dashboard_preferences LIMIT 1")
+      .get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS dashboard_preferences (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL UNIQUE,
+          layout TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create dashboard_preferences table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
  try {
    sqlite.prepare("SELECT id FROM host_access LIMIT 1").get();
  } catch {
@@ -851,6 +996,37 @@ const migrateSchema = () => {
    }
  }

+  try {
+    sqlite.prepare("SELECT id FROM opkssh_tokens LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS opkssh_tokens (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          host_id INTEGER NOT NULL,
+          ssh_cert TEXT NOT NULL,
+          private_key TEXT NOT NULL,
+          email TEXT,
+          sub TEXT,
+          issuer TEXT,
+          audience TEXT,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          expires_at TEXT NOT NULL,
+          last_used TEXT,
+          UNIQUE(user_id, host_id),
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+          FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create opkssh_tokens table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
  try {
    const existingRoles = sqlite.prepare("SELECT name, is_system FROM roles").all() as Array<{ name: string; is_system: number }>;

@@ -90,6 +90,21 @@ export const sshData = sqliteTable("ssh_data", {
  enableDocker: integer("enable_docker", { mode: "boolean" })
    .notNull()
    .default(false),
+  showTerminalInSidebar: integer("show_terminal_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(true),
+  showFileManagerInSidebar: integer("show_file_manager_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(false),
+  showTunnelInSidebar: integer("show_tunnel_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(false),
+  showDockerInSidebar: integer("show_docker_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(false),
+  showServerStatsInSidebar: integer("show_server_stats_in_sidebar", { mode: "boolean" })
+    .notNull()
+    .default(false),
  defaultPath: text("default_path"),
  statsConfig: text("stats_config"),
  terminalConfig: text("terminal_config"),
@@ -103,6 +118,13 @@ export const sshData = sqliteTable("ssh_data", {
  socks5Password: text("socks5_password"),
  socks5ProxyChain: text("socks5_proxy_chain"),

+  hostKeyFingerprint: text("host_key_fingerprint"),
+  hostKeyType: text("host_key_type"),
+  hostKeyAlgorithm: text("host_key_algorithm").default("sha256"),
+  hostKeyFirstSeen: text("host_key_first_seen"),
+  hostKeyLastVerified: text("host_key_last_verified"),
+  hostKeyChangedCount: integer("host_key_changed_count").default(0),
+
  createdAt: text("created_at")
    .notNull()
    .default(sql`CURRENT_TIMESTAMP`),
@@ -177,7 +199,7 @@ export const sshCredentials = sqliteTable("ssh_credentials", {
  folder: text("folder"),
  tags: text("tags"),
  authType: text("auth_type").notNull(),
-  username: text("username").notNull(),
+  username: text("username"),
  password: text("password"),
  key: text("key", { length: 16384 }),
  private_key: text("private_key", { length: 16384 }),
@@ -295,6 +317,35 @@ export const commandHistory = sqliteTable("command_history", {
    .default(sql`CURRENT_TIMESTAMP`),
 });

+export const networkTopology = sqliteTable("network_topology", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  topology: text("topology"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const dashboardPreferences = sqliteTable("dashboard_preferences", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .unique()
+    .references(() => users.id, { onDelete: "cascade" }),
+  layout: text("layout").notNull(),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
 export const hostAccess = sqliteTable("host_access", {
  id: integer("id").primaryKey({ autoIncrement: true }),
  hostId: integer("host_id")
@@ -447,3 +498,27 @@ export const sessionRecordings = sqliteTable("session_recordings", {
    .default(false),
  terminationReason: text("termination_reason"),
 });
+
+export const opksshTokens = sqliteTable("opkssh_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  hostId: integer("host_id")
+    .notNull()
+    .references(() => sshData.id, { onDelete: "cascade" }),
+
+  sshCert: text("ssh_cert", { length: 8192 }).notNull(),
+  privateKey: text("private_key", { length: 8192 }).notNull(),
+
+  email: text("email"),
+  sub: text("sub"),
+  issuer: text("issuer"),
+  audience: text("audience"),
+
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  expiresAt: text("expires_at").notNull(),
+  lastUsed: text("last_used"),
+});
@@ -10,6 +10,7 @@ import { eq, and } from "drizzle-orm";
 import fetch from "node-fetch";
 import { authLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";
+import { getProxyAgent } from "../../utils/proxy-agent.js";

 class AlertCache {
  private cache: Map<string, CacheEntry> = new Map();
@@ -60,6 +61,7 @@ async function fetchAlertsFromGitHub(): Promise<TermixAlert[]> {
        Accept: "application/json",
        "User-Agent": "TermixAlertChecker/1.0",
      },
+      agent: getProxyAgent(url),
    });

    if (!response.ok) {
@@ -99,8 +101,20 @@ const router = express.Router();
 const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();

-// Route: Get alerts for the authenticated user (excluding dismissed ones)
-// GET /alerts
+/**
+ * @openapi
+ * /alerts:
+ *   get:
+ *     summary: Get active alerts
+ *     description: Fetches active alerts for the authenticated user, excluding those that have been dismissed.
+ *     tags:
+ *      - Alerts
+ *     responses:
+ *       200:
+ *         description: A list of active alerts.
+ *       500:
+ *         description: Failed to fetch alerts.
+ */
 router.get("/", authenticateJWT, async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -131,8 +145,33 @@ router.get("/", authenticateJWT, async (req, res) => {
  }
 });

-// Route: Dismiss an alert for the authenticated user
-// POST /alerts/dismiss
+/**
+ * @openapi
+ * /alerts/dismiss:
+ *   post:
+ *     summary: Dismiss an alert
+ *     description: Marks an alert as dismissed for the authenticated user.
+ *     tags:
+ *      - Alerts
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               alertId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Alert dismissed successfully.
+ *       400:
+ *         description: Alert ID is required.
+ *       409:
+ *         description: Alert already dismissed.
+ *       500:
+ *         description: Failed to dismiss alert.
+ */
 router.post("/dismiss", authenticateJWT, async (req, res) => {
  try {
    const { alertId } = req.body;
@@ -170,8 +209,20 @@ router.post("/dismiss", authenticateJWT, async (req, res) => {
  }
 });

-// Route: Get dismissed alerts for a user
-// GET /alerts/dismissed/:userId
+/**
+ * @openapi
+ * /alerts/dismissed:
+ *   get:
+ *     summary: Get dismissed alerts
+ *     description: Fetches a list of alerts that have been dismissed by the authenticated user.
+ *     tags:
+ *      - Alerts
+ *     responses:
+ *       200:
+ *         description: A list of dismissed alerts.
+ *       500:
+ *         description: Failed to fetch dismissed alerts.
+ */
 router.get("/dismissed", authenticateJWT, async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;
@@ -194,8 +245,33 @@ router.get("/dismissed", authenticateJWT, async (req, res) => {
  }
 });

-// Route: Undismiss an alert for the authenticated user (remove from dismissed list)
-// DELETE /alerts/dismiss
+/**
+ * @openapi
+ * /alerts/dismiss:
+ *   delete:
+ *     summary: Undismiss an alert
+ *     description: Removes an alert from the dismissed list for the authenticated user.
+ *     tags:
+ *      - Alerts
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               alertId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Alert undismissed successfully.
+ *       400:
+ *         description: Alert ID is required.
+ *       404:
+ *         description: Dismissed alert not found.
+ *       500:
+ *         description: Failed to undismiss alert.
+ */
 router.delete("/dismiss", authenticateJWT, async (req, res) => {
  try {
    const { alertId } = req.body;
@@ -84,8 +84,52 @@ const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 const requireDataAccess = authManager.createDataAccessMiddleware();

-// Create a new credential
-// POST /credentials
+/**
+ * @openapi
+ * /credentials:
+ *   post:
+ *     summary: Create a new credential
+ *     description: Creates a new SSH credential for the authenticated user.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *               folder:
+ *                 type: string
+ *               tags:
+ *                 type: array
+ *                 items:
+ *                   type: string
+ *               authType:
+ *                 type: string
+ *                 enum: [password, key]
+ *               username:
+ *                 type: string
+ *               password:
+ *                 type: string
+ *               key:
+ *                 type: string
+ *               keyPassword:
+ *                 type: string
+ *               keyType:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Credential created successfully.
+ *       400:
+ *         description: Invalid request body.
+ *       500:
+ *         description: Failed to create credential.
+ */
 router.post(
  "/",
  authenticateJWT,
@@ -105,18 +149,13 @@ router.post(
      keyType,
    } = req.body;

-    if (
-      !isNonEmptyString(userId) ||
-      !isNonEmptyString(name) ||
-      !isNonEmptyString(username)
-    ) {
+    if (!isNonEmptyString(userId) || !isNonEmptyString(name)) {
      authLogger.warn("Invalid credential creation data validation failed", {
        operation: "credential_create",
        userId,
        hasName: !!name,
-        hasUsername: !!username,
      });
-      return res.status(400).json({ error: "Name and username are required" });
+      return res.status(400).json({ error: "Name is required" });
    }

    if (!["password", "key"].includes(authType)) {
@@ -183,7 +222,7 @@ router.post(
        folder: folder?.trim() || null,
        tags: Array.isArray(tags) ? tags.join(",") : tags || "",
        authType,
-        username: username.trim(),
+        username: username?.trim() || null,
        password: plainPassword,
        key: plainKey,
        private_key: keyInfo?.privateKey || plainKey,
@@ -231,8 +270,22 @@ router.post(
  },
 );

-// Get all credentials for the authenticated user
-// GET /credentials
+/**
+ * @openapi
+ * /credentials:
+ *   get:
+ *     summary: Get all credentials
+ *     description: Retrieves all SSH credentials for the authenticated user.
+ *     tags:
+ *       - Credentials
+ *     responses:
+ *       200:
+ *         description: A list of credentials.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to fetch credentials.
+ */
 router.get(
  "/",
  authenticateJWT,
@@ -264,8 +317,22 @@ router.get(
  },
 );

-// Get all unique credential folders for the authenticated user
-// GET /credentials/folders
+/**
+ * @openapi
+ * /credentials/folders:
+ *   get:
+ *     summary: Get credential folders
+ *     description: Retrieves all unique credential folders for the authenticated user.
+ *     tags:
+ *       - Credentials
+ *     responses:
+ *       200:
+ *         description: A list of folder names.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to fetch credential folders.
+ */
 router.get(
  "/folders",
  authenticateJWT,
@@ -302,15 +369,37 @@ router.get(
  },
 );

-// Get a specific credential by ID (with plain text secrets)
-// GET /credentials/:id
+/**
+ * @openapi
+ * /credentials/{id}:
+ *   get:
+ *     summary: Get a specific credential
+ *     description: Retrieves a specific credential by its ID, including secrets.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: The requested credential.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Credential not found.
+ *       500:
+ *         description: Failed to fetch credential.
+ */
 router.get(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;

    if (!isNonEmptyString(userId) || !id) {
      authLogger.warn("Invalid request for credential fetch");
@@ -366,21 +455,60 @@ router.get(
  },
 );

-// Update a credential
-// PUT /credentials/:id
+/**
+ * @openapi
+ * /credentials/{id}:
+ *   put:
+ *     summary: Update a credential
+ *     description: Updates a specific credential by its ID.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: The updated credential.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Credential not found.
+ *       500:
+ *         description: Failed to update credential.
+ */
 router.put(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const updateData = req.body;

    if (!isNonEmptyString(userId) || !id) {
      authLogger.warn("Invalid request for credential update");
      return res.status(400).json({ error: "Invalid request" });
    }
+    authLogger.info("Updating SSH credential", {
+      operation: "credential_update",
+      userId,
+      credentialId: parseInt(id),
+      changes: Object.keys(updateData),
+    });

    try {
      const existing = await db
@@ -411,7 +539,7 @@ router.put(
          : updateData.tags || "";
      }
      if (updateData.username !== undefined)
-        updateFields.username = updateData.username.trim();
+        updateFields.username = updateData.username?.trim() || null;
      if (updateData.authType !== undefined)
        updateFields.authType = updateData.authType;
      if (updateData.keyType !== undefined)
@@ -487,17 +615,11 @@ router.put(
      );

      const credential = updated[0];
-      authLogger.success(
-        `SSH credential updated: ${credential.name} (${credential.authType}) by user ${userId}`,
-        {
-          operation: "credential_update_success",
-          userId,
-          credentialId: parseInt(id),
-          name: credential.name,
-          authType: credential.authType,
-          username: credential.username,
-        },
-      );
+      authLogger.success("SSH credential updated", {
+        operation: "credential_update_success",
+        userId,
+        credentialId: parseInt(id),
+      });

      res.json(formatCredentialOutput(updated[0]));
    } catch (err) {
@@ -510,20 +632,47 @@ router.put(
  },
 );

-// Delete a credential
-// DELETE /credentials/:id
+/**
+ * @openapi
+ * /credentials/{id}:
+ *   delete:
+ *     summary: Delete a credential
+ *     description: Deletes a specific credential by its ID.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Credential deleted successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Credential not found.
+ *       500:
+ *         description: Failed to delete credential.
+ */
 router.delete(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;

    if (!isNonEmptyString(userId) || !id) {
      authLogger.warn("Invalid request for credential deletion");
      return res.status(400).json({ error: "Invalid request" });
    }
+    authLogger.info("Deleting SSH credential", {
+      operation: "credential_delete",
+      userId,
+      credentialId: parseInt(id),
+    });

    try {
      const credentialToDelete = await db
@@ -603,17 +752,11 @@ router.delete(
        );

      const credential = credentialToDelete[0];
-      authLogger.success(
-        `SSH credential deleted: ${credential.name} (${credential.authType}) by user ${userId}`,
-        {
-          operation: "credential_delete_success",
-          userId,
-          credentialId: parseInt(id),
-          name: credential.name,
-          authType: credential.authType,
-          username: credential.username,
-        },
-      );
+      authLogger.success("SSH credential deleted", {
+        operation: "credential_delete_success",
+        userId,
+        credentialId: parseInt(id),
+      });

      res.json({ message: "Credential deleted successfully" });
    } catch (err) {
@@ -626,14 +769,46 @@ router.delete(
  },
 );

-// Apply a credential to an SSH host (for quick application)
-// POST /credentials/:id/apply-to-host/:hostId
+/**
+ * @openapi
+ * /credentials/{id}/apply-to-host/{hostId}:
+ *   post:
+ *     summary: Apply a credential to a host
+ *     description: Applies a credential to an SSH host for quick application.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *       - in: path
+ *         name: hostId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Credential applied to host successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Credential not found.
+ *       500:
+ *         description: Failed to apply credential to host.
+ */
 router.post(
  "/:id/apply-to-host/:hostId",
  authenticateJWT,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id: credentialId, hostId } = req.params;
+    const credentialId = Array.isArray(req.params.id)
+      ? req.params.id[0]
+      : req.params.id;
+    const hostId = Array.isArray(req.params.hostId)
+      ? req.params.hostId[0]
+      : req.params.hostId;

    if (!isNonEmptyString(userId) || !credentialId || !hostId) {
      authLogger.warn("Invalid request for credential application");
@@ -665,7 +840,7 @@ router.post(
        .update(sshData)
        .set({
          credentialId: parseInt(credentialId),
-          username: credential.username as string,
+          username: (credential.username as string) || "",
          authType: (credential.auth_type || credential.authType) as string,
          password: null,
          key: null,
@@ -705,14 +880,36 @@ router.post(
  },
 );

-// Get hosts using a specific credential
-// GET /credentials/:id/hosts
+/**
+ * @openapi
+ * /credentials/{id}/hosts:
+ *   get:
+ *     summary: Get hosts using a credential
+ *     description: Retrieves a list of hosts that are using a specific credential.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: A list of hosts.
+ *       400:
+ *         description: Invalid request.
+ *       500:
+ *         description: Failed to fetch hosts using credential.
+ */
 router.get(
  "/:id/hosts",
  authenticateJWT,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id: credentialId } = req.params;
+    const credentialId = Array.isArray(req.params.id)
+      ? req.params.id[0]
+      : req.params.id;

    if (!isNonEmptyString(userId) || !credentialId) {
      authLogger.warn("Invalid request for credential hosts fetch");
@@ -758,7 +955,7 @@ function formatCredentialOutput(
          : []
        : [],
    authType: credential.authType || credential.auth_type,
-    username: credential.username,
+    username: credential.username || null,
    publicKey: credential.public_key || credential.publicKey,
    keyType: credential.key_type || credential.keyType,
    detectedKeyType: credential.detected_key_type || credential.detectedKeyType,
@@ -800,8 +997,33 @@ function formatSSHHostOutput(
  };
 }

-// Rename a credential folder
-// PUT /credentials/folders/rename
+/**
+ * @openapi
+ * /credentials/folders/rename:
+ *   put:
+ *     summary: Rename a credential folder
+ *     description: Renames a credential folder for the authenticated user.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               oldName:
+ *                 type: string
+ *               newName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Folder renamed successfully.
+ *       400:
+ *         description: Both oldName and newName are required.
+ *       500:
+ *         description: Failed to rename folder.
+ */
 router.put(
  "/folders/rename",
  authenticateJWT,
@@ -840,8 +1062,33 @@ router.put(
  },
 );

-// Detect SSH key type endpoint
-// POST /credentials/detect-key-type
+/**
+ * @openapi
+ * /credentials/detect-key-type:
+ *   post:
+ *     summary: Detect SSH key type
+ *     description: Detects the type of an SSH private key.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               privateKey:
+ *                 type: string
+ *               keyPassword:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Key type detection result.
+ *       400:
+ *         description: Private key is required.
+ *       500:
+ *         description: Failed to detect key type.
+ */
 router.post(
  "/detect-key-type",
  authenticateJWT,
@@ -874,8 +1121,31 @@ router.post(
  },
 );

-// Detect SSH public key type endpoint
-// POST /credentials/detect-public-key-type
+/**
+ * @openapi
+ * /credentials/detect-public-key-type:
+ *   post:
+ *     summary: Detect SSH public key type
+ *     description: Detects the type of an SSH public key.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               publicKey:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Key type detection result.
+ *       400:
+ *         description: Public key is required.
+ *       500:
+ *         description: Failed to detect public key type.
+ */
 router.post(
  "/detect-public-key-type",
  authenticateJWT,
@@ -909,8 +1179,35 @@ router.post(
  },
 );

-// Validate SSH key pair endpoint
-// POST /credentials/validate-key-pair
+/**
+ * @openapi
+ * /credentials/validate-key-pair:
+ *   post:
+ *     summary: Validate SSH key pair
+ *     description: Validates if a given SSH private key and public key match.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               privateKey:
+ *                 type: string
+ *               publicKey:
+ *                 type: string
+ *               keyPassword:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Key pair validation result.
+ *       400:
+ *         description: Private key and public key are required.
+ *       500:
+ *         description: Failed to validate key pair.
+ */
 router.post(
  "/validate-key-pair",
  authenticateJWT,
@@ -953,8 +1250,32 @@ router.post(
  },
 );

-// Generate new SSH key pair endpoint
-// POST /credentials/generate-key-pair
+/**
+ * @openapi
+ * /credentials/generate-key-pair:
+ *   post:
+ *     summary: Generate new SSH key pair
+ *     description: Generates a new SSH key pair.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               keyType:
+ *                 type: string
+ *               keySize:
+ *                 type: integer
+ *               passphrase:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: The new key pair.
+ *       500:
+ *         description: Failed to generate SSH key pair.
+ */
 router.post(
  "/generate-key-pair",
  authenticateJWT,
@@ -996,8 +1317,33 @@ router.post(
  },
 );

-// Generate public key from private key endpoint
-// POST /credentials/generate-public-key
+/**
+ * @openapi
+ * /credentials/generate-public-key:
+ *   post:
+ *     summary: Generate public key from private key
+ *     description: Generates a public key from a given private key.
+ *     tags:
+ *       - Credentials
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               privateKey:
+ *                 type: string
+ *               keyPassword:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: The generated public key.
+ *       400:
+ *         description: Private key is required.
+ *       500:
+ *         description: Failed to generate public key.
+ */
 router.post(
  "/generate-public-key",
  authenticateJWT,
@@ -1283,7 +1629,7 @@ async function deploySSHKeyToHost(
            .replace(/'/g, "'\\''");

          conn.exec(
-            `printf '%s\\n' '${escapedKey} ${credData.name}@Termix' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys`,
+            `printf '%s\n' '${escapedKey} ${credData.name}@Termix' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys`,
            (err, stream) => {
              if (err) {
                clearTimeout(addTimeout);
@@ -1502,13 +1848,47 @@ async function deploySSHKeyToHost(
  });
 }

-// Deploy SSH Key to Host endpoint
-// POST /credentials/:id/deploy-to-host
+/**
+ * @openapi
+ * /credentials/{id}/deploy-to-host:
+ *   post:
+ *     summary: Deploy SSH key to a host
+ *     description: Deploys an SSH public key to a target host's authorized_keys file.
+ *     tags:
+ *       - Credentials
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               targetHostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: SSH key deployed successfully.
+ *       400:
+ *         description: Credential ID and target host ID are required.
+ *       401:
+ *         description: Authentication required.
+ *       404:
+ *         description: Credential or target host not found.
+ *       500:
+ *         description: Failed to deploy SSH key.
+ */
 router.post(
  "/:id/deploy-to-host",
  authenticateJWT,
  async (req: Request, res: Response) => {
-    const credentialId = parseInt(req.params.id);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const credentialId = parseInt(id);
    const { targetHostId } = req.body;

    if (!credentialId || !targetHostId) {
@@ -0,0 +1,195 @@
+import express from "express";
+import { eq } from "drizzle-orm";
+import { getDb } from "../db/index.js";
+import { networkTopology } from "../db/schema.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import { databaseLogger } from "../../utils/logger.js";
+
+const router = express.Router();
+const authManager = AuthManager.getInstance();
+const authenticateJWT = authManager.createAuthMiddleware();
+
+/**
+ * @openapi
+ * /network-topology:
+ *   get:
+ *     summary: Get network topology for authenticated user
+ *     description: Retrieves the saved network topology graph (nodes and edges) for the current user. Returns null if no topology exists.
+ *     tags:
+ *       - Network Topology
+ *     security:
+ *       - bearerAuth: []
+ *     responses:
+ *       200:
+ *         description: Network topology retrieved successfully
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               nullable: true
+ *               properties:
+ *                 nodes:
+ *                   type: array
+ *                   description: Array of graph nodes (hosts and groups)
+ *                   items:
+ *                     type: object
+ *                     properties:
+ *                       data:
+ *                         type: object
+ *                         description: Node data including id, label, type, etc.
+ *                       position:
+ *                         type: object
+ *                         description: Node position coordinates
+ *                         properties:
+ *                           x:
+ *                             type: number
+ *                           y:
+ *                             type: number
+ *                 edges:
+ *                   type: array
+ *                   description: Array of graph edges (connections)
+ *                   items:
+ *                     type: object
+ *                     properties:
+ *                       data:
+ *                         type: object
+ *                         description: Edge data including source and target node ids
+ *       401:
+ *         description: User not authenticated
+ *       500:
+ *         description: Server error
+ */
+router.get(
+  "/",
+  authenticateJWT,
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const userId = (req as AuthenticatedRequest).userId;
+      if (!userId) {
+        return res.status(401).json({ error: "User not authenticated" });
+      }
+
+      const db = getDb();
+      const result = await db
+        .select()
+        .from(networkTopology)
+        .where(eq(networkTopology.userId, userId));
+
+      if (result.length > 0) {
+        const topologyStr = result[0].topology;
+        const topology = topologyStr ? JSON.parse(topologyStr) : null;
+        return res.json(topology);
+      } else {
+        return res.json(null);
+      }
+    } catch (error) {
+      databaseLogger.error("Failed to fetch network topology", error, {
+        operation: "network_topology_fetch",
+        userId: (req as AuthenticatedRequest).userId,
+      });
+      return res.status(500).json({
+        error: "Failed to fetch network topology",
+        details: (error as Error).message,
+      });
+    }
+  },
+);
+
+/**
+ * @openapi
+ * /network-topology:
+ *   post:
+ *     summary: Save network topology for authenticated user
+ *     description: Saves or updates the network topology graph. Uses upsert logic - creates new record if none exists, updates existing record otherwise.
+ *     tags:
+ *       - Network Topology
+ *     security:
+ *       - bearerAuth: []
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             required:
+ *               - topology
+ *             properties:
+ *               topology:
+ *                 type: object
+ *                 description: Network topology data containing nodes and edges
+ *                 properties:
+ *                   nodes:
+ *                     type: array
+ *                     description: Array of graph nodes (hosts and groups)
+ *                   edges:
+ *                     type: array
+ *                     description: Array of graph edges (connections)
+ *     responses:
+ *       200:
+ *         description: Topology saved successfully
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 success:
+ *                   type: boolean
+ *       400:
+ *         description: Invalid topology data
+ *       401:
+ *         description: User not authenticated
+ *       500:
+ *         description: Server error
+ */
+router.post(
+  "/",
+  authenticateJWT,
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const userId = (req as AuthenticatedRequest).userId;
+      if (!userId) {
+        return res.status(401).json({ error: "User not authenticated" });
+      }
+
+      const { topology } = req.body;
+      if (!topology) {
+        return res.status(400).json({ error: "Topology data is required" });
+      }
+
+      const db = getDb();
+
+      const topologyStr =
+        typeof topology === "string" ? topology : JSON.stringify(topology);
+
+      const existing = await db
+        .select()
+        .from(networkTopology)
+        .where(eq(networkTopology.userId, userId));
+
+      if (existing.length > 0) {
+        await db
+          .update(networkTopology)
+          .set({ topology: topologyStr })
+          .where(eq(networkTopology.userId, userId));
+      } else {
+        await db
+          .insert(networkTopology)
+          .values({ userId, topology: topologyStr });
+      }
+
+      return res.json({ success: true });
+    } catch (error) {
+      databaseLogger.error("Failed to save network topology", error, {
+        operation: "network_topology_save",
+        userId: (req as AuthenticatedRequest).userId,
+      });
+      return res.status(500).json({
+        error: "Failed to save network topology",
+        details: (error as Error).message,
+      });
+    }
+  },
+);
+
+export default router;
@@ -27,13 +27,57 @@ function isNonEmptyString(value: unknown): value is string {
  return typeof value === "string" && value.trim().length > 0;
 }

-//Share a host with a user or role
-//POST /rbac/host/:id/share
+/**
+ * @openapi
+ * /rbac/host/{id}/share:
+ *   post:
+ *     summary: Share a host
+ *     description: Shares a host with a user or a role.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               targetType:
+ *                 type: string
+ *                 enum: [user, role]
+ *               targetUserId:
+ *                 type: string
+ *               targetRoleId:
+ *                 type: integer
+ *               durationHours:
+ *                 type: number
+ *               permissionLevel:
+ *                 type: string
+ *                 enum: [view]
+ *     responses:
+ *       200:
+ *         description: Host shared successfully.
+ *       400:
+ *         description: Invalid request body.
+ *       403:
+ *         description: Not host owner.
+ *       404:
+ *         description: Target user or role not found.
+ *       500:
+ *         description: Failed to share host.
+ */
 router.post(
  "/host/:id/share",
  authenticateJWT,
  async (req: AuthenticatedRequest, res: Response) => {
-    const hostId = parseInt(req.params.id, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const hostId = parseInt(id, 10);
    const userId = req.userId!;

    if (isNaN(hostId)) {
@@ -73,10 +117,12 @@ router.post(
        .limit(1);

      if (host.length === 0) {
-        databaseLogger.warn("Attempt to share host not owned by user", {
-          operation: "share_host",
+        databaseLogger.warn("Permission denied", {
+          operation: "rbac_permission_denied",
          userId,
-          hostId,
+          resource: "host",
+          resourceId: hostId,
+          action: "share",
        });
        return res.status(403).json({ error: "Not host owner" });
      }
@@ -174,6 +220,13 @@ router.post(
            userId,
          );
        }
+        databaseLogger.info("Permission granted", {
+          operation: "rbac_permission_grant",
+          adminId: userId,
+          hostId,
+          resource: "host",
+          action: "view",
+        });

        return res.json({
          success: true,
@@ -210,6 +263,13 @@ router.post(
          userId,
        );
      }
+      databaseLogger.success("Host shared successfully", {
+        operation: "rbac_host_share_success",
+        userId,
+        hostId,
+        targetUserId: targetType === "user" ? targetUserId : undefined,
+        permissionLevel,
+      });

      res.json({
        success: true,
@@ -227,14 +287,45 @@ router.post(
  },
 );

-// Revoke host access
-// DELETE /rbac/host/:id/access/:accessId
+/**
+ * @openapi
+ * /rbac/host/{id}/access/{accessId}:
+ *   delete:
+ *     summary: Revoke host access
+ *     description: Revokes a user's or role's access to a host.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *       - in: path
+ *         name: accessId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Access revoked successfully.
+ *       400:
+ *         description: Invalid ID.
+ *       403:
+ *         description: Not host owner.
+ *       500:
+ *         description: Failed to revoke access.
+ */
 router.delete(
  "/host/:id/access/:accessId",
  authenticateJWT,
  async (req: AuthenticatedRequest, res: Response) => {
-    const hostId = parseInt(req.params.id, 10);
-    const accessId = parseInt(req.params.accessId, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const accessIdParam = Array.isArray(req.params.accessId)
+      ? req.params.accessId[0]
+      : req.params.accessId;
+    const hostId = parseInt(id, 10);
+    const accessId = parseInt(accessIdParam, 10);
    const userId = req.userId!;

    if (isNaN(hostId) || isNaN(accessId)) {
@@ -253,6 +344,12 @@ router.delete(
      }

      await db.delete(hostAccess).where(eq(hostAccess.id, accessId));
+      databaseLogger.info("Permission revoked", {
+        operation: "rbac_permission_revoke",
+        adminId: userId,
+        hostId,
+        accessId,
+      });

      res.json({ success: true, message: "Access revoked" });
    } catch (error) {
@@ -267,13 +364,36 @@ router.delete(
  },
 );

-// Get host access list
-// GET /rbac/host/:id/access
+/**
+ * @openapi
+ * /rbac/host/{id}/access:
+ *   get:
+ *     summary: Get host access list
+ *     description: Retrieves the list of users and roles that have access to a host.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: The access list for the host.
+ *       400:
+ *         description: Invalid host ID.
+ *       403:
+ *         description: Not host owner.
+ *       500:
+ *         description: Failed to get access list.
+ */
 router.get(
  "/host/:id/access",
  authenticateJWT,
  async (req: AuthenticatedRequest, res: Response) => {
-    const hostId = parseInt(req.params.id, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const hostId = parseInt(id, 10);
    const userId = req.userId!;

    if (isNaN(hostId)) {
@@ -338,8 +458,20 @@ router.get(
  },
 );

-// Get user's shared hosts (hosts shared WITH this user)
-// GET /rbac/shared-hosts
+/**
+ * @openapi
+ * /rbac/shared-hosts:
+ *   get:
+ *     summary: Get shared hosts
+ *     description: Retrieves the list of hosts that have been shared with the authenticated user.
+ *     tags:
+ *       - RBAC
+ *     responses:
+ *       200:
+ *         description: A list of shared hosts.
+ *       500:
+ *         description: Failed to get shared hosts.
+ */
 router.get(
  "/shared-hosts",
  authenticateJWT,
@@ -385,8 +517,20 @@ router.get(
  },
 );

-// Get all roles
-// GET /rbac/roles
+/**
+ * @openapi
+ * /rbac/roles:
+ *   get:
+ *     summary: Get all roles
+ *     description: Retrieves a list of all roles.
+ *     tags:
+ *       - RBAC
+ *     responses:
+ *       200:
+ *         description: A list of roles.
+ *       500:
+ *         description: Failed to get roles.
+ */
 router.get(
  "/roles",
  authenticateJWT,
@@ -413,8 +557,20 @@ router.get(
  },
 );

-// Get all roles
-// GET /rbac/roles
+/**
+ * @openapi
+ * /rbac/roles:
+ *   get:
+ *     summary: Get all roles
+ *     description: Retrieves a list of all roles.
+ *     tags:
+ *       - RBAC
+ *     responses:
+ *       200:
+ *         description: A list of roles.
+ *       500:
+ *         description: Failed to get roles.
+ */
 router.get(
  "/roles",
  authenticateJWT,
@@ -443,8 +599,37 @@ router.get(
  },
 );

-// Create new role
-// POST /rbac/roles
+/**
+ * @openapi
+ * /rbac/roles:
+ *   post:
+ *     summary: Create a new role
+ *     description: Creates a new role.
+ *     tags:
+ *       - RBAC
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               displayName:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Role created successfully.
+ *       400:
+ *         description: Invalid request body.
+ *       409:
+ *         description: A role with this name already exists.
+ *       500:
+ *         description: Failed to create role.
+ */
 router.post(
  "/roles",
  authenticateJWT,
@@ -503,14 +688,48 @@ router.post(
  },
 );

-// Update role
-// PUT /rbac/roles/:id
+/**
+ * @openapi
+ * /rbac/roles/{id}:
+ *   put:
+ *     summary: Update a role
+ *     description: Updates a role by its ID.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               displayName:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Role updated successfully.
+ *       400:
+ *         description: Invalid request body or role ID.
+ *       404:
+ *         description: Role not found.
+ *       500:
+ *         description: Failed to update role.
+ */
 router.put(
  "/roles/:id",
  authenticateJWT,
  permissionManager.requireAdmin(),
  async (req: AuthenticatedRequest, res: Response) => {
-    const roleId = parseInt(req.params.id, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const roleId = parseInt(id, 10);
    const { displayName, description } = req.body;

    if (isNaN(roleId)) {
@@ -570,14 +789,39 @@ router.put(
  },
 );

-// Delete role
-// DELETE /rbac/roles/:id
+/**
+ * @openapi
+ * /rbac/roles/{id}:
+ *   delete:
+ *     summary: Delete a role
+ *     description: Deletes a role by its ID.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Role deleted successfully.
+ *       400:
+ *         description: Invalid role ID.
+ *       403:
+ *         description: Cannot delete system roles.
+ *       404:
+ *         description: Role not found.
+ *       500:
+ *         description: Failed to delete role.
+ */
 router.delete(
  "/roles/:id",
  authenticateJWT,
  permissionManager.requireAdmin(),
  async (req: AuthenticatedRequest, res: Response) => {
-    const roleId = parseInt(req.params.id, 10);
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+    const roleId = parseInt(id, 10);

    if (isNaN(roleId)) {
      return res.status(400).json({ error: "Invalid role ID" });
@@ -634,14 +878,51 @@ router.delete(
  },
 );

-// Assign role to user
-// POST /rbac/users/:userId/roles
+/**
+ * @openapi
+ * /rbac/users/{userId}/roles:
+ *   post:
+ *     summary: Assign a role to a user
+ *     description: Assigns a role to a user.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: userId
+ *         required: true
+ *         schema:
+ *           type: string
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               roleId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Role assigned successfully.
+ *       400:
+ *         description: Role ID is required.
+ *       403:
+ *         description: System roles cannot be manually assigned.
+ *       404:
+ *         description: User or role not found.
+ *       409:
+ *         description: Role already assigned.
+ *       500:
+ *         description: Failed to assign role.
+ */
 router.post(
  "/users/:userId/roles",
  authenticateJWT,
  permissionManager.requireAdmin(),
  async (req: AuthenticatedRequest, res: Response) => {
-    const targetUserId = req.params.userId;
+    const targetUserId = Array.isArray(req.params.userId)
+      ? req.params.userId[0]
+      : req.params.userId;
    const currentUserId = req.userId!;

    try {
@@ -731,6 +1012,13 @@ router.post(
      }

      permissionManager.invalidateUserPermissionCache(targetUserId);
+      databaseLogger.info("Role assigned to user", {
+        operation: "rbac_role_assign",
+        adminId: currentUserId,
+        targetUserId,
+        roleId,
+        roleName: role[0].name,
+      });

      res.json({
        success: true,
@@ -746,15 +1034,49 @@ router.post(
  },
 );

-// Remove role from user
-// DELETE /rbac/users/:userId/roles/:roleId
+/**
+ * @openapi
+ * /rbac/users/{userId}/roles/{roleId}:
+ *   delete:
+ *     summary: Remove a role from a user
+ *     description: Removes a role from a user.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: userId
+ *         required: true
+ *         schema:
+ *           type: string
+ *       - in: path
+ *         name: roleId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Role removed successfully.
+ *       400:
+ *         description: Invalid role ID.
+ *       403:
+ *         description: System roles cannot be removed.
+ *       404:
+ *         description: Role not found.
+ *       500:
+ *         description: Failed to remove role.
+ */
 router.delete(
  "/users/:userId/roles/:roleId",
  authenticateJWT,
  permissionManager.requireAdmin(),
  async (req: AuthenticatedRequest, res: Response) => {
-    const targetUserId = req.params.userId;
-    const roleId = parseInt(req.params.roleId, 10);
+    const targetUserId = Array.isArray(req.params.userId)
+      ? req.params.userId[0]
+      : req.params.userId;
+    const roleIdParam = Array.isArray(req.params.roleId)
+      ? req.params.roleId[0]
+      : req.params.roleId;
+    const roleId = parseInt(roleIdParam, 10);

    if (isNaN(roleId)) {
      return res.status(400).json({ error: "Invalid role ID" });
@@ -789,6 +1111,12 @@ router.delete(
        );

      permissionManager.invalidateUserPermissionCache(targetUserId);
+      databaseLogger.info("Role removed from user", {
+        operation: "rbac_role_remove",
+        adminId: req.userId!,
+        targetUserId,
+        roleId,
+      });

      res.json({
        success: true,
@@ -805,13 +1133,35 @@ router.delete(
  },
 );

-// Get user's roles
-// GET /rbac/users/:userId/roles
+/**
+ * @openapi
+ * /rbac/users/{userId}/roles:
+ *   get:
+ *     summary: Get user's roles
+ *     description: Retrieves a list of roles for a specific user.
+ *     tags:
+ *       - RBAC
+ *     parameters:
+ *       - in: path
+ *         name: userId
+ *         required: true
+ *         schema:
+ *           type: string
+ *     responses:
+ *       200:
+ *         description: A list of roles.
+ *       403:
+ *         description: Access denied.
+ *       500:
+ *         description: Failed to get user roles.
+ */
 router.get(
  "/users/:userId/roles",
  authenticateJWT,
  async (req: AuthenticatedRequest, res: Response) => {
-    const targetUserId = req.params.userId;
+    const targetUserId = Array.isArray(req.params.userId)
+      ? req.params.userId[0]
+      : req.params.userId;
    const currentUserId = req.userId!;

    if (
@@ -4,7 +4,7 @@ import { db } from "../db/index.js";
 import { snippets, snippetFolders } from "../db/schema.js";
 import { eq, and, desc, asc, sql } from "drizzle-orm";
 import type { Request, Response } from "express";
-import { authLogger } from "../../utils/logger.js";
+import { authLogger, databaseLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";

 const router = express.Router();
@@ -17,8 +17,22 @@ const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 const requireDataAccess = authManager.createDataAccessMiddleware();

-// Get all snippet folders
-// GET /snippets/folders
+/**
+ * @openapi
+ * /snippets/folders:
+ *   get:
+ *     summary: Get all snippet folders
+ *     description: Retrieves all snippet folders for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     responses:
+ *       200:
+ *         description: A list of snippet folders.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to fetch snippet folders.
+ */
 router.get(
  "/folders",
  authenticateJWT,
@@ -46,8 +60,37 @@ router.get(
  },
 );

-// Create a new snippet folder
-// POST /snippets/folders
+/**
+ * @openapi
+ * /snippets/folders:
+ *   post:
+ *     summary: Create a new snippet folder
+ *     description: Creates a new snippet folder for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               color:
+ *                 type: string
+ *               icon:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Snippet folder created successfully.
+ *       400:
+ *         description: Folder name is required.
+ *       409:
+ *         description: Folder with this name already exists.
+ *       500:
+ *         description: Failed to create snippet folder.
+ */
 router.post(
  "/folders",
  authenticateJWT,
@@ -110,15 +153,50 @@ router.post(
  },
 );

-// Update snippet folder metadata (color, icon)
-// PUT /snippets/folders/:name/metadata
+/**
+ * @openapi
+ * /snippets/folders/{name}/metadata:
+ *   put:
+ *     summary: Update snippet folder metadata
+ *     description: Updates the metadata (color, icon) of a snippet folder.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: name
+ *         required: true
+ *         schema:
+ *           type: string
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               color:
+ *                 type: string
+ *               icon:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Snippet folder metadata updated successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Folder not found.
+ *       500:
+ *         description: Failed to update snippet folder metadata.
+ */
 router.put(
  "/folders/:name/metadata",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { name } = req.params;
+    const name = Array.isArray(req.params.name)
+      ? req.params.name[0]
+      : req.params.name;
    const { color, icon } = req.body;

    if (!isNonEmptyString(userId) || !name) {
@@ -194,8 +272,37 @@ router.put(
  },
 );

-// Rename snippet folder
-// PUT /snippets/folders/rename
+/**
+ * @openapi
+ * /snippets/folders/rename:
+ *   put:
+ *     summary: Rename a snippet folder
+ *     description: Renames a snippet folder for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               oldName:
+ *                 type: string
+ *               newName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Folder renamed successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Folder not found.
+ *       409:
+ *         description: Folder with new name already exists.
+ *       500:
+ *         description: Failed to rename snippet folder.
+ */
 router.put(
  "/folders/rename",
  authenticateJWT,
@@ -282,15 +389,37 @@ router.put(
  },
 );

-// Delete snippet folder
-// DELETE /snippets/folders/:name
+/**
+ * @openapi
+ * /snippets/folders/{name}:
+ *   delete:
+ *     summary: Delete a snippet folder
+ *     description: Deletes a snippet folder and moves its snippets to the root.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: name
+ *         required: true
+ *         schema:
+ *           type: string
+ *     responses:
+ *       200:
+ *         description: Snippet folder deleted successfully.
+ *       400:
+ *         description: Invalid request.
+ *       500:
+ *         description: Failed to delete snippet folder.
+ */
 router.delete(
  "/folders/:name",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { name } = req.params;
+    const name = Array.isArray(req.params.name)
+      ? req.params.name[0]
+      : req.params.name;

    if (!isNonEmptyString(userId) || !name) {
      authLogger.warn("Invalid request for snippet folder delete");
@@ -338,8 +467,40 @@ router.delete(
  },
 );

-// Reorder snippets (bulk update)
-// PUT /snippets/reorder
+/**
+ * @openapi
+ * /snippets/reorder:
+ *   put:
+ *     summary: Reorder snippets
+ *     description: Bulk updates the order and folder of snippets.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               snippets:
+ *                 type: array
+ *                 items:
+ *                   type: object
+ *                   properties:
+ *                     id:
+ *                       type: integer
+ *                     order:
+ *                       type: integer
+ *                     folder:
+ *                       type: string
+ *     responses:
+ *       200:
+ *         description: Snippets reordered successfully.
+ *       400:
+ *         description: Invalid request.
+ *       500:
+ *         description: Failed to reorder snippets.
+ */
 router.put(
  "/reorder",
  authenticateJWT,
@@ -405,8 +566,35 @@ router.put(
  },
 );

-// Execute a snippet on a host
-// POST /snippets/execute
+/**
+ * @openapi
+ * /snippets/execute:
+ *   post:
+ *     summary: Execute a snippet on a host
+ *     description: Executes a snippet on a specified host.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               snippetId:
+ *                 type: integer
+ *               hostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Snippet executed successfully.
+ *       400:
+ *         description: Snippet ID and Host ID are required.
+ *       404:
+ *         description: Snippet or host not found.
+ *       500:
+ *         description: Failed to execute snippet.
+ */
 router.post(
  "/execute",
  authenticateJWT,
@@ -662,8 +850,22 @@ router.post(
  },
 );

-// Get all snippets for the authenticated user
-// GET /snippets
+/**
+ * @openapi
+ * /snippets:
+ *   get:
+ *     summary: Get all snippets
+ *     description: Retrieves all snippets for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     responses:
+ *       200:
+ *         description: A list of snippets.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to fetch snippets.
+ */
 router.get(
  "/",
  authenticateJWT,
@@ -696,15 +898,37 @@ router.get(
  },
 );

-// Get a specific snippet by ID
-// GET /snippets/:id
+/**
+ * @openapi
+ * /snippets/{id}:
+ *   get:
+ *     summary: Get a specific snippet
+ *     description: Retrieves a specific snippet by its ID.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: The requested snippet.
+ *       400:
+ *         description: Invalid request parameters.
+ *       404:
+ *         description: Snippet not found.
+ *       500:
+ *         description: Failed to fetch snippet.
+ */
 router.get(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const snippetId = parseInt(id, 10);

    if (!isNonEmptyString(userId) || isNaN(snippetId)) {
@@ -735,8 +959,39 @@ router.get(
  },
 );

-// Create a new snippet
-// POST /snippets
+/**
+ * @openapi
+ * /snippets:
+ *   post:
+ *     summary: Create a new snippet
+ *     description: Creates a new snippet for the authenticated user.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               content:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *               folder:
+ *                 type: string
+ *               order:
+ *                 type: integer
+ *     responses:
+ *       201:
+ *         description: Snippet created successfully.
+ *       400:
+ *         description: Name and content are required.
+ *       500:
+ *         description: Failed to create snippet.
+ */
 router.post(
  "/",
  authenticateJWT,
@@ -788,9 +1043,8 @@ router.post(
      };

      const result = await db.insert(snippets).values(insertData).returning();
-
-      authLogger.success(`Snippet created: ${name} by user ${userId}`, {
-        operation: "snippet_create_success",
+      databaseLogger.info("Command snippet created", {
+        operation: "snippet_create",
        userId,
        snippetId: result[0].id,
        name,
@@ -806,15 +1060,54 @@ router.post(
  },
 );

-// Update a snippet
-// PUT /snippets/:id
+/**
+ * @openapi
+ * /snippets/{id}:
+ *   put:
+ *     summary: Update a snippet
+ *     description: Updates a specific snippet by its ID.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               content:
+ *                 type: string
+ *               description:
+ *                 type: string
+ *               folder:
+ *                 type: string
+ *               order:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: The updated snippet.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Snippet not found.
+ *       500:
+ *         description: Failed to update snippet.
+ */
 router.put(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const updateData = req.body;

    if (!isNonEmptyString(userId) || !id) {
@@ -862,16 +1155,11 @@ router.put(
        .select()
        .from(snippets)
        .where(eq(snippets.id, parseInt(id)));
-
-      authLogger.success(
-        `Snippet updated: ${updated[0].name} by user ${userId}`,
-        {
-          operation: "snippet_update_success",
-          userId,
-          snippetId: parseInt(id),
-          name: updated[0].name,
-        },
-      );
+      databaseLogger.info("Command snippet updated", {
+        operation: "snippet_update",
+        userId,
+        snippetId: parseInt(id),
+      });

      res.json(updated[0]);
    } catch (err) {
@@ -883,15 +1171,37 @@ router.put(
  },
 );

-// Delete a snippet
-// DELETE /snippets/:id
+/**
+ * @openapi
+ * /snippets/{id}:
+ *   delete:
+ *     summary: Delete a snippet
+ *     description: Deletes a specific snippet by its ID.
+ *     tags:
+ *       - Snippets
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Snippet deleted successfully.
+ *       400:
+ *         description: Invalid request.
+ *       404:
+ *         description: Snippet not found.
+ *       500:
+ *         description: Failed to delete snippet.
+ */
 router.delete(
  "/:id",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { id } = req.params;
+    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;

    if (!isNonEmptyString(userId) || !id) {
      authLogger.warn("Invalid request for snippet delete");
@@ -911,16 +1221,11 @@ router.delete(
      await db
        .delete(snippets)
        .where(and(eq(snippets.id, parseInt(id)), eq(snippets.userId, userId)));
-
-      authLogger.success(
-        `Snippet deleted: ${existing[0].name} by user ${userId}`,
-        {
-          operation: "snippet_delete_success",
-          userId,
-          snippetId: parseInt(id),
-          name: existing[0].name,
-        },
-      );
+      databaseLogger.info("Command snippet deleted", {
+        operation: "snippet_delete",
+        userId,
+        snippetId: parseInt(id),
+      });

      res.json({ success: true });
    } catch (err) {
@@ -4,7 +4,7 @@ import { db } from "../db/index.js";
 import { commandHistory } from "../db/schema.js";
 import { eq, and, desc, sql } from "drizzle-orm";
 import type { Request, Response } from "express";
-import { authLogger } from "../../utils/logger.js";
+import { authLogger, databaseLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";

 const router = express.Router();
@@ -17,8 +17,33 @@ const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 const requireDataAccess = authManager.createDataAccessMiddleware();

-// Save command to history
-// POST /terminal/command_history
+/**
+ * @openapi
+ * /terminal/command_history:
+ *   post:
+ *     summary: Save command to history
+ *     description: Saves a command to the command history for a specific host.
+ *     tags:
+ *       - Terminal
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *               command:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Command saved successfully.
+ *       400:
+ *         description: Missing required parameters.
+ *       500:
+ *         description: Failed to save command.
+ */
 router.post(
  "/command_history",
  authenticateJWT,
@@ -59,15 +84,37 @@ router.post(
  },
 );

-// Get command history for a specific host
-// GET /terminal/command_history/:hostId
+/**
+ * @openapi
+ * /terminal/command_history/{hostId}:
+ *   get:
+ *     summary: Get command history
+ *     description: Retrieves the command history for a specific host.
+ *     tags:
+ *       - Terminal
+ *     parameters:
+ *       - in: path
+ *         name: hostId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: A list of commands.
+ *       400:
+ *         description: Invalid request parameters.
+ *       500:
+ *         description: Failed to fetch history.
+ */
 router.get(
  "/command_history/:hostId",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { hostId } = req.params;
+    const hostId = Array.isArray(req.params.hostId)
+      ? req.params.hostId[0]
+      : req.params.hostId;
    const hostIdNum = parseInt(hostId, 10);

    if (!isNonEmptyString(userId) || isNaN(hostIdNum)) {
@@ -107,8 +154,33 @@ router.get(
  },
 );

-// Delete a specific command from history
-// POST /terminal/command_history/delete
+/**
+ * @openapi
+ * /terminal/command_history/delete:
+ *   post:
+ *     summary: Delete a specific command from history
+ *     description: Deletes a specific command from the history of a host.
+ *     tags:
+ *       - Terminal
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *               command:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Command deleted successfully.
+ *       400:
+ *         description: Missing required parameters.
+ *       500:
+ *         description: Failed to delete command.
+ */
 router.post(
  "/command_history/delete",
  authenticateJWT,
@@ -150,15 +222,37 @@ router.post(
  },
 );

-// Clear command history for a specific host (optional feature)
-// DELETE /terminal/command_history/:hostId
+/**
+ * @openapi
+ * /terminal/command_history/{hostId}:
+ *   delete:
+ *     summary: Clear command history
+ *     description: Clears the entire command history for a specific host.
+ *     tags:
+ *       - Terminal
+ *     parameters:
+ *       - in: path
+ *         name: hostId
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Command history cleared successfully.
+ *       400:
+ *         description: Invalid request.
+ *       500:
+ *         description: Failed to clear history.
+ */
 router.delete(
  "/command_history/:hostId",
  authenticateJWT,
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
-    const { hostId } = req.params;
+    const hostId = Array.isArray(req.params.hostId)
+      ? req.params.hostId[0]
+      : req.params.hostId;
    const hostIdNum = parseInt(hostId, 10);

    if (!isNonEmptyString(userId) || isNaN(hostIdNum)) {
@@ -175,9 +269,8 @@ router.delete(
            eq(commandHistory.hostId, hostIdNum),
          ),
        );
-
-      authLogger.success(`Command history cleared for host ${hostId}`, {
-        operation: "command_history_clear_success",
+      databaseLogger.info("Terminal history cleared", {
+        operation: "terminal_history_clear",
        userId,
        hostId: hostIdNum,
      });
@@ -0,0 +1,392 @@
+import { Client } from "ssh2";
+import type { WebSocket } from "ws";
+import { sshLogger, authLogger } from "../utils/logger.js";
+import { getDb } from "../database/db/index.js";
+import { sshCredentials, sshData } from "../database/db/schema.js";
+import { eq, and } from "drizzle-orm";
+import { SimpleDBOps } from "../utils/simple-db-ops.js";
+import { UserCrypto } from "../utils/user-crypto.js";
+
+interface ResolvedCredentials {
+  username: string;
+  password?: string;
+  key?: Buffer;
+  keyPassword?: string;
+  authType?: string;
+}
+
+interface HostConfig {
+  id: number;
+  ip: string;
+  port: number;
+  username: string;
+  password?: string;
+  key?: string;
+  keyPassword?: string;
+  keyType?: string;
+  authType?: string;
+  credentialId?: number;
+  userId?: string;
+  forceKeyboardInteractive?: boolean;
+}
+
+interface AuthContext {
+  userId: string;
+  ws: WebSocket;
+  hostId: number;
+  isKeyboardInteractive: boolean;
+  keyboardInteractiveResponded: boolean;
+  keyboardInteractiveFinish: ((responses: string[]) => void) | null;
+  totpPromptSent: boolean;
+  warpgateAuthPromptSent: boolean;
+  totpTimeout: NodeJS.Timeout | null;
+  warpgateAuthTimeout: NodeJS.Timeout | null;
+  totpAttempts: number;
+}
+
+const userCrypto = UserCrypto.getInstance();
+const MAX_TOTP_ATTEMPTS = 3;
+
+export class SSHAuthManager {
+  public context: AuthContext;
+
+  constructor(context: AuthContext) {
+    this.context = context;
+  }
+
+  async resolveCredentials(
+    hostConfig: HostConfig,
+  ): Promise<ResolvedCredentials> {
+    let resolvedCredentials: ResolvedCredentials = {
+      username: hostConfig.username,
+      authType: hostConfig.authType || "none",
+    };
+
+    if (hostConfig.credentialId) {
+      const credentials = await SimpleDBOps.select(
+        getDb()
+          .select()
+          .from(sshCredentials)
+          .where(
+            and(
+              eq(sshCredentials.id, hostConfig.credentialId),
+              eq(sshCredentials.userId, this.context.userId),
+            ),
+          ),
+        "ssh_credentials",
+        this.context.userId,
+      );
+
+      if (credentials.length > 0) {
+        const cred = credentials[0];
+        resolvedCredentials = {
+          username: (cred.username as string) || hostConfig.username,
+          password: (cred.password as string) || undefined,
+          key: cred.privateKey
+            ? Buffer.from(cred.privateKey as string)
+            : undefined,
+          keyPassword: (cred.passphrase as string) || undefined,
+          authType: (cred.authType as string) || "none",
+        };
+      }
+    } else {
+      if (hostConfig.password) {
+        resolvedCredentials.password = hostConfig.password;
+        resolvedCredentials.authType = "password";
+      }
+
+      if (hostConfig.key) {
+        resolvedCredentials.key = Buffer.from(hostConfig.key, "utf8");
+        resolvedCredentials.authType = "key";
+
+        if (hostConfig.keyPassword) {
+          resolvedCredentials.keyPassword = hostConfig.keyPassword;
+        }
+      }
+    }
+
+    return resolvedCredentials;
+  }
+
+  handleKeyboardInteractive(
+    name: string,
+    instructions: string,
+    instructionsLang: string,
+    prompts: Array<{ prompt: string; echo: boolean }>,
+    finish: (responses: string[]) => void,
+    resolvedCredentials: ResolvedCredentials,
+  ): void {
+    this.context.isKeyboardInteractive = true;
+    const promptTexts = prompts.map((p) => p.prompt);
+
+    const warpgatePattern = /warpgate\s+authentication/i;
+    const isWarpgate =
+      warpgatePattern.test(name) ||
+      warpgatePattern.test(instructions) ||
+      promptTexts.some((p) => warpgatePattern.test(p));
+
+    if (isWarpgate) {
+      this.handleWarpgateAuth(name, instructions, promptTexts, finish);
+      return;
+    }
+
+    const totpPromptIndex = prompts.findIndex((p) =>
+      /verification code|verification_code|token|otp|2fa|authenticator|google.*auth/i.test(
+        p.prompt,
+      ),
+    );
+
+    if (totpPromptIndex !== -1) {
+      this.handleTotpAuth(
+        prompts,
+        totpPromptIndex,
+        finish,
+        resolvedCredentials,
+      );
+      return;
+    }
+
+    this.handlePasswordAuth(prompts, finish, resolvedCredentials);
+  }
+
+  private handleWarpgateAuth(
+    name: string,
+    instructions: string,
+    promptTexts: string[],
+    finish: (responses: string[]) => void,
+  ): void {
+    const fullText = `${name}\n${instructions}\n${promptTexts.join("\n")}`;
+
+    const urlMatch = fullText.match(/https?:\/\/[^\s\n]+/i);
+    const keyMatch = fullText.match(
+      /security key[:\s]+([a-z0-9](?:\s+[a-z0-9]){3}|[a-z0-9]{4})/i,
+    );
+
+    if (urlMatch) {
+      this.context.keyboardInteractiveFinish = (responses: string[]) => {
+        finish([""]);
+      };
+
+      this.context.warpgateAuthPromptSent = true;
+
+      this.sendLog("auth", "info", "Warpgate authentication required");
+
+      this.context.ws.send(
+        JSON.stringify({
+          type: "warpgate_auth_required",
+          url: urlMatch[0],
+          securityKey: keyMatch ? keyMatch[1] : "N/A",
+          instructions: instructions,
+        }),
+      );
+
+      this.context.warpgateAuthTimeout = setTimeout(() => {
+        if (this.context.keyboardInteractiveFinish) {
+          this.context.keyboardInteractiveFinish = null;
+          this.context.warpgateAuthPromptSent = false;
+          sshLogger.warn("Warpgate authentication timeout", {
+            operation: "warpgate_timeout",
+            hostId: this.context.hostId,
+          });
+          this.context.ws.send(
+            JSON.stringify({
+              type: "error",
+              message: "Warpgate authentication timeout. Please reconnect.",
+            }),
+          );
+        }
+      }, 300000);
+    }
+  }
+
+  private handleTotpAuth(
+    prompts: Array<{ prompt: string; echo: boolean }>,
+    totpPromptIndex: number,
+    finish: (responses: string[]) => void,
+    resolvedCredentials: ResolvedCredentials,
+  ): void {
+    if (this.context.totpPromptSent) {
+      sshLogger.warn("TOTP prompt asked again - invalid code", {
+        operation: "ssh_keyboard_interactive_totp_retry",
+        hostId: this.context.hostId,
+      });
+      authLogger.warn("TOTP verification failed for SSH session", {
+        operation: "terminal_totp_failed",
+        userId: this.context.userId,
+        hostId: this.context.hostId,
+      });
+
+      this.sendLog("auth", "warning", "Invalid TOTP code");
+
+      this.context.ws.send(
+        JSON.stringify({
+          type: "totp_retry",
+        }),
+      );
+      return;
+    }
+
+    this.context.totpPromptSent = true;
+    this.context.keyboardInteractiveResponded = true;
+
+    this.context.keyboardInteractiveFinish = (totpResponses: string[]) => {
+      const totpCode = (totpResponses[0] || "").trim();
+
+      const responses = prompts.map((p, index) => {
+        if (index === totpPromptIndex) {
+          return totpCode;
+        }
+        if (/password/i.test(p.prompt) && resolvedCredentials.password) {
+          return resolvedCredentials.password;
+        }
+        return "";
+      });
+
+      finish(responses);
+    };
+
+    if (this.context.totpTimeout) {
+      clearTimeout(this.context.totpTimeout);
+    }
+
+    this.context.totpTimeout = setTimeout(() => {
+      if (this.context.keyboardInteractiveFinish) {
+        this.context.keyboardInteractiveFinish = null;
+        this.context.totpPromptSent = false;
+        sshLogger.warn("TOTP prompt timeout", {
+          operation: "totp_timeout",
+          hostId: this.context.hostId,
+        });
+        this.context.ws.send(
+          JSON.stringify({
+            type: "error",
+            message: "TOTP verification timeout. Please reconnect.",
+          }),
+        );
+      }
+    }, 180000);
+
+    this.sendLog("auth", "info", "TOTP verification required");
+    authLogger.info("TOTP verification prompt sent to client", {
+      operation: "terminal_totp_prompt",
+      userId: this.context.userId,
+      hostId: this.context.hostId,
+    });
+
+    this.context.ws.send(
+      JSON.stringify({
+        type: "totp_required",
+        prompt: prompts[totpPromptIndex].prompt,
+      }),
+    );
+  }
+
+  private handlePasswordAuth(
+    prompts: Array<{ prompt: string; echo: boolean }>,
+    finish: (responses: string[]) => void,
+    resolvedCredentials: ResolvedCredentials,
+  ): void {
+    const hasStoredPassword =
+      resolvedCredentials.password && resolvedCredentials.authType !== "none";
+
+    const passwordPromptIndex = prompts.findIndex((p) =>
+      /password/i.test(p.prompt),
+    );
+
+    if (!hasStoredPassword && passwordPromptIndex !== -1) {
+      if (this.context.keyboardInteractiveResponded) {
+        return;
+      }
+      this.context.keyboardInteractiveResponded = true;
+
+      this.context.keyboardInteractiveFinish = (userResponses: string[]) => {
+        const userInput = (userResponses[0] || "").trim();
+
+        const responses = prompts.map((p, index) => {
+          if (index === passwordPromptIndex) {
+            return userInput;
+          }
+          return "";
+        });
+
+        finish(responses);
+      };
+
+      if (this.context.totpTimeout) {
+        clearTimeout(this.context.totpTimeout);
+      }
+
+      this.context.totpTimeout = setTimeout(() => {
+        if (this.context.keyboardInteractiveFinish) {
+          this.context.keyboardInteractiveFinish = null;
+          this.context.keyboardInteractiveResponded = false;
+          sshLogger.warn("Password prompt timeout", {
+            operation: "password_timeout",
+            hostId: this.context.hostId,
+          });
+          this.context.ws.send(
+            JSON.stringify({
+              type: "error",
+              message: "Password verification timeout. Please reconnect.",
+            }),
+          );
+        }
+      }, 180000);
+
+      this.sendLog("auth", "info", "Password authentication required");
+
+      this.context.ws.send(
+        JSON.stringify({
+          type: "password_required",
+          prompt: prompts[passwordPromptIndex].prompt,
+        }),
+      );
+      return;
+    }
+
+    const responses = prompts.map((p) => {
+      if (/password/i.test(p.prompt) && resolvedCredentials.password) {
+        return resolvedCredentials.password;
+      }
+      return "";
+    });
+
+    finish(responses);
+  }
+
+  sendLog(
+    stage: string,
+    level: string,
+    message: string,
+    details?: Record<string, any>,
+  ): void {
+    this.context.ws.send(
+      JSON.stringify({
+        type: "connection_log",
+        data: {
+          stage,
+          level,
+          message,
+          details,
+        },
+      }),
+    );
+  }
+
+  cleanup(): void {
+    if (this.context.totpTimeout) {
+      clearTimeout(this.context.totpTimeout);
+      this.context.totpTimeout = null;
+    }
+
+    if (this.context.warpgateAuthTimeout) {
+      clearTimeout(this.context.warpgateAuthTimeout);
+      this.context.warpgateAuthTimeout = null;
+    }
+
+    this.context.keyboardInteractiveFinish = null;
+    this.context.totpPromptSent = false;
+    this.context.warpgateAuthPromptSent = false;
+    this.context.keyboardInteractiveResponded = false;
+  }
+}
@@ -9,7 +9,7 @@ import { SimpleDBOps } from "../utils/simple-db-ops.js";
 import { systemLogger } from "../utils/logger.js";
 import type { SSHHost } from "../../types/index.js";

-const dockerConsoleLogger = systemLogger;
+const sshLogger = systemLogger;

 interface SSHSession {
  client: SSHClient;
@@ -17,6 +17,7 @@ interface SSHSession {
  isConnected: boolean;
  containerId?: string;
  shell?: string;
+  hostId?: number;
 }

 const activeSessions = new Map<string, SSHSession>();
@@ -121,7 +122,7 @@ async function createJumpHostChain(
      try {
        jumpHost.jumpHosts = JSON.parse(jumpHost.jumpHosts);
      } catch (e) {
-        dockerConsoleLogger.error("Failed to parse jump hosts", e, {
+        sshLogger.error("Failed to parse jump hosts", e, {
          hostId: jumpHost.id,
        });
        jumpHost.jumpHosts = [];
@@ -226,6 +227,11 @@ async function createJumpHostChain(
 wss.on("connection", async (ws: WebSocket, req) => {
  const userId = (req as any).userId;
  const sessionId = `docker-console-${Date.now()}-${Math.random()}`;
+  sshLogger.info("Docker console WebSocket connected", {
+    operation: "docker_console_connect",
+    sessionId,
+    userId,
+  });

  let sshSession: SSHSession | null = null;

@@ -251,7 +257,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
            try {
              hostConfig.jumpHosts = JSON.parse(hostConfig.jumpHosts);
            } catch (e) {
-              dockerConsoleLogger.error("Failed to parse jump hosts", e, {
+              sshLogger.error("Failed to parse jump hosts", e, {
                hostId: hostConfig.id,
              });
              hostConfig.jumpHosts = [];
@@ -383,6 +389,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
              stream: null,
              isConnected: true,
              containerId,
+              hostId: hostConfig.id,
            };

            activeSessions.set(sessionId, sshSession);
@@ -417,7 +424,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
                  );
                });
              } catch {
-                dockerConsoleLogger.warn(
+                sshLogger.warn(
                  `Requested shell ${shell} not found, detecting available shell`,
                  {
                    operation: "shell_validation",
@@ -435,6 +442,13 @@ wss.on("connection", async (ws: WebSocket, req) => {
            sshSession.shell = shellToUse;

            const execCommand = `docker exec -it ${containerId} /bin/${shellToUse}`;
+            sshLogger.info("Attaching to Docker container", {
+              operation: "docker_attach",
+              sessionId,
+              userId,
+              hostId: hostConfig.id,
+              containerId,
+            });

            client.exec(
              execCommand,
@@ -447,15 +461,11 @@ wss.on("connection", async (ws: WebSocket, req) => {
              },
              (err, stream) => {
                if (err) {
-                  dockerConsoleLogger.error(
-                    "Failed to create docker exec",
-                    err,
-                    {
-                      operation: "docker_exec",
-                      sessionId,
-                      containerId,
-                    },
-                  );
+                  sshLogger.error("Failed to create docker exec", err, {
+                    operation: "docker_exec",
+                    sessionId,
+                    containerId,
+                  });

                  ws.send(
                    JSON.stringify({
@@ -467,6 +477,13 @@ wss.on("connection", async (ws: WebSocket, req) => {
                }

                sshSession!.stream = stream;
+                sshLogger.success("Docker container attached", {
+                  operation: "docker_attach_success",
+                  sessionId,
+                  userId,
+                  hostId: hostConfig.id,
+                  containerId,
+                });

                stream.on("data", (data: Buffer) => {
                  if (ws.readyState === WebSocket.OPEN) {
@@ -510,7 +527,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
              },
            );
          } catch (error) {
-            dockerConsoleLogger.error("Failed to connect to container", error, {
+            sshLogger.error("Failed to connect to container", error, {
              operation: "console_connect",
              sessionId,
              containerId: message.data.containerId,
@@ -570,13 +587,13 @@ wss.on("connection", async (ws: WebSocket, req) => {
        }

        default:
-          dockerConsoleLogger.warn("Unknown message type", {
+          sshLogger.warn("Unknown message type", {
            operation: "ws_message",
            type: message.type,
          });
      }
    } catch (error) {
-      dockerConsoleLogger.error("WebSocket message error", error, {
+      sshLogger.error("WebSocket message error", error, {
        operation: "ws_message",
        sessionId,
      });
@@ -591,6 +608,13 @@ wss.on("connection", async (ws: WebSocket, req) => {
  });

  ws.on("close", () => {
+    sshLogger.info("Docker console disconnected", {
+      operation: "docker_console_disconnect",
+      sessionId,
+      userId,
+      hostId: sshSession?.hostId,
+      containerId: sshSession?.containerId,
+    });
    if (sshSession) {
      if (sshSession.stream) {
        sshSession.stream.end();
@@ -601,7 +625,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
  });

  ws.on("error", (error) => {
-    dockerConsoleLogger.error("WebSocket error", error, {
+    sshLogger.error("WebSocket error", error, {
      operation: "ws_error",
      sessionId,
    });
@@ -0,0 +1,471 @@
+import type { WebSocket } from "ws";
+import { db } from "../database/db/index.js";
+import { sshData } from "../database/db/schema.js";
+import { eq } from "drizzle-orm";
+import { sshLogger } from "../utils/logger.js";
+import crypto from "crypto";
+
+interface HostKeyVerificationData {
+  scenario: "new" | "changed";
+  ip: string;
+  port: number;
+  hostname?: string;
+  fingerprint: string;
+  oldFingerprint?: string;
+  keyType: string;
+  oldKeyType?: string;
+  algorithm: string;
+}
+
+interface VerificationResponse {
+  action: "accept" | "reject";
+}
+
+export class SSHHostKeyVerifier {
+  /**
+   * Creates a hostVerifier callback for ssh2 Client.connect()
+   *
+   * @param hostId - Database ID of the host (null for quick connect)
+   * @param ip - IP address or hostname
+   * @param port - SSH port
+   * @param ws - WebSocket for user prompts (null for non-interactive connections)
+   * @param userId - User ID for logging
+   * @param isJumpHost - If true, auto-accepts without prompting
+   * @returns async hostVerifier callback
+   */
+  static async createHostVerifier(
+    hostId: number | null,
+    ip: string,
+    port: number,
+    ws: WebSocket | null,
+    userId: string,
+    isJumpHost: boolean = false,
+  ): Promise<(hostkey: Buffer, verify: (valid: boolean) => void) => void> {
+    return (hostkey: Buffer, verify: (valid: boolean) => void): void => {
+      (async () => {
+        try {
+          const fingerprint = hostkey.toString("hex");
+          const keyType = this.getKeyType(hostkey);
+          const algorithm = "sha256";
+
+          if (!hostId) {
+            sshLogger.info(
+              "Host key verification skipped (no hostId - quick connect)",
+              {
+                operation: "host_key_skip",
+                ip,
+                port,
+                fingerprint,
+                keyType,
+                userId,
+              },
+            );
+            verify(true);
+            return;
+          }
+
+          const host = await db.query.sshData.findFirst({
+            where: eq(sshData.id, hostId),
+          });
+
+          if (!host) {
+            sshLogger.warn(
+              "Host not found in database during key verification",
+              {
+                operation: "host_key_no_host",
+                hostId,
+                ip,
+                port,
+                userId,
+              },
+            );
+            verify(true);
+            return;
+          }
+
+          if (!host.hostKeyFingerprint) {
+            if (isJumpHost) {
+              await this.storeHostKey(hostId, fingerprint, keyType, algorithm);
+              sshLogger.info("Jump host key auto-accepted and stored", {
+                operation: "host_key_stored",
+                hostId,
+                ip,
+                port,
+                fingerprint,
+                keyType,
+                userId,
+                isJumpHost: true,
+              });
+              verify(true);
+              return;
+            }
+
+            if (!ws) {
+              sshLogger.warn(
+                "No WebSocket available for host key verification prompt",
+                {
+                  operation: "host_key_no_ws",
+                  hostId,
+                  ip,
+                  port,
+                  userId,
+                },
+              );
+              verify(true);
+              return;
+            }
+
+            const accepted = await this.promptUserForNewKey(
+              ws,
+              ip,
+              port,
+              host.name || undefined,
+              fingerprint,
+              keyType,
+              algorithm,
+            );
+
+            if (accepted) {
+              await this.storeHostKey(hostId, fingerprint, keyType, algorithm);
+              sshLogger.info("New host key accepted by user and stored", {
+                operation: "host_key_stored",
+                hostId,
+                ip,
+                port,
+                fingerprint,
+                keyType,
+                userId,
+              });
+            } else {
+              sshLogger.warn("User rejected new host key", {
+                operation: "host_key_rejected",
+                hostId,
+                ip,
+                port,
+                fingerprint,
+                keyType,
+                userId,
+              });
+            }
+
+            verify(accepted);
+            return;
+          }
+
+          if (host.hostKeyFingerprint === fingerprint) {
+            await db
+              .update(sshData)
+              .set({
+                hostKeyLastVerified: new Date().toISOString(),
+              })
+              .where(eq(sshData.id, hostId));
+
+            sshLogger.info("Host key verified successfully", {
+              operation: "host_key_verified",
+              hostId,
+              ip,
+              port,
+              fingerprint,
+              keyType,
+              userId,
+            });
+
+            verify(true);
+            return;
+          }
+
+          sshLogger.error("Host key mismatch detected - SECURITY WARNING", {
+            operation: "host_key_mismatch",
+            hostId,
+            ip,
+            port,
+            oldFingerprint: host.hostKeyFingerprint,
+            newFingerprint: fingerprint,
+            oldKeyType: host.hostKeyType,
+            newKeyType: keyType,
+            userId,
+            changeCount: host.hostKeyChangedCount || 0,
+          });
+
+          if (isJumpHost) {
+            await this.updateHostKey(
+              hostId,
+              fingerprint,
+              keyType,
+              algorithm,
+              host.hostKeyChangedCount || 0,
+            );
+            sshLogger.warn("Jump host key changed - auto-accepted", {
+              operation: "host_key_updated",
+              hostId,
+              ip,
+              port,
+              fingerprint,
+              keyType,
+              userId,
+              isJumpHost: true,
+            });
+            verify(true);
+            return;
+          }
+
+          if (!ws) {
+            sshLogger.error(
+              "Host key changed - please connect via Terminal to verify the new key",
+              {
+                operation: "host_key_no_ws_reject",
+                hostId,
+                ip,
+                port,
+                userId,
+                message:
+                  "SSH host key has changed. For security, please open a Terminal connection to this host first to verify and accept the new key fingerprint.",
+              },
+            );
+            verify(false);
+            return;
+          }
+
+          const accepted = await this.promptUserForChangedKey(
+            ws,
+            ip,
+            port,
+            host.name || undefined,
+            fingerprint,
+            host.hostKeyFingerprint,
+            keyType,
+            host.hostKeyType || "unknown",
+            algorithm,
+          );
+
+          if (accepted) {
+            await this.updateHostKey(
+              hostId,
+              fingerprint,
+              keyType,
+              algorithm,
+              host.hostKeyChangedCount || 0,
+            );
+            sshLogger.warn("Changed host key accepted by user", {
+              operation: "host_key_updated",
+              hostId,
+              ip,
+              port,
+              oldFingerprint: host.hostKeyFingerprint,
+              newFingerprint: fingerprint,
+              userId,
+              changeCount: (host.hostKeyChangedCount || 0) + 1,
+            });
+          } else {
+            sshLogger.error("User rejected changed host key", {
+              operation: "host_key_change_rejected",
+              hostId,
+              ip,
+              port,
+              userId,
+            });
+          }
+
+          verify(accepted);
+        } catch (error) {
+          sshLogger.error("Error in host key verification", error, {
+            operation: "host_key_error",
+            hostId,
+            ip,
+            port,
+            userId,
+          });
+          verify(false);
+        }
+      })();
+    };
+  }
+
+  private static async storeHostKey(
+    hostId: number,
+    fingerprint: string,
+    keyType: string,
+    algorithm: string,
+  ): Promise<void> {
+    await db
+      .update(sshData)
+      .set({
+        hostKeyFingerprint: fingerprint,
+        hostKeyType: keyType,
+        hostKeyAlgorithm: algorithm,
+        hostKeyFirstSeen: new Date().toISOString(),
+        hostKeyLastVerified: new Date().toISOString(),
+      })
+      .where(eq(sshData.id, hostId));
+  }
+
+  private static async updateHostKey(
+    hostId: number,
+    fingerprint: string,
+    keyType: string,
+    algorithm: string,
+    currentChangeCount: number,
+  ): Promise<void> {
+    await db
+      .update(sshData)
+      .set({
+        hostKeyFingerprint: fingerprint,
+        hostKeyType: keyType,
+        hostKeyAlgorithm: algorithm,
+        hostKeyLastVerified: new Date().toISOString(),
+        hostKeyChangedCount: currentChangeCount + 1,
+      })
+      .where(eq(sshData.id, hostId));
+  }
+
+  private static async promptUserForNewKey(
+    ws: WebSocket,
+    ip: string,
+    port: number,
+    hostname: string | undefined,
+    fingerprint: string,
+    keyType: string,
+    algorithm: string,
+  ): Promise<boolean> {
+    return new Promise<boolean>((resolve) => {
+      const timeout = setTimeout(() => {
+        ws.removeListener("message", messageHandler);
+        sshLogger.warn("Host key verification timeout (new key)", {
+          operation: "host_key_timeout",
+          ip,
+          port,
+        });
+        resolve(false);
+      }, 60000);
+
+      const messageHandler = (data: Buffer) => {
+        try {
+          const message = JSON.parse(data.toString());
+
+          if (message.type === "host_key_verification_response") {
+            clearTimeout(timeout);
+            ws.removeListener("message", messageHandler);
+
+            const response = message.data as VerificationResponse;
+            resolve(response.action === "accept");
+          }
+        } catch (error) {
+          sshLogger.error(
+            "Error parsing host key verification response",
+            error,
+          );
+        }
+      };
+
+      ws.on("message", messageHandler);
+
+      const verificationData: HostKeyVerificationData = {
+        scenario: "new",
+        ip,
+        port,
+        hostname,
+        fingerprint,
+        keyType,
+        algorithm,
+      };
+
+      ws.send(
+        JSON.stringify({
+          type: "host_key_verification_required",
+          data: verificationData,
+        }),
+      );
+    });
+  }
+
+  private static async promptUserForChangedKey(
+    ws: WebSocket,
+    ip: string,
+    port: number,
+    hostname: string | undefined,
+    fingerprint: string,
+    oldFingerprint: string,
+    keyType: string,
+    oldKeyType: string,
+    algorithm: string,
+  ): Promise<boolean> {
+    return new Promise<boolean>((resolve) => {
+      const timeout = setTimeout(() => {
+        ws.removeListener("message", messageHandler);
+        sshLogger.error("Host key verification timeout (changed key)", {
+          operation: "host_key_timeout",
+          ip,
+          port,
+        });
+        resolve(false);
+      }, 120000);
+
+      const messageHandler = (data: Buffer) => {
+        try {
+          const message = JSON.parse(data.toString());
+
+          if (message.type === "host_key_verification_response") {
+            clearTimeout(timeout);
+            ws.removeListener("message", messageHandler);
+
+            const response = message.data as VerificationResponse;
+            resolve(response.action === "accept");
+          }
+        } catch (error) {
+          sshLogger.error(
+            "Error parsing host key verification response",
+            error,
+          );
+        }
+      };
+
+      ws.on("message", messageHandler);
+
+      const verificationData: HostKeyVerificationData = {
+        scenario: "changed",
+        ip,
+        port,
+        hostname,
+        fingerprint,
+        oldFingerprint,
+        keyType,
+        oldKeyType,
+        algorithm,
+      };
+
+      ws.send(
+        JSON.stringify({
+          type: "host_key_changed",
+          data: verificationData,
+        }),
+      );
+    });
+  }
+
+  private static getKeyType(key: Buffer): string {
+    try {
+      if (key.length < 4) {
+        return "unknown";
+      }
+
+      const typeLength = key.readUInt32BE(0);
+      if (typeLength > key.length - 4 || typeLength > 256) {
+        return "unknown";
+      }
+
+      const keyType = key.toString("utf8", 4, 4 + typeLength);
+
+      if (
+        (keyType && keyType.startsWith("ssh-")) ||
+        keyType.startsWith("ecdsa-")
+      ) {
+        return keyType;
+      }
+
+      return "unknown";
+    } catch (error) {
+      sshLogger.error("Error parsing SSH key type", error);
+      return "unknown";
+    }
+  }
+}
@@ -0,0 +1,803 @@
+import { spawn, ChildProcess } from "child_process";
+import { randomUUID } from "crypto";
+import { WebSocket } from "ws";
+import { IncomingMessage } from "http";
+import { OPKSSHBinaryManager } from "../utils/opkssh-binary-manager.js";
+import { sshLogger } from "../utils/logger.js";
+import { getDb } from "../database/db/index.js";
+import { opksshTokens } from "../database/db/schema.js";
+import { eq, and } from "drizzle-orm";
+import { UserCrypto } from "../utils/user-crypto.js";
+import { FieldCrypto } from "../utils/field-crypto.js";
+import { promises as fs } from "fs";
+import path from "path";
+import axios from "axios";
+
+const AUTH_TIMEOUT = 60 * 1000;
+
+interface OPKSSHAuthSession {
+  requestId: string;
+  userId: string;
+  hostId: number;
+  hostname: string;
+  process: ChildProcess;
+  localPort: number;
+  callbackPort: number;
+  remoteRedirectUri: string;
+  status:
+    | "starting"
+    | "waiting_for_auth"
+    | "authenticating"
+    | "completed"
+    | "error";
+  ws: WebSocket;
+  stdoutBuffer: string;
+  privateKeyBuffer: string;
+  sshCertBuffer: string;
+  identity: {
+    email?: string;
+    sub?: string;
+    issuer?: string;
+    audience?: string;
+  };
+  createdAt: Date;
+  approvalTimeout: NodeJS.Timeout;
+  cleanup: () => Promise<void>;
+}
+
+const activeAuthSessions = new Map<string, OPKSSHAuthSession>();
+const cleanupInProgress = new Set<string>();
+
+export function getRequestOrigin(req: IncomingMessage): string {
+  const protoHeader =
+    req.headers["x-forwarded-proto"] ||
+    ((req.socket as any).encrypted ? "https" : "http");
+  const proto =
+    typeof protoHeader === "string"
+      ? protoHeader.split(",")[0].trim()
+      : String(protoHeader);
+
+  const portHeader = req.headers["x-forwarded-port"];
+  const port =
+    typeof portHeader === "string"
+      ? portHeader.split(",")[0].trim()
+      : undefined;
+
+  const hostHeaderRaw =
+    req.headers["x-forwarded-host"] || req.headers.host || "localhost";
+  const hostHeader =
+    typeof hostHeaderRaw === "string"
+      ? hostHeaderRaw.split(",")[0].trim()
+      : String(hostHeaderRaw);
+
+  if (port) {
+    const hostWithoutPort = hostHeader.split(":")[0];
+    const isDefaultPort =
+      (proto === "http" && port === "80") ||
+      (proto === "https" && port === "443");
+    return isDefaultPort
+      ? `${proto}://${hostWithoutPort}`
+      : `${proto}://${hostWithoutPort}:${port}`;
+  }
+
+  return `${proto}://${hostHeader}`;
+}
+
+function getOPKConfigPath(): string {
+  const dataDir =
+    process.env.DATA_DIR || path.join(process.cwd(), "db", "data");
+  return path.join(dataDir, ".opk", "config.yml");
+}
+
+async function ensureOPKConfigDir(): Promise<void> {
+  const configPath = getOPKConfigPath();
+  const configDir = path.dirname(configPath);
+  await fs.mkdir(configDir, { recursive: true });
+}
+
+async function createTemplateConfig(): Promise<void> {
+  const configPath = getOPKConfigPath();
+  const template = `
+# OPKSSH Configuration
+# OPKSSH Documentation: https://github.com/openpubkey/opkssh/blob/main/docs/config.md
+# Termix Documentation: https://docs.termix.site/opkssh
+`;
+
+  try {
+    await ensureOPKConfigDir();
+    await fs.writeFile(configPath, template, "utf8");
+    sshLogger.info(`Created template OPKSSH config at ${configPath}`);
+  } catch (error) {
+    sshLogger.warn("Failed to create template OPKSSH config", error);
+  }
+}
+
+async function checkOPKConfigExists(): Promise<{
+  exists: boolean;
+  error?: string;
+  configPath?: string;
+}> {
+  const configPath = getOPKConfigPath();
+  const isDocker =
+    !!process.env.DATA_DIR && process.env.DATA_DIR.startsWith("/app");
+  const dockerHint = isDocker
+    ? "\n\nDocker: Ensure /app/data is mounted as a volume with write permissions for node:node user."
+    : "";
+
+  try {
+    const content = await fs.readFile(configPath, "utf8");
+
+    if (!content.includes("providers:")) {
+      return {
+        exists: false,
+        configPath,
+        error: `OPKSSH configuration is missing 'providers' section. Please edit the config file at:\n${configPath}\n\n.`,
+      };
+    }
+
+    const lines = content.split("\n");
+
+    const hasUncommentedProvider = lines.some((line) => {
+      const trimmed = line.trim();
+      return (
+        trimmed.startsWith("- alias:") ||
+        (trimmed.startsWith("issuer:") && !line.trimStart().startsWith("#"))
+      );
+    });
+
+    if (!hasUncommentedProvider) {
+      return {
+        exists: false,
+        configPath,
+        error: `OPKSSH configuration has no active providers. Please edit the config file at:\n${configPath}\n\nUncomment and configure at least one OIDC provider.\nSee documentation: https://github.com/openpubkey/opkssh/blob/main/docs/config.md${dockerHint}`,
+      };
+    }
+
+    if (!content.includes("redirect_uris:")) {
+      return {
+        exists: false,
+        configPath,
+        error: `OPKSSH configuration is missing 'redirect_uris' field.`,
+      };
+    }
+
+    return { exists: true, configPath };
+  } catch {
+    await createTemplateConfig();
+    return {
+      exists: false,
+      configPath,
+      error: `OPKSSH configuration not found. A template config file has been created at:\n${configPath}\n\nPlease edit this file and configure your OIDC provider (Google, GitHub, Microsoft, etc.).\nSee documentation: https://github.com/openpubkey/opkssh/blob/main/docs/config.md${dockerHint}`,
+    };
+  }
+}
+
+export async function startOPKSSHAuth(
+  userId: string,
+  hostId: number,
+  hostname: string,
+  ws: WebSocket,
+  requestOrigin: string,
+): Promise<string> {
+  try {
+    await ensureOPKConfigDir();
+    const configDir = path.dirname(getOPKConfigPath());
+    await fs.access(configDir, fs.constants.R_OK | fs.constants.W_OK);
+  } catch (error) {
+    sshLogger.error("OPKSSH directory not accessible", error);
+    const isDocker =
+      !!process.env.DATA_DIR && process.env.DATA_DIR.startsWith("/app");
+    const dockerHint = isDocker
+      ? "\n\nDocker: Ensure /app/data is mounted as a volume with write permissions for node:node user."
+      : "";
+    ws.send(
+      JSON.stringify({
+        type: "opkssh_error",
+        error: `OPKSSH directory initialization failed: ${error.message}${dockerHint}`,
+      }),
+    );
+    return "";
+  }
+
+  const configCheck = await checkOPKConfigExists();
+  if (!configCheck.exists) {
+    ws.send(
+      JSON.stringify({
+        type: "opkssh_config_error",
+        requestId: "",
+        error: configCheck.error,
+        instructions: configCheck.error,
+      }),
+    );
+    return "";
+  }
+
+  const requestId = randomUUID();
+  const remoteRedirectUri = `${requestOrigin}/ssh/opkssh-callback`;
+
+  const session: Partial<OPKSSHAuthSession> = {
+    requestId,
+    userId,
+    hostId,
+    hostname,
+    localPort: 0,
+    callbackPort: 0,
+    remoteRedirectUri,
+    status: "starting",
+    ws,
+    stdoutBuffer: "",
+    privateKeyBuffer: "",
+    sshCertBuffer: "",
+    identity: {},
+    createdAt: new Date(),
+  };
+
+  try {
+    const binaryPath = OPKSSHBinaryManager.getBinaryPath();
+    const configPath = getOPKConfigPath();
+    const configDir = path.dirname(configPath);
+
+    const args = [
+      "login",
+      "--print-key",
+      `--config-path=${configPath}`,
+      `--remote-redirect-uri=${remoteRedirectUri}`,
+    ];
+
+    const opksshProcess = spawn(binaryPath, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        ...process.env,
+      },
+    });
+    session.process = opksshProcess;
+
+    const cleanup = async () => {
+      await cleanupAuthSession(requestId);
+    };
+    session.cleanup = cleanup;
+
+    const timeout = setTimeout(async () => {
+      sshLogger.warn(`OPKSSH auth timeout for session ${requestId}`);
+      ws.send(
+        JSON.stringify({
+          type: "opkssh_timeout",
+          requestId,
+        }),
+      );
+      await cleanup();
+    }, AUTH_TIMEOUT);
+
+    session.approvalTimeout = timeout;
+
+    ws.on("close", () => {
+      cleanup();
+    });
+
+    activeAuthSessions.set(requestId, session as OPKSSHAuthSession);
+
+    opksshProcess.stdout?.on("data", (data) => {
+      const output = data.toString();
+      handleOPKSSHOutput(requestId, output);
+    });
+
+    opksshProcess.stderr?.on("data", async (data) => {
+      const stderr = data.toString();
+
+      if (stderr.includes("Opening browser to")) {
+        handleOPKSSHOutput(requestId, stderr);
+      }
+
+      if (stderr.includes("listening on")) {
+        handleOPKSSHOutput(requestId, stderr);
+      }
+
+      if (stderr.includes("provider not found") || stderr.includes("config")) {
+        ws.send(
+          JSON.stringify({
+            type: "opkssh_config_error",
+            requestId,
+            error:
+              "OPKSSH configuration error. Please verify your config file contains valid OIDC provider settings.",
+            instructions:
+              "See documentation: https://github.com/openpubkey/opkssh/blob/main/docs/config.md",
+          }),
+        );
+        cleanup();
+      }
+
+      if (
+        stderr.includes("level=error") ||
+        stderr.includes("Error:") ||
+        stderr.includes("failed")
+      ) {
+        const isXdgOpenError = stderr.includes('exec: "xdg-open"');
+        if (!isXdgOpenError) {
+          if (
+            stderr.includes("bind: address already in use") ||
+            stderr.includes("error logging in") ||
+            stderr.includes("failed to start")
+          ) {
+            await cleanup();
+          }
+        }
+      }
+    });
+
+    opksshProcess.on("error", (error) => {
+      ws.send(
+        JSON.stringify({
+          type: "opkssh_error",
+          requestId,
+          error: `OPKSSH process error: ${error.message}`,
+        }),
+      );
+      cleanup();
+    });
+
+    opksshProcess.on("exit", (code) => {
+      if (code !== 0 && session.status !== "completed") {
+        ws.send(
+          JSON.stringify({
+            type: "opkssh_error",
+            requestId,
+            error: `OPKSSH process exited with code ${code}`,
+          }),
+        );
+      }
+      cleanup();
+    });
+
+    return requestId;
+  } catch (error) {
+    sshLogger.error(`Failed to start OPKSSH auth session`, error);
+    ws.send(
+      JSON.stringify({
+        type: "opkssh_error",
+        requestId,
+        error: `Failed to start OPKSSH authentication: ${error instanceof Error ? error.message : "Unknown error"}`,
+      }),
+    );
+    return "";
+  }
+}
+
+function handleOPKSSHOutput(requestId: string, output: string): void {
+  const session = activeAuthSessions.get(requestId);
+  if (!session) {
+    return;
+  }
+
+  session.stdoutBuffer += output;
+
+  const chooserUrlMatch = session.stdoutBuffer.match(
+    /Opening browser to http:\/\/localhost:(\d+)\/chooser/,
+  );
+  if (chooserUrlMatch && session.status === "starting") {
+    const actualPort = parseInt(chooserUrlMatch[1], 10);
+    const localChooserUrl = `http://localhost:${actualPort}/chooser`;
+
+    session.localPort = actualPort;
+
+    const baseUrl = session.remoteRedirectUri.replace(
+      /\/ssh\/opkssh-callback$/,
+      "",
+    );
+    const proxiedChooserUrl = `${baseUrl}/ssh/opkssh-chooser/${requestId}`;
+
+    session.status = "waiting_for_auth";
+    session.ws.send(
+      JSON.stringify({
+        type: "opkssh_status",
+        requestId,
+        stage: "chooser",
+        url: proxiedChooserUrl,
+        localUrl: localChooserUrl,
+        message: "Please authenticate in your browser",
+      }),
+    );
+  }
+
+  const callbackPortMatch = session.stdoutBuffer.match(
+    /listening on http:\/\/127\.0\.0\.1:(\d+)\//,
+  );
+  if (callbackPortMatch && !session.callbackPort) {
+    session.callbackPort = parseInt(callbackPortMatch[1], 10);
+  }
+
+  if (output.includes("BEGIN OPENSSH PRIVATE KEY")) {
+    session.status = "authenticating";
+    session.ws.send(
+      JSON.stringify({
+        type: "opkssh_status",
+        requestId,
+        stage: "authenticating",
+        message: "Processing authentication...",
+      }),
+    );
+  }
+
+  const privateKeyMatch = session.stdoutBuffer.match(
+    /(-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----)/,
+  );
+  if (privateKeyMatch) {
+    session.privateKeyBuffer = privateKeyMatch[1].trim();
+  }
+
+  const certMatch = session.stdoutBuffer.match(
+    /(ecdsa-sha2-nistp256-cert-v01@openssh\.com\s+[A-Za-z0-9+/=]+|ssh-rsa-cert-v01@openssh\.com\s+[A-Za-z0-9+/=]+|ssh-ed25519-cert-v01@openssh\.com\s+[A-Za-z0-9+/=]+)/,
+  );
+  if (certMatch) {
+    session.sshCertBuffer = certMatch[1].trim();
+  }
+
+  const identityMatch = session.stdoutBuffer.match(
+    /Email, sub, issuer, audience:\s*\n?\s*([^\s]+)\s+([^\s]+)\s+([^\s]+)\s+([^\s]+)/,
+  );
+  if (identityMatch) {
+    session.identity = {
+      email: identityMatch[1],
+      sub: identityMatch[2],
+      issuer: identityMatch[3],
+      audience: identityMatch[4],
+    };
+  }
+
+  if (session.privateKeyBuffer && session.sshCertBuffer) {
+    if (!session.privateKeyBuffer.includes("BEGIN OPENSSH PRIVATE KEY")) {
+      sshLogger.error(`Invalid private key extracted [${requestId}]`, {
+        bufferPrefix: session.privateKeyBuffer.substring(0, 50),
+      });
+      session.ws.send(
+        JSON.stringify({
+          type: "opkssh_error",
+          requestId,
+          error: "Failed to extract valid private key from OPKSSH output",
+        }),
+      );
+      return;
+    }
+
+    if (!session.sshCertBuffer.match(/-cert-v01@openssh\.com/)) {
+      sshLogger.error(`Invalid SSH certificate extracted [${requestId}]`, {
+        bufferPrefix: session.sshCertBuffer.substring(0, 50),
+      });
+      session.ws.send(
+        JSON.stringify({
+          type: "opkssh_error",
+          requestId,
+          error: "Failed to extract valid SSH certificate from OPKSSH output",
+        }),
+      );
+      return;
+    }
+
+    storeOPKSSHToken(session);
+  }
+}
+
+async function storeOPKSSHToken(session: OPKSSHAuthSession): Promise<void> {
+  try {
+    const db = getDb();
+    const userCrypto = UserCrypto.getInstance();
+
+    const expiresAt = new Date();
+    expiresAt.setHours(expiresAt.getHours() + 24);
+
+    const userDataKey = userCrypto.getUserDataKey(session.userId);
+    if (!userDataKey) {
+      throw new Error("User data key not found");
+    }
+
+    const tokenId = `opkssh-${session.userId}-${session.hostId}`;
+
+    const encryptedCert = FieldCrypto.encryptField(
+      session.sshCertBuffer,
+      userDataKey,
+      tokenId,
+      "ssh_cert",
+    );
+    const encryptedKey = FieldCrypto.encryptField(
+      session.privateKeyBuffer,
+      userDataKey,
+      tokenId,
+      "private_key",
+    );
+
+    await db
+      .insert(opksshTokens)
+      .values({
+        userId: session.userId,
+        hostId: session.hostId,
+        sshCert: encryptedCert,
+        privateKey: encryptedKey,
+        email: session.identity.email,
+        sub: session.identity.sub,
+        issuer: session.identity.issuer,
+        audience: session.identity.audience,
+        expiresAt: expiresAt.toISOString(),
+      })
+      .onConflictDoUpdate({
+        target: [opksshTokens.userId, opksshTokens.hostId],
+        set: {
+          sshCert: encryptedCert,
+          privateKey: encryptedKey,
+          email: session.identity.email,
+          sub: session.identity.sub,
+          issuer: session.identity.issuer,
+          audience: session.identity.audience,
+          expiresAt: expiresAt.toISOString(),
+          createdAt: new Date().toISOString(),
+        },
+      });
+
+    session.status = "completed";
+    session.ws.send(
+      JSON.stringify({
+        type: "opkssh_completed",
+        requestId: session.requestId,
+        expiresAt: expiresAt.toISOString(),
+      }),
+    );
+
+    try {
+      await axios.post(
+        "http://localhost:30006/activity/log",
+        {
+          type: "opkssh_authentication",
+          hostId: session.hostId,
+          hostName: session.hostname,
+          status: "approved",
+        },
+        {
+          headers: {
+            Authorization: `Bearer ${process.env.INTERNAL_AUTH_TOKEN}`,
+          },
+        },
+      );
+    } catch (activityError) {
+      sshLogger.warn("Failed to log OPKSSH activity", activityError);
+    }
+
+    await session.cleanup();
+  } catch (error) {
+    sshLogger.error(
+      `Failed to store OPKSSH token for session ${session.requestId}`,
+      error,
+    );
+    session.ws.send(
+      JSON.stringify({
+        type: "opkssh_error",
+        requestId: session.requestId,
+        error: "Failed to store authentication token",
+      }),
+    );
+    await session.cleanup();
+  }
+}
+
+export async function getOPKSSHToken(
+  userId: string,
+  hostId: number,
+): Promise<{ sshCert: string; privateKey: string } | null> {
+  try {
+    const db = getDb();
+    const token = await db
+      .select()
+      .from(opksshTokens)
+      .where(
+        and(eq(opksshTokens.userId, userId), eq(opksshTokens.hostId, hostId)),
+      )
+      .limit(1);
+
+    if (!token || token.length === 0) {
+      return null;
+    }
+
+    const tokenData = token[0];
+    const expiresAt = new Date(tokenData.expiresAt);
+
+    if (expiresAt < new Date()) {
+      await db
+        .delete(opksshTokens)
+        .where(
+          and(eq(opksshTokens.userId, userId), eq(opksshTokens.hostId, hostId)),
+        );
+      return null;
+    }
+
+    const userCrypto = UserCrypto.getInstance();
+    const userDataKey = userCrypto.getUserDataKey(userId);
+    if (!userDataKey) {
+      throw new Error("User data key not found");
+    }
+
+    const tokenId = `opkssh-${userId}-${hostId}`;
+    const decryptedCert = FieldCrypto.decryptField(
+      tokenData.sshCert,
+      userDataKey,
+      tokenId,
+      "ssh_cert",
+    );
+    const decryptedKey = FieldCrypto.decryptField(
+      tokenData.privateKey,
+      userDataKey,
+      tokenId,
+      "private_key",
+    );
+
+    await db
+      .update(opksshTokens)
+      .set({ lastUsed: new Date().toISOString() })
+      .where(
+        and(eq(opksshTokens.userId, userId), eq(opksshTokens.hostId, hostId)),
+      );
+
+    return {
+      sshCert: decryptedCert,
+      privateKey: decryptedKey,
+    };
+  } catch (error) {
+    sshLogger.error(`Failed to retrieve OPKSSH token`, error);
+    return null;
+  }
+}
+
+export async function deleteOPKSSHToken(
+  userId: string,
+  hostId: number,
+): Promise<void> {
+  const db = getDb();
+  await db
+    .delete(opksshTokens)
+    .where(
+      and(eq(opksshTokens.userId, userId), eq(opksshTokens.hostId, hostId)),
+    );
+}
+
+export async function invalidateOPKSSHToken(
+  userId: string,
+  hostId: number,
+  reason: string,
+): Promise<void> {
+  try {
+    const db = getDb();
+    await db
+      .delete(opksshTokens)
+      .where(
+        and(eq(opksshTokens.userId, userId), eq(opksshTokens.hostId, hostId)),
+      );
+  } catch (error) {
+    sshLogger.error(`Failed to invalidate OPKSSH token`, {
+      userId,
+      hostId,
+      reason,
+      error,
+    });
+  }
+}
+
+export async function handleOAuthCallback(
+  requestId: string,
+  queryString: string,
+): Promise<{ success: boolean; message?: string }> {
+  const session = activeAuthSessions.get(requestId);
+
+  if (!session) {
+    return { success: false, message: "Invalid authentication session" };
+  }
+
+  try {
+    const callbackUrl = `http://localhost:${session.localPort}/login-callback?${queryString}`;
+    await axios.get(callbackUrl, {
+      timeout: 10000,
+      validateStatus: () => true,
+    });
+    return { success: true };
+  } catch {
+    session.ws.send(
+      JSON.stringify({
+        type: "opkssh_error",
+        requestId,
+        error: "Failed to complete authentication",
+      }),
+    );
+    await session.cleanup();
+    return { success: false, message: "Authentication failed" };
+  }
+}
+
+async function cleanupAuthSession(requestId: string): Promise<void> {
+  if (cleanupInProgress.has(requestId)) {
+    return;
+  }
+
+  cleanupInProgress.add(requestId);
+
+  try {
+    const session = activeAuthSessions.get(requestId);
+    if (!session) {
+      cleanupInProgress.delete(requestId);
+      return;
+    }
+
+    if (session.approvalTimeout) {
+      clearTimeout(session.approvalTimeout);
+    }
+
+    if (session.process) {
+      try {
+        session.process.kill("SIGTERM");
+        await new Promise<void>((resolve) => {
+          const killTimeout = setTimeout(() => {
+            if (session.process && !session.process.killed) {
+              session.process.kill("SIGKILL");
+            }
+            resolve();
+          }, 3000);
+
+          session.process.once("exit", () => {
+            clearTimeout(killTimeout);
+            resolve();
+          });
+        });
+
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+      } catch (killError) {
+        sshLogger.warn(
+          `Failed to kill OPKSSH process for session ${requestId}`,
+          killError,
+        );
+      }
+    }
+
+    activeAuthSessions.delete(requestId);
+  } finally {
+    cleanupInProgress.delete(requestId);
+  }
+}
+
+export function cancelAuthSession(requestId: string): void {
+  const session = activeAuthSessions.get(requestId);
+  if (session) {
+    session.cleanup();
+  }
+}
+
+export function getActiveAuthSession(
+  requestId: string,
+): OPKSSHAuthSession | undefined {
+  return activeAuthSessions.get(requestId);
+}
+
+export function getActiveSessionsForUser(userId: string): OPKSSHAuthSession[] {
+  const sessions: OPKSSHAuthSession[] = [];
+  for (const session of activeAuthSessions.values()) {
+    if (session.userId === userId) {
+      sessions.push(session);
+    }
+  }
+  return sessions;
+}
+
+export function getActiveSessionsAll(): OPKSSHAuthSession[] {
+  return Array.from(activeAuthSessions.values());
+}
+
+export async function getUserIdFromRequest(req: any): Promise<string | null> {
+  try {
+    const { AuthManager } = await import("../utils/auth-manager.js");
+    const authManager = AuthManager.getInstance();
+
+    const token =
+      req.cookies?.jwt || req.headers.authorization?.replace("Bearer ", "");
+    if (!token) {
+      return null;
+    }
+
+    const decoded = await authManager.verifyJWTToken(token);
+    return decoded?.userId || null;
+  } catch (error) {
+    return null;
+  }
+}
@@ -11,6 +11,7 @@ import { SimpleDBOps } from "../utils/simple-db-ops.js";
 import { AuthManager } from "../utils/auth-manager.js";
 import { PermissionManager } from "../utils/permission-manager.js";
 import type { AuthenticatedRequest, ProxyNode } from "../../types/index.js";
+import type { LogEntry, ConnectionStage } from "../../types/connection-log.js";
 import { collectCpuMetrics } from "./widgets/cpu-collector.js";
 import { collectMemoryMetrics } from "./widgets/memory-collector.js";
 import { collectDiskMetrics } from "./widgets/disk-collector.js";
@@ -19,7 +20,24 @@ import { collectUptimeMetrics } from "./widgets/uptime-collector.js";
 import { collectProcessesMetrics } from "./widgets/processes-collector.js";
 import { collectSystemMetrics } from "./widgets/system-collector.js";
 import { collectLoginStats } from "./widgets/login-stats-collector.js";
+import { collectPortsMetrics } from "./widgets/ports-collector.js";
+import { collectFirewallMetrics } from "./widgets/firewall-collector.js";
 import { createSocks5Connection } from "../utils/socks5-helper.js";
+import { SSHHostKeyVerifier } from "./host-key-verifier.js";
+
+function createConnectionLog(
+  type: "info" | "success" | "warning" | "error",
+  stage: ConnectionStage,
+  message: string,
+  details?: Record<string, any>,
+): Omit<LogEntry, "id" | "timestamp"> {
+  return {
+    type,
+    stage,
+    message,
+    details,
+  };
+}

 async function resolveJumpHost(
  hostId: number,
@@ -108,6 +126,15 @@ async function createJumpHostChain(
      const jumpClient = new Client();
      clients.push(jumpClient);

+      const jumpHostVerifier = await SSHHostKeyVerifier.createHostVerifier(
+        jumpHostConfig.id,
+        jumpHostConfig.ip,
+        jumpHostConfig.port || 22,
+        null,
+        userId,
+        true,
+      );
+
      const connected = await new Promise<boolean>((resolve) => {
        const timeout = setTimeout(() => {
          resolve(false);
@@ -134,6 +161,7 @@ async function createJumpHostChain(
          username: jumpHostConfig.username,
          tryKeyboard: true,
          readyTimeout: 30000,
+          hostVerifier: jumpHostVerifier,
        };

        if (jumpHostConfig.authType === "password" && jumpHostConfig.password) {
@@ -361,8 +389,8 @@ class SSHConnectionPool {
  private async createConnection(
    host: SSHHostWithCredentials,
  ): Promise<Client> {
+    const config = await buildSshConfig(host);
    return new Promise(async (resolve, reject) => {
-      const config = buildSshConfig(host);
      const client = new Client();
      const timeout = setTimeout(() => {
        client.end();
@@ -1006,6 +1034,20 @@ class PollingManager {
    const statusOnly = options?.statusOnly ?? false;
    const viewerUserId = options?.viewerUserId;

+    const enabledCollectors: string[] = [];
+    if (statsConfig.statusCheckEnabled) enabledCollectors.push("status");
+    if (!statusOnly && statsConfig.metricsEnabled) {
+      enabledCollectors.push(
+        "cpu",
+        "memory",
+        "disk",
+        "network",
+        "uptime",
+        "processes",
+        "system",
+      );
+    }
+
    const existingConfig = this.pollingConfigs.get(host.id);

    if (existingConfig) {
@@ -1133,12 +1175,10 @@ class PollingManager {
      const latestConfig = this.pollingConfigs.get(refreshedHost.id);
      if (latestConfig && latestConfig.statsConfig.metricsEnabled) {
        const backoffInfo = pollingBackoff.getBackoffInfo(refreshedHost.id);
-        statsLogger.error("Failed to collect metrics for host", {
-          operation: "metrics_poll_failed",
+        statsLogger.error("Stats collector connection failed", error, {
+          operation: "stats_connect_failed",
          hostId: refreshedHost.id,
-          hostName: refreshedHost.name,
-          error: errorMessage,
-          backoff: backoffInfo,
+          retryInfo: backoffInfo,
        });
      }
    }
@@ -1155,6 +1195,7 @@ class PollingManager {
        clearInterval(config.metricsTimer);
        config.metricsTimer = undefined;
      }
+
      this.pollingConfigs.delete(hostId);
      if (clearData) {
        this.statusStore.delete(hostId);
@@ -1283,12 +1324,6 @@ class PollingManager {

    for (const [sessionId, viewer] of this.viewerDetails.entries()) {
      if (now - viewer.lastHeartbeat > maxInactivity) {
-        statsLogger.warn("Cleaning up inactive viewer", {
-          operation: "cleanup_inactive_viewer",
-          sessionId,
-          hostId: viewer.hostId,
-          inactiveFor: Math.floor((now - viewer.lastHeartbeat) / 1000),
-        });
        this.unregisterViewer(viewer.hostId, sessionId);
      }
    }
@@ -1322,12 +1357,7 @@ app.use(
    origin: (origin, callback) => {
      if (!origin) return callback(null, true);

-      const allowedOrigins = [
-        "http://localhost:5173",
-        "http://localhost:3000",
-        "http://127.0.0.1:5173",
-        "http://127.0.0.1:3000",
-      ];
+      const allowedOrigins = ["http://localhost:5173", "http://127.0.0.1:5173"];

      if (allowedOrigins.includes(origin)) {
        return callback(null, true);
@@ -1519,7 +1549,15 @@ async function resolveHostCredentials(
          if (credentials.length > 0) {
            const credential = credentials[0];
            baseHost.credentialId = credential.id;
-            baseHost.authType = credential.auth_type || credential.authType;
+            baseHost.authType =
+              credential.auth_type ||
+              credential.authType ||
+              (credential.password
+                ? "password"
+                : credential.key ||
+                    (credential as Record<string, unknown>).private_key
+                  ? "key"
+                  : "none");

            if (!host.overrideCredentialUsername) {
              baseHost.username = credential.username;
@@ -1540,6 +1578,13 @@ async function resolveHostCredentials(
            }
          } else {
            addLegacyCredentials(baseHost, host);
+            if (baseHost.authType === "credential") {
+              baseHost.authType = baseHost.password
+                ? "password"
+                : baseHost.key
+                  ? "key"
+                  : "none";
+            }
          }
        }
      } catch (error) {
@@ -1547,6 +1592,13 @@ async function resolveHostCredentials(
          `Failed to resolve credential ${host.credentialId} for host ${host.id}: ${error instanceof Error ? error.message : "Unknown error"}`,
        );
        addLegacyCredentials(baseHost, host);
+        if (baseHost.authType === "credential") {
+          baseHost.authType = baseHost.password
+            ? "password"
+            : baseHost.key
+              ? "key"
+              : "none";
+        }
      }
    } else {
      addLegacyCredentials(baseHost, host);
@@ -1571,7 +1623,9 @@ function addLegacyCredentials(
  baseHost.keyType = host.keyType;
 }

-function buildSshConfig(host: SSHHostWithCredentials): ConnectConfig {
+async function buildSshConfig(
+  host: SSHHostWithCredentials,
+): Promise<ConnectConfig> {
  const base: ConnectConfig = {
    host: host.ip,
    port: host.port,
@@ -1582,6 +1636,14 @@ function buildSshConfig(host: SSHHostWithCredentials): ConnectConfig {
    readyTimeout: 60000,
    tcpKeepAlive: true,
    tcpKeepAliveInitialDelay: 30000,
+    hostVerifier: await SSHHostKeyVerifier.createHostVerifier(
+      host.id,
+      host.ip,
+      host.port,
+      null,
+      host.userId || "",
+      false,
+    ),
    env: {
      TERM: "xterm-256color",
      LANG: "en_US.UTF-8",
@@ -1676,6 +1738,25 @@ function buildSshConfig(host: SSHHostWithCredentials): ConnectConfig {
      throw new Error(`Invalid SSH key format for host ${host.ip}`);
    }
  } else if (host.authType === "none") {
+  } else if (host.authType === "opkssh") {
+  } else if (host.authType === "credential") {
+    if (host.password) {
+      base.password = host.password;
+    } else if (host.key) {
+      const cleanKey = host.key
+        .trim()
+        .replace(/\r\n/g, "\n")
+        .replace(/\r/g, "\n");
+      (base as Record<string, unknown>).privateKey = Buffer.from(
+        cleanKey,
+        "utf8",
+      );
+      if (host.keyPassword) {
+        (base as Record<string, unknown>).passphrase = host.keyPassword;
+      }
+    } else {
+      throw new Error(`Credential for host ${host.ip} could not be resolved`);
+    }
  } else {
    throw new Error(
      `Unsupported authentication type '${host.authType}' for host ${host.ip}`,
@@ -1782,6 +1863,52 @@ async function collectMetrics(host: SSHHostWithCredentials): Promise<{
          login_stats = await collectLoginStats(client);
        } catch (e) {}

+        let ports: {
+          source: "ss" | "netstat" | "none";
+          ports: Array<{
+            protocol: "tcp" | "udp";
+            localAddress: string;
+            localPort: number;
+            state?: string;
+            pid?: number;
+            process?: string;
+          }>;
+        } = {
+          source: "none",
+          ports: [],
+        };
+        try {
+          ports = await collectPortsMetrics(client);
+        } catch (e) {}
+
+        let firewall: {
+          type: "iptables" | "nftables" | "none";
+          status: "active" | "inactive" | "unknown";
+          chains: Array<{
+            name: string;
+            policy: string;
+            rules: Array<{
+              chain: string;
+              target: string;
+              protocol: string;
+              source: string;
+              destination: string;
+              dport?: string;
+              sport?: string;
+              state?: string;
+              interface?: string;
+              extra?: string;
+            }>;
+          }>;
+        } = {
+          type: "none",
+          status: "unknown",
+          chains: [],
+        };
+        try {
+          firewall = await collectFirewallMetrics(client);
+        } catch (e) {}
+
        const result = {
          cpu,
          memory,
@@ -1791,6 +1918,8 @@ async function collectMetrics(host: SSHHostWithCredentials): Promise<{
          processes,
          system,
          login_stats,
+          ports,
+          firewall,
        };

        metricsCache.set(host.id, result);
@@ -1864,6 +1993,20 @@ function tcpPing(
  });
 }

+/**
+ * @openapi
+ * /status:
+ *   get:
+ *     summary: Get all host statuses
+ *     description: Retrieves the status of all hosts for the authenticated user.
+ *     tags:
+ *       - Server Stats
+ *     responses:
+ *       200:
+ *         description: A map of host IDs to their status entries.
+ *       401:
+ *         description: Session expired - please log in again.
+ */
 app.get("/status", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;

@@ -1886,6 +2029,28 @@ app.get("/status", async (req, res) => {
  res.json(result);
 });

+/**
+ * @openapi
+ * /status/{id}:
+ *   get:
+ *     summary: Get host status by ID
+ *     description: Retrieves the status of a specific host by its ID.
+ *     tags:
+ *       - Server Stats
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Host status entry.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Status not available.
+ */
 app.get("/status/:id", validateHostId, async (req, res) => {
  const id = Number(req.params.id);
  const userId = (req as AuthenticatedRequest).userId;
@@ -1910,6 +2075,20 @@ app.get("/status/:id", validateHostId, async (req, res) => {
  res.json(statusEntry);
 });

+/**
+ * @openapi
+ * /clear-connections:
+ *   post:
+ *     summary: Clear all SSH connections
+ *     description: Clears all SSH connections from the connection pool.
+ *     tags:
+ *       - Server Stats
+ *     responses:
+ *       200:
+ *         description: All SSH connections cleared.
+ *       401:
+ *         description: Session expired - please log in again.
+ */
 app.post("/clear-connections", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;

@@ -1924,6 +2103,20 @@ app.post("/clear-connections", async (req, res) => {
  res.json({ message: "All SSH connections cleared" });
 });

+/**
+ * @openapi
+ * /refresh:
+ *   post:
+ *     summary: Refresh polling
+ *     description: Clears all SSH connections and refreshes host polling.
+ *     tags:
+ *       - Server Stats
+ *     responses:
+ *       200:
+ *         description: Polling refreshed.
+ *       401:
+ *         description: Session expired - please log in again.
+ */
 app.post("/refresh", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;

@@ -1940,6 +2133,35 @@ app.post("/refresh", async (req, res) => {
  res.json({ message: "Polling refreshed" });
 });

+/**
+ * @openapi
+ * /host-updated:
+ *   post:
+ *     summary: Start polling for updated host
+ *     description: Starts polling for a specific host after it has been updated.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Host polling started.
+ *       400:
+ *         description: Invalid hostId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Host not found.
+ *       500:
+ *         description: Failed to start polling.
+ */
 app.post("/host-updated", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;
  const { hostId } = req.body;
@@ -1975,6 +2197,33 @@ app.post("/host-updated", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /host-deleted:
+ *   post:
+ *     summary: Stop polling for deleted host
+ *     description: Stops polling for a specific host after it has been deleted.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Host polling stopped.
+ *       400:
+ *         description: Invalid hostId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       500:
+ *         description: Failed to stop polling.
+ */
 app.post("/host-deleted", async (req, res) => {
  const userId = (req as AuthenticatedRequest).userId;
  const { hostId } = req.body;
@@ -2003,6 +2252,28 @@ app.post("/host-deleted", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/{id}:
+ *   get:
+ *     summary: Get host metrics
+ *     description: Retrieves current metrics for a specific host including CPU, memory, disk, network, processes, and system information.
+ *     tags:
+ *       - Server Stats
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Host metrics data.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Metrics not available.
+ */
 app.get("/metrics/:id", validateHostId, async (req, res) => {
  const id = Number(req.params.id);
  const userId = (req as AuthenticatedRequest).userId;
@@ -2040,31 +2311,105 @@ app.get("/metrics/:id", validateHostId, async (req, res) => {
  });
 });

+/**
+ * @openapi
+ * /metrics/start/{id}:
+ *   post:
+ *     summary: Start metrics collection
+ *     description: Establishes an SSH connection and starts collecting metrics for a specific host.
+ *     tags:
+ *       - Server Stats
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Metrics collection started successfully, or TOTP required.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Host not found.
+ *       500:
+ *         description: Failed to start metrics collection.
+ */
 app.post("/metrics/start/:id", validateHostId, async (req, res) => {
  const id = Number(req.params.id);
  const userId = (req as AuthenticatedRequest).userId;

+  const connectionLogs: Array<Omit<LogEntry, "id" | "timestamp">> = [];
+
  if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+    connectionLogs.push(
+      createConnectionLog("error", "stats_connecting", "Session expired"),
+    );
    return res.status(401).json({
      error: "Session expired - please log in again",
      code: "SESSION_EXPIRED",
+      connectionLogs,
    });
  }

  try {
    const host = await fetchHostById(id, userId);
    if (!host) {
-      return res.status(404).json({ error: "Host not found" });
+      connectionLogs.push(
+        createConnectionLog("error", "stats_connecting", "Host not found"),
+      );
+      return res.status(404).json({ error: "Host not found", connectionLogs });
+    }
+
+    connectionLogs.push(
+      createConnectionLog(
+        "info",
+        "stats_connecting",
+        "Starting metrics collection",
+      ),
+    );
+
+    connectionLogs.push(
+      createConnectionLog("info", "dns", `Resolving DNS for ${host.ip}`),
+    );
+
+    connectionLogs.push(
+      createConnectionLog(
+        "info",
+        "tcp",
+        `Connecting to ${host.ip}:${host.port}`,
+      ),
+    );
+
+    connectionLogs.push(
+      createConnectionLog("info", "handshake", "Initiating SSH handshake"),
+    );
+
+    if (host.authType === "password") {
+      connectionLogs.push(
+        createConnectionLog("info", "auth", "Authenticating with password"),
+      );
+    } else if (host.authType === "key") {
+      connectionLogs.push(
+        createConnectionLog("info", "auth", "Authenticating with SSH key"),
+      );
    }

    const sessionKey = getSessionKey(host.id, userId);

    const existingSession = metricsSessions[sessionKey];
    if (existingSession && existingSession.isConnected) {
-      return res.json({ success: true });
+      connectionLogs.push(
+        createConnectionLog(
+          "success",
+          "stats_polling",
+          "Using existing metrics session",
+        ),
+      );
+      return res.json({ success: true, connectionLogs });
    }

-    const config = buildSshConfig(host);
+    const config = await buildSshConfig(host);
    const client = new Client();

    const connectionPromise = new Promise<{
@@ -2113,6 +2458,14 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
              totpAttempts: 0,
            };

+            connectionLogs.push(
+              createConnectionLog(
+                "info",
+                "stats_totp",
+                "TOTP verification required",
+              ),
+            );
+
            clearTimeout(timeout);
            if (!isResolved) {
              isResolved = true;
@@ -2141,6 +2494,22 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
        if (!isResolved) {
          isResolved = true;

+          connectionLogs.push(
+            createConnectionLog(
+              "success",
+              "connected",
+              "SSH connection established successfully",
+            ),
+          );
+
+          connectionLogs.push(
+            createConnectionLog(
+              "success",
+              "stats_polling",
+              "Metrics session established",
+            ),
+          );
+
          metricsSessions[sessionKey] = {
            client,
            isConnected: true,
@@ -2162,10 +2531,82 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
        clearTimeout(timeout);
        if (!isResolved) {
          isResolved = true;
+
+          const errorMessage =
+            error instanceof Error ? error.message : String(error);
+          let errorStage: ConnectionStage = "error";
+
+          if (
+            errorMessage.includes("ENOTFOUND") ||
+            errorMessage.includes("getaddrinfo")
+          ) {
+            errorStage = "dns";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `DNS resolution failed: ${errorMessage}`,
+              ),
+            );
+          } else if (
+            errorMessage.includes("ECONNREFUSED") ||
+            errorMessage.includes("ETIMEDOUT")
+          ) {
+            errorStage = "tcp";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `TCP connection failed: ${errorMessage}`,
+              ),
+            );
+          } else if (
+            errorMessage.includes("handshake") ||
+            errorMessage.includes("key exchange")
+          ) {
+            errorStage = "handshake";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `SSH handshake failed: ${errorMessage}`,
+              ),
+            );
+          } else if (
+            errorMessage.includes("authentication") ||
+            errorMessage.includes("Authentication")
+          ) {
+            errorStage = "auth";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `Authentication failed: ${errorMessage}`,
+              ),
+            );
+          } else if (errorMessage.includes("verification failed")) {
+            errorStage = "handshake";
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                errorStage,
+                `SSH host key has changed. For security, please open a Terminal connection to this host first to verify and accept the new key fingerprint.`,
+              ),
+            );
+          } else {
+            connectionLogs.push(
+              createConnectionLog(
+                "error",
+                "error",
+                `SSH connection failed: ${errorMessage}`,
+              ),
+            );
+          }
+
          statsLogger.error("SSH connection error in metrics/start", {
            operation: "metrics_start_ssh_error",
            hostId: host.id,
-            error: error instanceof Error ? error.message : String(error),
+            error: errorMessage,
          });
          reject(error);
        }
@@ -2176,6 +2617,9 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
        (host.socks5Host ||
          (host.socks5ProxyChain && host.socks5ProxyChain.length > 0))
      ) {
+        connectionLogs.push(
+          createConnectionLog("info", "proxy", "Connecting via SOCKS5 proxy"),
+        );
        createSocks5Connection(host.ip, host.port, {
          useSocks5: host.useSocks5,
          socks5Host: host.socks5Host,
@@ -2194,6 +2638,13 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
            if (!isResolved) {
              isResolved = true;
              clearTimeout(timeout);
+              connectionLogs.push(
+                createConnectionLog(
+                  "error",
+                  "proxy",
+                  `SOCKS5 proxy connection failed: ${error instanceof Error ? error.message : "Unknown error"}`,
+                ),
+              );
              reject(error);
            }
          });
@@ -2203,22 +2654,61 @@ app.post("/metrics/start/:id", validateHostId, async (req, res) => {
    });

    const result = await connectionPromise;
-    res.json(result);
+    res.json({ ...result, connectionLogs });
  } catch (error) {
    statsLogger.error("Failed to start metrics collection", {
      operation: "metrics_start_error",
      hostId: id,
      error: error instanceof Error ? error.message : String(error),
    });
+    connectionLogs.push(
+      createConnectionLog(
+        "error",
+        "stats_connecting",
+        `Failed to start metrics: ${error instanceof Error ? error.message : "Unknown error"}`,
+      ),
+    );
    res.status(500).json({
      error:
        error instanceof Error
          ? error.message
          : "Failed to start metrics collection",
+      connectionLogs,
    });
  }
 });

+/**
+ * @openapi
+ * /metrics/stop/{id}:
+ *   post:
+ *     summary: Stop metrics collection
+ *     description: Stops metrics collection for a specific host and cleans up the SSH session.
+ *     tags:
+ *       - Server Stats
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: false
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               viewerSessionId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Metrics collection stopped successfully.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       500:
+ *         description: Failed to stop metrics collection.
+ */
 app.post("/metrics/stop/:id", validateHostId, async (req, res) => {
  const id = Number(req.params.id);
  const userId = (req as AuthenticatedRequest).userId;
@@ -2261,6 +2751,37 @@ app.post("/metrics/stop/:id", validateHostId, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/connect-totp:
+ *   post:
+ *     summary: Complete TOTP verification for metrics
+ *     description: Verifies the TOTP code and completes the metrics SSH connection.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               sessionId:
+ *                 type: string
+ *               totpCode:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: TOTP verified, metrics connection established.
+ *       400:
+ *         description: Missing sessionId or totpCode.
+ *       401:
+ *         description: Session expired or invalid TOTP code.
+ *       404:
+ *         description: TOTP session not found or expired.
+ *       500:
+ *         description: Failed to verify TOTP.
+ */
 app.post("/metrics/connect-totp", async (req, res) => {
  const { sessionId, totpCode } = req.body;
  const userId = (req as AuthenticatedRequest).userId;
@@ -2396,6 +2917,35 @@ app.post("/metrics/connect-totp", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/heartbeat:
+ *   post:
+ *     summary: Update viewer heartbeat
+ *     description: Updates the heartbeat timestamp for a metrics viewer session to keep it alive.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               viewerSessionId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Heartbeat updated successfully.
+ *       400:
+ *         description: Invalid viewerSessionId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       404:
+ *         description: Viewer session not found.
+ *       500:
+ *         description: Failed to update heartbeat.
+ */
 app.post("/metrics/heartbeat", async (req, res) => {
  const { viewerSessionId } = req.body;
  const userId = (req as AuthenticatedRequest).userId;
@@ -2428,6 +2978,33 @@ app.post("/metrics/heartbeat", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/register-viewer:
+ *   post:
+ *     summary: Register metrics viewer
+ *     description: Registers a new viewer session for a host to track who is viewing metrics.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Viewer registered successfully.
+ *       400:
+ *         description: Invalid hostId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       500:
+ *         description: Failed to register viewer.
+ */
 app.post("/metrics/register-viewer", async (req, res) => {
  const { hostId } = req.body;
  const userId = (req as AuthenticatedRequest).userId;
@@ -2458,6 +3035,35 @@ app.post("/metrics/register-viewer", async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /metrics/unregister-viewer:
+ *   post:
+ *     summary: Unregister metrics viewer
+ *     description: Unregisters a viewer session when they stop viewing metrics for a host.
+ *     tags:
+ *       - Server Stats
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               hostId:
+ *                 type: integer
+ *               viewerSessionId:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Viewer unregistered successfully.
+ *       400:
+ *         description: Invalid hostId or viewerSessionId.
+ *       401:
+ *         description: Session expired - please log in again.
+ *       500:
+ *         description: Failed to unregister viewer.
+ */
 app.post("/metrics/unregister-viewer", async (req, res) => {
  const { hostId, viewerSessionId } = req.body;
  const userId = (req as AuthenticatedRequest).userId;
@@ -30,12 +30,7 @@ app.use(
    origin: (origin, callback) => {
      if (!origin) return callback(null, true);

-      const allowedOrigins = [
-        "http://localhost:5173",
-        "http://localhost:3000",
-        "http://127.0.0.1:5173",
-        "http://127.0.0.1:3000",
-      ];
+      const allowedOrigins = ["http://localhost:5173", "http://127.0.0.1:5173"];

      if (allowedOrigins.includes(origin)) {
        return callback(null, true);
@@ -294,7 +289,12 @@ async function cleanupTunnelResources(
    if (verification?.timeout) clearTimeout(verification.timeout);
    try {
      verification?.conn.end();
-    } catch (error) {}
+    } catch (error) {
+      tunnelLogger.error("Error during tunnel cleanup", error, {
+        operation: "tunnel_cleanup_error",
+        tunnelName,
+      });
+    }
    tunnelVerifications.delete(tunnelName);
  }

@@ -359,7 +359,12 @@ async function handleDisconnect(
      const verification = tunnelVerifications.get(tunnelName);
      if (verification?.timeout) clearTimeout(verification.timeout);
      verification?.conn.end();
-    } catch (error) {}
+    } catch (error) {
+      tunnelLogger.error("Error during tunnel cleanup", error, {
+        operation: "tunnel_cleanup_error",
+        tunnelName,
+      });
+    }
    tunnelVerifications.delete(tunnelName);
  }

@@ -519,6 +524,16 @@ async function connectSSHTunnel(
 ): Promise<void> {
  const tunnelName = tunnelConfig.name;
  const tunnelMarker = getTunnelMarker(tunnelName);
+  tunnelLogger.info("Tunnel creation request received", {
+    operation: "tunnel_create_request",
+    userId: tunnelConfig.sourceUserId,
+    hostId: tunnelConfig.sourceHostId,
+    tunnelName,
+    tunnelType: tunnelConfig.tunnelType || "remote",
+    sourcePort: tunnelConfig.sourcePort,
+    endpointHost: tunnelConfig.endpointHost,
+    endpointPort: tunnelConfig.endpointPort,
+  });

  if (manualDisconnects.has(tunnelName)) {
    return;
@@ -548,9 +563,16 @@ async function connectSSHTunnel(
    !tunnelConfig.sourceUsername ||
    !tunnelConfig.sourceSSHPort
  ) {
-    tunnelLogger.error("Invalid tunnel connection details", {
-      operation: "tunnel_connect",
+    const missingFields = [];
+    if (!tunnelConfig) missingFields.push("tunnelConfig");
+    if (!tunnelConfig?.sourceIP) missingFields.push("sourceIP");
+    if (!tunnelConfig?.sourceUsername) missingFields.push("sourceUsername");
+    if (!tunnelConfig?.sourceSSHPort) missingFields.push("sourceSSHPort");
+
+    tunnelLogger.error("Invalid tunnel connection details", undefined, {
+      operation: "tunnel_connect_validation_failed",
      tunnelName,
+      missingFields: missingFields.join(", "),
      hasSourceIP: !!tunnelConfig?.sourceIP,
      hasSourceUsername: !!tunnelConfig?.sourceUsername,
      hasSourceSSHPort: !!tunnelConfig?.sourceSSHPort,
@@ -560,6 +582,7 @@ async function connectSSHTunnel(
      status: CONNECTION_STATES.FAILED,
      reason: "Missing required connection details",
    });
+    tunnelConnecting.delete(tunnelName);
    return;
  }

@@ -600,12 +623,19 @@ async function connectSSHTunnel(
            };
          } else {
            const errorMessage = `Cannot connect tunnel '${tunnelName}': shared credentials not available`;
-            tunnelLogger.error(errorMessage);
+            tunnelLogger.error(errorMessage, undefined, {
+              operation: "tunnel_shared_credentials_unavailable",
+              tunnelName,
+              requestingUserId: tunnelConfig.requestingUserId,
+              sourceUserId: tunnelConfig.sourceUserId,
+              sourceHostId: tunnelConfig.sourceHostId,
+            });
            broadcastTunnelStatus(tunnelName, {
              connected: false,
              status: CONNECTION_STATES.FAILED,
              reason: errorMessage,
            });
+            tunnelConnecting.delete(tunnelName);
            return;
          }
        }
@@ -662,12 +692,18 @@ async function connectSSHTunnel(
    !resolvedEndpointCredentials.password
  ) {
    const errorMessage = `Cannot connect tunnel '${tunnelName}': endpoint host requires password authentication but no plaintext password available. Enable autostart for endpoint host or configure credentials in tunnel connection.`;
-    tunnelLogger.error(errorMessage);
+    tunnelLogger.error(errorMessage, undefined, {
+      operation: "tunnel_endpoint_password_unavailable",
+      tunnelName,
+      endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+      endpointAuthMethod: resolvedEndpointCredentials.authMethod,
+    });
    broadcastTunnelStatus(tunnelName, {
      connected: false,
      status: CONNECTION_STATES.FAILED,
      reason: errorMessage,
    });
+    tunnelConnecting.delete(tunnelName);
    return;
  }

@@ -676,12 +712,18 @@ async function connectSSHTunnel(
    !resolvedEndpointCredentials.sshKey
  ) {
    const errorMessage = `Cannot connect tunnel '${tunnelName}': endpoint host requires key authentication but no plaintext key available. Enable autostart for endpoint host or configure credentials in tunnel connection.`;
-    tunnelLogger.error(errorMessage);
+    tunnelLogger.error(errorMessage, undefined, {
+      operation: "tunnel_endpoint_key_unavailable",
+      tunnelName,
+      endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+      endpointAuthMethod: resolvedEndpointCredentials.authMethod,
+    });
    broadcastTunnelStatus(tunnelName, {
      connected: false,
      status: CONNECTION_STATES.FAILED,
      reason: errorMessage,
    });
+    tunnelConnecting.delete(tunnelName);
    return;
  }

@@ -745,6 +787,19 @@ async function connectSSHTunnel(
        return;
      }

+      tunnelLogger.error(
+        `Tunnel connection timeout after 60 seconds for '${tunnelName}'`,
+        undefined,
+        {
+          operation: "tunnel_connection_timeout",
+          tunnelName,
+          sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+          endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+          retryAttempt,
+          usingSocks5: tunnelConfig.useSocks5 || false,
+        },
+      );
+
      try {
        conn.end();
      } catch (error) {}
@@ -763,7 +818,22 @@ async function connectSSHTunnel(

  conn.on("error", (err) => {
    clearTimeout(connectionTimeout);
-    tunnelLogger.error(`SSH error for '${tunnelName}': ${err.message}`);
+
+    const errorType = classifyError(err.message);
+
+    tunnelLogger.error(`Tunnel connection failed for '${tunnelName}'`, err, {
+      operation: "tunnel_connect_error",
+      tunnelName,
+      errorType,
+      errorMessage: err.message,
+      sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+      endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+      tunnelType: tunnelConfig.tunnelType || "remote",
+      sourcePort: tunnelConfig.sourcePort,
+      retryAttempt,
+      usingSocks5: tunnelConfig.useSocks5 || false,
+      authMethod: tunnelConfig.sourceAuthMethod,
+    });

    tunnelConnecting.delete(tunnelName);

@@ -771,8 +841,6 @@ async function connectSSHTunnel(
      return;
    }

-    const errorType = classifyError(err.message);
-
    if (!manualDisconnects.has(tunnelName)) {
      broadcastTunnelStatus(tunnelName, {
        connected: false,
@@ -822,34 +890,61 @@ async function connectSSHTunnel(

  conn.on("ready", () => {
    clearTimeout(connectionTimeout);
+    tunnelLogger.info("Creating new SSH connection for tunnel", {
+      operation: "tunnel_connection_create",
+      userId: tunnelConfig.sourceUserId,
+      hostId: tunnelConfig.sourceHostId,
+      tunnelName,
+    });

    const isAlreadyVerifying = tunnelVerifications.has(tunnelName);
    if (isAlreadyVerifying) {
      return;
    }

+    const tunnelType = tunnelConfig.tunnelType || "remote";
+    const tunnelFlag = tunnelType === "local" ? "-L" : "-R";
+    const portMapping =
+      tunnelType === "local"
+        ? `${tunnelConfig.sourcePort}:${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`
+        : `${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort}`;
+
    let tunnelCmd: string;
    if (
      resolvedEndpointCredentials.authMethod === "key" &&
      resolvedEndpointCredentials.sshKey
    ) {
      const keyFilePath = `/tmp/tunnel_key_${tunnelName.replace(/[^a-zA-Z0-9]/g, "_")}`;
-      tunnelCmd = `echo '${resolvedEndpointCredentials.sshKey}' > ${keyFilePath} && chmod 600 ${keyFilePath} && exec -a "${tunnelMarker}" ssh -i ${keyFilePath} -N -o StrictHostKeyChecking=no -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes -R ${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort} ${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP} && rm -f ${keyFilePath}`;
+      tunnelCmd = `echo '${resolvedEndpointCredentials.sshKey}' > ${keyFilePath} && chmod 600 ${keyFilePath} && exec -a "${tunnelMarker}" ssh -i ${keyFilePath} -N -o StrictHostKeyChecking=no -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes ${tunnelFlag} ${portMapping} ${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP} && rm -f ${keyFilePath}`;
    } else {
-      tunnelCmd = `exec -a "${tunnelMarker}" sshpass -p '${resolvedEndpointCredentials.password || ""}' ssh -N -o StrictHostKeyChecking=no -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes -R ${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort} ${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}`;
+      tunnelCmd = `exec -a "${tunnelMarker}" sshpass -p '${resolvedEndpointCredentials.password || ""}' ssh -N -o StrictHostKeyChecking=no -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes ${tunnelFlag} ${portMapping} ${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}`;
    }

    conn.exec(tunnelCmd, (err, stream) => {
      if (err) {
+        const errorType = classifyError(err.message);
+
        tunnelLogger.error(
-          `Connection error for '${tunnelName}': ${err.message}`,
+          `Failed to execute tunnel command for '${tunnelName}'`,
+          err,
+          {
+            operation: "tunnel_exec_error",
+            tunnelName,
+            errorType,
+            errorMessage: err.message,
+            sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+            endpointHost: `${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}:${tunnelConfig.endpointPort}`,
+            tunnelType: tunnelConfig.tunnelType || "remote",
+            sourcePort: tunnelConfig.sourcePort,
+            endpointPort: tunnelConfig.endpointPort,
+            retryAttempt,
+          },
        );

        conn.end();

        activeTunnels.delete(tunnelName);

-        const errorType = classifyError(err.message);
        const shouldNotRetry =
          errorType === "AUTHENTICATION_FAILED" ||
          errorType === "CONNECTION_FAILED";
@@ -859,6 +954,14 @@ async function connectSSHTunnel(
      }

      activeTunnels.set(tunnelName, conn);
+      tunnelLogger.success("Tunnel port binding successful", {
+        operation: "tunnel_port_bound",
+        userId: tunnelConfig.sourceUserId,
+        hostId: tunnelConfig.sourceHostId,
+        tunnelName,
+        sourcePort: tunnelConfig.sourcePort,
+        endpointPort: tunnelConfig.endpointPort,
+      });

      setTimeout(() => {
        if (
@@ -866,6 +969,12 @@ async function connectSSHTunnel(
          activeTunnels.has(tunnelName)
        ) {
          tunnelConnecting.delete(tunnelName);
+          tunnelLogger.success("Tunnel creation complete", {
+            operation: "tunnel_create_complete",
+            userId: tunnelConfig.sourceUserId,
+            hostId: tunnelConfig.sourceHostId,
+            tunnelName,
+          });

          broadcastTunnelStatus(tunnelName, {
            connected: true,
@@ -1079,12 +1188,23 @@ async function connectSSHTunnel(
    ) {
      tunnelLogger.error(
        `Invalid SSH key format for tunnel '${tunnelName}'. Key should contain both BEGIN and END markers`,
+        undefined,
+        {
+          operation: "tunnel_invalid_ssh_key_format",
+          tunnelName,
+          sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+          keyType: resolvedSourceCredentials.keyType,
+          hasBeginMarker:
+            resolvedSourceCredentials.sshKey.includes("-----BEGIN"),
+          hasEndMarker: resolvedSourceCredentials.sshKey.includes("-----END"),
+        },
      );
      broadcastTunnelStatus(tunnelName, {
        connected: false,
        status: CONNECTION_STATES.FAILED,
        reason: "Invalid SSH key format",
      });
+      tunnelConnecting.delete(tunnelName);
      return;
    }

@@ -1105,12 +1225,20 @@ async function connectSSHTunnel(
  } else if (resolvedSourceCredentials.authMethod === "key") {
    tunnelLogger.error(
      `SSH key authentication requested but no key provided for tunnel '${tunnelName}'`,
+      undefined,
+      {
+        operation: "tunnel_ssh_key_missing",
+        tunnelName,
+        sourceHost: `${tunnelConfig.sourceUsername}@${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
+        authMethod: resolvedSourceCredentials.authMethod,
+      },
    );
    broadcastTunnelStatus(tunnelName, {
      connected: false,
      status: CONNECTION_STATES.FAILED,
      reason: "SSH key authentication requested but no key provided",
    });
+    tunnelConnecting.delete(tunnelName);
    return;
  } else {
    connOptions.password = resolvedSourceCredentials.password;
@@ -1152,10 +1280,16 @@ async function connectSSHTunnel(
      }
    } catch (socks5Error) {
      tunnelLogger.error("SOCKS5 connection failed for tunnel", socks5Error, {
-        operation: "socks5_connect",
+        operation: "tunnel_socks5_connection_failed",
        tunnelName,
+        sourceHost: `${tunnelConfig.sourceIP}:${tunnelConfig.sourceSSHPort}`,
        proxyHost: tunnelConfig.socks5Host,
        proxyPort: tunnelConfig.socks5Port || 1080,
+        hasProxyAuth: !!(
+          tunnelConfig.socks5Username && tunnelConfig.socks5Password
+        ),
+        errorMessage:
+          socks5Error instanceof Error ? socks5Error.message : "Unknown error",
      });
      broadcastTunnelStatus(tunnelName, {
        connected: false,
@@ -1166,6 +1300,7 @@ async function connectSSHTunnel(
            ? socks5Error.message
            : "Unknown error"),
      });
+      tunnelConnecting.delete(tunnelName);
      return;
    }
  }
@@ -1179,6 +1314,13 @@ async function killRemoteTunnelByMarker(
  callback: (err?: Error) => void,
 ) {
  const tunnelMarker = getTunnelMarker(tunnelName);
+  tunnelLogger.info("Killing remote tunnel process", {
+    operation: "tunnel_remote_kill",
+    userId: tunnelConfig.sourceUserId,
+    hostId: tunnelConfig.sourceHostId,
+    tunnelName,
+    marker: tunnelMarker,
+  });

  let resolvedSourceCredentials = {
    password: tunnelConfig.sourcePassword,
@@ -1302,7 +1444,9 @@ async function killRemoteTunnelByMarker(
  }

  conn.on("ready", () => {
-    const checkCmd = `ps aux | grep -E '(${tunnelMarker}|ssh.*-R.*${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort}.*${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}|sshpass.*ssh.*-R.*${tunnelConfig.endpointPort})' | grep -v grep`;
+    const tunnelType = tunnelConfig.tunnelType || "remote";
+    const tunnelFlag = tunnelType === "local" ? "-L" : "-R";
+    const checkCmd = `ps aux | grep -E '(${tunnelMarker}|ssh.*${tunnelFlag}.*${tunnelConfig.endpointPort}:.*:${tunnelConfig.sourcePort}.*${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}|sshpass.*ssh.*${tunnelFlag})' | grep -v grep`;

    conn.exec(checkCmd, (_err, stream) => {
      let foundProcesses = false;
@@ -1316,15 +1460,29 @@ async function killRemoteTunnelByMarker(

      stream.on("close", () => {
        if (!foundProcesses) {
+          tunnelLogger.warn("Remote tunnel process not found", {
+            operation: "tunnel_remote_not_found",
+            userId: tunnelConfig.sourceUserId,
+            hostId: tunnelConfig.sourceHostId,
+            tunnelName,
+            marker: tunnelMarker,
+          });
          conn.end();
          callback();
          return;
        }
+        tunnelLogger.info("Remote tunnel process found, proceeding to kill", {
+          operation: "tunnel_remote_found",
+          userId: tunnelConfig.sourceUserId,
+          hostId: tunnelConfig.sourceHostId,
+          tunnelName,
+          marker: tunnelMarker,
+        });

        const killCmds = [
          `pkill -TERM -f '${tunnelMarker}'`,
-          `sleep 1 && pkill -f 'ssh.*-R.*${tunnelConfig.endpointPort}:localhost:${tunnelConfig.sourcePort}.*${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}'`,
-          `sleep 1 && pkill -f 'sshpass.*ssh.*-R.*${tunnelConfig.endpointPort}'`,
+          `sleep 1 && pkill -f 'ssh.*${tunnelFlag}.*${tunnelConfig.endpointPort}:.*:${tunnelConfig.sourcePort}.*${tunnelConfig.endpointUsername}@${tunnelConfig.endpointIP}'`,
+          `sleep 1 && pkill -f 'sshpass.*ssh.*${tunnelFlag}.*${tunnelConfig.endpointPort}'`,
          `sleep 2 && pkill -9 -f '${tunnelMarker}'`,
        ];

@@ -1350,6 +1508,13 @@ async function killRemoteTunnelByMarker(
                  tunnelLogger.warn(
                    `Some tunnel processes may still be running for '${tunnelName}'`,
                  );
+                } else {
+                  tunnelLogger.success("Remote tunnel process killed", {
+                    operation: "tunnel_remote_killed",
+                    userId: tunnelConfig.sourceUserId,
+                    hostId: tunnelConfig.sourceHostId,
+                    tunnelName,
+                  });
                }
                conn.end();
                callback();
@@ -1450,10 +1615,42 @@ async function killRemoteTunnelByMarker(
  }
 }

+/**
+ * @openapi
+ * /ssh/tunnel/status:
+ *   get:
+ *     summary: Get all tunnel statuses
+ *     description: Retrieves the status of all SSH tunnels.
+ *     tags:
+ *       - SSH Tunnels
+ *     responses:
+ *       200:
+ *         description: A list of all tunnel statuses.
+ */
 app.get("/ssh/tunnel/status", (req, res) => {
  res.json(getAllTunnelStatus());
 });

+/**
+ * @openapi
+ * /ssh/tunnel/status/{tunnelName}:
+ *   get:
+ *     summary: Get tunnel status by name
+ *     description: Retrieves the status of a specific SSH tunnel by its name.
+ *     tags:
+ *       - SSH Tunnels
+ *     parameters:
+ *       - in: path
+ *         name: tunnelName
+ *         required: true
+ *         schema:
+ *           type: string
+ *     responses:
+ *       200:
+ *         description: Tunnel status.
+ *       404:
+ *         description: Tunnel not found.
+ */
 app.get("/ssh/tunnel/status/:tunnelName", (req, res) => {
  const { tunnelName } = req.params;
  const status = connectionStatus.get(tunnelName);
@@ -1465,6 +1662,39 @@ app.get("/ssh/tunnel/status/:tunnelName", (req, res) => {
  res.json({ name: tunnelName, status });
 });

+/**
+ * @openapi
+ * /ssh/tunnel/connect:
+ *   post:
+ *     summary: Connect SSH tunnel
+ *     description: Establishes an SSH tunnel connection with the specified configuration.
+ *     tags:
+ *       - SSH Tunnels
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               name:
+ *                 type: string
+ *               sourceHostId:
+ *                 type: integer
+ *               tunnelIndex:
+ *                 type: integer
+ *     responses:
+ *       200:
+ *         description: Connection request received.
+ *       400:
+ *         description: Invalid tunnel configuration.
+ *       401:
+ *         description: Authentication required.
+ *       403:
+ *         description: Access denied to this host.
+ *       500:
+ *         description: Failed to connect tunnel.
+ */
 app.post(
  "/ssh/tunnel/connect",
  authenticateJWT,
@@ -1619,6 +1849,35 @@ app.post(
  },
 );

+/**
+ * @openapi
+ * /ssh/tunnel/disconnect:
+ *   post:
+ *     summary: Disconnect SSH tunnel
+ *     description: Disconnects an active SSH tunnel.
+ *     tags:
+ *       - SSH Tunnels
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               tunnelName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Disconnect request received.
+ *       400:
+ *         description: Tunnel name required.
+ *       401:
+ *         description: Authentication required.
+ *       403:
+ *         description: Access denied.
+ *       500:
+ *         description: Failed to disconnect tunnel.
+ */
 app.post(
  "/ssh/tunnel/disconnect",
  authenticateJWT,
@@ -1647,6 +1906,12 @@ app.post(
        }
      }

+      tunnelLogger.info("Tunnel stop request received", {
+        operation: "tunnel_stop_request",
+        userId,
+        hostId: config?.sourceHostId,
+        tunnelName,
+      });
      manualDisconnects.add(tunnelName);
      retryCounters.delete(tunnelName);
      retryExhaustedTunnels.delete(tunnelName);
@@ -1657,6 +1922,12 @@ app.post(
      }

      await cleanupTunnelResources(tunnelName, true);
+      tunnelLogger.info("Tunnel cleanup completed", {
+        operation: "tunnel_cleanup_complete",
+        userId,
+        hostId: config?.sourceHostId,
+        tunnelName,
+      });

      broadcastTunnelStatus(tunnelName, {
        connected: false,
@@ -1683,6 +1954,35 @@ app.post(
  },
 );

+/**
+ * @openapi
+ * /ssh/tunnel/cancel:
+ *   post:
+ *     summary: Cancel tunnel retry
+ *     description: Cancels the retry mechanism for a failed SSH tunnel connection.
+ *     tags:
+ *       - SSH Tunnels
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               tunnelName:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Cancel request received.
+ *       400:
+ *         description: Tunnel name required.
+ *       401:
+ *         description: Authentication required.
+ *       403:
+ *         description: Access denied.
+ *       500:
+ *         description: Failed to cancel tunnel retry.
+ */
 app.post(
  "/ssh/tunnel/cancel",
  authenticateJWT,
@@ -1806,6 +2106,7 @@ async function initializeAutoStartTunnels(): Promise<void> {
                  tunnelConnection.endpointHost,
                  tunnelConnection.endpointPort,
                ),
+                tunnelType: tunnelConnection.tunnelType || "remote",
                sourceHostId: host.id,
                tunnelIndex: tunnelIndex,
                hostName: host.name || `${host.username}@${host.ip}`,
@@ -0,0 +1,254 @@
+import type { Client } from "ssh2";
+import { execCommand } from "./common-utils.js";
+import type {
+  FirewallMetrics,
+  FirewallChain,
+  FirewallRule,
+} from "../../../types/stats-widgets.js";
+
+function parseIptablesRule(line: string): FirewallRule | null {
+  if (!line.startsWith("-A ")) return null;
+
+  const rule: FirewallRule = {
+    chain: "",
+    target: "",
+    protocol: "all",
+    source: "0.0.0.0/0",
+    destination: "0.0.0.0/0",
+  };
+
+  const chainMatch = line.match(/^-A\s+(\S+)/);
+  if (chainMatch) {
+    rule.chain = chainMatch[1];
+  }
+
+  const targetMatch = line.match(/-j\s+(\S+)/);
+  if (targetMatch) {
+    rule.target = targetMatch[1];
+  }
+
+  const protocolMatch = line.match(/-p\s+(\S+)/);
+  if (protocolMatch) {
+    rule.protocol = protocolMatch[1];
+  }
+
+  const sourceMatch = line.match(/-s\s+(\S+)/);
+  if (sourceMatch) {
+    rule.source = sourceMatch[1];
+  }
+
+  const destMatch = line.match(/-d\s+(\S+)/);
+  if (destMatch) {
+    rule.destination = destMatch[1];
+  }
+
+  const dportMatch = line.match(/--dport\s+(\S+)/);
+  if (dportMatch) {
+    rule.dport = dportMatch[1];
+  }
+
+  const sportMatch = line.match(/--sport\s+(\S+)/);
+  if (sportMatch) {
+    rule.sport = sportMatch[1];
+  }
+
+  const stateMatch = line.match(/--state\s+(\S+)/);
+  if (stateMatch) {
+    rule.state = stateMatch[1];
+  }
+
+  const interfaceMatch = line.match(/-i\s+(\S+)/);
+  if (interfaceMatch) {
+    rule.interface = interfaceMatch[1];
+  }
+
+  return rule;
+}
+
+function parseIptablesOutput(output: string): FirewallChain[] {
+  const chains: Map<string, FirewallChain> = new Map();
+  const lines = output.split("\n");
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+
+    const policyMatch = trimmed.match(/^:(\S+)\s+(\S+)/);
+    if (policyMatch) {
+      const [, chainName, policy] = policyMatch;
+      chains.set(chainName, {
+        name: chainName,
+        policy: policy,
+        rules: [],
+      });
+      continue;
+    }
+
+    const rule = parseIptablesRule(trimmed);
+    if (rule) {
+      let chain = chains.get(rule.chain);
+      if (!chain) {
+        chain = {
+          name: rule.chain,
+          policy: "ACCEPT",
+          rules: [],
+        };
+        chains.set(rule.chain, chain);
+      }
+      chain.rules.push(rule);
+    }
+  }
+
+  return Array.from(chains.values());
+}
+
+function parseNftablesOutput(output: string): FirewallChain[] {
+  const chains: FirewallChain[] = [];
+  let currentChain: FirewallChain | null = null;
+
+  const lines = output.split("\n");
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+
+    const chainMatch = trimmed.match(
+      /chain\s+(\S+)\s*\{?\s*(?:type\s+\S+\s+hook\s+(\S+))?/,
+    );
+    if (chainMatch) {
+      if (currentChain) {
+        chains.push(currentChain);
+      }
+      currentChain = {
+        name: chainMatch[1].toUpperCase(),
+        policy: "ACCEPT",
+        rules: [],
+      };
+      continue;
+    }
+
+    if (currentChain && trimmed.startsWith("policy ")) {
+      const policyMatch = trimmed.match(/policy\s+(\S+)/);
+      if (policyMatch) {
+        currentChain.policy = policyMatch[1].toUpperCase();
+      }
+      continue;
+    }
+
+    if (currentChain && trimmed && !trimmed.startsWith("}")) {
+      const rule: FirewallRule = {
+        chain: currentChain.name,
+        target: "",
+        protocol: "all",
+        source: "0.0.0.0/0",
+        destination: "0.0.0.0/0",
+      };
+
+      if (trimmed.includes("accept")) rule.target = "ACCEPT";
+      else if (trimmed.includes("drop")) rule.target = "DROP";
+      else if (trimmed.includes("reject")) rule.target = "REJECT";
+
+      const tcpMatch = trimmed.match(/tcp\s+dport\s+(\S+)/);
+      if (tcpMatch) {
+        rule.protocol = "tcp";
+        rule.dport = tcpMatch[1];
+      }
+
+      const udpMatch = trimmed.match(/udp\s+dport\s+(\S+)/);
+      if (udpMatch) {
+        rule.protocol = "udp";
+        rule.dport = udpMatch[1];
+      }
+
+      const saddrMatch = trimmed.match(/saddr\s+(\S+)/);
+      if (saddrMatch) {
+        rule.source = saddrMatch[1];
+      }
+
+      const daddrMatch = trimmed.match(/daddr\s+(\S+)/);
+      if (daddrMatch) {
+        rule.destination = daddrMatch[1];
+      }
+
+      const iifMatch = trimmed.match(/iif\s+"?(\S+)"?/);
+      if (iifMatch) {
+        rule.interface = iifMatch[1].replace(/"/g, "");
+      }
+
+      const ctStateMatch = trimmed.match(/ct\s+state\s+(\S+)/);
+      if (ctStateMatch) {
+        rule.state = ctStateMatch[1].toUpperCase();
+      }
+
+      if (rule.target) {
+        currentChain.rules.push(rule);
+      }
+    }
+
+    if (trimmed === "}") {
+      if (currentChain) {
+        chains.push(currentChain);
+        currentChain = null;
+      }
+    }
+  }
+
+  if (currentChain) {
+    chains.push(currentChain);
+  }
+
+  return chains;
+}
+
+export async function collectFirewallMetrics(
+  client: Client,
+): Promise<FirewallMetrics> {
+  try {
+    const iptablesResult = await execCommand(
+      client,
+      "iptables-save 2>/dev/null",
+      15000,
+    );
+
+    if (iptablesResult.stdout && iptablesResult.stdout.includes("*filter")) {
+      const chains = parseIptablesOutput(iptablesResult.stdout);
+      const hasRules = chains.some((c) => c.rules.length > 0);
+
+      return {
+        type: "iptables",
+        status: hasRules ? "active" : "inactive",
+        chains: chains.filter(
+          (c) =>
+            c.name === "INPUT" || c.name === "OUTPUT" || c.name === "FORWARD",
+        ),
+      };
+    }
+
+    const nftResult = await execCommand(
+      client,
+      "nft list ruleset 2>/dev/null",
+      15000,
+    );
+
+    if (nftResult.stdout && nftResult.stdout.trim()) {
+      const chains = parseNftablesOutput(nftResult.stdout);
+      const hasRules = chains.some((c) => c.rules.length > 0);
+
+      return {
+        type: "nftables",
+        status: hasRules ? "active" : "inactive",
+        chains,
+      };
+    }
+
+    return {
+      type: "none",
+      status: "unknown",
+      chains: [],
+    };
+  } catch {
+    return {
+      type: "none",
+      status: "unknown",
+      chains: [],
+    };
+  }
+}
@@ -0,0 +1,154 @@
+import type { Client } from "ssh2";
+import { execCommand } from "./common-utils.js";
+import type {
+  PortsMetrics,
+  ListeningPort,
+} from "../../../types/stats-widgets.js";
+
+function parseSsOutput(output: string): ListeningPort[] {
+  const ports: ListeningPort[] = [];
+  const lines = output.split("\n").slice(1);
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+
+    const parts = trimmed.split(/\s+/);
+    if (parts.length < 5) continue;
+
+    const protocol = parts[0]?.toLowerCase();
+    if (protocol !== "tcp" && protocol !== "udp") continue;
+
+    const state = parts[1];
+    const localAddr = parts[4];
+
+    if (!localAddr) continue;
+
+    const lastColon = localAddr.lastIndexOf(":");
+    if (lastColon === -1) continue;
+
+    const address = localAddr.substring(0, lastColon);
+    const portStr = localAddr.substring(lastColon + 1);
+    const port = parseInt(portStr, 10);
+
+    if (isNaN(port)) continue;
+
+    const portEntry: ListeningPort = {
+      protocol: protocol as "tcp" | "udp",
+      localAddress: address.replace(/^\[|\]$/g, ""),
+      localPort: port,
+      state: protocol === "tcp" ? state : undefined,
+    };
+
+    const processInfo = parts[6];
+    if (processInfo && processInfo.startsWith("users:")) {
+      const pidMatch = processInfo.match(/pid=(\d+)/);
+      const nameMatch = processInfo.match(/\("([^"]+)"/);
+      if (pidMatch) portEntry.pid = parseInt(pidMatch[1], 10);
+      if (nameMatch) portEntry.process = nameMatch[1];
+    }
+
+    ports.push(portEntry);
+  }
+
+  return ports;
+}
+
+function parseNetstatOutput(output: string): ListeningPort[] {
+  const ports: ListeningPort[] = [];
+  const lines = output.split("\n");
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+
+    const parts = trimmed.split(/\s+/);
+    if (parts.length < 4) continue;
+
+    const proto = parts[0]?.toLowerCase();
+    if (!proto) continue;
+
+    let protocol: "tcp" | "udp";
+    if (proto.startsWith("tcp")) {
+      protocol = "tcp";
+    } else if (proto.startsWith("udp")) {
+      protocol = "udp";
+    } else {
+      continue;
+    }
+
+    const localAddr = parts[3];
+    if (!localAddr) continue;
+
+    const lastColon = localAddr.lastIndexOf(":");
+    if (lastColon === -1) continue;
+
+    const address = localAddr.substring(0, lastColon);
+    const portStr = localAddr.substring(lastColon + 1);
+    const port = parseInt(portStr, 10);
+
+    if (isNaN(port)) continue;
+
+    const portEntry: ListeningPort = {
+      protocol,
+      localAddress: address,
+      localPort: port,
+    };
+
+    if (protocol === "tcp" && parts.length >= 6) {
+      portEntry.state = parts[5];
+    }
+
+    const pidProgram = parts[parts.length - 1];
+    if (pidProgram && pidProgram.includes("/")) {
+      const [pidStr, process] = pidProgram.split("/");
+      const pid = parseInt(pidStr, 10);
+      if (!isNaN(pid)) portEntry.pid = pid;
+      if (process) portEntry.process = process;
+    }
+
+    ports.push(portEntry);
+  }
+
+  return ports;
+}
+
+export async function collectPortsMetrics(
+  client: Client,
+): Promise<PortsMetrics> {
+  try {
+    const ssResult = await execCommand(client, "ss -tulnp 2>/dev/null", 15000);
+
+    if (ssResult.stdout && ssResult.stdout.includes("Local")) {
+      const ports = parseSsOutput(ssResult.stdout);
+      return {
+        source: "ss",
+        ports: ports.sort((a, b) => a.localPort - b.localPort),
+      };
+    }
+
+    const netstatResult = await execCommand(
+      client,
+      "netstat -tulnp 2>/dev/null",
+      15000,
+    );
+
+    if (netstatResult.stdout && netstatResult.stdout.includes("Local")) {
+      const ports = parseNetstatOutput(netstatResult.stdout);
+      return {
+        source: "netstat",
+        ports: ports.sort((a, b) => a.localPort - b.localPort),
+      };
+    }
+
+    return {
+      source: "none",
+      ports: [],
+    };
+  } catch {
+    return {
+      source: "none",
+      ports: [],
+    };
+  }
+}
@@ -10,6 +10,7 @@ import { SystemCrypto } from "./utils/system-crypto.js";
 import { systemLogger, versionLogger } from "./utils/logger.js";

 (async () => {
+  const initStartTime = Date.now();
  try {
    dotenv.config({ quiet: true });

@@ -23,6 +24,12 @@ import { systemLogger, versionLogger } from "./utils/logger.js";
      }
    } catch (error) {}

+    systemLogger.info("Termix backend initialization started", {
+      operation: "backend_init_start",
+      nodeEnv: process.env.NODE_ENV || "production",
+      port: process.env.PORT || 4090,
+    });
+
    let version = "unknown";

    const versionSources = [
@@ -88,14 +95,41 @@ import { systemLogger, versionLogger } from "./utils/logger.js";
    await systemCrypto.initializeInternalAuthToken();

    await AutoSSLSetup.initialize();
+    systemLogger.success("SSL setup completed", {
+      operation: "backend_init_ssl",
+      sslEnabled: process.env.SSL_ENABLED === "true",
+    });

    const dbModule = await import("./database/db/index.js");
    await dbModule.initializeDatabase();
+    systemLogger.success("Database initialized", {
+      operation: "backend_init_db",
+    });

    const authManager = AuthManager.getInstance();
    await authManager.initialize();
    DataCrypto.initialize();

+    const { OPKSSHBinaryManager } =
+      await import("./utils/opkssh-binary-manager.js");
+    try {
+      await OPKSSHBinaryManager.ensureBinary();
+    } catch (error) {
+      const dataDir =
+        process.env.DATA_DIR || path.join(process.cwd(), "db", "data");
+      systemLogger.warn(
+        "Failed to initialize OPKSSH binary - OPKSSH authentication will not be available",
+        {
+          operation: "opkssh_binary_init_failed",
+          error: error instanceof Error ? error.message : "Unknown error",
+          stack: error instanceof Error ? error.stack : undefined,
+          platform: process.platform,
+          arch: process.arch,
+          dataDir,
+        },
+      );
+    }
+
    await import("./database/database.js");

    await import("./ssh/terminal.js");
@@ -106,6 +140,13 @@ import { systemLogger, versionLogger } from "./utils/logger.js";
    await import("./ssh/docker-console.js");
    await import("./dashboard.js");

+    systemLogger.success("Termix backend started successfully", {
+      operation: "backend_init_complete",
+      port: process.env.PORT || 4090,
+      ssl: process.env.SSL_ENABLED === "true",
+      duration: Date.now() - initStartTime,
+    });
+
    process.on("SIGINT", () => {
      systemLogger.info(
        "Received SIGINT signal, initiating graceful shutdown...",
@@ -0,0 +1,156 @@
+import swaggerJSDoc from "swagger-jsdoc";
+import path from "path";
+import { fileURLToPath } from "url";
+import { promises as fs } from "fs";
+import { systemLogger } from "./utils/logger.js";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const projectRoot = path.join(__dirname, "..", "..", "..");
+
+const swaggerOptions: swaggerJSDoc.Options = {
+  definition: {
+    openapi: "3.0.3",
+    info: {
+      title: "Termix API",
+      version: "0.0.0",
+      description: "Termix Backend API Reference",
+    },
+    servers: [
+      {
+        url: "http://localhost:30001",
+        description: "Main database and authentication server",
+      },
+      {
+        url: "http://localhost:30003",
+        description: "SSH tunnel management server",
+      },
+      {
+        url: "http://localhost:30004",
+        description: "SSH file manager server",
+      },
+      {
+        url: "http://localhost:30005",
+        description: "Server statistics and monitoring server",
+      },
+      {
+        url: "http://localhost:30006",
+        description: "Dashboard server",
+      },
+      {
+        url: "http://localhost:30007",
+        description: "Docker management server",
+      },
+    ],
+    components: {
+      securitySchemes: {
+        bearerAuth: {
+          type: "http",
+          scheme: "bearer",
+          bearerFormat: "JWT",
+        },
+      },
+      schemas: {
+        Error: {
+          type: "object",
+          properties: {
+            error: { type: "string" },
+            details: { type: "string" },
+          },
+        },
+      },
+    },
+    security: [
+      {
+        bearerAuth: [],
+      },
+    ],
+    tags: [
+      {
+        name: "Alerts",
+        description: "System alerts and notifications management",
+      },
+      {
+        name: "Credentials",
+        description: "SSH credential management",
+      },
+      {
+        name: "Network Topology",
+        description: "Network topology visualization and management",
+      },
+      {
+        name: "RBAC",
+        description: "Role-based access control for host sharing",
+      },
+      {
+        name: "Snippets",
+        description: "Command snippet management",
+      },
+      {
+        name: "Terminal",
+        description: "Terminal command history",
+      },
+      {
+        name: "Users",
+        description: "User management and authentication",
+      },
+      {
+        name: "Dashboard",
+        description: "Dashboard statistics and activity",
+      },
+      {
+        name: "Docker",
+        description: "Docker container management",
+      },
+      {
+        name: "SSH Tunnels",
+        description: "SSH tunnel connection management",
+      },
+      {
+        name: "Server Stats",
+        description: "Server status monitoring and metrics collection",
+      },
+      {
+        name: "File Manager",
+        description: "SSH file management operations",
+      },
+    ],
+  },
+  apis: [
+    path.join(projectRoot, "src", "backend", "database", "routes", "*.ts"),
+    path.join(projectRoot, "src", "backend", "dashboard.ts"),
+    path.join(projectRoot, "src", "backend", "ssh", "*.ts"),
+  ],
+};
+
+async function generateOpenAPISpec() {
+  try {
+    systemLogger.info("Generating OpenAPI specification", {
+      operation: "openapi_generate_start",
+    });
+
+    const swaggerSpec = swaggerJSDoc(swaggerOptions);
+
+    const outputPath = path.join(projectRoot, "openapi.json");
+
+    await fs.writeFile(
+      outputPath,
+      JSON.stringify(swaggerSpec, null, 2),
+      "utf-8",
+    );
+
+    systemLogger.success("OpenAPI specification generated", {
+      operation: "openapi_generate_success",
+    });
+  } catch (error) {
+    systemLogger.error("Failed to generate OpenAPI specification", error, {
+      operation: "openapi_generation",
+    });
+    process.exit(1);
+  }
+}
+
+generateOpenAPISpec();
+
+export { swaggerOptions, generateOpenAPISpec };
@@ -2,7 +2,7 @@ import jwt from "jsonwebtoken";
 import { UserCrypto } from "./user-crypto.js";
 import { SystemCrypto } from "./system-crypto.js";
 import { DataCrypto } from "./data-crypto.js";
-import { databaseLogger } from "./logger.js";
+import { databaseLogger, authLogger } from "./logger.js";
 import type { Request, Response, NextFunction } from "express";
 import { db } from "../database/db/index.js";
 import { sessions } from "../database/db/schema.js";
@@ -346,6 +346,11 @@ class AuthManager {

  async revokeSession(sessionId: string): Promise<boolean> {
    try {
+      authLogger.info("User session invalidated", {
+        operation: "user_logout",
+        sessionId,
+      });
+
      await db.delete(sessions).where(eq(sessions.id, sessionId));

      try {
@@ -387,6 +392,12 @@ class AuthManager {
        (s) => !exceptSessionId || s.id !== exceptSessionId,
      ).length;

+      authLogger.info("All user sessions invalidated", {
+        operation: "user_logout_all",
+        userId,
+        sessionCount: deletedCount,
+      });
+
      if (exceptSessionId) {
        await db
          .delete(sessions)
@@ -518,6 +529,15 @@ class AuthManager {
    };
  }

+  getClearCookieOptions(req: RequestWithHeaders) {
+    return {
+      httpOnly: false,
+      secure: req.secure || req.headers["x-forwarded-proto"] === "https",
+      sameSite: "strict" as const,
+      path: "/",
+    };
+  }
+
  createAuthMiddleware() {
    return async (req: Request, res: Response, next: NextFunction) => {
      const authReq = req as AuthenticatedRequest;
@@ -125,7 +125,7 @@ class DataCrypto {
        if (needsUpdate) {
          const updateQuery = `
            UPDATE ssh_data
-            SET password = ?, key = ?, key_password = ?, key_type = ?, autostart_password = ?, autostart_key = ?, autostart_key_password = ?, updated_at = CURRENT_TIMESTAMP
+            SET password = ?, key = ?, key_password = ?, key_type = ?, autostart_password = ?, autostart_key = ?, autostart_key_password = ?, sudo_password = ?, updated_at = CURRENT_TIMESTAMP
            WHERE id = ?
          `;
          db.prepare(updateQuery).run(
@@ -136,6 +136,7 @@ class DataCrypto {
            updatedRecord.autostartPassword || null,
            updatedRecord.autostartKey || null,
            updatedRecord.autostartKeyPassword || null,
+            updatedRecord.sudoPassword || null,
            record.id,
          );

@@ -476,10 +477,6 @@ class DataCrypto {
    }
  }

-  /**
-   * Encrypt sensitive credential fields with system key for offline sharing
-   * Returns an object with systemPassword, systemKey, systemKeyPassword fields
-   */
  static async encryptRecordWithSystemKey<T extends Record<string, unknown>>(
    tableName: string,
    record: T,
@@ -372,89 +372,19 @@ class DatabaseFileEncryption {
    encryptedPath: string,
    targetPath?: string,
  ): Promise<string> {
-    if (!fs.existsSync(encryptedPath)) {
-      throw new Error(
-        `Encrypted database file does not exist: ${encryptedPath}`,
-      );
-    }
-
-    const metadataPath = `${encryptedPath}${this.METADATA_FILE_SUFFIX}`;
-    if (!fs.existsSync(metadataPath)) {
-      throw new Error(`Metadata file does not exist: ${metadataPath}`);
-    }
-
    const decryptedPath =
      targetPath || encryptedPath.replace(this.ENCRYPTED_FILE_SUFFIX, "");

    try {
-      const metadataContent = fs.readFileSync(metadataPath, "utf8");
-      const metadata: EncryptedFileMetadata = JSON.parse(metadataContent);
+      const decryptedBuffer = await this.decryptDatabaseToBuffer(encryptedPath);

-      const encryptedData = fs.readFileSync(encryptedPath);
-
-      if (
-        metadata.dataSize !== undefined &&
-        encryptedData.length !== metadata.dataSize
-      ) {
-        databaseLogger.error(
-          "Encrypted file size mismatch - possible corrupted write or mismatched metadata",
-          null,
-          {
-            operation: "database_file_size_mismatch",
-            encryptedPath,
-            actualSize: encryptedData.length,
-            expectedSize: metadata.dataSize,
-          },
-        );
-        throw new Error(
-          `Encrypted file size mismatch: expected ${metadata.dataSize} bytes but got ${encryptedData.length} bytes. ` +
-            `This indicates corrupted files or interrupted write operation.`,
-        );
-      }
-
-      let key: Buffer;
-      if (metadata.version === "v2") {
-        key = await this.systemCrypto.getDatabaseKey();
-      } else if (metadata.version === "v1") {
-        databaseLogger.warn(
-          "Decrypting legacy v1 encrypted database - consider upgrading",
-          {
-            operation: "decrypt_legacy_v1",
-            path: encryptedPath,
-          },
-        );
-        if (!metadata.salt) {
-          throw new Error("v1 encrypted file missing required salt field");
-        }
-        const salt = Buffer.from(metadata.salt, "hex");
-        const fixedSeed =
-          process.env.DB_FILE_KEY || "termix-database-file-encryption-seed-v1";
-        key = crypto.pbkdf2Sync(fixedSeed, salt, 100000, 32, "sha256");
-      } else {
-        throw new Error(`Unsupported encryption version: ${metadata.version}`);
-      }
-
-      const decipher = crypto.createDecipheriv(
-        metadata.algorithm,
-        key,
-        Buffer.from(metadata.iv, "hex"),
-      ) as crypto.DecipherGCM;
-      decipher.setAuthTag(Buffer.from(metadata.tag, "hex"));
-
-      const decrypted = Buffer.concat([
-        decipher.update(encryptedData),
-        decipher.final(),
-      ]);
-
-      fs.writeFileSync(decryptedPath, decrypted);
+      fs.writeFileSync(decryptedPath, decryptedBuffer);

      databaseLogger.info("Database file decrypted successfully", {
        operation: "database_file_decryption",
        encryptedPath,
        decryptedPath,
-        encryptedSize: encryptedData.length,
-        decryptedSize: decrypted.length,
-        fingerprintPrefix: metadata.fingerprint,
+        decryptedSize: decryptedBuffer.length,
      });

      return decryptedPath;
@@ -480,12 +410,14 @@ class DatabaseFileEncryption {
      try {
        const metadataContent = fs.readFileSync(metadataPath, "utf8");
        const metadata: EncryptedFileMetadata = JSON.parse(metadataContent);
-        return (
+        if (
          metadata.version === this.VERSION &&
          metadata.algorithm === this.ALGORITHM
-        );
+        ) {
+          return true;
+        }
      } catch {
-        return false;
+        // .meta parse failed, fall through to single-file detection
      }
    }

@@ -526,11 +458,32 @@ class DatabaseFileEncryption {
    }

    try {
-      const metadataPath = `${encryptedPath}${this.METADATA_FILE_SUFFIX}`;
-      const metadataContent = fs.readFileSync(metadataPath, "utf8");
-      const metadata: EncryptedFileMetadata = JSON.parse(metadataContent);
-
      const fileStats = fs.statSync(encryptedPath);
+      let metadata: EncryptedFileMetadata | null = null;
+
+      const metadataPath = `${encryptedPath}${this.METADATA_FILE_SUFFIX}`;
+      if (fs.existsSync(metadataPath)) {
+        try {
+          const metadataContent = fs.readFileSync(metadataPath, "utf8");
+          metadata = JSON.parse(metadataContent);
+        } catch {
+          // .meta parse failed, try single-file format
+        }
+      }
+
+      if (!metadata) {
+        const fileBuffer = fs.readFileSync(encryptedPath);
+        const metadataLength = fileBuffer.readUInt32BE(0);
+        const metadataEnd = 4 + metadataLength;
+        const metadataJson = fileBuffer
+          .subarray(4, metadataEnd)
+          .toString("utf8");
+        metadata = JSON.parse(metadataJson);
+      }
+
+      if (!metadata) {
+        return null;
+      }

      return {
        version: metadata.version,
@@ -32,10 +32,10 @@ class FieldCrypto {
      "key",
      "key_password",
      "keyPassword",
-      "keyType",
      "autostartPassword",
      "autostartKey",
      "autostartKeyPassword",
+      "sudoPassword",
    ]),
    ssh_credentials: new Set([
      "password",
@@ -46,7 +46,12 @@ class FieldCrypto {
      "key",
      "public_key",
      "publicKey",
-      "keyType",
+    ]),
+    opkssh_tokens: new Set([
+      "ssh_cert",
+      "sshCert",
+      "private_key",
+      "privateKey",
    ]),
  };

@@ -7,11 +7,21 @@ interface LoginAttempt {
 class LoginRateLimiter {
  private ipAttempts = new Map<string, LoginAttempt>();
  private usernameAttempts = new Map<string, LoginAttempt>();
+  private totpAttempts = new Map<string, LoginAttempt>();
+  private resetCodeAttempts = new Map<string, LoginAttempt>();

  private readonly MAX_ATTEMPTS = 5;
  private readonly WINDOW_MS = 10 * 60 * 1000;
  private readonly LOCKOUT_MS = 10 * 60 * 1000;

+  private readonly TOTP_MAX_ATTEMPTS = 5;
+  private readonly TOTP_WINDOW_MS = 1 * 60 * 1000;
+  private readonly TOTP_LOCKOUT_MS = 5 * 60 * 1000;
+
+  private readonly RESET_CODE_MAX_ATTEMPTS = 5;
+  private readonly RESET_CODE_WINDOW_MS = 1 * 60 * 1000;
+  private readonly RESET_CODE_LOCKOUT_MS = 5 * 60 * 1000;
+
  constructor() {
    setInterval(() => this.cleanup(), 5 * 60 * 1000);
  }
@@ -40,6 +50,28 @@ class LoginRateLimiter {
        this.usernameAttempts.delete(username);
      }
    }
+
+    for (const [userId, attempt] of this.totpAttempts.entries()) {
+      if (attempt.lockedUntil && attempt.lockedUntil < now) {
+        this.totpAttempts.delete(userId);
+      } else if (
+        !attempt.lockedUntil &&
+        now - attempt.firstAttempt > this.TOTP_WINDOW_MS
+      ) {
+        this.totpAttempts.delete(userId);
+      }
+    }
+
+    for (const [username, attempt] of this.resetCodeAttempts.entries()) {
+      if (attempt.lockedUntil && attempt.lockedUntil < now) {
+        this.resetCodeAttempts.delete(username);
+      } else if (
+        !attempt.lockedUntil &&
+        now - attempt.firstAttempt > this.RESET_CODE_WINDOW_MS
+      ) {
+        this.resetCodeAttempts.delete(username);
+      }
+    }
  }

  recordFailedAttempt(ip: string, username?: string): void {
@@ -141,6 +173,114 @@ class LoginRateLimiter {

    return minRemaining;
  }
+
+  recordFailedTOTPAttempt(userId: string): void {
+    const now = Date.now();
+
+    const totpAttempt = this.totpAttempts.get(userId);
+    if (!totpAttempt) {
+      this.totpAttempts.set(userId, {
+        count: 1,
+        firstAttempt: now,
+      });
+    } else if (now - totpAttempt.firstAttempt > this.TOTP_WINDOW_MS) {
+      this.totpAttempts.set(userId, {
+        count: 1,
+        firstAttempt: now,
+      });
+    } else {
+      totpAttempt.count++;
+      if (totpAttempt.count >= this.TOTP_MAX_ATTEMPTS) {
+        totpAttempt.lockedUntil = now + this.TOTP_LOCKOUT_MS;
+      }
+    }
+  }
+
+  resetTOTPAttempts(userId: string): void {
+    this.totpAttempts.delete(userId);
+  }
+
+  isTOTPLocked(userId: string): { locked: boolean; remainingTime?: number } {
+    const now = Date.now();
+
+    const totpAttempt = this.totpAttempts.get(userId);
+    if (totpAttempt?.lockedUntil && totpAttempt.lockedUntil > now) {
+      return {
+        locked: true,
+        remainingTime: Math.ceil((totpAttempt.lockedUntil - now) / 1000),
+      };
+    }
+
+    return { locked: false };
+  }
+
+  getRemainingTOTPAttempts(userId: string): number {
+    const now = Date.now();
+
+    const totpAttempt = this.totpAttempts.get(userId);
+    if (totpAttempt && now - totpAttempt.firstAttempt <= this.TOTP_WINDOW_MS) {
+      return Math.max(0, this.TOTP_MAX_ATTEMPTS - totpAttempt.count);
+    }
+
+    return this.TOTP_MAX_ATTEMPTS;
+  }
+
+  recordResetCodeAttempt(username: string): void {
+    const now = Date.now();
+
+    const resetAttempt = this.resetCodeAttempts.get(username);
+    if (!resetAttempt) {
+      this.resetCodeAttempts.set(username, {
+        count: 1,
+        firstAttempt: now,
+      });
+    } else if (now - resetAttempt.firstAttempt > this.RESET_CODE_WINDOW_MS) {
+      this.resetCodeAttempts.set(username, {
+        count: 1,
+        firstAttempt: now,
+      });
+    } else {
+      resetAttempt.count++;
+      if (resetAttempt.count >= this.RESET_CODE_MAX_ATTEMPTS) {
+        resetAttempt.lockedUntil = now + this.RESET_CODE_LOCKOUT_MS;
+      }
+    }
+  }
+
+  resetResetCodeAttempts(username: string): void {
+    this.resetCodeAttempts.delete(username);
+  }
+
+  isResetCodeLocked(username: string): {
+    locked: boolean;
+    remainingTime?: number;
+  } {
+    const now = Date.now();
+
+    const resetAttempt = this.resetCodeAttempts.get(username);
+    if (resetAttempt?.lockedUntil && resetAttempt.lockedUntil > now) {
+      return {
+        locked: true,
+        remainingTime: Math.ceil((resetAttempt.lockedUntil - now) / 1000),
+      };
+    }
+
+    return { locked: false };
+  }
+
+  getRemainingResetCodeAttempts(username: string): number {
+    const now = Date.now();
+
+    const resetAttempt = this.resetCodeAttempts.get(username);
+    if (
+      resetAttempt &&
+      now - resetAttempt.firstAttempt <= this.RESET_CODE_WINDOW_MS
+    ) {
+      return Math.max(0, this.RESET_CODE_MAX_ATTEMPTS - resetAttempt.count);
+    }
+
+    return this.RESET_CODE_MAX_ATTEMPTS;
+  }
 }

 export const loginRateLimiter = new LoginRateLimiter();
@@ -0,0 +1,226 @@
+import { promises as fs } from "fs";
+import path from "path";
+import { createWriteStream } from "fs";
+import { pipeline } from "stream/promises";
+import { systemLogger } from "./logger.js";
+
+const OPKSSH_REPO = "openpubkey/opkssh";
+
+function getBinaryDir(): string {
+  const dataDir =
+    process.env.DATA_DIR || path.join(process.cwd(), "db", "data");
+  return path.join(dataDir, "opkssh");
+}
+
+function getVersionFile(): string {
+  return path.join(getBinaryDir(), "version.txt");
+}
+
+interface GitHubAsset {
+  name: string;
+  browser_download_url: string;
+}
+
+interface GitHubRelease {
+  tag_name: string;
+  assets: GitHubAsset[];
+}
+
+export class OPKSSHBinaryManager {
+  private static binaryPath: string | null = null;
+
+  static async ensureBinary(): Promise<string> {
+    if (this.binaryPath) {
+      return this.binaryPath;
+    }
+
+    const binaryName = this.getBinaryName();
+    const expectedPath = path.join(getBinaryDir(), binaryName);
+
+    try {
+      await fs.access(expectedPath);
+      const needsUpdate = await this.checkForUpdate();
+      if (needsUpdate) {
+        systemLogger.info("Newer OPKSSH version available, updating...", {
+          operation: "opkssh_binary_update_start",
+        });
+        await this.downloadBinary();
+      }
+
+      this.binaryPath = expectedPath;
+      return expectedPath;
+    } catch {
+      systemLogger.info("OPKSSH binary not found, downloading...", {
+        operation: "opkssh_binary_download_start",
+      });
+      await this.downloadBinary();
+      this.binaryPath = expectedPath;
+      return expectedPath;
+    }
+  }
+
+  static async downloadBinary(): Promise<void> {
+    try {
+      await fs.mkdir(getBinaryDir(), { recursive: true });
+
+      const release = await this.getLatestRelease();
+
+      const asset = this.findMatchingAsset(release.assets);
+      if (!asset) {
+        throw new Error(
+          `No matching OPKSSH binary found for platform ${process.platform} ${process.arch}`,
+        );
+      }
+
+      const binaryName = this.getBinaryName();
+      const binaryPath = path.join(getBinaryDir(), binaryName);
+
+      const response = await fetch(asset.browser_download_url);
+      if (!response.ok) {
+        throw new Error(`Failed to download: ${response.statusText}`);
+      }
+
+      if (!response.body) {
+        throw new Error("Response body is null");
+      }
+
+      const fileStream = createWriteStream(binaryPath);
+      await pipeline(
+        response.body as unknown as NodeJS.ReadableStream,
+        fileStream,
+      );
+
+      await fs.chmod(binaryPath, 0o755);
+
+      await fs.writeFile(getVersionFile(), release.tag_name, "utf8");
+
+      systemLogger.info(
+        `OPKSSH binary downloaded successfully to ${binaryPath}`,
+        {
+          operation: "opkssh_binary_download_complete",
+          path: binaryPath,
+          version: release.tag_name,
+        },
+      );
+    } catch (error) {
+      systemLogger.error("Failed to download OPKSSH binary", error, {
+        operation: "opkssh_binary_download_error",
+      });
+      throw error;
+    }
+  }
+
+  static getBinaryPath(): string {
+    if (!this.binaryPath) {
+      throw new Error(
+        "OPKSSH binary not initialized. Call ensureBinary() first.",
+      );
+    }
+    return this.binaryPath;
+  }
+
+  private static async checkForUpdate(): Promise<boolean> {
+    try {
+      let localVersion: string | null = null;
+      try {
+        localVersion = await fs.readFile(getVersionFile(), "utf8");
+        localVersion = localVersion.trim();
+      } catch {
+        return true;
+      }
+
+      const release = await this.getLatestRelease();
+      const latestVersion = release.tag_name;
+
+      if (localVersion !== latestVersion) {
+        return true;
+      }
+
+      return false;
+    } catch (error) {
+      systemLogger.warn("Failed to check for OPKSSH updates", {
+        operation: "opkssh_update_check_failed",
+        error: error instanceof Error ? error.message : "Unknown error",
+      });
+      return false;
+    }
+  }
+
+  private static async getLatestRelease(): Promise<GitHubRelease> {
+    const url = `https://api.github.com/repos/${OPKSSH_REPO}/releases/latest`;
+    const response = await fetch(url, {
+      headers: {
+        "User-Agent": "Termix",
+      },
+    });
+
+    if (!response.ok) {
+      throw new Error(`Failed to fetch release info: ${response.statusText}`);
+    }
+
+    return (await response.json()) as GitHubRelease;
+  }
+
+  private static findMatchingAsset(assets: GitHubAsset[]): GitHubAsset | null {
+    const platform = process.platform;
+    const arch = process.arch;
+
+    const osMap: Record<string, string> = {
+      win32: "windows",
+      linux: "linux",
+      darwin: "darwin",
+    };
+
+    const archMap: Record<string, string> = {
+      x64: "amd64",
+      arm64: "arm64",
+    };
+
+    const mappedOs = osMap[platform];
+    const mappedArch = archMap[arch];
+
+    if (!mappedOs || !mappedArch) {
+      return null;
+    }
+
+    const patterns = [
+      `opkssh-${mappedOs}-${mappedArch}.exe`,
+      `opkssh-${mappedOs}-${mappedArch}`,
+      `opkssh_${mappedOs}_${mappedArch}.exe`,
+      `opkssh_${mappedOs}_${mappedArch}`,
+    ];
+
+    for (const pattern of patterns) {
+      const asset = assets.find(
+        (a) => a.name.toLowerCase() === pattern.toLowerCase(),
+      );
+      if (asset) {
+        return asset;
+      }
+    }
+
+    return null;
+  }
+
+  private static getBinaryName(): string {
+    const platform = process.platform;
+    const arch = process.arch;
+
+    const osMap: Record<string, string> = {
+      win32: "windows",
+      linux: "linux",
+      darwin: "darwin",
+    };
+
+    const archMap: Record<string, string> = {
+      x64: "amd64",
+      arm64: "arm64",
+    };
+
+    const mappedOs = osMap[platform] || platform;
+    const mappedArch = archMap[arch] || arch;
+
+    const extension = platform === "win32" ? ".exe" : "";
+    return `opkssh-${mappedOs}-${mappedArch}${extension}`;
+  }
+}
@@ -63,9 +63,6 @@ class PermissionManager {
    return this.instance;
  }

-  /**
-   * Clean up expired host access entries
-   */
  private async cleanupExpiredAccess(): Promise<void> {
    try {
      const now = new Date().toISOString();
@@ -85,23 +82,14 @@ class PermissionManager {
    }
  }

-  /**
-   * Clear permission cache
-   */
  private clearPermissionCache(): void {
    this.permissionCache.clear();
  }

-  /**
-   * Invalidate permission cache for a specific user
-   */
  invalidateUserPermissionCache(userId: string): void {
    this.permissionCache.delete(userId);
  }

-  /**
-   * Get user permissions from roles
-   */
  async getUserPermissions(userId: string): Promise<string[]> {
    const cached = this.permissionCache.get(userId);
    if (cached && Date.now() - cached.timestamp < this.CACHE_TTL) {
@@ -150,10 +138,6 @@ class PermissionManager {
    }
  }

-  /**
-   * Check if user has a specific permission
-   * Supports wildcards: "hosts.*", "*"
-   */
  async hasPermission(userId: string, permission: string): Promise<boolean> {
    const userPermissions = await this.getUserPermissions(userId);

@@ -176,9 +160,6 @@ class PermissionManager {
    return false;
  }

-  /**
-   * Check if user can access a specific host
-   */
  async canAccessHost(
    userId: string,
    hostId: number,
@@ -229,6 +210,20 @@ class PermissionManager {
      if (sharedAccess.length > 0) {
        const access = sharedAccess[0];

+        const hostOwnerCheck = await db
+          .select({ ownerId: sshData.userId })
+          .from(sshData)
+          .where(eq(sshData.id, hostId))
+          .limit(1);
+
+        if (hostOwnerCheck.length > 0 && hostOwnerCheck[0].ownerId === userId) {
+          return {
+            hasAccess: true,
+            isOwner: true,
+            isShared: false,
+          };
+        }
+
        if (action === "write" || action === "delete") {
          return {
            hasAccess: false,
@@ -282,9 +277,6 @@ class PermissionManager {
    }
  }

-  /**
-   * Check if user is admin (backward compatibility)
-   */
  async isAdmin(userId: string): Promise<boolean> {
    try {
      const user = await db
@@ -318,9 +310,6 @@ class PermissionManager {
    }
  }

-  /**
-   * Middleware: Require specific permission
-   */
  requirePermission(permission: string) {
    return async (
      req: AuthenticatedRequest,
@@ -353,9 +342,6 @@ class PermissionManager {
    };
  }

-  /**
-   * Middleware: Require host access
-   */
  requireHostAccess(
    hostIdParam: string = "id",
    action: "read" | "write" | "execute" | "delete" | "share" = "read",
@@ -371,7 +357,10 @@ class PermissionManager {
        return res.status(401).json({ error: "Not authenticated" });
      }

-      const hostId = parseInt(req.params[hostIdParam], 10);
+      const hostIdValue = Array.isArray(req.params[hostIdParam])
+        ? req.params[hostIdParam][0]
+        : req.params[hostIdParam];
+      const hostId = parseInt(hostIdValue, 10);

      if (isNaN(hostId)) {
        return res.status(400).json({ error: "Invalid host ID" });
@@ -400,9 +389,6 @@ class PermissionManager {
    };
  }

-  /**
-   * Middleware: Require admin role (backward compatible)
-   */
  requireAdmin() {
    return async (
      req: AuthenticatedRequest,
@@ -0,0 +1,32 @@
+import { HttpsProxyAgent } from "https-proxy-agent";
+import type { Agent } from "http";
+
+export function getProxyAgent(targetUrl?: string): Agent | undefined {
+  const proxyUrl =
+    process.env.https_proxy ||
+    process.env.HTTPS_PROXY ||
+    process.env.http_proxy ||
+    process.env.HTTP_PROXY;
+
+  if (!proxyUrl) return undefined;
+
+  if (targetUrl) {
+    const noProxy = process.env.no_proxy || process.env.NO_PROXY || "";
+    const hostname = new URL(targetUrl).hostname.toLowerCase();
+
+    for (const entry of noProxy.split(",")) {
+      const trimmed = entry.trim().toLowerCase();
+      if (!trimmed) continue;
+
+      const normalized = trimmed
+        .replace(/^\*\./, "")
+        .replace(/^\./, "");
+
+      if (hostname === normalized || hostname.endsWith(`.${normalized}`)) {
+        return undefined;
+      }
+    }
+  }
+
+  return new HttpsProxyAgent(proxyUrl);
+}
@@ -21,11 +21,6 @@ interface CredentialData {
  keyType?: string;
 }

-/**
- * Manages shared credentials for RBAC host sharing.
- * Creates per-user encrypted credential copies to enable credential sharing
- * without requiring the credential owner to be online.
- */
 class SharedCredentialManager {
  private static instance: SharedCredentialManager;

@@ -38,10 +33,6 @@ class SharedCredentialManager {
    return this.instance;
  }

-  /**
-   * Create shared credential for a specific user
-   * Called when sharing a host with a user
-   */
  async createSharedCredentialForUser(
    hostAccessId: number,
    originalCredentialId: number,
@@ -121,10 +112,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Create shared credentials for all users in a role
-   * Called when sharing a host with a role
-   */
  async createSharedCredentialsForRole(
    hostAccessId: number,
    originalCredentialId: number,
@@ -172,10 +159,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Get credential data for a shared user
-   * Called when a shared user connects to a host
-   */
  async getSharedCredentialForUser(
    hostId: number,
    userId: string,
@@ -230,10 +213,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Update all shared credentials when original credential is updated
-   * Called when credential owner updates credential
-   */
  async updateSharedCredentialsForOriginal(
    credentialId: number,
    ownerId: string,
@@ -310,10 +289,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Delete shared credentials when original credential is deleted
-   * Called from credential deletion route
-   */
  async deleteSharedCredentialsForOriginal(
    credentialId: number,
  ): Promise<void> {
@@ -330,10 +305,6 @@ class SharedCredentialManager {
    }
  }

-  /**
-   * Re-encrypt pending shared credentials for a user when they log in
-   * Called during user login
-   */
  async reEncryptPendingCredentialsForUser(userId: string): Promise<void> {
    try {
      const userDEK = DataCrypto.getUserDataKey(userId);
@@ -405,9 +376,6 @@ class SharedCredentialManager {
    };
  }

-  /**
-   * Decrypt credential using system key (for offline sharing when owner is offline)
-   */
  private async getDecryptedCredentialViaSystemKey(
    credentialId: number,
  ): Promise<CredentialData> {
@@ -13,13 +13,6 @@ export interface SOCKS5Config {
  socks5ProxyChain?: ProxyNode[];
 }

-/**
- * Creates a SOCKS5 connection through a single proxy or a chain of proxies
- * @param targetHost - Target SSH server hostname/IP
- * @param targetPort - Target SSH server port
- * @param socks5Config - SOCKS5 proxy configuration
- * @returns Promise with connected socket or null if SOCKS5 is not enabled
- */
 export async function createSocks5Connection(
  targetHost: string,
  targetPort: number,
@@ -47,9 +40,6 @@ export async function createSocks5Connection(
  return null;
 }

-/**
- * Creates a connection through a single SOCKS proxy
- */
 async function createSingleProxyConnection(
  targetHost: string,
  targetPort: number,
@@ -87,10 +77,6 @@ async function createSingleProxyConnection(
  }
 }

-/**
- * Creates a connection through a chain of SOCKS proxies
- * Each proxy in the chain connects through the previous one
- */
 async function createProxyChainConnection(
  targetHost: string,
  targetPort: number,
@@ -303,9 +303,8 @@ class UserCrypto {
      await this.storeKEKSalt(userId, newKekSalt);
      await this.storeEncryptedDEK(userId, newEncryptedDEK);

-      const { saveMemoryDatabaseToFile } = await import(
-        "../database/db/index.js"
-      );
+      const { saveMemoryDatabaseToFile } =
+        await import("../database/db/index.js");
      await saveMemoryDatabaseToFile();

      oldKEK.fill(0);
@@ -341,9 +340,8 @@ class UserCrypto {
      await this.storeKEKSalt(userId, newKekSalt);
      await this.storeEncryptedDEK(userId, newEncryptedDEK);

-      const { saveMemoryDatabaseToFile } = await import(
-        "../database/db/index.js"
-      );
+      const { saveMemoryDatabaseToFile } =
+        await import("../database/db/index.js");
      await saveMemoryDatabaseToFile();

      newKEK.fill(0);
@@ -364,15 +362,6 @@ class UserCrypto {
    }
  }

-  /**
-   * Convert a password-based user's encryption to DUAL-AUTH encryption.
-   * This is used when linking an OIDC account to a password account for dual-auth.
-   *
-   * IMPORTANT: This does NOT delete the password-based KEK salt!
-   * The user needs to maintain BOTH password and OIDC authentication methods.
-   * We keep the password KEK salt so password login still works.
-   * We also store the DEK encrypted with OIDC system key for OIDC login.
-   */
  async convertToOIDCEncryption(userId: string): Promise<void> {
    try {
      const existingEncryptedDEK = await this.getEncryptedDEK(userId);
@@ -427,9 +416,8 @@ class UserCrypto {
        },
      );

-      const { saveMemoryDatabaseToFile } = await import(
-        "../database/db/index.js"
-      );
+      const { saveMemoryDatabaseToFile } =
+        await import("../database/db/index.js");
      await saveMemoryDatabaseToFile();
    } catch (error) {
      databaseLogger.error("Failed to convert to OIDC encryption", error, {
@@ -177,30 +177,57 @@ class UserDataImport {
          continue;
        }

-        const tempId = `import-ssh-${targetUserId}-${Date.now()}-${imported}`;
-        const newHostData = {
+        const existing = await getDb()
+          .select()
+          .from(sshData)
+          .where(
+            and(
+              eq(sshData.userId, targetUserId),
+              eq(sshData.ip, host.ip as string),
+              eq(sshData.port, host.port as number),
+              eq(sshData.username, host.username as string),
+            ),
+          );
+
+        if (existing.length > 0 && !options.replaceExisting) {
+          skipped++;
+          continue;
+        }
+
+        const newHostData: any = {
          ...host,
-          id: tempId,
          userId: targetUserId,
-          createdAt: new Date().toISOString(),
          updatedAt: new Date().toISOString(),
        };

-        let processedHostData = newHostData;
+        if (existing.length === 0) {
+          newHostData.createdAt = new Date().toISOString();
+        }
+
+        let processedHostData: any = newHostData;
        if (options.userDataKey) {
          processedHostData = DataCrypto.encryptRecord(
            "ssh_data",
            newHostData,
            targetUserId,
            options.userDataKey,
-          );
+          ) as Record<string, unknown>;
        }

        delete processedHostData.id;

-        await getDb()
-          .insert(sshData)
-          .values(processedHostData as unknown as typeof sshData.$inferInsert);
+        if (existing.length > 0 && options.replaceExisting) {
+          await getDb()
+            .update(sshData)
+            .set(processedHostData as unknown as typeof sshData.$inferInsert)
+            .where(eq(sshData.id, existing[0].id));
+        } else {
+          await getDb()
+            .insert(sshData)
+            .values(
+              processedHostData as unknown as typeof sshData.$inferInsert,
+            );
+        }
        imported++;
      } catch (error) {
        errors.push(
@@ -233,34 +260,59 @@ class UserDataImport {
          continue;
        }

-        const tempCredId = `import-cred-${targetUserId}-${Date.now()}-${imported}`;
-        const newCredentialData = {
+        const existing = await getDb()
+          .select()
+          .from(sshCredentials)
+          .where(
+            and(
+              eq(sshCredentials.userId, targetUserId),
+              eq(sshCredentials.name, credential.name as string),
+            ),
+          );
+
+        if (existing.length > 0 && !options.replaceExisting) {
+          skipped++;
+          continue;
+        }
+
+        const newCredentialData: any = {
          ...credential,
-          id: tempCredId,
          userId: targetUserId,
-          usageCount: 0,
-          lastUsed: null,
-          createdAt: new Date().toISOString(),
          updatedAt: new Date().toISOString(),
        };

-        let processedCredentialData = newCredentialData;
+        if (existing.length === 0) {
+          newCredentialData.usageCount = 0;
+          newCredentialData.lastUsed = null;
+          newCredentialData.createdAt = new Date().toISOString();
+        }
+
+        let processedCredentialData: any = newCredentialData;
        if (options.userDataKey) {
          processedCredentialData = DataCrypto.encryptRecord(
            "ssh_credentials",
            newCredentialData,
            targetUserId,
            options.userDataKey,
-          );
+          ) as Record<string, unknown>;
        }

        delete processedCredentialData.id;

-        await getDb()
-          .insert(sshCredentials)
-          .values(
-            processedCredentialData as unknown as typeof sshCredentials.$inferInsert,
-          );
+        if (existing.length > 0 && options.replaceExisting) {
+          await getDb()
+            .update(sshCredentials)
+            .set(
+              processedCredentialData as unknown as typeof sshCredentials.$inferInsert,
+            )
+            .where(eq(sshCredentials.id, existing[0].id));
+        } else {
+          await getDb()
+            .insert(sshCredentials)
+            .values(
+              processedCredentialData as unknown as typeof sshCredentials.$inferInsert,
+            );
+        }
        imported++;
      } catch (error) {
        errors.push(
@@ -36,7 +36,7 @@ function TooltipTrigger({

 function TooltipContent({
  className,
-  sideOffset = 0,
+  sideOffset = 4,
  children,
  ...props
 }: React.ComponentProps<typeof TooltipPrimitive.Content>) {
@@ -46,7 +46,7 @@ function TooltipContent({
        data-slot="tooltip-content"
        sideOffset={sideOffset}
        className={cn(
-          "bg-primary text-primary-foreground animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs text-balance",
+          "bg-elevated text-foreground border border-edge-medium shadow-lg animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs text-balance",
          className,
        )}
        {...props}
@@ -745,7 +745,7 @@ export const DEFAULT_TERMINAL_CONFIG = {
  fontSize: 14,
  fontFamily: "Caskaydia Cove Nerd Font Mono",
  letterSpacing: 0,
-  lineHeight: 1.2,
+  lineHeight: 1.0,
  theme: "termix",

  scrollback: 10000,
@@ -1,4 +1,4 @@
-import { useState } from "react";
+import { useState, useEffect, useCallback } from "react";
 import { toast } from "sonner";

 interface ConfirmationOptions {
@@ -9,10 +9,56 @@ interface ConfirmationOptions {
  variant?: "default" | "destructive";
 }

+interface ToastConfirmOptions {
+  confirmOnEnter?: boolean;
+  duration?: number;
+}
+
 export function useConfirmation() {
  const [isOpen, setIsOpen] = useState(false);
  const [options, setOptions] = useState<ConfirmationOptions | null>(null);
  const [onConfirm, setOnConfirm] = useState<(() => void) | null>(null);
+  const [activeToastId, setActiveToastId] = useState<string | number | null>(
+    null,
+  );
+  const [pendingConfirmCallback, setPendingConfirmCallback] = useState<
+    (() => void) | null
+  >(null);
+  const [pendingResolve, setPendingResolve] = useState<
+    ((value: boolean) => void) | null
+  >(null);
+
+  const handleEnterKey = useCallback(
+    (event: KeyboardEvent) => {
+      if (event.key === "Enter" && activeToastId !== null) {
+        event.preventDefault();
+        event.stopPropagation();
+
+        if (pendingConfirmCallback) {
+          pendingConfirmCallback();
+        }
+        if (pendingResolve) {
+          pendingResolve(true);
+        }
+
+        toast.dismiss(activeToastId);
+        setActiveToastId(null);
+        setPendingConfirmCallback(null);
+        setPendingResolve(null);
+      }
+    },
+    [activeToastId, pendingConfirmCallback, pendingResolve],
+  );
+
+  useEffect(() => {
+    if (activeToastId !== null) {
+      // Use capture phase to intercept Enter before terminal receives it
+      window.addEventListener("keydown", handleEnterKey, true);
+      return () => {
+        window.removeEventListener("keydown", handleEnterKey, true);
+      };
+    }
+  }, [activeToastId, handleEnterKey]);

  const confirm = (opts: ConfirmationOptions, callback: () => void) => {
    setOptions(opts);
@@ -40,6 +86,7 @@ export function useConfirmation() {
    callback?: () => void,
    variantOrConfirmLabel: "default" | "destructive" | string = "Confirm",
    cancelLabel: string = "Cancel",
+    toastOptions: ToastConfirmOptions = { confirmOnEnter: false },
  ): Promise<boolean> => {
    return new Promise((resolve) => {
      const isVariant =
@@ -47,43 +94,64 @@ export function useConfirmation() {
        variantOrConfirmLabel === "destructive";
      const confirmLabel = isVariant ? "Confirm" : variantOrConfirmLabel;

-      if (typeof opts === "string") {
-        toast(opts, {
-          action: {
-            label: confirmLabel,
-            onClick: () => {
-              if (callback) callback();
-              resolve(true);
-            },
-          },
-          cancel: {
-            label: cancelLabel,
-            onClick: () => {
-              resolve(false);
-            },
-          },
-        } as any);
-      } else if (typeof opts === "object") {
-        const actualConfirmLabel = opts.confirmText || confirmLabel;
-        const actualCancelLabel = opts.cancelText || cancelLabel;
+      const { confirmOnEnter = false, duration = 8000 } = toastOptions;

-        toast(opts.description, {
-          action: {
-            label: actualConfirmLabel,
-            onClick: () => {
-              if (callback) callback();
-              resolve(true);
-            },
-          },
-          cancel: {
-            label: actualCancelLabel,
-            onClick: () => {
-              resolve(false);
-            },
-          },
-        } as any);
-      } else {
+      const handleToastConfirm = () => {
+        if (callback) callback();
+        resolve(true);
+        setActiveToastId(null);
+        setPendingConfirmCallback(null);
+        setPendingResolve(null);
+      };
+
+      const handleToastCancel = () => {
        resolve(false);
+        setActiveToastId(null);
+        setPendingConfirmCallback(null);
+        setPendingResolve(null);
+      };
+
+      const message = typeof opts === "string" ? opts : opts.description;
+      const actualConfirmLabel =
+        typeof opts === "object" && opts.confirmText
+          ? opts.confirmText
+          : confirmLabel;
+      const actualCancelLabel =
+        typeof opts === "object" && opts.cancelText
+          ? opts.cancelText
+          : cancelLabel;
+
+      const toastId = toast(message, {
+        duration,
+        action: {
+          label: confirmOnEnter
+            ? `${actualConfirmLabel} ↵`
+            : actualConfirmLabel,
+          onClick: handleToastConfirm,
+        },
+        cancel: {
+          label: actualCancelLabel,
+          onClick: handleToastCancel,
+        },
+        onDismiss: () => {
+          setActiveToastId(null);
+          setPendingConfirmCallback(null);
+          setPendingResolve(null);
+        },
+        onAutoClose: () => {
+          resolve(false);
+          setActiveToastId(null);
+          setPendingConfirmCallback(null);
+          setPendingResolve(null);
+        },
+      } as any);
+
+      if (confirmOnEnter) {
+        setActiveToastId(toastId);
+        setPendingConfirmCallback(() => () => {
+          if (callback) callback();
+        });
+        setPendingResolve(() => resolve);
      }
    });
  };
@@ -0,0 +1,67 @@
+import { useEffect, useState, useCallback } from "react";
+import { isElectron } from "@/ui/main-axios";
+import { getBasePath } from "@/lib/base-path";
+
+interface ServiceWorkerState {
+  isSupported: boolean;
+  isRegistered: boolean;
+  updateAvailable: boolean;
+}
+
+export function useServiceWorker(): ServiceWorkerState {
+  const [state, setState] = useState<ServiceWorkerState>({
+    isSupported: false,
+    isRegistered: false,
+    updateAvailable: false,
+  });
+
+  const handleUpdateFound = useCallback(
+    (registration: ServiceWorkerRegistration) => {
+      const newWorker = registration.installing;
+      if (!newWorker) return;
+
+      newWorker.addEventListener("statechange", () => {
+        if (
+          newWorker.state === "installed" &&
+          navigator.serviceWorker.controller
+        ) {
+          setState((prev) => ({ ...prev, updateAvailable: true }));
+        }
+      });
+    },
+    [],
+  );
+
+  useEffect(() => {
+    const isSupported =
+      "serviceWorker" in navigator && !isElectron() && import.meta.env.PROD;
+
+    setState((prev) => ({ ...prev, isSupported }));
+
+    if (!isSupported) return;
+
+    const registerSW = async () => {
+      try {
+        const registration = await navigator.serviceWorker.register(
+          `${getBasePath()}/sw.js`,
+        );
+        setState((prev) => ({ ...prev, isRegistered: true }));
+
+        registration.addEventListener("updatefound", () =>
+          handleUpdateFound(registration),
+        );
+      } catch (error) {
+        console.error("[SW] Registration failed:", error);
+      }
+    };
+
+    if (document.readyState === "complete") {
+      registerSW();
+    } else {
+      window.addEventListener("load", registerSW);
+      return () => window.removeEventListener("load", registerSW);
+    }
+  }, [handleUpdateFound]);
+
+  return state;
+}
@@ -3,31 +3,40 @@ import { initReactI18next } from "react-i18next";
 import LanguageDetector from "i18next-browser-languagedetector";

 import enTranslation from "../locales/en.json";
-import zhTranslation from "../locales/zh.json";
-import deTranslation from "../locales/de.json";
-import ptTranslation from "../locales/pt.json";
-import ruTranslation from "../locales/ru.json";
-import frTranslation from "../locales/fr.json";
-import koTranslation from "../locales/ko.json";
-import itTranslation from "../locales/it.json";
-import esTranslation from "../locales/es.json";
-import hiTranslation from "../locales/hi.json";
-import bnTranslation from "../locales/bn.json";
-import jaTranslation from "../locales/ja.json";
-import viTranslation from "../locales/vi.json";
-import trTranslation from "../locales/tr.json";
-import heTranslation from "../locales/he.json";
-import arTranslation from "../locales/ar.json";
-import plTranslation from "../locales/pl.json";
-import nlTranslation from "../locales/nl.json";
-import svTranslation from "../locales/sv.json";
-import idTranslation from "../locales/id.json";
-import thTranslation from "../locales/th.json";
-import ukTranslation from "../locales/uk.json";
-import csTranslation from "../locales/cs.json";
-import roTranslation from "../locales/ro.json";
-import elTranslation from "../locales/el.json";
-import nbTranslation from "../locales/nb.json";
+import afTranslation from "../locales/translated/af_ZA.json";
+import arTranslation from "../locales/translated/ar_SA.json";
+import bnTranslation from "../locales/translated/bn_BD.json";
+import bgTranslation from "../locales/translated/bg_BG.json";
+import caTranslation from "../locales/translated/ca_ES.json";
+import csTranslation from "../locales/translated/cs_CZ.json";
+import daTranslation from "../locales/translated/da_DK.json";
+import deTranslation from "../locales/translated/de_DE.json";
+import elTranslation from "../locales/translated/el_GR.json";
+import esESTranslation from "../locales/translated/es_ES.json";
+import fiTranslation from "../locales/translated/fi_FI.json";
+import frTranslation from "../locales/translated/fr_FR.json";
+import heTranslation from "../locales/translated/he_IL.json";
+import hiTranslation from "../locales/translated/hi_IN.json";
+import huTranslation from "../locales/translated/hu_HU.json";
+import idTranslation from "../locales/translated/id_ID.json";
+import itTranslation from "../locales/translated/it_IT.json";
+import jaTranslation from "../locales/translated/ja_JP.json";
+import koTranslation from "../locales/translated/ko_KR.json";
+import nlTranslation from "../locales/translated/nl_NL.json";
+import noTranslation from "../locales/translated/no_NO.json";
+import plTranslation from "../locales/translated/pl_PL.json";
+import ptPTTranslation from "../locales/translated/pt_PT.json";
+import ptBRTranslation from "../locales/translated/pt_BR.json";
+import roTranslation from "../locales/translated/ro_RO.json";
+import ruTranslation from "../locales/translated/ru_RU.json";
+import srTranslation from "../locales/translated/sr_SP.json";
+import svSETranslation from "../locales/translated/sv_SE.json";
+import thTranslation from "../locales/translated/th_TH.json";
+import trTranslation from "../locales/translated/tr_TR.json";
+import ukTranslation from "../locales/translated/uk_UA.json";
+import viTranslation from "../locales/translated/vi_VN.json";
+import zhCNTranslation from "../locales/translated/zh_CN.json";
+import zhTWTranslation from "../locales/translated/zh_TW.json";

 i18n
  .use(LanguageDetector)
@@ -35,31 +44,40 @@ i18n
  .init({
    supportedLngs: [
      "en",
-      "zh",
-      "de",
-      "pt",
-      "ru",
-      "fr",
-      "ko",
-      "it",
-      "es",
-      "hi",
-      "bn",
-      "ja",
-      "vi",
-      "tr",
-      "he",
+      "af",
      "ar",
-      "pl",
-      "nl",
-      "sv",
-      "id",
-      "th",
-      "uk",
+      "bn",
+      "bg",
+      "ca",
      "cs",
-      "ro",
+      "da",
+      "de",
      "el",
-      "nb",
+      "es-ES",
+      "fi",
+      "fr",
+      "he",
+      "hi",
+      "hu",
+      "id",
+      "it",
+      "ja",
+      "ko",
+      "nl",
+      "no",
+      "pl",
+      "pt-PT",
+      "pt-BR",
+      "ro",
+      "ru",
+      "sr",
+      "sv-SE",
+      "th",
+      "tr",
+      "uk",
+      "vi",
+      "zh-CN",
+      "zh-TW",
    ],
    fallbackLng: "en",
    debug: false,
@@ -76,80 +94,107 @@ i18n
      en: {
        translation: enTranslation,
      },
-      zh: {
-        translation: zhTranslation,
-      },
-      de: {
-        translation: deTranslation,
-      },
-      pt: {
-        translation: ptTranslation,
-      },
-      ru: {
-        translation: ruTranslation,
-      },
-      fr: {
-        translation: frTranslation,
-      },
-      ko: {
-        translation: koTranslation,
-      },
-      it: {
-        translation: itTranslation,
-      },
-      es: {
-        translation: esTranslation,
-      },
-      hi: {
-        translation: hiTranslation,
-      },
-      bn: {
-        translation: bnTranslation,
-      },
-      ja: {
-        translation: jaTranslation,
-      },
-      vi: {
-        translation: viTranslation,
-      },
-      tr: {
-        translation: trTranslation,
-      },
-      he: {
-        translation: heTranslation,
+      af: {
+        translation: afTranslation,
      },
      ar: {
        translation: arTranslation,
      },
-      pl: {
-        translation: plTranslation,
+      bn: {
+        translation: bnTranslation,
      },
-      nl: {
-        translation: nlTranslation,
+      bg: {
+        translation: bgTranslation,
      },
-      sv: {
-        translation: svTranslation,
-      },
-      id: {
-        translation: idTranslation,
-      },
-      th: {
-        translation: thTranslation,
-      },
-      uk: {
-        translation: ukTranslation,
+      ca: {
+        translation: caTranslation,
      },
      cs: {
        translation: csTranslation,
      },
-      ro: {
-        translation: roTranslation,
+      da: {
+        translation: daTranslation,
+      },
+      de: {
+        translation: deTranslation,
      },
      el: {
        translation: elTranslation,
      },
-      nb: {
-        translation: nbTranslation,
+      "es-ES": {
+        translation: esESTranslation,
+      },
+      fi: {
+        translation: fiTranslation,
+      },
+      fr: {
+        translation: frTranslation,
+      },
+      he: {
+        translation: heTranslation,
+      },
+      hi: {
+        translation: hiTranslation,
+      },
+      hu: {
+        translation: huTranslation,
+      },
+      id: {
+        translation: idTranslation,
+      },
+      it: {
+        translation: itTranslation,
+      },
+      ja: {
+        translation: jaTranslation,
+      },
+      ko: {
+        translation: koTranslation,
+      },
+      nl: {
+        translation: nlTranslation,
+      },
+      no: {
+        translation: noTranslation,
+      },
+      pl: {
+        translation: plTranslation,
+      },
+      "pt-PT": {
+        translation: ptPTTranslation,
+      },
+      "pt-BR": {
+        translation: ptBRTranslation,
+      },
+      ro: {
+        translation: roTranslation,
+      },
+      ru: {
+        translation: ruTranslation,
+      },
+      sr: {
+        translation: srTranslation,
+      },
+      "sv-SE": {
+        translation: svSETranslation,
+      },
+      th: {
+        translation: thTranslation,
+      },
+      tr: {
+        translation: trTranslation,
+      },
+      uk: {
+        translation: ukTranslation,
+      },
+      vi: {
+        translation: viTranslation,
+      },
+      "zh-CN": {
+        translation: zhCNTranslation,
+      },
+      "zh-TW": {
+        translation: zhTWTranslation,
      },
    },

@@ -0,0 +1,5 @@
+export function getBasePath(): string {
+  const base = import.meta.env.BASE_URL || "/";
+  if (base === "./" || base === "/") return "";
+  return base.endsWith("/") ? base.slice(0, -1) : base;
+}
@@ -0,0 +1,120 @@
+type EventListener = (...args: any[]) => void;
+
+class DatabaseHealthMonitor {
+  private static instance: DatabaseHealthMonitor;
+  private dbHealthy: boolean = true;
+  private lastCheckTime: number = 0;
+  private checkInProgress: boolean = false;
+  private listeners: Map<string, EventListener[]> = new Map();
+  private consecutiveErrorTimer: ReturnType<typeof setTimeout> | null = null;
+  private confirmedUnhealthy: boolean = false;
+
+  private constructor() {}
+
+  static getInstance(): DatabaseHealthMonitor {
+    if (!DatabaseHealthMonitor.instance) {
+      DatabaseHealthMonitor.instance = new DatabaseHealthMonitor();
+    }
+    return DatabaseHealthMonitor.instance;
+  }
+
+  on(event: string, listener: EventListener): void {
+    if (!this.listeners.has(event)) {
+      this.listeners.set(event, []);
+    }
+    this.listeners.get(event)!.push(listener);
+  }
+
+  off(event: string, listener: EventListener): void {
+    const eventListeners = this.listeners.get(event);
+    if (eventListeners) {
+      const index = eventListeners.indexOf(listener);
+      if (index !== -1) {
+        eventListeners.splice(index, 1);
+      }
+    }
+  }
+
+  private emit(event: string, ...args: any[]): void {
+    const eventListeners = this.listeners.get(event);
+    if (eventListeners) {
+      eventListeners.forEach((listener) => listener(...args));
+    }
+  }
+
+  reportSessionExpired() {
+    this.emit("session-expired", { timestamp: Date.now() });
+  }
+
+  reportDatabaseError(error: any, _wasAuthenticated: boolean = false) {
+    const errorMessage = error?.response?.data?.error || error?.message || "";
+    const errorCode = error?.response?.data?.code || error?.code;
+
+    const isDatabaseError =
+      errorMessage.toLowerCase().includes("database") ||
+      errorMessage.toLowerCase().includes("sqlite") ||
+      errorMessage.toLowerCase().includes("drizzle") ||
+      errorCode === "DATABASE_ERROR" ||
+      errorCode === "DB_CONNECTION_FAILED";
+
+    const isBackendUnreachable =
+      errorCode === "ERR_NETWORK" ||
+      errorCode === "ECONNREFUSED" ||
+      (errorMessage.toLowerCase().includes("network error") &&
+        error?.response === undefined);
+
+    if (!(isDatabaseError || isBackendUnreachable)) {
+      return;
+    }
+
+    if (this.dbHealthy && !this.consecutiveErrorTimer) {
+      this.consecutiveErrorTimer = setTimeout(() => {
+        this.consecutiveErrorTimer = null;
+        if (this.dbHealthy) {
+          this.dbHealthy = false;
+          this.confirmedUnhealthy = true;
+          this.emit("database-connection-lost", {
+            error: errorMessage || "Backend server unreachable",
+            code: errorCode,
+            timestamp: Date.now(),
+          });
+        }
+      }, 10000);
+    }
+  }
+
+  reportDatabaseSuccess() {
+    this.clearErrorTimer();
+
+    if (this.confirmedUnhealthy) {
+      this.dbHealthy = true;
+      this.confirmedUnhealthy = false;
+      this.emit("database-connection-restored", {
+        timestamp: Date.now(),
+      });
+    } else if (!this.dbHealthy) {
+      this.dbHealthy = true;
+    }
+  }
+
+  private clearErrorTimer(): void {
+    if (this.consecutiveErrorTimer !== null) {
+      clearTimeout(this.consecutiveErrorTimer);
+      this.consecutiveErrorTimer = null;
+    }
+  }
+
+  isDatabaseHealthy(): boolean {
+    return this.dbHealthy;
+  }
+
+  reset() {
+    this.dbHealthy = true;
+    this.confirmedUnhealthy = false;
+    this.lastCheckTime = 0;
+    this.checkInProgress = false;
+    this.clearErrorTimer();
+  }
+}
+
+export const dbHealthMonitor = DatabaseHealthMonitor.getInstance();
@@ -0,0 +1,3 @@
+# DO NOT MODIFY TRANSLATED FILES DIRECTLY
+
+Instead, use Crowdsin. See [docs](https://docs.termix.site/translations).
@@ -1,5 +1,6 @@
 {
  "credentials": {
+    "credentials": "Credentials",
    "credentialsViewer": "Credentials Viewer",
    "manageYourSSHCredentials": "Manage your SSH credentials securely",
    "addCredential": "Add Credential",
@@ -44,6 +45,8 @@
    "passwordRequired": "Password is required",
    "sshKeyRequired": "SSH key is required",
    "credentialAddedSuccessfully": "Credential \"{{name}}\" added successfully",
+    "savingCredential": "Saving credential...",
+    "updatingCredential": "Updating credential...",
    "general": "General",
    "description": "Description",
    "folder": "Folder",
@@ -97,6 +100,10 @@
    "deploymentProcessDescription": "This will safely add the public key to the target host's ~/.ssh/authorized_keys file without overwriting existing keys. The operation is reversible.",
    "chooseHostToDeploy": "Choose a host to deploy to...",
    "deploying": "Deploying...",
+    "copyDeployCommand": "Copy Deploy Command",
+    "copyDeployCommandDescription": "Copy a shell command to manually add the public key to a host's authorized_keys file. Useful when password authentication is disabled.",
+    "deployCommandCopied": "Deploy command copied to clipboard",
+    "manualDeployInfo": "Paste this command in the target host's terminal (e.g., Proxmox console, IPMI, or physical access) to add the SSH key.",
    "name": "Name",
    "noHostsAvailable": "No hosts available",
    "noHostsMatchSearch": "No hosts match your search",
@@ -184,6 +191,32 @@
    "renameFolder": "Rename folder",
    "idLabel": "ID:"
  },
+  "quickConnect": {
+    "title": "Quick Connect",
+    "description": "Connect directly to a terminal or file manager session without saving a host configuration",
+    "ipAddress": "IP Address or Hostname",
+    "port": "Port",
+    "username": "Username",
+    "password": "Password",
+    "key": "SSH Private Key",
+    "keyPassword": "Key Password (Optional)",
+    "keyType": "Key Type",
+    "uploadFile": "Upload File",
+    "pasteKey": "Paste Key",
+    "credential": "Credential",
+    "overrideUsername": "Override Credential Username",
+    "overrideUsernameDesc": "Use a different username than the one stored in the credential",
+    "connectTerminal": "Connect to Terminal",
+    "connectFileManager": "Connect to File Manager",
+    "cancel": "Cancel",
+    "passwordRequired": "Password is required",
+    "keyRequired": "SSH key is required",
+    "credentialRequired": "Credential selection is required",
+    "connectionEstablished": "Connection established successfully",
+    "connectionFailed": "Failed to establish connection",
+    "autoDetect": "Auto Detect",
+    "authentication": "Authentication"
+  },
  "dragIndicator": {
    "error": "Error: {{error}}",
    "dragging": "Dragging {{fileName}}",
@@ -270,7 +303,9 @@
    "createFolder": "Create Folder",
    "editFolder": "Edit Folder",
    "editFolderDescription": "Customize your snippet folder",
-    "createFolderDescription": "Organize your snippets into folders"
+    "createFolderDescription": "Organize your snippets into folders",
+    "confirmExecution": "Execute \"{{name}}\"?",
+    "confirmExecutionDesc": "Are you sure you want to execute this snippet?"
  },
  "commandHistory": {
    "title": "History",
@@ -374,6 +409,7 @@
    "required": "Required",
    "optional": "Optional",
    "connect": "Connect",
+    "copied": "Copied",
    "connecting": "Connecting...",
    "creating": "Creating...",
    "clear": "Clear",
@@ -387,6 +423,7 @@
    "sshPath": "SSH Path",
    "localPath": "Local Path",
    "appName": "Termix",
+    "openInNewTab": "Open in New Tab",
    "resetSidebarWidth": "Reset sidebar width",
    "dragToResizeSidebar": "Drag to resize sidebar",
    "noAuthCredentials": "No authentication credentials available for this SSH host",
@@ -464,10 +501,13 @@
    "retry": "Retry",
    "checking": "Checking...",
    "checkingDatabase": "Checking database connection...",
+    "checkingAuthentication": "Checking authentication...",
+    "backendReconnected": "Server connection restored",
    "actions": "Actions",
    "remove": "Remove",
    "revoke": "Revoke",
-    "create": "Create"
+    "create": "Create",
+    "update": "Update"
  },
  "nav": {
    "home": "Home",
@@ -489,7 +529,12 @@
    "hostManager": "Host Manager",
    "cannotSplitTab": "Cannot split this tab",
    "tabNavigation": "Tab Navigation",
-    "hostTabTitle": "{{username}}@{{ip}}:{{port}}"
+    "hostTabTitle": "{{username}}@{{ip}}:{{port}}",
+    "copyPassword": "Copy Password",
+    "copySudoPassword": "Copy Sudo Password",
+    "passwordCopied": "Password copied to clipboard",
+    "sudoPasswordCopied": "Sudo password copied to clipboard",
+    "noPasswordAvailable": "No password available"
  },
  "admin": {
    "title": "Admin Settings",
@@ -537,6 +582,7 @@
    "userRegistration": "User Registration",
    "allowNewAccountRegistration": "Allow new account registration",
    "allowPasswordLogin": "Allow username/password login",
+    "allowPasswordReset": "Allow password reset via reset code",
    "missingRequiredFields": "Missing required fields: {{fields}}",
    "oidcConfigurationUpdated": "OIDC configuration updated successfully!",
    "failedToFetchOidcConfig": "Failed to fetch OIDC configuration",
@@ -777,6 +823,7 @@
  },
  "hosts": {
    "title": "Host Manager",
+    "hosts": "Hosts",
    "sshHosts": "SSH Hosts",
    "noHosts": "No SSH Hosts",
    "noHostsMessage": "You haven't added any SSH hosts yet. Click \"Add Host\" to get started.",
@@ -807,7 +854,7 @@
    "failedToImportJson": "Failed to import JSON file",
    "connectionDetails": "Connection Details",
    "organization": "Organization",
-    "ipAddress": "IP Address",
+    "ipAddress": "IP Address or Hostname",
    "port": "Port",
    "name": "Name",
    "username": "Username",
@@ -856,6 +903,13 @@
    "autoStartContainer": "Auto Start on Container Launch",
    "autoStartDesc": "Automatically start this tunnel when the container launches",
    "addConnection": "Add Tunnel Connection",
+    "tunnelType": "Tunnel Type",
+    "tunnelTypeLocal": "Local (-L)",
+    "tunnelTypeRemote": "Remote (-R)",
+    "tunnelTypeLocalDesc": "Forward local port to remote endpoint",
+    "tunnelTypeRemoteDesc": "Forward remote port to local machine",
+    "tunnelForwardDescriptionLocal": "This tunnel will forward traffic from local port {{sourcePort}} to port {{endpointPort}} on the endpoint machine.",
+    "tunnelForwardDescriptionRemote": "This tunnel will forward traffic from port {{sourcePort}} on the source machine (current connection details in general tab) to port {{endpointPort}} on the endpoint machine.",
    "sshpassRequired": "Sshpass Required For Password Authentication",
    "sshpassRequiredDesc": "For password authentication in tunnels, sshpass must be installed on the system.",
    "otherInstallMethods": "Other installation methods:",
@@ -863,19 +917,24 @@
    "or": "or",
    "centosRhelFedora": "CentOS/RHEL/Fedora",
    "macos": "macOS",
-    "windows": "Windows",
+    "windows": "Windows (WSL, no official binary)",
    "sshServerConfigRequired": "SSH Server Configuration Required",
    "sshServerConfigDesc": "For tunnel connections, the SSH server must be configured to allow port forwarding:",
    "gatewayPortsYes": "to bind remote ports to all interfaces",
    "allowTcpForwardingYes": "to enable port forwarding",
    "permitRootLoginYes": "if using root user for tunneling",
-    "editSshConfig": "Edit /etc/ssh/sshd_config and restart SSH: sudo systemctl restart sshd",
+    "editSshConfig": "Edit the SSH configuration file:",
+    "sshConfigPath": "/etc/ssh/sshd_config",
+    "restartSshService": "Then restart the SSH service:",
+    "restartSshCommand": "sudo systemctl restart sshd",
    "upload": "Upload",
    "authentication": "Authentication",
    "password": "Password",
    "key": "Key",
    "credential": "Credential",
    "none": "None",
+    "opkssh": "OPKSSH",
+    "opksshAuthDescription": "Prompts you for OPKSSH web-auth upon every connect. Your auth token will last for 24 hours until it must be renewed.",
    "selectCredential": "Select Credential",
    "selectCredentialPlaceholder": "Choose a credential...",
    "credentialRequired": "Credential is required when using credential authentication",
@@ -1046,6 +1105,7 @@
    "noneAuthTitle": "Keyboard-Interactive Authentication",
    "noneAuthDescription": "This authentication method will use keyboard-interactive authentication when connecting to the SSH server.",
    "noneAuthDetails": "Keyboard-interactive authentication allows the server to prompt you for credentials during connection. This is useful for servers that require multi-factor authentication or if you do not want to save credentials locally.",
+    "opksshAuthTitle": "OPKSSH Authentication",
    "forceKeyboardInteractive": "Force Keyboard-Interactive",
    "forceKeyboardInteractiveDesc": "Forces the use of keyboard-interactive authentication. This is sometimes required for servers that use Two-Factor Authentication (TOTP/2FA).",
    "overrideCredentialUsername": "Override Credential Username",
@@ -1106,6 +1166,19 @@
    "quickActionName": "Action name",
    "noSnippetFound": "No snippet found",
    "quickActionsOrder": "Quick action buttons will appear in the order listed above on the Server Stats page",
+    "sidebarCustomization": "Sidebar Button Customization",
+    "sidebarCustomizationDesc": "Choose which actions appear as quick buttons in the sidebar. Actions not shown as buttons will appear in the dropdown menu.",
+    "showTerminalInSidebar": "Show Terminal Button",
+    "showTerminalInSidebarDesc": "Display terminal as a quick button in the sidebar",
+    "showFileManagerInSidebar": "Show File Manager Button",
+    "showFileManagerInSidebarDesc": "Display file manager as a quick button in the sidebar",
+    "showTunnelInSidebar": "Show Tunnel Button",
+    "showTunnelInSidebarDesc": "Display tunnel management as a quick button in the sidebar",
+    "showDockerInSidebar": "Show Docker Button",
+    "showDockerInSidebarDesc": "Display docker management as a quick button in the sidebar",
+    "showServerStatsInSidebar": "Show Server Stats Button",
+    "showServerStatsInSidebarDesc": "Display server statistics as a quick button in the sidebar",
+    "atLeastOneActionRequired": "At least one enabled action must be shown in the sidebar",
    "advancedAuthSettings": "Advanced Authentication Settings",
    "sudoPasswordAutoFill": "Sudo Password Auto-Fill",
    "sudoPasswordAutoFillDesc": "Automatically offer to insert SSH password when sudo prompts for password",
@@ -1125,6 +1198,15 @@
    "addVariable": "Add Variable",
    "docker": "Docker",
    "openDocker": "Open Docker",
+    "copyFullScreenUrl": "Copy Full-Screen URL",
+    "fullScreenUrlCopied": "Full-screen URL copied to clipboard",
+    "failedToCopyUrl": "Failed to copy URL to clipboard",
+    "copyTerminalUrl": "Copy Terminal URL",
+    "copyFileManagerUrl": "Copy File Manager URL",
+    "copyTunnelUrl": "Copy Tunnel URL",
+    "copyServerStatsUrl": "Copy Server Stats URL",
+    "copyDockerUrl": "Copy Docker URL",
+    "fullScreenUrlTooltip": "Copy URL to open this app in full-screen mode",
    "notEnabled": "Docker is not enabled for this host. Enable it in Host Settings to use Docker features.",
    "validating": "Validating Docker...",
    "error": "Error",
@@ -1274,10 +1356,44 @@
    "totpCodeLabel": "Verification Code",
    "totpPlaceholder": "000000",
    "totpVerify": "Verify",
+    "warpgateAuthRequired": "Warpgate Authentication Required",
+    "warpgateSecurityKey": "Security Key",
+    "warpgateAuthUrl": "Authentication URL",
+    "warpgateOpenBrowser": "Open in Browser",
+    "warpgateContinue": "I've Completed Authentication",
+    "warpgateTimeout": "Warpgate authentication timeout. Please reconnect.",
+    "opksshAuthRequired": "OPKSSH Authentication Required",
+    "opksshAuthDescription": "Complete authentication in your browser to continue. This session will remain valid for 24 hours.",
+    "opksshAuthUrl": "Authentication URL",
+    "opksshOpenBrowser": "Open Browser to Authenticate",
+    "opksshWaitingForAuth": "Waiting for authentication in browser...",
+    "opksshAuthenticating": "Processing authentication...",
+    "opksshTimeout": "Authentication timed out. Please try again.",
+    "opksshAuthFailed": "Authentication failed. Please check your credentials and try again.",
+    "opksshConfigMissing": "OPKSSH configuration not found. Please create ~/.opk/config.yml with your OIDC provider settings. See documentation: https://github.com/openpubkey/opkssh#configuration",
    "sudoPasswordPopupTitle": "Insert Password?",
    "sudoPasswordPopupHint": "Press Enter to insert, Esc to dismiss",
    "sudoPasswordPopupConfirm": "Insert",
-    "sudoPasswordPopupDismiss": "Dismiss"
+    "sudoPasswordPopupDismiss": "Dismiss",
+    "websocketAbnormalClose": "Connection closed unexpectedly. This may be due to a reverse proxy or SSL configuration issue. Please check server logs.",
+    "totpInvalid": "Invalid code. Please try again.",
+    "authMethodFallback": "{{method}} authentication failed. Trying alternative method...",
+    "authenticationRequired": "Authentication required",
+    "connectionLogTitle": "Connection Log",
+    "connectionLogCopy": "Copy logs to clipboard",
+    "connectionLogClear": "Clear logs",
+    "connectionLogEmpty": "No connection logs yet",
+    "connectionLogConnecting": "Connecting to host...",
+    "connectionLogCopied": "Connection logs copied to clipboard",
+    "connectionLogCopyFailed": "Failed to copy logs to clipboard",
+    "allAuthMethodsFailed": "All authentication methods failed. Please check your credentials.",
+    "methodNotSupported": "Server does not support {{method}} authentication. Available methods: {{available}}",
+    "retryWithMethod": "Retry with {{method}}",
+    "automaticFallback": "Automatically trying {{method}} authentication...",
+    "totpTimeout": "TOTP verification timeout. Please reconnect.",
+    "passwordTimeout": "Password verification timeout. Please reconnect.",
+    "connectionRejected": "Connection rejected by server. Please check your authentication and network configuration.",
+    "hostKeyRejected": "SSH host key verification rejected. Connection cancelled."
  },
  "fileManager": {
    "title": "File Manager",
@@ -1360,6 +1476,12 @@
    "itemDeletedSuccessfully": "{{type}} deleted successfully",
    "itemsDeletedSuccessfully": "{{count}} items deleted successfully",
    "failedToDeleteItems": "Failed to delete items",
+    "sudoPasswordRequired": "Administrator Password Required",
+    "enterSudoPassword": "Enter sudo password to continue this operation",
+    "sudoPassword": "Sudo password",
+    "sudoOperationFailed": "Sudo operation failed",
+    "sudoAuthFailed": "Sudo authentication failed",
+    "deleteOperation": "Delete files/folders",
    "dragFilesToUpload": "Drop files here to upload",
    "emptyFolder": "This folder is empty",
    "itemCount": "{{count}} items",
@@ -1564,9 +1686,11 @@
    "fileTooLarge": "File too large: {{error}}",
    "sshConnectionFailed": "SSH connection failed. Please check your connection to {{name}} ({{ip}}:{{port}})",
    "loadFileFailed": "Failed to load file: {{error}}",
+    "connecting": "Connecting...",
    "connectedSuccessfully": "Connected successfully",
    "totpVerificationFailed": "TOTP verification failed",
-    "sshConnectionFailed": "SSH connection failed. Please check your connection to {{name}} ({{ip}}:{{port}})",
+    "warpgateVerificationFailed": "Warpgate authentication failed",
+    "authenticationFailed": "Authentication failed",
    "verificationCodePrompt": "Verification code:",
    "newFolderDefault": "NewFolder",
    "newFileDefault": "NewFile.txt",
@@ -1673,6 +1797,8 @@
    "refreshStatus": "Refresh Status",
    "fileManagerAlreadyOpen": "File Manager already open for this host",
    "openFileManager": "Open File Manager",
+    "connecting": "Connecting...",
+    "connectionFailed": "Failed to connect to server",
    "cpuCores_one": "{{count}} CPU",
    "cpuCores_other": "{{count}} CPUs",
    "naCpus": "N/A CPU(s)",
@@ -1731,7 +1857,34 @@
    "executingQuickAction": "Executing {{name}}...",
    "quickActionSuccess": "{{name}} completed successfully",
    "quickActionFailed": "{{name}} failed",
-    "quickActionError": "Failed to execute {{name}}"
+    "quickActionError": "Failed to execute {{name}}",
+    "ports": {
+      "title": "Listening Ports",
+      "protocol": "Protocol",
+      "port": "Port",
+      "address": "Address",
+      "state": "State",
+      "process": "Process",
+      "noData": "No listening ports data"
+    },
+    "firewall": {
+      "title": "Firewall",
+      "active": "Active",
+      "inactive": "Inactive",
+      "notDetected": "Not Detected",
+      "policy": "Policy",
+      "rules": "rules",
+      "noRules": "No rules",
+      "noData": "No firewall data available",
+      "action": "Action",
+      "protocol": "Proto",
+      "port": "Port",
+      "source": "Source",
+      "accept": "ACCEPT",
+      "drop": "DROP",
+      "reject": "REJECT",
+      "anywhere": "Anywhere"
+    }
  },
  "auth": {
    "tagline": "SSH SERVER MANAGER",
@@ -1843,6 +1996,20 @@
    "passwordResetSuccess": "Password Reset Successful",
    "passwordResetSuccessDesc": "Your password has been reset successfully. You can now log in with your new password."
  },
+  "hostKey": {
+    "verifyNewHost": "Verify SSH Host Key",
+    "keyChangedWarning": "SSH Host Key Changed",
+    "firstConnectionTitle": "First time connecting to this host",
+    "firstConnectionDescription": "The authenticity of this host cannot be established. Verify the fingerprint matches what you expect.",
+    "keyChangedDescription": "The host key for this server has changed since your last connection. This could indicate a security issue.",
+    "previousKey": "Previous Key",
+    "newFingerprint": "New Fingerprint",
+    "fingerprint": "Fingerprint",
+    "verifyInstructions": "If you trust this host, click Accept to continue and save this fingerprint for future connections.",
+    "securityWarning": "Security Warning",
+    "acceptAndContinue": "Accept & Continue",
+    "acceptNewKey": "Accept New Key & Continue"
+  },
  "errors": {
    "notFound": "Page not found",
    "unauthorized": "Unauthorized access",
@@ -1873,7 +2040,11 @@
    "emailExists": "Email already exists",
    "loadFailed": "Failed to load data",
    "saveError": "Failed to save",
-    "sessionExpired": "Session expired - please log in again"
+    "sessionExpired": "Session expired - please log in again",
+    "totpRateLimited": "Rate limited: Too many TOTP verification attempts. Please try again later.",
+    "totpRateLimitedWithTime": "Rate limited: Too many TOTP verification attempts. Please wait {{time}} seconds before trying again.",
+    "resetCodeRateLimited": "Rate limited: Too many verification attempts. Please try again later.",
+    "resetCodeRateLimitedWithTime": "Rate limited: Too many verification attempts. Please wait {{time}} seconds before trying again."
  },
  "messages": {
    "saveSuccess": "Saved successfully",
@@ -1931,6 +2102,11 @@
    "terminalSettings": "Terminal",
    "hostSidebarSettings": "Host & Sidebar",
    "snippetsSettings": "Snippets",
+    "confirmSnippetExecution": "Confirm Snippet Execution",
+    "confirmSnippetExecutionDesc": "Show confirmation dialog before executing snippets",
+    "updateSettings": "Updates",
+    "disableUpdateCheck": "Disable Update Check",
+    "disableUpdateCheckDesc": "Stop checking for new versions on startup and dashboard. Reduces network requests.",
    "currentPassword": "Current Password",
    "passwordChangedSuccess": "Password changed successfully! Please log in again.",
    "failedToChangePassword": "Failed to change password. Please check your current password and try again.",
@@ -1939,14 +2115,16 @@
    "themeDark": "Dark",
    "themeSystem": "System",
    "appearanceDesc": "Select the color theme for the application",
-    "terminalSyntaxHighlightingDesc": "Automatically highlight commands, paths, IPs, and log levels in terminal output"
+    "terminalSyntaxHighlightingDesc": "Automatically highlight commands, paths, IPs, and log levels in terminal output",
+    "enableCommandPaletteShortcut": "Enable Command Palette Shortcut",
+    "enableCommandPaletteShortcutDesc": "Double-tap left Shift to open the Command Palette for quick access to hosts"
  },
  "user": {
    "failedToLoadVersionInfo": "Failed to load version information"
  },
  "placeholders": {
    "enterCode": "000000",
-    "ipAddress": "127.0.0.1",
+    "ipAddress": "192.168.1.1 or example.com",
    "port": "22",
    "maxRetries": "3",
    "retryInterval": "10",
@@ -2134,6 +2312,7 @@
  },
  "dashboard": {
    "title": "Dashboard",
+    "loading": "Loading dashboard...",
    "github": "GitHub",
    "support": "Support",
    "discord": "Discord",
@@ -2163,7 +2342,88 @@
    "noServerData": "No server data available",
    "cpu": "CPU",
    "ram": "RAM",
-    "notAvailable": "N/A"
+    "notAvailable": "N/A",
+    "customizeLayout": "Customize Dashboard",
+    "dashboardSettings": "Dashboard Settings",
+    "enableDisableCards": "Enable/Disable Cards",
+    "resetLayout": "Reset to Default",
+    "serverOverviewCard": "Server Overview",
+    "recentActivityCard": "Recent Activity",
+    "networkGraphCard": "Network Graph",
+    "networkGraph": "Network Graph",
+    "quickActionsCard": "Quick Actions",
+    "serverStatsCard": "Server Stats"
+  },
+  "networkGraph": {
+    "title": "Network Graph",
+    "addHost": "Add Host",
+    "addGroup": "Add Group",
+    "addLink": "Add Link",
+    "deleteSelected": "Delete Selected",
+    "zoomIn": "Zoom In",
+    "zoomOut": "Zoom Out",
+    "resetView": "Reset View",
+    "exportJson": "Export JSON",
+    "importJson": "Import JSON",
+    "selectHost": "Select Host",
+    "chooseHost": "Choose a host...",
+    "parentGroup": "Parent Group",
+    "noGroup": "No Group",
+    "groupName": "Group Name",
+    "color": "Color",
+    "source": "Source",
+    "target": "Target",
+    "moveToGroup": "Move to Group",
+    "selectGroup": "Select group...",
+    "addConnection": "Add Connection",
+    "hostDetails": "Host Details",
+    "connectToHost": "Connect to Host",
+    "openTerminal": "Open Terminal",
+    "openFileManager": "Open File Manager",
+    "openTunnel": "Open Tunnels",
+    "openDocker": "Open Docker",
+    "openServerStats": "Open Server Details",
+    "moveToGroupAction": "Move to Group",
+    "removeFromGroup": "Remove from Group",
+    "addHostHere": "Add Host Here",
+    "editGroup": "Edit Group",
+    "delete": "Delete",
+    "cancel": "Cancel",
+    "add": "Add",
+    "create": "Create",
+    "update": "Update",
+    "move": "Move",
+    "connect": "Connect",
+    "close": "Close",
+    "createGroup": "Create Group",
+    "noAvailableHosts": "No available hosts",
+    "selectSourcePlaceholder": "Select Source...",
+    "selectTargetPlaceholder": "Select Target...",
+    "invalidFile": "Invalid File",
+    "hostAlreadyExists": "Host is already in the topology",
+    "sourceTargetMustDiffer": "Source and target must be different",
+    "connectionExists": "Connection already exists",
+    "unknown": "Unknown",
+    "name": "Name",
+    "ip": "IP",
+    "status": "Status",
+    "id": "ID",
+    "failedToLoadData": "Failed to load network topology data",
+    "failedToAddNode": "Failed to add node",
+    "sourceDifferentFromTarget": "Source and target must be different",
+    "exportJSON": "Export JSON",
+    "importJSON": "Import JSON",
+    "searchHost": "Search hosts...",
+    "noHostFound": "No hosts found",
+    "searchGroup": "Search groups...",
+    "noGroupFound": "No groups found",
+    "searchNode": "Search nodes...",
+    "noNodeFound": "No nodes found",
+    "terminal": "Terminal",
+    "fileManager": "File Manager",
+    "tunnel": "Tunnel",
+    "docker": "Docker",
+    "serverStats": "Server Stats"
  },
  "rbac": {
    "shareHost": "Share Host",
@@ -2356,9 +2616,15 @@
    "notEnabled": "Docker is not enabled for this host",
    "validating": "Validating Docker...",
    "connectingToHost": "Connecting to host...",
+    "connecting": "Connecting...",
    "error": "Error",
    "errorCode": "Error code: {{code}}",
    "version": "Docker {{version}}",
+    "connectionFailed": "Failed to connect to Docker",
+    "totpVerificationFailed": "TOTP verification failed",
+    "warpgateVerificationFailed": "Warpgate verification failed",
+    "verificationCodePrompt": "Enter verification code",
+    "loadingContainers": "Loading containers...",
    "containerStarted": "Container {{name}} started",
    "failedToStartContainer": "Failed to start container {{name}}",
    "containerStopped": "Container {{name}} stopped",
@@ -2422,6 +2688,7 @@
    "authenticationRequired": "Authentication required",
    "verificationCodePrompt": "Enter verification code",
    "totpVerificationFailed": "TOTP verification failed. Please try again.",
+    "warpgateVerificationFailed": "Warpgate authentication failed. Please try again.",
    "connectedTo": "Connected to {{containerName}}",
    "disconnected": "Disconnected",
    "consoleError": "Console error",
@@ -2443,7 +2710,51 @@
    "logs": "Logs",
    "stats": "Stats",
    "consoleTab": "Console",
-    "startContainerToAccess": "Start the container to access the console"
+    "startContainerToAccess": "Start the container to access the console",
+    "log": {
+      "connecting": "Connecting to Docker host...",
+      "authStarted": "Resolving authentication credentials...",
+      "totpRequired": "TOTP verification required",
+      "warpgateRequired": "Warpgate authentication required",
+      "sessionCreated": "Docker SSH session established",
+      "sessionReady": "Ready for Docker operations",
+      "error": "Docker connection failed: {{error}}"
+    }
+  },
+  "stats": {
+    "log": {
+      "connecting": "Starting metrics collection...",
+      "existingSession": "Using existing metrics session",
+      "totpVerifying": "TOTP verification required",
+      "sessionEstablished": "Metrics session established",
+      "collecting": "Collecting server metrics",
+      "heartbeat": "Keeping connection alive",
+      "stopped": "Metrics collection stopped",
+      "error": "Metrics collection failed: {{error}}"
+    }
+  },
+  "tunnel": {
+    "log": {
+      "connecting": "Establishing tunnel connection...",
+      "sourceConnecting": "Connecting to source host {{host}}...",
+      "sourceConnected": "Connected to source host",
+      "endpointResolving": "Resolving endpoint host {{host}}...",
+      "endpointResolved": "Endpoint host resolved",
+      "forwarding": "Setting up port forwarding {{localPort}} → {{remotePort}}...",
+      "connected": "Tunnel established successfully",
+      "retrying": "Connection failed, retrying in {{countdown}}s (attempt {{attempt}}/{{max}})...",
+      "retryExhausted": "Max retry attempts reached",
+      "error": "Tunnel connection failed: {{error}}"
+    }
+  },
+  "sftp": {
+    "log": {
+      "connecting": "Connecting to SFTP server...",
+      "jumpHost": "Connecting via jump host {{host}}...",
+      "connected": "SFTP connection established",
+      "authFailed": "Authentication failed",
+      "error": "SFTP operation failed: {{error}}"
+    }
  },
  "theme": {
    "switchToLight": "Switch to Light",
--- a/Show More
+++ b/Show More