v26.10.0 (#1573)

* feat: optional auto reconnect for dropped ssh sessions (#1321)

* feat: tighter compact host rows with inline tags (#1325)

* feat: bring back the alert feed homepage widget

* feat: pick target terminals for snippets again

* feat: share button on connection tabs again

* feat: recent servers list when linking the desktop app

* feat: list the fixed app shortcuts in keyboard shortcuts

* fix: translate hardcoded toasts and drop em dashes from ui text

* fix: translate leftover hardcoded ui text

* fix: toolbar files button opens at the shell directory again

* fix: show the remote desktop note under connection origin again

* chore: openapi docs for host metrics manager routes

* chore: openapi docs for undocumented routes and fix two broken doc blocks

* fix: declare terminal.listSessions use for snippet targets

* revert: drop the alert feed widget, the notification center replaces it

* feat: restore the alert feed homepage widget

* fix: quick connect fills the host address from plugin auth editors like tailscale

* fix: docker container logs use the base background color

* chore: fix dependabot alerts and apply safe npm upgrades

* fix: proxmox stats tab reads its switch from plugin host settings

* fix: count plugin ssh logins toward host status and stop showing reachable as a warning

* fix: hide the built-in source pill in the host editor

* fix: host status shows online when the port answers and only warns on a failed login

* fix: drop the top border on the split layout menu

* fix: host defaults tabs sit where the host editor puts them and skip plugins with nothing to default

* fix: remote desktop auth method labels and notes for vnc and telnet

* fix: add description to the web endpoint enable switch

* fix: crowdin sync and pretranslate for plugin locales, run plugin tests on release

* feat: move telemetry out of core into a usage statistics plugin

* fix: recent activity card no longer cuts off host names early

* fix: remove duplicate top border on split screen menu

* fix: redesign session log player controls, fix tooltip overlap and drop dot separators

* fix: file manager and sftp text showing raw i18n keys

* fix: onboarding rerunning for existing users after upgrading

* fix: fleet detail buttons overflowing the sidebar

* fix: session log player scrolling off screen horizontally

* fix: network graph lag when adding hosts and on every render

* fix: maintenance index name, shared host read only view and badge polling

* fix: meeting tabs, workspace tab merging, rail panels as tabs and general ui lag

* chore: update release notes

* fix: remote desktop tabs reconnecting on every tab switch

* fix: build plugin sdk before linting in release workflow

* chore: lint, format, and bump version to 2.9.0

* chore: skip crowdin pre-translate in release for now

* chore: switch to calver, bump version to 26.10.0

* fix(sso): send the PKCE verifier for GitHub login (#1534)

* fix(remote-desktop): clip cursor overflow without disabling zoom (#1535)

* test(remote-desktop): preserve sessions beyond one hour (#1536)

* fix(hosts): expose controls for overflowing editor tabs (#1537)

* fix(hosts): expose controls for overflowing editor tabs

* test(hosts): mock resize observation in admin panel tests

* fix(status): skip TCP probes while host sessions are active (#1538)

* fix(database): batch session activity persistence (#1539)

* docs(api): describe cookie and API key authentication (#1540)

* fix(snippets): repair missing note column on SQLite upgrades (#1541)

* fix(docker): retain stored SSH credential association (#1543)

* fix(file-manager): render transfer toasts without plugin hooks (#1546)

* feat(hosts): keep compact row actions inline (#1547)

* fix(auth): allow retrying unavailable second-factor interfaces (#1549)

* fix(auth): reject unresolved legacy identity provisioning (#1550)

* fix(desktop): ship the plugin SDK inside Mac App Store builds (#1551)

* fix(tmux): pass full session info to the terminal's session picker (#1552)

The tmux.sessions service reduced detected sessions to bare names, but the
picker reads session.name, so every entry rendered blank and selecting one
sent an empty name, which created a new session instead of attaching.

* fix(ssh): read force keyboard-interactive as a boolean when resolving hosts (#1553)

The column holds the text "true"/"false", and the resolver passed it
through as-is. The string "false" is truthy, so the password provider
treated every saved host as forced keyboard-interactive and left the
password out. Jump hops are built straight from the resolved host, so a
password hop whose server doesn't offer keyboard-interactive failed with
"All configured authentication methods failed".

* fix(database): batch database saves for bulk host writes (#1554)

* fix(database): yield to the event loop between database saves

Each SQLite save serializes and encrypts the whole database into new
buffers, which V8 only releases once the event loop turns. Boot
migrations and bulk host import write plugin settings per host and per
key in an awaited loop, so hundreds of full copies piled up and the
container ran out of memory.

* fix(database): save once per bulk host write instead of once per row

On SQLite every repository write force-saves the whole database. Boot
plugin data migrations, host defaults materialization and the bulk
host routes write one row per host per setting, so they serialized and
encrypted the full database hundreds of times in a row.

DatabaseSaveTrigger.batched wraps a function so force saves made while
it runs collapse into a single save when it finishes. Nested scopes fold
into the outer one, and work that outlives its scope saves normally.

* feat(hosts): add instance-wide predefined tag suggestions (#1548)

* feat(hosts): add shared predefined tag suggestions

* style(hosts): format tag catalog routes

* test(database): advance fake timers past the save yield (#1555)

* fix(i18n): complete Simplified Chinese core and plugin translations (#1542)

* fix(i18n): complete Chinese onboarding and navigation labels

* fix(i18n): translate remaining Chinese core and plugin interfaces

* fix(i18n): translate host editor tab overflow controls

* fix(i18n): use consistent Chinese fleet terminology

* fix(i18n): localize hardcoded controls and plugin views

* fix(i18n): translate built-in homepage widget catalog

* test(homepage): follow translated timezone placeholder

* fix(i18n): translate plugin-provided homepage widgets

* fix(i18n): localize feature settings section titles

* fix: 2.8 oidc accounts unable to sign in after upgrading (#1381)

* fix: plugins losing the saved ssh login when copying a host (#1391)

* fix: fleets, proxmox and automations not getting the host sudo password

* fix: host imports running a defaults pass and metrics restart per host (#1384)

* fix: high cpu from status probes and full database saves on every sample (#1300)

* fix: user data export freezing the server (#1393)

* fix: op:// secret references rejected as ssh keys on credentials (#1394)

* fix: slow file deletes from the trash lookups on every delete (#1390)

* fix: add openapi docs and error handling to host tag routes

* test: compare download stream buffers directly so it stops timing out

* chore: drop em dash from host row comment

* chore: update release notes for 2.9.1

* feat(ai): add remote coding agent sessions for SSH hosts (#1545)

* feat(ai): add host coding agent sessions with configured providers

* Wait for agent initialization and shutdown before resuming sessions

* Keep Pi transcripts outside its configuration migration directory

* Cover Pi session directory separation

* Update core permission catalog expectations for remote agents

* Install remote agent runtimes from verified official sources

* Wait for the identity panel credentials request in its test

* Add scoped SSH forwarding setup for remote agents

* Verify forwarding setup through a fresh SSH connection

* Bound the SSH forwarding verification timeout

* Return the forwarding verification callback result

* fix(ai): support agent send and interrupt keyboard shortcuts

* feat(ai): add agent queues attachments worktrees and session recovery

* fix(ai): handle deleted workspace paths and duplicate status events

* fix(ai): accept file references in root workspaces

* fix(ai): refresh paused queues after agent errors

* fix(ai): store agent sessions in plugin tables and lock down OpenCode

Agent sessions lived in a single ctx.kv value holding up to 2000 events,
which passed the 256 KB kv limit within minutes of a normal run. Every
save after that failed, so history, nativeId, queue and archive changes
were lost and every event wrote a kv audit row.

Sessions, events and queued prompts now have their own tables. A running
agent appends events in batches at most once a second with a lazy save;
session and queue changes save immediately. Prompts, drafts and stored
event text are capped in UTF-8 bytes to fit MySQL TEXT. kv:own is no
longer requested.

The OpenCode server now requires a per-session password, so other local
accounts on the host cannot drive the agent through its loopback port.

* test(upgrade): include agent session tables in the reviewed upgrade SQL

* test: run the posix-only ai agent tests on linux only

* fix: restore space to add host tags and redesign predefined tags editor

* fix: host key silently accepted when the host is missing from the database (#1397)

* fix: clearer host login failed status label and fix its translations (#1396)

* chore: add host key and status label fixes to release notes

* fix: sso and ldap provider dialogs overflowing the screen and using mismatched toggles

* chore: increment ver

* fix(audit): store plugin entries with no acting user as a null user_id (#1556)

Plugin audit entries written outside a request used the literal "system"
as user_id. That column references users.id, so the insert was refused
(Postgres logs it as an FK violation) and the entry was silently dropped.
Write null instead and keep "system" / plugin:<id> in username.

* chore: add sso/ldap dialog and audit log fixes to release notes

* fix: tunnels and host settings missing from shared hosts on desktop

* fix: remote desktop logins missing from shared hosts on desktop

* fix: simplify host status to online/offline and keep it live without a refresh

* chore: sync Crowdin translations for 2.9.1

* fix: build docker frontend/backend natively to stop arm64 hang, build sdk before openapi

* chore: rework plugin readmes, json changelogs and standalone repo setup

* chore: move plugins to their own repos and drop the plugins folder

* chore(deps-dev): bump globals (#1560)

Bumps the dev-minor-updates group with 1 update: [globals](https://github.com/sindresorhus/globals).


Updates `globals` from 17.12.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.12.0...v17.13.0)

---
updated-dependencies:
- dependency-name: globals
  dependency-version: 17.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: drop the 2.8 columns, moves and aliases kept for a downgrade

* chore: remove the 2.9 finish list

* feat: port the demo redesign with Manage and Settings tabs

* chore: pin the plugin signing key and use TERMIX_PAT in workflows

* chore: rename the plugin sdk to @termix-ssh/plugin-sdk

* feat: add a publish workflow for the plugin sdk

* chore: cleanup

* fix: harden plugin sockets, public routes, prebuilt binaries and login fallback

* chore: add a 2.9.1 upgrade check for postgres and mysql

* fix: stop full database rewrites on every plugin db call

* fix: stop full database rewrites on every plugin db call

* fix: restore release video link in 2.9.2 notes

* fix: use TERMIX_PAT in workflows

* feat: pin the official plugins in the docker image

* feat: implement plugin management UI

* feat: shared list kit, settings search, rail order and ui consistency fixes

* chore: run all workflows on blacksmith runners

* chore: split dashboard quick actions into quarters and drop host status row lines

* fix: open plain settings from the profile button, navigation only from the rail menu

* feat: consent check, developer mode file installs, install counts and issue links for plugins

* feat: row detail options for hosts and credentials, open manage from sidebar header

* fix: unify connection failure screens and rebuild stale local plugins

* feat: dev:all runner for web, electron and docker with plugin hot reload, termix-plugin dev

* chore: clean up npm scripts, make npm run dev the full runner and drop concurrently

* fix: settle quick connect panel loads in tests so they stop flaking

* fix: stop the dev runner rebuilding plugins when windows reports file reads as changes

* chore: update the plugin sdk ui export snapshot

* feat: full screen onboarding with a plugin picker and per step versions

* feat: changelog.md release notes, v tags, plugin release notes and videos

* chore: add temp changelog

* chore: release the plugin sdk as 1.0.1

* feat: show only the latest plugin release notes and cap long ones

* chore: publish docker images to termix-ssh on ghcr and termixssh on docker hub

* chore: rename docker hub token secret to DOCKERHUB_BUGATTIGUY527_TOKEN

* chore: renew mac app store provisioning profile

* chore: drop docs job from release workflow

* chore: run sdk publish on github hosted runner

* chore: remove dependabot

* chore: general file cleanup

* chore: rewrite readme and taglines for plugin-based termix

* chore: drop optional from ai plugin row in readme

* feat: per-repo issue forms and prefilled bug reports instead of the support repo

* feat: add report a bug link to the your account settings section

* fix: open settings goes to the plugin's page and hides when it has none

* feat: show plugin features from the manifest on the plugin page

* fix: retry failed or blocked plugins on restart instead of leaving them disabled

* fix: refresh plugin settings after enabling a plugin and match select and disabled bar styling

* feat: request a feature link for plugins and use the bug form for unverified plugins

* feat: beta channels for core and plugins with one stable/beta release workflow

* fix(sync): resolve shared hosts for connect-only recipients (#1568)

* fix(ssh): accept full passwords in keyboard-interactive prompts (#1569)

* fix(ssh): normalize PKCS8 private keys before connecting (#1570)

* fix(sidebar): reclaim space from hidden folder actions (#1571)

* fix(hosts): display protocol credential usernames for non-SSH hosts (#1572)

* fix: ask for a push/TOTP menu choice as text instead of a push confirm

* fix: keep client tunnels open when one of their connections fails (Support#1417)

* fix: send plugin form uploads to the plugin's route (Support#1406, Support#1420)

* fix: add missing sync ids to old snippet tables so snippets sync again (Support#1419)

* fix: start the macOS local terminal when the shell or spawn helper is broken (Support#1418)

* fix: refresh cached plugin translations when only a translation changes (Support#1411)

* fix: import sshpk as a default so the backend starts under ESM

* feat: add a plugin sdk changelog and tag sdk releases, release 1.0.2

* fix: drop the ./ from the plugin sdk bin path so npm stops warning

* chore: name core and sdk releases Termix vX and Plugin SDK vX

* fix: lock the desktop backend to the app's own origin (GHSA-frx8-qqgg-7j7g)

* fix: trust devices by a server-issued token, not a client header (GHSA-6gr3-r7jx-wfmh)

* fix: keep global settings out of non-admin data exports (GHSA-v3vp-ffww-q7pw)

* fix: refuse sessionless tokens and keep the secrets file owner only

* feat: add TRUSTED_PROXIES to choose who nginx takes client IPs from (GHSA-7j7m-85p4-2cpm)

* chore: standardize repo setup files

* chore: remove unused knip config

* chore: add LICENSE and use Node 24 from .nvmrc

* chore: update translation guidance, only en.json needs editing

* feat: plugin docs and env manifest fields, in-app docs links, SDK 1.0.3

* fix: header separators render as borders and center the status divider

* fix: lighter confirm prompt overlay to stop lag when it opens

* fix: put plugin-only tailwind classes in core's utilities layer, SDK 1.0.4

* fix: dev stages local plugin builds on paths with spaces and builds them with the local SDK

* fix: keep plugin tailwind variants in core's layer so overrides keep their order

* fix: manage tab refetches before giving up on a host or credential it cannot find

* fix: tab buttons like share show as soon as the terminal is ready

* fix: folder rows no longer nest action buttons inside a button

* fix: repin remote-desktop after its 1.0.0 re-release

* chore: repin bundled plugins after the 1.0.0 re-release

* fix: recent activity rows use the same separator as host status

* feat: upload banner

* fix: reject expired sessions on sockets, api key desktop links and 192.0.0.0/24

* fix: plugin sdk 1.0.5 with optional ui peers, safer timeouts and validate checks

* fix: bundled plugins path for source runs and backend cleanup

* fix: load plugin strings on guest pages, plugin wording and drop unused keys

* fix: beta version stamping, homebrew cask bump, dockerignore and readme platforms

* docs: 26.10.0 changelog

* fix: current version in the version route example

* chore: stop pushing the release- docker tag

* feat: remove the donation reminder and its column

* docs: note the removed donation reminder

* fix: link server wizard always opens inline, onboarding card grows for it

* feat: plugin text columns are longtext on mysql so they are not capped at 64KB

* fix: linked desktops keep a plugin when its update from the server fails

* chore: default mobile download links to v tags

* fix: sso only accounts cannot sign in with a passkey or other local method

* feat: note in the plugins tab that community plugins are coming

* fix: plugin validate accepts beta versions

* chore: pin bundled plugins rebuilt on sdk 1.0.5

* fix: skip locale fetches for disabled plugins

* fix: show translated names for the built-in admin and user roles

* fix: show host keys as SHA256 fingerprints like ssh-keygen

* fix: host editor scrolls to a newly enabled protocol section

* fix: pass the host to dashboard host row plugins

* fix: plugin cards show dividers between author, version and category

* fix: refuse plugin archives with paths outside the plugin folder

* fix: theme picker shows one dropdown arrow

* fix: read activity and audit times as UTC so they show in local time

* fix: show the real error for a wrong password or code on plugin sign in

* fix: explain that external sign in needs Auto-create external accounts

* fix: clear leftover plugin unpack folders at startup

* fix: shared session links open for guests again

* fix: share panels no longer list yourself as a share target

* fix: a host update without an auth type keeps the saved password

* fix: guest pages get the tab ids a guest plugin registers

* fix: refuse a 2.8 database, which already had a plugins table

* fix: dashboard cards fit on a phone

* fix: desktop setup no longer asks to secure the local account

* fix: the desktop app keeps the desktop layout in a narrow window

* fix: the desktop app shows the rail and no phone bar in a narrow window

* fix: name every sync type in the Sync panel and pluralize the link prompt

* chore: update the sdk ui snapshot for the host key dialog

* fix: turning a plugin back on restarts the plugins it turned off

* fix: quick connect asks to trust the host key

* fix: revoking a manager also removes the shares they handed out

* fix: database export works for users with TOTP on (#1426)

* fix: rdp and vnc logins use the folder credential when none is picked (#1429)

* fix: imported hosts get status checks without a restart

* fix: re-pin bundled plugins after 1.0.0 re-release

* fix: re-pin bundled plugins after search bar fix

* chore: update app icon to smaller version

* chore: round the readme logo, keep square source for app icons

* feat: grid columns and table view in the plugins tab

* fix: match the host key copy button to the fingerprint height

* fix: use brand color for toggles in sync settings

* fix: re-pin bundled plugins after 1.0.0 re-release

* fix: web terminals failing auth behind a proxy that rewrites Host (Support#651)

* fix: re-pin snippets and termix-identity after 1.0.0 overwrite

* fix: re-pin file-manager after 1.0.0 overwrite

* fix: re-pin file-manager after 1.0.0 overwrite

* chore: remove Crowdin from the release workflow

* chore: remove crowdin config

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.commitlintrc.json

@@ -1,21 +1,6 @@
 {
   "extends": ["@commitlint/config-conventional"],
   "rules": {
-    "type-enum": [
-      2,
-      "always",
-      [
-        "feat",
-        "fix",
-        "docs",
-        "style",
-        "refactor",
-        "perf",
-        "test",
-        "chore",
-        "revert"
-      ]
-    ],
     "subject-case": [0]
   }
 }

.dockerignore

@@ -5,13 +5,22 @@ yarn-error.log*
 
 dist
 build
-.next
-.nuxt
+coverage
+release
 
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
+# Local data, secrets and editor state
+db
+old_db
+ssl
+uploads
+plugins
+.env
+.env.*
+.mcp.json
+.claude
+CLAUDE.md
+termix-plugin-signing.key
+*.tmxplug.sig
 
 .vscode
 .idea
@@ -29,64 +38,31 @@ Thumbs.db
 
 .git
 .gitignore
+.husky
 
 README.md
 CONTRIBUTING.md
+CHANGELOG.md
 LICENSE
 
-repo-images/
-
-uploads/
-
 electron/
 electron-builder.json
+Casks
+packaging
 
 *.log
 *.tmp
 *.temp
-
 logs
-*.log
-
 pids
 *.pid
 *.seed
 *.pid.lock
 
-coverage
-
 .nyc_output
-
-jspm_packages/
-
 .npm
-
 .eslintcache
-
-.rpt2_cache/
-.rts2_cache_cjs/
-.rts2_cache_es/
-.rts2_cache_umd/
-
-.node_repl_history
-
-*.tgz
-
-.yarn-integrity
-
 .cache
 .parcel-cache
-
-.next
-
-.nuxt
-
-.vuepress/dist
-
-.serverless
-
-.fusebox/
-
-.dynamodb/
-
-.tern-port
+*.tgz
+.node_repl_history

.editorconfig

@@ -1,14 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[*.{js,cjs,mjs,jsx,ts,tsx,json,css,scss,md,yml,yaml}]
-indent_style = space
-indent_size = 2
-
-[*.md]
-trim_trailing_whitespace = false

.gitattributes

@@ -1,22 +1,5 @@
 * text=auto eol=lf
 
-*.js text eol=lf
-*.cjs text eol=lf
-*.mjs text eol=lf
-*.jsx text eol=lf
-*.ts text eol=lf
-*.tsx text eol=lf
-*.json text eol=lf
-*.css text eol=lf
-*.scss text eol=lf
-*.html text eol=lf
-*.md text eol=lf
-*.yaml text eol=lf
-*.yml text eol=lf
-
-*.sh text eol=lf
-*.bash text eol=lf
-
 *.bat text eol=crlf
 *.cmd text eol=crlf
 *.ps1 text eol=crlf
@@ -25,10 +8,10 @@
 *.jpg binary
 *.jpeg binary
 *.gif binary
+*.webp binary
 *.ico binary
-*.svg binary
+*.icns binary
 *.woff binary
 *.woff2 binary
 *.ttf binary
 *.eot binary
-*.icns binary

.github/ISSUE_TEMPLATE/beta_feedback.yml

@@ -0,0 +1,75 @@
+name: Beta feedback
+description: A bug, rough edge or idea from a Termix beta
+labels: [beta]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for testing a beta. Short reports are fine. If you opened this from Termix, the version and setup are already filled in.
+  - type: input
+    id: termix-version
+    attributes:
+      label: Beta version
+      description: Shown in Settings under Updates, or your image tag.
+      placeholder: "e.g. 26.11.0-beta.2"
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: The bug, what felt off, or your idea. Screenshots help a lot.
+    validations:
+      required: true
+  - type: dropdown
+    id: regression
+    attributes:
+      label: Does this happen on the latest stable release?
+      options:
+        - "Not tested on stable"
+        - "Yes, it happens on stable too"
+        - "No, only on this beta"
+        - "Not a bug, just feedback"
+    validations:
+      required: false
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: As few steps as you can.
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: false
+  - type: textarea
+    id: beta-plugins
+    attributes:
+      label: Plugins on a beta
+      description: Filled in by Termix. One plugin and version per line.
+      render: text
+    validations:
+      required: false
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Browser or desktop app, OS, and how the server is installed.
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Errors from the browser console, `docker logs termix`, or the error Termix shows. This is shown as code, so no backticks needed.
+      render: text
+    validations:
+      required: false
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched open issues and this is not a duplicate
+          required: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,107 @@
+name: Bug report
+description: Something in Termix itself is broken
+labels: [bug]
+type: Bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. A maintainer reads every issue, even when there is no reply right away. We usually reply once there is a fix or a workaround.
+
+        If you came from **Report an issue** in Termix, your versions and environment are already filled in below.
+
+        Is it about a plugin (terminal, file manager, Docker, remote desktop and so on)? Report it on that plugin's repo instead. **Report an issue** on the plugin's page in Termix takes you there with your versions filled in.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Describe the bug. Screenshots help a lot.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: As few steps as you can.
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect?
+      description: What should have happened instead?
+    validations:
+      required: false
+  - type: input
+    id: termix-version
+    attributes:
+      label: Termix version
+      description: Shown in Settings under About, or in your User Profile.
+      placeholder: "e.g. 26.10.0"
+    validations:
+      required: true
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      description: Where do you see the problem?
+      options:
+        - "Web browser"
+        - "Desktop app (Windows)"
+        - "Desktop app (macOS)"
+        - "Desktop app (Linux)"
+        - "Mobile app (iOS)"
+        - "Mobile app (Android)"
+        - "Other"
+    validations:
+      required: true
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Server install
+      description: How is the Termix server installed?
+      options:
+        - "Docker"
+        - "Manual build"
+        - "Proxmox community script"
+        - "Desktop app (built-in server)"
+        - "Not sure"
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Browser and OS, plus anything special about your setup (reverse proxy, database, SSO).
+      placeholder: |
+        Web, Chrome on Windows. Behind nginx, Postgres.
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Errors from the browser console, `docker logs termix`, or the error Termix shows. This is shown as code, so no backticks needed.
+      render: text
+    validations:
+      required: false
+  - type: textarea
+    id: context
+    attributes:
+      label: Anything else?
+      description: Links, config, or anything that might help.
+    validations:
+      required: false
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched open and closed issues and this is not a duplicate
+          required: true
+        - label: I am on the latest version, or I said which version I am on
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,11 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Support Center
-    url: https://github.com/Termix-SSH/Support/issues
-    about: Report any feature requests or bugs in the support center
-  - name: Discord
+  - name: Problem with a plugin?
+    url: https://github.com/Termix-SSH/Termix#plugins
+    about: Each plugin has its own repo. Find it in this list, or use Report an issue on the plugin's page in Termix.
+  - name: Questions and chat
     url: https://discord.gg/jVQGdvHDrf
-    about: Official Termix Discord server for general discussion (not recommended for support)
+    about: Ask the community on Discord. Bugs and ideas belong in issues.
+  - name: Business or priority support
+    url: https://termix.site/contact
+    about: For teams that need a faster response. Contact us to discuss terms.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,41 @@
+name: Feature request
+description: Suggest an idea for Termix itself
+labels: [feature]
+type: Feature
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Is it about a plugin (terminal, file manager, Docker, remote desktop and so on)? Report it on that plugin's repo instead. **Report an issue** on the plugin's page in Termix takes you there with your versions filled in.
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the idea. Explain the problem first, then how you would solve it.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+      description: What are you trying to do, and what gets in the way today?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: What would you like?
+      description: Describe how it should work.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives
+      description: Anything you tried or considered instead.
+    validations:
+      required: false
+  - type: textarea
+    id: context
+    attributes:
+      label: Anything else?
+      description: Screenshots, mockups or links.
+    validations:
+      required: false

.github/dependabot.yml

@@ -1,83 +0,0 @@
-version: 2
-updates:
-  # npm dependencies (single root package.json, no workspaces)
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 15
-    labels:
-      - "dependencies"
-      - "npm"
-    commit-message:
-      prefix: "chore"
-      prefix-development: "chore"
-      include: "scope"
-    groups:
-      dev-patch-updates:
-        dependency-type: "development"
-        update-types:
-          - "patch"
-      dev-minor-updates:
-        dependency-type: "development"
-        update-types:
-          - "minor"
-      prod-patch-updates:
-        dependency-type: "production"
-        update-types:
-          - "patch"
-      prod-minor-updates:
-        dependency-type: "production"
-        update-types:
-          - "minor"
-      # Major bumps grouped so they land as a single reviewable PR instead of
-      # one-per-package noise. These often need manual follow-up (Electron,
-      # React, Vite, Tailwind, Express 5, etc.).
-      major-updates:
-        update-types:
-          - "major"
-
-  # Docker base images (docker/Dockerfile + docker-compose / compose-dev)
-  - package-ecosystem: "docker"
-    directory: "/docker"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    labels:
-      - "dependencies"
-      - "docker"
-    commit-message:
-      prefix: "chore"
-      include: "scope"
-    groups:
-      docker-patch-updates:
-        update-types:
-          - "patch"
-      docker-minor-updates:
-        update-types:
-          - "minor"
-      docker-major-updates:
-        update-types:
-          - "major"
-
-  # GitHub Actions used across the workflows in .github/workflows
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    labels:
-      - "dependencies"
-      - "github-actions"
-    commit-message:
-      prefix: "ci"
-      include: "scope"
-    groups:
-      github-actions:
-        update-types:
-          - "patch"
-          - "minor"
-          - "major"

.github/funding.yml

@@ -1 +0,0 @@
-custom: https://donate.termix.site/

.github/pull_request_template.md

@@ -1,32 +0,0 @@
-# Overview
-
-_Short summary of what this PR does_
-
-- [ ] Added: ...
-- [ ] Updated: ...
-- [ ] Removed: ...
-- [ ] Fixed: ...
-
-# Changes Made
-
-_Detailed explanation of changes (if needed)_
-
-- ...
-
-# Related Issues
-
-_Link any issues this PR addresses_
-
-- Closes #ISSUE_NUMBER
-- Related to #ISSUE_NUMBER
-
-# Screenshots / Demos
-
-_(Optional: add before/after screenshots, GIFs, or console output)_
-
-# Checklist
-
-- [ ] Code follows project style guidelines
-- [ ] Supports mobile and desktop UI/app (if applicable)
-- [ ] I have read [Contributing.md](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)
-- [ ] This is not a translation request. See [docs](https://docs.termix.site/translations)

.github/workflows/dependabot-retarget.yml

@@ -1,157 +0,0 @@
-name: Retarget and Merge Dependabot PRs
-
-on:
-  schedule:
-    - cron: "0 6 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  retarget-and-merge:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
-
-      - name: Resolve newest dev branch
-        id: dev
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          REFS=$(gh api "repos/${{ github.repository }}/branches" --paginate -q '.[].name')
-          # The helper exits non-zero when no dev-X.Y.Z branch exists; treat that
-          # as "nothing to do" rather than a workflow failure.
-          if DEV_BRANCH=$(printf '%s\n' "$REFS" | node scripts/latest-dev-branch.cjs 2>/dev/null); then
-            echo "Newest dev branch: $DEV_BRANCH"
-            echo "branch=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
-          else
-            echo "No dev-X.Y.Z branch open; nothing to retarget."
-            echo "branch=" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Retarget and merge Dependabot PRs
-        if: ${{ steps.dev.outputs.branch != '' }}
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-          DEV_BRANCH: ${{ steps.dev.outputs.branch }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -uo pipefail
-
-          CONFLICT_LABEL="dependabot-rebase-requested"
-
-          # Ensure the bookkeeping label exists (no-op if it already does).
-          gh label create "$CONFLICT_LABEL" --repo "$REPO" \
-            --color "D93F0B" --description "Retarget workflow asked Dependabot to rebase a conflicting PR" \
-            2>/dev/null || true
-
-          # True if the PR already carries the conflict label.
-          has_conflict_label() {
-            gh pr view "$1" --repo "$REPO" --json labels \
-              -q '.labels[].name' | grep -qx "$CONFLICT_LABEL"
-          }
-
-          # Wait until GitHub has a definite mergeable verdict for a PR (it
-          # returns UNKNOWN while recomputing after a base change or a push).
-          # Echoes "<mergeable> <mergeStateStatus>".
-          wait_for_verdict() {
-            local pr="$1" mergeable state
-            for _ in $(seq 1 30); do
-              read -r mergeable state < <(gh pr view "$pr" --repo "$REPO" \
-                --json mergeable,mergeStateStatus \
-                -q '.mergeable + " " + .mergeStateStatus')
-              if [ "$mergeable" != "UNKNOWN" ] && [ "$state" != "UNKNOWN" ]; then
-                echo "$mergeable $state"
-                return 0
-              fi
-              sleep 20
-            done
-            echo "$mergeable $state"
-          }
-
-          # Phase 1: retarget every open Dependabot PR from main onto the dev
-          # branch. This kicks off a Dependabot rebase for each.
-          PR_NUMBERS=$(gh pr list --repo "$REPO" \
-            --author "app/dependabot" \
-            --base main \
-            --state open \
-            --json number -q '.[].number')
-
-          # Pick up PRs already sitting on the dev branch from a previous run too.
-          PR_NUMBERS="$PR_NUMBERS $(gh pr list --repo "$REPO" \
-            --author "app/dependabot" \
-            --base "$DEV_BRANCH" \
-            --state open \
-            --json number -q '.[].number')"
-
-          PR_NUMBERS=$(printf '%s\n' $PR_NUMBERS | sort -un)
-
-          if [ -z "$PR_NUMBERS" ]; then
-            echo "No open Dependabot PRs to process."
-            exit 0
-          fi
-
-          for PR in $PR_NUMBERS; do
-            BASE=$(gh pr view "$PR" --repo "$REPO" --json baseRefName -q .baseRefName)
-            if [ "$BASE" != "$DEV_BRANCH" ]; then
-              echo "Retargeting PR #$PR ($BASE -> $DEV_BRANCH)"
-              gh pr edit "$PR" --repo "$REPO" --base "$DEV_BRANCH"
-            fi
-          done
-
-          # Phase 2: merge one at a time. Each merge can make the remaining npm
-          # PRs stale, so re-check immediately before merging and rebase stragglers.
-          for PR in $PR_NUMBERS; do
-            echo "::group::PR #$PR"
-
-            read -r MERGEABLE STATE < <(wait_for_verdict "$PR")
-            echo "  mergeable=$MERGEABLE mergeStateStatus=$STATE"
-
-            # BEHIND = clean but needs the latest base; ask Dependabot to rebase
-            # and skip for now (next run merges it once it is up to date).
-            if [ "$STATE" = "BEHIND" ]; then
-              echo "  PR #$PR is behind $DEV_BRANCH; asking Dependabot to rebase."
-              gh pr comment "$PR" --repo "$REPO" --body "@dependabot rebase"
-              echo "::endgroup::"
-              continue
-            fi
-
-            # DIRTY / CONFLICTING = a real conflict. Try a rebase once (label it so
-            # we can tell next time); if it is STILL conflicting on a later run
-            # despite already being labelled, the rebase failed for good - close it
-            # so Dependabot reopens a fresh PR against the current dev branch.
-            if [ "$MERGEABLE" = "CONFLICTING" ] || [ "$STATE" = "DIRTY" ]; then
-              if has_conflict_label "$PR"; then
-                echo "  PR #$PR still conflicts after a prior rebase request; closing so Dependabot reopens it fresh."
-                gh pr close "$PR" --repo "$REPO" --delete-branch \
-                  --comment "Closing: this PR still conflicts with $DEV_BRANCH after a rebase attempt (its changes are likely already merged). Dependabot will reopen a fresh PR computed against the current $DEV_BRANCH."
-              else
-                echo "  PR #$PR conflicts with $DEV_BRANCH; requesting a rebase and labelling it."
-                gh pr edit "$PR" --repo "$REPO" --add-label "$CONFLICT_LABEL"
-                gh pr comment "$PR" --repo "$REPO" --body "@dependabot rebase"
-              fi
-              echo "::endgroup::"
-              continue
-            fi
-
-            # A clean PR that was previously flagged has recovered - drop the label.
-            if has_conflict_label "$PR"; then
-              gh pr edit "$PR" --repo "$REPO" --remove-label "$CONFLICT_LABEL" || true
-            fi
-
-            echo "  Squash-merging PR #$PR"
-            if gh pr merge "$PR" --repo "$REPO" --squash --admin; then
-              echo "  Merged PR #$PR"
-              # Give GitHub a moment to mark the now-stale siblings BEHIND.
-              sleep 15
-            else
-              echo "  Could not merge PR #$PR now; it will be retried next run."
-            fi
-
-            echo "::endgroup::"
-          done

.github/workflows/docker.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to build (e.g., 1.8.0)"
+        description: "Version to build (e.g., 26.10.0)"
         required: true
       build_type:
         description: "Build type"
@@ -13,15 +13,20 @@ on:
         type: choice
         options:
           - Development
+          - Beta
           - Production
+      source_ref:
+        description: "Git ref/SHA to build (defaults to the workflow ref)"
+        required: false
+        default: ""
   workflow_call:
     inputs:
       version:
-        description: "Version to build (e.g., 1.8.0)"
+        description: "Version to build (e.g., 26.10.0)"
         required: true
         type: string
       build_type:
-        description: "Build type (Development or Production)"
+        description: "Build type (Development, Beta or Production)"
         required: true
         type: string
       dry_run:
@@ -29,23 +34,42 @@ on:
         required: false
         type: boolean
         default: false
+      source_ref:
+        description: "Git ref/SHA to build"
+        required: false
+        type: string
+        default: ""
 
 jobs:
   build:
     runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 20
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.source_ref || github.ref }}
           fetch-depth: 1
 
+      - name: Resolve source revision
+        run: |
+          echo "SOURCE_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+          echo "BUILD_CREATED=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
+
+      # The image reads its version from package.json, so a beta has to say so.
+      - name: Stamp beta version
+        if: ${{ inputs.build_type == 'Beta' }}
+        run: node scripts/sync-version.cjs --version "${{ inputs.version }}"
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
         with:
           platforms: linux/amd64,linux/arm64
 
       - name: Setup Docker Buildx
-        uses: useblacksmith/setup-docker-builder@v1
+        uses: useblacksmith/setup-docker-builder@v2
+        with:
+          cache-key: termix-ssh/termix
 
       - name: Determine tags
         id: tags
@@ -57,19 +81,23 @@ jobs:
           ALL_TAGS=()
 
           if [ "$BUILD_TYPE" = "Production" ]; then
-            TAGS+=("release-$VERSION" "$VERSION" "latest")
-            for tag in "${TAGS[@]}"; do
-              ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
-              ALL_TAGS+=("docker.io/bugattiguy527/termix:$tag")
-            done
+            TAGS+=("$VERSION" "latest")
+          elif [ "$BUILD_TYPE" = "Beta" ]; then
+            TAGS+=("beta" "$VERSION")
           else
             TAGS+=("dev-$VERSION")
-            for tag in "${TAGS[@]}"; do
-              ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
-            done
           fi
 
+          for tag in "${TAGS[@]}"; do
+            ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
+            ALL_TAGS+=("ghcr.io/termix-ssh/termix:$tag")
+            if [ "$BUILD_TYPE" != "Development" ]; then
+              ALL_TAGS+=("docker.io/bugattiguy527/termix:$tag")
+            fi
+          done
+
           echo "ALL_TAGS=$(IFS=,; echo "${ALL_TAGS[*]}")" >> $GITHUB_ENV
+          echo "TAGS=${TAGS[*]}" >> $GITHUB_ENV
 
       - name: Login to GHCR
         if: ${{ !inputs.dry_run }}
@@ -77,14 +105,14 @@ jobs:
         with:
           registry: ghcr.io
           username: lukegus
-          password: ${{ secrets.GHCR_TOKEN }}
+          password: ${{ secrets.TERMIX_PAT }}
 
-      - name: Login to Docker Hub (prod only)
-        if: ${{ inputs.build_type == 'Production' && !inputs.dry_run }}
+      - name: Login to Docker Hub (prod and beta only)
+        if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}
         uses: docker/login-action@v4
         with:
           username: bugattiguy527
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          password: ${{ secrets.DOCKERHUB_BUGATTIGUY527_TOKEN }}
 
       - name: Build and push multi-arch image
         uses: useblacksmith/build-push-action@v2
@@ -98,12 +126,30 @@ jobs:
             BUILDKIT_CONTEXT_KEEP_GIT_DIR=1
           labels: |
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+            org.opencontainers.image.revision=${{ env.SOURCE_SHA }}
+            org.opencontainers.image.created=${{ env.BUILD_CREATED }}
           outputs: ${{ inputs.dry_run && 'type=cacheonly' || 'type=registry,compression=zstd' }}
 
+      - name: Login to Docker Hub as termixssh
+        id: termix_hub
+        if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}
+        env:
+          TOKEN: ${{ secrets.DOCKERHUB_TERMIXSSH_TOKEN }}
+        run: |
+          if [ -z "$TOKEN" ]; then
+            echo "DOCKERHUB_TERMIXSSH_TOKEN is not set, skipping docker.io/termixssh"
+            exit 0
+          fi
+          echo "$TOKEN" | docker login docker.io --username termixssh --password-stdin
+          echo "ready=true" >> "$GITHUB_OUTPUT"
+
+      - name: Copy image to docker.io/termixssh
+        if: ${{ steps.termix_hub.outputs.ready == 'true' }}
+        run: |
+          for tag in $TAGS; do
+            docker buildx imagetools create --tag "docker.io/termixssh/termix:$tag" "ghcr.io/termix-ssh/termix:$tag"
+          done
+
       - name: Cleanup Docker
         if: always()
         run: |

.github/workflows/donation-goal.yml

@@ -1,126 +0,0 @@
-name: Donation Goal Badge
-
-on:
-  schedule:
-    - cron: "0 */6 * * *"
-  workflow_dispatch:
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Generate donation goal SVG
-        run: |
-          set -e
-
-          EVM_ADDRESS="0x83eA1Db55cc6E34fCD11Da2b7849621af67b6E34"
-          BTC_ADDRESS="bc1qrxc3vpnl6qhh9p8akjmjukcgmgmq852ua64h05"
-          SOL_ADDRESS="T4BF5ioySVUjwaPNw4Sdu7oK8SXLxgQRcMaTQ6YJ2UJ"
-          DOCS_SNAPSHOT_URL="https://raw.githubusercontent.com/Termix-SSH/Termix-Docs/main/static/donation-snapshot.json"
-          MONTHLY_GOAL=750
-
-          # Fetch crypto prices
-          PRICES=$(curl -sf "https://api.coingecko.com/api/v3/simple/price?ids=ethereum,bitcoin,solana&vs_currencies=usd" || echo '{}')
-          ETH_PRICE=$(echo "$PRICES" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('ethereum',{}).get('usd',0))" 2>/dev/null || echo 0)
-          BTC_PRICE=$(echo "$PRICES" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('bitcoin',{}).get('usd',0))" 2>/dev/null || echo 0)
-          SOL_PRICE=$(echo "$PRICES" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('solana',{}).get('usd',0))" 2>/dev/null || echo 0)
-
-          # Fetch live balances
-          ETH_RAW=$(curl -sf "https://eth.blockscout.com/api/v2/addresses/${EVM_ADDRESS}" || echo '{"coin_balance":"0"}')
-          ETH_BAL=$(echo "$ETH_RAW" | python3 -c "import sys,json; d=json.load(sys.stdin); print(int(d.get('coin_balance','0')) / 1e18)" 2>/dev/null || echo 0)
-
-          BASE_RAW=$(curl -sf "https://base.blockscout.com/api/v2/addresses/${EVM_ADDRESS}" || echo '{"coin_balance":"0"}')
-          BASE_BAL=$(echo "$BASE_RAW" | python3 -c "import sys,json; d=json.load(sys.stdin); print(int(d.get('coin_balance','0')) / 1e18)" 2>/dev/null || echo 0)
-
-          BTC_RAW=$(curl -sf "https://blockstream.info/api/address/${BTC_ADDRESS}" || echo '{"chain_stats":{"funded_txo_sum":0,"spent_txo_sum":0}}')
-          BTC_BAL=$(echo "$BTC_RAW" | python3 -c "import sys,json; d=json.load(sys.stdin); s=d.get('chain_stats',{}); print((s.get('funded_txo_sum',0)-s.get('spent_txo_sum',0))/1e8)" 2>/dev/null || echo 0)
-
-          SOL_RAW=$(curl -sf -X POST "https://api.mainnet-beta.solana.com" \
-            -H "Content-Type: application/json" \
-            -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getBalance\",\"params\":[\"${SOL_ADDRESS}\"]}" || echo '{"result":{"value":0}}')
-          SOL_BAL=$(echo "$SOL_RAW" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('value',0)/1e9)" 2>/dev/null || echo 0)
-
-          # Fetch snapshot baseline from docs repo
-          SNAPSHOT=$(curl -sf "$DOCS_SNAPSHOT_URL" || echo '{"ethBal":0,"baseBal":0,"btcBal":0,"solBal":0}')
-          SNAP_ETH=$(echo "$SNAPSHOT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('ethBal',0))" 2>/dev/null || echo 0)
-          SNAP_BASE=$(echo "$SNAPSHOT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('baseBal',0))" 2>/dev/null || echo 0)
-          SNAP_BTC=$(echo "$SNAPSHOT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('btcBal',0))" 2>/dev/null || echo 0)
-          SNAP_SOL=$(echo "$SNAPSHOT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('solBal',0))" 2>/dev/null || echo 0)
-
-          export ETH_BAL BASE_BAL BTC_BAL SOL_BAL SNAP_ETH SNAP_BASE SNAP_BTC SNAP_SOL ETH_PRICE BTC_PRICE SOL_PRICE MONTHLY_GOAL
-
-          python3 - <<'PYEOF'
-          import os, math
-
-          eth_bal   = float(os.environ.get('ETH_BAL', 0))
-          base_bal  = float(os.environ.get('BASE_BAL', 0))
-          btc_bal   = float(os.environ.get('BTC_BAL', 0))
-          sol_bal   = float(os.environ.get('SOL_BAL', 0))
-          snap_eth  = float(os.environ.get('SNAP_ETH', 0))
-          snap_base = float(os.environ.get('SNAP_BASE', 0))
-          snap_btc  = float(os.environ.get('SNAP_BTC', 0))
-          snap_sol  = float(os.environ.get('SNAP_SOL', 0))
-          eth_price = float(os.environ.get('ETH_PRICE', 0))
-          btc_price = float(os.environ.get('BTC_PRICE', 0))
-          sol_price = float(os.environ.get('SOL_PRICE', 0))
-          goal      = float(os.environ.get('MONTHLY_GOAL', 750))
-
-          delta_eth  = max(0, eth_bal  - snap_eth)
-          delta_base = max(0, base_bal - snap_base)
-          delta_btc  = max(0, btc_bal  - snap_btc)
-          delta_sol  = max(0, sol_bal  - snap_sol)
-
-          total = delta_eth * eth_price + delta_base * eth_price + delta_btc * btc_price + delta_sol * sol_price
-          pct   = min(total / goal * 100, 100) if goal > 0 else 0
-
-          if total < 1:
-              display = '< $1'
-          else:
-              display = f'${math.floor(total):,}'
-
-          goal_display = f'${int(goal):,}'
-
-          # SVG dimensions
-          W = 400
-          BAR_W = 360
-          BAR_X = 20
-          BAR_H = 8
-          FILL_W = round(BAR_W * pct / 100)
-
-          label = f'Monthly Donation Goal  {display} / {goal_display}'
-          pct_label = f'{round(pct)}% of monthly goal' if pct < 100 else 'Goal reached this month. Thank you!'
-
-          svg = f'''<svg xmlns="http://www.w3.org/2000/svg" width="{W}" height="52" role="img" aria-label="Monthly donation goal">
-            <title>Monthly donation goal</title>
-            <rect width="{W}" height="52" rx="6" fill="#0c0d0b"/>
-            <text x="{W//2}" y="13" font-family="sans-serif" font-size="11" fill="#F39044" text-anchor="middle">{label}</text>
-            <rect x="{BAR_X}" y="20" width="{BAR_W}" height="{BAR_H}" rx="4" fill="#F3904433"/>
-            <rect x="{BAR_X}" y="20" width="{FILL_W}" height="{BAR_H}" rx="4" fill="#F39044"/>
-            <text x="{W//2}" y="44" font-family="sans-serif" font-size="10" fill="#F3904499" text-anchor="middle">{pct_label}</text>
-          </svg>'''
-
-          with open('repo-images/donation-goal.svg', 'w') as f:
-              f.write(svg)
-          print(f'SVG written: {display} / {goal_display} ({round(pct)}%)')
-          PYEOF
-      - name: Commit SVG
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add repo-images/donation-goal.svg
-          if git diff --cached --quiet; then
-            exit 0
-          fi
-          # Amend the previous bot commit if it exists, otherwise create a new one
-          LAST_AUTHOR=$(git log -1 --format='%ae')
-          if [ "$LAST_AUTHOR" = "github-actions[bot]@users.noreply.github.com" ]; then
-            git commit --amend --no-edit
-            git push --force-with-lease
-          else
-            git commit -m "chore: update donation goal badge"
-            git push
-          fi

.github/workflows/electron.yml

@@ -23,6 +23,10 @@ on:
           - file
           - release
           - submit
+      source_ref:
+        description: "Git ref/SHA to build (defaults to the workflow ref)"
+        required: false
+        default: ""
   workflow_call:
     inputs:
       build_type:
@@ -38,6 +42,16 @@ on:
         required: false
         type: string
         default: ""
+      version_override:
+        description: "Version string to stamp into built artifacts instead of package.json's version"
+        required: false
+        type: string
+        default: ""
+      source_ref:
+        description: "Git ref/SHA to build"
+        required: false
+        type: string
+        default: ""
     outputs:
       macos_universal_dmg_sha256:
         description: "SHA256 of the universal macOS DMG (for Homebrew cask)"
@@ -54,21 +68,67 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.source_ref || github.ref }}
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
 
+      - name: Install Spectre-mitigated MSVC libraries
+        shell: pwsh
+        run: |
+          # node-pty's binding.gyp sets SpectreMitigation, so MSBuild refuses to
+          # build without these. They are not on the runner image by default.
+          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+          $installPath = & $vswhere -latest -products * -property installationPath
+          if (-not $installPath) { throw "Visual Studio installation not found" }
+
+          # Derive the toolset version from the installed MSVC so the component
+          # id keeps matching when the runner image bumps the compiler.
+          $toolsetDir = Get-ChildItem -Path "$installPath\VC\Tools\MSVC" -Directory |
+            Sort-Object Name -Descending | Select-Object -First 1
+          if (-not $toolsetDir) { throw "No MSVC toolset found under $installPath" }
+          $parts = $toolsetDir.Name.Split(".")
+          $shortVer = "$($parts[0]).$($parts[1].Substring(0,2))"
+          Write-Host "MSVC toolset $($toolsetDir.Name) -> component version $shortVer"
+
+          $installer = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vs_installer.exe"
+          $components = @(
+            "Microsoft.VisualStudio.Component.VC.$shortVer.17.14.x86.x64.Spectre",
+            "Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre"
+          )
+          $args = @("modify", "--installPath", "`"$installPath`"", "--quiet", "--norestart", "--nocache")
+          foreach ($c in $components) { $args += @("--add", $c) }
+
+          Write-Host "Installing: $($components -join ', ')"
+          $proc = Start-Process -FilePath $installer -ArgumentList $args -Wait -PassThru -NoNewWindow
+          if ($proc.ExitCode -ne 0 -and $proc.ExitCode -ne 3010) {
+            Write-Host "vs_installer exited with $($proc.ExitCode); verifying libraries anyway"
+          }
+
+          $found = Get-ChildItem -Path "$installPath\VC\Tools\MSVC" -Recurse -Filter "*.lib" -ErrorAction SilentlyContinue |
+            Where-Object { $_.FullName -match "\\spectre\\" } | Select-Object -First 1
+          if (-not $found) { throw "Spectre-mitigated libraries still missing after install" }
+          Write-Host "Spectre libs present: $($found.FullName)"
+
       - name: Install dependencies
         run: npm ci
 
+      # A beta build has to know it is a beta, or it reports the stable version.
+      - name: Stamp beta version
+        if: inputs.version_override != ''
+        run: node scripts/sync-version.cjs --version "${{ inputs.version_override }}"
+
       - name: Get version
         id: package-version
         run: |
-          $VERSION = (Get-Content package.json | ConvertFrom-Json).version
+          $VERSION = "${{ inputs.version_override }}"
+          if ([string]::IsNullOrEmpty($VERSION)) {
+            $VERSION = (Get-Content package.json | ConvertFrom-Json).version
+          }
           echo "version=$VERSION" >> $env:GITHUB_OUTPUT
 
       - name: Build Windows (All Architectures)
@@ -144,10 +204,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.source_ref || github.ref }}
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -164,6 +225,11 @@ jobs:
           npm install --force @rollup/rollup-linux-arm64-gnu
           npm install --force @rollup/rollup-linux-arm-gnueabihf
 
+      # A beta build has to know it is a beta, or it reports the stable version.
+      - name: Stamp beta version
+        if: inputs.version_override != ''
+        run: node scripts/sync-version.cjs --version "${{ inputs.version_override }}"
+
       - name: Build Linux x64
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -274,7 +340,10 @@ jobs:
       - name: Get version for Flatpak
         id: flatpak-version
         run: |
-          VERSION=$(node -p "require('./package.json').version")
+          VERSION="${{ inputs.version_override }}"
+          if [ -z "$VERSION" ]; then
+            VERSION=$(node -p "require('./package.json').version")
+          fi
           RELEASE_DATE=$(date +%Y-%m-%d)
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "release_date=$RELEASE_DATE" >> $GITHUB_OUTPUT
@@ -288,16 +357,16 @@ jobs:
           CHECKSUM_ARM64=$(sha256sum "release/termix_linux_arm64_appimage.AppImage" | awk '{print $1}')
 
           mkdir -p flatpak-build
-          cp flatpak/com.karmaa.termix.yml flatpak-build/
-          cp flatpak/com.karmaa.termix.desktop flatpak-build/
-          cp flatpak/com.karmaa.termix.metainfo.xml flatpak-build/
+          cp packaging/flatpak/com.karmaa.termix.yml flatpak-build/
+          cp packaging/flatpak/com.karmaa.termix.desktop flatpak-build/
+          cp packaging/flatpak/com.karmaa.termix.metainfo.xml flatpak-build/
           cp public/icon.svg flatpak-build/com.karmaa.termix.svg
           convert public/icon.png -resize 256x256 flatpak-build/icon-256.png
           convert public/icon.png -resize 128x128 flatpak-build/icon-128.png
 
           cd flatpak-build
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/release-VERSION_PLACEHOLDER-tag/termix_linux_x64_appimage.AppImage|file://$(realpath ../release/termix_linux_x64_appimage.AppImage)|g" com.karmaa.termix.yml
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/release-VERSION_PLACEHOLDER-tag/termix_linux_arm64_appimage.AppImage|file://$(realpath ../release/termix_linux_arm64_appimage.AppImage)|g" com.karmaa.termix.yml
+          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_x64_appimage.AppImage|file://$(realpath ../release/termix_linux_x64_appimage.AppImage)|g" com.karmaa.termix.yml
+          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_arm64_appimage.AppImage|file://$(realpath ../release/termix_linux_arm64_appimage.AppImage)|g" com.karmaa.termix.yml
           sed -i "s/CHECKSUM_X64_PLACEHOLDER/$CHECKSUM_X64/g" com.karmaa.termix.yml
           sed -i "s/CHECKSUM_ARM64_PLACEHOLDER/$CHECKSUM_ARM64/g" com.karmaa.termix.yml
           sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" com.karmaa.termix.metainfo.xml
@@ -322,8 +391,8 @@ jobs:
       - name: Create flatpakref file
         run: |
           VERSION="${{ steps.flatpak-version.outputs.version }}"
-          cp flatpak/com.karmaa.termix.flatpakref release/
-          sed -i "s|VERSION_PLACEHOLDER|release-${VERSION}-tag|g" release/com.karmaa.termix.flatpakref
+          cp packaging/flatpak/com.karmaa.termix.flatpakref release/
+          sed -i "s|VERSION_PLACEHOLDER|v${VERSION}|g" release/com.karmaa.termix.flatpakref
 
       - name: Upload Flatpak bundle
         uses: actions/upload-artifact@v7
@@ -354,10 +423,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.source_ref || github.ref }}
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -367,6 +437,12 @@ jobs:
           npm ci
           npm install --force @rollup/rollup-darwin-arm64
           npm install dmg-license
+          node scripts/install-macos-sharp.cjs
+
+      # A beta build has to know it is a beta, or it reports the stable version.
+      - name: Stamp beta version
+        if: inputs.version_override != ''
+        run: node scripts/sync-version.cjs --version "${{ inputs.version_override }}"
 
       - name: Check for Code Signing Certificates
         id: check_certs
@@ -407,14 +483,15 @@ jobs:
 
           security find-identity -v -p codesigning $KEYCHAIN_PATH
 
+      # Betas never go to the App Store, so they skip the MAS package.
       - name: Build macOS App Store Package
-        if: steps.check_certs.outputs.has_certs == 'true'
+        id: mas_build
+        if: steps.check_certs.outputs.has_certs == 'true' && inputs.version_override == ''
         env:
           ELECTRON_BUILDER_ALLOW_UNRESOLVED_DEPENDENCIES: true
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_OPTIONS: --max-old-space-size=4096
         run: |
-          CURRENT_VERSION=$(node -p "require('./package.json').version")
           BUILD_VERSION="${{ github.run_number }}"
 
           npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
@@ -473,17 +550,32 @@ jobs:
           NODE_OPTIONS: --max-old-space-size=4096
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          if [ "${{ steps.check_certs.outputs.has_certs }}" != "true" ]; then
+          if [ "${{ steps.mas_build.outcome }}" != "success" ]; then
             npm run build
           fi
           npx electron-builder --mac dmg --universal --x64 --arm64 --publish never
 
+      - name: Verify macOS sharp packaging
+        run: |
+          artifacts=(release/termix_macos_*_dmg.dmg)
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          if [ -n "$MAS_PKG" ]; then
+            artifacts+=("$MAS_PKG")
+          fi
+          node scripts/verify-macos-sharp.cjs "${artifacts[@]}"
+
+      - name: Locate macOS MAS PKG
+        id: locate_mas_pkg
+        run: |
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          echo "path=$MAS_PKG" >> "$GITHUB_OUTPUT"
+
       - name: Upload macOS MAS PKG
-        if: steps.check_certs.outputs.has_certs == 'true' && hashFiles('release/termix_macos_universal_mas.pkg') != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release' || inputs.artifact_destination == 'submit')
+        if: steps.mas_build.outcome == 'success' && steps.locate_mas_pkg.outputs.path != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release' || inputs.artifact_destination == 'submit')
         uses: actions/upload-artifact@v7
         with:
           name: termix_macos_universal_mas
-          path: release/termix_macos_universal_mas.pkg
+          path: ${{ steps.locate_mas_pkg.outputs.path }}
           retention-days: 30
           if-no-files-found: warn
 
@@ -514,7 +606,10 @@ jobs:
       - name: Get version for Homebrew
         id: homebrew-version
         run: |
-          VERSION=$(node -p "require('./package.json').version")
+          VERSION="${{ inputs.version_override }}"
+          if [ -z "$VERSION" ]; then
+            VERSION=$(node -p "require('./package.json').version")
+          fi
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Compute universal DMG checksum
@@ -525,7 +620,7 @@ jobs:
           echo "sha256=$CHECKSUM" >> $GITHUB_OUTPUT
 
       - name: Generate Homebrew Cask
-        if: hashFiles('release/termix_macos_universal_dmg.dmg') != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release')
+        if: hashFiles('release/termix_macos_universal_dmg.dmg') != '' && inputs.version_override == '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release')
         run: |
           VERSION="${{ steps.homebrew-version.outputs.version }}"
           DMG_PATH="release/termix_macos_universal_dmg.dmg"
@@ -539,7 +634,7 @@ jobs:
           sed -i '' "s/CHECKSUM_PLACEHOLDER/$CHECKSUM/g" homebrew-generated/termix.rb
           sed -i '' "s|version \".*\"|version \"$VERSION\"|g" homebrew-generated/termix.rb
           sed -i '' "s|sha256 \".*\"|sha256 \"$CHECKSUM\"|g" homebrew-generated/termix.rb
-          sed -i '' "s|release-[0-9.]*-tag|release-$VERSION-tag|g" homebrew-generated/termix.rb
+          sed -i '' "s|download/[^/]*/termix_macos|download/v$VERSION/termix_macos|g" homebrew-generated/termix.rb
 
       - name: Upload Homebrew Cask as artifact
         uses: actions/upload-artifact@v7
@@ -550,12 +645,12 @@ jobs:
           retention-days: 30
 
       - name: Upload Homebrew Cask to release
-        if: hashFiles('homebrew-generated/termix.rb') != '' && inputs.artifact_destination == 'release'
+        if: hashFiles('homebrew-generated/termix.rb') != '' && inputs.version_override == '' && inputs.artifact_destination == 'release'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           VERSION="${{ steps.homebrew-version.outputs.version }}"
-          RELEASE_TAG="release-$VERSION-tag"
+          RELEASE_TAG="v$VERSION"
 
           gh release list --repo ${{ github.repository }} --limit 100 | grep -q "$RELEASE_TAG" || {
             echo "Release $RELEASE_TAG not found"
@@ -580,6 +675,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.source_ref || github.ref }}
           fetch-depth: 1
 
       - name: Get version from package.json
@@ -593,7 +689,7 @@ jobs:
         run: |
           $VERSION = "${{ steps.package-version.outputs.version }}"
           $MSI_NAME = "termix_windows_x64_msi.msi"
-          $DOWNLOAD_URL = "https://github.com/Termix-SSH/Termix/releases/download/release-$($VERSION)-tag/$($MSI_NAME)"
+          $DOWNLOAD_URL = "https://github.com/Termix-SSH/Termix/releases/download/v$($VERSION)/$($MSI_NAME)"
 
           Write-Host "Downloading from $DOWNLOAD_URL"
           New-Item -ItemType Directory -Force -Path "release_asset"
@@ -616,10 +712,10 @@ jobs:
           $CHECKSUM = "${{ steps.msi-info.outputs.checksum }}"
           $MSI_NAME = "${{ steps.msi-info.outputs.msi_name }}"
 
-          $DOWNLOAD_URL = "https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$MSI_NAME"
+          $DOWNLOAD_URL = "https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$MSI_NAME"
 
           New-Item -ItemType Directory -Force -Path "choco-build"
-          Copy-Item -Path "chocolatey\*" -Destination "choco-build" -Recurse -Force
+          Copy-Item -Path "packaging\chocolatey\*" -Destination "choco-build" -Recurse -Force
 
           $installScript = Get-Content "choco-build\tools\chocolateyinstall.ps1" -Raw -Encoding UTF8
           $installScript = $installScript -replace 'DOWNLOAD_URL_PLACEHOLDER', $DOWNLOAD_URL
@@ -642,7 +738,7 @@ jobs:
           choco pack termix-ssh.nuspec
 
           if ($LASTEXITCODE -ne 0) {
-            throw "Chocolatey push failed with exit code $LASTEXITCODE"
+            throw "Chocolatey pack failed with exit code $LASTEXITCODE"
           }
 
       - name: Check for Chocolatey API Key
@@ -686,6 +782,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.source_ref || github.ref }}
           fetch-depth: 1
 
       - name: Get version from package.json
@@ -703,7 +800,7 @@ jobs:
           mkdir -p release_assets
 
           APPIMAGE_X64_NAME="termix_linux_x64_appimage.AppImage"
-          URL_X64="https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$APPIMAGE_X64_NAME"
+          URL_X64="https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$APPIMAGE_X64_NAME"
           PATH_X64="release_assets/$APPIMAGE_X64_NAME"
           echo "Downloading x64 AppImage from $URL_X64"
           curl -L -o "$PATH_X64" "$URL_X64"
@@ -711,7 +808,7 @@ jobs:
           CHECKSUM_X64=$(sha256sum "$PATH_X64" | awk '{print $1}')
 
           APPIMAGE_ARM64_NAME="termix_linux_arm64_appimage.AppImage"
-          URL_ARM64="https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$APPIMAGE_ARM64_NAME"
+          URL_ARM64="https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$APPIMAGE_ARM64_NAME"
           PATH_ARM64="release_assets/$APPIMAGE_ARM64_NAME"
           echo "Downloading arm64 AppImage from $URL_ARM64"
           curl -L -o "$PATH_ARM64" "$URL_ARM64"
@@ -737,10 +834,10 @@ jobs:
 
           mkdir -p flatpak-submission
 
-          cp flatpak/com.karmaa.termix.yml flatpak-submission/
-          cp flatpak/com.karmaa.termix.desktop flatpak-submission/
-          cp flatpak/com.karmaa.termix.metainfo.xml flatpak-submission/
-          cp flatpak/flathub.json flatpak-submission/
+          cp packaging/flatpak/com.karmaa.termix.yml flatpak-submission/
+          cp packaging/flatpak/com.karmaa.termix.desktop flatpak-submission/
+          cp packaging/flatpak/com.karmaa.termix.metainfo.xml flatpak-submission/
+          cp packaging/flatpak/flathub.json flatpak-submission/
 
           cp public/icon.svg flatpak-submission/com.karmaa.termix.svg
           convert public/icon.png -resize 256x256 flatpak-submission/icon-256.png
@@ -823,6 +920,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.source_ref || github.ref }}
           fetch-depth: 1
 
       - name: Get version from package.json
@@ -836,7 +934,7 @@ jobs:
         run: |
           VERSION="${{ steps.package-version.outputs.version }}"
           DMG_NAME="termix_macos_universal_dmg.dmg"
-          URL="https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$DMG_NAME"
+          URL="https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$DMG_NAME"
 
           mkdir -p release_asset
           DOWNLOAD_PATH="release_asset/$DMG_NAME"
@@ -857,6 +955,9 @@ jobs:
           echo "dmg_name=$DMG_NAME" >> $GITHUB_OUTPUT
           echo "checksum=$CHECKSUM" >> $GITHUB_OUTPUT
 
+      - name: Verify macOS sharp packaging
+        run: node scripts/verify-macos-sharp.cjs release_asset/termix_macos_universal_dmg.dmg
+
       - name: Prepare Homebrew submission files
         run: |
           VERSION="${{ steps.package-version.outputs.version }}"
@@ -867,8 +968,8 @@ jobs:
 
           cp Casks/termix.rb homebrew-submission/Casks/t/termix.rb
 
-          sed -i '' "s/VERSION_PLACEHOLDER/$VERSION/g" homebrew-submission/Casks/t/termix.rb
-          sed -i '' "s/CHECKSUM_PLACEHOLDER/$CHECKSUM/g" homebrew-submission/Casks/t/termix.rb
+          sed -i '' "s|version \".*\"|version \"$VERSION\"|g" homebrew-submission/Casks/t/termix.rb
+          sed -i '' "s|sha256 \".*\"|sha256 \"$CHECKSUM\"|g" homebrew-submission/Casks/t/termix.rb
 
       - name: Verify Cask syntax
         run: |
@@ -933,10 +1034,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.source_ref || github.ref }}
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -946,6 +1048,7 @@ jobs:
           npm ci
           npm install --force @rollup/rollup-darwin-arm64
           npm install dmg-license
+          node scripts/install-macos-sharp.cjs
 
       - name: Check for Code Signing Certificates
         id: check_certs
@@ -986,16 +1089,6 @@ jobs:
 
           security find-identity -v -p codesigning $KEYCHAIN_PATH
 
-      - name: Build macOS App Store Package
-        if: steps.check_certs.outputs.has_certs == 'true'
-        env:
-          ELECTRON_BUILDER_ALLOW_UNRESOLVED_DEPENDENCIES: true
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_OPTIONS: --max-old-space-size=4096
-        run: |
-          BUILD_VERSION="${{ github.run_number }}"
-          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
-
       - name: Check for App Store Connect API credentials
         id: check_asc_creds
         run: |
@@ -1014,12 +1107,113 @@ jobs:
         if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
         run: gem install fastlane -N
 
-      - name: Upload and submit to Mac App Store
+      - name: Write App Store Connect API key
         if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
         env:
           APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
           APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}
           APPLE_KEY_CONTENT: ${{ secrets.APPLE_KEY_CONTENT }}
+        run: |
+          # Write API key JSON that Fastlane expects; the PEM's newlines
+          # must be preserved as literal \n escapes, not stripped, or
+          # spaceship fails to parse the key (invalid curve name).
+          mkdir -p /tmp/asc_keys
+          KEY_P8_PATH="/tmp/asc_keys/AuthKey_${APPLE_KEY_ID}.p8"
+          API_KEY_JSON="/tmp/asc_keys/api_key.json"
+
+          echo "$APPLE_KEY_CONTENT" | base64 --decode > "$KEY_P8_PATH"
+
+          KEY_ID="$APPLE_KEY_ID" ISSUER_ID="$APPLE_ISSUER_ID" KEY_P8_PATH="$KEY_P8_PATH" \
+            node -e '
+              const fs = require("fs");
+              const key = fs.readFileSync(process.env.KEY_P8_PATH, "utf8");
+              process.stdout.write(JSON.stringify({
+                key_id: process.env.KEY_ID,
+                issuer_id: process.env.ISSUER_ID,
+                key,
+                in_house: false,
+              }, null, 2) + "\n");
+            ' > "$API_KEY_JSON"
+
+      - name: Resolve next build number from App Store Connect
+        id: build_number
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
+        run: |
+          APP_VERSION=$(node -p "require('./package.json').version")
+          OUT_FILE="$RUNNER_TEMP/latest_build_number.txt"
+          LANE_DIR="$RUNNER_TEMP/asc_lane/fastlane"
+          mkdir -p "$LANE_DIR"
+
+          cat > "$LANE_DIR/Fastfile" <<EOF
+          default_platform(:mac)
+
+          lane :fetch_build_number do
+            live_number = app_store_build_number(
+              live: true,
+              platform: "osx",
+              api_key_path: "/tmp/asc_keys/api_key.json",
+              app_identifier: "com.karmaa.termix",
+              initial_build_number: 0,
+            )
+            pending_number = app_store_build_number(
+              live: false,
+              platform: "osx",
+              api_key_path: "/tmp/asc_keys/api_key.json",
+              app_identifier: "com.karmaa.termix",
+              initial_build_number: 0,
+            )
+            number = [live_number, pending_number].max
+            File.write("$OUT_FILE", number.to_s)
+          end
+          EOF
+
+          (cd "$RUNNER_TEMP/asc_lane" && fastlane fetch_build_number) 2>&1 || true
+
+          LATEST=""
+          if [ -f "$OUT_FILE" ]; then
+            LATEST=$(cat "$OUT_FILE" | tr -d '[:space:]')
+          fi
+
+          if ! [[ "$LATEST" =~ ^[0-9]+$ ]]; then
+            echo "Could not resolve latest build number from App Store Connect; falling back to run number."
+            LATEST="${{ github.run_number }}"
+          fi
+          echo "build_version=$((LATEST + 1))" >> "$GITHUB_OUTPUT"
+
+      - name: Build macOS App Store Package
+        if: steps.check_certs.outputs.has_certs == 'true'
+        env:
+          ELECTRON_BUILDER_ALLOW_UNRESOLVED_DEPENDENCIES: true
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_OPTIONS: --max-old-space-size=4096
+        run: |
+          BUILD_VERSION="${{ steps.build_number.outputs.build_version || github.run_number }}"
+          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
+
+      - name: Verify macOS sharp packaging
+        if: steps.check_certs.outputs.has_certs == 'true'
+        run: |
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          if [ -z "$MAS_PKG" ]; then
+            echo "MAS pkg not found under release/; aborting."
+            exit 1
+          fi
+          node scripts/verify-macos-sharp.cjs "$MAS_PKG"
+
+      - name: Generate App Store release notes
+        id: asc_notes
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
+        run: |
+          META_DIR="$RUNNER_TEMP/asc_metadata"
+          rm -rf "$META_DIR"
+          node scripts/generate-appstore-notes.cjs \
+            --changelog CHANGELOG.md \
+            --out-dir "$META_DIR" \
+            --locales "en-US"
+          echo "metadata_path=$META_DIR" >> "$GITHUB_OUTPUT"
+
+      - name: Upload and submit to Mac App Store
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
         run: |
           PKG_FILE=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
           if [ -z "$PKG_FILE" ]; then
@@ -1028,28 +1222,22 @@ jobs:
           fi
 
           VERSION=$(node -p "require('./package.json').version")
-
-          # Write API key JSON that Fastlane deliver expects
-          mkdir -p /tmp/asc_keys
-          KEY_P8_PATH="/tmp/asc_keys/AuthKey_${APPLE_KEY_ID}.p8"
           API_KEY_JSON="/tmp/asc_keys/api_key.json"
 
-          echo "$APPLE_KEY_CONTENT" | base64 --decode > "$KEY_P8_PATH"
-
-          printf '{\n  "key_id": "%s",\n  "issuer_id": "%s",\n  "key": "%s",\n  "in_house": false\n}\n' \
-            "$APPLE_KEY_ID" \
-            "$APPLE_ISSUER_ID" \
-            "$(tr -d '\n' < "$KEY_P8_PATH")" \
-            > "$API_KEY_JSON"
-
           fastlane deliver \
             --pkg "$PKG_FILE" \
             --api_key_path "$API_KEY_JSON" \
             --app_version "$VERSION" \
-            --skip_metadata true \
+            --platform osx \
+            --app_identifier "com.karmaa.termix" \
+            --skip_metadata false \
+            --metadata_path "${{ steps.asc_notes.outputs.metadata_path }}" \
             --skip_screenshots true \
+            --skip_app_version_update false \
             --submit_for_review true \
             --automatic_release true \
+            --precheck_include_in_app_purchases false \
+            --submission_information "{\"export_compliance_uses_encryption\": false}" \
             --force true
 
       - name: Clean up keychains

.github/workflows/openapi.yml

@@ -1,32 +0,0 @@
-name: Generate OpenAPI Specification
-
-on:
-  workflow_dispatch:
-
-jobs:
-  generate-openapi:
-    name: Generate OpenAPI JSON
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Generate OpenAPI specification
-        run: npm run generate:openapi
-
-      - name: Upload OpenAPI artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: openapi-spec
-          path: openapi.json
-          retention-days: 90

.github/workflows/pr-check.yml

@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -24,14 +24,88 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Run ESLint
-        run: npx eslint .
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
+      - name: Lint
+        run: npm run lint
 
       - name: Run Prettier check
         run: npx prettier --check .
 
       - name: Type check
-        run: npx tsc --noEmit
+        run: npm run type-check
 
       - name: Build
         run: npm run build
+
+      - name: Run unit tests
+        run: npm run test
+
+  database-dialects:
+    name: Postgres and MySQL
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: termix
+          POSTGRES_PASSWORD: termix
+          POSTGRES_DB: termix_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+      mysql:
+        image: mysql:8
+        env:
+          MYSQL_ROOT_PASSWORD: termix
+          MYSQL_DATABASE: termix_test
+          MYSQL_USER: termix
+          MYSQL_PASSWORD: termix
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd "mysqladmin ping -h 127.0.0.1 -ptermix"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
+      - name: Verify Postgres
+        run: npm run verify:dialect -- postgres://termix:termix@127.0.0.1:5432/termix_test
+
+      - name: Verify MySQL
+        run: npm run verify:dialect -- mysql://termix:termix@127.0.0.1:3306/termix_test
+
+      - name: Repository tests on Postgres
+        env:
+          TEST_DIALECT: postgres
+          TEST_DATABASE_URL: postgres://termix:termix@127.0.0.1:5432/termix_test
+        run: npx vitest run src/backend/tests/database/repositories --no-file-parallelism
+
+      - name: Repository tests on MySQL
+        env:
+          TEST_DIALECT: mysql
+          TEST_DATABASE_URL: mysql://termix:termix@127.0.0.1:3306/termix_test
+        run: npx vitest run src/backend/tests/database/repositories --no-file-parallelism

.github/workflows/publish-sdk.yml

@@ -0,0 +1,84 @@
+name: Publish SDK
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: "Publish mode"
+        required: true
+        default: Publish
+        type: choice
+        options:
+          - Publish
+          - Dry run
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish @termix-ssh/plugin-sdk
+    runs-on: ubuntu-latest
+
+    env:
+      NODE_OPTIONS: "--max-old-space-size=4096"
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Update npm
+        run: npm install -g npm@^11.19.0
+
+      - run: npm ci
+
+      - name: Check the version is new
+        run: |
+          VERSION=$(node -p "require('./packages/plugin-sdk/package.json').version")
+          if npm view "@termix-ssh/plugin-sdk@$VERSION" version >/dev/null 2>&1; then
+            echo "@termix-ssh/plugin-sdk@$VERSION is already on npm. Bump packages/plugin-sdk/package.json first."
+            if [ "${{ inputs.mode }}" = "Publish" ]; then
+              exit 1
+            fi
+          fi
+          echo "Publishing @termix-ssh/plugin-sdk@$VERSION"
+
+      - run: npm run build:sdk
+
+      - run: npm run lint
+
+      - run: npm run type-check
+
+      - run: npm run test
+
+      - name: Publish
+        run: |
+          if [ "${{ inputs.mode }}" = "Dry run" ]; then
+            npm publish --workspace @termix-ssh/plugin-sdk --provenance --access public --dry-run
+          else
+            npm publish --workspace @termix-ssh/plugin-sdk --provenance --access public
+          fi
+
+      - name: Tag and release
+        if: ${{ inputs.mode == 'Publish' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION=$(node -p "require('./packages/plugin-sdk/package.json').version")
+          node -e "
+            const fs = require('fs');
+            const { changelogSection } = require('./packages/plugin-sdk/dist/changelog.js');
+            const notes = changelogSection(fs.readFileSync('packages/plugin-sdk/CHANGELOG.md', 'utf8'), process.argv[1]);
+            fs.writeFileSync('sdk-notes.md', notes);
+          " "$VERSION"
+          gh release create "sdk-v$VERSION" \
+            --target "${{ github.sha }}" \
+            --title "Plugin SDK v$VERSION" \
+            --notes-file sdk-notes.md \
+            --latest=false

.github/workflows/release.yml

@@ -1,10 +1,24 @@
 name: Release
 
+# Stable: run by hand from a dev-X.Y.Z branch. Beta: run by hand from a dev
+# branch, or let the Tuesday and Friday schedule snapshot the newest dev
+# branch when it moved since the last beta.
+
 on:
+  schedule:
+    - cron: "0 15 * * 2,5"
   workflow_dispatch:
     inputs:
+      channel:
+        description: "Stable release or beta"
+        required: true
+        default: Stable
+        type: choice
+        options:
+          - Stable
+          - Beta
       mode:
-        description: "Release mode"
+        description: "Release mode (Overwrite release is stable only)"
         required: true
         default: Everything
         type: choice
@@ -17,23 +31,45 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
   prep:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
-      version: ${{ steps.info.outputs.version }}
-      release_tag: ${{ steps.info.outputs.release_tag }}
+      channel: ${{ steps.mode.outputs.channel }}
+      mode: ${{ steps.mode.outputs.mode }}
+      skip: ${{ steps.beta.outputs.skip || 'false' }}
+      version: ${{ steps.info.outputs.version || steps.beta.outputs.version }}
+      release_tag: ${{ steps.info.outputs.release_tag || steps.beta.outputs.release_tag }}
       mobile_version: ${{ steps.info.outputs.mobile_version }}
-      dev_branch: ${{ steps.info.outputs.dev_branch }}
+      mobile_tag: ${{ steps.info.outputs.mobile_tag }}
+      dev_branch: ${{ steps.info.outputs.dev_branch || steps.beta.outputs.dev_branch }}
+      sha: ${{ steps.beta.outputs.sha }}
+      prev_ref: ${{ steps.beta.outputs.prev_ref }}
     steps:
+      - name: Resolve channel and mode
+        id: mode
+        run: |
+          CHANNEL="${{ inputs.channel || 'Beta' }}"
+          MODE="${{ inputs.mode || 'Everything' }}"
+          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
+          echo "mode=$MODE" >> "$GITHUB_OUTPUT"
+          if [ "$CHANNEL" = "Beta" ] && [ "$MODE" = "Overwrite release" ]; then
+            echo "Overwrite release is for stable releases only."
+            exit 1
+          fi
+
       - name: Guard branch (release modes)
-        if: ${{ inputs.mode != 'Overwrite release' && !startsWith(github.ref, 'refs/heads/dev-') }}
+        if: ${{ github.event_name == 'workflow_dispatch' && steps.mode.outputs.mode != 'Overwrite release' && !startsWith(github.ref, 'refs/heads/dev-') }}
         run: |
           echo "This mode must be run from a dev branch (got ${{ github.ref }})."
           exit 1
 
       - name: Guard branch (overwrite mode)
-        if: ${{ inputs.mode == 'Overwrite release' && github.ref != 'refs/heads/main' }}
+        if: ${{ steps.mode.outputs.mode == 'Overwrite release' && github.ref != 'refs/heads/main' }}
         run: |
           echo "Overwrite release must be run from main (got ${{ github.ref }})."
           exit 1
@@ -44,16 +80,17 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
 
       - name: Resolve versions
         id: info
+        if: ${{ steps.mode.outputs.channel == 'Stable' }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          if [ "${{ inputs.mode }}" = "Overwrite release" ]; then
+          if [ "${{ steps.mode.outputs.mode }}" = "Overwrite release" ]; then
             DEV_BRANCH=""
             VERSION=$(node -p "require('./package.json').version")
           else
@@ -62,37 +99,81 @@ jobs:
           fi
           echo "dev_branch=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "release_tag=release-$VERSION-tag" >> "$GITHUB_OUTPUT"
+          echo "release_tag=v$VERSION" >> "$GITHUB_OUTPUT"
 
           MOBILE_RAW=$(gh release view -R Termix-SSH/Mobile --json tagName -q .tagName)
-          MOBILE_VERSION=$(echo "$MOBILE_RAW" | sed -E 's/^release-//; s/-tag$//')
+          MOBILE_VERSION=$(echo "$MOBILE_RAW" | sed -E 's/^release-//; s/-tag$//; s/^v//')
           if [ -z "$MOBILE_VERSION" ]; then
             echo "Failed to resolve the latest Termix-SSH/Mobile release version."
             exit 1
           fi
           echo "mobile_version=$MOBILE_VERSION" >> "$GITHUB_OUTPUT"
+          echo "mobile_tag=$MOBILE_RAW" >> "$GITHUB_OUTPUT"
 
-      - name: Validate release notes
+      - name: Check CHANGELOG.md has notes for this version
+        if: ${{ steps.mode.outputs.channel == 'Stable' }}
         run: |
           node scripts/generate-release-body.cjs \
             --version "${{ steps.info.outputs.version }}" \
             --mobile-version "${{ steps.info.outputs.mobile_version }}" \
-            --notes RELEASE_NOTES.md > /dev/null
+            --mobile-tag "${{ steps.info.outputs.mobile_tag }}" > /dev/null
 
-  normalize:
+      - name: Resolve beta version
+        id: beta
+        if: ${{ steps.mode.outputs.channel == 'Beta' }}
+        env:
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+        run: |
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            REFS=$(gh api "repos/${{ github.repository }}/branches" --paginate -q '.[].name')
+            if ! DEV_BRANCH=$(printf '%s\n' "$REFS" | node scripts/latest-dev-branch.cjs 2>/dev/null); then
+              echo "No dev-X.Y.Z branch is open, so no beta today."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          else
+            DEV_BRANCH="${GITHUB_REF#refs/heads/}"
+          fi
+
+          BASE=$(node scripts/parse-dev-branch.cjs "$DEV_BRANCH")
+          SHA=$(gh api "repos/${{ github.repository }}/branches/$DEV_BRANCH" -q .commit.sha)
+          TAGS=$(gh api "repos/${{ github.repository }}/git/matching-refs/tags/v$BASE-beta." -q '.[].ref' | sed 's#^refs/tags/##')
+          LATEST=$(printf '%s\n' "$TAGS" | node scripts/beta-version.cjs "$BASE" --latest)
+          VERSION=$(printf '%s\n' "$TAGS" | node scripts/beta-version.cjs "$BASE")
+
+          if [ -n "$LATEST" ]; then
+            LATEST_SHA=$(gh api "repos/${{ github.repository }}/commits/$LATEST" -q .sha)
+            if [ "$LATEST_SHA" = "$SHA" ] && [ "${{ github.event_name }}" = "schedule" ]; then
+              echo "$DEV_BRANCH has not moved since $LATEST, so no beta today."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            PREV="$LATEST"
+          else
+            PREV=$(gh release view --repo ${{ github.repository }} --json tagName -q .tagName 2>/dev/null || true)
+          fi
+
+          echo "Beta $VERSION from $DEV_BRANCH @ $SHA, changes since ${PREV:-nothing}"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "dev_branch=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release_tag=v$VERSION" >> "$GITHUB_OUTPUT"
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          echo "prev_ref=$PREV" >> "$GITHUB_OUTPUT"
+
+  verify-beta:
     needs: [prep]
-    if: ${{ inputs.mode != 'Overwrite release' }}
+    if: ${{ needs.prep.outputs.channel == 'Beta' && needs.prep.outputs.skip != 'true' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - name: Checkout dev branch
+      - name: Checkout beta commit
         uses: actions/checkout@v7
         with:
-          ref: ${{ needs.prep.outputs.dev_branch }}
-          fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
+          ref: ${{ needs.prep.outputs.sha }}
+          fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -100,10 +181,51 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Build
+        run: npm run build
+
+      - name: Run unit tests
+        run: npm run test
+
+  normalize:
+    needs: [prep]
+    if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Overwrite release' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout dev branch
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.prep.outputs.dev_branch }}
+          fetch-depth: 0
+          token: ${{ secrets.TERMIX_PAT }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      # Manifest validation in lint loads the built SDK.
+      - name: Build SDK
+        run: npm run build:sdk
+
       - name: Lint and format
         run: |
-          npm run lint:fix || true
+          npm run lint:fix
           npm run format
+          npm run lint
 
       - name: Run unit tests
         run: npm run test
@@ -121,7 +243,7 @@ jobs:
             exit 0
           fi
 
-          if [ "${{ inputs.mode }}" = "Dry run" ]; then
+          if [ "${{ needs.prep.outputs.mode }}" = "Dry run" ]; then
             echo "DRY RUN: would commit and push the following changes to ${{ needs.prep.outputs.dev_branch }}:"
             git --no-pager diff --stat
             exit 0
@@ -131,9 +253,9 @@ jobs:
           git commit -m "chore: lint, format, and bump version to ${{ needs.prep.outputs.version }}"
           git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
 
-  crowdin:
+  sync-main:
     needs: [prep, normalize]
-    if: ${{ inputs.mode != 'Dry run' && inputs.mode != 'Overwrite release' }}
+    if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Overwrite release' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout dev branch
@@ -141,79 +263,29 @@ jobs:
         with:
           ref: ${{ needs.prep.outputs.dev_branch }}
           fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Merge main into dev branch
         run: |
           git config user.name "LukeGus"
           git config user.email "bugattiguy527@gmail.com"
           git fetch origin main
-          git merge origin/main -X ours --no-edit || true
-          git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
-
-      - name: Clean up stale Crowdin git integration branch
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --head i18n_translate --state open --json number -q '.[0].number' || true)
-          if [ -n "$PR_NUMBER" ]; then
-            gh pr close "$PR_NUMBER" --repo ${{ github.repository }} --delete-branch || true
+          # -X ours leaves modify/delete conflicts, so settle those to the dev side too
+          if ! git merge origin/main -X ours --no-edit; then
+            git diff --name-only --diff-filter=U | while read -r f; do
+              if git cat-file -e "HEAD:$f" 2>/dev/null; then
+                git checkout --ours -- "$f" && git add -- "$f"
+              else
+                git rm -q -- "$f"
+              fi
+            done
+            git commit --no-edit
           fi
-          git push origin --delete i18n_translate || true
-
-      - name: Upload sources to Crowdin
-        uses: crowdin/github-action@v2
-        with:
-          upload_sources: true
-          upload_translations: false
-          download_translations: false
-          create_pull_request: false
-          push_translations: false
-          token: ${{ secrets.CROWDIN_API_KEY }}
-          project_id: "858252"
-        env:
-          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
-
-      - name: Machine pre-translate untranslated strings
-        env:
-          CROWDIN_API_KEY: ${{ secrets.CROWDIN_API_KEY }}
-        run: node scripts/crowdin-pretranslate.cjs
-
-      - name: Download translations from Crowdin
-        uses: crowdin/github-action@v2
-        with:
-          upload_sources: false
-          upload_translations: false
-          download_translations: true
-          create_pull_request: false
-          push_translations: false
-          token: ${{ secrets.CROWDIN_API_KEY }}
-          project_id: "858252"
-        env:
-          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
-
-      - name: Commit translations to dev branch
-        run: |
-          git config user.name "LukeGus"
-          git config user.email "bugattiguy527@gmail.com"
-
-          git add src/ui/locales/translated
-          if git diff --cached --quiet; then
-            echo "No translation changes to commit."
-            exit 0
-          fi
-          git commit -m "chore: sync Crowdin translations for ${{ needs.prep.outputs.version }}"
           git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
 
   merge-to-main:
-    needs: [prep, normalize, crowdin]
-    if: ${{ always() && needs.prep.result == 'success' && (needs.normalize.result == 'success' || needs.normalize.result == 'skipped') && (needs.crowdin.result == 'success' || needs.crowdin.result == 'skipped') }}
+    needs: [prep, normalize, sync-main]
+    if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.channel == 'Stable' && (needs.normalize.result == 'success' || needs.normalize.result == 'skipped') && (needs.sync-main.result == 'success' || needs.sync-main.result == 'skipped') }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       main_sha: ${{ steps.merge.outputs.main_sha }}
@@ -225,7 +297,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
 
@@ -235,24 +307,24 @@ jobs:
           node scripts/generate-release-body.cjs \
             --version "${{ needs.prep.outputs.version }}" \
             --mobile-version "${{ needs.prep.outputs.mobile_version }}" \
-            --notes RELEASE_NOTES.md > PR_BODY.md
+            --mobile-tag "${{ needs.prep.outputs.mobile_tag }}" > PR_BODY.md
 
       - name: Open and squash-merge PR to main
         id: merge
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           DEV_BRANCH="${{ needs.prep.outputs.dev_branch }}"
-          TITLE="release-${{ needs.prep.outputs.version }}"
+          TITLE="v${{ needs.prep.outputs.version }}"
 
-          if [ "${{ inputs.mode }}" = "Overwrite release" ]; then
+          if [ "${{ needs.prep.outputs.mode }}" = "Overwrite release" ]; then
             echo "OVERWRITE: no merge; building from main as-is."
             echo "build_ref=main" >> "$GITHUB_OUTPUT"
             echo "main_sha=$(gh api repos/${{ github.repository }}/commits/main -q .sha)" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          if [ "${{ inputs.mode }}" = "Dry run" ]; then
+          if [ "${{ needs.prep.outputs.mode }}" = "Dry run" ]; then
             echo "DRY RUN: would open and squash-merge a PR from $DEV_BRANCH into main."
             echo "DRY RUN: downstream jobs will build from $DEV_BRANCH instead of main."
             echo "build_ref=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
@@ -278,20 +350,22 @@ jobs:
 
           MAIN_SHA=$(gh api repos/${{ github.repository }}/commits/main -q .sha)
           echo "main_sha=$MAIN_SHA" >> "$GITHUB_OUTPUT"
-          echo "build_ref=main" >> "$GITHUB_OUTPUT"
+          echo "build_ref=$MAIN_SHA" >> "$GITHUB_OUTPUT"
 
   docker:
-    needs: [prep, merge-to-main]
+    needs: [prep, verify-beta, merge-to-main]
+    if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.skip != 'true' && (needs.merge-to-main.result == 'success' || needs.verify-beta.result == 'success') }}
     uses: ./.github/workflows/docker.yml
     with:
       version: ${{ needs.prep.outputs.version }}
-      build_type: Production
-      dry_run: ${{ inputs.mode == 'Dry run' }}
+      build_type: ${{ needs.prep.outputs.channel == 'Beta' && 'Beta' || 'Production' }}
+      dry_run: ${{ needs.prep.outputs.mode == 'Dry run' }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.prep.outputs.sha }}
     secrets: inherit
 
   create-release:
     needs: [prep, merge-to-main, docker]
-    if: ${{ inputs.mode != 'Dry run' }}
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.docker.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       contents: write
@@ -303,14 +377,14 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
 
       - name: Clear existing release artifacts (overwrite mode)
-        if: ${{ inputs.mode == 'Overwrite release' }}
+        if: ${{ needs.prep.outputs.mode == 'Overwrite release' }}
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           TAG="${{ needs.prep.outputs.release_tag }}"
           if ! gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
@@ -323,48 +397,93 @@ jobs:
           done
 
       - name: Generate release body
-        if: ${{ inputs.mode != 'Overwrite release' }}
+        if: ${{ needs.prep.outputs.mode != 'Overwrite release' }}
         run: |
           node scripts/generate-release-body.cjs \
             --version "${{ needs.prep.outputs.version }}" \
             --mobile-version "${{ needs.prep.outputs.mobile_version }}" \
-            --notes RELEASE_NOTES.md > RELEASE_BODY.md
+            --mobile-tag "${{ needs.prep.outputs.mobile_tag }}" > RELEASE_BODY.md
 
       - name: Create or update GitHub release
-        if: ${{ inputs.mode != 'Overwrite release' }}
+        if: ${{ needs.prep.outputs.mode != 'Overwrite release' }}
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           TAG="${{ needs.prep.outputs.release_tag }}"
-          TITLE="release-${{ needs.prep.outputs.version }}"
+          TITLE="Termix v${{ needs.prep.outputs.version }}"
           if gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
             gh release edit "$TAG" --repo ${{ github.repository }} --title "$TITLE" --notes-file RELEASE_BODY.md
           else
             gh release create "$TAG" --repo ${{ github.repository }} --title "$TITLE" --notes-file RELEASE_BODY.md --target "${{ needs.merge-to-main.outputs.main_sha }}"
           fi
 
+  create-beta-release:
+    needs: [prep, docker]
+    if: ${{ always() && needs.prep.outputs.channel == 'Beta' && needs.docker.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout beta commit
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.prep.outputs.sha }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Generate beta release body
+        run: |
+          node scripts/generate-beta-body.cjs \
+            --version "${{ needs.prep.outputs.version }}" \
+            --branch "${{ needs.prep.outputs.dev_branch }}" \
+            --sha "${{ needs.prep.outputs.sha }}" \
+            --prev "${{ needs.prep.outputs.prev_ref }}" > BETA_BODY.md
+
+      - name: Create beta release
+        env:
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+        run: |
+          VERSION="${{ needs.prep.outputs.version }}"
+          TITLE="Termix v${VERSION%-beta.*} Beta ${VERSION##*-beta.}"
+          TAG="${{ needs.prep.outputs.release_tag }}"
+          if gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
+            gh release edit "$TAG" --repo ${{ github.repository }} \
+              --title "$TITLE" --notes-file BETA_BODY.md --prerelease
+          else
+            gh release create "$TAG" --repo ${{ github.repository }} \
+              --title "$TITLE" --notes-file BETA_BODY.md \
+              --prerelease --target "${{ needs.prep.outputs.sha }}"
+          fi
+
   electron-release:
-    needs: [prep, merge-to-main, create-release]
-    if: ${{ always() && needs.merge-to-main.result == 'success' && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped') }}
+    needs: [prep, merge-to-main, docker, create-release, create-beta-release]
+    if: ${{ always() && needs.prep.outputs.skip != 'true' && needs.docker.result == 'success' && needs.create-release.result != 'failure' && needs.create-beta-release.result != 'failure' }}
     uses: ./.github/workflows/electron.yml
     with:
       build_type: all
-      artifact_destination: ${{ inputs.mode == 'Dry run' && 'file' || 'release' }}
+      artifact_destination: ${{ needs.prep.outputs.mode == 'Dry run' && 'file' || 'release' }}
       release_tag: ${{ needs.prep.outputs.release_tag }}
+      version_override: ${{ needs.prep.outputs.channel == 'Beta' && needs.prep.outputs.version || '' }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.prep.outputs.sha }}
     secrets: inherit
 
   electron-submit:
-    needs: [prep, electron-release]
-    if: ${{ inputs.mode != 'Dry run' && inputs.mode != 'Skip submit' }}
+    needs: [prep, merge-to-main, electron-release]
+    if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Skip submit' }}
     uses: ./.github/workflows/electron.yml
     with:
       build_type: all
       artifact_destination: submit
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref }}
     secrets: inherit
 
   cask-commit-back:
     needs: [prep, electron-release]
-    if: ${{ inputs.mode != 'Dry run' }}
+    if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       contents: write
@@ -374,7 +493,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 1
-          token: ${{ secrets.GHCR_TOKEN }}
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Bump and commit Homebrew cask
         env:
@@ -386,158 +505,66 @@ jobs:
             exit 0
           fi
 
+          git config user.name "LukeGus"
+          git config user.email "bugattiguy527@gmail.com"
+
+          git fetch origin main
+          git checkout -B main origin/main
+
           sed -i "s|version \".*\"|version \"$VERSION\"|g" Casks/termix.rb
           sed -i "s|sha256 \".*\"|sha256 \"$DMG_SHA256\"|g" Casks/termix.rb
 
-          if git diff --quiet Casks/termix.rb; then
+          git add Casks/termix.rb
+          if git diff --cached --quiet; then
             echo "Cask already up to date."
             exit 0
           fi
 
-          git config user.name "LukeGus"
-          git config user.email "bugattiguy527@gmail.com"
-          git add Casks/termix.rb
-          git stash
-          git pull --rebase origin main
-          git stash pop
           git commit -m "chore: bump Homebrew cask to $VERSION"
           git push origin HEAD:main
 
-  docs:
-    needs: [prep, merge-to-main]
-    if: ${{ always() && needs.merge-to-main.result == 'success' && inputs.mode != 'Overwrite release' }}
+  prune-betas:
+    needs: [prep, create-release]
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.create-release.result == 'success' && needs.prep.outputs.mode != 'Overwrite release' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - name: Checkout Termix
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.merge-to-main.outputs.build_ref }}
-          fetch-depth: 1
-          path: termix
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: "termix/.nvmrc"
-          cache: "npm"
-          cache-dependency-path: termix/package-lock.json
-
-      - name: Generate OpenAPI spec
-        working-directory: termix
-        run: |
-          npm ci
-          npm run generate:openapi
-
-      - name: Checkout Docs repository
-        uses: actions/checkout@v7
-        with:
-          repository: Termix-SSH/Docs
-          ref: main
-          fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
-          path: docs-repo
-
-      - name: Create docs release branch
-        working-directory: docs-repo
-        run: git checkout -B "dev-${{ needs.prep.outputs.version }}"
-
-      - name: Overwrite OpenAPI spec and regenerate API docs
-        working-directory: docs-repo
-        run: |
-          cp ../termix/openapi.json static/openapi.json
-          npm ci
-          npm run docusaurus gen-api-docs termix
-
-      - name: Commit and push docs branch
-        working-directory: docs-repo
-        run: |
-          git config user.name "LukeGus"
-          git config user.email "bugattiguy527@gmail.com"
-
-          if git diff --quiet; then
-            echo "No docs changes to commit."
-            exit 0
-          fi
-
-          if [ "${{ inputs.mode }}" = "Dry run" ]; then
-            echo "DRY RUN: would commit and push the following docs changes to dev-${{ needs.prep.outputs.version }}:"
-            git --no-pager diff --stat
-            exit 0
-          fi
-
-          git add -A
-          git commit -m "feat: update API docs for ${{ needs.prep.outputs.version }}"
-          git push --force origin "dev-${{ needs.prep.outputs.version }}"
-
-      - name: Open and squash-merge docs PR
-        if: ${{ inputs.mode != 'Dry run' }}
-        working-directory: docs-repo
+      - name: Delete this version's beta releases (tags stay)
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
-          BRANCH="dev-${{ needs.prep.outputs.version }}"
-          if ! git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null 2>&1; then
-            echo "No docs branch pushed (nothing changed); skipping PR."
-            exit 0
-          fi
+          PREFIX="v${{ needs.prep.outputs.version }}-beta."
+          gh release list --repo ${{ github.repository }} --limit 200 --json tagName -q '.[].tagName' \
+            | grep -F "$PREFIX" | while read -r TAG; do
+              echo "Deleting release $TAG"
+              gh release delete "$TAG" --repo ${{ github.repository }} --yes || true
+            done
 
-          PR_NUMBER=$(gh pr list --repo Termix-SSH/Docs --head "$BRANCH" --base main --state open --json number -q '.[0].number' || true)
-          if [ -z "$PR_NUMBER" ]; then
-            PR_NUMBER=$(gh pr create --repo Termix-SSH/Docs \
-              --base main --head "$BRANCH" \
-              --title "release-${{ needs.prep.outputs.version }}" \
-              --body "API docs for ${{ needs.prep.outputs.version }}" \
-              | grep -oE '[0-9]+$')
-          fi
-
-          gh pr merge "$PR_NUMBER" --repo Termix-SSH/Docs --squash --admin
-
-  publish-youtube:
+  # The docs site reads the env catalog, API spec and download list from the
+  # newest stable release.
+  docs-refresh:
     needs: [prep, electron-release]
-    if: ${{ always() && inputs.mode != 'Dry run' && inputs.mode != 'Overwrite release' && needs.electron-release.result == 'success' }}
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - name: Checkout main
-        uses: actions/checkout@v7
-        with:
-          ref: main
-          fetch-depth: 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
-
-      - name: Set release video to public
+      - name: Tell the docs site
         env:
-          YOUTUBE_CLIENT_ID: ${{ secrets.YOUTUBE_CLIENT_ID }}
-          YOUTUBE_CLIENT_SECRET: ${{ secrets.YOUTUBE_CLIENT_SECRET }}
-          YOUTUBE_REFRESH_TOKEN: ${{ secrets.YOUTUBE_REFRESH_TOKEN }}
-        run: node scripts/publish-youtube.cjs
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+        run: gh api repos/Termix-SSH/Docs/dispatches -f event_type=core-released
 
   cleanup:
-    needs:
-      [
-        prep,
-        merge-to-main,
-        electron-release,
-        cask-commit-back,
-        docs,
-        publish-youtube,
-      ]
-    if: ${{ always() && (inputs.mode == 'Everything' || inputs.mode == 'Skip submit') && needs.merge-to-main.result == 'success' && needs.electron-release.result == 'success' && needs.cask-commit-back.result == 'success' && needs.docs.result == 'success' && needs.publish-youtube.result == 'success' }}
+    needs: [prep, merge-to-main, electron-release, cask-commit-back]
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && (needs.prep.outputs.mode == 'Everything' || needs.prep.outputs.mode == 'Skip submit') && needs.merge-to-main.result == 'success' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
       - name: Delete dev branch in Termix
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
-          git push https://x-access-token:${{ secrets.GHCR_TOKEN }}@github.com/${{ github.repository }}.git \
+          git push https://x-access-token:${{ secrets.TERMIX_PAT }}@github.com/${{ github.repository }}.git \
             --delete "${{ needs.prep.outputs.dev_branch }}" || true
-
-      - name: Delete dev branch in Docs
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          git push https://x-access-token:${{ secrets.GHCR_TOKEN }}@github.com/Termix-SSH/Docs.git \
-            --delete "dev-${{ needs.prep.outputs.version }}" || true

.gitignore

@@ -13,9 +13,17 @@ dist-ssr
 coverage
 *.local
 
+# Plugin build output. termix-plugin build writes it, the packaged server
+# gets its copy under dist/plugins.
+*.tmxplug
+*.tmxplug.sig
+termix-plugin-signing.key
+/src/**/*.js
+
 .vscode/
-.idea
+.idea/
 .DS_Store
+Thumbs.db
 *.suo
 *.ntvs*
 *.njsproj
@@ -33,5 +41,7 @@ electron/build-info.cjs
 /.mcp.json
 /CLAUDE.md
 /old_db/
-/scripts/fix-bugs.mjs
-/scripts/fix-features.mjs
+/scripts/auto-fix.mjs
+/scripts/auto-fix-blocklist.json
+/scripts/auto-fix-state.json
+/scripts/auto-fix-report-*.json

.husky/commit-msg

@@ -1 +1 @@
-npx --no -- commitlint --edit $1
+npx --no -- commitlint --edit "$1"

.husky/pre-commit

@@ -1 +1,3 @@
-npx lint-staged
+# The .cmd shims on Windows add their own paths to each command, so keep
+# lint-staged's chunks well under cmd.exe's 8191 character limit.
+npx lint-staged --max-arg-length 4000

.prettierignore

@@ -1,19 +1,14 @@
 build
 coverage
 dist
+node_modules
+package-lock.json
+
 dist-ssr
 release
-
-node_modules
-src/mcp-server/node_modules
-package-lock.json
-pnpm-lock.yaml
-yarn.lock
-
 db
-
-.env
-
 *.min.js
 *.min.css
 openapi.json
+drizzle/
+src/ui/settings/settings-search-index.ts

CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+## 26.10.0
+
+### Added
+
+- Plugins. Every feature beyond hosts, credentials and sharing is now its own plugin with its own repo, and you pick which ones you want
+- A Plugins tab to install, update, pin, turn off and remove plugins from the official registry, with release notes and a beta channel per plugin
+- Developer mode to install a plugin from a file, and a plugin SDK on npm to build your own
+- The community plugin registry is open for submissions. Termix can install community plugins in a later update
+- Redesigned UI with a Manage tab for hosts and credentials and a Settings tab with search
+- New full screen onboarding where you choose which plugins to start with
+- Beta channel for Termix itself in Settings > Updates
+- Docs links on every settings page, in the Plugins tab, in plugin settings and in the command palette
+- Plugins can link their own docs and list the environment variables they read, shown on their page in the Plugins tab
+- Report a bug links that open a prefilled issue in the right repo
+- `TRUSTED_PROXIES` to choose which proxies nginx takes client IPs from
+
+### Changed
+
+- Termix now uses calendar versions (year, month, patch), starting with 26.10.0
+- Redesigned host defaults with admin, user and folder levels
+- Simpler host status: online or offline, kept live without a refresh
+- Bug reports and feature requests now go to each repo instead of the Support repo
+
+### Fixed
+
+- A lot of bugs across the app, the desktop app and every plugin
+- Several security issues reported through GitHub advisories
+
+### Removed
+
+- Downgrading to 2.8 is no longer supported. A 2.8 install has to start 2.9 once before upgrading
+- The donation reminder popup

CODE_OF_CONDUCT.md

@@ -1,128 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-- Demonstrating empathy and kindness toward other people
-- Being respectful of differing opinions, viewpoints, and experiences
-- Giving and gracefully accepting constructive feedback
-- Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-- Focusing on what is best not just for us as individuals, but for the
-  overall community
-
-Examples of unacceptable behavior include:
-
-- The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-- Trolling, insulting or derogatory comments, and personal or political attacks
-- Public or private harassment
-- Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-- Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-mail@termix.site.
-All complaints will be reviewed and investigated promptly and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -1,8 +1,10 @@
 # Contributing
 
+Termix is a small core plus plugins. This repo is the core: hosts, credentials, users, sharing, sessions, the app shell and the plugin runtime. Every other feature lives in its own `Plugin-<Name>` repo. If your change is about the terminal, file manager, Docker or any other plugin feature, open it in that plugin's repo instead.
+
 ## Prerequisites
 
-- [Node.js](https://nodejs.org/en/download/) (built with v24)
+- [Node.js](https://nodejs.org/en/download/) 22.12 or newer (built with v24)
 - [NPM](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
 - [Git](https://git-scm.com/downloads)
 
@@ -19,88 +21,55 @@
 
 ## Running the development server
 
-Run the following commands:
-
 ```sh
 npm run dev
-npm run dev:backend
 ```
 
-This will start the backend and the frontend Vite server. You can access Termix by going to `http://localhost:5174/`.
+This builds everything, starts the backend and then the Vite server at `http://localhost:5173/`. Backend changes restart the backend, and plugin changes in `../Termix-Plugins` rebuild and reload that plugin. `npm run dev:electron` does the same with the desktop app, and `npm run dev -- --help` lists the other options.
 
-## Contributing
+## Useful commands
 
-1. **Fork the repository**: Click the "Fork" button at the top right of
-   the [repository page](https://github.com/Termix-SSH/Termix).
-2. **Create a new branch**:
+```sh
+npm run test         # run the test suite
+npm run type-check   # type-check the core
+npm run lint         # lint and the other repo checks
+npm run format       # format the code with Prettier
+```
+
+## Making a change
+
+1. **Fork the repository**: Click "Fork" at the top right of the [repository page](https://github.com/Termix-SSH/Termix).
+2. **Create a branch**:
    ```sh
    git checkout -b feature/my-new-feature
    ```
-3. **Make your changes**: Implement your feature, fix, or improvement.
+3. **Make your changes** and add or update tests for them.
 4. **Commit your changes**:
    ```sh
-   git commit -m "Feature request my new feature"
+   git commit -m "feat: add my new feature"
    ```
 5. **Push to your fork**:
    ```sh
-   git push origin feature/my-feature-request
+   git push origin feature/my-new-feature
    ```
-6. **Open a pull request**: Go to the original repository and create a PR with a clear description.
+6. **Open a pull request** against the current `dev-*` branch with a clear description.
 
 ## Guidelines
 
-- Follow the existing code style. Use Tailwind CSS with shadcn components.
-- Use the below color scheme with the respective CSS variable placed in the `className` of a div/component.
-- Place all API routes in the `main-axios.ts` file. Updating the `openapi.json` is unneeded.
-- Include meaningful commit messages.
-- Link related issues when applicable.
-- `MobileApp.tsx` renders when the users screen width is less than 768px, otherwise it loads the usual `DesktopApp.tsx`.
+- Follow the existing code style. The frontend uses React, Tailwind CSS and shadcn components in `src/ui/`.
+- Never hardcode text. Use `t()` and add the English string to `src/ui/locales/en.json`. That's the only locale file you need to update. Other languages are translated automatically, and if an automatic translation is wrong you can fix it in that language's file.
+- Keep the UI flat and square. Avoid rounded corners on panels, cards and dialogs.
+- Use the theme variables (like `var(--bg-base)` and `var(--text-primary)`) instead of fixed colors.
+- There is one component tree for desktop and mobile. Use `src/ui/hooks/use-mobile.ts` for layout changes.
+- Core never names a plugin. If core needs something from a plugin, add a slot, action or component id that the plugin fills.
+- Tests live in `src/backend/tests/` and `src/ui/tests/`, mirroring the source tree. `npm run test` must pass.
+- Every API route gets an OpenAPI JSDoc comment like the routes around it.
+- Use short commit messages that start with `feat:`, `fix:` or `chore:`, and link related issues.
 
-## Color Scheme
+## Building a plugin
 
-### Background Colors
-
-| CSS Variable                  | Color Value | Usage                       | Description                              |
-| ----------------------------- | ----------- | --------------------------- | ---------------------------------------- |
-| `--color-dark-bg`             | `#18181b`   | Main dark background        | Primary dark background color            |
-| `--color-dark-bg-darker`      | `#0e0e10`   | Darker backgrounds          | Darker variant for panels and containers |
-| `--color-dark-bg-darkest`     | `#09090b`   | Darkest backgrounds         | Darkest background (terminal)            |
-| `--color-dark-bg-light`       | `#141416`   | Light dark backgrounds      | Lighter variant of dark background       |
-| `--color-dark-bg-very-light`  | `#101014`   | Very light dark backgrounds | Very light variant of dark background    |
-| `--color-dark-bg-panel`       | `#1b1b1e`   | Panel backgrounds           | Background for panels and cards          |
-| `--color-dark-bg-panel-hover` | `#232327`   | Panel hover states          | Background for panels on hover           |
-
-### Element-Specific Backgrounds
-
-| CSS Variable             | Color Value | Usage              | Description                                   |
-| ------------------------ | ----------- | ------------------ | --------------------------------------------- |
-| `--color-dark-bg-input`  | `#222225`   | Input fields       | Background for input fields and form elements |
-| `--color-dark-bg-button` | `#23232a`   | Button backgrounds | Background for buttons and clickable elements |
-| `--color-dark-bg-active` | `#1d1d1f`   | Active states      | Background for active/selected elements       |
-| `--color-dark-bg-header` | `#131316`   | Header backgrounds | Background for headers and navigation bars    |
-
-### Border Colors
-
-| CSS Variable                 | Color Value | Usage           | Description                              |
-| ---------------------------- | ----------- | --------------- | ---------------------------------------- |
-| `--color-dark-border`        | `#303032`   | Default borders | Standard border color                    |
-| `--color-dark-border-active` | `#2d2d30`   | Active borders  | Border color for active elements         |
-| `--color-dark-border-hover`  | `#434345`   | Hover borders   | Border color on hover states             |
-| `--color-dark-border-light`  | `#5a5a5d`   | Light borders   | Lighter border color for subtle elements |
-| `--color-dark-border-medium` | `#373739`   | Medium borders  | Medium weight border color               |
-| `--color-dark-border-panel`  | `#222224`   | Panel borders   | Border color for panels and cards        |
-
-### Interactive States
-
-| CSS Variable             | Color Value | Usage             | Description                                   |
-| ------------------------ | ----------- | ----------------- | --------------------------------------------- |
-| `--color-dark-hover`     | `#2d2d30`   | Hover states      | Background color for hover effects            |
-| `--color-dark-active`    | `#2a2a2c`   | Active states     | Background color for active elements          |
-| `--color-dark-pressed`   | `#1a1a1c`   | Pressed states    | Background color for pressed/clicked elements |
-| `--color-dark-hover-alt` | `#2a2a2d`   | Alternative hover | Alternative hover state color                 |
+Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). It talks to Termix only through `@termix-ssh/plugin-sdk` and has its own build, test and release setup.
 
 ## Support
 
-If you need help or want to request a feature with Termix, visit the [Issues](https://github.com/Termix-SSH/Support/issues) page, log in, and press `New Issue`.
-Please be as detailed as possible in your issue, preferably written in English. You can also join the [Discord](https://discord.gg/jVQGdvHDrf) server and visit the support
-channel, however, response times may be longer.
+Bugs and ideas for Termix itself go in [this repo](https://github.com/Termix-SSH/Termix/issues/new/choose). Plugin problems go in that plugin's own `Plugin-<Name>` repo. Please be as detailed as possible, preferably in English. You can also ask in the [Discord](https://discord.gg/jVQGdvHDrf) server.

Casks/termix.rb

@@ -1,10 +1,10 @@
 cask "termix" do
-  version "2.4.1"
-  sha256 "c71209bf0bde9eefa5aeefbfc2b1db3af4ca3546e5f2ef09d233a6d3d1719150"
+  version "2.9.2"
+  sha256 "808d876b37ab802c511e964c232619b1ba2949ec39ccd2b1f97e264544739172"
 
-  url "https://github.com/Termix-SSH/Termix/releases/download/release-#{version}-tag/termix_macos_universal_dmg.dmg"
+  url "https://github.com/Termix-SSH/Termix/releases/download/v#{version}/termix_macos_universal_dmg.dmg"
   name "Termix"
-  desc "Web-based server management platform with SSH terminal, tunneling, and file editing"
+  desc "Self-hosted, plugin-based server management"
   homepage "https://github.com/Termix-SSH/Termix"
 
   livecheck do

LICENSE

@@ -1,13 +1,203 @@
-Copyright 2025 Luke Gustafson
+Copyright 2026 Luke Gustafson
 
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-    http://www.apache.org/licenses/LICENSE-2.0
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -4,24 +4,7 @@
 
 <h1>Termix</h1>
 
-<p>Self-hosted SSH management and remote desktop access</p>
-
-<p>
-  English ·
-  <a href="readme/README-CN.md">中文</a> ·
-  <a href="readme/README-JA.md">日本語</a> ·
-  <a href="readme/README-KO.md">한국어</a> ·
-  <a href="readme/README-FR.md">Français</a> ·
-  <a href="readme/README-DE.md">Deutsch</a> ·
-  <a href="readme/README-ES.md">Español</a> ·
-  <a href="readme/README-PT.md">Português</a> ·
-  <a href="readme/README-RU.md">Русский</a> ·
-  <a href="readme/README-AR.md">العربية</a> ·
-  <a href="readme/README-HI.md">हिन्दी</a> ·
-  <a href="readme/README-TR.md">Türkçe</a> ·
-  <a href="readme/README-VI.md">Tiếng Việt</a> ·
-  <a href="readme/README-IT.md">Italiano</a>
-</p>
+<p>Self-hosted, plugin-based server management</p>
 
 <p>
   <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
@@ -31,23 +14,8 @@
   <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>
 
-<br />
-
-Termix is free and open source. If you find it useful, consider [donating](https://donate.termix.site/) to help cover server costs and development time.
-
-<a href="https://donate.termix.site/"><img src="./repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
-
-<br />
-
-<img src="./repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
 <p>
-  <img src="repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Achieved on September 1st, 2025</sub>
+  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
 </p>
 
 </div>
@@ -56,160 +24,75 @@ Termix is free and open source. If you find it useful, consider [donating](https
 
 ## Overview
 
-Termix is an open-source, forever-free, self-hosted all-in-one server management platform. It provides a multi-platform solution for managing your servers and infrastructure through a single, intuitive interface. Termix offers SSH terminal access, remote desktop control (RDP, VNC, Telnet), SSH tunneling capabilities, remote file management, and many other tools. Termix is the perfect free and self-hosted alternative to Termius available for all platforms.
+Termix is a free, open source, self-hosted platform for managing your servers, built on plugins. The core is small. It keeps your hosts, credentials, users, sharing and sessions. Everything else, like the SSH terminal, remote desktop, file manager, Docker and metrics, is a plugin you can turn on, turn off or remove.
+
+It runs on web, desktop and mobile, and it is a self-hosted alternative to Termius that stays free forever.
 
 <br />
 
-## Features
+## Try the Demo
 
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**SSH Terminal Access:**
-Full-featured terminal with split-screen support (up to 4 panels) with a browser-like tab system. Includes support for customizing the terminal including common terminal themes, fonts, and other components.
-
-</td>
-<td width="50%" valign="top">
-
-**Remote Desktop Access:**
-RDP, VNC, and Telnet support over the browser with complete customization and split screening.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**SSH Tunnel Management:**
-Create and manage server-to-server SSH tunnels with automatic reconnection, health monitoring, and local, remote, or dynamic SOCKS forwarding. Desktop client-to-server tunnel settings are stored locally per desktop install, optional C2S preset snapshots can be saved to the server, renamed, loaded, or deleted when you want to move a local tunnel configuration between clients.
-
-</td>
-<td width="50%" valign="top">
-
-**Remote File Manager:**
-Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly with sudo support. Includes support for moving files from server to server.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Docker and Podman Management:**
-Start, stop, pause, remove containers. View container stats. Control containers using a docker exec terminal. Supports both Docker and Podman as the container runtime. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH Host Manager:**
-Save, organize, and manage your SSH connections with tags and folders (folder customization and nested folder support), and easily save reusable login info while being able to automate the deployment of SSH keys.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Host Metrics:**
-View CPU, memory, disk usage, network, uptime, system information, firewall, port monitor, log viewer, users/permissions, certificates, and many more which work on most Linux based servers. Includes time-series history graphs and threshold-based alerts with ntfy and webhook support.
-
-</td>
-<td width="50%" valign="top">
-
-**User Authentication:**
-Secure user management with admin controls and OIDC/LDAP/SSO (with access control), 2FA (TOTP), and passkey (WebAuthn) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together. View audit log of all users actions.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tailscale Integration:**
-List devices from your tailnet to quickly add them as hosts, and connect using Tailscale SSH as an authentication method, letting your tailnet ACLs handle authorization without storing credentials.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC:**
-Create roles and share hosts across users/roles.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Serial Connections:**
-Connect to serial devices (routers, switches, microcontrollers, etc.) directly from the browser or desktop app. Configure baud rate, data bits, stop bits, and parity. Uses the Web Serial API in supported browsers or a native backend in the Electron app.
-
-</td>
-<td width="50%" valign="top">
-
-**Alerts:**
-Set threshold-based alert rules on host metrics (CPU, memory, disk, etc.) and get notified via ntfy or webhooks when they fire. View firing and resolved alerts in a history log.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Homepage:**
-A fully customizable homepage with a drag-and-drop widget grid. Add widgets for host status, service links, clocks, notes, RSS feeds, weather, Docker containers, host metrics charts, embedded terminals, iframes, and more.
-
-</td>
-<td width="50%" valign="top">
-
-**Database Encryption:**
-Backend stored as encrypted SQLite database files. View [docs](https://docs.termix.site/security) for more.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Network Graph:**
-Customize your Dashboard to visualize your homelab based off your SSH connections with status support.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH Tools:**
-Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Persistent Tabs:**
-SSH sessions and tabs stay open across devices/refreshes if enabled in user profile.
-
-</td>
-<td width="50%" valign="top">
-
-**Languages:**
-Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
+Want to see it before you install it? Try the demo at [demo.termix.site](https://demo.termix.site/). Any username and password works.
 
 <br />
 
-<details>
-<summary><b>More features</b></summary>
+## Core
+
+What every Termix install has, with or without plugins:
+
+- **Hosts:** Save hosts in nested folders with tags and parent hosts, bulk edit, import and export, and use Quick Connect for one-off connections
+- **Credentials:** Reuse saved passwords and keys across hosts, with host defaults you can set for the server, a user or a folder
+- **Sharing and Roles:** Share hosts, credentials and folders with users or roles at four levels: connect, view, edit and manage
+- **Accounts:** Local accounts, sessions you can see and revoke, trusted devices, API keys and an audit log
+- **Security:** Passwords, keys and other secrets are encrypted per user, and the database can be encrypted on disk
+- **Desktop Sync:** The desktop app runs on its own and can link to a Termix server to keep an offline copy of your account
+- **Interface:** Tabs and split screen, a command palette (double tap left shift), rebindable shortcuts, themes, branding and around 30 languages
+- **Databases:** SQLite by default, with PostgreSQL and MySQL supported too
+
 <br />
 
-- **Dashboard** - View server information at a glance on your dashboard
-- **API Keys** - Create user-scoped API keys with expiration dates to be used for automation/CI
-- **Data Export/Import** - Export and import SSH hosts, credentials, and file manager data
-- **Automatic SSL Setup** - Built-in SSL certificate generation and management with HTTPS redirects
-- **Modern UI** - Clean desktop/mobile-friendly interface built with React, Tailwind CSS, and Shadcn. Choose between many different UI themes including light, dark, Dracula, etc. Use URL routes to open any connection in full-screen.
-- **Command History** - Auto-complete and view previously ran SSH commands
-- **Quick Connect** - Connect to a server without having to save the connection data
-- **Command Palette** - Double tap left shift to quickly access SSH connections with your keyboard
-- **Proxmox Integration** - Auto-add hosts into Termix from your Proxmox instance
-- **SSH Feature Rich** - Supports jump hosts, Warpgate, TOTP based connections, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, SSH agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, and more.
-- **Termix ID** - A sshid.io equivalent built into Termix. Claim a handle, publish your public SSH keys at a resolver URL, and use a built-in CA to issue SSH certificates.
+## Plugins
 
-</details>
+Plugins add everything else. The official ones ship with Termix, and admins can install, update or remove plugins from the Plugins tab. Each plugin has its own repo.
+
+| Plugin                                                                      | What it does                                                                                                |
+| --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| [ACME Certificates](https://github.com/Termix-SSH/Plugin-ACME-SSL)          | Gets the Termix HTTPS certificate from Let's Encrypt or any ACME provider and renews it for you.            |
+| [AI Assistant](https://github.com/Termix-SSH/Plugin-AI)                     | An AI assistant that reads your setup and proposes changes for you to approve.                              |
+| [Alerts](https://github.com/Termix-SSH/Plugin-Alerts)                       | One inbox for every alert in Termix, with delivery to webhooks, ntfy, Discord and email.                    |
+| [Automations](https://github.com/Termix-SSH/Plugin-Automations)             | Run steps on your hosts on a schedule or when something happens.                                            |
+| [Docker](https://github.com/Termix-SSH/Plugin-Docker)                       | Manage Docker and Podman containers on your hosts over SSH, with logs, stats and a console.                 |
+| [File Manager](https://github.com/Termix-SSH/Plugin-File-Manager)           | Browse, edit and move files over SFTP, including straight from one server to another.                       |
+| [Fleets](https://github.com/Termix-SSH/Plugin-Fleets)                       | Group hosts into fleets and run commands, package actions and file transfers on all of them at once.        |
+| [HashiCorp Vault](https://github.com/Termix-SSH/Plugin-Vault)               | Connect to hosts with short-lived SSH certificates signed by HashiCorp Vault.                               |
+| [Homepage](https://github.com/Termix-SSH/Plugin-Homepage)                   | A drag and drop widget page for your servers and services, plus service links for the dashboard.            |
+| [Host Metrics](https://github.com/Termix-SSH/Plugin-Host-Metrics)           | Live CPU, memory, disk, network and GPU stats, plus tools to manage your hosts.                             |
+| [LDAP](https://github.com/Termix-SSH/Plugin-LDAP)                           | Sign in with your LDAP or Active Directory username and password.                                           |
+| [Network Topology](https://github.com/Termix-SSH/Plugin-Network-Topology)   | Draws your hosts and the links between them as a live, interactive graph.                                   |
+| [OPKSSH](https://github.com/Termix-SSH/Plugin-OPKSSH)                       | Connect to hosts with short-lived OpenPubkey SSH certificates after signing in with your identity provider. |
+| [Passkeys](https://github.com/Termix-SSH/Plugin-WebAuthn)                   | Sign in with a passkey or security key instead of a password.                                               |
+| [Proxmox](https://github.com/Termix-SSH/Plugin-Proxmox)                     | Import Proxmox VE guests as hosts, keep them in sync and watch node stats.                                  |
+| [Remote Desktop](https://github.com/Termix-SSH/Plugin-Remote-Desktop)       | RDP, VNC and Telnet sessions in your browser, with clipboard, file transfer, sharing and recording.         |
+| [Secret Sources](https://github.com/Termix-SSH/Plugin-Secret-Sources)       | Pull host passwords and keys from 1Password when you connect instead of storing them in Termix.             |
+| [Serial](https://github.com/Termix-SSH/Plugin-Serial)                       | Open a serial console to a router, switch or other device plugged into your computer.                       |
+| [Session Recording](https://github.com/Termix-SSH/Plugin-Session-Recording) | Record terminal and remote desktop sessions and play them back or download them later.                      |
+| [Session Sharing](https://github.com/Termix-SSH/Plugin-Session-Sharing)     | Share live sessions by link or with another user, and present sessions to a group in meeting rooms.         |
+| [Single sign-on](https://github.com/Termix-SSH/Plugin-SSO)                  | Sign in with any OpenID Connect provider, GitHub or Google.                                                 |
+| [Snippets](https://github.com/Termix-SSH/Plugin-Snippets)                   | Save the commands you run often and run them in a terminal or on many hosts in one click.                   |
+| [SSH Terminal](https://github.com/Termix-SSH/Plugin-SSH-Terminal)           | SSH terminal sessions with tabs, split screen, history, macros and a local terminal in the desktop app.     |
+| [Step CA](https://github.com/Termix-SSH/Plugin-Step-CA)                     | Connect to hosts with short-lived SSH certificates from a smallstep step-ca server.                         |
+| [Tailscale](https://github.com/Termix-SSH/Plugin-Tailscale)                 | Add tailnet devices as hosts and connect with Tailscale SSH.                                                |
+| [Termix Identity](https://github.com/Termix-SSH/Plugin-Termix-Identity)     | Publish your SSH public keys under a public handle and run your own SSH certificate authority.              |
+| [Tmux Monitor](https://github.com/Termix-SSH/Plugin-Tmux-Monitor)           | Browse and control tmux sessions, windows and panes across your hosts.                                      |
+| [TOTP](https://github.com/Termix-SSH/Plugin-TOTP)                           | Two-factor sign in with a code from an authenticator app, with backup codes.                                |
+| [Tunnels](https://github.com/Termix-SSH/Plugin-Tunnels)                     | SSH port forwarding that reconnects on its own, plus client tunnels from the desktop app.                   |
+| [Usage Statistics](https://github.com/Termix-SSH/Plugin-Telemetry)          | Sends a small anonymous daily report so we can see how Termix is used.                                      |
+| [Wake-on-LAN](https://github.com/Termix-SSH/Plugin-Wake-On-LAN)             | Wake sleeping machines by sending a Wake-on-LAN packet to their MAC address.                                |
+| [Warpgate](https://github.com/Termix-SSH/Plugin-Warpgate)                   | Connect to hosts through a Warpgate SSH bastion.                                                            |
+| [Web Endpoint](https://github.com/Termix-SSH/Plugin-Web-Endpoint)           | Open a host's web UI inside Termix, directly or over an SSH tunnel.                                         |
+| [Workspaces](https://github.com/Termix-SSH/Plugin-Workspaces)               | Save your open tabs and split layouts and reopen them in one click.                                         |
+
+Want to build your own? Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). Plugins you can install are listed in the [registry](https://github.com/Termix-SSH/Termix-Registry). Its community registry is open for submissions now, and Termix will be able to install community plugins in a later update. See [submitting a plugin](https://docs.termix.site/develop/community-registry).
 
 <br />
 
@@ -226,14 +109,14 @@ Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/tr
 </tr>
 <tr>
 <td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portable · MSI Installer · Chocolatey</td>
+<td>Portable · EXE and MSI Installer · Chocolatey</td>
 </tr>
 <tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
+<td align="center"><b>Linux</b> <sub>x64/arm64/armv7l</sub></td>
 <td>Portable · AUR · AppImage · Deb · Flatpak</td>
 </tr>
 <tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
+<td align="center"><b>macOS</b> <sub>Universal/x64/arm64, v12.0+</sub></td>
 <td>Apple App Store · DMG · Homebrew</td>
 </tr>
 <tr>
@@ -250,14 +133,14 @@ Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/tr
 
 ## Installation
 
-Visit the [Termix Docs](https://docs.termix.site/install) for full installation instructions across all platforms.
+Visit the [Termix Docs](https://docs.termix.site/install) for full install steps on every platform.
 
-Sample Docker Compose file (you can omit `guacd` and the network if you don't plan on using remote desktop features):
+Sample Docker Compose file (you can leave out `guacd` and the network if you don't plan to use the Remote Desktop plugin):
 
 ```yaml
 services:
   termix:
-    image: ghcr.io/lukegus/termix:latest
+    image: ghcr.io/termix-ssh/termix:latest
     container_name: termix
     restart: unless-stopped
     ports:
@@ -266,6 +149,10 @@ services:
       - termix-data:/app/data
     environment:
       PORT: "8080"
+      GUACD_HOST: "guacd"
+      GUACD_TUNNEL_HOST: "termix"
+      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
+      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
     depends_on:
       - guacd
     networks:
@@ -275,8 +162,8 @@ services:
     image: guacamole/guacd:1.6.0
     container_name: guacd
     restart: unless-stopped
-    ports:
-      - "4822:4822"
+    volumes:
+      - termix-data:/termix-data
     networks:
       - termix-net
 
@@ -289,120 +176,86 @@ networks:
     driver: bridge
 ```
 
+### Cloud Hosting
+
+You can run Termix on a VPS instead of inside your own network. If Termix runs on the network it manages, an outage takes Termix down with it, right when you need it to fix things. Running it somewhere else keeps it reachable, gives you a static IP and lets you get in from anywhere without a VPN or port forward.
+
+[GINERNET](https://docs.termix.site/install/ginernet) sponsors Termix, and the docs have a step by step guide for their VPS platform.
+
 <br />
 
 ## Donate
 
-Termix is free and open source with no subscriptions or paid plans. If you find it useful, consider donating to help cover server costs, domains, and development time.
+Termix is free and open source with no subscriptions or paid plans. If you find it useful, consider donating to help cover server costs, domains and development time.
 
 [Donate](https://donate.termix.site/)
 
 <br />
 
-## Screenshots
-
-<div align="center">
-
-<br />
-
-[![YouTube](./repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Watch update overviews on YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="./repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="./repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="./repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="./repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="./repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="./repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="./repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="./repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="./repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Some videos and images may be out of date or may not perfectly showcase features.</sub>
-
-</div>
-
-<br />
-
-## Planned Features
-
-See [Projects](https://github.com/orgs/Termix-SSH/projects/5) for all planned features. If you are looking to contribute, see [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
 ## Sponsors
 
+Interested in a paid placement to support development? Email [mail@termix.site](mailto:mail@termix.site).
+
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
+</a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://rackgenius.com/">
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
+</a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://ginernet.com/">
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
+</a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
 </a>
 
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Support
 
-If you need help or want to request a feature with Termix, visit the [Issues](https://github.com/Termix-SSH/Support/issues) page, log in, and press `New Issue`. Please be as detailed as possible in your issue, preferably written in English. You can also join the [Discord](https://discord.gg/jVQGdvHDrf) server and visit the support channel, however, response times may be longer.
+Bugs and ideas for Termix itself (login, hosts, credentials, sharing, sync, the app and desktop app) go in this repo: [report a bug](https://github.com/Termix-SSH/Termix/issues/new?template=bug_report.yml) or [request a feature](https://github.com/Termix-SSH/Termix/issues/new?template=feature_request.yml).
+
+Every plugin has its own repo, so a problem with the terminal, file manager, Docker, remote desktop or any other plugin goes in that plugin's repo (see the table above, or use Report an issue on the plugin's page in the app, which fills in your versions for you). Not sure where it goes? Open it here and it will be moved.
+
+You need to be logged in to GitHub. Please be as detailed as possible, preferably in English.
+
+For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf) server. Update videos are on [YouTube](https://www.youtube.com/@TermixSSH/videos).
 
 <br />
 
 ## License
 
-Distributed under the Apache License Version 2.0. See `LICENSE` for more information.
+Distributed under the Apache License Version 2.0. See [LICENSE](LICENSE) for more information.

RELEASE_NOTES.md

@@ -1,81 +0,0 @@
-<!-- SUMMARY -->
-
-Major new features including serial connections, Tailscale/WireGuard support, HashiCorp Vault SSH auth, Bitwarden SSH agent, WebAuthn passkeys, Podman support, a new grid-based dashboard, host metrics history with alerting, and much more.
-
-<!-- /SUMMARY -->
-
-<!-- YOUTUBE -->
-
-https://youtu.be/c3UD4q2jW_8
-
-<!-- /YOUTUBE -->
-
-<!-- UPDATE_LOG -->
-
-- Termix ID with a public handle, hosted public key resolver, and built-in CA for issuing SSH certificates
-- Serial connections support
-- Tailscale and WireGuard VPN host integration with status detection
-- HashiCorp Vault SSH signer authentication
-- Bitwarden SSH agent integration
-- WebAuthn passkey authentication
-- Podman container runtime support alongside Docker
-- SSH agent forwarding support across all SSH features
-- New grid and widget-based dashboard homepage
-- Grafana-style server stats history graphs
-- Alert system with ntfy and webhook notification support
-- Host temperature metrics card
-- App fullscreen mode
-- External editor support for file manager (desktop app)
-- Safe host sharing export
-- SSH credential password fallback for key-based auth
-- Open all sessions in a folder at once
-- Custom terminal theme color support
-- Custom tunnel endpoints configuration
-- GUACD_URL environment variable support
-- App rail hover expansion setting
-- Terminal font zoom with mouse wheel
-- File manager terminals promoted to full tabs
-- Donate button on dashboard
-- PuTTY PPK SSH key support
-- Confirmation dialog when closing active host connections
-- Confirmation prompt before opening large files in the editor
-- Cross-host file manager clipboard
-- Prioritize host results in command palette search
-- Retry autostart tunnel host fetches on failure
-<!-- /UPDATE_LOG -->
-
-<!-- BUG_FIXES -->
-
-- SSH port connection bug
-- VNC required argument handshake failure
-- Jump host SOCKS5 proxy selection using wrong proxy
-- Tunnel endpoint resolution failing in some configurations
-- Direct tunnel skipping endpoint credential validation incorrectly
-- Dashboard host routing ignoring protocol settings
-- Dashboard service link creation broken
-- File manager uploads failing with 400 error and missing schema migrations on upgrade
-- Large file manager uploads not chunked (chunked for files >=1.5GB)
-- File uploads over 100MB failing due to ArrayBuffer browser limit
-- File path case not preserved in file manager UI
-- File downloads unreliable in the desktop app
-- Tmux detection path handling incorrect
-- Host metrics startup polling incorrect
-- TUI terminal output highlighting incorrect
-- Runtime base path for auth callbacks incorrect
-- Windows app icon unstable
-- SSH heading syntax highlighting broken
-- Terminal link dialog layering issue
-- Electron OIDC browser authentication failures
-- Proxmox import auth fallback not working
-- OIDC role credential shares not synced for OIDC users
-- RDP connections requiring credentials when none are needed
-- VNC authentication settings not persisted
-- Guacamole unicode token corruption
-- Guacamole websocket base path incorrect
-- Guacamole disconnect during startup crash
-- Host metrics starting for non-SSH hosts
-- Sidebar host hover causing layout shift
-- Alert UI incorrectly applying Termix CSS and alert system failing to load
-- Translation key incorrect for nav close action
-- PUID HTML ownership in Docker entrypoint
-<!-- /BUG_FIXES -->

SECURITY.md

@@ -1,5 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-Please report any vulnerabilities to [GitHub Security](https://github.com/Termix-SSH/Termix/security/advisories).

biome.json

@@ -1,58 +0,0 @@
-{
-  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
-  "vcs": {
-    "enabled": true,
-    "clientKind": "git",
-    "useIgnoreFile": true,
-    "defaultBranch": "dev-2.5.0"
-  },
-  "files": {
-    "ignoreUnknown": true,
-    "includes": [
-      "**",
-      "!!build",
-      "!!coverage",
-      "!!dist",
-      "!!dist-ssr",
-      "!!release",
-      "!!node_modules",
-      "!!src/mcp-server/node_modules",
-      "!!db",
-      "!!.env",
-      "!!**/*.min.js",
-      "!!**/*.min.css",
-      "!!openapi.json"
-    ]
-  },
-  "formatter": {
-    "enabled": true,
-    "indentStyle": "space",
-    "indentWidth": 2,
-    "lineWidth": 80,
-    "lineEnding": "lf"
-  },
-  "linter": {
-    "enabled": false
-  },
-  "javascript": {
-    "formatter": {
-      "quoteStyle": "double",
-      "semicolons": "always",
-      "trailingCommas": "all",
-      "arrowParentheses": "always"
-    }
-  },
-  "json": {
-    "formatter": {
-      "trailingCommas": "none"
-    }
-  },
-  "css": {
-    "parser": {
-      "tailwindDirectives": true
-    }
-  },
-  "assist": {
-    "enabled": false
-  }
-}

build/after-pack.cjs

@@ -1,12 +0,0 @@
-const fs = require("fs");
-const path = require("path");
-
-exports.default = async function afterPack(context) {
-  const { targets, appOutDir } = context;
-
-  const isDir = targets.some((t) => t.name === "dir");
-  if (!isDir) return;
-
-  const markerPath = path.join(appOutDir, ".portable");
-  fs.writeFileSync(markerPath, "");
-};

components.json

@@ -5,7 +5,7 @@
   "tsx": true,
   "tailwind": {
     "config": "",
-    "css": "src/index.css",
+    "css": "src/ui/index.css",
     "baseColor": "neutral",
     "cssVariables": true,
     "prefix": ""
@@ -15,7 +15,7 @@
   "aliases": {
     "components": "@/components",
     "utils": "@/lib/utils",
-    "ui": "@/components/ui",
+    "ui": "@/components",
     "lib": "@/lib",
     "hooks": "@/hooks"
   },

crowdin.yml

@@ -1,6 +0,0 @@
-project_id: "858252"
-api_token: "env:CROWDIN_API_TOKEN"
-
-files:
-  - source: /src/ui/locales/en.json
-    translation: /src/ui/locales/translated/%locale_with_underscore%.json

docker/Dockerfile

@@ -1,17 +1,20 @@
 # Stage 1: Install dependencies
-FROM node:24-slim AS deps
+# The builders only produce JS, so they run on the build machine's own arch
+# once instead of under QEMU per target. Rolldown hangs under arm64 emulation.
+FROM --platform=$BUILDPLATFORM node:24-slim AS deps
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
+COPY packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
 COPY .npmrc ./
 COPY vendor ./vendor
 
-COPY scripts/patch-guacamole-lite.cjs ./scripts/
+COPY scripts/patch-ssh2-agent.cjs ./scripts/
 
 RUN npm ci --ignore-scripts && \
-    node scripts/patch-guacamole-lite.cjs && \
+    node scripts/patch-ssh2-agent.cjs && \
     npm cache clean --force
 
 # Stage 2: Build frontend
@@ -31,41 +34,76 @@ WORKDIR /app
 
 COPY . .
 
-RUN npm rebuild better-sqlite3
-
 RUN npm run build:backend
 
-# Stage 4: Production dependencies only
+# Stage 4: Download OPKSSH binary for the target platform so the image works offline
+FROM node:24-slim AS opkssh-downloader
+ARG TARGETARCH
+ARG OPKSSH_VERSION=v0.16.0
+ARG OPKSSH_SHA256_AMD64=c018c3e7baf98612b923e742dd87be38650bf61e3b755fb2bc90de177568b1bf
+ARG OPKSSH_SHA256_ARM64=9dd10c2b6ce99cde18e52c054877ca014134b291fd82afe71741c68db4f83d44
+WORKDIR /opkssh
+
+RUN apt-get update && apt-get install -y curl ca-certificates && rm -rf /var/lib/apt/lists/*
+
+RUN case "$TARGETARCH" in \
+      amd64) OPKSSH_ARCH=amd64; OPKSSH_SHA256="$OPKSSH_SHA256_AMD64" ;; \
+      arm64) OPKSSH_ARCH=arm64; OPKSSH_SHA256="$OPKSSH_SHA256_ARM64" ;; \
+      *) echo "Unsupported architecture: $TARGETARCH" && exit 1 ;; \
+    esac && \
+    curl -fSL -o "opkssh-linux-${OPKSSH_ARCH}" \
+      "https://github.com/openpubkey/opkssh/releases/download/${OPKSSH_VERSION}/opkssh-linux-${OPKSSH_ARCH}" && \
+    echo "$OPKSSH_SHA256  opkssh-linux-${OPKSSH_ARCH}" | sha256sum -c - && \
+    chmod 755 "opkssh-linux-${OPKSSH_ARCH}" && \
+    echo -n "$OPKSSH_VERSION" > version.txt
+
+# Stage 5: Production dependencies only
 FROM node:24-slim AS production-deps
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
+# The plugin SDK is a workspace package core imports at runtime, so npm ci
+# has to see it to link it and install its dependencies.
+COPY packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
 COPY .npmrc ./
 COPY vendor ./vendor
 
-COPY scripts/patch-guacamole-lite.cjs ./scripts/
+COPY scripts/patch-ssh2-agent.cjs ./scripts/
 
 RUN npm ci --omit=dev --ignore-scripts && \
-    node scripts/patch-guacamole-lite.cjs && \
-    npm rebuild better-sqlite3 bcryptjs ssh2 && \
+    node scripts/patch-ssh2-agent.cjs && \
+    rm -rf node_modules/better-sqlite3/prebuilds && \
+    npm run build-release --prefix node_modules/better-sqlite3 && \
+    test -f node_modules/better-sqlite3/build/Release/better_sqlite3.node && \
+    npm rebuild bcryptjs ssh2 && \
     npm cache clean --force
 
-# Stage 5: Final optimized image
+# Stage 6: Final optimized image
 FROM node:24-slim
 WORKDIR /app
 
+# The release the opkssh-downloader stage baked in, so the plugin trusts that
+# binary when the build picks a version other than its pinned one.
+ARG OPKSSH_VERSION=v0.16.0
+ARG OPKSSH_SHA256_AMD64=c018c3e7baf98612b923e742dd87be38650bf61e3b755fb2bc90de177568b1bf
+ARG OPKSSH_SHA256_ARM64=9dd10c2b6ce99cde18e52c054877ca014134b291fd82afe71741c68db4f83d44
+
 ENV DATA_DIR=/app/data \
+    OPKSSH_BUNDLED_DIR=/app/opkssh-bundled \
+    OPKSSH_VERSION=$OPKSSH_VERSION \
+    OPKSSH_SHA256_AMD64=$OPKSSH_SHA256_AMD64 \
+    OPKSSH_SHA256_ARM64=$OPKSSH_SHA256_ARM64 \
     PORT=8080 \
     NODE_ENV=production
 
-RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu wget certbot python3-certbot-dns-cloudflare && \
+RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu wget && \
     update-ca-certificates && \
     rm -rf /var/lib/apt/lists/* && \
-    mkdir -p /app/data /app/uploads /app/data/.opk /app/nginx /tmp/nginx && \
+    mkdir -p /app/data /app/uploads /app/nginx /tmp/nginx && \
     chown -R node:node /app /tmp/nginx && \
-    chmod 755 /app/data /app/uploads /app/data/.opk /app/nginx /tmp/nginx
+    chmod 755 /app/data /app/uploads /app/nginx /tmp/nginx
 
 COPY docker/nginx.conf /app/nginx/nginx.conf.template
 COPY docker/nginx-https.conf /app/nginx/nginx-https.conf.template
@@ -74,11 +112,23 @@ COPY --chown=node:node --from=frontend-builder /app/dist /app/html
 
 COPY --chown=node:node --from=production-deps /app/node_modules /app/node_modules
 COPY --chown=node:node --from=backend-builder /app/dist/backend ./dist/backend
+# Plugins pinned in docker/bundled-plugins.json, resolved as dist/plugins by
+# getBundledPluginsDir().
+COPY --chown=node:node --from=backend-builder /app/dist/plugins ./dist/plugins
+# Target of node_modules/@termix-ssh/plugin-sdk, which core and the plugins import.
+COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
+COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/dist ./packages/plugin-sdk/dist
+# Pre-baked OPKSSH binary. The opkssh plugin uses it when its checksum
+# matches, so an offline install never downloads one.
+COPY --chown=node:node --from=opkssh-downloader /opkssh /app/opkssh-bundled
 COPY --chown=node:node package.json ./
+# Schema for Postgres and MySQL. Unused by the default SQLite deployment, which
+# builds its tables at startup instead.
+COPY --chown=node:node drizzle ./drizzle
 
 VOLUME ["/app/data"]
 
-EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006 30007 30008 30009 30010 30011 30012
+EXPOSE ${PORT}
 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
     CMD wget -q -O /dev/null http://localhost:30001/health || exit 1

docker/bundled-plugins.json

@@ -0,0 +1,265 @@
+{
+  "plugins": [
+    {
+      "id": "acme-ssl",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.0.0/acme-ssl-1.0.0.tmxplug",
+      "sha256": "34aa172b2f6bc6a773ebdff2ec0f590d411ce258fd43176bdddb4c30d1fe30da"
+    },
+    {
+      "id": "ai",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.0.0/ai-1.0.0.tmxplug",
+      "sha256": "ad291a2c6f6f01b72ebd275e8d202b78f55bc13a1e1a40f419d04e71b2fbd06b"
+    },
+    {
+      "id": "alerts",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.0.0/alerts-1.0.0.tmxplug",
+      "sha256": "3fe008f9d2a32e2b7111399054a2264ea5cf5d71264cc31e85cdab3e909cc62f",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "automations",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.0.0/automations-1.0.0.tmxplug",
+      "sha256": "76d4cff6e78d40ec67e899f0c7b2aca43d35a47b9a15071d0a8f5a8d939af9a9"
+    },
+    {
+      "id": "docker",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.0.0/docker-1.0.0.tmxplug",
+      "sha256": "641e564ba915a72efed4236272d63f6fff43904309833870f3554d3e9bd28dfa",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "file-manager",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.0.0/file-manager-1.0.0.tmxplug",
+      "sha256": "1cafccfe86a29e2f318026ca7bc20629df94331c81209607976dafd7feac0ca4",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "fleets",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.0/fleets-1.0.0.tmxplug",
+      "sha256": "1ebeccd6b2a8e9510ab56658374d0b87f652149101d14956752a696ca920f611"
+    },
+    {
+      "id": "homepage",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.0.0/homepage-1.0.0.tmxplug",
+      "sha256": "65cd21802f6a71f3b3c582bc0007bfc91160abc161b2390bce715fd2ed987f99"
+    },
+    {
+      "id": "host-metrics",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.0.0/host-metrics-1.0.0.tmxplug",
+      "sha256": "1afce5489038e5e30b55210e8e43ba93e0446fe087e2952af75a402dbf809ea9",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "ldap",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.0/ldap-1.0.0.tmxplug",
+      "sha256": "1df08a931457043ba500689a73b4b5ab2bfb43630f377557e0fb13280b996334"
+    },
+    {
+      "id": "network-topology",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.0/network-topology-1.0.0.tmxplug",
+      "sha256": "dc3ad943c1753b352b4d80c09836a293a8767293061ddf2e641575bae97124e9"
+    },
+    {
+      "id": "opkssh",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.0/opkssh-1.0.0.tmxplug",
+      "sha256": "91cc1575aa1ff84632e0b6a4da68df3a7df4b8e18431b9c0378d314b886ed55d"
+    },
+    {
+      "id": "proxmox",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.0.0/proxmox-1.0.0.tmxplug",
+      "sha256": "09891a3ab67a5b6589d8ab9e0fc88d8c63ff9d4e52ed8e7cbd0801a5e64e593f"
+    },
+    {
+      "id": "remote-desktop",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.0.0/remote-desktop-1.0.0.tmxplug",
+      "sha256": "7b24691953550458ee1609372443eeb5580d20091b02c95011c0427268350efc",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "secret-sources",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.0/secret-sources-1.0.0.tmxplug",
+      "sha256": "04e9cfca70ffafc41546ddf0f1f6411743a2e0e9835b26ad5c0b91ac11028485"
+    },
+    {
+      "id": "serial",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.0/serial-1.0.0.tmxplug",
+      "sha256": "2470acbd6c4c343c3d89dada972051f1ee7aace88af1e6719b92f19a4a6e46ea",
+      "onboarding": {
+        "recommended": "desktop",
+        "consent": false
+      }
+    },
+    {
+      "id": "session-recording",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.0.0/session-recording-1.0.0.tmxplug",
+      "sha256": "6b630ca0e08d79be7cb49366c898586ee3416a518f8e200157a6191c2c7c9ab7"
+    },
+    {
+      "id": "session-sharing",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.0.0/session-sharing-1.0.0.tmxplug",
+      "sha256": "0c0d3f2d63184d4a4b2a90b11a1ee247ddc937abba76af74eb39e27048b412f9"
+    },
+    {
+      "id": "snippets",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.0.0/snippets-1.0.0.tmxplug",
+      "sha256": "47872d08cdf4a15b50c8f90ca125276a92579147a27cb6b5639a84a01160abe5",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "ssh-terminal",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.0.0/ssh-terminal-1.0.0.tmxplug",
+      "sha256": "5b5a357bbf9a503c6b68725245712a99fa8ea0eec0baff64319be28950acac79",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "sso",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.0/sso-1.0.0.tmxplug",
+      "sha256": "d9f69f7f52b778d1b144c58e5a65006780498d6fa171b5aeb18e15b7b033ca6b",
+      "onboarding": {
+        "recommended": false,
+        "consent": false,
+        "enabledByEnv": ["OIDC_CLIENT_ID"]
+      }
+    },
+    {
+      "id": "step-ca",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.0/step-ca-1.0.0.tmxplug",
+      "sha256": "05209afbaeb104ff77fecb5cf26a7823b9ed66031eac7557d3216fc3b861f7a6"
+    },
+    {
+      "id": "tailscale",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.0.0/tailscale-1.0.0.tmxplug",
+      "sha256": "e9840bddef696b24354b9f04f2c97e164c3879f3fd1b337347de728db522874e"
+    },
+    {
+      "id": "telemetry",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.0/telemetry-1.0.0.tmxplug",
+      "sha256": "b41210d638b93470891ab238e3d1180a0e0d0f0c697b1c2079156416dec05966",
+      "onboarding": {
+        "recommended": true,
+        "consent": true
+      }
+    },
+    {
+      "id": "termix-identity",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.0/termix-identity-1.0.0.tmxplug",
+      "sha256": "facd9f1c6036202e7c6b1020408ce49c7ba4bc687a8f8b93ccf60e97f473f897"
+    },
+    {
+      "id": "tmux-monitor",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.0.0/tmux-monitor-1.0.0.tmxplug",
+      "sha256": "d453e0c5f1bf54160615d5df4e12eac0d97fea3c78c0aad5ebe8552e1f2de42c"
+    },
+    {
+      "id": "totp",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.0/totp-1.0.0.tmxplug",
+      "sha256": "a2d389048d16e31c089cf211fe2fb37fcfb33369497b58ee445e8626e9ec494d",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "tunnels",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.0.0/tunnels-1.0.0.tmxplug",
+      "sha256": "dc6c2942490c07ec1f9a4065850288cbb00c42dae64397937d2551d689314939",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "vault",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.0/vault-1.0.0.tmxplug",
+      "sha256": "bdad88ed576ed30b464c9cbddab4d9bb60696581dc1b815b76e1b4a08500f870"
+    },
+    {
+      "id": "wake-on-lan",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.0.0/wake-on-lan-1.0.0.tmxplug",
+      "sha256": "3e7d4c8a9a20cde95d8594d4ae8e1fa0469d0751be9f00249f6431b10ada9ea9"
+    },
+    {
+      "id": "warpgate",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.0/warpgate-1.0.0.tmxplug",
+      "sha256": "18ed1c8238ecf57b5776ad93c6533d7040b988ae765012c5da591b85faa02d2e"
+    },
+    {
+      "id": "web-endpoint",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.0.0/web-endpoint-1.0.0.tmxplug",
+      "sha256": "7f69e608eccd8cc6fa2436bffb3e2c3c8aae6cebebf7341913f15e7f9be58e42"
+    },
+    {
+      "id": "webauthn",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.0.0/webauthn-1.0.0.tmxplug",
+      "sha256": "dafcd7bfffc39b60a14333164dfd8ca70986da1390285359669d0293cd050121",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "workspaces",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.0.0/workspaces-1.0.0.tmxplug",
+      "sha256": "1ee3a07bd8d61b46b6fbe118d2a424f8027575282287622b467e83a4356e6412",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    }
+  ]
+}

docker/compose-dev.yml

@@ -12,6 +12,13 @@ services:
     environment:
       PORT: "8080"
       NODE_ENV: development
+      GUACD_HOST: "guacd-dev"
+      GUACD_TUNNEL_HOST: "termix-dev"
+      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
+      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
+      # REDIS_URL: "redis://redis:6379"
+      # TERMIX_REDIS_PREFIX: "termix:collab"
+      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
     depends_on:
       - guacd-dev
     networks:
@@ -21,6 +28,8 @@ services:
     image: guacamole/guacd:1.6.0
     container_name: guacd-dev
     restart: unless-stopped
+    volumes:
+      - termix-dev-data:/termix-data
     networks:
       - termix-dev-net
 

docker/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   termix:
-    image: ghcr.io/lukegus/termix:latest
+    image: ghcr.io/termix-ssh/termix:latest
     container_name: termix
     restart: unless-stopped
     ports:
@@ -10,6 +10,28 @@ services:
     environment:
       PORT: "8080"
       GUACD_HOST: "guacd"
+      GUACD_TUNNEL_HOST: "termix"
+      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
+      # Where guacd stores files for RDP drive redirection (one folder per
+      # user is created underneath). Must be writable by guacd's user.
+      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
+      # Multi-instance deployments should point every backend at the same
+      # Redis. Without it, collaboration rooms keep their single-instance
+      # in-memory fallback.
+      # REDIS_URL: "redis://redis:6379"
+      # TERMIX_REDIS_PREFIX: "termix:collab"
+      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
+      # Hardened deployments can require keys from environment variables or
+      # Docker secrets mounted through JWT_SECRET_FILE, DATABASE_KEY_FILE,
+      # ENCRYPTION_KEY_FILE and INTERNAL_AUTH_TOKEN_FILE.
+      # TERMIX_REQUIRE_EXTERNAL_SECRETS: "true"
+      # Trusted reverse-proxy authentication is disabled by default. When
+      # enabled, do not expose this container directly to untrusted clients.
+      # TRUSTED_PROXY_AUTH_ENABLED: "true"
+      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.16.0.0/12"
+      # TRUSTED_PROXY_AUTH_ROLE_MAP: '{"operators":["user"]}'
+      # TRUSTED_PROXY_AUTH_USERNAME_HEADER: "x-forwarded-username"
+      # TRUSTED_PROXY_AUTH_ROLE_HEADER: "x-forwarded-role"
     depends_on:
       - guacd
     networks:
@@ -19,6 +41,8 @@ services:
     image: guacamole/guacd:1.6.0
     container_name: guacd
     restart: unless-stopped
+    volumes:
+      - termix-data:/termix-data
     networks:
       - termix-net
 

docker/entrypoint.sh

@@ -22,11 +22,38 @@ if [ "$(id -u)" = "0" ]; then
     fi
 fi
 
+DATA_DIR=${DATA_DIR:-/app/data}
+
+RUNTIME_ENABLE_SSL_SET=${ENABLE_SSL+x}
+RUNTIME_ENABLE_SSL=${ENABLE_SSL-}
+RUNTIME_SSL_PORT_SET=${SSL_PORT+x}
+RUNTIME_SSL_PORT=${SSL_PORT-}
+RUNTIME_SSL_CERT_PATH_SET=${SSL_CERT_PATH+x}
+RUNTIME_SSL_CERT_PATH=${SSL_CERT_PATH-}
+RUNTIME_SSL_KEY_PATH_SET=${SSL_KEY_PATH+x}
+RUNTIME_SSL_KEY_PATH=${SSL_KEY_PATH-}
+RUNTIME_SSL_DOMAIN_SET=${SSL_DOMAIN+x}
+RUNTIME_SSL_DOMAIN=${SSL_DOMAIN-}
+
+if [ -f "$DATA_DIR/.env" ]; then
+    echo "Loading persisted SSL settings from $DATA_DIR/.env"
+    set -a
+    . "$DATA_DIR/.env"
+    set +a
+fi
+
+[ "$RUNTIME_ENABLE_SSL_SET" = "x" ] && ENABLE_SSL=$RUNTIME_ENABLE_SSL
+[ "$RUNTIME_SSL_PORT_SET" = "x" ] && SSL_PORT=$RUNTIME_SSL_PORT
+[ "$RUNTIME_SSL_CERT_PATH_SET" = "x" ] && SSL_CERT_PATH=$RUNTIME_SSL_CERT_PATH
+[ "$RUNTIME_SSL_KEY_PATH_SET" = "x" ] && SSL_KEY_PATH=$RUNTIME_SSL_KEY_PATH
+[ "$RUNTIME_SSL_DOMAIN_SET" = "x" ] && SSL_DOMAIN=$RUNTIME_SSL_DOMAIN
+
 export PORT=${PORT:-8080}
 export ENABLE_SSL=${ENABLE_SSL:-false}
 export SSL_PORT=${SSL_PORT:-8443}
 export SSL_CERT_PATH=${SSL_CERT_PATH:-/app/data/ssl/termix.crt}
 export SSL_KEY_PATH=${SSL_KEY_PATH:-/app/data/ssl/termix.key}
+export TERMIX_SSL_TERMINATED_BY_NGINX=true
 
 echo "Configuring web UI to run on port: $PORT"
 
@@ -41,31 +68,40 @@ fi
 mkdir -p /tmp/nginx
 envsubst '${PORT} ${SSL_PORT} ${SSL_CERT_PATH} ${SSL_KEY_PATH}' < $NGINX_CONF_SOURCE > /tmp/nginx/nginx.conf
 
-mkdir -p /app/data /app/uploads /app/data/.opk /app/data/acme-webroot/.well-known/acme-challenge
-chmod 755 /app/data /app/uploads /app/data/.opk 2>/dev/null || true
+# Which proxies may set the client IP through X-Forwarded-For. Unset keeps
+# the private ranges in the template.
+if [ -n "$TRUSTED_PROXIES" ]; then
+    REAL_IP_LINES=""
+    for proxy in $(echo "$TRUSTED_PROXIES" | tr ',' ' '); do
+        case "$proxy" in
+            *[!0-9a-fA-F:./]*) echo "Ignoring invalid TRUSTED_PROXIES entry: $proxy" ;;
+            *) REAL_IP_LINES="${REAL_IP_LINES}    set_real_ip_from ${proxy};\n" ;;
+        esac
+    done
+    echo "Trusting X-Forwarded-For from: $TRUSTED_PROXIES"
+    awk -v lines="$REAL_IP_LINES" '
+        /# BEGIN TRUSTED_PROXIES/ { printf "%s", lines; skip = 1; next }
+        /# END TRUSTED_PROXIES/ { skip = 0; next }
+        !skip
+    ' /tmp/nginx/nginx.conf > /tmp/nginx/nginx.conf.tmp
+    mv /tmp/nginx/nginx.conf.tmp /tmp/nginx/nginx.conf
+fi
+
+if [ "$ENABLE_SSL" = "true" ] && [ "$PORT" = "$SSL_PORT" ]; then
+    echo "HTTP and HTTPS use port $SSL_PORT; disabling the HTTP redirect listener"
+    sed -i '/# BEGIN HTTP_REDIRECT_SERVER/,/# END HTTP_REDIRECT_SERVER/d' /tmp/nginx/nginx.conf
+fi
+
+mkdir -p /app/data /app/uploads
+chmod 755 /app/data /app/uploads 2>/dev/null || true
 
 if [ -w /app/data ]; then
     echo "Data directory is writable"
 else
-    echo "WARNING: Data directory is not writable. OPKSSH may fail."
+    echo "WARNING: Data directory is not writable. Plugins that keep files (OPKSSH, recordings) may fail."
     ls -ld /app/data
 fi
 
-if [ -w /app/data/.opk ]; then
-    echo "OPKSSH directory is writable"
-else
-    echo "WARNING: OPKSSH directory is not writable. OPKSSH authentication will fail."
-    ls -ld /app/data/.opk
-fi
-
-OPKSSH_DIR="${DATA_DIR:-/app/data}/opkssh"
-if [ ! -d "$OPKSSH_DIR" ]; then
-    echo "WARNING: OPKSSH binary directory not found at $OPKSSH_DIR"
-    echo "OPKSSH will be downloaded automatically on first use."
-else
-    echo "OPKSSH binary directory found at $OPKSSH_DIR"
-fi
-
 if [ "$ENABLE_SSL" = "true" ]; then
     echo "Checking SSL certificate configuration..."
     mkdir -p /app/data/ssl
@@ -79,8 +115,16 @@ if [ "$ENABLE_SSL" = "true" ]; then
         if openssl x509 -in /app/data/ssl/termix.crt -checkend 2592000 -noout >/dev/null 2>&1; then
             echo "SSL certificates are valid and will be reused for domain: $DOMAIN"
         else
-            echo "SSL certificate is expired or expiring soon, regenerating..."
-            rm -f /app/data/ssl/termix.crt /app/data/ssl/termix.key
+            SUBJECT=$(openssl x509 -in /app/data/ssl/termix.crt -noout -subject 2>/dev/null | sed 's/^subject=//')
+            ISSUER=$(openssl x509 -in /app/data/ssl/termix.crt -noout -issuer 2>/dev/null | sed 's/^issuer=//')
+            # Only replace our own self-signed certificate. A CA-issued one is
+            # kept until it expires, even when nothing renews it.
+            if [ -n "$SUBJECT" ] && [ "$SUBJECT" = "$ISSUER" ]; then
+                echo "Self-signed SSL certificate is expired or expiring soon, regenerating..."
+                rm -f /app/data/ssl/termix.crt /app/data/ssl/termix.key
+            else
+                echo "WARNING: SSL certificate expires within 30 days and was not issued by Termix. Renew it."
+            fi
         fi
     else
         echo "SSL certificates not found, will generate new ones..."
@@ -140,7 +184,14 @@ if [ -n "$BASE_PATH" ]; then
     echo "Injecting BASE_PATH: $BASE_PATH"
     # Strip trailing slash for use as a path prefix
     CLEAN_BASE_PATH="${BASE_PATH%/}"
-    find /app/html -name "index.html" -exec sed -i "s|window.__TERMIX_BASE_PATH__ = \"\"|window.__TERMIX_BASE_PATH__ = \"$CLEAN_BASE_PATH\"|g" {} \;
+    case "$CLEAN_BASE_PATH" in
+        /*) ;;
+        *) echo "BASE_PATH must start with /" >&2; exit 1 ;;
+    esac
+    case "$CLEAN_BASE_PATH" in
+        *[!A-Za-z0-9_./~-]*) echo "BASE_PATH contains unsupported characters" >&2; exit 1 ;;
+    esac
+    find /app/html -name "index.html" -exec sed -i "s|name=\"termix-base-path\" content=\"\"|name=\"termix-base-path\" content=\"$CLEAN_BASE_PATH\"|g" {} \;
     # Patch sw.js static asset paths with the base path prefix
     find /app/html -name "sw.js" -exec sed -i "s|__TERMIX_SW_BASE_PATH__|$CLEAN_BASE_PATH|g" {} \;
 else
@@ -163,8 +214,4 @@ else
     echo "Warning: package.json not found"
 fi
 
-node dist/backend/backend/starter.js
-
-echo "All services started"
-
-tail -f /dev/null
+exec node dist/backend/backend/starter.js

docker/nginx-https.conf

@@ -11,6 +11,8 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
+    server_tokens off;
+
     access_log /tmp/nginx/access.log;
 
     client_body_temp_path /tmp/nginx/client_body;
@@ -21,12 +23,30 @@ http {
 
     sendfile on;
     keepalive_timeout 65;
+
+    # Static assets only. API responses arrive already gzipped from the node
+    # backend, and gzip_proxied would otherwise have nginx decompress and
+    # recompress them for nothing.
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 2048;
+    gzip_comp_level 5;
+    gzip_types
+        text/plain
+        text/css
+        text/javascript
+        application/javascript
+        application/json
+        application/wasm
+        image/svg+xml;
     client_header_timeout 300s;
 
+    # BEGIN TRUSTED_PROXIES
     set_real_ip_from 127.0.0.1;
     set_real_ip_from 10.0.0.0/8;
     set_real_ip_from 172.16.0.0/12;
     set_real_ip_from 192.168.0.0/16;
+    # END TRUSTED_PROXIES
     real_ip_header X-Forwarded-For;
     real_ip_recursive on;
 
@@ -51,16 +71,30 @@ http {
     ssl_session_cache shared:SSL:10m;
     ssl_session_timeout 10m;
 
+    # BEGIN HTTP_REDIRECT_SERVER
     server {
         listen ${PORT};
         server_name _;
 
-        return 301 https://$host:${SSL_PORT}$request_uri;
+        # ACME http-01 checks arrive on plain HTTP and must not be redirected.
+        location ^~ /.well-known/acme-challenge/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location / {
+            return 301 https://$host:${SSL_PORT}$request_uri;
+        }
     }
+    # END HTTP_REDIRECT_SERVER
 
     server {
         listen ${SSL_PORT} ssl;
         server_name _;
+        client_max_body_size 50m;
 
         absolute_redirect off;
 
@@ -69,17 +103,20 @@ http {
 
         add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
         add_header X-Content-Type-Options nosniff always;
-        add_header X-XSS-Protection "1; mode=block" always;
 
         location ^~ /.well-known/acme-challenge/ {
-            root /app/data/acme-webroot;
-            default_type "text/plain";
-            try_files $uri =404;
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
 
         location = /sw.js {
             root /app/html;
             expires off;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri =404;
         }
@@ -87,31 +124,68 @@ http {
         location = /manifest.json {
             root /app/html;
             expires off;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri =404;
         }
 
-        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        location ^~ /assets/ {
             root /app/html;
             expires 1y;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "public, max-age=31536000, immutable" always;
             try_files $uri =404;
         }
 
+        location ^~ /fonts/ {
+            root /app/html;
+            expires 1y;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=31536000, immutable" always;
+            try_files $uri =404;
+        }
+
+        location ^~ /icons/ {
+            root /app/html;
+            expires 30d;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=2592000" always;
+            try_files $uri =404;
+        }
+
+        location ~* ^/[^/]+\.(js|css|png|jpe?g|gif|ico|svg|webp|woff2?|ttf|eot)$ {
+            root /app/html;
+            expires 30d;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=2592000" always;
+            try_files $uri =404;
+        }
+
+        location ~* \.map$ {
+            access_log off;
+            log_not_found off;
+            return 404;
+        }
+
         location / {
             root /app/html;
             index index.html index.htm;
             expires off;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-0FPou4vGHwupDie6Xais6VntpJ4yaK9E6TyhXLwZe8o='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; connect-src 'self' http: https: ws: wss:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; frame-src http: https:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri $uri/ /index.html;
         }
 
-        location ~* \.map$ {
-            return 404;
-            access_log off;
-            log_not_found off;
-        }
-
         location ~ ^/users/sessions(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -150,42 +224,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/alerts(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-rules(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/notification-channels(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-firings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/rbac(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -208,7 +246,7 @@ http {
             proxy_read_timeout 300s;
         }
 
-        location ~ ^/snippets(/.*)?$ {
+        location ~ ^/ssh-auth(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -217,25 +255,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/vault(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/termix-id(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
-
-        location ~ ^/c2s-tunnel-presets(/.*)?$ {
+        location ~ ^/sync(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -253,7 +273,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/terminal(/.*)?$ {
+        location ~ ^/plugins(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -262,6 +282,66 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
+        # Plugin frontend bundles, stylesheets and locales. Public like
+        # /assets; the backend picks the cache policy from the ?v= query.
+        location ^~ /plugin-assets/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        # Every plugin's HTTP routes. One block, no per-plugin entries: a
+        # plugin serves at /plugin-api/<id>/ on the main backend and never
+        # gets a port or a block of its own. Buffering is off so SSE streams
+        # (AI, Proxmox discovery) reach the browser as they are produced, and
+        # request buffering is off so large uploads stream through.
+        location ^~ /plugin-api/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            client_max_body_size 0;
+        }
+
+        # Every plugin's WebSockets: terminal, Guacamole display, Docker
+        # console. Served at /plugin-ws/<id>/<path> from the same backend.
+        location ^~ /plugin-ws/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+        }
+
         location ~ ^/open-tabs(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -280,26 +360,34 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/database(/.*)?$ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
+        location ~ ^/host-sidebar(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
         }
 
-        location ~ ^/db(/.*)?$ {
+        location ~ ^/credential-sidebar(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/ui-preferences(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/database(/.*)?$ {
             client_max_body_size 5G;
             client_body_timeout 300s;
 
@@ -339,36 +427,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/host/opkssh-chooser(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-chooser$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
-        }
-
-        location ~ ^/host/opkssh-callback(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-callback$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
-        }
-
         location /host/ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -378,193 +436,10 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location /session_logs/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /tailscale/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/websocket/ {
-            proxy_pass http://127.0.0.1:30002/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ^~ /guacamole/websocket/ {
-            proxy_pass http://127.0.0.1:30008/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-Host $http_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ~ ^/guacamole(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
-            proxy_cache off;
-        }
-
-        location /host/file_manager/recent {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/pinned {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/shortcuts {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/sudo-password {
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/file_manager/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location /host/file_manager/ssh/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location ~ ^/network-topology(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
+        # File manager routes (recent/pinned/shortcuts, SFTP, transfers) moved
+        # to the file-manager plugin, served under /plugin-api/file-manager/.
+        # Session logs moved to the session-recording plugin, served under
+        # /plugin-api/session-recording/.
 
         location /health {
             proxy_pass http://127.0.0.1:30001;
@@ -575,8 +450,11 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/status(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
+        # Service links and the homepage widget canvas moved to the homepage
+        # plugin, served under /plugin-api/homepage/.
+
+        location /dashboard/ {
+            proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -584,163 +462,10 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 60s;
-            proxy_read_timeout 60s;
-        }
-
-        location ~ ^/(refresh|host-updated)$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/host-metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 600s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/global-settings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/uptime(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/activity(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/service-links(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/homepage(/.*)?$ {
-            proxy_pass http://127.0.0.1:30012;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ^~ /docker/console/ {
-            proxy_pass http://127.0.0.1:30009/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-Host $http_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        # --- tmux-monitor begin ---
-        location ~ ^/tmux_monitor(/.*)?$ {
-            proxy_pass http://127.0.0.1:30010;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-        # --- tmux-monitor end ---
-
-        location ~ ^/docker(/.*)?$ {
-            proxy_pass http://127.0.0.1:30007;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-
-        location ^~ /serial/websocket/ {
-            proxy_pass http://127.0.0.1:30011/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-        }
-
         error_page 500 502 503 504 /50x.html;
         location = /50x.html {
             root /app/html;
+            internal;
         }
     }
 }

docker/nginx.conf

@@ -11,6 +11,8 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
+    server_tokens off;
+
     access_log /tmp/nginx/access.log;
 
     client_body_temp_path /tmp/nginx/client_body;
@@ -21,12 +23,30 @@ http {
 
     sendfile on;
     keepalive_timeout 65;
+
+    # Static assets only. API responses arrive already gzipped from the node
+    # backend, and gzip_proxied would otherwise have nginx decompress and
+    # recompress them for nothing.
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 2048;
+    gzip_comp_level 5;
+    gzip_types
+        text/plain
+        text/css
+        text/javascript
+        application/javascript
+        application/json
+        application/wasm
+        image/svg+xml;
     client_header_timeout 300s;
 
+    # BEGIN TRUSTED_PROXIES
     set_real_ip_from 127.0.0.1;
     set_real_ip_from 10.0.0.0/8;
     set_real_ip_from 172.16.0.0/12;
     set_real_ip_from 192.168.0.0/16;
+    # END TRUSTED_PROXIES
     real_ip_header X-Forwarded-For;
     real_ip_recursive on;
 
@@ -54,21 +74,24 @@ http {
     server {
         listen ${PORT};
         server_name _;
+        client_max_body_size 50m;
 
         absolute_redirect off;
 
         add_header X-Content-Type-Options nosniff always;
-        add_header X-XSS-Protection "1; mode=block" always;
 
         location ^~ /.well-known/acme-challenge/ {
-            root /app/data/acme-webroot;
-            default_type "text/plain";
-            try_files $uri =404;
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
 
         location = /sw.js {
             root /app/html;
             expires off;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri =404;
         }
@@ -76,31 +99,62 @@ http {
         location = /manifest.json {
             root /app/html;
             expires off;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri =404;
         }
 
-        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        location ^~ /assets/ {
             root /app/html;
             expires 1y;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "public, max-age=31536000, immutable" always;
             try_files $uri =404;
         }
 
+        location ^~ /fonts/ {
+            root /app/html;
+            expires 1y;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=31536000, immutable" always;
+            try_files $uri =404;
+        }
+
+        location ^~ /icons/ {
+            root /app/html;
+            expires 30d;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=2592000" always;
+            try_files $uri =404;
+        }
+
+        location ~* ^/[^/]+\.(js|css|png|jpe?g|gif|ico|svg|webp|woff2?|ttf|eot)$ {
+            root /app/html;
+            expires 30d;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=2592000" always;
+            try_files $uri =404;
+        }
+
+        location ~* \.map$ {
+            access_log off;
+            log_not_found off;
+            return 404;
+        }
+
         location / {
             root /app/html;
             index index.html index.htm;
             expires off;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-0FPou4vGHwupDie6Xais6VntpJ4yaK9E6TyhXLwZe8o='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; connect-src 'self' http: https: ws: wss:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; frame-src http: https:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri $uri/ /index.html;
         }
 
-        location ~* \.map$ {
-            return 404;
-            access_log off;
-            log_not_found off;
-        }
-
         location ~ ^/users/sessions(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -139,42 +193,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/alerts(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-rules(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/notification-channels(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-firings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/rbac(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -197,7 +215,7 @@ http {
             proxy_read_timeout 300s;
         }
 
-        location ~ ^/snippets(/.*)?$ {
+        location ~ ^/ssh-auth(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -206,37 +224,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/vault(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/termix-id(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
-
-        location ~ ^/proxmox(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 120s;
-            proxy_read_timeout 120s;
-        }
-
-        location ~ ^/c2s-tunnel-presets(/.*)?$ {
+        location ~ ^/sync(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -254,7 +242,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/terminal(/.*)?$ {
+        location ~ ^/plugins(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -263,6 +251,66 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
+        # Plugin frontend bundles, stylesheets and locales. Public like
+        # /assets; the backend picks the cache policy from the ?v= query.
+        location ^~ /plugin-assets/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        # Every plugin's HTTP routes. One block, no per-plugin entries: a
+        # plugin serves at /plugin-api/<id>/ on the main backend and never
+        # gets a port or a block of its own. Buffering is off so SSE streams
+        # (AI, Proxmox discovery) reach the browser as they are produced, and
+        # request buffering is off so large uploads stream through.
+        location ^~ /plugin-api/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            client_max_body_size 0;
+        }
+
+        # Every plugin's WebSockets: terminal, Guacamole display, Docker
+        # console. Served at /plugin-ws/<id>/<path> from the same backend.
+        location ^~ /plugin-ws/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+        }
+
         location ~ ^/open-tabs(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -281,26 +329,34 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/database(/.*)?$ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
+        location ~ ^/host-sidebar(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
         }
 
-        location ~ ^/db(/.*)?$ {
+        location ~ ^/credential-sidebar(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/ui-preferences(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/database(/.*)?$ {
             client_max_body_size 5G;
             client_body_timeout 300s;
 
@@ -340,36 +396,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/host/opkssh-chooser(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-chooser$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
-        }
-
-        location ~ ^/host/opkssh-callback(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-callback$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
-        }
-
         location /host/ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -379,193 +405,10 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location /session_logs/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /tailscale/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/websocket/ {
-            proxy_pass http://127.0.0.1:30002/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ^~ /guacamole/websocket/ {
-            proxy_pass http://127.0.0.1:30008/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-Host $http_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ~ ^/guacamole(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
-            proxy_cache off;
-        }
-
-        location /host/file_manager/recent {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/pinned {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/shortcuts {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/sudo-password {
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/file_manager/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location /host/file_manager/ssh/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location ~ ^/network-topology(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
+        # File manager routes (recent/pinned/shortcuts, SFTP, transfers) moved
+        # to the file-manager plugin, served under /plugin-api/file-manager/.
+        # Session logs moved to the session-recording plugin, served under
+        # /plugin-api/session-recording/.
 
         location /health {
             proxy_pass http://127.0.0.1:30001;
@@ -576,8 +419,11 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/status(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
+        # Service links and the homepage widget canvas moved to the homepage
+        # plugin, served under /plugin-api/homepage/.
+
+        location /dashboard/ {
+            proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -585,163 +431,10 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 60s;
-            proxy_read_timeout 60s;
-        }
-
-        location ~ ^/(refresh|host-updated)$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/host-metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 600s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/global-settings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/uptime(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/activity(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/service-links(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/homepage(/.*)?$ {
-            proxy_pass http://127.0.0.1:30012;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ^~ /docker/console/ {
-            proxy_pass http://127.0.0.1:30009/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-Host $http_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        # --- tmux-monitor begin ---
-        location ~ ^/tmux_monitor(/.*)?$ {
-            proxy_pass http://127.0.0.1:30010;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-        # --- tmux-monitor end ---
-
-        location ~ ^/docker(/.*)?$ {
-            proxy_pass http://127.0.0.1:30007;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-
-        location ^~ /serial/websocket/ {
-            proxy_pass http://127.0.0.1:30011/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-        }
-
         error_page 500 502 503 504 /50x.html;
         location = /50x.html {
             root /app/html;
+            internal;
         }
     }
 }

drizzle.config.mysql.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "mysql",
+  schema: "./src/backend/database/db/schema.mysql.ts",
+  out: "./drizzle/mysql",
+});

drizzle.config.pg.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./src/backend/database/db/schema.pg.ts",
+  out: "./drizzle/postgres",
+});

drizzle.config.sqlite.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "sqlite",
+  schema: "./src/backend/database/db/schema.ts",
+  out: "./drizzle/sqlite",
+});

drizzle/mysql/0000_clean_pretty_boy.sql

@@ -0,0 +1,890 @@
+CREATE TABLE `alert_firings` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`rule_id` int NOT NULL,
+	`host_id` int NOT NULL,
+	`host_name` text NOT NULL,
+	`fired_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`resolved_at` text,
+	`value` double,
+	`message` text NOT NULL,
+	`severity` text NOT NULL DEFAULT ('warning'),
+	`acknowledged` boolean NOT NULL DEFAULT false,
+	CONSTRAINT `alert_firings_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `alert_rule_channels` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`rule_id` int NOT NULL,
+	`channel_id` int NOT NULL,
+	CONSTRAINT `alert_rule_channels_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `alert_rules` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int,
+	`name` varchar(255) NOT NULL,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`trigger_type` text NOT NULL,
+	`threshold_value` double,
+	`threshold_duration_seconds` int,
+	`cooldown_minutes` int NOT NULL DEFAULT 15,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `alert_rules_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `api_keys` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`token_hash` text NOT NULL,
+	`token_prefix` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text,
+	`last_used_at` text,
+	`is_active` boolean NOT NULL DEFAULT true,
+	CONSTRAINT `api_keys_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `audit_logs` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255),
+	`username` text NOT NULL,
+	`action` text NOT NULL,
+	`resource_type` text NOT NULL,
+	`resource_id` text,
+	`resource_name` text,
+	`details` text,
+	`ip_address` text,
+	`user_agent` text,
+	`success` boolean NOT NULL,
+	`error_message` text,
+	`timestamp` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `audit_logs_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `c2s_tunnel_presets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`config` text NOT NULL,
+	`platform` text,
+	`computer_name` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `c2s_tunnel_presets_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `command_history` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`command` text NOT NULL,
+	`executed_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `command_history_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `dashboard_service_links` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`label` text NOT NULL,
+	`url` text NOT NULL,
+	`order` int NOT NULL DEFAULT 0,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `dashboard_service_links_id` PRIMARY KEY(`id`),
+	CONSTRAINT `dashboard_service_links_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `dismissed_alerts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`alert_id` text NOT NULL,
+	`dismissed_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `dismissed_alerts_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `file_manager_pinned` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`path` text NOT NULL,
+	`pinned_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `file_manager_pinned_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `file_manager_recent` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`path` text NOT NULL,
+	`last_opened` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `file_manager_recent_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `file_manager_shortcuts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`path` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `file_manager_shortcuts_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `homepage_items` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`type_id` text NOT NULL,
+	`title` text,
+	`config` text NOT NULL DEFAULT ('{}'),
+	`folder_id` int,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `homepage_items_id` PRIMARY KEY(`id`),
+	CONSTRAINT `homepage_items_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `homepage_layouts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`layout` text NOT NULL DEFAULT ('{}'),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `homepage_layouts_id` PRIMARY KEY(`id`),
+	CONSTRAINT `homepage_layouts_user_id_unique` UNIQUE(`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('connect'),
+	`expires_at` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`last_accessed_at` text,
+	`access_count` int NOT NULL DEFAULT 0,
+	CONSTRAINT `host_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_health_checks` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`checks` text NOT NULL,
+	`interval_seconds` int NOT NULL DEFAULT 300,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `host_health_checks_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_host_health_checks_user_host` UNIQUE(`user_id`,`host_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_health_history` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`check_id` text NOT NULL,
+	`ts` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`ok` boolean NOT NULL,
+	`latency_ms` int,
+	`detail` text,
+	CONSTRAINT `host_health_history_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_metrics_history` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`ts` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`cpu_percent` double,
+	`mem_percent` double,
+	`disk_percent` double,
+	`net_rx_bytes` int,
+	`net_tx_bytes` int,
+	CONSTRAINT `host_metrics_history_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_metrics_preferences` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`layout` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `host_metrics_preferences_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_host_metrics_prefs_user_host` UNIQUE(`user_id`,`host_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ssh_data` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`connection_type` text NOT NULL DEFAULT ('ssh'),
+	`name` varchar(255),
+	`ip` text NOT NULL,
+	`port` int NOT NULL,
+	`username` text NOT NULL,
+	`folder` text,
+	`tags` text,
+	`pin` boolean NOT NULL DEFAULT false,
+	`auth_type` text NOT NULL,
+	`use_warpgate` boolean NOT NULL DEFAULT false,
+	`share_ssh_auth` boolean NOT NULL DEFAULT false,
+	`force_keyboard_interactive` text,
+	`password` text,
+	`key` text,
+	`key_password` text,
+	`key_type` text,
+	`sudo_password` text,
+	`autostart_password` text,
+	`autostart_key` text,
+	`autostart_key_password` text,
+	`credential_id` int,
+	`override_credential_username` boolean,
+	`vault_profile_id` int,
+	`enable_terminal` boolean NOT NULL DEFAULT true,
+	`enable_session_logging` boolean NOT NULL DEFAULT true,
+	`allow_session_sharing` boolean NOT NULL DEFAULT true,
+	`enable_command_history` boolean NOT NULL DEFAULT true,
+	`enable_tunnel` boolean NOT NULL DEFAULT true,
+	`tunnel_connections` text,
+	`jump_hosts` text,
+	`enable_file_manager` boolean NOT NULL DEFAULT true,
+	`scp_legacy` boolean NOT NULL DEFAULT false,
+	`enable_docker` boolean NOT NULL DEFAULT false,
+	`enable_tmux_monitor` boolean NOT NULL DEFAULT false,
+	`show_terminal_in_sidebar` boolean NOT NULL DEFAULT true,
+	`show_file_manager_in_sidebar` boolean NOT NULL DEFAULT false,
+	`show_tunnel_in_sidebar` boolean NOT NULL DEFAULT false,
+	`show_docker_in_sidebar` boolean NOT NULL DEFAULT false,
+	`show_server_stats_in_sidebar` boolean NOT NULL DEFAULT false,
+	`default_path` text,
+	`stats_config` text,
+	`docker_config` text,
+	`enable_proxmox` boolean NOT NULL DEFAULT false,
+	`proxmox_config` text,
+	`terminal_config` text,
+	`quick_actions` text,
+	`notes` text,
+	`enable_ssh` boolean NOT NULL DEFAULT true,
+	`enable_rdp` boolean NOT NULL DEFAULT false,
+	`enable_vnc` boolean NOT NULL DEFAULT false,
+	`enable_telnet` boolean NOT NULL DEFAULT false,
+	`ssh_port` int DEFAULT 22,
+	`rdp_port` int DEFAULT 3389,
+	`vnc_port` int DEFAULT 5900,
+	`telnet_port` int DEFAULT 23,
+	`rdp_credential_id` int,
+	`rdp_user` text,
+	`rdp_password` text,
+	`rdp_domain` text,
+	`rdp_security` text,
+	`rdp_ignore_cert` boolean DEFAULT false,
+	`vnc_credential_id` int,
+	`vnc_password` text,
+	`vnc_user` text,
+	`telnet_user` text,
+	`telnet_password` text,
+	`telnet_credential_id` int,
+	`rdp_auth_type` text,
+	`vnc_auth_type` text,
+	`telnet_auth_type` text,
+	`domain` text,
+	`security` text,
+	`ignore_cert` boolean DEFAULT false,
+	`guacamole_config` text,
+	`use_socks5` boolean,
+	`socks5_host` text,
+	`socks5_port` int,
+	`socks5_username` text,
+	`socks5_password` text,
+	`socks5_proxy_chain` text,
+	`connection_origin` text,
+	`mac_address` text,
+	`wol_broadcast_address` text,
+	`port_knock_sequence` text,
+	`host_key_fingerprint` text,
+	`host_key_type` text,
+	`host_key_algorithm` text DEFAULT ('sha256'),
+	`host_key_first_seen` text,
+	`host_key_last_verified` text,
+	`host_key_changed_count` int DEFAULT 0,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ssh_data_id` PRIMARY KEY(`id`),
+	CONSTRAINT `ssh_data_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `network_topology` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`topology` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `network_topology_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `notification_channels` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`type` text NOT NULL,
+	`config` text NOT NULL,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `notification_channels_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `opkssh_tokens` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`ssh_cert` text NOT NULL,
+	`private_key` text NOT NULL,
+	`email` text,
+	`sub` text,
+	`issuer` text,
+	`audience` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`last_used` text,
+	CONSTRAINT `opkssh_tokens_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_opkssh_tokens_user_host` UNIQUE(`user_id`,`host_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `recent_activity` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`type` text NOT NULL,
+	`host_id` int NOT NULL,
+	`host_name` text,
+	`timestamp` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `recent_activity_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `roles` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`display_name` text NOT NULL,
+	`description` text,
+	`is_system` boolean NOT NULL DEFAULT false,
+	`permissions` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `roles_id` PRIMARY KEY(`id`),
+	CONSTRAINT `roles_name_unique` UNIQUE(`name`)
+);
+--> statement-breakpoint
+CREATE TABLE `session_recordings` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255),
+	`username` text,
+	`access_id` int,
+	`started_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`ended_at` text,
+	`duration` int,
+	`commands` text,
+	`dangerous_actions` text,
+	`recording_path` text,
+	`protocol` varchar(255) NOT NULL DEFAULT 'ssh',
+	`format` text NOT NULL DEFAULT ('text'),
+	`terminated_by_owner` boolean DEFAULT false,
+	`termination_reason` text,
+	CONSTRAINT `session_recordings_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `session_share_participants` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`share_id` varchar(255) NOT NULL,
+	`user_id` varchar(255),
+	`guest_label` text,
+	`joined_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`left_at` text,
+	CONSTRAINT `session_share_participants_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `session_shares` (
+	`id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`protocol` varchar(255) NOT NULL,
+	`session_id` text NOT NULL,
+	`tab_instance_id` text,
+	`share_type` text NOT NULL,
+	`target_user_id` varchar(255),
+	`link_token` varchar(255),
+	`permission_level` text NOT NULL DEFAULT ('read-only'),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`revoked_at` text,
+	`last_joined_at` text,
+	`join_count` int NOT NULL DEFAULT 0,
+	CONSTRAINT `session_shares_id` PRIMARY KEY(`id`),
+	CONSTRAINT `session_shares_link_token_unique` UNIQUE(`link_token`)
+);
+--> statement-breakpoint
+CREATE TABLE `sessions` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`jwt_token` text NOT NULL,
+	`device_type` text NOT NULL,
+	`device_info` text NOT NULL,
+	`oidc_sub` text,
+	`oidc_sid` text,
+	`sso_provider_id` int,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`last_active_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `sessions_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `settings` (
+	`key` varchar(255) NOT NULL,
+	`value` text NOT NULL,
+	CONSTRAINT `settings_key` PRIMARY KEY(`key`)
+);
+--> statement-breakpoint
+CREATE TABLE `shared_host_auth_overrides` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`protocol` varchar(255) NOT NULL DEFAULT 'ssh',
+	`credential_id` int NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `shared_host_auth_overrides_id` PRIMARY KEY(`id`),
+	CONSTRAINT `shared_host_auth_overrides_host_user_protocol_unique` UNIQUE(`host_id`,`user_id`,`protocol`)
+);
+--> statement-breakpoint
+CREATE TABLE `shared_host_secrets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_access_id` int NOT NULL,
+	`target_user_id` varchar(255) NOT NULL,
+	`protocol` varchar(255) NOT NULL DEFAULT 'ssh',
+	`source_type` text NOT NULL DEFAULT ('credential'),
+	`original_credential_id` int,
+	`encrypted_username` text,
+	`encrypted_auth_type` text,
+	`encrypted_password` text,
+	`encrypted_key` text,
+	`encrypted_key_password` text,
+	`encrypted_key_type` text,
+	`encrypted_domain` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `shared_host_secrets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_shared_host_secrets_scope` UNIQUE(`host_access_id`,`target_user_id`,`protocol`)
+);
+--> statement-breakpoint
+CREATE TABLE `snippet_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`snippet_id` int NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('view'),
+	`expires_at` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `snippet_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `snippet_folders` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`color` text,
+	`icon` text,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `snippet_folders_id` PRIMARY KEY(`id`),
+	CONSTRAINT `snippet_folders_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `snippets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`content` text NOT NULL,
+	`description` text,
+	`folder` text,
+	`order` int NOT NULL DEFAULT 0,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`host_filter` text,
+	CONSTRAINT `snippets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `snippets_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ssh_credential_usage` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_id` int NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`used_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ssh_credential_usage_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ssh_credentials` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`folder` text,
+	`tags` text,
+	`auth_type` text NOT NULL,
+	`username` text,
+	`password` text,
+	`key` text,
+	`private_key` text,
+	`public_key` text,
+	`key_password` text,
+	`key_type` text,
+	`detected_key_type` text,
+	`cert_public_key` text,
+	`usage_count` int NOT NULL DEFAULT 0,
+	`last_used` text,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ssh_credentials_id` PRIMARY KEY(`id`),
+	CONSTRAINT `ssh_credentials_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ssh_folders` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`color` text,
+	`icon` text,
+	`credential_id` int,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ssh_folders_id` PRIMARY KEY(`id`),
+	CONSTRAINT `ssh_folders_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `sso_providers` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`type` text NOT NULL,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`display_order` int NOT NULL DEFAULT 0,
+	`config` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `sso_providers_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `sync_tombstones` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`entity_type` text NOT NULL,
+	`sync_id` varchar(255) NOT NULL,
+	`deleted_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `sync_tombstones_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `termix_identities` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`handle` varchar(255) NOT NULL,
+	`description` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `termix_identities_id` PRIMARY KEY(`id`),
+	CONSTRAINT `termix_identities_user_id_unique` UNIQUE(`user_id`),
+	CONSTRAINT `termix_identities_handle_unique` UNIQUE(`handle`)
+);
+--> statement-breakpoint
+CREATE TABLE `termix_identity_ca` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`identity_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`public_key` text NOT NULL,
+	`private_key` text NOT NULL,
+	`validity_days` int NOT NULL DEFAULT 90,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `termix_identity_ca_id` PRIMARY KEY(`id`),
+	CONSTRAINT `termix_identity_ca_identity_id_unique` UNIQUE(`identity_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `termix_identity_keys` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`identity_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`public_key` text NOT NULL,
+	`key_type` text NOT NULL,
+	`algorithm` text NOT NULL,
+	`label` text,
+	`comment` text,
+	`source` text NOT NULL DEFAULT ('manual'),
+	`credential_id` int,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `termix_identity_keys_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `tmux_session_tags` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`session_name` text NOT NULL,
+	`tag` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `tmux_session_tags_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `transfer_recent` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`source_host_id` int NOT NULL,
+	`dest_host_id` int NOT NULL,
+	`dest_path` text NOT NULL,
+	`dest_path_label` text NOT NULL,
+	`last_used` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `transfer_recent_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `trusted_devices` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`device_fingerprint` text NOT NULL,
+	`device_type` text NOT NULL,
+	`device_info` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`last_used_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `trusted_devices_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `user_open_tabs` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`tab_type` text NOT NULL,
+	`host_id` int,
+	`label` text NOT NULL,
+	`tab_order` int NOT NULL DEFAULT 0,
+	`backend_session_id` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_open_tabs_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `user_preferences` (
+	`user_id` varchar(255) NOT NULL,
+	`reopen_tabs_on_login` boolean NOT NULL DEFAULT false,
+	`theme` text,
+	`font_size` text,
+	`accent_color` text,
+	`language` text,
+	`storage_mode` text,
+	`command_autocomplete` boolean,
+	`command_palette_enabled` boolean,
+	`show_host_tags` boolean,
+	`host_tray_on_click` boolean,
+	`pin_app_rail` boolean,
+	`expand_app_rail_on_hover` boolean,
+	`folders_collapsed` boolean,
+	`confirm_snippet_execution` boolean,
+	`disable_update_check` boolean,
+	`confirm_tab_close` boolean,
+	`hidden_rail_tabs` text,
+	`compact_host_view` boolean,
+	`status_color_scheme` text,
+	`custom_themes` text,
+	`custom_keybindings` text,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_preferences_user_id` PRIMARY KEY(`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `user_roles` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`role_id` int NOT NULL,
+	`granted_by` varchar(255),
+	`granted_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_roles_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_user_roles_user_role` UNIQUE(`user_id`,`role_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `users` (
+	`id` varchar(255) NOT NULL,
+	`username` text NOT NULL,
+	`password_hash` text NOT NULL,
+	`is_admin` boolean NOT NULL DEFAULT false,
+	`is_oidc` boolean NOT NULL DEFAULT false,
+	`oidc_identifier` text,
+	`sso_provider_id` int,
+	`client_id` text,
+	`client_secret` text,
+	`issuer_url` text,
+	`authorization_url` text,
+	`token_url` text,
+	`identifier_path` text,
+	`name_path` text,
+	`scopes` text DEFAULT ('openid email profile'),
+	`totp_secret` text,
+	`totp_enabled` boolean NOT NULL DEFAULT false,
+	`totp_backup_codes` text,
+	`registered_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`donation_modal_dismissed` boolean NOT NULL DEFAULT false,
+	CONSTRAINT `users_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `vault_profiles` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`folder` text,
+	`tags` text,
+	`vault_addr` text NOT NULL,
+	`vault_namespace` text,
+	`oidc_mount` text,
+	`oidc_role` text,
+	`ssh_mount` text,
+	`ssh_role` text NOT NULL,
+	`valid_principals` text,
+	`key_type` text,
+	`shared` boolean NOT NULL DEFAULT false,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `vault_profiles_id` PRIMARY KEY(`id`),
+	CONSTRAINT `vault_profiles_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `vault_tokens` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`profile_id` int NOT NULL,
+	`ssh_cert` text NOT NULL,
+	`private_key` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`last_used` text,
+	CONSTRAINT `vault_tokens_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_vault_tokens_user_profile` UNIQUE(`user_id`,`profile_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `webauthn_credentials` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`credential_id` text NOT NULL,
+	`public_key` text NOT NULL,
+	`counter` int NOT NULL DEFAULT 0,
+	`device_type` text,
+	`backed_up` boolean NOT NULL DEFAULT false,
+	`transports` text,
+	`user_verification` text NOT NULL DEFAULT ('preferred'),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`last_used_at` text,
+	CONSTRAINT `webauthn_credentials_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `alert_firings` ADD CONSTRAINT `alert_firings_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_firings` ADD CONSTRAINT `alert_firings_rule_id_alert_rules_id_fk` FOREIGN KEY (`rule_id`) REFERENCES `alert_rules`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_rule_channels` ADD CONSTRAINT `alert_rule_channels_rule_id_alert_rules_id_fk` FOREIGN KEY (`rule_id`) REFERENCES `alert_rules`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_rule_channels` ADD CONSTRAINT `alert_rule_channels_channel_id_notification_channels_id_fk` FOREIGN KEY (`channel_id`) REFERENCES `notification_channels`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_rules` ADD CONSTRAINT `alert_rules_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_rules` ADD CONSTRAINT `alert_rules_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `api_keys` ADD CONSTRAINT `api_keys_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `audit_logs` ADD CONSTRAINT `audit_logs_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `c2s_tunnel_presets` ADD CONSTRAINT `c2s_tunnel_presets_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `command_history` ADD CONSTRAINT `command_history_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `command_history` ADD CONSTRAINT `command_history_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `dashboard_service_links` ADD CONSTRAINT `dashboard_service_links_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `dismissed_alerts` ADD CONSTRAINT `dismissed_alerts_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_pinned` ADD CONSTRAINT `file_manager_pinned_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_pinned` ADD CONSTRAINT `file_manager_pinned_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_recent` ADD CONSTRAINT `file_manager_recent_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_recent` ADD CONSTRAINT `file_manager_recent_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_shortcuts` ADD CONSTRAINT `file_manager_shortcuts_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_shortcuts` ADD CONSTRAINT `file_manager_shortcuts_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `homepage_items` ADD CONSTRAINT `homepage_items_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `homepage_layouts` ADD CONSTRAINT `homepage_layouts_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_access` ADD CONSTRAINT `host_access_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_access` ADD CONSTRAINT `host_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_access` ADD CONSTRAINT `host_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_access` ADD CONSTRAINT `host_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_health_checks` ADD CONSTRAINT `host_health_checks_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_health_checks` ADD CONSTRAINT `host_health_checks_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_health_history` ADD CONSTRAINT `host_health_history_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_health_history` ADD CONSTRAINT `host_health_history_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_metrics_history` ADD CONSTRAINT `host_metrics_history_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_metrics_preferences` ADD CONSTRAINT `host_metrics_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_metrics_preferences` ADD CONSTRAINT `host_metrics_preferences_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_vault_profile_id_vault_profiles_id_fk` FOREIGN KEY (`vault_profile_id`) REFERENCES `vault_profiles`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_rdp_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`rdp_credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_vnc_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`vnc_credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_telnet_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`telnet_credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `network_topology` ADD CONSTRAINT `network_topology_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `notification_channels` ADD CONSTRAINT `notification_channels_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `opkssh_tokens` ADD CONSTRAINT `opkssh_tokens_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `opkssh_tokens` ADD CONSTRAINT `opkssh_tokens_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `recent_activity` ADD CONSTRAINT `recent_activity_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `recent_activity` ADD CONSTRAINT `recent_activity_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_recordings` ADD CONSTRAINT `session_recordings_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_recordings` ADD CONSTRAINT `session_recordings_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_recordings` ADD CONSTRAINT `session_recordings_access_id_host_access_id_fk` FOREIGN KEY (`access_id`) REFERENCES `host_access`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_share_participants` ADD CONSTRAINT `session_share_participants_share_id_session_shares_id_fk` FOREIGN KEY (`share_id`) REFERENCES `session_shares`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_share_participants` ADD CONSTRAINT `session_share_participants_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_shares` ADD CONSTRAINT `session_shares_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_shares` ADD CONSTRAINT `session_shares_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_shares` ADD CONSTRAINT `session_shares_target_user_id_users_id_fk` FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `sessions` ADD CONSTRAINT `sessions_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` ADD CONSTRAINT `shared_host_auth_overrides_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` ADD CONSTRAINT `shared_host_auth_overrides_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` ADD CONSTRAINT `shared_host_auth_overrides_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` ADD CONSTRAINT `shared_host_secrets_host_access_id_host_access_id_fk` FOREIGN KEY (`host_access_id`) REFERENCES `host_access`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` ADD CONSTRAINT `shared_host_secrets_target_user_id_users_id_fk` FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` ADD CONSTRAINT `shared_host_secrets_original_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`original_credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_access` ADD CONSTRAINT `snippet_access_snippet_id_snippets_id_fk` FOREIGN KEY (`snippet_id`) REFERENCES `snippets`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_access` ADD CONSTRAINT `snippet_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_access` ADD CONSTRAINT `snippet_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_access` ADD CONSTRAINT `snippet_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_folders` ADD CONSTRAINT `snippet_folders_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippets` ADD CONSTRAINT `snippets_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_credential_usage` ADD CONSTRAINT `ssh_credential_usage_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_credential_usage` ADD CONSTRAINT `ssh_credential_usage_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_credential_usage` ADD CONSTRAINT `ssh_credential_usage_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_credentials` ADD CONSTRAINT `ssh_credentials_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_folders` ADD CONSTRAINT `ssh_folders_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_folders` ADD CONSTRAINT `ssh_folders_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `sync_tombstones` ADD CONSTRAINT `sync_tombstones_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identities` ADD CONSTRAINT `termix_identities_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_ca` ADD CONSTRAINT `termix_identity_ca_identity_id_termix_identities_id_fk` FOREIGN KEY (`identity_id`) REFERENCES `termix_identities`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_ca` ADD CONSTRAINT `termix_identity_ca_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` ADD CONSTRAINT `termix_identity_keys_identity_id_termix_identities_id_fk` FOREIGN KEY (`identity_id`) REFERENCES `termix_identities`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` ADD CONSTRAINT `termix_identity_keys_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` ADD CONSTRAINT `termix_identity_keys_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `tmux_session_tags` ADD CONSTRAINT `tmux_session_tags_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `tmux_session_tags` ADD CONSTRAINT `tmux_session_tags_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `transfer_recent` ADD CONSTRAINT `transfer_recent_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `transfer_recent` ADD CONSTRAINT `transfer_recent_source_host_id_ssh_data_id_fk` FOREIGN KEY (`source_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `transfer_recent` ADD CONSTRAINT `transfer_recent_dest_host_id_ssh_data_id_fk` FOREIGN KEY (`dest_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `trusted_devices` ADD CONSTRAINT `trusted_devices_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_open_tabs` ADD CONSTRAINT `user_open_tabs_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_open_tabs` ADD CONSTRAINT `user_open_tabs_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD CONSTRAINT `user_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_roles` ADD CONSTRAINT `user_roles_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_roles` ADD CONSTRAINT `user_roles_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_roles` ADD CONSTRAINT `user_roles_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `vault_profiles` ADD CONSTRAINT `vault_profiles_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `vault_tokens` ADD CONSTRAINT `vault_tokens_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `vault_tokens` ADD CONSTRAINT `vault_tokens_profile_id_vault_profiles_id_fk` FOREIGN KEY (`profile_id`) REFERENCES `vault_profiles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `webauthn_credentials` ADD CONSTRAINT `webauthn_credentials_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0001_puzzling_aqueduct.sql

@@ -0,0 +1,10 @@
+CREATE TABLE `host_sidebar_preferences` (
+	`user_id` varchar(255) NOT NULL,
+	`data` text NOT NULL,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `host_sidebar_preferences_user_id` PRIMARY KEY(`user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `sort_order` int;--> statement-breakpoint
+ALTER TABLE `ssh_folders` ADD `sort_order` int;--> statement-breakpoint
+ALTER TABLE `host_sidebar_preferences` ADD CONSTRAINT `host_sidebar_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0002_bumpy_korg.sql

@@ -0,0 +1,10 @@
+CREATE TABLE `credential_sidebar_preferences` (
+	`user_id` varchar(255) NOT NULL,
+	`data` text NOT NULL,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `credential_sidebar_preferences_user_id` PRIMARY KEY(`user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_credentials` ADD `pin` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_credentials` ADD `sort_order` int;--> statement-breakpoint
+ALTER TABLE `credential_sidebar_preferences` ADD CONSTRAINT `credential_sidebar_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0003_dry_human_robot.sql

@@ -0,0 +1 @@
+ALTER TABLE `snippets` ADD `is_note` boolean DEFAULT false NOT NULL;

drizzle/mysql/0004_fancy_spencer_smythe.sql

@@ -0,0 +1,28 @@
+CREATE TABLE `proxmox_node_history` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`ts` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`cpu_percent` double,
+	`mem_percent` double,
+	`disk_percent` double,
+	`net_rx_bytes` int,
+	`net_tx_bytes` int,
+	CONSTRAINT `proxmox_node_history_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `proxmox_stats_preferences` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`layout` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `proxmox_stats_preferences_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_proxmox_stats_prefs_user_host` UNIQUE(`user_id`,`host_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `enable_proxmox_stats` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `proxmox_stats_config` text;--> statement-breakpoint
+ALTER TABLE `proxmox_node_history` ADD CONSTRAINT `proxmox_node_history_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `proxmox_stats_preferences` ADD CONSTRAINT `proxmox_stats_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `proxmox_stats_preferences` ADD CONSTRAINT `proxmox_stats_preferences_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0005_tearful_mindworm.sql

@@ -0,0 +1 @@
+ALTER TABLE `ssh_data` ADD `enable_terminal_toolbar` boolean DEFAULT true NOT NULL;

drizzle/mysql/0006_last_fantastic_four.sql

@@ -0,0 +1,45 @@
+CREATE TABLE `fleet_inventory` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`os_pretty_name` text,
+	`kernel` text,
+	`architecture` text,
+	`hostname` text,
+	`uptime_seconds` int,
+	`ip` text,
+	`package_manager` text,
+	`collected_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `fleet_inventory_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_fleet_inventory_host` UNIQUE(`host_id`,`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `fleet_members` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`fleet_id` int NOT NULL,
+	`host_id` int NOT NULL,
+	`added_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `fleet_members_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_fleet_members_fleet_host` UNIQUE(`fleet_id`,`host_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `fleets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`color` text,
+	`icon` text,
+	`tag_rules` text,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `fleets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `fleets_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `fleet_inventory` ADD CONSTRAINT `fleet_inventory_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `fleet_inventory` ADD CONSTRAINT `fleet_inventory_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `fleet_members` ADD CONSTRAINT `fleet_members_fleet_id_fleets_id_fk` FOREIGN KEY (`fleet_id`) REFERENCES `fleets`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `fleet_members` ADD CONSTRAINT `fleet_members_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `fleets` ADD CONSTRAINT `fleets_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0007_aspiring_turbo.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `parent_host_id` int;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_parent_host_id_ssh_data_id_fk` FOREIGN KEY (`parent_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE set null ON UPDATE no action;

drizzle/mysql/0008_lame_nighthawk.sql

@@ -0,0 +1,18 @@
+CREATE TABLE `user_workspaces` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`color` text,
+	`icon` text,
+	`kind` text NOT NULL DEFAULT ('manual'),
+	`is_default` boolean NOT NULL DEFAULT false,
+	`payload` text NOT NULL DEFAULT ('{}'),
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`last_used_at` text,
+	CONSTRAINT `user_workspaces_id` PRIMARY KEY(`id`),
+	CONSTRAINT `user_workspaces_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `user_workspaces` ADD CONSTRAINT `user_workspaces_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0009_tan_skaar.sql

@@ -0,0 +1,26 @@
+ALTER TABLE `api_keys` MODIFY COLUMN `expires_at` varchar(255);--> statement-breakpoint
+ALTER TABLE `audit_logs` MODIFY COLUMN `action` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `audit_logs` MODIFY COLUMN `resource_type` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `audit_logs` MODIFY COLUMN `timestamp` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_access` MODIFY COLUMN `expires_at` varchar(255);--> statement-breakpoint
+ALTER TABLE `opkssh_tokens` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `recent_activity` MODIFY COLUMN `timestamp` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `session_shares` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `sessions` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `snippet_access` MODIFY COLUMN `expires_at` varchar(255);--> statement-breakpoint
+ALTER TABLE `trusted_devices` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `vault_tokens` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `webauthn_credentials` MODIFY COLUMN `credential_id` varchar(255) NOT NULL;--> statement-breakpoint
+CREATE INDEX `idx_audit_logs_timestamp` ON `audit_logs` (`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_audit_logs_user_ts` ON `audit_logs` (`user_id`,`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_audit_logs_action_ts` ON `audit_logs` (`action`,`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_audit_logs_resource_ts` ON `audit_logs` (`resource_type`,`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_host_access_user_id` ON `host_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_host_access_role_id` ON `host_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_host_access_host_id` ON `host_access` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_host_access_expires_at` ON `host_access` (`expires_at`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_data_user_id` ON `ssh_data` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_data_parent_host` ON `ssh_data` (`parent_host_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_data_credential` ON `ssh_data` (`credential_id`);--> statement-breakpoint
+CREATE INDEX `idx_sessions_user_id` ON `sessions` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_sessions_expires_at` ON `sessions` (`expires_at`);

drizzle/mysql/0010_small_infant_terrible.sql

@@ -0,0 +1,8 @@
+CREATE TABLE `ui_preferences` (
+	`user_id` varchar(255) NOT NULL,
+	`data` text NOT NULL,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ui_preferences_user_id` PRIMARY KEY(`user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ui_preferences` ADD CONSTRAINT `ui_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0011_easy_the_order.sql

@@ -0,0 +1,32 @@
+ALTER TABLE `alert_firings` MODIFY COLUMN `fired_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `session_recordings` MODIFY COLUMN `started_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `session_shares` MODIFY COLUMN `session_id` varchar(255) NOT NULL;--> statement-breakpoint
+CREATE INDEX `idx_alert_firings_rule` ON `alert_firings` (`rule_id`,`fired_at`);--> statement-breakpoint
+CREATE INDEX `idx_alert_firings_host` ON `alert_firings` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_api_keys_user_id` ON `api_keys` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_command_history_user_host` ON `command_history` (`user_id`,`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_dismissed_alerts_user_id` ON `dismissed_alerts` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_file_manager_pinned_user` ON `file_manager_pinned` (`user_id`,`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_file_manager_recent_user` ON `file_manager_recent` (`user_id`,`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_file_manager_shortcuts_user` ON `file_manager_shortcuts` (`user_id`,`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_fleet_inventory_user` ON `fleet_inventory` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_fleet_members_host` ON `fleet_members` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_homepage_items_user_id` ON `homepage_items` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_recent_activity_user_ts` ON `recent_activity` (`user_id`,`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_session_recordings_user_started` ON `session_recordings` (`user_id`,`started_at`);--> statement-breakpoint
+CREATE INDEX `idx_session_recordings_host` ON `session_recordings` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_session_shares_session_id` ON `session_shares` (`session_id`);--> statement-breakpoint
+CREATE INDEX `idx_session_shares_host_id` ON `session_shares` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_snippet_access_user_id` ON `snippet_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_snippet_access_snippet_id` ON `snippet_access` (`snippet_id`);--> statement-breakpoint
+CREATE INDEX `idx_snippet_access_role_id` ON `snippet_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_snippets_user_id` ON `snippets` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_credential_usage_credential` ON `ssh_credential_usage` (`credential_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_credential_usage_user` ON `ssh_credential_usage` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_credentials_user_id` ON `ssh_credentials` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_folders_user_id` ON `ssh_folders` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_transfer_recent_user` ON `transfer_recent` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_trusted_devices_user_id` ON `trusted_devices` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_user_open_tabs_user_id` ON `user_open_tabs` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_user_roles_role_id` ON `user_roles` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_user_workspaces_user_id` ON `user_workspaces` (`user_id`);

drizzle/mysql/0012_outgoing_ultron.sql

@@ -0,0 +1,224 @@
+CREATE TABLE `ai_conversations` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`title` text,
+	`provider_id` int,
+	`model` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ai_conversations_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ai_messages` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`conversation_id` int NOT NULL,
+	`role` text NOT NULL,
+	`content` text NOT NULL DEFAULT (''),
+	`tool_calls` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ai_messages_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ai_proposals` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`conversation_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`kind` text NOT NULL,
+	`summary` text,
+	`payload` text NOT NULL DEFAULT ('{}'),
+	`status` varchar(255) NOT NULL DEFAULT 'pending',
+	`applied_at` text,
+	`result_summary` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ai_proposals_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ai_providers` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`provider_type` text NOT NULL,
+	`label` varchar(255) NOT NULL,
+	`base_url` text,
+	`api_key` text,
+	`api_key_prefix` text,
+	`default_model` text,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ai_providers_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_ai_providers_user_label` UNIQUE(`user_id`,`label`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_channels` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`automation_id` int NOT NULL,
+	`channel_id` int NOT NULL,
+	CONSTRAINT `automation_channels_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_automation_channels_pair` UNIQUE(`automation_id`,`channel_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_run_steps` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`run_id` int NOT NULL,
+	`step_index` int NOT NULL,
+	`step_id` text NOT NULL,
+	`step_type` text NOT NULL,
+	`status` varchar(255) NOT NULL,
+	`started_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`finished_at` text,
+	`output` text,
+	`error` text,
+	`truncated` boolean NOT NULL DEFAULT false,
+	CONSTRAINT `automation_run_steps_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_runs` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`automation_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`trigger_type` text NOT NULL,
+	`trigger_context` text,
+	`status` varchar(255) NOT NULL,
+	`started_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`finished_at` text,
+	`duration_ms` int,
+	`error` text,
+	`dry_run` boolean NOT NULL DEFAULT false,
+	`parent_run_id` int,
+	CONSTRAINT `automation_runs_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_schedules` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`automation_id` int NOT NULL,
+	`cron` text,
+	`interval_seconds` int,
+	`timezone` text,
+	`next_due_at` varchar(255),
+	`last_tick_at` text,
+	CONSTRAINT `automation_schedules_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_automation_schedules_automation` UNIQUE(`automation_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_trigger_state` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`automation_id` int NOT NULL,
+	`state_key` varchar(255) NOT NULL,
+	`breach_started_at` text,
+	`last_fired_at` text,
+	`last_value` double,
+	`last_observed_state` text,
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `automation_trigger_state_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_automation_trigger_state_key` UNIQUE(`automation_id`,`state_key`)
+);
+--> statement-breakpoint
+CREATE TABLE `automations` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`definition` text NOT NULL,
+	`definition_version` int NOT NULL DEFAULT 1,
+	`concurrency_policy` text NOT NULL DEFAULT ('skip'),
+	`max_run_seconds` int NOT NULL DEFAULT 300,
+	`dry_run` boolean NOT NULL DEFAULT false,
+	`last_run_at` text,
+	`last_run_status` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `automations_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `alert_rules` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `alert_rules` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `api_keys` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `c2s_tunnel_presets` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `c2s_tunnel_presets` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `credential_sidebar_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `dashboard_service_links` MODIFY COLUMN `label` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `dashboard_service_links` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `dashboard_service_links` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `file_manager_shortcuts` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `fleets` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `fleets` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `homepage_items` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `homepage_items` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `homepage_layouts` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_access` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_health_checks` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_health_checks` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_metrics_preferences` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_metrics_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_sidebar_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `network_topology` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `network_topology` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `notification_channels` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `opkssh_tokens` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `proxmox_stats_preferences` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `proxmox_stats_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `roles` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `roles` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `session_shares` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `sessions` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippet_access` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippet_folders` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippet_folders` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippets` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippets` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_folders` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_folders` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `sso_providers` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `sso_providers` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identities` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identities` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identity_ca` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identity_ca` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` MODIFY COLUMN `label` varchar(255);--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `tmux_session_tags` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `trusted_devices` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ui_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `label` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_workspaces` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_workspaces` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `vault_profiles` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `vault_profiles` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `vault_tokens` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `webauthn_credentials` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD `ai_assistant_enabled` boolean;--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD `ai_read_only_commands` boolean;--> statement-breakpoint
+ALTER TABLE `ai_conversations` ADD CONSTRAINT `ai_conversations_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ai_messages` ADD CONSTRAINT `ai_messages_conversation_id_ai_conversations_id_fk` FOREIGN KEY (`conversation_id`) REFERENCES `ai_conversations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ai_proposals` ADD CONSTRAINT `ai_proposals_conversation_id_ai_conversations_id_fk` FOREIGN KEY (`conversation_id`) REFERENCES `ai_conversations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ai_proposals` ADD CONSTRAINT `ai_proposals_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ai_providers` ADD CONSTRAINT `ai_providers_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_channels` ADD CONSTRAINT `automation_channels_automation_id_automations_id_fk` FOREIGN KEY (`automation_id`) REFERENCES `automations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_channels` ADD CONSTRAINT `automation_channels_channel_id_notification_channels_id_fk` FOREIGN KEY (`channel_id`) REFERENCES `notification_channels`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_run_steps` ADD CONSTRAINT `automation_run_steps_run_id_automation_runs_id_fk` FOREIGN KEY (`run_id`) REFERENCES `automation_runs`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_runs` ADD CONSTRAINT `automation_runs_automation_id_automations_id_fk` FOREIGN KEY (`automation_id`) REFERENCES `automations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_runs` ADD CONSTRAINT `automation_runs_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_schedules` ADD CONSTRAINT `automation_schedules_automation_id_automations_id_fk` FOREIGN KEY (`automation_id`) REFERENCES `automations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_trigger_state` ADD CONSTRAINT `automation_trigger_state_automation_id_automations_id_fk` FOREIGN KEY (`automation_id`) REFERENCES `automations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automations` ADD CONSTRAINT `automations_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_ai_conversations_user` ON `ai_conversations` (`user_id`,`updated_at`);--> statement-breakpoint
+CREATE INDEX `idx_ai_messages_conversation` ON `ai_messages` (`conversation_id`,`created_at`);--> statement-breakpoint
+CREATE INDEX `idx_ai_proposals_user` ON `ai_proposals` (`user_id`,`status`);--> statement-breakpoint
+CREATE INDEX `idx_ai_proposals_conversation` ON `ai_proposals` (`conversation_id`);--> statement-breakpoint
+CREATE INDEX `idx_automation_run_steps_run` ON `automation_run_steps` (`run_id`,`step_index`);--> statement-breakpoint
+CREATE INDEX `idx_automation_runs_automation` ON `automation_runs` (`automation_id`,`started_at`);--> statement-breakpoint
+CREATE INDEX `idx_automation_runs_user` ON `automation_runs` (`user_id`,`started_at`);--> statement-breakpoint
+CREATE INDEX `idx_automation_schedules_due` ON `automation_schedules` (`next_due_at`);--> statement-breakpoint
+CREATE INDEX `idx_automations_user` ON `automations` (`user_id`,`enabled`);

drizzle/mysql/0013_third_wraith.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `user_preferences` ADD `terminal_defaults` text;--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD `rdp_defaults` text;

drizzle/mysql/0014_bitter_nextwave.sql

@@ -0,0 +1 @@
+ALTER TABLE `user_preferences` ADD `terminal_macros` text;

drizzle/mysql/0015_red_cobalt_man.sql

@@ -0,0 +1,34 @@
+CREATE TABLE `collab_room_members` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`room_id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`room_role` text NOT NULL DEFAULT ('member'),
+	`added_by` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `collab_room_members_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_collab_room_members_room_user` UNIQUE(`room_id`,`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `collab_rooms` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`persistent` boolean NOT NULL DEFAULT false,
+	`presenter_user_id` varchar(255),
+	`stage_protocol` text,
+	`stage_host_id` int,
+	`stage_share_id` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`ended_at` text,
+	CONSTRAINT `collab_rooms_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_room_id_collab_rooms_id_fk` FOREIGN KEY (`room_id`) REFERENCES `collab_rooms`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_added_by_users_id_fk` FOREIGN KEY (`added_by`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_presenter_user_id_users_id_fk` FOREIGN KEY (`presenter_user_id`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_stage_host_id_ssh_data_id_fk` FOREIGN KEY (`stage_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_stage_share_id_session_shares_id_fk` FOREIGN KEY (`stage_share_id`) REFERENCES `session_shares`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_collab_room_members_user` ON `collab_room_members` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_collab_rooms_owner` ON `collab_rooms` (`owner_user_id`);

drizzle/mysql/0016_unusual_tyrannus.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `collab_rooms` ADD `guest_link_token` varchar(255);--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `idx_collab_rooms_guest_token` UNIQUE(`guest_link_token`);

drizzle/mysql/0017_spicy_proteus.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `secret_sources` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`kind` text NOT NULL DEFAULT ('onepassword-connect'),
+	`base_url` text NOT NULL,
+	`token` text NOT NULL,
+	`shared` boolean NOT NULL DEFAULT false,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `secret_sources_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `secret_sources` ADD CONSTRAINT `secret_sources_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_secret_sources_user` ON `secret_sources` (`user_id`);

drizzle/mysql/0018_fancy_barracuda.sql

@@ -0,0 +1,42 @@
+CREATE TABLE `credential_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_id` int NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('use'),
+	`expires_at` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `credential_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `shared_credential_secrets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_access_id` int NOT NULL,
+	`target_user_id` varchar(255) NOT NULL,
+	`credential_id` int NOT NULL,
+	`encrypted_username` text,
+	`auth_type` text NOT NULL DEFAULT ('password'),
+	`encrypted_password` text,
+	`encrypted_key` text,
+	`encrypted_key_password` text,
+	`key_type` text,
+	`public_key` text,
+	`cert_public_key` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `shared_credential_secrets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_shared_credential_secrets_scope` UNIQUE(`credential_access_id`,`target_user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_cred_secrets_access_id_fk` FOREIGN KEY (`credential_access_id`) REFERENCES `credential_access`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_credential_secrets_target_user_id_users_id_fk` FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_credential_secrets_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_credential_access_user_id` ON `credential_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_role_id` ON `credential_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_credential_id` ON `credential_access` (`credential_id`);--> statement-breakpoint
+CREATE INDEX `idx_shared_credential_secrets_target` ON `shared_credential_secrets` (`target_user_id`,`credential_id`);

drizzle/mysql/0019_certain_archangel.sql

@@ -0,0 +1,22 @@
+CREATE TABLE `folder_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`folder` varchar(255) NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('connect'),
+	`expires_at` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `folder_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `snippets` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `vault_profiles` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_folder_access_owner_folder` ON `folder_access` (`owner_user_id`,`folder`);

drizzle/mysql/0020_wise_green_goblin.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `enable_web_ui` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `web_ui_config` text;

drizzle/mysql/0021_thick_galactus.sql

@@ -0,0 +1 @@
+ALTER TABLE `ssh_data` ADD `enable_ai_assistant` boolean DEFAULT false NOT NULL;

drizzle/mysql/0022_secret_blacklash.sql

@@ -0,0 +1,51 @@
+CREATE TABLE `plugin_install_counts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`registry_id` varchar(255) NOT NULL,
+	`count` int NOT NULL DEFAULT 0,
+	`source` text NOT NULL DEFAULT ('aggregate-telemetry'),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_install_counts_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_install_counts_plugin_registry` UNIQUE(`plugin_id`,`registry_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugin_permission_grants` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`capability` varchar(255) NOT NULL,
+	`granted_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`granted_by` varchar(255) NOT NULL,
+	CONSTRAINT `plugin_permission_grants_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_permission_grants_plugin_capability` UNIQUE(`plugin_id`,`capability`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugin_registries` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`url` text NOT NULL,
+	`kind` text NOT NULL DEFAULT ('community'),
+	`enabled` boolean NOT NULL DEFAULT true,
+	`signing_key` text,
+	`last_checked_at` text,
+	`last_index_hash` text,
+	CONSTRAINT `plugin_registries_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugins` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`version` text NOT NULL,
+	`tier` text NOT NULL DEFAULT ('available'),
+	`source` text NOT NULL DEFAULT ('community'),
+	`registry_id` varchar(255),
+	`state` text NOT NULL DEFAULT ('disabled'),
+	`installed_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`auto_update` boolean NOT NULL DEFAULT false,
+	`manifest_json` text NOT NULL,
+	CONSTRAINT `plugins_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_permission_grants` ADD CONSTRAINT `plugin_permission_grants_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `plugin_permission_grants` ADD CONSTRAINT `plugin_permission_grants_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_plugins_registry_id` ON `plugins` (`registry_id`);

drizzle/mysql/0023_even_beast.sql

@@ -0,0 +1 @@
+ALTER TABLE `user_preferences` ADD `show_pin_app_rail_button` boolean;

drizzle/mysql/0024_thin_colleen_wing.sql

@@ -0,0 +1,11 @@
+CREATE TABLE `plugin_storage` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`key` varchar(255) NOT NULL,
+	`value` text NOT NULL,
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_storage_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_storage_plugin_key` UNIQUE(`plugin_id`,`key`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_storage` ADD CONSTRAINT `plugin_storage_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0025_wet_master_mold.sql

@@ -0,0 +1,3 @@
+DROP TABLE `alert_firings`;--> statement-breakpoint
+DROP TABLE `alert_rule_channels`;--> statement-breakpoint
+DROP TABLE `alert_rules`;

drizzle/mysql/0026_empty_black_bird.sql

@@ -0,0 +1,3 @@
+ALTER TABLE `plugin_permission_grants` MODIFY COLUMN `granted_by` varchar(255);--> statement-breakpoint
+ALTER TABLE `plugin_permission_grants` ADD `source` text DEFAULT ('admin') NOT NULL;--> statement-breakpoint
+ALTER TABLE `plugins` ADD `last_error` text;

drizzle/mysql/0027_watery_multiple_man.sql

@@ -0,0 +1,11 @@
+CREATE TABLE `plugin_migrations` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`migration_id` varchar(255) NOT NULL,
+	`checksum` text NOT NULL,
+	`applied_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_migrations_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_migrations_plugin_migration` UNIQUE(`plugin_id`,`migration_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_migrations` ADD CONSTRAINT `plugin_migrations_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0028_fair_tusk.sql

@@ -0,0 +1,17 @@
+CREATE TABLE `rbac_applied_defaults` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`role_name` varchar(255) NOT NULL,
+	`permission` varchar(255) NOT NULL,
+	`applied_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `rbac_applied_defaults_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_rbac_applied_defaults_role_permission` UNIQUE(`role_name`,`permission`)
+);
+--> statement-breakpoint
+CREATE TABLE `rbac_known_permissions` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`permission` varchar(255) NOT NULL,
+	`plugin_id` varchar(255),
+	`first_seen_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `rbac_known_permissions_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_rbac_known_permissions_permission` UNIQUE(`permission`)
+);

drizzle/mysql/0029_open_captain_america.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `plugin_settings` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`scope` enum('admin','user','host','secret') NOT NULL,
+	`scope_id` varchar(255),
+	`key` varchar(255) NOT NULL,
+	`value` text,
+	`encrypted` boolean NOT NULL DEFAULT false,
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_settings_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_settings_scope_key` UNIQUE(`plugin_id`,`scope`,`scope_id`,`key`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_settings` ADD CONSTRAINT `plugin_settings_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_plugin_settings_plugin_scope` ON `plugin_settings` (`plugin_id`,`scope`);

drizzle/mysql/0030_sweet_warlock.sql

@@ -0,0 +1,24 @@
+CREATE TABLE `user_external_identities` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`provider_id` varchar(255) NOT NULL,
+	`subject` varchar(255) NOT NULL,
+	`email` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_external_identities_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_user_external_identities_provider_subject` UNIQUE(`provider_id`,`subject`)
+);
+--> statement-breakpoint
+CREATE TABLE `user_second_factors` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`factor_id` varchar(255) NOT NULL,
+	`enrolled_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_second_factors_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_user_second_factors_user_factor` UNIQUE(`user_id`,`plugin_id`,`factor_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `user_external_identities` ADD CONSTRAINT `user_external_identities_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_second_factors` ADD CONSTRAINT `user_second_factors_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_user_external_identities_user` ON `user_external_identities` (`user_id`);

drizzle/mysql/0031_nebulous_diamondback.sql

@@ -0,0 +1,5 @@
+-- user_workspaces moved to the workspaces plugin, whose first migration renames it
+-- to p_workspaces_workspaces. Dropping it here would lose every saved workspace,
+-- so this only stops drizzle tracking it. SELECT 1 because MySQL rejects an
+-- empty query.
+SELECT 1;

drizzle/mysql/0032_lethal_marrow.sql

@@ -0,0 +1,4 @@
+-- network_topology moved to the network-topology plugin, which adopts (renames)
+-- this table in its own migration before this drizzle migration would run.
+-- No DROP here: it would delete every row before the plugin's rename applies.
+SELECT 1;

drizzle/mysql/0033_clear_anthem.sql

@@ -0,0 +1,4 @@
+-- snippets, snippet_folders and snippet_access moved to the snippets plugin
+-- (p_snippets_*), adopted by rename rather than dropped. A real DROP TABLE
+-- here would run before the plugin's adoption migration and delete every row.
+SELECT 1;

drizzle/mysql/0034_green_vector.sql

@@ -0,0 +1,2 @@
+-- dropped, see plugin adoption (fleets plugin, migrations/mysql/0001_adopt_fleets.sql)
+SELECT 1;

drizzle/mysql/0035_clumsy_leech.sql

@@ -0,0 +1,6 @@
+-- proxmox_node_history and proxmox_stats_preferences moved to the proxmox
+-- plugin (p_proxmox_*), adopted by rename rather than dropped. The four
+-- ssh_data proxmox columns are copied into the plugin's host settings after
+-- plugins load, which is after this migration, so a real DROP COLUMN here
+-- would delete the data first. The columns stay in place, unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0036_dear_vapor.sql

@@ -0,0 +1,5 @@
+-- file_manager_pinned, file_manager_recent, file_manager_shortcuts and
+-- transfer_recent are adopted (renamed, not dropped) by the file-manager
+-- plugin's own migration, which runs at plugin activation, after core's
+-- drizzle migrations. A DROP TABLE here would run first and delete the data.
+SELECT 1;

drizzle/mysql/0037_foamy_norman_osborn.sql

@@ -0,0 +1,5 @@
+-- c2s_tunnel_presets moved to the tunnels plugin, whose first migration renames
+-- it to p_tunnels_presets. Dropping it here would lose every saved preset, so
+-- this only stops drizzle tracking it. SELECT 1 because MySQL rejects an
+-- empty query.
+SELECT 1;

drizzle/mysql/0038_quiet_karnak.sql

@@ -0,0 +1,5 @@
+-- command_history moved to the ssh-terminal plugin, whose first migration
+-- renames it to p_ssh_terminal_command_history. Dropping it here would lose
+-- every saved command, so this only stops drizzle tracking it. SELECT 1
+-- because MySQL rejects an empty query.
+SELECT 1;

drizzle/mysql/0039_condemned_shiva.sql

@@ -0,0 +1,5 @@
+-- tmux_session_tags moved to the tmux-monitor plugin, whose first migration
+-- renames it to p_tmux_monitor_session_tags. Dropping it here would lose
+-- every saved tag, so this only stops drizzle tracking it. SELECT 1 because
+-- MySQL rejects an empty query.
+SELECT 1;

drizzle/mysql/0040_misty_skin.sql

@@ -0,0 +1,6 @@
+-- session_shares, session_share_participants, collab_rooms and
+-- collab_room_members moved to the session-sharing plugin, whose first
+-- migration renames them. Dropping them here would lose every share and
+-- room, so this only stops drizzle tracking them. SELECT 1 because MySQL
+-- rejects an empty query.
+SELECT 1;

drizzle/mysql/0041_wonderful_cargill.sql

@@ -0,0 +1,5 @@
+-- session_recordings moved to the session-recording plugin, whose first
+-- migration renames it. Dropping it here would lose every recording, so
+-- this only stops drizzle tracking it. SELECT 1 because MySQL rejects an
+-- empty query.
+SELECT 1;

drizzle/mysql/0042_colorful_bill_hollister.sql

@@ -0,0 +1,7 @@
+-- The remote desktop host options (enable_rdp, enable_vnc, enable_telnet,
+-- the three ports, rdp_security, rdp_ignore_cert, security, ignore_cert,
+-- guacamole_config) and user_preferences.rdp_defaults moved to the
+-- remote-desktop plugin's settings. The copy runs after plugins load, which
+-- is after this migration, so a real DROP COLUMN here would delete the data
+-- first. The columns stay in place, unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0043_unusual_lucky_pierre.sql

@@ -0,0 +1,9 @@
+-- host_metrics_preferences, host_health_checks, host_health_history and
+-- host_metrics_history moved to the host-metrics plugin, which adopts them by
+-- rename in its own first migration. That runs after this one, so a real
+-- DROP TABLE here would delete every row first.
+SELECT 1;--> statement-breakpoint
+-- Status checks are core: the per-host switch and interval, copied out of
+-- stats_config at boot by host-status-config-migration.ts.
+ALTER TABLE `ssh_data` ADD `status_check_enabled` boolean DEFAULT true NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `status_check_interval` int;

drizzle/mysql/0044_jittery_thunderball.sql

@@ -0,0 +1,6 @@
+-- ssh_data.stats_config split: its status half moved to status_check_enabled
+-- and status_check_interval, its metrics half to the host-metrics plugin's
+-- host settings. Both copies run at boot, after this migration, so a real
+-- DROP COLUMN here would delete the data first. The column stays in place,
+-- unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0045_flowery_the_hood.sql

@@ -0,0 +1,5 @@
+-- ssh_data.enable_docker and docker_config moved to the docker plugin's host
+-- settings. The copy runs at boot, after this migration, so a real DROP
+-- COLUMN here would delete the data first. The columns stay in place,
+-- unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0046_rich_logan.sql

@@ -0,0 +1,4 @@
+-- The automation tables moved to the automations plugin, which renames them
+-- into its own namespace at activation. That runs after this migration, so a
+-- real DROP TABLE here would delete every automation first.
+SELECT 1;

drizzle/mysql/0047_red_silver_sable.sql

@@ -0,0 +1,8 @@
+-- The ai tables moved to the ai plugin, which renames them into its own
+-- namespace at activation, and ssh_data.enable_ai_assistant and the two
+-- user_preferences ai columns moved to its settings. Both run after this
+-- migration, so a real DROP here would delete the data first. The columns
+-- stay in place, unused, until 3.0.0. The timestamp and label type changes
+-- drizzle-kit also wrote are generator drift (see FINISH-LIST.md), not a
+-- change to the database, and are left out on purpose.
+SELECT 1;

drizzle/mysql/0048_hard_demogoblin.sql

@@ -0,0 +1,6 @@
+-- dashboard_service_links, homepage_items and homepage_layouts moved to the
+-- homepage plugin, which adopts them by rename at activation (see
+-- plugins/homepage/migrations/mysql/0001_adopt_homepage_tables.sql).
+-- Dropping them here would delete every row before the plugin's migration
+-- ever runs, since this runs at boot before the plugins table exists.
+SELECT 1;

drizzle/mysql/0049_quiet_blacklash.sql

@@ -0,0 +1,4 @@
+-- mac_address and wol_broadcast_address move to the wake-on-lan plugin's
+-- host settings at boot, after this migration runs. Dropping them here would
+-- delete the data before the copy has a chance to run.
+SELECT 1;

drizzle/mysql/0050_optimal_speedball.sql

@@ -0,0 +1,4 @@
+-- secret_sources moves to the secret-sources plugin's adopted table at
+-- activation, after this migration runs. Dropping it here would delete the
+-- data before the plugin has a chance to rename it.
+SELECT 1;

drizzle/mysql/0051_icy_hercules.sql

@@ -0,0 +1,4 @@
+-- webauthn_credentials moves to the webauthn plugin's adopted table at
+-- activation, and the users TOTP columns are read by the TOTP boot migration
+-- after this runs. Dropping either here would lose the data first.
+SELECT 1;

drizzle/mysql/0052_illegal_gladiator.sql

@@ -0,0 +1,4 @@
+-- sso_providers moves to the sso plugin's adopted table at activation, and
+-- its LDAP rows are copied into the ldap plugin by a boot migration after
+-- this runs. Dropping it here would lose the data first.
+SELECT 1;

drizzle/mysql/0053_magical_groot.sql

@@ -0,0 +1,5 @@
+-- opkssh_tokens moves to the opkssh plugin's adopted table at activation,
+-- and ssh_data.use_warpgate is copied into the warpgate plugin's host
+-- settings by a boot migration after this runs. Dropping either here would
+-- lose the data first.
+SELECT 1;