Documentation

README.md

@@ -1,14 +1,15 @@
 # Nexus Terminal
 
-**A desktop client for SSH, Telnet, RAW TCP, and GitHub — with secure credential handling and a focused, multi-session workflow.**
+**A desktop client for SSH, Telnet, RAW TCP, VNC, GitHub, local terminals, and Leviathan binary analysis — with secure credential handling and a focused, multi-session workflow.**
 
 Nexus Terminal helps you manage many connections at once, keep terminal work organised, and move files with confidence.
 
 ## Highlights
 
-- SSH, Telnet, RAW TCP, and GitHub sessions in one app
+- SSH, Telnet, RAW TCP, VNC, GitHub, and local terminal sessions in one app
 - Tabbed sessions with split panes, pinning, and reordering
 - SFTP browser with drag-and-drop uploads and a directory picker
+- Leviathan binary workbench with hex editing, entropy, carving, BinSnoop, structure parsers, transforms, and spectrogram tools
 - Disconnected overlay with one-click reconnect
 - Broadcast input, snippets, and terminal search
 - Session recording and playback

docs/overview.md

@@ -1,10 +1,10 @@
 # Nexus Terminal Overview
 
-Nexus Terminal is a desktop connection workspace for people who manage servers, network services, remote desktops, and repositories every day. It brings SSH, Telnet, RAW TCP, VNC, GitHub, and local shell workflows into one focused app with secure credential handling, multi-session organisation, file transfer, automation, and recording built in.
+Nexus Terminal is a desktop connection and analysis workspace for people who manage servers, network services, remote desktops, repositories, and binary artefacts every day. It brings SSH, Telnet, RAW TCP, VNC, GitHub, local shell, and Leviathan binary-analysis workflows into one focused app with secure credential handling, multi-session organisation, file transfer, automation, recording, and inspection tooling built in.
 
 ## Product positioning
 
-Nexus is more than an SSH client. It is a single command centre for remote access, terminal operations, file movement, raw socket inspection, GitHub repository visibility, and repeatable operational workflows.
+Nexus is more than an SSH client. It is a single command centre for remote access, terminal operations, file movement, raw socket inspection, GitHub repository visibility, binary triage, and repeatable operational workflows.
 
 Use Nexus when you need to:
 
@@ -13,7 +13,7 @@ Use Nexus when you need to:
 - Move files over SSH without leaving the terminal workspace.
 - Work safely with host key verification, encrypted secrets, TOTP support, and audit logging.
 - Reuse commands, automate login flows, record sessions, and react to terminal output.
-- Support mixed estates that include SSH servers, Telnet devices, raw TCP services, VNC desktops, GitHub repositories, and local shells.
+- Support mixed estates that include SSH servers, Telnet devices, raw TCP services, VNC desktops, GitHub repositories, local shells, firmware images, binaries, archives, and other artefacts.
 
 ## Main feature groups
 
@@ -25,6 +25,7 @@ Use Nexus when you need to:
 - **VNC** for remote desktop access.
 - **GitHub** for repository browsing and download workflows.
 - **Local terminal** for opening a shell on the local machine.
+- **Leviathan** for binary inspection, editing, carving, transforms, and spectrogram workflows.
 - **Quick connect** for one-off sessions without saving a profile.
 - **Saved profiles** for repeat connections.
 
@@ -45,6 +46,7 @@ Use Nexus when you need to:
 - Pin tabs to keep important systems visible.
 - Rename sessions.
 - Reorder tabs.
+- Scroll overflowing tabs and hover them to see full names and connection start times.
 - Close one session or all sessions.
 - Split panes vertically or horizontally.
 - Resize split panes.
@@ -169,6 +171,47 @@ Use Nexus when you need to:
 - Open repositories in the browser.
 - Download repository ZIP archives.
 
+### Leviathan binary workbench
+
+- Switch from **Nexus Terminal** to **Leviathan** from the sidebar header.
+- Load a local file into a working document, inspect it with multiple tools, then save the patched working copy.
+- Tools open as normal tabs beside connection sessions.
+- Leviathan tabs close immediately without connection-disconnect confirmation.
+- Shared undo, redo, and revert actions for byte-level edits.
+- File-backed document model for large local files, with chunked save/export where supported.
+- Clear limits for tools that require bounded in-memory buffers, such as image/audio spectrogram conversion and some parsers.
+
+### Leviathan editor and triage tools
+
+- **Hex Editor** with editable byte cells, live ASCII preview, 16-byte and 32-byte rows, byte search, string/hex search, previous/next match navigation, and range opening from analysis views.
+- **Overview** for first-pass summary across hashes, entropy, strings, indicators, and carve candidates.
+- **Hashes** for CRC32, MD5, SHA-1, SHA-256, and SHA-512.
+- **Entropy** graph over the whole file, with selectable ranges that can open a new hex editor tab.
+- **Strings** extraction for ASCII and UTF-16 text.
+- **IOCs** for URLs, domains, paths, hashes, and other indicators.
+- **Search** and **Multi-search** for text, hex, and regular-expression matching.
+- Exportable results from tools that find files, ranges, or structured artefacts.
+
+### Leviathan structure, recovery, and transform tools
+
+- **Structures** parser for common binary formats such as PE, ELF, Mach-O, ZIP, images, RIFF, ASN.1, and certificates.
+- **Disasm** heuristic disassembly for common CPU families, with raw byte fallback for unsupported architectures.
+- **PDF** object, stream, xref, and suspicious-surface inspection.
+- **SquashFS** superblock and filesystem metadata inspection with human-readable bad-magic errors.
+- **Carve**, **Keys**, **Timestamps**, **Stego**, and **Metadata** tools for embedded artefacts and recovery workflows.
+- **BinSnoop** deep signature scanning across the whole file, with export for discovered files and ranges.
+- **Rules** for YARA-like rule scans.
+- **Patch Plan** and **Patch Apply** for validating and applying patch scripts.
+- **Transforms** for hex, Base64, URL, XOR, inflate, and cipher pipelines.
+- **Case Export** for bundling useful artefacts from a working investigation.
+
+### Leviathan spectrogram tools
+
+- Convert an image into WAV audio so the image appears in a spectrogram.
+- Insert an encoded image into an existing WAV or MP3 carrier.
+- Visualise WAV or MP3 audio as a spectrogram image.
+- Control FFT size, height, maximum width, aspect ratio, frequency range, brightness, and contrast.
+
 ### Automation and reusable workflows
 
 - Snippet library for saved commands.
@@ -228,25 +271,26 @@ Use Nexus when you need to:
 
 ### Suggested headline
 
-Nexus Terminal: one desktop workspace for SSH, files, sockets, remote desktops, and repositories.
+Nexus Terminal: one desktop workspace for SSH, files, sockets, remote desktops, repositories, and binary artefacts.
 
 ### Suggested subheadline
 
-Manage SSH, Telnet, RAW TCP, VNC, GitHub, and local shell sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings, and automation built in.
+Manage SSH, Telnet, RAW TCP, VNC, GitHub, local shell, and Leviathan binary-analysis sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings, automation, and artefact-inspection tools built in.
 
 ### Short product description
 
-Nexus Terminal helps developers, operators, support engineers, and homelab users manage many connections without juggling separate tools. Save profiles, organise them with groups and tags, connect in tabs or split panes, move files over SFTP, inspect raw TCP traffic, open VNC desktops, browse GitHub repositories, and keep credentials protected with keychain and encrypted-vault storage.
+Nexus Terminal helps developers, operators, support engineers, reverse engineers, firmware analysts, and homelab users manage many connections and artefacts without juggling separate tools. Save profiles, organise them with groups and tags, connect in tabs or split panes, move files over SFTP, inspect raw TCP traffic, open VNC desktops, browse GitHub repositories, triage binaries with Leviathan, and keep credentials protected with keychain and encrypted-vault storage.
 
 ### Product page feature bullets
 
-- All-in-one connection workspace for SSH, Telnet, RAW TCP, VNC, GitHub, and local shells.
+- All-in-one connection and analysis workspace for SSH, Telnet, RAW TCP, VNC, GitHub, local shells, and Leviathan tools.
 - Fast multi-session interface with tabs, pinned sessions, split panes, reconnect, and broadcast input.
 - Rich SSH support including agent auth, TOTP, jump hosts, proxies, port forwarding, startup commands, login scripts, and host key policies.
 - Built-in SFTP browser with upload, download, rename, delete, folders, bookmarks, drag-and-drop upload, and permission-aware directory picking.
 - RAW TCP tooling with text, hex, split views, payload presets, captures, timestamps, and byte-level sending.
 - VNC viewer with scale-to-fit, view-only mode, quality controls, shared sessions, and optional SSH tunnelling.
 - GitHub repository browser with organisation grouping, filtering, activity sorting, metadata, ZIP downloads, and GitHub Enterprise support.
+- Leviathan binary workbench with hex editing, hashes, entropy, strings, IOCs, carving, BinSnoop, structures, PDF/SquashFS inspection, transforms, rules, patching, case export, and spectrogram image/audio tools.
 - Secure credential model using OS keychain first, encrypted vault fallback, per-profile secret modes, known hosts, encrypted exports, and audit logging.
 - Productivity tools including command palette, snippets, trigger rules, session recording, terminal search, scrollback export, and local terminal.
 
@@ -257,6 +301,7 @@ Nexus Terminal helps developers, operators, support engineers, and homelab users
 - Support teams who troubleshoot customer systems, network appliances, and legacy Telnet devices.
 - Network and hardware engineers who need RAW TCP and Telnet tools beside normal SSH workflows.
 - Homelab users who want SSH, VNC, file transfer, and repo access in one desktop app.
+- Reverse engineers, firmware analysts, and security researchers who want binary triage beside their live operational sessions.
 
 ## Learn more
 

docs/quick-start.md

@@ -1,6 +1,6 @@
 # Nexus Terminal Quick Start
 
-Nexus Terminal is a desktop client for SSH, Telnet, RAW TCP, and GitHub sessions. This page is a shareable quick start for everyday use.
+Nexus Terminal is a desktop client for SSH, Telnet, RAW TCP, VNC, GitHub, local terminal sessions, and Leviathan binary analysis. This page is a shareable quick start for everyday use.
 
 ## Get connected in minutes
 
@@ -14,11 +14,20 @@ One-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** for quick connect.
 ## Daily workflow
 
 - **Tabs and splits**: Drag tabs to reorder, and split the workspace to view multiple sessions at once.
+- **Scrollable tabs**: Use the tab bar scrollbar or mouse wheel/trackpad over the tab strip when many tabs are open. Hover a tab to see its full name and connection start time.
 - **Broadcast input**: Toggle with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux) to send the same command to all connected sessions.
 - **Snippets**: Save common commands and run them with one click.
 - **Search**: Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search within the active terminal.
 - **Reconnect quickly**: If a session drops, click **Reconnect** on the disconnected overlay.
 
+## VNC remote desktops
+
+Create a **VNC** profile for remote desktop sessions. Use SSH tunnelling when possible, especially outside trusted networks. Direct VNC is available for isolated or trusted networks, but classic VNC traffic may not be encrypted.
+
+## Leviathan binary tools
+
+Click **Leviathan** beside **Nexus Terminal** in the sidebar header to switch from connection profiles to binary-analysis tools. Use **Load** to choose a file, then open tools such as Hex Editor, Overview, Hashes, Entropy, Strings, Carve, BinSnoop, Structures, PDF, SquashFS, Transforms, and Spectrogram tools. Tools open in normal tabs and can be closed without a disconnect confirmation.
+
 ## File transfers on SSH
 
 Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename, and delete files.

docs/user-manual.md

@@ -12,9 +12,10 @@
 8. SFTP file browser
 9. Drag-and-drop uploads and paste
 10. Session recordings
-11. Security and credentials
-12. Settings
-13. Troubleshooting
+11. Leviathan binary workbench
+12. Security and credentials
+13. Settings
+14. Troubleshooting
 
 ---
 
@@ -50,7 +51,7 @@ Tip: You can drag the divider between split panes to rebalance space.
 ### Create a new profile
 
 1. Click **New** in the sidebar.
-2. Choose the protocol (SSH, Telnet, RAW, GitHub).
+2. Choose the protocol (SSH, Telnet, RAW, VNC, or GitHub).
 3. Fill in the required fields and optional settings.
 4. Save and connect.
 
@@ -86,6 +87,15 @@ Tip: Use the search box to filter profiles by name, host, or tag.
 - Text, hex, and split views for binary-safe data.
 - Payload presets and configurable encoding and line endings.
 
+### VNC
+
+- Remote desktop viewer embedded in the Nexus workspace.
+- Password prompt and saved-password modes.
+- View-only mode, scale-to-fit, shared sessions, and quality controls.
+- Optional SSH tunnel for safer VNC transport.
+
+Use SSH tunnelling for VNC whenever possible. Direct VNC is useful on trusted or isolated networks, but many classic VNC deployments do not provide strong transport encryption.
+
 ### GitHub
 
 - Browse repositories by organisation.
@@ -97,6 +107,9 @@ Tip: Use the search box to filter profiles by name, host, or tag.
 
 - **Reorder** tabs by dragging them.
 - **Pin** important sessions to keep them at the front.
+- **Scroll** the tab bar with the scrollbar or mouse wheel/trackpad when many tabs are open.
+- **Hover** a tab to see the full name and, for connected sessions, the connection start time.
+- **Close** tabs with the close button on the left side of each tab. Leviathan tool tabs close without a disconnect confirmation.
 - **Split** the workspace vertically or horizontally to view multiple sessions at once.
 - **Broadcast** input to multiple connected sessions when needed.
 
@@ -190,7 +203,69 @@ Screenshot: Recordings list with playback controls.
 
 ---
 
-## 11. Security and credentials
+## 11. Leviathan binary workbench
+
+Leviathan is the integrated binary-analysis and editing workspace inside Nexus Terminal. It is useful for firmware images, unknown binaries, archives, captures, embedded files, suspicious documents, and audio spectrogram experiments.
+
+### Switching to Leviathan
+
+Click **Leviathan** in the top-left sidebar header. The normal connection list changes into a tool list. Click **Nexus Terminal** to return to saved servers and groups.
+
+Use **Load** to select a local file. The selected file becomes the current Leviathan working document. Use **Save** to write the patched working copy to a chosen destination.
+
+Leviathan tools open as regular tabs. You can open multiple tool tabs at once, switch between them, and close them without a connection-disconnect confirmation.
+
+### Hex Editor
+
+The Hex Editor is the primary byte-level view.
+
+- Choose 16 or 32 bytes per row.
+- Edit byte cells directly; typing two hex digits advances to the next byte.
+- The ASCII preview updates as bytes are edited.
+- Paste hex runs such as `de ad be ef` or `deadbeef` into consecutive cells.
+- Use Search to find strings or hex values, then move through matches with previous/next.
+- Undo, redo, or revert edits from the Leviathan panel header.
+
+### Triage tools
+
+- **Overview**: first-pass summary across hashes, entropy, strings, indicators, and carve candidates.
+- **Hashes**: CRC32, MD5, SHA-1, SHA-256, and SHA-512.
+- **Entropy**: graph entropy across the whole file; select a region to open that range in a new Hex Editor tab.
+- **Strings**: ASCII and UTF-16 string extraction.
+- **IOCs**: URLs, domains, paths, hashes, and other indicators.
+- **Search** and **Multi-search**: text, hex, and regular-expression matching.
+
+### Structure and recovery tools
+
+- **Structures** parses common formats such as PE, ELF, Mach-O, ZIP, images, RIFF, ASN.1, and certificates.
+- **Disasm** provides heuristic disassembly for common CPU families and raw byte fallback where decoding is not implemented.
+- **PDF** inspects objects, streams, xrefs, and suspicious surfaces.
+- **SquashFS** inspects filesystem superblocks and metadata; non-SquashFS input shows a human-readable bad-magic error.
+- **Carve** and **BinSnoop** scan for embedded files and signatures and can export discovered files or ranges.
+- **Keys**, **Timestamps**, **Stego**, and **Metadata** help recover common artefacts from binaries and containers.
+
+### Editing, transforms, and cases
+
+- **Patch Plan** validates patch scripts without modifying the working copy.
+- **Patch Apply** applies validated patch scripts.
+- **Transforms** runs pipelines such as hex, Base64, URL, XOR, inflate, and cipher transforms over selected data.
+- **Rules** runs YARA-like scans over the current document.
+- **Case Export** packages investigation artefacts from the working document.
+
+### Spectrogram tools
+
+- **Spectrogram Encode** converts an image into WAV audio so the image appears in a spectrogram.
+- It can also insert an encoded image into an existing WAV or MP3 carrier.
+- **Spectrogram View** renders WAV or MP3 audio as a spectrogram image.
+- Controls include FFT size, height, maximum width, aspect ratio, frequency range, brightness, and contrast.
+
+### Large file behaviour
+
+Leviathan keeps loaded files file-backed where possible and writes patched working copies in chunks. Some tools still need bounded in-memory buffers because the underlying parser or decoder works on complete byte slices; those tools reject oversized inputs with a clear message rather than trying to allocate unbounded memory.
+
+---
+
+## 12. Security and credentials
 
 Nexus Terminal stores credentials securely:
 
@@ -214,7 +289,7 @@ Screenshot: TOTP configuration in the profile editor.
 
 ---
 
-## 12. Settings
+## 13. Settings
 
 Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux) and configure:
 
@@ -227,7 +302,7 @@ Screenshot: Settings panel with appearance and security options.
 
 ---
 
-## 13. Troubleshooting
+## 14. Troubleshooting
 
 ### Session shows as disconnected
 
@@ -239,6 +314,19 @@ Screenshot: Settings panel with appearance and security options.
 - Check the folder is writable; **READ ONLY** indicates no write permission.
 - Confirm the SSH session is connected.
 
+### VNC will not connect
+
+- Confirm the VNC host and port are correct. The common VNC port is `5900` plus the display number.
+- If using a password, check whether the profile is set to saved, session-only, or ask-every-time mode.
+- If using an SSH tunnel, verify the tunnel host, username, authentication method, and SSH host key policy.
+- If direct VNC is enabled, test from a trusted network first and prefer an SSH tunnel for untrusted networks.
+
+### Leviathan cannot load or save a file
+
+- Check that the file still exists and that your user account can read it.
+- When saving, choose a writable destination and avoid overwriting a file that another process has locked.
+- Some tools enforce explicit size limits for safety. If a tool rejects an oversized input, try selecting a smaller range or using a tool that works on the file-backed document.
+
 ### Cannot read a folder
 
 - **NO READ** indicates insufficient permissions.

frontend/scripts/test-regressions.js

@@ -204,6 +204,31 @@ assertContains(
   "Hex Editor",
   "Leviathan mode must put Hex Editor in the tool list",
 );
+assertContains(
+  "frontend/src/js/settings.js",
+  "Leviathan Binary Tools",
+  "in-app help must document the integrated Leviathan workbench",
+);
+assertContains(
+  "frontend/src/js/settings.js",
+  "VNC Connections",
+  "in-app help must document VNC connection profiles",
+);
+assertContains(
+  "docs/user-manual.md",
+  "## 11. Leviathan binary workbench",
+  "user manual must include a full Leviathan section",
+);
+assertContains(
+  "docs/user-manual.md",
+  "### VNC",
+  "user manual must include VNC connection guidance",
+);
+assertContains(
+  "docs/overview.md",
+  "### Leviathan binary workbench",
+  "product overview must include Leviathan as a first-class feature group",
+);
 assertContains(
   "frontend/src/js/leviathan.js",
   "LeviathanSetByte",

frontend/src/js/settings.js

@@ -549,15 +549,17 @@
           id: "getting-started",
           title: "Getting Started",
           content: `
-                <p>Welcome to <strong>Nexus Terminal</strong> — a desktop application for connecting to remote servers via SSH, Telnet, and RAW TCP, as well as browsing your GitHub repositories.</p>
+                <p>Welcome to <strong>Nexus Terminal</strong> — a desktop application for SSH, Telnet, RAW TCP, VNC, GitHub, local terminal, and Leviathan binary-analysis workflows.</p>
                 <h4>Creating Your First Connection</h4>
                 <ol>
                     <li>Click the <strong>+</strong> button at the top of the sidebar, or press <kbd>⌘N</kbd> (Mac) / <kbd>Ctrl+N</kbd> (Windows/Linux).</li>
-                    <li>Choose a protocol (SSH, Telnet, RAW, or GitHub).</li>
+                    <li>Choose a protocol (SSH, Telnet, RAW, VNC, or GitHub).</li>
                     <li>Fill in the hostname, port, and any credentials required.</li>
                     <li>Optionally assign the connection to a <strong>group</strong> to keep your sidebar organised.</li>
                     <li>Click <strong>Save</strong>, then double-click the entry in the sidebar to connect.</li>
                 </ol>
+                <h4>Leviathan Tools</h4>
+                <p>Click <strong>Leviathan</strong> beside <strong>Nexus Terminal</strong> in the sidebar header to switch from connection profiles to binary-analysis tools. Use <strong>Load</strong> to choose a local file, then open tools such as Hex Editor, Overview, Entropy, Carve, BinSnoop, Structures, and Spectrogram View.</p>
                 <h4>Quick Connect</h4>
                 <p>Need to connect quickly without saving a profile? Press <kbd>⌘⇧Q</kbd> / <kbd>Ctrl+Shift+Q</kbd> to open the quick connect dialog. Choose SSH, Telnet, or RAW, enter the host and port, and you're connected immediately.</p>
                 <h4>Managing Connections</h4>
@@ -631,6 +633,22 @@
                 </ul>
             `,
         },
+        {
+          id: "vnc",
+          title: "VNC Connections",
+          content: `
+                <p>VNC profiles open a remote desktop viewer inside the Nexus workspace.</p>
+                <ul>
+                    <li><strong>Password handling</strong> — ask each time, use the session only, or save the password in the encrypted secret store.</li>
+                    <li><strong>View-only mode</strong> — observe a desktop without sending mouse or keyboard input.</li>
+                    <li><strong>Scale-to-fit</strong> — resize the remote desktop to fit the available workspace.</li>
+                    <li><strong>Shared session</strong> — request a shared VNC session where the server supports it.</li>
+                    <li><strong>Quality</strong> — tune image quality for slower links.</li>
+                    <li><strong>SSH tunnel</strong> — carry VNC traffic through an SSH connection using password, public key, or SSH agent authentication.</li>
+                </ul>
+                <p>Prefer <strong>SSH tunnel</strong> for VNC outside trusted networks. Direct VNC is supported for isolated or trusted networks, but many classic VNC deployments do not provide strong transport encryption.</p>
+            `,
+        },
         {
           id: "github",
           title: "GitHub Connections",
@@ -646,6 +664,35 @@
                 <p>Your repositories are listed grouped by organisation or owner, sorted by last commit date (newest first). The list refreshes automatically every few minutes.</p>
             `,
         },
+        {
+          id: "leviathan",
+          title: "Leviathan Binary Tools",
+          content: `
+                <p>Leviathan is the built-in binary-analysis and editing workbench. It is useful for firmware images, unknown binaries, archives, captures, embedded files, documents, and audio spectrogram experiments.</p>
+                <h4>Opening and Saving Files</h4>
+                <p>Switch to <strong>Leviathan</strong> in the sidebar header, click <strong>Load</strong>, and select a local file. The file becomes the active working document. Use <strong>Save</strong> to write the patched working copy to a destination you choose.</p>
+                <p>Leviathan tools open in normal tabs beside terminal and VNC sessions. They close immediately without a disconnect confirmation.</p>
+                <h4>Hex Editor</h4>
+                <ul>
+                    <li>Edit byte cells directly; two hex digits commit the byte and move to the next cell.</li>
+                    <li>The ASCII preview updates while editing.</li>
+                    <li>Switch between 16-byte and 32-byte rows.</li>
+                    <li>Search for strings or hex values and move through matches with previous/next.</li>
+                    <li>Paste runs such as <code>de ad be ef</code> or <code>deadbeef</code> into consecutive cells.</li>
+                    <li>Use Undo, Redo, and Revert from the Leviathan panel header.</li>
+                </ul>
+                <h4>Triage Tools</h4>
+                <p><strong>Overview</strong>, <strong>Hashes</strong>, <strong>Entropy</strong>, <strong>Strings</strong>, <strong>IOCs</strong>, <strong>Search</strong>, and <strong>Multi-search</strong> provide a first pass over the current document. The Entropy tool renders the whole-file graph and lets you open selected ranges in the Hex Editor.</p>
+                <h4>Structure and Recovery Tools</h4>
+                <p><strong>Structures</strong>, <strong>Disasm</strong>, <strong>PDF</strong>, <strong>SquashFS</strong>, <strong>Carve</strong>, <strong>Keys</strong>, <strong>Timestamps</strong>, <strong>Stego</strong>, <strong>Metadata</strong>, <strong>BinSnoop</strong>, and <strong>Rules</strong> help identify embedded formats, files, signatures, strings, keys, and suspicious structures. Carve and BinSnoop can export discovered files or ranges.</p>
+                <h4>Edit, Transform, and Case Tools</h4>
+                <p><strong>Patch Plan</strong> validates patch scripts, <strong>Patch Apply</strong> applies them, <strong>Transforms</strong> runs hex/Base64/URL/XOR/inflate/cipher pipelines, and <strong>Case Export</strong> packages investigation artefacts.</p>
+                <h4>Spectrogram Tools</h4>
+                <p><strong>Spectrogram Encode</strong> turns an image into WAV audio or inserts an encoded image into an existing WAV/MP3 carrier. <strong>Spectrogram View</strong> visualises WAV or MP3 audio as a spectrogram image with controls for FFT size, height, aspect ratio, frequency range, brightness, and contrast.</p>
+                <h4>Large Files</h4>
+                <p>Leviathan keeps loaded files file-backed where possible and saves patched working copies in chunks. Tools that require complete image, audio, PDF, or other parser buffers enforce explicit size limits and show a clear message if an input is too large.</p>
+            `,
+        },
         {
           id: "sessions",
           title: "Sessions & Tabs",
@@ -655,7 +702,9 @@
                     <li><strong>Rename</strong> — right-click a tab and choose "Rename".</li>
                     <li><strong>Reorder</strong> — drag tabs left or right to rearrange.</li>
                     <li><strong>Pin</strong> — right-click and pin a tab so it stays at the left of the bar.</li>
-                    <li><strong>Close</strong> — click the <strong>×</strong> on a tab, or press <kbd>⌘W</kbd> / <kbd>Ctrl+W</kbd>.</li>
+                    <li><strong>Scroll</strong> — use the tab bar scrollbar or mouse wheel/trackpad over the tab strip when many tabs are open.</li>
+                    <li><strong>Hover hints</strong> — hover a tab to see its full name and connected-since time where available.</li>
+                    <li><strong>Close</strong> — click the <strong>×</strong> on the left side of a tab, or press <kbd>⌘W</kbd> / <kbd>Ctrl+W</kbd>. Leviathan tabs close without a disconnect confirmation.</li>
                 </ul>
                 <h4>Split Panes</h4>
                 <p>You can split the terminal into multiple panes:</p>
@@ -797,12 +846,26 @@
                     <li>If the server is genuinely unreachable, attempts will exhaust after the configured maximum (default 5).</li>
                     <li>Check the reconnection settings in the profile's Advanced section.</li>
                 </ul>
+                <h4>VNC will not connect</h4>
+                <ul>
+                    <li>Check the VNC host and port. The common port is <code>5900</code> plus the display number.</li>
+                    <li>If a password is required, check whether the profile is set to saved, session-only, or ask-every-time mode.</li>
+                    <li>If using an SSH tunnel, verify the tunnel host, username, authentication method, private key, and host-key policy.</li>
+                    <li>If using direct VNC, test from a trusted network and prefer SSH tunnelling on untrusted networks.</li>
+                </ul>
                 <h4>The terminal looks garbled or the wrong size</h4>
                 <ul>
                     <li>Try resizing the window — the terminal should re-fit automatically.</li>
                     <li>If you're using split panes, drag the divider to give the terminal more space.</li>
                     <li>Some older servers may not support modern terminal features. Try a different terminal theme in <strong>Settings → Terminal</strong>.</li>
                 </ul>
+                <h4>Leviathan cannot load, save, or run a tool</h4>
+                <ul>
+                    <li>Check that the selected file still exists and that your account can read it.</li>
+                    <li>When saving, choose a writable destination and avoid files that are locked by another process.</li>
+                    <li>Some tools have explicit size limits because their parsers or decoders need a complete buffer. Use a smaller file or selected range when available.</li>
+                    <li>If SquashFS reports bad magic, the file is probably not a SquashFS image; inspect the header in Hex Editor or try Overview/BinSnoop first.</li>
+                </ul>
                 <h4>"Host key verification failed"</h4>
                 <p>This means the server's fingerprint has changed since your last connection. This can happen if the server was reinstalled, but it could also indicate a security threat. If you're certain it's safe, go to <strong>Settings → Known Hosts</strong>, find the entry, and remove it. You'll be prompted to accept the new key on your next connection.</p>
                 <h4>I forgot my vault master password</h4>