From 8c646e71767c968917f34848db69741fe2ed137e Mon Sep 17 00:00:00 2001
From: Andy Dixon <andy@andydixon.com>
Date: Sun, 11 Oct 2026 17:52:35 +0100
Subject: [PATCH] docs: rewrite for Nexus Terminal

---
 .github/copilot-instructions.md | 151 +++++-----
 README.md                       |  81 +++---
 docs/overview.md                | 343 ++++++++++------------
 docs/quick-start.md             |  55 ++--
 docs/user-manual.md             | 488 +++++++++++++++++++++-----------
 5 files changed, 613 insertions(+), 505 deletions(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 0a8e9d7..e6bfdb7 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -1,109 +1,86 @@
-# Copilot Instructions — Alchementary Link
+# Copilot Instructions — Nexus Terminal
+
+Nexus Terminal is a native desktop client (SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub, local shell) written in Rust with an eframe/egui UI. All the code lives in the Cargo workspace under `rust/`.
 
 ## Build & Test
 
 ```bash
-make deps              # go mod download + npm install
-make build             # production build → build/bin/alchementary-link.app
-make dev               # wails dev with hot reload
-make test              # go test ./... -v -count=1
-make lint              # golangci-lint run ./...
+cd rust
+cargo run --release                                     # the app (binary `nexus-terminal`)
+cargo test --workspace                                  # unit and integration tests
+cargo clippy --workspace --all-targets -- -D warnings   # must be clean
+cargo fmt --all --check                                 # must be clean
 
-# Single package test
-go test ./internal/storage/ -v -count=1 -run TestProfileCRUD
+# Single test
+cargo test -p nexus-core --lib storage::
+cargo test -p nexus-core --test ssh_integration
 ```
 
-The frontend has no separate build step — `npm run build` (called by Wails) copies xterm vendor libs from `node_modules` into `frontend/src/js/lib/` and `frontend/src/css/lib/`. All frontend assets are embedded at compile time via `frontend/embed.go`.
+CI (`.github/workflows/ci.yml`) runs `cargo test --locked`, `cargo fmt --check` and `cargo clippy --all-targets -D warnings` on Linux, macOS and Windows. The toolchain is pinned in `rust/rust-toolchain.toml`. Platform prerequisites and release packaging are in `docs/build-and-release.md`.
 
 ## Architecture
 
-Wails v2 desktop app: Go backend + HTML/CSS/JS frontend rendered in a native webview (WKWebView on macOS).
+The project is engine-first: a UI-free core crate, and the egui app is one client of it.
 
-**Go backend** (`internal/`):
-- `app/` — lifecycle bootstrap: opens SQLite, inits secret stores, wires everything together
-- `api/` — single `Service` struct bound to Wails; every public method is callable from JS as `window.go.api.Service.MethodName()`
-- `sessions/` — manages concurrent protocol sessions; owns SSH/Telnet/RAW/GitHub client lifecycles; handles auto-reconnect, login scripts, broadcast
-- `storage/` — SQLite repository (WAL mode) with embedded sequential migrations in `storage/migrations/`
-- `secrets/` — two-tier credential storage: OS keychain (preferred) → AES-256-GCM encrypted file vault (fallback)
-- `models/` — shared domain types and defaults; protocol configs are JSON-encoded in the DB
-- `sshclient/` — SSH client with agent, TOTP/2FA, and SOCKS5/HTTP proxy support
-- `telnetclient/`, `rawclient/`, `githubclient/` — protocol implementations
-- `sftpclient/` — SFTP file operations (browse, upload, download, rename, delete)
-- `sshconfig/` — OpenSSH `~/.ssh/config` parser and importer
-- `recording/` — asciicast v2 session recording and playback
-- `exportimport/` — encrypted profile bundles (.link format)
-- `updater/` — GitHub Releases update checker
-- `knownhosts/` — SSH host key management
-- `validation/` — profile and protocol validation
-- `audit/` — timestamped audit logging
+```
+rust/
+├── core/   nexus-core: storage, secrets, models, protocol clients, session Manager, Service. No egui.
+│   ├── migrations/       numbered SQL migrations, embedded with include_str!
+│   └── tests/            sessions.rs, ssh_integration.rs, fixtures/
+└── app/    nexus: the egui shell (binary `nexus-terminal`)
+```
 
-**Frontend** (`frontend/`):
-- Plain HTML/CSS/JS — no framework, no bundler, no ES modules
-- `index.html` is the app shell; loads CSS then JS in strict order
-- `src/js/` — 18 modules, each IIFE-wrapped, exporting to `window.AlchementaryLink`
-- `src/css/` — modular stylesheets; `tokens.css` defines all design tokens
-- Vendor libs (xterm.js, addons) live in `src/js/lib/` and `src/css/lib/` — auto-copied, gitignored
+**Core (`rust/core/src/`):**
+- `service.rs` — `Service`, the app-facing API: profiles, connect/reconnect, credentials, known hosts, preferences, snippets, import/export, SSH keys, SFTP, updates. File dialogs live in the UI; methods here take paths.
+- `sessions.rs` — `Manager`: concurrent sessions, auto-reconnect with backoff, login scripts, broadcast writes, recording hooks, secret resolution (saved / session-only / ask every time), host-key checks. It reports through one `Event` enum (`Data`, `State`, `Closed`, `RawData`, `Irc`, `Github*`, `Forward*`, `Recording*`, `SftpProgress`, `SecretPrompt`, `HostKeyVerify`, `Vnc*`).
+- `clients/` — one module per protocol (`ssh`, `sftp`, `telnet`, `raw`, `serial`, `local`, `irc`, `github`, `vnc`). Read the conventions at the top of `clients/mod.rs` before touching one: `connect()` blocks its (worker) thread and returns once usable; the client then owns its reader thread(s) and reports through `Callbacks` (data, fatal error, close exactly once); `write`/`resize`/`close` are callable from any thread and `close` is idempotent. russh-based clients use the shared tokio runtime from `clients::rt()`; the rest use plain threads.
+- `storage.rs` (SQLite via rusqlite, WAL), `secrets.rs` (keychain + vault), `config.rs` (data directories and Alchementary Link migration), `models.rs`, `validation.rs`, `exportimport.rs`, `recording.rs` (asciicast v2), `sshconfig.rs`, `updater.rs`, `ircformat.rs`, `terminalenv.rs`, `keyfiles.rs`.
 
-**Go ↔ JS communication:**
-- **Synchronous:** Frontend calls `window.go.api.Service.*()` (returns Promise)
-- **Asynchronous:** Backend pushes events via `wailsRuntime.EventsEmit()`; frontend listens with `window.runtime.EventsOn()`
-- **Bidirectional events** for secret prompts and host key verification: backend emits a request event with a `requestID`, frontend shows a modal, then emits a response event with the same ID. The Go side blocks on a channel keyed by that ID.
+**App (`rust/app/src/`):**
+- `main.rs` parses flags, opens the `Service` and starts eframe. `app.rs` owns `App`: it installs an event sink that forwards `Event`s over a channel and calls `request_repaint`, drains them each frame (`on_event`), handles `Request`s, the keyboard shortcuts (`shortcuts()`), and lays out the frame.
+- `state.rs` — `Shared` (service handle, cached profiles and preferences, tabs, panes, toasts) and the `Request` queue features use to ask the main window to act.
+- `views.rs` — `View::{Terminal, Raw, Irc, Github, Vnc}`, one per pane.
+- `terminal.rs` (`TermView`: alacritty_terminal drawn with egui's painter), `tabs.rs` (tab strip, workspace, find bar, overlays), `splits.rs` (split tree), `sidebar.rs`, `chrome.rs` (title bar, status bar, command palette `Cmd` enum, prompts, dialogs, toasts).
+- Feature windows: `profile_editor.rs`, `quick_connect.rs`, `settings.rs` (including the Help topics), `ssh_keys.rs`, `transfer.rs` (import/export), `sftp.rs`, `forwards.rs`, `snippets.rs`, `triggers.rs`, `recordings.rs`.
+- Protocol views: `raw_view.rs`, `irc_view.rs`, `github_view.rs`, `vnc_view.rs`.
 
-Key events: `session:data`, `session:state`, `session:closed`, `session:raw:data`, `session:github:repos`, `session:secret:prompt`/`session:secret:response`, `session:hostkey:verify`/`session:hostkey:response`.
-
-## WKWebView Constraints (Critical)
-
-The macOS webview silently blocks or breaks several standard web APIs. These constraints affect every frontend change:
-
-1. **No `window.confirm()`, `window.prompt()`, `window.alert()`** — they either return false/null silently or do nothing. All user prompts must use the custom modal system (DOM-based backdrop + modal with `is-visible` class toggling).
-
-2. **No ES modules** — `<script type="module">` fails silently. All JS files use plain `<script>` tags and IIFE wrappers: `(function() { ... })();`
-
-3. **Click swallowing on text-selectable elements** — WKWebView initiates a text selection gesture on `mousedown` for `<div>` elements, which swallows the first `click` event (appears to require double-click). Fix: add `mousedown` handler with `e.preventDefault()` on any clickable non-input element (section headers, list items, etc.).
-
-4. **Modal visibility pattern** — both `.modal-backdrop` AND `.modal` elements start with `opacity: 0; visibility: hidden` in CSS. You must add the `is-visible` class to **both** elements, not just the backdrop.
-
-5. **Wails runtime injection** — `window.go` and `window.runtime` are injected by Wails before scripts execute. Do NOT add explicit script tags for Wails scripts. The frontend polls for their availability at startup (max 5s).
+**Flow:** UI → `Service` / `Manager` method (plain Rust call) → protocol client on a worker thread → `Callbacks` → `Manager` emits `Event` → app channel → `App::on_event` on the next frame. Credential and host-key questions are `Event::SecretPrompt` / `Event::HostKeyVerify` carrying an `mpsc::Sender` reply; the connecting thread blocks on the receiver, and dropping the sender (closing the prompt or the session) cancels it.
 
 ## Conventions
 
-**Language:** All code comments in British English (colour, initialise, behaviour, etc.).
+- **British English** in comments, docs and UI strings (colour, initialise, behaviour, favourite).
+- **Never block the UI thread.** Anything that touches the network, the keychain, `ssh-keygen` or slow disk work runs on a worker thread: `Shared::spawn` (errors become toasts), `settings::Job` (poll a result each frame), or a module's own inbox. Call `ctx.request_repaint()` when the work finishes. Quick SQLite calls through `Service` are fine inline.
+- **Colours come from `Tokens`** (`theme.rs`, `Tokens::get(ctx)`): `text`, `text_dim`, `text_faint`, `accent`, `success`, `warning`, `danger`, `field`, `card`, `dock`, … Don't hard-code colours; all three app themes (Pro, Midnight, Light) must work. Protocol colours and badges come from `views::protocol_color` / `protocol_badge`; terminal palettes from `terminal_themes.rs`.
+- **Icons are Phosphor** (`egui_phosphor::regular as icon`), usually as `format!("{}  Label", icon::X)`. Reuse the helpers in `widgets.rs` (`primary`, `button`, `icon_button`, `hint`, `empty`, `chip`, `section`, `kv`) and `chrome::modal` for modal dialogs.
+- **Shortcut labels** go through `state::keys("Mod+Shift+K")`, which renders ⌘ on macOS and Ctrl elsewhere. A new shortcut needs an entry in `App::shortcuts()`, the command palette (`chrome::commands`), the menu, the Help "Keyboard Shortcuts" topic and the README table.
+- **Formatting:** `rustfmt.toml` sets `max_width = 160` with `use_small_heuristics = "Max"`, so long single-line expressions are normal. Run `cargo fmt --all` rather than wrapping by hand.
+- Errors are `nexus_core::Result<T>` (`Box<dyn Error + Send + Sync>`); use `?` and `format!` messages that read well in a toast.
+- Protocol configs are `Option<…Config>` fields on `Profile` (`ssh`, `telnet`, `raw`, `github`, `vnc`, `irc`, `serial`), stored as JSON columns; `Profile::new(protocol)` fills the defaults, and the structs use `#[serde(default)]` so older rows still load.
+- A `ponytail:` comment marks a deliberate simplification and names its limit; keep them accurate when you change that code.
 
-**Go patterns:**
-- String-typed enums: `type Protocol string` with `const ProtocolSSH Protocol = "ssh"` etc.
-- Protocol configs are pointer fields on `Profile` (`SSH *SSHConfig`, `Telnet *TelnetConfig`, etc.) — nil when not applicable
-- `NewProfile(protocol)` factory in `defaults.go` populates sensible defaults per protocol
-- Storage uses `nullableJSON()` helper to write nil for unused config columns
-- Tests use `t.TempDir()` for isolation, `t.Fatalf()` for setup failures
+**Adding a protocol** touches: `models.rs` (`Protocol`, config struct, defaults, labels), `validation.rs`, a new migration (CHECK constraint and config column) plus the column lists in `storage.rs`, a client in `clients/`, the `Manager` connect/close/write paths in `sessions.rs`, the profile editor section, Quick Connect if relevant, a view (or `TermView` for terminal protocols), `views::protocol_badge`/`protocol_color`, the palette, and a Help topic.
 
-**Frontend patterns:**
-- Every JS file is IIFE-wrapped and exports to `window.AlchementaryLink` namespace
-- Script load order matters (defined in `index.html`) — utils → state → notifications → sidebar → tabs → themes → terminal → profiles → raw → github → settings → commands → secrets → recordings → sftp → splitpane → snippets → app
-- DOM helpers: `createElement(tag, className, attrs)` from utils.js (supports `textContent`, `innerHTML`, `dataset`, `on*` event handlers)
-- Profile editor uses `_renderSection(title, fields)` pattern with `_field(type, name, label, value, opts)` helper for form generation
-- Login script editor uses `_renderLoginScriptSection(prefix, steps)` for expect-style step lists
-- TOTP section uses `_renderTOTPSection(profile)` with encrypted vault storage
-- `protocolColour()` returns CSS class names like `proto-ssh`; tab badges use `badge-ssh` class naming (different pattern)
+## Data compatibility (hard rules)
 
-**CSS patterns:**
-- Design tokens in `tokens.css`: `--bg-base`, `--bg-surface`, `--bg-elevated`, `--text-primary`, `--accent`, `--protocol-ssh`, etc.
-- Dark charcoal palette — not Material Design literally, but Material-inspired layering
-- Protocol colours: SSH=teal `#4ecdc4`, Telnet=amber `#ffa726`, RAW=purple `#ab47bc`, GitHub=indigo `#7c8aff`
+Existing users upgrade in place, and their data came from the Go app first. Nexus Terminal must keep reading it.
 
-**Adding a new protocol:**
-1. Add `Protocol` constant + config struct in `models/models.go`
-2. Add defaults in `models/defaults.go` `NewProfile()` switch
-3. Create client package in `internal/<proto>client/`
-4. Add `connect<Proto>()` in `sessions/manager.go` + case in `Connect()` switch
-5. Add API methods in `api/api.go` if needed
-6. Add DB migration in `storage/migrations/` (update CHECK constraint, add config column)
-7. Update `storage/store.go`: all SELECT/INSERT/UPDATE queries + both scan functions
-8. Frontend: add DEFAULTS in `profiles.js`, render sections, collect form values, protocol tab
-9. Frontend: add viewer in new JS file (IIFE-wrapped), include in `index.html`, wire in `app.js`
-10. Add CSS: protocol colour token, sidebar indicator, tab badge, viewer styles
+- **Never change the database, vault, export or recording formats incompatibly.** The vault (`vault/vault.json`: Argon2id t=3, m=128 MiB, 4 lanes; AES-256-GCM per secret), the export envelope (`[version][32-byte salt][12-byte nonce][ciphertext]`, `.nexus`; `.link` must still import) and asciicast v2 recordings are fixed.
+- **Fixtures** generated by the old Go app live in `rust/core/tests/fixtures/` (`link.db`, `vault/`, `profiles.link`, `recordings/`). Tests in `storage.rs`, `secrets.rs`, `exportimport.rs` and `recording.rs` read them. Don't regenerate or edit them to make a test pass.
+- **Schema changes are new SQL files** in `rust/core/migrations/` (`008_….sql`, …), added to `MIGRATIONS` in `storage.rs`. Each ends with `INSERT INTO schema_version (version, applied_at) VALUES (N, datetime('now'));`. Never edit an applied migration. SQLite has no `ALTER COLUMN`; use the recreate-table pattern.
+- **Keychain** entries are stored under the service `NexusTerminal`; reads fall back to `AlchementaryLink` and copy forward. Don't change key names (`profile:<id>:<kind>`).
+- **Data directory** names (`NexusTerminal`, `nexus.db`, `vault/`, `recordings/`) and the first-run migration from `AlchementaryLink/` in `config.rs` are user-facing; keep them stable.
 
-**Database migrations:**
-- Numbered SQL files: `001_initial.sql`, `002_github_protocol.sql`, etc.
-- Each must `INSERT INTO schema_version (version, applied_at) VALUES (N, datetime('now'))` at the end
-- SQLite has no `ALTER COLUMN` — use the recreate-table pattern (CREATE new → INSERT INTO new SELECT FROM old → DROP old → ALTER TABLE RENAME)
-- Every query in `store.go` that touches the profiles table must be updated when columns change (there are ~8 SELECT column lists + 2 scan functions)
+## Testing tips
+
+- **Never point a test or manual run at your real data.** Use `--data-dir DIR` (a temporary directory) for manual runs; tests create their own directory under `std::env::temp_dir()`, as the existing ones do.
+- **App flags** (`rust/app/src/main.rs`):
+  - `--data-dir DIR` — use another data directory.
+  - `--screenshot out.png` — render, save a PNG and exit (works under `xvfb-run`); combine with `--size WxH` and `--theme pro|midnight|light`.
+  - `--open WINDOW` — open a window at startup: `editor[:protocol|id]`, `quick`, `settings[:terminal|security|knownhosts|help|about]`, `keys`, `snippets`, `triggers`, `recordings`, `palette`, `export`, `import`.
+  - `--connect NAME` — connect a saved profile by display name or id.
+  - `--run-local CMD` — open a local terminal and type `CMD` into it once connected.
+
+  For example: `cargo run -- --data-dir /tmp/nx --open settings:help --screenshot /tmp/help.png`.
+- **SSH integration tests** (`core/tests/ssh_integration.rs`) start a throwaway `sshd` as the current user on a random port and skip themselves when OpenSSH isn't installed. They **must never open an interactive login shell** — the user's shell profile can auto-attach tmux/byobu to a real session. Set the profile's startup command to `/bin/sh -i`, as the existing `profile()` helper does.
+- `core/tests/sessions.rs` drives the `Manager` end to end against local TCP listeners; follow its `manager()` and `wait()` helpers for event-driven tests.
+- UI logic that can be tested without a window (parsers, fuzzy matching, split trees, snippet variables, trigger matching) has `#[cfg(test)]` unit tests next to it; add one with any non-trivial change.
diff --git a/README.md b/README.md
index 72c35d8..e4ad419 100644
--- a/README.md
+++ b/README.md
@@ -1,30 +1,36 @@
-# Alchementary Link
+# Nexus Terminal
 
-**A desktop client for SSH, Telnet, RAW TCP, VNC, GitHub, local terminals, and Leviathan binary analysis — with secure credential handling and a focused, multi-session workflow.**
+**A native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminals — with secure credential handling and a focused, multi-session workflow.**
 
-Alchementary Link helps you manage many connections at once, keep terminal work organised, and move files with confidence.
+Nexus Terminal helps you manage many connections at once, keep terminal work organised, and move files with confidence. It is a single Rust application with no webview, so it starts quickly and stays responsive under heavy terminal output.
 
 ## Highlights
 
-- SSH, Telnet, RAW TCP, VNC, GitHub, and local terminal sessions in one app
-- Tabbed sessions with split panes, pinning, and reordering
-- SFTP browser with drag-and-drop uploads and a directory picker
-- Leviathan binary workbench with hex editing, entropy, carving, BinSnoop, structure parsers, transforms, and spectrogram tools
-- Disconnected overlay with one-click reconnect
-- Broadcast input, snippets, and terminal search
-- Session recording and playback
-- Secure credential storage with OS keychain and encrypted vault fallback
+- SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminal sessions in one app
+- Tabbed sessions with split panes, pinning and drag-to-reorder
+- SFTP browser with drag-and-drop uploads and a permission-aware directory picker
+- SSH jump hosts, SOCKS5/HTTP proxies, local and remote port forwards, agent forwarding and TOTP auto-fill
+- Serial consoles with full line settings (baud, data bits, parity, stop bits, flow control)
+- Native VNC viewer, optionally tunnelled over SSH
+- Disconnected overlay with one-click reconnect, and auto-reconnect with backoff
+- Broadcast input, snippets, trigger rules and terminal search
+- Session recording (asciicast v2) and playback
+- Secure credential storage with the OS keychain first and an encrypted vault fallback
 
 ## Quick start
 
-1. Launch Alchementary Link.
-2. Click **New** in the sidebar and create a connection profile.
-3. Click **Connect** to open a session in a new tab.
+1. Launch Nexus Terminal.
+2. Click **+** at the bottom of the sidebar (or press **Cmd+N** / **Ctrl+N**) and create a connection profile.
+3. Click **Create & Connect** to save it and open a session in a new tab. Afterwards, click the profile in the sidebar to connect.
 
-Prefer a one-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** to quick connect.
+Prefer a one-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** to quick connect, or click **Local Machine** in the sidebar for a local shell.
 
 If a session drops, use the **Reconnect** button in the disconnected overlay.
 
+### Coming from Alchementary Link?
+
+On first run, Nexus Terminal copies your Alchementary Link profiles, encrypted vault and recordings into its own data directory, and picks up credentials saved in the OS keychain. The old data is left untouched. Older `.link` export files can still be imported.
+
 ## Documentation
 
 - Product overview: [docs/overview.md](docs/overview.md)
@@ -36,20 +42,31 @@ If a session drops, use the **Reconnect** button in the disconnected overlay.
 
 All shortcuts use **Cmd** on macOS and **Ctrl** on Windows/Linux.
 
-| macOS Shortcut    | Windows/Linux Shortcut | Action                      |
-| ----------------- | ---------------------- | --------------------------- |
-| Cmd + K           | Ctrl + K               | Open command palette        |
-| Cmd + N           | Ctrl + N               | New connection              |
-| Cmd + W           | Ctrl + W               | Close current tab           |
-| Cmd + Tab         | Ctrl + Tab             | Next tab                    |
-| Cmd + Shift + Tab | Ctrl + Shift + Tab     | Previous tab                |
-| Cmd + 1–9         | Ctrl + 1–9             | Switch to tab by number     |
-| Cmd + ,           | Ctrl + ,               | Open settings               |
-| Cmd + F           | Ctrl + F               | Find in terminal            |
-| Cmd + Shift + D   | Ctrl + Shift + D       | Split pane vertically       |
-| Cmd + Shift + E   | Ctrl + Shift + E       | Split pane horizontally     |
-| Cmd + Shift + R   | Ctrl + Shift + R       | Toggle session recording    |
-| Cmd + Shift + B   | Ctrl + Shift + B       | Toggle broadcast input mode |
-| Cmd + Shift + S   | Ctrl + Shift + S       | Open snippet library        |
-| Cmd + Shift + Q   | Ctrl + Shift + Q       | Quick connect               |
-| F11               | F11                    | Toggle fullscreen           |
+| macOS Shortcut    | Windows/Linux Shortcut | Action                           |
+| ----------------- | ---------------------- | -------------------------------- |
+| Cmd + K           | Ctrl + K               | Open command palette             |
+| Cmd + N           | Ctrl + N               | New connection                   |
+| Cmd + W           | Ctrl + W               | Close current tab                |
+| Cmd + Tab         | Ctrl + Tab             | Next tab                         |
+| Cmd + Shift + Tab | Ctrl + Shift + Tab     | Previous tab                     |
+| Cmd + 1–9         | Ctrl + 1–9             | Switch to tab by number          |
+| Cmd + ,           | Ctrl + ,               | Open settings                    |
+| Cmd + F           | Ctrl + F               | Find in terminal                 |
+| Cmd + Shift + D   | Ctrl + Shift + D       | Split pane right (side by side)  |
+| Cmd + Shift + E   | Ctrl + Shift + E       | Split pane down (top and bottom) |
+| Cmd + Shift + R   | Ctrl + Shift + R       | Toggle session recording         |
+| Cmd + Shift + B   | Ctrl + Shift + B       | Toggle broadcast input mode      |
+| Cmd + Shift + S   | Ctrl + Shift + S       | Open snippet library             |
+| Cmd + Shift + Q   | Ctrl + Shift + Q       | Quick connect                    |
+| F11               | F11                    | Toggle fullscreen                |
+
+## Building from source
+
+Nexus Terminal is a Rust workspace in `rust/`. With [rustup](https://rustup.rs) installed:
+
+```bash
+cd rust
+cargo run --release
+```
+
+See [docs/build-and-release.md](docs/build-and-release.md) for platform prerequisites, tests and release packaging.
diff --git a/docs/overview.md b/docs/overview.md
index 51e55de..ac5c7cc 100644
--- a/docs/overview.md
+++ b/docs/overview.md
@@ -1,19 +1,21 @@
-# Alchementary Link Overview
+# Nexus Terminal Overview
 
-Alchementary Link is a desktop connection and analysis workspace for people who manage servers, network services, remote desktops, repositories, and binary artefacts every day. It brings SSH, Telnet, RAW TCP, VNC, GitHub, local shell, and Leviathan binary-analysis workflows into one focused app with secure credential handling, multi-session organisation, file transfer, automation, recording, and inspection tooling built in.
+Nexus Terminal is a native desktop connection workspace for people who manage servers, network services, serial devices, remote desktops, chat networks and repositories every day. It brings SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shell sessions into one focused app with secure credential handling, multi-session organisation, file transfer, automation and recording built in.
+
+It is a single Rust application drawn with egui: there is no webview, no bundled browser engine and no runtime to install. Terminal output goes straight from the network into the terminal emulator, so large outputs stay responsive.
 
 ## Product positioning
 
-Link is more than an SSH client. It is a single command centre for remote access, terminal operations, file movement, raw socket inspection, GitHub repository visibility, binary triage, and repeatable operational workflows.
+Nexus Terminal is more than an SSH client. It is a single command centre for remote access, terminal operations, file movement, raw socket inspection, serial consoles, IRC, GitHub repository visibility and repeatable operational workflows.
 
-Use Link when you need to:
+Use Nexus Terminal when you need to:
 
 - Connect quickly to many systems without re-entering credentials.
-- Keep multiple live sessions organised with tabs, pinned tabs, split panes, and status indicators.
+- Keep multiple live sessions organised with tabs, pinned tabs, split panes and status indicators.
 - Move files over SSH without leaving the terminal workspace.
-- Work safely with host key verification, encrypted secrets, TOTP support, and audit logging.
-- Reuse commands, automate login flows, record sessions, and react to terminal output.
-- Support mixed estates that include SSH servers, Telnet devices, raw TCP services, VNC desktops, GitHub repositories, local shells, firmware images, binaries, archives, and other artefacts.
+- Work safely with host key verification, encrypted secrets, TOTP support and audit logging.
+- Reuse commands, automate login flows, record sessions and react to terminal output.
+- Support mixed estates that include SSH servers, Telnet devices, raw TCP services, serial consoles, VNC desktops, IRC networks, GitHub repositories and local shells.
 
 ## Main feature groups
 
@@ -21,287 +23,238 @@ Use Link when you need to:
 
 - **SSH** for secure remote terminal access.
 - **Telnet** for legacy devices and services.
-- **RAW TCP** for direct socket interaction, protocol testing, and device troubleshooting.
-- **VNC** for remote desktop access.
+- **RAW TCP** for direct socket interaction, protocol testing and device troubleshooting.
+- **Serial** for USB-serial adapters, console cables, development boards and network gear.
+- **VNC** for remote desktop access, with a native viewer.
+- **IRC** for chat networks, with rooms, users and an optional SSH tunnel.
 - **GitHub** for repository browsing and download workflows.
 - **Local terminal** for opening a shell on the local machine.
-- **Leviathan** for binary inspection, editing, carving, transforms, and spectrogram workflows.
-- **Quick connect** for one-off sessions without saving a profile.
+- **Quick connect** for one-off SSH, Telnet, RAW, IRC or Serial sessions without saving a profile.
 - **Saved profiles** for repeat connections.
 
 ### Profile management
 
-- Create, edit, duplicate, and delete connection profiles.
-- Store display names, descriptions, notes, groups, tags, environment labels, and favourites.
-- Search profiles by name, host, or tag.
-- Filter profiles by protocol, group, tag, and favourite status.
+- Create, edit, duplicate and delete connection profiles.
+- Store display names, descriptions, notes, groups, tags and favourites.
+- Fuzzy search across name, host, tags and protocol.
+- Sidebar sections for Local Machine, Favourites, Recent (last five), groups and Ungrouped.
+- Multi-select profiles with Ctrl/Cmd-click for bulk connect, disconnect, tagging, moving between groups and deleting.
 - Test basic host and port reachability before connecting.
-- Import existing OpenSSH config entries from `~/.ssh/config`, including hostnames, usernames, ports, identity files, and jump hosts.
-- Export and import profiles using encrypted `.link` bundles.
-- Choose import behaviour for duplicates: skip, overwrite, or duplicate.
+- Import existing OpenSSH config entries from `~/.ssh/config`, including hostnames, usernames, ports, identity files and jump hosts.
+- Export and import profiles using encrypted `.nexus` bundles; older `.link` bundles from Alchementary Link import too.
+- Plain JSON export and import, with secrets redacted unless you choose to include them.
+- Choose import behaviour for duplicates: skip, overwrite or duplicate.
 
 ### Multi-session workspace
 
-- Tabbed sessions with connection state indicators.
-- Pin tabs to keep important systems visible.
-- Rename sessions.
-- Reorder tabs.
-- Scroll overflowing tabs and hover them to see full names and connection start times.
-- Close one session or all sessions.
-- Split panes vertically or horizontally.
-- Resize split panes.
+- Custom title bar with File, Session, View and Help menus, a command palette launcher and a light/dark toggle.
+- Tabbed sessions with protocol badges, connection state dots and activity markers.
+- Pin tabs to keep important systems at the front.
+- Rename, duplicate, reconnect and reorder tabs (drag, or Move Left/Right).
+- Scroll overflowing tabs and hover them to see the host, state and connection start time.
+- Split the active tab right or down, as many times as you like, with draggable dividers.
 - Switch tabs by keyboard shortcut.
-- Broadcast input to multiple connected sessions.
-- Show disconnected overlays with a one-click reconnect action.
-- Auto-reconnect support for SSH, Telnet, and RAW TCP profiles.
-- Command palette for fast access to connections, settings, terminal actions, security tools, import/export, snippets, triggers, and local terminal.
+- Broadcast input to all connected terminal sessions, or to a chosen set.
+- Disconnected and error overlays with one-click reconnect.
+- Auto-reconnect with exponential backoff for SSH, Telnet, RAW TCP, Serial and IRC profiles.
+- Guided error dialogs for authentication and host-key failures, with shortcuts to edit the profile or open Known Hosts.
+- Command palette for connections, tabs, new profiles, settings, import/export, themes, the secret store, SSH keys, snippets, triggers, recordings and terminal actions.
+- Status bar with session state, protocol, recording indicator, SSH latency, broadcast state, vault state, session count and update notices.
 
 ### Terminal experience
 
-- xterm.js-powered terminal rendering.
-- Configurable terminal font family, font size, scrollback, cursor style, and colour theme.
-- Search within terminal output.
-- Search options for case sensitivity, regular expressions, and whole-word matching.
-- Copy, paste, select all, clear, and reset from the terminal context menu.
-- Clipboard-aware paste behaviour.
-- Clickable web links where supported.
-- Alternate-screen scroll handling for tools such as `tmux`, `screen`, and `byobu`.
-- Export terminal scrollback as plain text.
-- Send break signals where supported.
-- Ping active sessions to check responsiveness.
+- Native terminal emulation (alacritty_terminal) with full colour, mouse reporting, bracketed paste and IME input.
+- Eleven terminal colour schemes, applied to every open terminal at once.
+- Configurable font family, font size, scrollback and cursor style, per profile or as defaults.
+- Find in terminal output, with case-sensitive and regular-expression options and a match counter.
+- Copy with Ctrl/Cmd+C when text is selected (otherwise it sends an interrupt), paste with Ctrl/Cmd+V.
+- Double-click selects a word, triple-click selects a line, Shift-click extends a selection.
+- Ctrl/Cmd-click a web link to open it in your browser.
+- Shift+PageUp/PageDown/Home/End and the mouse wheel scroll the scrollback; on the alternate screen the wheel sends arrow keys, so `tmux`, `screen` and `byobu` scroll naturally.
+- Context menu with Copy, Paste, Select All, Find, Send Snippet, Port Forwards, Split Right, Split Down, Export Output, Clear and Reset.
+- Export the whole scrollback as plain text.
+- Status-bar latency for the active SSH session.
 
 ### SSH capabilities
 
-- Password authentication.
-- Public key authentication.
-- Keyboard-interactive authentication.
-- SSH agent authentication.
+- Password, public key, keyboard-interactive and SSH agent authentication.
 - SSH agent forwarding.
-- Private key path discovery from `~/.ssh`.
-- SSH key manager for listing, generating, copying, and deleting key pairs.
-- Ed25519, RSA, and ECDSA key generation.
-- Optional private key passphrase handling.
-- TOTP / 2FA secret storage and code generation for keyboard-interactive login flows.
-- Host key verification policies per profile: Strict, Ask, Accept new, and Insecure.
+- Private key suggestions from `~/.ssh`, with a key file check.
+- SSH key manager for listing, generating, copying and deleting key pairs (Ed25519, RSA 2048/4096 and ECDSA, optional passphrase).
+- TOTP / 2FA secret storage and automatic code entry for keyboard-interactive logins.
+- Host key verification policies per profile: Strict, Ask, Accept new and Insecure.
 - Known hosts storage and management.
-- Jump host support for bastion and multi-hop access.
-- SOCKS5 proxy support.
-- HTTP CONNECT proxy support.
-- Local and remote port forwarding.
-- Runtime port forward management for active SSH sessions.
-- Startup commands.
-- Custom environment variables.
-- Terminal type configuration.
-- Keepalive interval and missed-keepalive settings.
-- Compression option.
+- Jump hosts for bastion and multi-hop access.
+- SOCKS5 and HTTP CONNECT proxies.
+- Local and remote port forwarding, started on connect or managed at runtime.
+- Startup commands, custom environment variables and terminal type.
+- Keepalive interval and missed-keepalive settings, and compression.
 - Expect-style login scripts with wait and send steps.
 - Built-in SFTP browser for file transfer.
 
 ### SFTP file browser
 
-- Open a side panel for SSH file browsing.
-- Navigate remote folders with breadcrumbs.
-- Go directly to a remote path.
-- Bookmark remote locations.
-- Refresh remote listings.
-- Create folders.
-- Upload files.
-- Download single files or multiple selected files.
-- Rename files and folders.
-- Delete files and folders.
-- Multi-select support for batch actions.
-- Resizable SFTP panel alongside the terminal.
-- Drag and drop files into an SSH terminal.
-- Choose whether dropped files are uploaded or pasted into the terminal as text.
-- Upload directory picker with folder filtering, breadcrumbs, keyboard navigation, and permission badges.
-- Permission labels for read-only and inaccessible folders.
+- Opens in a resizable dock beside the terminal.
+- Navigate remote folders with breadcrumbs, or go directly to a path.
+- Bookmark remote locations (kept per profile).
+- Refresh listings and create folders.
+- Upload files, and download single or multiple selected files.
+- Rename and delete files and folders.
+- Multi-select for batch actions.
+- Transfer queue with progress.
+- Drag and drop files onto an SSH terminal, then upload them or paste their contents.
+- Upload directory picker with folder filtering, breadcrumbs, keyboard navigation and READ ONLY / NO READ badges.
 
 ### Telnet capabilities
 
-- Telnet option negotiation.
-- Terminal type negotiation.
-- NAWS window-size updates.
-- Local echo option.
-- Line mode option.
-- Configurable line endings: LF, CR, CRLF, or none.
-- Configurable encoding: UTF-8, ASCII, and ISO 8859-1.
+- Telnet option negotiation, including echo, terminal type and NAWS window-size updates.
+- Local echo and line mode options.
+- Configurable line endings: LF, CR, CRLF or none.
+- Configurable encoding: UTF-8, ASCII and ISO 8859-1.
 - Negotiation debug mode.
 - Expect-style login scripts.
-- Auto-reconnect with configurable retry count.
-- Break signal support.
+- Auto-reconnect with a configurable retry count.
 
 ### RAW TCP capabilities
 
 - Direct TCP socket sessions.
-- Text, hex, and split data views.
-- Send data as text, hex, or escaped bytes.
-- Quick insert controls for common bytes such as NUL, CR, LF, ETX, and EOT.
+- Text, hex and split data views.
+- Send data as text, hex or escaped bytes.
+- Quick insert buttons for NUL, CR, LF, ETX and EOT.
 - Payload presets for reusable test messages.
-- Optional timestamps.
-- Optional send/receive direction labels.
-- Pause and resume display updates.
-- Clear the capture buffer.
-- Save RAW session captures.
+- Optional timestamps and send/receive direction labels.
+- Pause and resume display updates, and clear the capture buffer.
+- Save RAW session captures as JSON.
 - Configurable encoding and line endings.
 - Connect and read timeouts.
 - Auto-reconnect option.
 
+### Serial capabilities
+
+- Pick a device from the detected port list, or type a path such as `/dev/ttyUSB0`, `/dev/cu.usbserial-…` or `COM3`.
+- Baud rate from common presets or any custom value, 5–8 data bits, none/odd/even parity, 1 or 2 stop bits.
+- Flow control: none, XON/XOFF (software) or RTS/CTS (hardware).
+- Line ending, encoding and local echo.
+- Assert DTR and RTS on connect (both on by default).
+- Auto-reconnect: unplugging the adapter disconnects the session, and the port is reopened when it comes back.
+- Clear hints for permission-denied and busy ports.
+- Works with everything a terminal session supports: recording, triggers, broadcast, snippets, find and split panes.
+
 ### VNC capabilities
 
-- VNC remote desktop sessions.
-- noVNC-based viewer inside the Link workspace.
+- Native VNC viewer inside the Nexus Terminal workspace (RFB 3.3–3.8; Raw, CopyRect, Hextile, ZRLE and Tight encodings).
 - Password prompt and password storage modes.
 - View-only mode.
-- Scale-to-fit display.
-- Shared-session option.
-- Quality setting.
-- SSH tunnel option for VNC traffic.
-- SSH tunnel authentication by password, public key, or SSH agent.
+- Scale-to-fit or 1:1 display, switchable from the toolbar.
+- Shared-session option and a quality setting.
+- Send the local clipboard to the remote desktop, send Ctrl+Alt+Del, and request a full refresh.
+- SSH tunnel option for VNC traffic, with password, public key or SSH agent authentication.
+- A warning before connecting without a tunnel, because classic VNC traffic is not encrypted.
+
+### IRC capabilities
+
+- Nick, real name, TLS and an optional server password.
+- NickServ identification on connect.
+- Auto-join rooms.
+- A Server tab plus one tab per room or private conversation, with unread markers.
+- Slash commands such as `/join`, `/part`, `/msg`, `/me`, `/nick`, `/topic`, `/list`, `/names`, `/whois` and `/raw`.
+- Tab nick completion, and click a nick to mention it.
+- Room browser with a filter, and a users list for the current room.
+- mIRC colour and formatting codes rendered in the conversation.
+- Optional SSH tunnel and auto-reconnect.
 
 ### GitHub capabilities
 
 - GitHub profile type using a personal access token.
 - GitHub.com and GitHub Enterprise API base URL support.
 - Repository viewer grouped by owner or organisation.
-- Repository filtering by name, description, or language.
+- Repository filtering.
 - Repositories sorted by latest commit activity.
-- Shows repository metadata such as language, stars, private/fork/archived state, latest committer, and latest commit time.
-- Manual refresh.
-- Configurable refresh interval.
+- Repository metadata such as language, stars, private/fork/archived state, latest committer and latest commit time.
+- Manual refresh and a configurable refresh interval.
 - Open repositories in the browser.
 - Download repository ZIP archives.
 
-### Leviathan binary workbench
-
-- Switch from **Alchementary Link** to **Leviathan** from the sidebar header.
-- Load a local file into a working document, inspect it with multiple tools, then save the patched working copy.
-- Tools open as normal tabs beside connection sessions.
-- Leviathan tabs close immediately without connection-disconnect confirmation.
-- Shared undo, redo, and revert actions for byte-level edits.
-- File-backed document model for large local files, with chunked save/export where supported.
-- Clear limits for tools that require bounded in-memory buffers, such as image/audio spectrogram conversion and some parsers.
-
-### Leviathan editor and triage tools
-
-- **Hex Editor** with editable byte cells, live ASCII preview, 16-byte and 32-byte rows, byte search, string/hex search, previous/next match navigation, and range opening from analysis views.
-- **Overview** for first-pass summary across hashes, entropy, strings, indicators, and carve candidates.
-- **Hashes** for CRC32, MD5, SHA-1, SHA-256, and SHA-512.
-- **Entropy** graph over the whole file, with selectable ranges that can open a new hex editor tab.
-- **Strings** extraction for ASCII and UTF-16 text.
-- **IOCs** for URLs, domains, paths, hashes, and other indicators.
-- **Search** and **Multi-search** for text, hex, and regular-expression matching.
-- Exportable results from tools that find files, ranges, or structured artefacts.
-
-### Leviathan structure, recovery, and transform tools
-
-- **Structures** parser for common binary formats such as PE, ELF, Mach-O, ZIP, images, RIFF, ASN.1, and certificates.
-- **Disasm** heuristic disassembly for common CPU families, with raw byte fallback for unsupported architectures.
-- **PDF** object, stream, xref, and suspicious-surface inspection.
-- **SquashFS** superblock and filesystem metadata inspection with human-readable bad-magic errors.
-- **Carve**, **Keys**, **Timestamps**, **Stego**, and **Metadata** tools for embedded artefacts and recovery workflows.
-- **BinSnoop** deep signature scanning across the whole file, with export for discovered files and ranges.
-- **Rules** for YARA-like rule scans.
-- **Patch Plan** and **Patch Apply** for validating and applying patch scripts.
-- **Transforms** for hex, Base64, URL, XOR, inflate, and cipher pipelines.
-- **Case Export** for bundling useful artefacts from a working investigation.
-
-### Leviathan spectrogram tools
-
-- Convert an image into WAV audio so the image appears in a spectrogram.
-- Insert an encoded image into an existing WAV or MP3 carrier.
-- Visualise WAV or MP3 audio as a spectrogram image.
-- Control FFT size, height, maximum width, aspect ratio, frequency range, brightness, and contrast.
-
 ### Automation and reusable workflows
 
-- Snippet library for saved commands.
-- Snippet folders, descriptions, and tags.
-- Send snippets to active sessions.
-- Snippet variables before sending commands.
+- Snippet library for saved commands, with names, descriptions and folders.
+- Send snippets to the active session.
+- Built-in snippet variables (`{{hostname}}`, `{{date}}`, `{{time}}`, `{{timestamp}}`) and prompted custom variables.
 - Broadcast input mode for running the same command across connected sessions.
-- Trigger rules that watch terminal output.
-- Trigger matching by text or regular expression.
-- Trigger actions for notifications, tab highlighting, sound, or combined notify/highlight behaviour.
+- Trigger rules that watch terminal output, matching plain text or regular expressions.
+- Trigger actions for notifications, tab highlighting, both, or a sound (attention request).
 - Expect-style login scripts for SSH and Telnet.
 - Startup commands for SSH sessions.
 
 ### Session recording
 
 - Start and stop terminal recording per session.
-- Recording indicator on active tabs.
-- Recordings saved in asciicast v2-compatible format.
-- Recording browser for listing saved recordings.
-- Playback controls.
+- Recording indicator on the tab and in the status bar.
+- Recordings saved in asciicast v2 format.
+- Recording browser with storage usage and clean-up by age or total size.
+- Playback with play/pause, restart, a seek bar and speed control.
 - Delete saved recordings.
-- Recording metadata includes title, dimensions, duration, size, creation time, and file path.
 
 ### Security and credential handling
 
-- OS keychain first where available, including macOS Keychain, Linux Secret Service, and Windows Credential Manager.
-- Encrypted vault fallback.
-- Vault encryption with AES-256-GCM and Argon2id-derived keys.
-- Secret store lock and unlock workflow.
-- Per-profile secret modes: Saved, Session only, and Ask every time.
+- OS keychain first where available: macOS Keychain, Linux Secret Service and Windows Credential Manager.
+- Encrypted vault fallback, using AES-256-GCM with an Argon2id-derived key.
+- Secret store lock and unlock workflow, with a master-password strength meter.
+- Per-credential secret modes: Save securely, Remember for this session, and Ask every time.
 - Encrypted storage for TOTP secrets.
 - Known host verification and known host management.
-- Audit log for security-relevant operations.
-- Audit entries for connections, disconnections, profile changes, secret access, imports, and exports.
-- Secrets are not written into audit entries.
+- Audit log of connections, disconnections, profile changes, credential access, imports and exports. Secrets are never written to it.
 - Encrypted profile exports with password-based AES-256-GCM encryption and Argon2id key derivation.
-- Plain profile export can redact inline secrets.
 
 ### Settings and maintenance
 
-- Application theme setting.
-- Terminal theme selection.
+- App theme (Pro, Midnight or Light) and terminal colour scheme.
 - Default protocol preference.
-- Default terminal font, size, scrollback, and cursor settings.
+- Default terminal font, size, scrollback and cursor settings.
 - Confirm-on-close and confirm-on-disconnect preferences.
-- Status bar visibility setting.
-- Sidebar width preference.
-- Native paste preference.
+- Status bar visibility and sidebar width.
 - Local shell selection.
 - Secret store settings.
 - Known hosts management.
-- Help and troubleshooting content inside settings.
-- Background and manual update checks.
-- Update checks report availability, current version, latest version, release notes, release URL, and publish date.
+- Help topics and troubleshooting inside Settings.
+- A background update check at launch, and a manual check in Settings → About.
 
 ## Website-ready summary
 
 ### Suggested headline
 
-Alchementary Link: one desktop workspace for SSH, files, sockets, remote desktops, repositories, and binary artefacts.
+Nexus Terminal: one native desktop workspace for SSH, files, sockets, serial consoles, remote desktops, chat and repositories.
 
 ### Suggested subheadline
 
-Manage SSH, Telnet, RAW TCP, VNC, GitHub, local shell, and Leviathan binary-analysis sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings, automation, and artefact-inspection tools built in.
+Manage SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shell sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings and automation built in.
 
 ### Short product description
 
-Alchementary Link helps developers, operators, support engineers, reverse engineers, firmware analysts, and homelab users manage many connections and artefacts without juggling separate tools. Save profiles, organise them with groups and tags, connect in tabs or split panes, move files over SFTP, inspect raw TCP traffic, open VNC desktops, browse GitHub repositories, triage binaries with Leviathan, and keep credentials protected with keychain and encrypted-vault storage.
+Nexus Terminal helps developers, operators, support engineers, network and hardware engineers, and homelab users manage many connections without juggling separate tools. Save profiles, organise them with groups and tags, connect in tabs or split panes, move files over SFTP, inspect raw TCP traffic, talk to serial devices, open VNC desktops, join IRC networks, browse GitHub repositories, and keep credentials protected with keychain and encrypted-vault storage.
 
 ### Product page feature bullets
 
-- All-in-one connection and analysis workspace for SSH, Telnet, RAW TCP, VNC, GitHub, local shells, and Leviathan tools.
-- Fast multi-session interface with tabs, pinned sessions, split panes, reconnect, and broadcast input.
-- Rich SSH support including agent auth, TOTP, jump hosts, proxies, port forwarding, startup commands, login scripts, and host key policies.
-- Built-in SFTP browser with upload, download, rename, delete, folders, bookmarks, drag-and-drop upload, and permission-aware directory picking.
-- RAW TCP tooling with text, hex, split views, payload presets, captures, timestamps, and byte-level sending.
-- VNC viewer with scale-to-fit, view-only mode, quality controls, shared sessions, and optional SSH tunnelling.
-- GitHub repository browser with organisation grouping, filtering, activity sorting, metadata, ZIP downloads, and GitHub Enterprise support.
-- Leviathan binary workbench with hex editing, hashes, entropy, strings, IOCs, carving, BinSnoop, structures, PDF/SquashFS inspection, transforms, rules, patching, case export, and spectrogram image/audio tools.
-- Secure credential model using OS keychain first, encrypted vault fallback, per-profile secret modes, known hosts, encrypted exports, and audit logging.
-- Productivity tools including command palette, snippets, trigger rules, session recording, terminal search, scrollback export, and local terminal.
+- All-in-one connection workspace for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shells.
+- Native and fast: no webview, with a terminal that stays responsive under heavy output.
+- Multi-session interface with tabs, pinned sessions, split panes, reconnect and broadcast input.
+- Rich SSH support including agent auth and forwarding, TOTP, jump hosts, proxies, port forwarding, startup commands, login scripts and host key policies.
+- Built-in SFTP browser with upload, download, rename, delete, folders, bookmarks, drag-and-drop upload and permission-aware directory picking.
+- RAW TCP tooling with text, hex and split views, payload presets, captures, timestamps and byte-level sending.
+- Serial consoles with full line settings, flow control, DTR/RTS control and auto-reconnect on replug.
+- Native VNC viewer with scale-to-fit, view-only mode, quality controls, shared sessions and optional SSH tunnelling.
+- IRC client with rooms, nick completion, NickServ and mIRC formatting.
+- GitHub repository browser with organisation grouping, filtering, activity sorting, ZIP downloads and GitHub Enterprise support.
+- Secure credential model using the OS keychain first, encrypted vault fallback, per-credential secret modes, known hosts, encrypted exports and audit logging.
+- Productivity tools including command palette, snippets, trigger rules, session recording, terminal search, scrollback export and local terminal.
 
 ## Who it is for
 
-- Developers who connect to many application servers, staging environments, and production hosts.
+- Developers who connect to many application servers, staging environments and production hosts.
 - Platform and DevOps teams who need organised, secure access across infrastructure.
-- Support teams who troubleshoot customer systems, network appliances, and legacy Telnet devices.
-- Network and hardware engineers who need RAW TCP and Telnet tools beside normal SSH workflows.
-- Homelab users who want SSH, VNC, file transfer, and repo access in one desktop app.
-- Reverse engineers, firmware analysts, and security researchers who want binary triage beside their live operational sessions.
+- Support teams who troubleshoot customer systems, network appliances and legacy Telnet devices.
+- Network and hardware engineers who need RAW TCP, Telnet and serial tools beside normal SSH workflows.
+- Homelab users who want SSH, VNC, file transfer, serial consoles and repo access in one desktop app.
 
 ## Learn more
 
diff --git a/docs/quick-start.md b/docs/quick-start.md
index 0a366ea..e1a62a4 100644
--- a/docs/quick-start.md
+++ b/docs/quick-start.md
@@ -1,42 +1,46 @@
-# Alchementary Link Quick Start
+# Nexus Terminal Quick Start
 
-Alchementary Link is a desktop client for SSH, Telnet, RAW TCP, VNC, GitHub, local terminal sessions, and Leviathan binary analysis. This page is a shareable quick start for everyday use.
+Nexus Terminal is a native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminal sessions. This page is a shareable quick start for everyday use.
 
 ## Get connected in minutes
 
-1. Open Alchementary Link.
-2. Click **New** in the sidebar.
-3. Choose a protocol and enter the connection details.
-4. Click **Connect** to open the session in a new tab.
+1. Open Nexus Terminal.
+2. Click **+** at the bottom of the sidebar, or press **Cmd+N** (macOS) / **Ctrl+N** (Windows/Linux).
+3. Choose a protocol at the top of the editor and enter the connection details.
+4. Click **Create & Connect** to save the profile and open the session in a new tab.
 
-One-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** for quick connect.
+Next time, just click the profile in the sidebar.
+
+One-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** for quick connect. Need a local shell? Click **Local Machine** at the top of the sidebar.
 
 ## Daily workflow
 
-- **Tabs and splits**: Drag tabs to reorder, and split the workspace to view multiple sessions at once.
-- **Scrollable tabs**: Use the tab bar scrollbar or mouse wheel/trackpad over the tab strip when many tabs are open. Hover a tab to see its full name and connection start time.
-- **Broadcast input**: Toggle with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux) to send the same command to all connected sessions.
-- **Snippets**: Save common commands and run them with one click.
-- **Search**: Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search within the active terminal.
+- **Command palette**: Press **Cmd+K** / **Ctrl+K** to connect, switch tabs or run any command by typing a few letters.
+- **Tabs and splits**: Drag tabs to reorder them, right-click a tab to pin, rename, duplicate or reconnect it, and split the workspace with **Cmd+Shift+D** / **Ctrl+Shift+D** (right) or **Cmd+Shift+E** / **Ctrl+Shift+E** (down).
+- **Scrollable tabs**: Use the mouse wheel or trackpad over the tab strip when many tabs are open. Hover a tab to see its host, state and connection start time.
+- **Broadcast input**: Toggle with **Cmd+Shift+B** / **Ctrl+Shift+B** to send the same keystrokes to every connected terminal. Right-click the broadcast button on the tab strip to pick targets.
+- **Snippets**: Save common commands with **Cmd+Shift+S** / **Ctrl+Shift+S** and send them with one click.
+- **Search**: Press **Cmd+F** / **Ctrl+F** to search within the active terminal.
+- **Copy, paste and links**: Select text and press **Cmd+C** / **Ctrl+C** to copy (with nothing selected, Ctrl+C interrupts as usual). **Cmd+V** / **Ctrl+V** pastes. **Cmd-click** / **Ctrl-click** a URL to open it.
 - **Reconnect quickly**: If a session drops, click **Reconnect** on the disconnected overlay.
 
+## Serial consoles
+
+Create a **Serial** profile, pick the device from the list (click refresh after plugging in an adapter) and set the baud rate and line settings to match the device — 115200 8N1 with no flow control is the default. On Linux your user needs to be in the `dialout` (or `uucp`) group; on macOS use the `/dev/cu.*` device.
+
 ## VNC remote desktops
 
-Create a **VNC** profile for remote desktop sessions. Use SSH tunnelling when possible, especially outside trusted networks. Direct VNC is available for isolated or trusted networks, but classic VNC traffic may not be encrypted.
-
-## Leviathan binary tools
-
-Click **Leviathan** beside **Alchementary Link** in the sidebar header to switch from connection profiles to binary-analysis tools. Use **Load** to choose a file, then open tools such as Hex Editor, Overview, Hashes, Entropy, Strings, Carve, BinSnoop, Structures, PDF, SquashFS, Transforms, and Spectrogram tools. Tools open in normal tabs and can be closed without a disconnect confirmation.
+Create a **VNC** profile for remote desktop sessions. Use the SSH tunnel option when possible, especially outside trusted networks. Direct VNC is available for isolated or trusted networks, but classic VNC traffic is not encrypted, so Nexus Terminal asks before connecting without a tunnel.
 
 ## File transfers on SSH
 
-Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename, and delete files.
+Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename and delete files, create folders and bookmark locations.
 
 ### Drag and drop files
 
-Drop file(s) into the terminal and choose to:
+Drop file(s) onto a terminal and choose to:
 
-- **Upload** to a selected remote folder, or
+- **Upload to current directory** — pick a remote folder (SSH sessions only), or
 - **Paste contents** into the terminal as if typed.
 
 The upload picker lists folders only and marks permissions:
@@ -47,9 +51,14 @@ The upload picker lists folders only and marks permissions:
 ## Security basics
 
 - Credentials are stored in the OS keychain where available.
-- An encrypted vault is used as a fallback.
+- An encrypted vault (AES-256-GCM, Argon2id) is used as a fallback; set it up in **Settings → Security**.
+- Each password, passphrase or token can be saved, remembered for the session only, or asked for every time.
 - SSH host key checks can be set per profile (Strict, Ask, Accept new, Insecure).
 
+## Coming from Alchementary Link
+
+Your profiles, vault and recordings are copied across automatically on first run, and keychain entries are picked up the first time they are needed. Your old Alchementary Link data is left untouched.
+
 ## Common shortcuts
 
 | macOS Shortcut  | Windows/Linux Shortcut | Action                   |
@@ -62,8 +71,8 @@ The upload picker lists folders only and marks permissions:
 | Cmd + Shift + B | Ctrl + Shift + B       | Broadcast input          |
 | Cmd + Shift + Q | Ctrl + Shift + Q       | Quick connect            |
 | Cmd + Shift + R | Ctrl + Shift + R       | Toggle session recording |
-| Cmd + Shift + D | Ctrl + Shift + D       | Split pane vertically    |
-| Cmd + Shift + E | Ctrl + Shift + E       | Split pane horizontally  |
+| Cmd + Shift + D | Ctrl + Shift + D       | Split pane right         |
+| Cmd + Shift + E | Ctrl + Shift + E       | Split pane down          |
 
 ## Need more detail?
 
diff --git a/docs/user-manual.md b/docs/user-manual.md
index 628fd19..1b8bad8 100644
--- a/docs/user-manual.md
+++ b/docs/user-manual.md
@@ -1,4 +1,4 @@
-# Alchementary Link User Manual
+# Nexus Terminal User Manual
 
 ## Contents
 
@@ -8,14 +8,16 @@
 4. Connection types
 5. Tabs and split panes
 6. Terminal actions and search
-7. Snippets and broadcast input
+7. Snippets, broadcast input and triggers
 8. SFTP file browser
 9. Drag-and-drop uploads and paste
-10. Session recordings
-11. Leviathan binary workbench
+10. Port forwards
+11. Session recordings
 12. Security and credentials
-13. Settings
-14. Troubleshooting
+13. Import and export
+14. Settings and updates
+15. Data locations and migration from Alchementary Link
+16. Troubleshooting
 
 ---
 
@@ -23,26 +25,35 @@
 
 ### Launch and connect
 
-- Start Alchementary Link.
-- Click **New** in the sidebar, choose a protocol, and fill in the profile details.
-- Click **Connect** to open a session in a new tab.
+- Start Nexus Terminal.
+- Click **+** at the bottom of the sidebar (or press **Cmd+N** / **Ctrl+N**), choose a protocol, and fill in the profile details.
+- Click **Create & Connect** to save the profile and open a session in a new tab, or **Create** to save it for later.
+- Click a profile in the sidebar to connect to it.
 
 ### Quick connect
 
-Use **Cmd+Shift+Q** (macOS) or **Ctrl+Shift+Q** (Windows/Linux) to open a lightweight connect dialog. This starts a one-off session without saving a profile.
+Use **Cmd+Shift+Q** (macOS) or **Ctrl+Shift+Q** (Windows/Linux) to open a lightweight connect dialog. Choose SSH, Telnet, RAW, IRC or Serial, enter the host (or serial device), port, and username or nick where relevant, then press **Enter**. This starts a one-off session without saving a profile.
+
+### Local terminal
+
+Click **Local Machine** at the top of the sidebar, choose **File → Local terminal**, or click **Local** on the welcome screen to open a shell on this computer. When the shell exits, the tab shows `[Exited - press enter to restart]`; press **Enter** to start a new shell in the same tab.
+
+### Command palette
+
+Press **Cmd+K** / **Ctrl+K**, or click the search box in the title bar, to open the command palette. Type a few letters to find a connection, switch to a tab, create a profile, open a window, change theme, lock or unlock the secret store, or run a terminal action. Use **Up/Down** to move, **Enter** to run, and **Esc** to close.
 
 ---
 
 ## 2. The interface at a glance
 
-- **Sidebar**: Profiles grouped by folders or tags, with search at the top.
-- **Tab bar**: One tab per session with status indicators, badges, and quick actions.
-- **Workspace**: The active terminal or viewer; split panes appear here.
-- **Status bar**: Connection state and session details.
+- **Title bar**: the File, Session, View and Help menus, the active session's name and host, the command palette launcher, a light/dark toggle, and the window controls. Drag the title bar to move the window; double-click it to maximise.
+- **Sidebar**: a search box, then **Local Machine**, **★ Favourites**, **Recent** (the last five connections), one section per group, and **Ungrouped** (or **All Connections** when you have no groups). Sections collapse when you click their headers. The footer has buttons for New connection, Command palette, Import, Export, Recordings and Settings. Drag the sidebar edge to resize it.
+- **Tab strip**: one tab per session, with a state dot, protocol badge, pin marker, activity dot and close button. SSH tabs also have a folder icon for SFTP. On the right are **+** (new connection) and the broadcast button.
+- **Workspace**: the active terminal or viewer; split panes appear here. With no tabs open it shows a welcome screen with **New Connection**, **Quick Connect** and **Local** buttons.
+- **Right dock**: the profile editor or the SFTP browser, resizable.
+- **Status bar**: the active session's state and protocol, a **REC** marker while recording, latency for SSH sessions, a **BROADCAST** marker, the vault state (click it to open Security settings), the number of connected sessions, and an update notice when a new version is available.
 
-Screenshot: Main window with sidebar, tab bar, and active terminal.
-
-Tip: You can drag the divider between split panes to rebalance space.
+Notifications appear as toasts in the top-right corner and dismiss themselves after a few seconds; click **×** to dismiss one early.
 
 ---
 
@@ -50,22 +61,39 @@ Tip: You can drag the divider between split panes to rebalance space.
 
 ### Create a new profile
 
-1. Click **New** in the sidebar.
-2. Choose the protocol (SSH, Telnet, RAW, VNC, or GitHub).
-3. Fill in the required fields and optional settings.
-4. Save and connect.
+1. Click **+** in the sidebar footer or on the tab strip, press **Cmd+N** / **Ctrl+N**, or right-click a group header and choose **New connection in …**.
+2. Choose the protocol (SSH, Telnet, RAW TCP, GitHub, VNC, IRC or Serial) at the top of the editor. Switching protocol keeps the common fields.
+3. Fill in the **General** section: Display Name, Host (or Device for serial), Port, Username, Group and Description.
+4. Fill in the protocol sections and, for terminal protocols, the **Terminal** section (font family, font size 8–36, scrollback 0–100000 lines, cursor style).
+5. Optionally add **Tags** (comma-separated) and **Notes**.
+6. Click **Create & Connect**, or **Create** to save without connecting.
 
-Screenshot: New profile form with protocol selector and connection fields.
+Click **Test** to check that the host and port are reachable; a toast reports the round-trip time. Fields with problems are highlighted when you save.
 
-### Edit, duplicate, or delete
+The **Group** field suggests existing groups; type a new name to create one.
 
-Right-click a profile in the sidebar to edit, duplicate, or delete it. You can also click the pencil icon on hover, or double-click the item to edit.
+### Edit, duplicate, favourite, export or delete
 
-### Folders, tags, and favourites
+Right-click a profile in the sidebar for **Connect**, **Edit**, **Duplicate**, **Add to Favourites** / **Remove from Favourites**, **Export…** and **Delete**. Double-click a profile to edit it. Deleting a profile also removes its saved credentials.
 
-Use folders and tags to organise profiles. Mark profiles as favourites for quick access.
+### Bulk actions
 
-Tip: Use the search box to filter profiles by name, host, or tag.
+Ctrl-click (Cmd-click on macOS) profiles to select several. A bar appears at the bottom of the sidebar with:
+
+- **Connect all**
+- **Disconnect** (asks first when **Confirm on disconnect** is on)
+- **Tags** → **Add tags…** or **Replace tags…**
+- **Move group** (leave the name empty to move to Ungrouped)
+- **Delete**
+- **Clear** (clear the selection)
+
+### Search
+
+Type in the sidebar search box to fuzzy-search profiles by name, host, tag and protocol.
+
+### Already open?
+
+If you connect to a profile that already has a live session, Nexus Terminal asks whether to **Use Existing**, open a **New Connection**, or **Cancel**.
 
 ---
 
@@ -73,105 +101,190 @@ Tip: Use the search box to filter profiles by name, host, or tag.
 
 ### SSH
 
-- Password, public key, keyboard-interactive, SSH agent, and TOTP/2FA.
-- Jump hosts, port forwarding, proxy support, and auto-reconnect.
-- Built-in SFTP browser and session recording.
+- **Authentication**: password, public key, keyboard-interactive and SSH agent. Choose which methods to try under **Auth Methods**, and tick **Use SSH Agent for Authentication** to use `ssh-agent` (Pageant or the OpenSSH agent on Windows).
+- **Key & Passphrase**: choose a key from the suggestions (keys in `~/.ssh`), click **Browse**, or type a full path (`~` is not expanded). The editor checks that the file exists and is a private key.
+- **Host Verification**: the host key policy (see section 12).
+- **Jump Hosts**: one or more bastions, each with user, host, port and an optional key. Nexus Terminal tunnels through each hop in order.
+- **Port Forwarding**: local and remote forwards, each with a bind address and port, destination, label and an **Active** box to start it on connect.
+- **Startup**: a startup command and environment variables (`KEY=VALUE`, one per line).
+- **Login Script**: expect-style steps (see below).
+- **SSH Agent**: agent authentication and **Forward Agent to Remote** (like `ssh -A`).
+- **TOTP / 2FA**: store a Base32 TOTP secret to answer two-factor prompts automatically. Click **Test** to show the current code, **Save** to store the secret, and **Delete** to remove it. Save the profile first.
+- **Proxy**: none, SOCKS5 or HTTP CONNECT, with host, port and optional username and password. The proxy is used to reach the SSH server, or the first jump host.
+- **Advanced**: terminal type, keepalive interval, max missed keepalives, compression, auto-reconnect and the maximum number of reconnect attempts (1–20).
+
+The SFTP browser, port forwards and status-bar latency are available on SSH sessions.
 
 ### Telnet
 
-- Option negotiation, encoding, local echo, and line endings.
-- Auto-login scripts and auto-reconnect.
+- **Login**: local echo and line mode.
+- **Terminal & Encoding**: terminal type and encoding (UTF-8, ASCII or ISO 8859-1).
+- **Echo & Line Endings**: LF, CR, CRLF or none.
+- **Negotiation**: **Debug Negotiation** for troubleshooting option negotiation.
+- **Login Script** and **Reconnection** settings.
+
+Telnet sends everything in plain text. Avoid it for anything sensitive over an untrusted network.
 
 ### RAW TCP
 
-- Text, hex, and split views for binary-safe data.
-- Payload presets and configurable encoding and line endings.
+- **Encoding & Framing**: encoding (UTF-8, ASCII or Hex) and line ending.
+- **Display**: show timestamps and show direction.
+- **Payload Presets**: named payloads with a format (Text, Hex or Escaped) for quick sending.
+- **Timeouts & Reconnect**: connect and read timeouts, and auto-reconnect.
+
+A RAW session opens a viewer instead of a terminal:
+
+- **Text**, **Hex** and **Split** views of everything sent and received.
+- **Pause** / **Resume**, **Clear**, and **Save** (writes the capture as JSON).
+- A send bar with a format selector (Text, Hex or Escaped), a **Presets…** menu, and quick buttons for EOT, ETX, LF, CR and NUL. Press **Enter** to send.
+
+### Serial
+
+Serial profiles open a terminal on a local serial port.
+
+- **Device**: pick the port from the list and click refresh after plugging in an adapter, or type a path such as `/dev/ttyUSB0`, `/dev/cu.usbserial-…` or `COM3`.
+- **Line Settings**: baud rate (a preset from 300 to 1000000, or a custom value), data bits (5–8), parity (none, odd or even), stop bits (1 or 2) and flow control (none, XON/XOFF or RTS/CTS).
+- **Behaviour**: line ending, encoding, local echo (for devices that don't echo), **Assert DTR on connect**, **Assert RTS on connect**, and auto-reconnect.
+
+The defaults are 115200 baud, 8 data bits, no parity, 1 stop bit, no flow control, CR line endings, and DTR and RTS asserted.
+
+When the adapter is unplugged the session disconnects; with auto-reconnect on, the port is reopened when the device returns. Serial sessions support everything other terminals do: recording, triggers, broadcast, snippets, find and split panes.
 
 ### VNC
 
-- Remote desktop viewer embedded in the Link workspace.
-- Password prompt and saved-password modes.
-- View-only mode, scale-to-fit, shared sessions, and quality controls.
-- Optional SSH tunnel for safer VNC transport.
+- **VNC Server**: VNC host (defaults to the profile's Host), port, and password storage mode.
+- **Display**: **View Only**, **Scale to Fit**, **Shared Session** and **Quality (0-9)**.
+- **SSH Tunnel**: carry VNC traffic through SSH, with host, port, username and password, public key or SSH agent authentication.
 
-Use SSH tunnelling for VNC whenever possible. Direct VNC is useful on trusted or isolated networks, but many classic VNC deployments do not provide strong transport encryption.
+The viewer's toolbar shows the connection state and desktop size, and has buttons to switch between scaled and 1:1 display, refresh the screen, **Paste Clipboard** (send your local clipboard to the remote desktop) and **Ctrl+Alt+Del**. Click the desktop to give it keyboard focus.
+
+Use SSH tunnelling for VNC whenever possible. If a VNC profile has no tunnel, Nexus Terminal warns that the traffic is unencrypted and offers **Connect Anyway**, **Edit Profile** or **Cancel**.
+
+### IRC
+
+- **IRC**: nick, real name, **Use TLS** (port 6697 for most TLS networks) and an optional server password.
+- **NickServ**: identify on connect, with an optional account name and password.
+- **Rooms**: rooms to join automatically, one per line or comma-separated.
+- **SSH Tunnel** and **Reconnection** settings.
+
+The IRC view has a **Server** tab and a tab per room or conversation, with a dot on tabs that have unread messages. Type messages or `/commands` in the composer (`/join`, `/part`, `/msg`, `/me`, `/notice`, `/nick`, `/topic`, `/list`, `/names`, `/whois`, `/who`, `/raw`, `/quit`, `/help`). Press **Tab** to complete a nick, or click a nick to mention it. The side panel lists joined rooms, a room browser with a filter (click a room to join it), and the users in the current room.
 
 ### GitHub
 
-- Browse repositories by organisation.
-- Sorted by most recent activity.
+- **API**: API base URL (`https://api.github.com`, or your GitHub Enterprise API URL) and personal access token storage. The token needs the `repo` scope.
+- **Refresh**: refresh interval, 60–3600 seconds.
+
+Repositories are grouped by owner or organisation and sorted by most recent activity. Each card shows Private, Fork and Archived badges, language, stars, description, and the last commit and committer. Use the filter box to narrow the list, **Refresh now** to update it, **Visit** to open a repository in your browser, and **ZIP** to download an archive.
 
 ---
 
 ## 5. Tabs and split panes
 
-- **Reorder** tabs by dragging them.
-- **Pin** important sessions to keep them at the front.
-- **Scroll** the tab bar with the scrollbar or mouse wheel/trackpad when many tabs are open.
-- **Hover** a tab to see the full name and, for connected sessions, the connection start time.
-- **Close** tabs with the close button on the left side of each tab. Leviathan tool tabs close without a disconnect confirmation.
-- **Split** the workspace vertically or horizontally to view multiple sessions at once.
-- **Broadcast** input to multiple connected sessions when needed.
+- **Reorder** tabs by dragging them, or right-click and choose **Move Left** / **Move Right**.
+- **Pin** important sessions from the tab's right-click menu; pinned tabs stay at the front.
+- **Rename**, **Duplicate** (open another session to the same profile) and **Reconnect** from the right-click menu.
+- **Scroll** the tab strip with the mouse wheel or trackpad when many tabs are open.
+- **Hover** a tab to see its name, host, state and, for connected sessions, the connection start time.
+- **Close** a tab with its **×**, **Cmd+W** / **Ctrl+W**, or **Close** in the right-click menu. When **Confirm on close** is on, closing a connected tab asks first (GitHub tabs close straight away).
+- **Switch** tabs with **Cmd+Tab** / **Ctrl+Tab**, **Cmd+Shift+Tab** / **Ctrl+Shift+Tab**, or **Cmd+1–9** / **Ctrl+1–9**.
+- A dot on a background tab means it has new output.
 
-Screenshot: Tab bar with pinned sessions and split panes.
+### Split panes
 
-Tip: Pinned tabs stay at the front so key systems never get buried.
+- **Cmd+Shift+D** / **Ctrl+Shift+D** splits the focused pane to the right (side by side).
+- **Cmd+Shift+E** / **Ctrl+Shift+E** splits it downwards (top and bottom).
+- Split Right and Split Down are also in the Session menu, the terminal's right-click menu and the command palette.
+
+A new pane offers **Local Machine** and your terminal profiles (SSH, Telnet and Serial); click one to open it in that pane. Drag a divider to resize panes. Click **×** on a pane's header to close it; its neighbour takes the space. Closing the tab closes every pane in it.
 
 ---
 
 ## 6. Terminal actions and search
 
+### Keyboard and mouse
+
+- **Copy**: select text and press **Cmd+C** / **Ctrl+C**. With nothing selected, **Ctrl+C** sends an interrupt as usual.
+- **Paste**: **Cmd+V** / **Ctrl+V**. Pastes are bracketed when the remote application asks for it.
+- **Select**: drag to select, double-click for a word, triple-click for a line, Shift-click to extend.
+- **Links**: hold **Cmd** / **Ctrl** and click a web link to open it in your browser.
+- **Scroll**: the mouse wheel, or **Shift+PageUp**, **Shift+PageDown**, **Shift+Home** and **Shift+End**. On the alternate screen (for example in `tmux`, `screen`, `byobu` or `less`) the wheel sends arrow keys instead.
+- Applications that use the mouse (such as `htop`, `vim` or `tmux` with mouse mode) receive mouse clicks and the wheel directly.
+
 ### Context menu
 
 Right-click in the terminal for:
 
-- Copy and paste
-- Select all
+- Copy and Paste
+- Select All
 - Find
-- Send snippet
-- Clear and reset
-
-Screenshot: Terminal context menu and search bar.
+- Send Snippet
+- Port Forwards (SSH)
+- Split Right and Split Down
+- Export Output (save the whole scrollback as a text file)
+- Clear and Reset
 
 ### Search
 
-Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search in the active terminal. Toggle case sensitivity and regular expressions as needed.
+Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search in the active terminal. Toggle **Aa** for case-sensitive matching and **.\*** for regular expressions. The bar shows "*n* of *total*"; press **Enter** for the next match, **Shift+Enter** for the previous one, and **Esc** to close.
+
+### Disconnects and errors
+
+When a session drops, the pane is dimmed and shows a **Disconnected** (or **Connection error**) card with **Reconnect** and **Close**. While auto-reconnect is running it shows **Reconnecting…** with a **Cancel** button, and a toast shows the attempt number and delay.
+
+If a connection fails because of authentication or a host key, a guided dialog explains what happened and offers **Retry**, **Edit Profile**, **Known Hosts** (for host-key errors) and **Close**.
 
 ---
 
-## 7. Snippets and broadcast input
+## 7. Snippets, broadcast input and triggers
 
 ### Snippets
 
-Open the snippet library with **Cmd+Shift+S** (macOS) or **Ctrl+Shift+S** (Windows/Linux) and save frequently-used commands. Send a snippet to the active session with one click.
+Open the snippet library with **Cmd+Shift+S** (macOS) or **Ctrl+Shift+S** (Windows/Linux), from the Session menu, or with **Send Snippet** in the terminal's right-click menu. Create snippets with a name, description, command and folder, search them, and click **Send to Session** to type the command into the active session followed by Enter.
 
-Screenshot: Snippet library with search and folder grouping.
+Snippets can use variables:
+
+- `{{hostname}}`, `{{date}}`, `{{time}}` and `{{timestamp}}` are filled in automatically.
+- Any other `{{name}}` is asked for when you send the snippet.
 
 ### Broadcast input
 
-Toggle broadcast mode with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux). While active, all input is sent to every connected session.
+Toggle broadcast mode with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux), the broadcast button on the tab strip, or the Session menu. While it is on, everything you type is also sent to every other connected terminal session, and the status bar shows **BROADCAST**.
+
+To broadcast to only some sessions, right-click the broadcast button (or choose **Session → Broadcast targets…**), tick the sessions you want, and click **Apply & Enable**.
+
+### Trigger rules
+
+Open **Trigger Rules** from the Session menu or the command palette. Each rule has a name, a pattern (plain text or regular expression), a case-sensitive option, an enabled switch and an action:
+
+- **Notify**: show a toast.
+- **Highlight tab**: briefly outline the pane.
+- **Notify + Highlight**: both.
+- **Sound**: ask the operating system for attention (for example, a bouncing dock icon or flashing taskbar button) and show a toast.
+
+Rules are checked against each complete line of terminal output, with colour codes removed.
 
 ---
 
 ## 8. SFTP file browser
 
-Open the file browser with the **folder** icon on an SSH tab. You can:
+Open the file browser with the **folder** icon on an SSH tab, or **Session → SFTP browser**. It opens in the right dock beside the terminal. You can:
 
-- Navigate folders using the breadcrumb trail.
-- Upload, download, rename, and delete files.
-- Refresh and create folders.
+- Navigate folders using the breadcrumb trail, the `..` entry, or **Go to path**.
+- Upload files, and download one or more selected files to a folder you choose.
+- Rename a single item, and delete one or more items (with confirmation).
+- Create folders and refresh the listing.
+- Bookmark the current folder with the star button; bookmarks are kept per profile.
+- Watch transfers and their progress in the transfer list.
 
-The browser runs inside the SSH session and shows remote contents in a side panel.
-
-Screenshot: SFTP browser open alongside the terminal.
+Ctrl-click (Cmd-click) or Shift-click to select several items. Drag the dock edge to resize it.
 
 ---
 
 ## 9. Drag-and-drop uploads and paste
 
-When you drop file(s) into an active terminal, Alchementary Link asks whether to:
+When you drop file(s) onto an active terminal, Nexus Terminal asks whether to:
 
-- **Upload** to a chosen remote directory, or
+- **Upload to current directory** — choose a remote directory (SSH sessions only), or
 - **Paste contents** into the terminal as if typed.
 
 ### Upload directory picker
@@ -181,163 +294,202 @@ The picker looks like the SFTP browser and lists remote folders only. It shows:
 - **READ ONLY** for folders you cannot write to.
 - **NO READ** for folders you cannot access.
 
-Use the filter box to narrow the list, and the breadcrumb trail or **Up** button to move around. You can also use the keyboard:
+Use the filter box to narrow the list, and the breadcrumb trail or **Up** button to move around. **Use this folder** is disabled when the folder is not writable. You can also use the keyboard:
 
 - **Up/Down**: move selection
 - **Enter**: choose the selected folder
+- **Backspace**: go up a folder (when the filter is empty)
 - **Escape**: cancel
 
 If the SFTP browser is already open, the picker starts in the same directory.
 
-Screenshot: Upload directory picker with permissions badges.
-
 Tip: Use the filter box to jump quickly to common folders.
 
 ---
 
-## 10. Session recordings
+## 10. Port forwards
 
-Toggle recording with **Cmd+Shift+R** (macOS) or **Ctrl+Shift+R** (Windows/Linux). Recordings are saved as asciicast v2 files and can be replayed from the recordings panel.
+Forwards saved in an SSH profile start when the session connects. To manage forwards on a live SSH session, choose **Port Forwards** from the terminal's right-click menu or **Session → Port forwards**. The dialog lists active forwards (marked **L** for local or **R** for remote) with a stop button, and lets you start a new one:
 
-Screenshot: Recordings list with playback controls.
+- **Local →**: listen on a local bind address and port, and forward to a destination reachable from the server.
+- **Remote ←**: ask the server to listen, and forward connections back to a destination reachable from this computer.
+
+Toasts report when a forward starts, stops or fails.
 
 ---
 
-## 11. Leviathan binary workbench
+## 11. Session recordings
 
-Leviathan is the integrated binary-analysis and editing workspace inside Alchementary Link. It is useful for firmware images, unknown binaries, archives, captures, embedded files, suspicious documents, and audio spectrogram experiments.
+Toggle recording with **Cmd+Shift+R** (macOS) or **Ctrl+Shift+R** (Windows/Linux), or **Session → Toggle recording**. A red dot appears on the tab and **REC** in the status bar. Recordings are saved as asciicast v2 files.
 
-### Switching to Leviathan
+Open the recordings browser from the sidebar footer, the Session menu or the command palette. It shows how many recordings you have and how much space they use, lets you play or delete each one, and has **Clean up** for removing recordings older than 7, 30 or 90 days, or keeping the total under 1 GB or 5 GB.
 
-Click **Leviathan** in the top-left sidebar header. The normal connection list changes into a tool list. Click **Alchementary Link** to return to saved servers and groups.
-
-Use **Load** to select a local file. The selected file becomes the current Leviathan working document. Use **Save** to write the patched working copy to a chosen destination.
-
-Leviathan tools open as regular tabs. You can open multiple tool tabs at once, switch between them, and close them without a connection-disconnect confirmation.
-
-### Hex Editor
-
-The Hex Editor is the primary byte-level view.
-
-- Choose 16 or 32 bytes per row.
-- Edit byte cells directly; typing two hex digits advances to the next byte.
-- The ASCII preview updates as bytes are edited.
-- Paste hex runs such as `de ad be ef` or `deadbeef` into consecutive cells.
-- Use Search to find strings or hex values, then move through matches with previous/next.
-- Undo, redo, or revert edits from the Leviathan panel header.
-
-### Triage tools
-
-- **Overview**: first-pass summary across hashes, entropy, strings, indicators, and carve candidates.
-- **Hashes**: CRC32, MD5, SHA-1, SHA-256, and SHA-512.
-- **Entropy**: graph entropy across the whole file; select a region to open that range in a new Hex Editor tab.
-- **Strings**: ASCII and UTF-16 string extraction.
-- **IOCs**: URLs, domains, paths, hashes, and other indicators.
-- **Search** and **Multi-search**: text, hex, and regular-expression matching.
-
-### Structure and recovery tools
-
-- **Structures** parses common formats such as PE, ELF, Mach-O, ZIP, images, RIFF, ASN.1, and certificates.
-- **Disasm** provides heuristic disassembly for common CPU families and raw byte fallback where decoding is not implemented.
-- **PDF** inspects objects, streams, xrefs, and suspicious surfaces.
-- **SquashFS** inspects filesystem superblocks and metadata; non-SquashFS input shows a human-readable bad-magic error.
-- **Carve** and **BinSnoop** scan for embedded files and signatures and can export discovered files or ranges.
-- **Keys**, **Timestamps**, **Stego**, and **Metadata** help recover common artefacts from binaries and containers.
-
-### Editing, transforms, and cases
-
-- **Patch Plan** validates patch scripts without modifying the working copy.
-- **Patch Apply** applies validated patch scripts.
-- **Transforms** runs pipelines such as hex, Base64, URL, XOR, inflate, and cipher transforms over selected data.
-- **Rules** runs YARA-like scans over the current document.
-- **Case Export** packages investigation artefacts from the working document.
-
-### Spectrogram tools
-
-- **Spectrogram Encode** converts an image into WAV audio so the image appears in a spectrogram.
-- It can also insert an encoded image into an existing WAV or MP3 carrier.
-- **Spectrogram View** renders WAV or MP3 audio as a spectrogram image.
-- Controls include FFT size, height, maximum width, aspect ratio, frequency range, brightness, and contrast.
-
-### Large file behaviour
-
-Leviathan keeps loaded files file-backed where possible and writes patched working copies in chunks. Some tools still need bounded in-memory buffers because the underlying parser or decoder works on complete byte slices; those tools reject oversized inputs with a clear message rather than trying to allocate unbounded memory.
+Playback starts automatically and has play/pause, restart, a seek bar with elapsed and total time, and speed control.
 
 ---
 
 ## 12. Security and credentials
 
-Alchementary Link stores credentials securely:
+### Where credentials are stored
 
-- **OS keychain first** (Keychain, Secret Service, or Credential Manager).
-- **Encrypted vault** fallback using AES-256-GCM with Argon2id.
+- **OS keychain first** (macOS Keychain, Linux Secret Service or Windows Credential Manager).
+- **Encrypted vault** fallback, using AES-256-GCM with an Argon2id-derived key (128 MiB of memory, which makes brute-force attacks expensive).
+
+If the keychain is unavailable, or refuses to store a secret, credentials go to the vault. Set the vault up in **Settings → Security** with **Initialise Secret Store**; the master-password dialog shows a strength meter (Weak, Fair, Good, Strong) and asks you to confirm the password. Unlock and lock it from the same page, the command palette, or by clicking the vault state in the status bar. The vault is locked again when Nexus Terminal quits.
+
+Without the master password, credentials in the vault cannot be recovered.
+
+### Secret modes
+
+Each password, passphrase, token or TOTP secret has its own mode:
+
+- **Save securely**: stored in the keychain or vault and used automatically.
+- **Remember for this session**: asked for once, kept in memory for that session, never written to disk.
+- **Ask every time**: asked for on every connection.
+
+When a session needs a credential it doesn't have, a prompt appears; press **Esc** or **Cancel** to abandon the connection.
 
 ### Host key verification
 
 Choose one of the following policies per SSH profile:
 
-- **Strict**: only accept previously saved fingerprints.
-- **Ask**: prompt before trusting a new host key.
-- **Accept new**: trust first-time keys, reject changes.
-- **Insecure**: accept any key (not recommended).
+- **Strict (known hosts only)**: only accept previously saved host keys.
+- **Ask on new or changed keys**: prompt before trusting a new host key; the dialog shows the key type and fingerprint with **Accept & Save** and **Reject**.
+- **Accept new, reject changed**: trust first-time keys automatically.
+- **Insecure (accept anything)**: accept any key (not recommended).
+
+Under every policy except Insecure, a key that differs from the saved one is rejected. Nexus Terminal keeps its own known-hosts list and does not read `~/.ssh/known_hosts`. Review and remove entries in **Settings → Known Hosts**; click a fingerprint to copy it.
 
 ### TOTP / 2FA
 
-Store a TOTP secret in the profile editor to auto-fill verification codes during SSH authentication.
+Store a TOTP secret in the profile editor to answer verification-code prompts automatically during SSH keyboard-interactive authentication. Secrets are stored in the keychain or vault, never in the profile database.
 
-Screenshot: TOTP configuration in the profile editor.
+### SSH key manager
+
+Open **SSH key manager** from the Session menu or the command palette. It lists key pairs in `~/.ssh` with their type, lets you copy a public key to the clipboard or delete a pair, and generates new Ed25519, RSA (2048 or 4096 bits) or ECDSA keys with an optional passphrase. Key generation uses the `ssh-keygen` program.
+
+### Audit log
+
+Connections, disconnections, profile changes, credential access, imports and exports are recorded in an audit log in the database. Secrets are never written to it.
 
 ---
 
-## 13. Settings
+## 13. Import and export
 
-Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux) and configure:
-
-- Terminal themes and fonts
-- Default behaviours
-- Secrets and vault settings
-- Recording and shortcut preferences
-
-Screenshot: Settings panel with appearance and security options.
+- **Encrypted export**: **File → Export profiles…**, the sidebar footer, the command palette, or **Export…** on a profile's right-click menu. Choose the profiles, set a password and save a `.nexus` file. Credentials saved in the keychain or vault are not included.
+- **Encrypted import**: **File → Import profiles…** or the sidebar footer. Choose a `.nexus` file (or a `.link` file from Alchementary Link), enter its password, and choose what happens when a profile already exists: **Skip existing**, **Overwrite existing** or **Create duplicates**.
+- **JSON export and import**: **Export Profiles (JSON)** and **Import Profiles (JSON)** in the command palette. JSON export includes every profile; tick **Include secrets** to keep inline proxy passwords and TOTP secrets, which are otherwise removed.
+- **OpenSSH config**: **File → Import ~/.ssh/config** or **Settings → About → Import ~/.ssh/config** creates profiles from your `Host` blocks, including hostnames, usernames, ports, identity files and jump hosts.
 
 ---
 
-## 14. Troubleshooting
+## 14. Settings and updates
+
+Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux), the sidebar footer, or **File → Settings**. Click **Save** to apply changes.
+
+- **General**: app theme (Pro, Midnight or Light), default protocol, confirm on close, confirm on disconnect, status bar, sidebar width, and local shell (leave empty for the system default; **Browse…** to pick one).
+- **Terminal**: colour scheme, font family, font size, scrollback lines and cursor style. These are the defaults for new profiles; profiles can override them.
+- **Security**: keychain and vault status; initialise, unlock or lock the secret store.
+- **Known Hosts**: saved host keys with first-seen and last-seen times, and **Remove**.
+- **Help**: built-in help topics, including connection types, shortcuts and troubleshooting.
+- **About**: version, **Check for Updates**, and **Import ~/.ssh/config**.
+
+The app theme and terminal colour scheme can also be changed from the **View** menu, and the light/dark button in the title bar.
+
+### Updates
+
+Nexus Terminal checks for a new version once at launch. When one is available, the status bar shows **Update available**; click it to open **Settings → About**, which shows the current and latest versions, release notes and a **View release** button. Nothing is downloaded or installed automatically.
+
+---
+
+## 15. Data locations and migration from Alchementary Link
+
+### Data locations
+
+| OS      | Data directory                                     |
+| ------- | -------------------------------------------------- |
+| macOS   | `~/Library/Application Support/NexusTerminal`      |
+| Windows | `%APPDATA%\NexusTerminal`                          |
+| Linux   | `$XDG_CONFIG_HOME/NexusTerminal` (usually `~/.config/NexusTerminal`) |
+
+The directory holds:
+
+- `nexus.db` — profiles, known hosts, preferences, snippets, IRC channel state and the audit log (SQLite)
+- `vault/vault.json` — the encrypted vault
+- `recordings/` — session recordings
+- `triggers.json` — trigger rules
+- `sftp-bookmarks.json` — SFTP bookmarks
+
+Credentials saved in the OS keychain are stored under the service name `NexusTerminal`.
+
+### Migrating from Alchementary Link
+
+On first run, if Nexus Terminal has no database yet and an Alchementary Link data directory (`AlchementaryLink`, in the same parent folder) exists, Nexus Terminal **copies** `link.db` to `nexus.db`, along with the `vault/` and `recordings/` directories, and shows a toast saying where the data came from. The Alchementary Link directory is left untouched.
+
+- If a `NexusTerminal/nexus.db` already exists (for example from a version before the Alchementary Link rebrand), it is used as-is and nothing is copied.
+- Keychain entries saved under `AlchementaryLink` are found the first time they are needed and copied to `NexusTerminal`. The old entries are not deleted.
+- Your vault master password is unchanged.
+- Trigger rules and SFTP bookmarks from Alchementary Link are not migrated; recreate them in Nexus Terminal.
+
+---
+
+## 16. Troubleshooting
 
 ### Session shows as disconnected
 
-- The terminal is blurred and shows a **DISCONNECTED** overlay when the connection drops.
+- The pane is dimmed and shows a **Disconnected** overlay when the connection drops.
 - Click **Reconnect** to reopen the session with the same profile.
 
+### Authentication fails
+
+- Check the username, password, key path and the auth methods ticked in the profile.
+- If the key has a passphrase, check the passphrase mode.
+- If the server uses two-factor prompts, check the TOTP secret with **Test** and make sure your system clock is accurate.
+
+### "Host key verification failed"
+
+The server's key differs from the one saved earlier. This can happen when a server is reinstalled, but it can also indicate an attack. If you're certain it's safe, open **Settings → Known Hosts**, remove the entry, and reconnect.
+
 ### Upload fails or is greyed out
 
 - Check the folder is writable; **READ ONLY** indicates no write permission.
-- Confirm the SSH session is connected.
-
-### VNC will not connect
-
-- Confirm the VNC host and port are correct. The common VNC port is `5900` plus the display number.
-- If using a password, check whether the profile is set to saved, session-only, or ask-every-time mode.
-- If using an SSH tunnel, verify the tunnel host, username, authentication method, and SSH host key policy.
-- If direct VNC is enabled, test from a trusted network first and prefer an SSH tunnel for untrusted networks.
-
-### Leviathan cannot load or save a file
-
-- Check that the file still exists and that your user account can read it.
-- When saving, choose a writable destination and avoid overwriting a file that another process has locked.
-- Some tools enforce explicit size limits for safety. If a tool rejects an oversized input, try selecting a smaller range or using a tool that works on the file-backed document.
+- Confirm the session is connected over SSH; upload isn't available for other protocols.
 
 ### Cannot read a folder
 
 - **NO READ** indicates insufficient permissions.
 - Try a parent folder or check remote access controls.
 
+### Serial port won't open
+
+- Check the device path and that the adapter is plugged in; refresh the device list in the editor.
+- **Permission denied** on Linux: add your user to the `dialout` group (`uucp` on some distributions), then log out and back in.
+- On macOS, use the `/dev/cu.*` device rather than `/dev/tty.*`.
+- **Port is in use by another program**: close any other program that has the port open, such as `screen`, `minicom` or an IDE serial monitor.
+- Garbled output usually means the baud rate, parity or stop bits don't match the device.
+
+### VNC will not connect
+
+- Confirm the VNC host and port are correct. The common VNC port is `5900` plus the display number.
+- If using a password, check whether it is set to save securely, remember for this session, or ask every time.
+- If using an SSH tunnel, verify the tunnel host, username, authentication method, private key and SSH host key policy.
+- If direct VNC is enabled, test from a trusted network first and prefer an SSH tunnel for untrusted networks.
+
+### The secret store is locked
+
+If a saved credential isn't used, the vault may be locked. Click the vault state in the status bar, or open **Settings → Security**, and unlock it.
+
 ### Session keeps reconnecting
 
 - Check network stability and credentials.
-- Review auto-reconnect settings in the profile.
+- Review the auto-reconnect settings in the profile. Reconnection backs off exponentially (1 s, 2 s, 4 s … up to 30 s) and stops after the maximum number of attempts.
 
 ### Terminal size looks wrong
 
+- Resize the window or drag a split divider; the terminal re-fits automatically.
 - Try disconnecting and reconnecting the session.
-- Avoid heavy UI resizing during initial connection.
+- Some older servers don't support modern terminal features; try a different terminal type in the profile.
+
+### Trying things safely
+
+To try something without touching your real data, start Nexus Terminal with `--data-dir DIR` to use a different data directory.