release: 3.0.1

Bump the workspace to 3.0.1 and bring the user guide up to date: an RDP
chapter, shell integration and inline images, SSH certificates and CAs,
known_hosts import/export, stored credentials and master password change,
profile sync (replacing the Alchementary Link migration chapter), the
Diagnostics tab and log, and refreshed screenshots throughout. The welcome
screen's protocol line now lists RDP.

docs/guide/chapters/appendix.tex

@@ -44,6 +44,7 @@
   \shortcut{Next / previous match}{\kbd{Enter} / \keys{Shift+Enter}}
   \shortcut{Scroll a page}{\keys{Shift+PageUp}}
   \shortcut{Top / bottom}{\keys{Shift+Home} / \kbd{End}}
+  \shortcut{Previous / next prompt}{\keys{\mod+Shift+Up} / \kbd{Down}}
   \shortcut{Open link}{\kbd{Ctrl}/\kbd{\ph{E1C4}} + click}}
 
 \sheet{pink}{\iMap\enspace Mouse moves}{%
@@ -63,8 +64,11 @@
   --data-dir DIR        & Use another data folder (portable installs, demos, testing).\\
   --theme pro|midnight|light & Start with this theme.\\
   --connect NAME        & Connect to a saved profile by name at startup. Repeat it for several.\\
-  --open WINDOW         & Open a window at startup: \code{settings}, \code{settings:security}, \code{snippets},
+  --open WINDOW         & Open a window at startup: \code{settings}, \code{settings:security},
-                          \code{keys}, \code{recordings}, \code{palette}, \code{quick}…\\
+                          \code{settings:diagnostics}, \code{snippets}, \code{keys}, \code{recordings}, \code{palette},
+                          \code{quick}…\\
+  --run-local CMD       & Open a local shell and run a command in it.\\
+  RUST\_LOG=debug        & (environment) More detail in \code{nexus.log}, and on the terminal you started from.\\
   --version             & Print the version and exit.\\
   \bottomrule
 \end{tabularx}
@@ -87,13 +91,18 @@ rerun the script, rebuild the guide.
   \item[Bastion / jump host] A server you go \emph{through} to reach the ones behind it.
   \item[Baud rate] How fast a serial line talks. Both ends must agree.
   \item[Broadcast] Typing into several sessions at once.
+  \item[Certificate authority] A key that vouches for other keys, so servers signed by it are trusted without a prompt.
   \item[DTR / RTS] Serial control lines. Some boards use them for reset or flashing.
   \item[Fingerprint] A short summary of a server's host key, used to spot imposters.
   \item[Host key] A server's identity. Changes when it's rebuilt, or when someone's pretending.
   \item[Keychain] Your operating system's password store.
+  \item[NLA] Network Level Authentication: Windows checks your password before building a desktop.
+  \item[OSC 133] The escape codes a shell uses to mark its prompts, which powers shell integration.
   \item[Port forward] A tunnel carrying one TCP port through SSH.
   \item[Profile] A saved connection.
   \item[RAW TCP] A plain socket: bytes in, bytes out, no terminal rules.
+  \item[RDP] Microsoft's Remote Desktop Protocol, for Windows (and xrdp) desktops.
+  \item[SASL] How IRC networks log you in while you connect, instead of messaging NickServ afterwards.
   \item[SFTP] File transfer over SSH.
   \item[Snippet] A saved command, optionally with blanks to fill in.
   \item[TOTP] Time-based one-time passwords: the six digits from your authenticator app.

docs/guide/chapters/part1-start.tex

@@ -40,10 +40,9 @@ The first time you open Nexus Terminal you get a calm, empty welcome screen. Thr
 
 \shot{welcome.png}{The welcome screen. Your saved connections will live down the left; here there are a few already.}
 
-\begin{headsup}[Coming from Alchementary Link?]
+\begin{headsup}[Got more than one computer?]
-Nexus Terminal spots your old data on first run and copies your profiles, vault and recordings across
+Point \ui{Profile sync} at a shared folder and your connections follow you around. See
-automatically. You'll see a little toast saying so. Your old data is left exactly where it was.
+\hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
-The details are in \hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
 \end{headsup}
 
 \section{Make your first connection}
@@ -51,7 +50,7 @@ The details are in \hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
 \begin{enumerate}
   \item Click \ui{New Connection}, or press \keys{\mod+N}.
   \item Pick the protocol along the top: \proto[teal]{SSH}, \proto[amber]{Telnet}, \proto[violet]{RAW TCP},
-        \proto[slate]{GitHub}, \proto[rose]{VNC}, \proto[amber]{IRC} or \proto[accent]{Serial}.
+        \proto[slate]{GitHub}, \proto[rose]{VNC}, \proto[rose]{RDP}, \proto[amber]{IRC} or \proto[accent]{Serial}.
   \item Fill in the \ui{General} bit: a \ui{Display Name} you'll recognise, the \ui{Host}, the \ui{Port}
         and your \ui{Username}.
   \item Click \ui{Create \& Connect}.

docs/guide/chapters/part2-connect.tex

@@ -1,9 +1,10 @@
 \guidepart{teal}{Connect}{Connect to all the things}
-  {Eight ways in. Pick the one you need; skip the rest.}
+  {Nine ways in. Pick the one you need; skip the rest.}
   {\partitem{\iTerminal}{SSH: the big one}
    \partitem{\iUsb}{Serial: cables and consoles}
    \partitem{\iPlug}{Telnet and RAW TCP}
    \partitem{\iDesktop}{VNC remote desktops}
+   \partitem{\iDesktop}{RDP: Windows desktops}
    \partitem{\iChat}{IRC}
    \partitem{\iGithub}{GitHub}}
 
@@ -47,6 +48,10 @@ Under \ui{Authentication}, tick which \ui{Auth Methods} to try: \ui{Public key},
 \ui{Keyboard-interactive}. Under \ui{SSH Agent}, tick \ui{Use SSH Agent for Authentication} to use keys already
 loaded into \code{ssh-agent} (or Pageant, or the Windows OpenSSH agent).
 
+Got an SSH \emph{user certificate}? Put it next to the key with the usual name (\code{id\_ed25519-cert.pub} beside
+\code{id\_ed25519}) and Nexus Terminal presents it automatically. Servers that hand out \emph{host} certificates are
+covered in \hyperref[ch:hostkeys]{Host keys} (p.\,\pageref{ch:hostkeys}).
+
 Every password and passphrase has a \emph{mode}: save it securely, remember it until you quit, or ask every time.
 That's all explained in \hyperref[ch:secrets]{Passwords \& the vault} (p.\,\pageref{ch:secrets}).
 
@@ -221,6 +226,60 @@ Turn on \ui{VNC viewers may control screen with password} in macOS Screen Sharin
 standard VNC password authentication, not Apple's own login method.
 \end{headsup}
 
+% =========================================================================================
+\chapter{RDP: Windows desktops}\label{ch:rdp}
+\chapmeta{4 minutes}{You'll be on a Windows (or xrdp) desktop without leaving Nexus Terminal}
+
+\begin{tldr}
+Host, username, password. Nexus Terminal logs on with NLA, pins the server's certificate like an SSH host key, and
+can go through a proxy, an SSH tunnel or an RD Gateway.
+\end{tldr}
+
+\begin{glance}{rose}{RDP}
+  Default port & 3389\\
+  Logs in with & NLA (NTLM, or Kerberos with a KDC); \ui{Allow servers without NLA} for xrdp\\
+  Display      & \ui{Scale to Fit}, fixed size, \ui{Resize With Tab}\\
+  Extras       & Clipboard both ways, remote audio, printer, shared folder\\
+  Getting there & SOCKS5 or HTTP proxy, SSH tunnel, RD Gateway (experimental)\\
+\end{glance}
+
+\shot{rdp.png}{An xrdp desktop in a tab. Ctrl+Alt+Del and Paste Clipboard sit on the toolbar.}
+
+\section{Setting it up}
+
+\begin{enumerate}
+  \item \keys{\mod+N}, protocol \proto[rose]{RDP}.
+  \item \ui{Host} and \ui{Username}; add a \ui{Domain} if your account has one.
+  \item Pick how the password is kept (save it, remember it until you quit, or ask every time).
+  \item \ui{Create \& Connect}. The first time, you're shown the server's certificate fingerprint. Accept it if
+        it's the machine you meant.
+\end{enumerate}
+
+Windows checks your password \emph{before} it builds a desktop (Network Level Authentication), so a typo fails fast.
+Linux machines running xrdp don't speak NLA: tick \ui{Allow servers without NLA} for those. In an Active Directory
+shop, set a \ui{Kerberos KDC} (\code{host} or \code{host:port}) and use your realm as the domain.
+
+\begin{headsup}[A changed certificate]
+RDP servers mostly use self-signed certificates, so Nexus Terminal remembers the fingerprint in
+\ui{Known Hosts}. If it changes you get \ui{Reject}, \ui{Accept Once} or \ui{Accept \& Update}, and nothing (not even your
+password) is sent until you choose.
+\end{headsup}
+
+\section{While you're connected}
+
+It works like the VNC viewer: click the desktop to give it your keyboard, \ui{Ctrl+Alt+Del} sends exactly that, and
+text you copy on either side turns up on the other. With \ui{Resize With Tab} the remote desktop follows the tab's
+size (Windows does this; other servers are scaled).
+
+Under \ui{Devices}: \ui{Play Remote Audio}; \ui{Redirect Printer}, which adds a \emph{Nexus Terminal} printer whose jobs
+land as PostScript files in your Downloads folder; and (Linux and macOS) a \ui{Shared Folder} that shows up remotely as
+a drive called Nexus. The server can read and change that folder, and nothing outside it.
+
+\section{Getting through}
+
+Pick \emph{one} of: a \ui{Proxy} (SOCKS5 or HTTP CONNECT), an \ui{SSH Tunnel} (same as VNC), or an \ui{RD Gateway}
+(experimental: the gateway needs a proper public certificate and Basic authentication over HTTPS).
+
 % =========================================================================================
 \chapter{IRC}\label{ch:irc}
 \chapmeta{3 minutes}{You'll be chatting in your project's channels from the same window as your servers}
@@ -231,7 +290,8 @@ Nick, server, rooms to join. Tabs for each room, \code{/commands} as you'd expec
 
 \begin{glance}{amber}{IRC}
   Default port & 6667, or 6697 with \ui{Use TLS} (use TLS!)\\
-  Extras       & NickServ identify on connect, auto-join rooms, room browser, SSH tunnel\\
+  Logs in with & SASL PLAIN (most networks want this now), or NickServ identify\\
+  Extras       & Auto-join rooms, room browser, real message times (IRCv3 server-time), SSH tunnel\\
 \end{glance}
 
 \shot{irc.png}{Chatting in \#nexus. Rooms down the right, users in the room below them.}

docs/guide/chapters/part3-faster.tex

@@ -30,7 +30,9 @@ Right-click a tab for everything. \keys{\mod+Shift+D} splits right, \keys{\mod+S
   \item[Switch] \keys{\mod+Tab} and \keys{\mod+Shift+Tab}, or \keys{\mod+1} to \keys{\mod+9}.
 \end{description}
 
-Lots of tabs? Scroll the tab strip with your mouse wheel or trackpad.
+Lots of tabs? Scroll the tab strip with your mouse wheel or trackpad. Quit with a dozen open and they're all back next
+time: \ui{Restore tabs at launch} (on by default) reconnects saved profiles and reopens local shells, splits and all,
+in the folder they were in.
 
 \section{Split panes}
 
@@ -62,9 +64,10 @@ Select to copy, \keys{\mod+F} to search, Ctrl/\ph{E1C4}-click links. Right-click
   \toprule
   Copy   & Select text, then \keys{\mod+C}. Nothing selected? \keys{Ctrl+C} interrupts the program as usual.\\
   Paste  & \keys{\mod+V}. Pastes are bracketed when the program asks for it, so editors won't auto-indent your paste
-           into a staircase.\\
+           into a staircase. Pasting several lines into a shell asks first (turn that off in Settings).\\
   Select & Drag for a range, double-click a word, triple-click a line, \kbd{Shift}-click to extend.\\
-  Links  & Hold \kbd{Ctrl} (\kbd{\ph{E1C4}}) and click a URL to open it in your browser.\\
+  Links  & Hold \kbd{Ctrl} (\kbd{\ph{E1C4}}) and click a URL to open it in your browser. Real hyperlinks that
+           programs print (\code{ls --hyperlink}, compilers) get a dotted underline; hover to see where they really go.\\
   Scroll & Mouse wheel, or \keys{Shift+PageUp}, \keys{Shift+PageDown}, \keys{Shift+Home}, \keys{Shift+End}.\\
   \bottomrule
 \end{tabularx}
@@ -77,8 +80,34 @@ wheel sends arrow keys instead of scrolling. Programs with mouse support (\code{
 
 \section{The right-click menu}
 
-\ui{Copy}, \ui{Paste}, \ui{Select All}, \ui{Find}, \ui{Send Snippet}, \ui{Port Forwards} (SSH), \ui{Split Right},
+\ui{Copy}, \ui{Paste}, \ui{Select All}, \ui{Find}, \ui{Previous Prompt} / \ui{Next Prompt}, \ui{Copy Last Command
-\ui{Split Down}, \ui{Export Output} (saves the whole scrollback as a text file), \ui{Clear} and \ui{Reset}.
+Output}, \ui{Send Snippet}, \ui{Port Forwards} (SSH), \ui{Split Right}, \ui{Split Down}, \ui{Export Output} (saves the
+whole scrollback as a text file), \ui{Clear} and \ui{Reset}.
+
+\section{Shell integration}
+
+If your shell marks its prompts (fish 4, Starship and Powerlevel10k do already), Nexus Terminal knows where every
+command starts and stops. \keys{\mod+Shift+Up} and \keys{\mod+Shift+Down} jump from prompt to prompt,
+\ui{Copy Last Command Output} grabs just what the last command printed, and a thin bar beside each prompt shows how it
+went: green for success, red for failure. Hover the bar for the exit code and how long it took.
+
+\shot{shell-integration.png}{\code{make test} failed (red bar), \code{ls} worked (green bar).}
+
+For bash, add this to \code{\textasciitilde/.bashrc} on the machine the shell runs on (the user manual has the zsh
+version):
+
+\begin{verbatim}
+PS0='\[\e]133;C\a\]'
+PROMPT_COMMAND='printf "\033]133;D;%s\007" "$?"; '"${PROMPT_COMMAND}"
+PS1='\[\e]133;A\a\]'"$PS1"'\[\e]133;B\a\]'
+\end{verbatim}
+
+\section{Pictures in the terminal}
+
+Programs that print images the iTerm2 way (\code{imgcat}, \code{wezterm imgcat}, \code{chafa -f iterm}) show PNG,
+JPEG and GIF images right in the scrollback. They scroll with the text and never spill past the edge.
+
+\shot{inline-image.png}{An image printed by a script, with the text carrying on underneath.}
 
 \section{Find}
 
@@ -168,7 +197,8 @@ Click the \iFolder{} on an SSH tab. Or drop a file onto the terminal and choose
 \section{The SFTP browser}
 
 Click the \iFolder{} folder icon on an SSH tab, \menu{Session\then SFTP browser}, or type ``sftp'' in the palette.
-It opens in the side dock next to your terminal.
+It opens in the side dock next to your terminal, in the folder your shell is in if the shell reports it
+(fish does; bash and zsh need a one-line hook, see the user manual).
 
 \shot{sftp.png}{Browsing the server's files next to the terminal.}
 

docs/guide/chapters/part4-safe.tex

@@ -72,6 +72,12 @@ Every password, passphrase, token or TOTP secret has its own setting:
 When Nexus Terminal needs a secret it doesn't have, it asks. Press \kbd{Esc} or \ui{Cancel} to give up on that
 connection.
 
+\section{Seeing and changing what's saved}
+
+\ui{Stored credentials} on the Security page lists every saved password, passphrase and token by profile, and whether
+it's in the keychain or the vault. \ui{Forget} deletes one. \ui{Change Master Password…} re-encrypts the whole vault
+under a new password in one go.
+
 \begin{sidequest}[What gets written down?]
 Connections, disconnections, profile changes, credential access, imports and exports go into an audit log in the
 database. Secrets themselves never do. TOTP secrets live in the keychain or vault too, never in the profile.
@@ -82,7 +88,7 @@ database. Secrets themselves never do. TOTP secrets live in the keychain or vaul
 \chapmeta{3 minutes}{You'll understand the scary fingerprint dialog and what to do about it}
 
 \begin{tldr}
-Every SSH server has a fingerprint. Nexus Terminal remembers it the first time and shouts if it ever changes.
+Every SSH server (and every RDP server, via its certificate) has a fingerprint. Nexus Terminal remembers it the first time and shouts if it ever changes.
 A changed fingerprint means a reinstalled server, or someone in the middle. Find out which before carrying on.
 \end{tldr}
 
@@ -92,20 +98,30 @@ Pick a policy per SSH profile under \ui{Host Verification}:
 \begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{48mm}X@{}}
   \toprule
   Strict (known hosts only)   & Only connects to servers you've already trusted.\\
-  Ask on new or changed keys  & Shows the fingerprint and asks. \ui{Accept \& Save} or \ui{Reject}. The default.\\
+  Ask on new or changed keys  & Shows the fingerprint and asks. New: \ui{Accept \& Save} or \ui{Reject}. Changed:
+                                \ui{Reject}, \ui{Accept Once} or \ui{Accept \& Update}. The default.\\
   Accept new, reject changed  & Trusts first-time servers silently, still refuses changed keys.\\
   Insecure (accept anything)  & Exactly what it says. Lab use only.\\
   \bottomrule
 \end{tabularx}
 
-Under every policy except \emph{Insecure}, a key that differs from the saved one is rejected.
+Under \emph{Strict} and \emph{Accept new}, a key that differs from the saved one is rejected outright.
 
 \crop{settings-knownhosts.png}{581}{253}{576}{285}{0.8\linewidth}{Known hosts. Click a fingerprint to copy it; \ui{Remove} to forget a server.}
 
-\begin{headsup}
+\begin{quickwin}
-Nexus Terminal keeps its own list of known hosts. It doesn't read \code{\textasciitilde/.ssh/known\_hosts}, so the
+Nexus Terminal keeps its own list, but \ui{Import \textasciitilde/.ssh/known\_hosts} brings in everything your
-first connection to each server asks once, even if your command-line \code{ssh} already knows it.
+command-line \code{ssh} already trusts (hashed names can't be read back, so those are skipped). \ui{Export…} goes the
-\end{headsup}
+other way, in OpenSSH format.
+\end{quickwin}
+
+\section{Certificate authorities}
+
+Big estates sign host keys with an SSH certificate authority instead of handing out fingerprints. \ui{Trust a CA…}
+adds the CA's public key for a host pattern in OpenSSH style (\code{*.corp.example}, \code{[jump.example]:2222},
+\code{!old.corp.example}); \code{@cert-authority} lines in an imported \code{known\_hosts} do the same. A server the CA
+covers must then show a certificate the CA signed, naming that host and in date. It's trusted without a prompt, and
+anything else is refused.
 
 % =========================================================================================
 \chapter{SSH keys}\label{ch:keys}
@@ -118,6 +134,6 @@ public key to the clipboard (ready to paste into GitHub or \code{authorized\_key
 \crop{keys.png}{725}{523}{725}{546}{0.75\linewidth}{The SSH key manager.}
 
 \begin{protip}
-Not sure which type? Pick Ed25519. It's small, fast and secure. Key generation uses your system's
+Not sure which type? Pick Ed25519. It's small, fast and secure. Keys are generated inside Nexus Terminal and
-\code{ssh-keygen}, which comes with macOS, Linux and Windows 10 and later.
+saved in the usual OpenSSH format, so \code{ssh} and \code{git} can use them too.
 \end{protip}

docs/guide/chapters/part5-yours.tex

@@ -1,5 +1,5 @@
 \guidepart{pink}{Make it yours}{Make it yours}
-  {Settings, backups, and moving in from Alchementary Link.}
+  {Settings, backups, and keeping several computers in step.}
   {\partitem{\iGear}{Settings}
    \partitem{\iUpload}{Import and export}
    \partitem{\iPlane}{Moving house}}
@@ -14,18 +14,24 @@ then click \ui{Save}.
 \begin{center}\begin{minipage}[t]{0.49\linewidth}\crop{settings-general.png}{581}{253}{576}{285}{\linewidth}{General}\end{minipage}\hfill\begin{minipage}[t]{0.49\linewidth}\crop{settings-terminal.png}{581}{253}{576}{285}{\linewidth}{Terminal}\end{minipage}\end{center}
 
 \begin{description}
-  \item[General] App theme (Pro, Midnight, Light), default protocol for new profiles, whether to ask before closing or
+  \item[General] App theme (Pro, Midnight, Light), default protocol for new profiles, \ui{Restore tabs at launch}
-        disconnecting, status bar on or off, sidebar width, and the local shell (leave it empty for the system default,
+        (saved connections reconnect, local shells reopen in the folder they were in), whether to ask before closing or
-        or \ui{Browse…} for one).
+        disconnecting, whether remote programs may write to your clipboard, a confirmation before pasting several lines,
+        the update check, status bar, sidebar width, and the local shell (empty for the system default, or
+        \ui{Browse…}).
   \item[Terminal] Colour scheme, font, size, scrollback and cursor style. These are the defaults for new profiles;
         each profile can override them.
-  \item[Security] Keychain and vault status; set up, unlock or lock the vault.
+  \item[Security] Keychain and vault status; set up, unlock or lock the vault; change the master password; your
-  \item[Known Hosts] Saved server fingerprints, with first-seen and last-seen times.
+        stored credentials; profile sync.
+  \item[Known Hosts] Saved server fingerprints, with first-seen and last-seen times; import and export
+        \code{known\_hosts}; trusted SSH certificate authorities.
+  \item[Diagnostics] Version, platform, where your data and log live, and the state of the keychain, vault and sync.
+        \ui{Copy Diagnostics} for bug reports (never includes credentials).
   \item[Help] Built-in help: connection types, shortcuts and troubleshooting, when this guide isn't to hand.
   \item[About] Version, \ui{Check for Updates} and \ui{Import \textasciitilde/.ssh/config}.
 \end{description}
 
-\crop{settings-help.png}{581}{253}{576}{285}{0.8\linewidth}{The built-in help, for when this guide isn't to hand.}
+\crop{settings-diagnostics.png}{604}{600}{604}{20}{0.8\linewidth}{Diagnostics: everything a bug report needs, nothing secret.}
 
 \section{Updates}
 
@@ -44,48 +50,57 @@ reads it back. Already have an \code{\textasciitilde/.ssh/config}? Import that t
 \begin{description}
   \item[Encrypted export] Choose the profiles, set a password, save a \code{.nexus} file. Saved passwords aren't
         included, so the file is safe to email to yourself.
-  \item[Encrypted import] Pick a \code{.nexus} (or an old \code{.link}) file, enter its password and decide what happens to
+  \item[Encrypted import] Pick a \code{.nexus} file, enter its password and decide what happens to
         profiles that already exist: \ui{Skip existing}, \ui{Overwrite existing} or \ui{Create duplicates}.
   \item[JSON] \ui{Export Profiles (JSON)} and \ui{Import Profiles (JSON)} are in the palette. Tick
-        \ui{Include secrets} to keep proxy passwords and TOTP secrets, which are otherwise left out.
+        \ui{Include secrets} to keep passwords typed by login scripts, which are otherwise blanked. Proxy passwords and
+        TOTP secrets live in the keychain or vault, so no export carries them.
   \item[OpenSSH config] \menu{File\then Import \textasciitilde/.ssh/config} turns your \code{Host} blocks into profiles,
         with host names, users, ports, identity files and jump hosts.
 \end{description}
 
-\crop{export.png}{894}{357}{872}{380}{0.55\linewidth}{Exporting profiles. Everything's ticked to start with; untick what you don't want.}
+\crop{export.png}{906}{388}{904}{390}{0.55\linewidth}{Exporting profiles. Everything's ticked to start with; untick what you don't want.}
 
 \begin{danger}[JSON with secrets is not encrypted]
-A JSON export with \ui{Include secrets} ticked has those secrets in plain text. Use the encrypted \code{.nexus} export to
+A JSON export with \ui{Include secrets} ticked has those login-script passwords in plain text. Use the encrypted \code{.nexus} export to
 move things between machines.
 \end{danger}
 
 % =========================================================================================
 \chapter{Moving house}\label{ch:move}
-\chapmeta{2 minutes}{You'll know what came over from Alchementary Link and what didn't}
+\chapmeta{3 minutes}{Your connections will follow you from laptop to desktop to work machine}
 
 \begin{tldr}
-It's automatic. First run copies your Alchementary Link profiles, vault and recordings. Your old folder is left
+Pick a folder every machine can see, set the same sync password on each, done. Profiles stay in step; passwords
-alone. Recreate trigger rules and SFTP bookmarks by hand.
+stay put on each machine.
 \end{tldr}
 
-When Nexus Terminal starts for the first time and finds an \code{AlchementaryLink} folder next to where its own data
+\section{Profile sync}
-goes, it \emph{copies} \code{link.db} to \code{nexus.db}, along with the \code{vault/} and \code{recordings/} folders,
+
-and shows a toast saying where they came from.
+\menu{Settings\then Security\then Profile sync}. \ui{Choose…} a folder your machines share (Dropbox, iCloud Drive,
+OneDrive, Nextcloud, a network share, or a git checkout you commit) and set the same \ui{Sync password} everywhere.
+Nexus Terminal keeps one encrypted file there, \code{nexus-profiles.nexus}, and merges it at launch, a few seconds
+after you change a profile, every ten minutes and whenever you click \ui{Sync Now}.
 
 \begin{checklist}
-  \item[\color{green}\iCheck] Profiles, groups, favourites, known hosts, snippets and preferences
+  \item[\color{green}\iCheck] Edited on two machines? The newer change wins, profile by profile.
-  \item[\color{green}\iCheck] Vault (same master password as before)
+  \item[\color{green}\iCheck] Deleted on one machine? It goes from the others too (unless someone edited it afterwards).
-  \item[\color{green}\iCheck] Recordings
+  \item[\color{rose}\ph{E4F6}] Passwords, keys and tokens never sync. Each machine keeps its own in its keychain or vault.
-  \item[\color{green}\iCheck] Keychain passwords: picked up the first time each one is needed, then copied across
-  \item[\color{green}\iCheck] Old \code{.link} export files still import
-  \item[\color{rose}\ph{E4F6}] Trigger rules and SFTP bookmarks (they lived in the old app's web storage)
 \end{checklist}
 
+\crop{settings-security.png}{581}{253}{576}{285}{0.8\linewidth}{Profile sync lives on the Security page, under your stored credentials.}
+
 \begin{headsup}
-If a \code{NexusTerminal/nexus.db} already exists (say, from before the Alchementary Link rebrand), it's used as it is
+Lose the sync password and the sync file can't be read, just like an encrypted export. Your local profiles are
-and nothing is copied.
+fine.
 \end{headsup}
 
+\section{One-off moves}
+
+Not worth setting up sync? \menu{File\then Export profiles…} on the old machine, \menu{File\then Import profiles…}
+on the new one (see \hyperref[ch:transfer]{Import and export}). Known hosts travel the same way through
+\ui{Export…} and \ui{Import} on the Known Hosts page.
+
 \section{Where everything lives}
 
 \renewcommand\arraystretch{1.45}
@@ -98,7 +113,8 @@ and nothing is copied.
 \end{tabularx}
 
 Inside: \code{nexus.db} (profiles, known hosts, preferences, snippets, IRC state and the audit log),
-\code{vault/vault.json}, \code{recordings/}, \code{triggers.json} and \code{sftp-bookmarks.json}. Keychain entries are
+\code{vault/vault.json}, \code{recordings/}, \code{triggers.json}, \code{sftp-bookmarks.json} and \code{nexus.log}, the
+diagnostic log. Keychain entries are
 stored under the service name \code{NexusTerminal}.
 
 \begin{protip}[Try things without touching your real data]

docs/guide/chapters/part6-fix.tex

@@ -25,7 +25,8 @@ password, or the baud rate.
 \fix{``Host key verification failed''}{%
 The server's fingerprint changed since you last connected. That happens when a server is rebuilt, but it's also exactly
 what an attack looks like. \textbf{Check with whoever runs the server.} If it's legitimate:
-\menu{Settings\then Known Hosts}, \ui{Remove} the entry, reconnect and accept the new key.}
+choose \ui{Accept \& Update} in the warning (or \ui{Accept Once} to defer the decision). Under a Strict or Accept-new
+policy there's no prompt: \menu{Settings\then Known Hosts}, \ui{Remove} the entry and reconnect.}
 
 \fix{It just says ``Connecting…'' forever}{%
 \begin{itemize}
@@ -61,6 +62,15 @@ Check the network and the credentials, then the profile's auto-reconnect setting
   \item Connecting to a Mac? Turn on password access in macOS Screen Sharing settings (see p.\,\pageref{ch:vnc}).
 \end{itemize}}
 
+\fix{RDP won't connect}{%
+\begin{itemize}
+  \item Linux box running xrdp? Tick \ui{Allow servers without NLA}.
+  \item ``Logon failed''? Check the domain. Kerberos users: the KDC must be reachable directly, not through the proxy.
+  \item Certificate warning after a server rebuild? That's expected once; compare the fingerprint, then
+        \ui{Accept \& Update}.
+  \item Going through an RD Gateway? It needs a certificate from a public CA and Basic authentication over HTTPS.
+\end{itemize}}
+
 \section{Files}
 
 \fix{Upload is greyed out or fails}{%
@@ -86,3 +96,11 @@ normally.}
 Start Nexus Terminal with \code{--data-dir} pointing at an empty folder and try the same connection there. If it
 works, something in your profile is off; duplicate the working one and compare.
 \end{quickwin}
+
+\section{Still stuck?}
+
+\fix{Something odd that isn't on this list}{%
+Look at \code{nexus.log} in your data folder (\menu{Settings\then Diagnostics} shows where): connections, reconnects,
+host-key checks and errors, never passwords or what's on screen. Start Nexus Terminal with \code{RUST\_LOG=debug} for
+more detail. Reporting a bug? \ui{Copy Diagnostics} and paste it in.}
+

docs/guide/nexus-guide.sty

@@ -194,7 +194,7 @@
     before skip=6pt, after skip=12pt, fontupper=\small,
     overlay={\node[anchor=north east, font=\heavy\tiny, text=#1!80!black, inner sep=8pt] at (frame.north east) {AT A GLANCE};}]
   {\heavy\Large\color{#1!85!black}#2}\par\vspace{4pt}
-  \renewcommand\arraystretch{1.35}\begin{tabular}{@{}>{\leavevmode\color{muted}}p{0.24\linewidth}p{0.72\linewidth}@{}}}
+  \renewcommand\arraystretch{1.35}\begin{tabular}{@{}>{\leavevmode\color{muted}}p{0.24\linewidth}>{\leavevmode}p{0.72\linewidth}@{}}}
   {\end{tabular}\end{tcolorbox}}
 
 % --- Headings --------------------------------------------------------------------------

docs/guide/nexus-guide.tex

@@ -3,7 +3,7 @@
 \usepackage{nexus-guide}
 
 \hypersetup{pdftitle={Nexus Terminal: The User Guide}, pdfauthor={Andy Dixon},
-  pdfsubject={SSH, Telnet, RAW, Serial, VNC, IRC and GitHub in one native app}}
+  pdfsubject={SSH, Telnet, RAW, Serial, VNC, RDP, IRC and GitHub in one native app}}
 
 \begin{document}
 \frontmatter
@@ -29,13 +29,13 @@
     {Every terminal you need. One window.\\Zero faff.};
   \node[anchor=north west, text=white!65!ink, font=\normalsize, text width=150mm]
     at ([xshift=22mm, yshift=-110mm]pg.north west)
-    {SSH\enspace·\enspace Telnet\enspace·\enspace RAW TCP\enspace·\enspace Serial\enspace·\enspace VNC\enspace·\enspace IRC\enspace·\enspace GitHub\enspace·\enspace Local shells};
+    {SSH\enspace·\enspace Telnet\enspace·\enspace RAW TCP\enspace·\enspace Serial\enspace·\enspace VNC\enspace·\enspace RDP\enspace·\enspace IRC\enspace·\enspace GitHub\enspace·\enspace Local shells};
   \node[anchor=south west, inner sep=0pt] at ([xshift=22mm, yshift=22mm]pg.south west)
     {\begin{tikzpicture}
       \node[inner sep=0pt, draw=white!25!ink, line width=0.6pt, rounded corners=4pt] {\includegraphics[width=166mm]{img/ssh.png}};
     \end{tikzpicture}};
   \node[anchor=south east, text=white!55!ink, font=\footnotesize, align=right]
-    at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 0.1\\October 2026\\dixon.cx};
+    at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 3.0.1\\October 2026\\dixon.cx};
 }\null
 \cleardoublepage
 
@@ -61,7 +61,7 @@ what you'll be able to do afterwards, and a \textbf{TL;DR} if you only want the
   …copy files to and from a server & \hyperref[ch:files]{Files}, p.\,\pageref{ch:files}\\
   …type the same thing into ten servers at once & \hyperref[ch:repeat]{Never type it twice}, p.\,\pageref{ch:repeat}\\
   …keep my passwords safe & \hyperref[ch:secrets]{Passwords \& the vault}, p.\,\pageref{ch:secrets}\\
-  …move over from Alchementary Link & \hyperref[ch:move]{Moving house}, p.\,\pageref{ch:move}\\
+  …keep two computers in step & \hyperref[ch:move]{Moving house}, p.\,\pageref{ch:move}\\
   …fix something that's broken & \hyperref[part:fix]{When things go wrong}, p.\,\pageref{ch:trouble}\\
   …just see the keyboard shortcuts & \hyperref[app:keys]{The cheat sheet}, p.\,\pageref{app:keys}\\
   \bottomrule

docs/guide/tools/screenshots.sh

@@ -90,9 +90,10 @@ shot editor-serial    --open editor:serial
 shot editor-telnet    --open editor:telnet
 shot editor-raw       --open editor:raw
 shot editor-vnc       --open editor:vnc
+shot editor-rdp       --open editor:rdp
 shot editor-irc       --open editor:irc
 shot editor-github    --open editor:github
-for t in general terminal security knownhosts help about; do shot "settings-$t" --open "settings:$t"; done
+for t in general terminal security knownhosts diagnostics help about; do shot "settings-$t" --open "settings:$t"; done
 shot keys             --open keys
 shot snippets         --open snippets
 shot triggers         --open triggers

rust/Cargo.lock

@@ -3710,7 +3710,7 @@ dependencies = [
 
 [[package]]
 name = "nexus"
-version = "0.1.0"
+version = "3.0.1"
 dependencies = [
  "alacritty_terminal",
  "arboard",
@@ -3735,7 +3735,7 @@ dependencies = [
 
 [[package]]
 name = "nexus-core"
-version = "0.1.0"
+version = "3.0.1"
 dependencies = [
  "aes-gcm 0.10.3",
  "argon2 0.5.3",

rust/Cargo.toml

@@ -4,7 +4,7 @@ members = ["core", "app"]
 exclude = ["fuzz"]
 
 [workspace.package]
-version = "0.1.0"
+version = "3.0.1"
 edition = "2024"
 
 [profile.dev.package."*"]

rust/app/src/tabs.rs

@@ -51,7 +51,7 @@ fn empty_state(app: &mut App, ui: &mut Ui) {
         ui.vertical_centered(|ui| {
             ui.add(egui::Image::new(&crate::chrome::logo(ui.ctx())).fit_to_exact_size(vec2(84.0, 84.0)));
             ui.label(RichText::new("Nexus Terminal").font(theme::semibold(28.0)));
-            ui.label(RichText::new("SSH · Telnet · RAW · Serial · VNC · IRC · GitHub").color(t.text_dim));
+            ui.label(RichText::new("SSH · Telnet · RAW · Serial · VNC · RDP · IRC · GitHub").color(t.text_dim));
             ui.add_space(18.0);
             ui.horizontal(|ui| {
                 ui.add_space((ui.available_width() - 330.0).max(0.0) / 2.0);

rust/core/examples/demo_data.rs

@@ -105,6 +105,10 @@ fn main() {
     vnc.vnc.as_mut().unwrap().vnc_port = 42900;
     vnc.vnc.as_mut().unwrap().scale_to_fit = true;
     profiles.push(vnc);
+    let mut rdp = mk(Protocol::Rdp, "Design workstation", "192.0.2.60", 0, "Home", false);
+    rdp.username = "andy".into();
+    rdp.rdp.as_mut().unwrap().domain = "STUDIO".into();
+    profiles.push(rdp);
 
     for p in profiles {
         svc.create_profile(p).unwrap();