Fixes two high-severity DoS vulnerabilities in x/crypto/ssh
(GO-2026-6354, GO-2026-6355) reachable via the SSH and VNC clients,
flagged by GitHub Dependabot. Requires bumping the go.mod go
directive to 1.26.0.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n
Renames the product across the codebase: Go module path, config/data
paths, keychain service name, export file extension, build tooling,
docs, and UI text. Sidebar brand mark now reads ">_ AlchementaryLink"
with "Alchementary" in the connection-group gold accent colour, and
the window title is "Alchementary Link".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n
Nexus terminal:
- Fix CSP that silently blocked the inline <style>, so the terminal now
fills 100% of the tab; theme xterm from VSCode colour variables and use
the editor/terminal monospace font.
- Re-fit via ResizeObserver/visibility/font-load and re-send geometry once
the session is connected, so the remote PTY no longer stays at 80x24.
- Remove the floating SFTP icon; SFTP now opens in the user's home folder
(retry SFTPPwd instead of falling back to /).
Both extensions:
- Polish panels to VSCode design standards (themed buttons, focus rings,
primary actions); redraw the activity-bar logos.
- chmod +x the bridge on activation (VSIX extraction may drop the exec bit).
Packaging:
- Stop tracking the per-host bridge binary (committed a macOS arm64 build
that broke Linux/Windows); ignore vscode/bin, vscode/dist, vscode/*/bin.
- Add package-all.sh to cross-compile the pure-Go bridge and produce one
platform-specific VSIX per target (win32/darwin/linux x64+arm64), with an
opt-in macOS codesign + notarization hook.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Andy Dixon
Andy Dixon
andyandClaude Opus 4.8